Free tools Website Health & Form Security Check

Tool · Quality assurance

Website Health & Form Security Check.

Find broken links, phone layout problems, and forms that are hard to use or open to spam. Check one page instantly, or your whole website (up to 50 pages) with the report emailed to you.

  • About a minute for one page
  • Up to 50 pages for a whole site
  • Reads pages only: never submits forms or logs in

Check a page

Any public page. We only read it; we never fill in or send your forms.

Checks broken links, phone layout, form usability, spam protection and form security on one page, in about a minute.

What we check

  • Broken links, page errors and images that fail to load
  • How the page looks on a phone
  • Form labels and error messages
  • Spam protection: reCAPTCHA, hCaptcha, Turnstile, hidden trap fields
  • Form security: https, anti-forgery tokens, where form data goes
  • Privacy notices, payment forms and basic security settings

No AI, no form submissions, no logins. Rule-based checks only.

Methodology

How the score works.

Every finding is Critical, Warning or Info. We start at 100 and take points off once per type of issue, plus a little for each repeat, so one template problem repeated on every page does not wipe out the score on its own.

  • Critical (for example a form sending data over plain http): 15 points, plus 3 for each repeat, up to 25.
  • Warning (for example a broken link): 6 points, plus 1 for each repeat, up to 10.
  • Info (for example a missing security header): 1 point.

90 or more is Good, 70 to 89 Needs attention, below 70 Needs work.

How this tool works

  • What it does. We load your pages in a real browser, like a visitor would, and read them. We check links, images, scripts, phone layout, your forms and a few security settings, then score the results with fixed rules. No AI is involved.
  • What it never does. It never fills in or submits your forms, never logs in, never clicks buy, donate or submit buttons, and never tries to break anything. It respects your robots.txt and skips login, cart and account pages.
  • What it cannot see. Protections that run on your server, such as Akismet, rate limiting or server-side validation, are invisible from outside. So we say "no visible bot protection detected" rather than calling a form unsafe.
  • Want more? Pair it with the free WCAG Accessibility Checker and Website Performance Audit, or ask our QA team for hands-on testing on a copy of your site.

Want a person to test it properly?

Our QA team tests real form submissions on a copy of your site, across browsers and devices, and fixes what we find.