How long does an audit take?

Standard mode usually takes one to three minutes; a slow site takes longer, because we wait for its answers instead of skipping them. Deeper mode (up to 25 internal pages) takes a few minutes. Leave the tab open or come back to the report URL later.

Is the audit private?

Every report lives at an unguessable URL with 32 random hex characters (about 10³⁸ possibilities). Anyone you send the link to can open it. We do not publish links, search engines are asked not to index reports, and a scan you start is not handed to anyone else. Details in the Privacy Policy.

crocky.host is a hosting company in Romania, and the audit is how we introduce ourselves. If the report leads you to consider us for hosting, a rebuild, or a migration, that is what keeps the tool running. Whether or not you ever talk to us, the report is yours.

Can I run it on a staging site?

Often, yes. Open "Password or maintenance mode?" on the form and paste the password. We handle HTTP basic auth, Shopify password pages, Netlify password protection, Cloudflare Access, and Vercel preview deployments. WordPress maintenance pages are detected but cannot be bypassed from outside; we will tell you what we saw. If your staging sits behind a VPN or an IP allow-list, contact us about a private deploy.

Do you store the data?

The report stays at its link. Its PDF and screenshots are kept for 30 days; after that, the PDF is printed again when you open it. After 12 months we remove the personal data found on the audited site (contact details, WordPress user names, cookie values) and keep the results to improve our checks. Email audit@crocky.host with the URL to have a report deleted. What we keep and why is in the Privacy Policy.

Does it check whether a site is AI slop?

Yes, by default; untick the box on the form to skip it. The report carries a verdict with the quoted evidence and a fix per finding. It never says a site is human-made; it reports what it found. How the check works, with its error rates.

See what's actually wrong with your website.

Performance, SEO, security, hosting, accessibility, carbon, and a check for AI slop. One shareable report in about two minutes, free, no account.

Standard scan Just this page, usually one to three minutes Are you sure? Deeper scan Up to 25 pages, a few minutes

Also check for AI slop / vibe coding Adds a verdict with quoted evidence and a fix per finding. On by default, about 5 s more; untick it to skip it. How the check works

Same checks on both modes. Standard scans only the URL you entered. Deeper goes up to 25 pages (a few minutes).

We send the report link to this address and, now and then, news about Crocky Audit. Every message has an unsubscribe link.

No news, just the report Also send me CrockyHost hosting offers

Password or maintenance mode?

Use this for a basic HTTP auth popup, a Shopify password page, WordPress maintenance mode, or similar gates. Username is optional (leave blank for screens that only ask for a password). We send the credentials only for this scan, then forget them.

No account needed. Your report lives at an unguessable link: whoever you send it to can open it, and we never publish it.

By running an audit you accept the Terms and confirm you have read the Privacy policy.

Slow time to first byte (3343 ms)

We could not connect to the mail server

Largest Contentful Paint (mobile)

Sample report, click to open

What we look at

Lighthouse is the starting point. The rest is what a hosting company checks before it takes a site on.

Performance: Lighthouse on mobile and desktop, real TTFB measurements, render-blocking resources, image and font loading strategy, JavaScript bundle weight.
SEO and meta: Title, description and canonical per page, sitemap.xml and robots.txt sanity, schema.org structured data, Open Graph and Twitter cards, broken internal links, alt-text coverage.
Accessibility: Color contrast, keyboard navigation, form labels, alt-text, ARIA misuse, focus order. Tested against WCAG 2.2 level AA via axe-core, following the W3C's WCAG-EM methodology and ACT Rules. The same bar the EU's European Accessibility Act requires via EN 301 549.
Security: Both HTTP and HTTPS sites scanned, with auto-HTTPS-redirect verified. All protective response headers (CSP, HSTS, X-Frame-Options, Permissions-Policy), TLS certificate quality and protocol version, cookie attributes, mixed content, exposed admin paths, outdated CMS versions.
Hosting and infra: TTFB against modern hosting baselines, HTTP/2 and /3 support, IPv6, HSTS preload status, redirect chain length, CDN and ASN detection, SPF, DKIM and DMARC.
Tech stack: Fingerprint of your CMS, framework, server, JavaScript libraries, page builders and analytics, including modern setups like Jamstack and static site generators. Anything end-of-life, abandoned, or known-vulnerable gets flagged.
Carbon: Estimated CO₂ grams per visit using the Sustainable Web Design v4 methodology, computed via the Green Web Foundation's CO2.js library. Page weight breakdown by resource type, green-hosting status via the Green Web Foundation.

Paste the address, press Audit, and in about two minutes you get a link you can share. Deeper mode reads up to 25 pages in a few minutes. No account, no install, nothing to wait for by email.

Read the full methodology

What's in the report

One page, five zones, every finding with its evidence and a fix. Nothing inflated, nothing buried.

Profile: How the site looks on Google, Facebook and X, its declared identity, languages and structured data.
Infrastructure: Server response time, protocol support, TLS certificate and its expiry, DNS and email authentication, CDN and hosting provider.
Risk and compliance: Security headers, cookie attributes, exposed paths, mixed content, accessibility violations against WCAG 2.2.
Content and reach: Titles and descriptions, canonical and sitemap sanity, page weight, image formats, carbon per visit.
Findings: Every issue on one grid, sorted by severity, each with the evidence it was taken from and a recommended fix. Plus the AI slop verdict, with the quoted elements.

Open the sample report

Questions before you start

The things people ask before their first run. Still stuck? Write to audit@crocky.host.

How long does an audit take?: Standard mode usually takes one to three minutes; a slow site takes longer, because we wait for its answers instead of skipping them. Deeper mode (up to 25 internal pages) takes a few minutes. Leave the tab open or come back to the report URL later.
Is the audit private?: Every report lives at an unguessable URL with 32 random hex characters (about 10³⁸ possibilities). Anyone you send the link to can open it. We do not publish links, search engines are asked not to index reports, and a scan you start is not handed to anyone else. Details in the Privacy Policy.
Why is it free?: crocky.host is a hosting company in Romania, and the audit is how we introduce ourselves. If the report leads you to consider us for hosting, a rebuild, or a migration, that is what keeps the tool running. Whether or not you ever talk to us, the report is yours.
Can I run it on a staging site?: Often, yes. Open "Password or maintenance mode?" on the form and paste the password. We handle HTTP basic auth, Shopify password pages, Netlify password protection, Cloudflare Access, and Vercel preview deployments. WordPress maintenance pages are detected but cannot be bypassed from outside; we will tell you what we saw. If your staging sits behind a VPN or an IP allow-list, contact us about a private deploy.
Do you store the data?: The report stays at its link. Its PDF and screenshots are kept for 30 days; after that, the PDF is printed again when you open it. After 12 months we remove the personal data found on the audited site (contact details, WordPress user names, cookie values) and keep the results to improve our checks. Email audit@crocky.host with the URL to have a report deleted. What we keep and why is in the Privacy Policy.
Does it check whether a site is AI slop?: Yes, by default; untick the box on the form to skip it. The report carries a verdict with the quoted evidence and a fix per finding. It never says a site is human-made; it reports what it found. How the check works, with its error rates.

See what's actually wrong with your website.

Start an audit

What we look at

What's in the report

Questions before you start