Scan your Next.js site before you ship
Next.js gives you server rendering, a metadata API and file-based robots and sitemap routes. Getting those right, plus a few headers Next.js doesn't add for you, covers most launch checks.
Free · No signup · Only scan sites you own or have permission to test
Common Next.js launch issues
🛡️ Security
- NEXT_PUBLIC_ variables are inlined into client JavaScript at build time; anything secret must stay server-only.
- No Content-Security-Policy, HSTS (outside some hosts) or X-Frame-Options is added by default; set them in next.config headers() or middleware.
- X-Powered-By: Next.js is sent unless poweredByHeader is false.
🔎 SEO
- Use the metadata export (or generateMetadata) for titles, descriptions and openGraph.
- app/robots.ts and app/sitemap.ts make robots.txt and sitemap.xml trivial but are often skipped.
- Pages made entirely client-side lose the server-rendering SEO benefit.
⚡ Performance
- Large 'use client' trees and heavy dependencies increase the JavaScript sent to the browser.
- Dynamic routes that could be static add server response time.
What ChillScan checks on your Next.js site
- ✓ Leaked keys in client chunks (_next/static)
- ✓ Security headers and X-Powered-By
- ✓ Metadata, Open Graph, robots.txt and sitemap.xml
- ✓ Response time, compression and JS weight
ChillScan reads only what a visitor's browser receives. It doesn't run JavaScript and can't scan pages behind a login or bot protection. See every check → · See a sample deep report →