Survey a website.
A free website audit for agencies and freelancers. Steeplejack runs the free tools you’d reach for anyway, such as Lighthouse and axe-core, in one go, adds checks of its own, and explains every result in plain English.
Anyone can see a summary. A free account unlocks the full report.
- Takes
- About a minute
- Looks at
- The homepage, its headers, DNS and certificate, robots.txt, sitemap (and a sample of the pages it lists), security.txt, a sample of the homepage’s links, its share image and icons, and when the domain expires
- Leaves alone
- Forms, logins and anything a normal visitor couldn't reach
One survey, every corner
More than 40 checks, in one report, because the problems that hurt a small organisation can be in any of these areas.
Email spoofing
Could someone send a fake invoice from this domain? SPF, DKIM, DMARC and MTA-STS.
Security
Certificates, security headers, mixed content, security.txt and domain expiry.
Search
Stray noindex tags, canonicals, titles, sitemap errors, broken links and real-visitor speed.
AI discoverability
Whether AI search crawlers are allowed in, whether they actually get through, and schema markup.
Accessibility
Automated WCAG checks and colour contrast, with a clear note of what automated tools miss.
Performance
Lighthouse speed, Core Web Vitals, page weight, third-party trackers and a carbon estimate.
Free tools, in one place
Lighthouse, accessibility checkers and DNS lookups are free, and you could run each one yourself. Steeplejack runs them for you, puts the results in one report in order of what to fix first, and adds checks the tools don’t do. Every check in the report says where its result came from.
What it builds on
- Lighthouse, through Google PageSpeed Insights, for speed, SEO and best practice
- axe-core’s accessibility rules, as Lighthouse runs them
- The Chrome UX Report, for how fast the site is for real visitors
- CO2.js from the Green Web Foundation, for a carbon estimate
- The domain registry’s own RDAP service, for when the domain expires
- webappanalyzer’s fingerprints, for which software the site runs
What Steeplejack adds, for example
- It visits the homepage as AI crawlers such as OAI-SearchBot, Claude-SearchBot and PerplexityBot, to see whether the server actually lets them in, not just what robots.txt says.
- It reads the domain’s SPF and DMARC records together, to say whether someone could send convincing fake email in its name.
- It asks for a page that doesn’t exist, to check the site answers with a real 404 rather than a page search engines might index.
- It loads the social share image, to check it works and is big enough to show.
Steeplejack isn’t affiliated with or endorsed by Google, Deque, the Green Web Foundation or the makers of any other tool named here.
A report you can act on
- Plain English
- Each finding says what was seen, why it matters and how to fix it, with links to the official documentation.
- In order
- Fixes are sorted by impact and effort, so you can see what to do first and what can wait.
- Your stack
- Many fixes include specific notes for TYPO3 and WordPress.
- Shareable
- Anyone can see a summary at the site’s address. Pass the Markdown or JSON version to your AI tool.
- Repeatable
- Survey again after your fixes and the new report shows what changed.
What it won’t pretend to do
- It isn’t a penetration test. A free survey only looks from the outside and sends no attack traffic.
- It doesn’t cover your whole site. It surveys the homepage, plus small samples of its links and sitemap.
- It isn’t an accessibility audit. Automated tools find roughly a third of accessibility problems.
- It won’t guess. If a site blocks the scanner, the report says so.
Built for people who look after websites
Check a site before you take it on, before it launches or as part of a care plan. How agencies and freelancers can use it.
Need more depth? See what Pro adds, and register your interest in the beta.
Questions
Why not just run these tools myself?
You can, and each check in the report names its source so you know where to look. Steeplejack saves running them one by one, puts everything in a single order of what to fix first, explains each result in plain English, and adds checks the tools don’t cover.
Is it really free?
Yes. A summary needs no account, and the full report needs a free one with a verified email. Steeplejack is in early testing, and two deeper levels, Pro and Expert, are planned.
Can I survey a site I don’t own?
The free survey only makes the requests a browser or search engine would, and SteeplejackBot’s page lists them. Site owners can email to ask for their site to be excluded.
Does it use AI to write the results?
Not on free surveys. They’re scripted, and the explanations come from a hand-written library. Pro is planned to be scripted too. AI-assisted analysis is only planned for Expert.
Who can see my report?
Anyone can see a summary of a site’s latest survey, without its security results. The full report is for signed-in users who have added that site. Results belong to the site rather than the person who ran the survey, so everyone tracking it sees the latest one. Nothing but the marketing pages is indexed.
Why might it say a check couldn’t run?
Some sites block automated visitors, and some checks need something the site doesn’t expose. Steeplejack marks those as not checked rather than guessing.