Plans
The free survey is available now. Pro and Expert are still being built and prices aren’t set, so everything in those columns may change.
| Feature | Free | Pro (planned) | Expert (planned) |
|---|---|---|---|
| Available | Now | Not yet: a free beta for early adopters comes first | Not yet: after Pro |
| Pages checked | Homepage, plus samples of its links and sitemap | Top 10 pages, with accessibility and speed checks on each | Every page |
| Built on | Lighthouse (through PageSpeed Insights), axe-core’s rules, the Chrome UX Report, CO2.js and RDAP, plus Steeplejack’s own checks | The same on each of your top 10 pages, plus NVD, OSV, endoflife.date and Retire.js for software and known vulnerabilities. With proof of control, the active checks currently use testssl.sh and Nuclei | As Pro across every page, plus a review by hand |
| Security | Passive checks: certificates, security headers, email and DNS protection, mixed content, security.txt and domain expiry | Adds cookies, disclosed versions, end-of-life software, known vulnerabilities and JavaScript libraries. With proof of control, also exposed files, admin panels and CMS-specific checks | Deeper testing with an agreed scope, plus a review of your composer.json and lockfiles |
| Proof you control the site | Not needed | Only for the active checks: a DNS record or a file on the server | Required |
| How it runs | Automatically | Automatically | Started by hand, once the scope is agreed and the scanner is allowed through any firewall |
| Report | Scripted report page, Markdown and JSON | Scripted report with an action plan and a download package. No AI and no custom branding | Adds a written, AI-assisted analysis and your own branding |
Active security tests only run where the customer has proved they control the domain. Without that proof, a Pro report says which checks it skipped and why.
Steeplejack isn’t affiliated with or endorsed by the makers of any tool named here.
Hear when they’re ready
If you have an account, register interest in the Pro beta. Otherwise, email steeplejack@mikestreety.co.uk. It’s also useful to hear what you’d want from a paid survey.