HTTP response inspection
- Status code, status text, and HTTP protocol version reported by the origin.
- Response time, content type, content length, and content encoding.
- Server, X-Powered-By, and CDN edge identifiers (when exposed).
Metadata analysis
- Title, description, viewport, charset, theme-color, and language declarations.
- Open Graph and Twitter Card metadata for social sharing fidelity.
- JSON-LD structured data presence and basic shape validation.
robots.txt
- Fetched from /robots.txt over HTTPS.
- User-agent and Disallow / Allow / Crawl-delay rules are reported as-is.
- Sitemap references are extracted for downstream discovery.
Sitemap discovery
Sitemap URLs are discovered from robots.txt, well-known paths (/sitemap.xml, /sitemap_index.xml), and link relations. Discovered sitemaps are parsed for URL counts and last-modified hints only.
Headers and security posture
- Standard response headers reported verbatim.
- Security headers scored against the OWASP Secure Headers project.
- Cookie attributes (Secure, HttpOnly, SameSite) surfaced for review.
Redirects and canonicals
- Redirect chains followed and surfaced to a configurable depth.
- Final URL, intermediate hops, and redirect status codes are reported.
- Canonical link rel="canonical" values extracted and compared against the requested URL.
Last reviewed: June 2026.