Verra

Check my site
Zyfrr

Product

Building an audit toolwe could stand behind

Most free website checkers exist to capture an email and produce a scary number. We wanted one that could be handed to a developer without embarrassment, and that would tell people honestly when their site was already fine.

6 areas

Checked on every run

~30 seconds

From URL to full report

Free

No account, no card

Project Zyfrr, our own productScope Design, engineering and launch of a public audit tool

Background

Why we built it

Almost every conversation with a prospective client starts the same way. They suspect something is wrong with their website, they cannot say what, and the last agency told them everything was fine. We were opening the same handful of tools every time and writing the same explanations by hand.

The obvious move was to automate the checks. The less obvious decision was to give the result away in full, including the cases where the honest answer is that nothing needs doing and they should keep their money.

The diagnosis

The hard part

Auditing a website is easy. Auditing a website that a stranger typed into a public box, quickly enough that they do not leave, without becoming a tool for attacking other people, is the actual engineering problem.

  • Anybody can enter any address, including internal ones that should never be reachable from a server
  • A cold analysis of a slow site genuinely takes over a minute, and people abandon in seconds
  • The report contains an email address and a phone number, which is personal data with rules attached
  • Free tools attract automated abuse within days of going live

The work

How we built it

01

Six checks, run at once

Speed on both phone and computer, TLS and security headers, email authentication, domain and hosting, findability, and whether the page is actually set up to convert. All of it runs concurrently, because the total wait is what loses people, not any single check.

02

Guarded against being pointed inward

Every address is resolved and checked before anything is fetched, so the tool cannot be aimed at private networks or internal services. Rate limiting sits in front of the whole thing, and results are cached for a day so a repeated request costs nothing.

03

Personal data encrypted at the field

Names, emails and phone numbers are encrypted individually rather than relying on the database being private. Lookups still work through a separate blind index, so we can find a record without being able to read the contents of the others.

04

A report worth sending to a developer

Every finding says what it is, what it costs and what to do about it, and the whole thing prints to a clean PDF. Reports are never indexed by search engines, because nobody wants an audit of their business turning up in a search for it.

Results

Where it landed

Numbers taken from a live run against our own domain, which anyone can repeat. The duration is a full uncached audit including both mobile and desktop analysis.

MeasureBeforeAfterWhat it means
Full audit, both devicesBy hand, around an hour28 secondsThe manual version meant opening six tools and writing up the results.
Areas checkedWhatever we remembered6, every timeConsistency matters more than breadth when you are comparing two sites.
Failed runs from timeoutsSilent, with data missingRetried once, then reportedA report that quietly omits half its data is worse than one that admits it failed.
Cost to the person running itA sales callNothingNo account, no card, and the full report for an email address.

What we would do differently

We shipped it with a single seventy five second timeout on the speed analysis, which felt generous and was not. A mobile run that overran it by 176 milliseconds threw away the entire mobile half of a report, and because the report still rendered and still looked complete, nothing said the numbers were missing rather than absent. We only caught it by reading a stored result closely. It now makes two attempts inside a smaller budget, and the fix took ten minutes. Designing the failure case properly on day one would have taken five.

Do not take our word for it

Check it yourself

The tool is public and free, so the fastest way to judge whether it is any good is to point it at something you already know well.

  1. 01Run it against your own website and see whether the findings match what you already suspected
  2. 02Run it against a site you know to be excellent, and check that it says so rather than inventing problems
  3. 03Compare a finding against Google PageSpeed Insights directly, since that is where the speed numbers come from

Built with

  • Next.js
  • TypeScript
  • MongoDB
  • PageSpeed Insights API
  • AES 256 GCM encryption
  • Vercel

Want something like this for your business?

A tool your customers can use for free is usually a better first impression than a brochure page. Tell us what your version would do and we will tell you what it would take.