Free · one page per organisation · replied to within two working days
Send me one page of your site. I will read it properly.
Give me one public URL from your own site and a work email at the same domain. Within two working days I will reply with one of two things: a specific problem I verified myself, with the exact steps to reproduce it in your own browser; or an honest account of what I checked, what I found clean, and what I could not check from outside. One page, one reply, no sequence, nothing stored beyond the correspondence itself. If I find nothing worth your money, I will say that, and the clean answer is the deliverable, not a consolation.
This is the same method the findings on the homepage come from, applied from outside. Those findings needed the inside of a paid engagement: account access, the physical labels, permission to test a form. A one-page read from the outside cannot see that far, which is exactly why the reply always lists what I could not check. It is free because one page is small and because the finding belongs to you either way. It is limited to one page per organisation because I read every submission myself, and that is the whole point.
What I check
- The served markup of that one page, as any visitor’s browser receives it.
- Its forms: read, never submitted. Nothing ever enters your systems.
- Its outbound links and HTTP headers.
- The domain’s public email-authentication records (SPF, DKIM, DMARC).
Read-only, GET requests only, under the same published conduct standard as my scanner. Nothing is logged in, nothing is probed, nothing non-public is touched.
What you get back
One reply, half a screen, in a fixed shape:
- Checked: the list above, itemised.
- Found: either a finding with its reproduction path, or “nothing I could verify”.
- Could not check from outside: the list. This line is never omitted, because an absent check reported as a clean result is the exact failure the check exists to prevent.
- Severity ceiling: anything found is described at most as “worth checking”. Frightening you into a purchase is not a business I want.
How to ask
There is a short form on the home page: your name, a work email address and the page you want read. It runs no JavaScript, sets no cookie and calls no third party; the submission is delivered to me as an ordinary email and stays as ordinary correspondence. If you would rather write directly, that works just as well:
- Send one public URL from your own site, from a work email address at the same domain.
- If the email domain and the page domain differ, I will ask you to place a one-line meta tag on the page temporarily, so this service cannot be used to probe a competitor’s site.
- I reply within two working days, to that address only.
One page per organisation, ever, tracked by hand in a private list. Repeat requesters get the honest sentence: you have had your page; the next step is the Sprint. Your URL and address are used to reply and nothing else; see the privacy notice.
The queue, stated plainly
This is a manual process and I am not going to dress it as anything else. Submissions are answered in order. As of 2 August 2026 the queue is empty; the next reply goes out within two working days. I update that line by hand. If the queue ever exceeds what two working days can honour, this page closes with the date it reopens, because a closed door with an honest date beats an open one with a slow reply.
How I avoid being wrong
Every reply is re-verified by hand, in a browser, immediately before it is sent. I learned why that matters the expensive way. The first time my scanner’s output was trusted at face value it produced three findings, and on hand re-verification all three were wrong: a DMARC record that did reproduce after all, a Cloudflare email-obfuscation endpoint misread as a broken link, and an uninterpolated JavaScript template literal misread as a broken link. The re-check caught all three before they reached a stranger, and the full account is on the scanner page. The check, not the tool, is the product. That is true of this free page and it is true of everything I sell.