Keys, weak rules, and risky browser settings often sit in public code until someone notices.
One URL. A clear risk count. Fixes after unlock.
Find website risks before customers do.
secgates checks security, search, AI visibility, speed, uptime, email, domains, and accessibility in one report.
Scan a website firstGet the risk count now. Unlock findings and AI fixes when you subscribe.
21 live public-safe checks67 scanner pagesOne clear reportLogin required to scan
Missing metadata, blocked crawlers, and thin page structure make your product harder to find.
Password resets land in spam, pages feel slow, and users hit avoidable barriers.
Scan first. Pay only when the report is worth opening.
secgates turns a website check into a simple business decision: how many serious issues did it find, and do you want the exact fixes?
Run the public-safe check
secgates reads public pages, DNS, headers, metadata, and safe response signals without changing your website.
See the issue count
You see how many critical, high, and medium problems were found before the findings are revealed.
Open the fix list
A paid plan reveals evidence, plain-English risk, and an AI-ready fix prompt for each finding.
Everything one scan reveals.
One run turns a URL into a clear picture: what is broken, how visible you are, and how fast you load.
- Security and exposure
- Search and AI visibility
- Speed and Core Web Vitals
- Uptime and email health
Issues, ranked by severity
Every finding sorted so the dangerous ones are impossible to miss.
Tracked over time
Search and AI visibility, trending up
Watch how readable your pages are to Google and answer engines as you ship fixes.
67scanner checks
21live right now
Performance, accessibility, and Core Web Vitals scored in the same pass.
One scan covers the places launch teams usually forget.
No scattered tools, no mystery scores, no noisy jargon. Just clear signals and what to do next.
Security gaps
Find exposed keys, weak headers, risky forms, storage mistakes, and unsafe login paths.
Search and AI visibilitySee whether Google, ChatGPT, Claude, Perplexity, and other crawlers can read the pages that matter.
Speed and page qualityCatch slow pages, heavy scripts, layout shifts, and Core Web Vitals drops before rankings suffer.
Email and domain healthWatch SPF, DKIM, DMARC, DNS drift, domain expiry, certificates, and sender trust.
Accessibility basicsFind missing labels, unclear structure, low contrast, and keyboard traps that block users.
What you get after unlock
Each finding is written so a junior developer can understand the risk and a coding agent can start fixing it.
See plansUnlocked findingHigh risk
Security header missing on checkout pages
Why it matters: Browsers are not being told how to block common page attacks.
Evidence: The response does not include the expected protection header.
AI fix prompt: Add the missing header in the web server or framework response layer, then run this scan again.
Start with the scanners most teams need before launch.
Open any scanner page to see what it checks, why it matters, and the issues it can reveal.
VulnerabilityVerified site required
SQL Injection Scanner
Detect SQL injection vulnerabilities in your web application before attackers exploit them.
View scanner →VulnerabilityVerified site requiredCross-Site Scripting (XSS) Scanner
Find XSS vulnerabilities that could let attackers inject malicious scripts into your pages.
View scanner →ConfigurationRuns nowSecurity Headers Scanner
Check if your site has the right HTTP security headers to prevent common attacks.
View scanner →ConfigurationRuns nowCSP Quality Scanner
Grade your Content Security Policy for real XSS containment, unsafe fallbacks, reporting, and Trusted Types readiness.
View scanner →ConfigurationRuns nowPermissions Policy Scanner
Check whether risky browser features like camera, microphone, geolocation, payment, USB, and clipboard access are locked down.
View scanner →ConfigurationRuns nowCross-Origin Isolation Scanner
Read-only review of COOP, COEP, and CORP headers that help isolate your site from cross-origin leaks and opener abuse.
View scanner →ConfigurationPlanned public-safeFetch Metadata Isolation Scanner
Safe-mode check for whether sensitive routes can reject suspicious cross-site requests using Sec-Fetch browser signals.
View scanner →VulnerabilityRuns nowAPI Key Exposure Scanner
Detect exposed API keys, tokens, and secrets in your frontend code and responses.
View scanner →ConfigurationPlanned public-safeSSL/TLS Security Scanner
Verify your SSL/TLS configuration, certificate validity, and encryption strength.
View scanner →Questions, answered.
Straight answers about scanning, pricing, and what you actually get back.
Do I have to pay to scan?
Scans are free. You only pay if issues are found and you want the full report.
What does secgates check?
Security gaps, search and AI visibility, speed and Core Web Vitals, uptime, email and domain health, and accessibility. One scan, one report.
Will scanning change or harm my site?
No. Every public-safe check is read-only. secgates reads public pages, DNS, headers, and metadata without touching your data or your users.
What do I get when I unlock a report?
For each finding: the affected page, plain-English evidence, why it matters, and an AI-ready fix prompt you can paste into Claude, Cursor, or your coding agent.
Can ChatGPT, Claude, and Perplexity read my site?
secgates checks exactly that. It flags blocked crawlers, thin page structure, and missing metadata that keep answer engines from citing you.
Do I need to be a security expert?
No. Findings are written so any builder understands the risk, and the fix prompts are built to hand straight to an AI coding tool.
Run the scan before your customers find the issue.
Start with a preview scan, see the serious issue count, then unlock the findings when you are ready to fix them.