How ChillScan Works
Short version: we only look at what any visitor's browser can already see. Nothing more.
The scan, step by step
- 1
You paste a URL
No signup, no repo connection, no install.
- 2
We load it like a visitor would
We fetch the page you entered and its response headers, download up to 25 of the script files it loads (without running them), and check robots.txt, sitemap.xml and the http:// version of your URL.
- 3
We check it against a launch checklist
Security (headers, HTTPS, cookies, secrets in client code), SEO basics and performance signals.
- 4
You get a plain-English report
The free scan shows your scores and the names and severity of your top 3 issues. The $12 Deep Scan adds every finding with explanations, fix tips and a copy-paste AI fix prompt.
What we read
- Public HTML of the page you enter
- HTTP response headers and TLS/HTTPS setup
- Cookies your site sets for a regular visitor
- Client-side JavaScript files the page loads (we read them; we don't run them)
- Public files like robots.txt and sitemap.xml
What we don't
- Your source code, repo or database
- Anything behind a login
- Passwords, tokens or credentials (we never ask for them)
- Attacks, fuzzing, brute-forcing or load testing
- Changing anything on your site
- Running your JavaScript or clicking through your app
Why this matters (and its limits)
If ChillScan can see something, so can anyone else on the internet. That's the point: a leaked key in your JS bundle or a missing security header is already public. Finding it first is the whole job.
The trade-off is that an outside view can't check everything. Logged-in permissions (can user A see user B's data?), server-side logic and your code itself need a code review or a tool that tests with logins. The alternatives page covers good options for that.
Only scan sites you own or have permission to test.
See what your site shows the world
Free, no signup, takes a moment.