Is it ready to launch?
Paste the address. In about two minutes you get a grade from A+ to F, the problems worth fixing first, worst first, and a copy-paste fix for each, written for where your site runs: Next.js, Vercel, Netlify, Cloudflare, Supabase. Made for sites built quickly with AI tools, and fine for any other.
What it reads, for any address
Only what a visitor’s browser would fetch, plus public records. Two requests at a time, a two-minute limit, and our name on every request (our checker).
| Security | HTTPS and the redirect to it, HSTS, Content-Security-Policy, framing, cookies, CORS on your APIs, mixed content, version leaks, security.txt. |
|---|---|
| SPF, DMARC and CAA on your domain, so nobody can send mail as you. | |
| Speed | Time to first byte, page weight, files sent uncompressed or without a cache time, oversized images, scripts that block the page. |
| Hidden instructions for AI | Text on your pages that a person can't see but an AI assistant reading the page would obey. |
| What it depends on | The hosts your page loads from, and the status pages of the services behind it. |
And once you’ve shown it’s yours
A TXT record on your domain unlocks the parts that read your own code. Without it, the report tells you what it skipped.
| Keys in your code | Key-like strings in the JavaScript your pages load, told apart by type: a Supabase service key or a Stripe secret key is serious, a publishable key is fine. Never used, never stored, never shown in full. |
|---|---|
| Source maps | Scripts that point at their own source code. |
| Missing pages | Whether an address that doesn't exist answers 404, as it should. |
Then keep watching
Every page, API and backend the check found comes back as a ready-made monitor. Tick the ones you want.
From your AI coding tool
Ask it to run the go-live check through OpenPing’s MCP server before it says it’s done.
What it never does
No sign-in attempts, no guessing of paths, no forms, no load. It reads; it never writes.
Get early access