Skip to content
SEO Optimizer is live, Audit on page SEO and AI-search readiness. Try it free
Scanverra
Sign in

6 tools · 1 plan · Free

Find what's broken
before you ship.

Six tools check your live site and the code behind it: speed, SEO, accessibility, security, real-browser errors and risky code. Each one writes the fix for your stack, and one subscription covers them all.

No sign-up for website audits · Free plan, no card · 5 free scans a month on each advanced tool

See a sample report
example.com
Audit Scores
DesktopvsMobile
Performance
Needs Work
Desktop
0D
Mobile
0A
Speed & load time+41
SEO
Good
Desktop
0A
Mobile
0A
Search visibility
Accessibility
Good
Desktop
0A
Mobile
0A
WCAG compliance+1
Best Practices
Needs Work
Desktop
0C
Mobile
0A
Web standards+22

Agentic Browsing

AI accessibility · llms.txt · structured data · robots.txt

0A

Detects your stack and writes fixes for it: 35+ frameworks and platforms

Next.jsReactWordPressShopifyWebflowWixVue.jsAngularFramerGhostNuxt
  • Performance audits on desktop and mobile
  • @scanverra/cli on npm
  • SARIF for GitHub code scanning
  • Reports in 7 languages

The Scanverra toolkit

Six tools. One subscription.

Start with a free website audit. When you need to go deeper, the other five are already in your plan.

  1. 01 / 06

    Website Audit

    Checked by Gauge

    Your site's report card.

    Core Web Vitals (LCP, CLS, TBT), on-page SEO and accessibility on desktop and mobile, scored and explained, with the fix written for your stack. Free and unlimited.

    • Core Web Vitals
    • On-page SEO
    • Accessibility
    • Stack fixes
    Start freeLearn more
    example.com
    Audit Scores
    Performance
    Needs Work
    56D
    97A
    SEO
    Good
    100A
    100A
    Accessibility
    Good
    96A
    97A
    Best Practices
    Needs Work
    78C
    100A

    Agentic Browsing

    AI accessibility · llms.txt · structured data

    90A

  2. 02 / 06

    SEO Optimizer

    Checked by Beacon

    Get found in Google and quoted in AI answers.

    Titles, meta tags, canonical URLs and structured data, plus AI-search readiness, E-E-A-T trust signals and your real Search Console data for the page.

    • GEO
    • E-E-A-T
    • Search Console
    • JS Rendering
    Start freeLearn more
    scanverra.com/seo-optimizer
    88/ 100
    example.com/blog/best-hiking-boots

    Pass

    GEO ready

    Pass

    E-E-A-T

    Live

    Search Console

  3. 03 / 06

    Security Scan

    Checked by Warden

    See what an attacker can probe from outside.

    Security headers, TLS, cookies, mixed content, exposed files and secrets leaked in page scripts, ranked by severity with a fix for each.

    • Headers
    • Secrets
    • CSRF
    • Cookies
    Start freeLearn more
    example.com/security-scan
    82/ 100
    Security ScoreGood

    0

    Critical

    1

    High

    3

    Medium

    2

    Low

    AI assessment: Missing Content-Security-Policy header exposes the site to XSS. Cookie flags and HSTS are configured correctly.

    CSP missing Outdated TLS cipher Server header exposed

  4. 04 / 06

    Browser Audit

    Checked by Scout

    Load your site in a real browser and catch what breaks.

    Console errors, broken links, forms and images on desktop and mobile, with a filmstrip of the page loading.

    • Broken Links
    • Images
    • Forms
    • Web Vitals
    Start freeLearn more
    example.com/browser-test
    88A
    Browser HealthGood

    1.8s

    LCP

    0.02

    CLS

    180ms

    TBT

    Full page screenshot
    0 console errors 2 broken links Mobile pass complete

  5. 05 / 06

    Repo Scanner

    Checked by Patch

    Catch leaked keys and risky code before you ship.

    Secrets, vulnerable dependencies, unsafe patterns and risky AI-agent settings, from GitHub, Bitbucket, the CLI or VS Code.

    • GitHub
    • Bitbucket
    • SAST
    • CVE Scanning
    Start freeLearn more
    github.com/acme/storefront
    76B

    Fair · Repo Health

    Quality Gate: FAILED

    1

    Secrets

    4

    SAST

    2

    Dep CVEs

    SecurityQualityIaC
    Hardcoded AWS secret keyconfig/aws.ts:12
    SSRF via unvalidated fetch URLlib/proxy.ts:44
    AI fix ready · Open PR in one click

  6. 06 / 06

    Accessibility Extension

    Checked by Ally

    Find and fix WCAG issues inside Chrome.

    Scan any page you have open. Every issue shows its evidence, repeats are grouped by component, and you get fix code to paste.

    • WCAG 2.2
    • Fix code
    • Component grouping
    • Runs locally
    Get the extensionLearn more
    The Scanverra Accessibility side panel showing a page's accessibility score, issues by severity and the issues to fix first

Watch the 1-minute story

Meet Scanverra, your bug hunter

Watch one scan find the bugs hiding in a website, rank them, write the fix for your stack and prove it worked.

No sign-up. Results in about a minute.

Read the video transcript

Your website looks fine. But underneath, it's crawling with bugs. Meet Scanverra, the bug hunter for your website and your code. Paste your URL and the hunt begins. Speed, security, SEO and your stack, checked in about a minute. Every bug gets caught. Leaked keys, slow pages, missing tags. Your report ranks every bug by impact, so you know what to fix first. Each one comes with the fix, written for your stack. Copy it, or open a pull request. Then re-scan to verify, and watch your scores climb. Schedule scans to keep patrolling, with six tools for your site and your code. Find what's broken before you ship. Start your first hunt free. No sign-up needed.

AI security

Three problems defining AI security

AI agents now write, run and ship your code. The repo scanner checks for the new ways that goes wrong, alongside the secrets, SAST and dependency checks you already run.

Automated AI attacks

Attackers hide instructions in files your coding agents trust: rules files, CLAUDE.md, copilot-instructions.md. Invisible Unicode, injected prompts and exfiltration commands turn the agent against your own repo, at machine speed.

  • Hidden Unicode payloads, decoded
  • Prompt injection and concealment phrasing
  • Instructions that ship secrets off the machine

Untrusted agentic development

Agents run shell commands, launch MCP servers and commit code, often with approvals switched off. One auto-approve setting or unpinned MCP package is all a poisoned prompt needs to reach a laptop or a CI runner.

  • Auto-approve, bypass and YOLO settings
  • Unpinned and vulnerable MCP servers
  • LLM output reaching eval() or a shell

Ungoverned AI applications

Few teams can list the models, providers and MCP servers their code uses. Every scan builds that inventory and checks it against a policy file you commit, so an unapproved model fails the scan instead of surprising an auditor.

  • AI bill of materials on every scan
  • Allow and block lists in .scanverra/ai-policy.json
  • Mapped to OWASP LLM and Agentic Top 10
Scan a repo for AI risks

Also runs in the CLI and on every pull request.

For developers

Built into your workflow

Run the same checks from your terminal, CI pipeline, editor or your own scripts.

CLIScan any repo on any git host. Text, JSON or SARIF output.CI/CDA GitHub Action, or one step in any pipeline. Fail the build on real problems.VS CodeSee findings inline while you code.REST APITrigger any scan and read results from your own tooling.Chrome extensionCheck accessibility on any page you have open, with fix code.

Your code stays on your machine

The CLI downloads Scanverra's signed rules, scans locally and uploads only findings: file, line, rule and fix suggestion. File contents and secret values are never uploaded. The matched line of code is sent only if you add --include-code.

CLI quick startHow we handle your data

The Free plan includes 1 API key. Uploaded CLI scans count toward your monthly free Repo Scanner scans.

npx @scanverra/cli scan .
scanverra scan .
Scanverra CLI scan output: files scanned, score, and a severity breakdown

.github/workflows/scanverra.yml

on: [push, pull_request]
jobs:
  scanverra:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@v4
      - uses: scanverra/scan-action@v1
        with:
          api-key: ${{ secrets.SCANVERRA_API_KEY }}
          fail-on: high
Monitor and report

Keep it fixed after you ship

Scheduled scans, score-drop alerts, history, side-by-side comparisons and client-ready reports.

Compare

Side-by-side scan comparison

See every metric change across scans in one matrix

Performance
SEO
Security
Accessibility
Explore the audit tool

AI Chat

ExplainPrioritizeFix

Ask about any finding

Health Score

0
Performance
SEO
Security

Free instant website assessment

PDF Reports

  • Executive summary
  • Scores by category
  • Prioritized fixes
  • Code snippets
PDF

Client-ready audit reports

Score History

Track every release

Who it's for

Built for the people who ship the site

  • Developers and indie builders

    Scan your repo before you push and your site before you launch. Run the same checks in CI so problems fail the build, not production.

    Start with Repo Scanner

  • Agencies

    Audit a client site in about a minute and send a PDF report with the fixes written in. Schedule scans so you hear about a drop before the client does.

    Start with Website AuditHow agencies use Scanverra

  • Marketing and SEO teams

    Find what is holding rankings back, including how ready your pages are to be quoted in AI answers, and get an alert when a score drops.

    Start with SEO Optimizer

Pricing

One subscription. All six tools.

Website audits are free and unlimited. A free account adds 5 scans a month on each advanced tool. Pro makes all six tools unlimited.

Free

$0

Forever free, no card required

  • Unlimited website audits
  • 5 free scans a month on each advanced tool
  • AI-written fixes and AI chat
  • Shareable report links
  • Score history (last 5 scans)
  • 1 API key for the CLI
  • Accessibility Extension: 20 scans a month
Get started free

Pro

Most popular

All six tools included

$19/month

Billed monthly, cancel anytime

  • Everything in Free
  • Unlimited scans on all six tools, including the Chrome extension
  • Scheduled scans with score-drop alerts
  • Unlimited score history
  • More API keys for CI/CD
  • Support tickets
Get Pro

Frequently asked questions

All six tools: Website Audit, SEO Optimizer, Security Scan, Browser Audit, Repo Scanner (with the CLI and VS Code extension) and the Accessibility Extension for Chrome. The Free plan gives you unlimited website audits and 5 scans a month on each advanced tool. Pro, Team and Enterprise make every tool unlimited.

A website audit is an automated analysis of a site's performance, SEO, accessibility, and security. It measures how fast the page loads, whether it ranks well in search, whether it meets accessibility standards, and whether it has security vulnerabilities: then explains what to fix.

PageSpeed Insights gives you scores and a list of issues for one page. Scanverra also detects your tech stack and writes the fix for it, checks security headers and leaked secrets, crawls with a real browser, and scans the code behind the site for secrets and vulnerable dependencies.

No. Website audits run without an account. A free account (Google, GitHub or email) saves your reports, adds score history and AI chat on your results, and unlocks the free monthly scans on the other tools. Scheduled scans are part of Pro.

Not with the CLI. It downloads Scanverra's signed rules, scans on your machine and uploads only findings (file path, line, rule and fix suggestion). File contents and secret values stay local unless you pass --include-code. The web Repo Scanner is different: it reads your repository through GitHub or Bitbucket to scan it on our servers.

Only what is needed to explain and fix the findings. For a website audit, that is the scan results for a public page: issues, metrics and the detected stack. For code, it is the findings plus, on the web Repo Scanner, the flagged code snippets (and the file being changed when you open a fix pull request). CLI uploads contain no code unless you pass --include-code.

A website audit usually takes 30 to 90 seconds, because the page is loaded in a real browser at desktop and mobile sizes. Browser audits take about a minute depending on site size. Repo scans depend on repository size, and CLI scans usually finish in seconds.

Scanverra detects 35+ frameworks including Next.js, React, Vue, Angular, Svelte, WordPress, Webflow, Wix, Shopify, WooCommerce, Ghost, Framer, and more: then tailors every fix to your specific stack.

Yes. Website audits are free and unlimited, no account needed, with a 15-minute wait before re-auditing the same site. A free account skips that wait for 5 audits a month. With a free account, each advanced tool includes free scans every month: Browser Audit 5, Security Scanner 5, Repo Scanner 5 (including CLI uploads) and SEO Optimizer 5. Pro removes the limits and adds scheduled scans with alerts.

Free to start, no card required

Ship with fewer surprises.
Start with one URL.

Run a free website audit now. Add the CLI to your pipeline when you're ready.

Scan my codeSee a sample report

No sign-up for website audits · Code scans run locally with the CLI