merekaman.vercel.app
Scanned:
Score by axis
- Security30
- SEO30
- Reputation100
Want one of these looked at properly?
This scan is broad and passive — it reads what your site shows everyone, across all five areas. A deep audit takes one of those areas and goes all the way down on your site specifically.
No email, no sign-up. Pick the one you care about.
Watch this site's security
We'll email you if its security slips: a new vulnerability, an expiring certificate, a blacklisting. No account needed.
Security alerts only. Nothing else, and no email unless something is wrong. Unsubscribe anytime.
Want more than security alerts?
Coming soonMonitor: daily re-scans across all five axes, instant alerts on new and cert expiry, Telegram & web push, and full history.
Fix what matters first
- 1Core Web Vitals (PageSpeed)+20
Improve Core Web Vitals — see the PageSpeed Insights report for specifics.
- 2SPF email anti-spoofing+12
Add an TXT record (v=spf1 …) so others can't spoof email from your domain.
- 3DMARC email anti-spoofing+12
Add a TXT record at _dmarc (v=DMARC1; p=…) to control spoofed-email handling.
- 4robots.txt+7
Add a robots.txt to guide crawlers.
- 5XML sitemap+7
Publish a sitemap.xml and reference it from robots.txt.
Recommendations are ranked by their impact on your score.
All checks
Security
30/ 100- N/A
HTTPS & HTTP→HTTPS redirect
The page could not be fetched.
- N/A
TLS certificate validity
The page could not be fetched.
- N/A
HSTS (Strict-Transport-Security)
The page could not be fetched.
- N/A
Content-Security-Policy
The page could not be fetched.
- N/A
Core security headers
The page could not be fetched.
- N/A
Mixed content (HTTP on HTTPS)
The page could not be fetched.
- Warn
SPF email anti-spoofing
No record
Add an TXT record (v=spf1 …) so others can't spoof email from your domain.
- Warn
DMARC email anti-spoofing
No record
Add a TXT record at _dmarc (v=DMARC1; p=…) to control spoofed-email handling.
- N/A
Vulnerable front-end libraries
The page could not be fetched.
- N/A
CMS known vulnerabilities
The page could not be fetched.
Performance
0/ 100- N/A
Time to First Byte
The page could not be fetched.
- N/A
Text compression
The page could not be fetched.
- N/A
HTTP/2 or HTTP/3
The page could not be fetched.
- N/A
Cache-Control
The page could not be fetched.
- Fail
Core Web Vitals (PageSpeed)
perf 62/100, 8.6 s, 0.00 (lab)
Good: 2.5 s or less
Improve Core Web Vitals — see the PageSpeed Insights report for specifics.
SEO
30/ 100- N/A
Page title
The page could not be fetched.
- N/A
Meta description
The page could not be fetched.
- N/A
Canonical URL
The page could not be fetched.
- Warn
robots.txt
No robots.txt found
Add a robots.txt to guide crawlers.
- Warn
XML sitemap
No sitemap found
Publish a sitemap.xml and reference it from robots.txt.
- N/A
Single H1
The page could not be fetched.
- N/A
Image alt text
The page could not be fetched.
- N/A
Structured data (JSON-LD)
The page could not be fetched.
2 SEO problems on this page. What about the rest of the site?
That is one page, checked from the outside. The faults that cost the most traffic only show up across a whole site — pages sharing a title, sections nothing links to, canonicals pointing at URLs that are gone.
A full audit crawls up to 100 pages and checks
- Indexability and crawling
- On-page and content
- Technical
- Structured data and social previews
- Links
- Site-wide configuration
Free while in beta ($19 after launch). No domain verification — we only read pages your site already shows everyone.
Infrastructure
30/ 100- N/A
CMS detection
The page could not be fetched.
- N/A
Web server
The page could not be fetched.
- N/A
CDN detection
The page could not be fetched.
- N/A
TLS version
The page could not be fetched.
- Warn
IPv6 (AAAA record)
No AAAA record
Add an AAAA record to serve visitors over IPv6.
Reputation
100/ 100- Pass
Google Safe Browsing
Not flagged
checked: Google Safe Browsing - Pass
Domain blacklist status
Not on major blocklists
checked: Spamhaus DBL, SURBL - Pass
Domain age
Registered ~6 years ago
2020-01-28Good: 90 days or more since registration
- Pass
Domain expiry
Expires in 3412 days
2036-01-28Good: 30 days or more to expiry
Want one of these looked at properly?
This scan is broad and passive — it reads what your site shows everyone, across all five areas. A deep audit takes one of those areas and goes all the way down on your site specifically.
No email, no sign-up. Pick the one you care about.
Go deeper
This scan is passive. An attacker won't be.
The free scan reads what your site shows everyone. A Deep Audit does what an attacker does: it actively probes your verified site for what's really exposed.
This free scan (passive)
- Security score
- Known-CVE counts
- Security headers
- TLS & certificate
- Blacklist & Safe Browsing
Deep Audit: active scan of your verified site
- Per-CVE breakdown: IDs, severity, exploit availability, fix version
- Exposed files (.git, .env, backups)
- Directory listing
- Open admin panels
- Open ports
- Subdomain exposure
- Prioritized fix plan
- Full PDF report
What we can't check without your permission
These need active probing of your site: exposed .git/.env/backups, open admin panels, open ports, forgotten subdomains. Verify your domain and we'll show you what an attacker would find.
How it works
- Verify your domain: a file or DNS record, about 2 minutes.
- We actively scan it: a few minutes; we email you when it's ready.
- Get your full report + PDF.
The deep scan is live and free while we're in beta. Verify your domain and run it now.
Active checks run only on a domain you've verified as yours, with your consent. We detect, never exploit. Free in beta; $39 one-time after launch, no subscription, and early adopters keep the deep scan free.
Run a free deep scan