Update, 8 October 2026: this post has grown into the full tour of the product. There are now 59 free tools, up from 27 on launch day, the latest ten for AI search, from robots.txt rules for AI bots to asking Claude whether it names your brand: all tools shows the full set, and the changelog lists every addition.
getReport is a free website checkup. Paste an address, and in under a minute you get one report that covers speed, SEO, security, accessibility, structured data, social previews and best practices, with a plain explanation and a concrete fix for every problem it finds. The report lives at its own link for 12 months, so you can send it to the person who will fix things.
There is no account, no trial, no "upgrade to see the rest" and no paid plan, and that is not a launch promotion. The usual model in this market is to run the check for free and sell the results back to you: the first five findings visible, the rest behind a quote form. We think a checkup you cannot read is not a checkup. getReport is funded by donations, nothing is gated, and the features that cost real money switch on for everyone once donations cover them. More on that below.
It is the third tool in a small family, after getSVG and getPNG. Same promise each time: free, fast, nothing to sign up for.
- 193checks behind a report
- 7modules, each with its own score
- 12 monthsa report stays at its link
A tour of the seven modules
Every report is the same 193 checks organised into seven modules, each with its own 0 to 100 score. Speed carries 30 of the 100 points of the overall grade, SEO 25 and security 15; the methodology page lists every check, its weight and the exact data source, so nothing about the grade is a secret.
Speed
30 checks, and the only module that uses outside data: Google's PageSpeed Insights runs the page in a throttled lab browser, and the Chrome UX Report adds what real visitors measured over the last 28 days. You get Core Web Vitals (LCP, INP, CLS) from both, then the causes: render-blocking resources, unused CSS and JavaScript, image formats and sizing, font loading, third-party weight and cache lifetimes. If the vitals are red, start with how to improve Core Web Vitals.
SEO
52 checks on the technical layer Google needs before content and links can count. Is the title there and between sensible lengths, is there exactly one H1, does the canonical point where it should, is there a stray noindex, does robots.txt block the page, is the sitemap valid XML and does it include the page, do hreflang pairs link back, how long is the redirect chain, and which links on the page are broken. The canonical gets its own pair of checks (present, and pointing somewhere valid), because it is the tag that quietly costs the most when it is wrong; canonical tags explained covers why.
Security
38 checks, no scanner theatrics. HTTPS enforced with a working HTTP redirect, HSTS, TLS 1.2 or newer, days until the certificate expires, the header set (CSP, X-Content-Type-Options, Referrer-Policy, Permissions-Policy), cookie flags (Secure, HttpOnly, SameSite), plus the embarrassing ones: an exposed .env or .git directory, directory listing turned on, and whether Google Web Risk has flagged the site. If your header report is all red, security headers from zero walks through the full set in order.
Accessibility
We render the page in a real browser, run the open-source axe-core engine on it, and group its findings by severity. On top of that come our own checks: a colour contrast summary, form fields without labels, links without names, keyboard traps, zoom disabled on mobile, and tap targets that are too small to hit. What accessibility checkers find most often explains the legal side and the usual first fixes.
Structured data
10 checks that read your JSON-LD and microdata the way Google does: does it parse at all, which schema types are declared, are the required properties for those types present, is the page eligible for a rich result, and are there duplicate entities fighting each other. If you have no structured data yet, JSON-LD basics shows how to add it without breaking anything.
Social
11 checks on how your link looks when someone pastes it into Slack, WhatsApp or LinkedIn: og:title, og:description and og:image present, the image at the right size and actually reachable, og:url matching the canonical, and a Twitter card. The report renders the preview so you see exactly what others will. How link previews work is the guide if yours shows a grey box.
Best practices
38 checks for everything that is not one module's job but still costs you visitors or fines: HTML validation errors, console errors, deprecated APIs, HTTP/2 or HTTP/3, Brotli or gzip compression, cache headers, image weight, JavaScript libraries with known vulnerabilities, a privacy policy link and a custom 404 page. It also checks consent properly: which trackers and cookies load before anyone clicks Accept, and whether your cookie banner has a real reject button.
Top fixes first, jargon second
A score tells you how bad it is, not what to do on Monday. So the top of every report is Top fixes: the 5 actions with the biggest estimated gain across all modules, each with the effort it takes (S, M or L), the points it is worth and one line of evidence. Every finding below that has two sides: what it means for your visitors or your rankings, written for the person who owns the site, and the technical detail for whoever changes the code, behind a toggle.
When the page is built with WordPress, a WordPress Doctor panel appears after the top fixes. It works only from what the page itself reveals: the theme, the plugins that load files, the page builder and how much each of them costs in bytes and milliseconds. It never guesses plugin names or brute-forces paths, and the sensitive results (user enumeration, exposed backups, open XML-RPC) show a plain yes or no to anonymous visitors; details go only to the verified owner.
The link is the product
Every report gets a short permanent address, and that address is the whole idea. It stays live for 12 months, carries a generated preview image (the score ring plus the domain) so it unfurls properly in chat apps, prints cleanly, and exports as PDF or JSON when a link is not enough. Send it to your developer, your agency or your boss; nobody needs an account to read it, and how to hand a report to a developer covers what to say alongside it.
Reports are also private by default: every one carries a noindex tag, so search engines stay out and a report is seen only by the people you send it to.
59 tools, one engine
The report is also split into 59 single-purpose tools, because sometimes you need one answer, not seven scores: a speed test, an SEO audit, security headers, an SSL check, a link preview, a robots.txt tester, a redirect checker, a broken link checker, a hacked-site checker, a cookie scanner, a bulk URL checker for up to 1,000 addresses, a sitemap generator that crawls up to 100 pages, an email DNS check for SPF, DKIM and DMARC, and more. Each tool runs the same checks as the report, from the same code, so a tool and a report never disagree about the same page.
The browser tools never send your files anywhere: the server log analyser, the schema generator and the image compressor do their work in your browser, and the file stays on your computer. Each of those pages says so, because you should not have to take our word for it.
Fixes you can follow
A report that tells you something is wrong is only half useful. Every finding links to a fix page, and there are two layers of them:
- 129 fix pages, one per problem, short: what it is, why it matters, how to fix it on common platforms.
- 347 in-depth guides for specific setups, with screenshots and code you can paste: Core Web Vitals on WordPress, security headers on nginx, recovering a hacked site, canonical tags on Shopify.
What free means here
Free usually means "free sample". Here it means the report costs us almost nothing to produce: Google's speed APIs are free within a daily quota, everything else runs on one small server, and an identical request within 12 hours gets the cached report. How getReport stays free walks through the actual numbers, server invoice included.
Donations cover that base, and they drive the funded unlocks: features with real monthly costs, such as a site crawl of up to 500 pages or daily monitoring with email alerts, each with a public price on the funding page. When monthly donations pass an unlock's threshold, it switches on for everyone. Not for donors, for everyone; there is no donor tier, and there never will be.
What getReport is not
Honesty about scope beats a longer feature list, so here is what a report will not tell you. getReport measures only what it can see on your site, so there is no keyword research, no backlink index and no rank tracking; those need paid data suppliers and are a different product. Google Search Console does rankings and indexing for your own site, free, and Ahrefs Webmaster Tools covers backlinks. There is no real-user monitoring and no sub-5-minute uptime pinging either; UptimeRobot's free tier does that well. We would rather point you to a good free tool than badly rebuild one.
What we don't do
- No account. You need an email address only for monitoring and alerts, and only when that unlock is on. Even proving you own a site needs no email: a DNS record, a meta tag or a file.
- No trackers without your OK. No ads. We ask whether Google Analytics may count visits; it runs only if you accept and never sees the sites you check. Privacy has the details.
- Reports are not indexed. Noindex by default, as above; only a verified owner can opt a report in.
- We don't hammer your site. Our crawler identifies itself as GetReportBot, fetches the pages a check needs and respects robots.txt. Our crawler explains how to recognise it or opt out.
What comes next
All 59 tools are live now, sorted into six topics on the tools page. Next comes more of the funding ladder: the 500-page crawl with a weekly re-check, daily speed monitoring with alerts when a score drops or a certificate is about to expire, and test locations in the US and Singapore, each as soon as donations cover it. The funding page shows live progress toward each one.
If something in a report is wrong or unclear, tell us at hello@getreport.app. Every finding has a "Was this useful?" button, and we read every answer.