881 services carry this tag in their source record. Tags come from the provider, not from us — a tag is a claim about what the service does, not proof that it does it well.
Paid page weight audit — HTML+CSS+JS+image+font byte breakdown (compressed + uncompressed) + per-category bytes + third-party resource ratio + render-blocking resource count + HTTP/2/3 ALPN detection + transfer-vs-uncomp...
Paid exhaustive meta-tag coverage audit — title + meta_description + meta_robots + meta_keywords + meta_author + meta_generator + meta_theme_color + meta_viewport + 17 OG fields (og:title/description/image/url/type/site_...
Paid security exposure-surface audit — HSTS preload-list membership via hstspreload.org API + HSTS header detection, RFC 9116 security.txt presence+format-validity (Contact/Expires/Canonical/Preferred-Languages), 18-path...
Paid deep HTTP redirect chain analyzer — per-hop latency_ms + headers (server/content-type/cache-control/x-cache/cf-ray/cf-ipcountry/vary/set-cookie count/hsts) + status sub-type classification (301/302/303/307/308) + cr...
Paid security.txt RFC 9116 deep audit — path discovery tries /.well-known/security.txt then /security.txt, parses all fields with line-continuation support, strict Contact format validation (mailto: + https://), strict E...
Paid CORS policy audit — baseline GET captures all Access-Control-* response headers (ACAO/ACAC/ACAM/ACEH/ACMA/ACRPN/ACEP/ACEN), dangerous-combo detection (ACAO=* + ACAC=true, ACAO='null', attacker-origin echo), prefligh...
Paid HTTP-method policy + dangerous-method exposure audit — OPTIONS Allow/DAV/ACAO/ACAM + TRACE echo-back + CONNECT + PUT/DELETE/PATCH write exposure + 4 method-override header sniffing (X-HTTP-Method-Override/X-Method-O...
Paid URL safety audit (sandbox-friendly) — 12-signal heuristic preflight for AI agents deciding whether to render/embed a URL: scheme allowlist (http = medium risk, mailto/file/javascript/data = high), Suspicious-TLD cat...
Paid form security + accessibility audit — per-form action analysis (empty/#/javascript:/data:/mixed-content http-on-https), method (GET with passwords = credential-in-URL), enctype (text/plain CRLF injection), target=_b...
Paid cache-freshness strategy audit — probes HTML page + /favicon.ico + /robots.txt + /sitemap.xml + first stylesheet URL + first script URL; for each captures Cache-Control directives + ETag + Last-Modified + Age + Vary...
Paid Wayback Machine CDX-API archive availability audit — snapshot_count, first_snapshot, last_snapshot, age_at_first_snapshot_days, age_at_last_snapshot_days, years_active, snapshots_per_year, is_archived, is_recently_a...
Paid HTTP/3 + Alt-Svc endpoint-discovery audit — parses RFC 7838 Alt-Svc header for h3/h3-29 protocol advertisement, captures port + host + max-age + persistent flag, reports advertised_h3, advertised_h3_port, advertised...
Paid redirect-chain security audit — full chain traversal (max 10 hops), open-redirect detection (//, @, javascript:), cross-domain count, https-only check, meta-refresh detection, redirect-security_score A-F grade via x...
Paid PWA Web App Manifest audit via x402
Paid error-response fingerprint + leakiness audit — 12-probe matrix (api-404/admin-path/.env/phpmyadmin/debug/wp-admin/graphql-invalid/internal-api/bad-json/wrong-accept/long-path/spoofed-loopback), captures per-probe st...
Paid SRI readiness audit - probes every <script src=...> tag on a page, classifies each as same-origin vs third-party, checks for presence of integrity= + crossorigin= attributes, HEAD-probes each script for reachability...
Paid redirect-chain map (cycle 95) — follows 3xx chain up to 15 hops without auto-follow (custom HTTPRedirectHandler); per-hop status+location+scheme_change+latency_ms+content_length; detects redirect loops, cross-domain...
Paid /.well-known/* inventory probe - enumerates 30 standard + proposed well-known paths (security.txt RFC 9116 + openid-configuration + webfinger + nodeinfo + agents.txt + llms.txt + llms-full.txt + apple-app-site-assoc...
Paid CAPTCHA + bot-management vendor detection (cycle 94) — page-level fingerprint of 11 vendors (reCAPTCHA v2/v3/enterprise + hCaptcha + Cloudflare Turnstile + Cloudflare challenge page + Arkose Labs + GeeTest + DataDom...
Paid hreflang <-> sitemap.xml cross-validator (cycle 94) — extracts page hreflang tags, validates BCP47 + self-reference + x-default + canonical agreement, locates sitemap (sitemap.xml + sitemap_index.xml + robots.txt Si...
Paid page-archaeology — detects parked domains, thin content, stale copyright (>5y), auto-generated patterns, missing author bylines; returns is_parked + is_thin + is_stale + classification (human_curated/auto_generated/...
Paid mixed-content body scanner (cycle 97) — parses HTML body for http:// subresources on https:// pages across 12 element types (img/script/link/iframe/source/object/embed/video/audio/form + CSS url() + inline event han...
Paid subdomain-takeover risk audit (cycle 100) — discovers subdomains via HackerTarget hostsearch, resolves CNAME chain (max 8 hops) via Cloudflare DoH, fingerprints 30+ known-vulnerable service providers (AWS S3, CloudF...
Paid full HTTP response header inventory (cycle 99) — DUMPS every response header and classifies each into 5 categories (security / caching / cors / content-negotiation / custom-vendor-prefixed); reports legacy_disclosur...