A five-second check of any WordPress site's front door.

What the site leaks, whether its pages are really cached, how fast it answers, and what to fix first. Public fetches only, as a visitor would make them. Nothing is stored.

Try wordpress.org or woocommerce.com.

What it looks at

What it leaks

the WordPress version in the page or readme.html, account names through the REST API, XML-RPC

Headers

HTTPS and HSTS, nosniff, framing protection, referrer policy, a content security policy

Caching

whether this request came from a page cache or CDN, the Cache-Control policy, time to first byte, redirect hops

Page weight

document size, scripts in the head, stylesheets, images without dimensions, third-party hosts

Footprint

the theme and the plugins that load assets on the page

Everything is read from the responses a browser would get. The check never logs in, never guesses passwords and never posts anything. There is also a JSON endpoint: /api/check?url=…