Transparent test setup
Test Program Reference
Complete documentation of all 124 automated checks across 5 scan layers and 24 modules.
How the scan works
- RGate loads the public URL in a real browser context and records the response, DOM, visible content, resources, headers, cookies, and runtime signals.
- The scanner combines browser evidence with HTTP inspection, active path probing, structured data parsing, and selected external vulnerability sources.
- From those signals we identify the visible tech stack, frameworks, backend-as-a-service usage, trackers, and public surface area.
- Checks then run layer by layer across Security, Legal, Accessibility, SEO, and Sustainability.
- Every finding is returned with evidence, risk context, remediation guidance, and release impact.
Scan requirements
- The tested page must be reachable from the public internet.
- The relevant surface should not require a login, passkey, VPN, or manual session.
- Bot, WAF, or scraping protection must not block the scanner from seeing the real page.
- DNS, redirects, TLS, and certificate configuration must be valid enough for a browser to load the target.
- robots.txt should not broadly block inspection of the public surface.
- Private IPs, localhost, and internal staging environments are outside the public scan scope.
What RGate returns
- Identified tech stack and public integration signals.
- Pass, fail, and skipped results for each module.
- Actionable findings with evidence, risk, and fix guidance.
- A release readiness decision instead of a raw score only.
- Markdown exports and agent fix plans for Cursor, GitHub Issues, and coding agents.
Security vulnerabilities are the most commonly exploited attack surface on the web. We test seven distinct areas — from TLS certificate configuration to backend-as-a-service misconfigurations — combining HTTP header inspection, active path probing, and cross-referenced vulnerability databases. Every finding maps to a documented attack vector from OWASP, CWE, or a national CVE database. Issues in this layer carry the highest potential for data breaches, unauthorized access, and compliance violations.
How it works
Performs a TLS handshake using the Node.js tls module, inspects certificate validity and expiry dates, then checks the HSTS header from the HTTP response.
How it works
Sends a HEAD request to the scanned URL and evaluates each security-relevant response header for presence and correct configuration.
How it works
Sends preflight OPTIONS and credentialed GET requests with a spoofed Origin header and inspects the server's CORS response headers for dangerous combinations.
How it works
Sends HTTP GET requests to common sensitive paths and evaluates response status codes and content signatures to detect unintended exposure.
How it works
Extracts the Supabase URL and anon key from page JavaScript, then queries the REST API and Storage API to evaluate table accessibility, write permissions, and bucket visibility.
How it works
Extracts Firebase configuration from the page JavaScript, then sends unauthenticated requests to each Firebase service endpoint to test access controls.
How it works
Fingerprints 228+ technologies from page source and HTTP headers, then queries the NVD REST API and OSV.dev batch API in parallel for matching CVE records with unfixed severity.
How it works
Applies 13 regex patterns across the fully rendered HTML and fetched JavaScript bundles, covering AWS access keys, OpenAI tokens, Stripe secret keys, GitHub personal access tokens, Slack webhooks, Google API keys, PEM private keys, and database connection strings.
How it works
Attaches pageerror and console event listeners in the Playwright browser context before navigation. Filters out known third-party noise (analytics, CDN errors, cross-origin script errors) to surface only actionable issues.
Legal compliance is actively enforced by data protection authorities across the EU and DACH region. We test for GDPR and ePrivacy requirements including cookie consent, privacy policy completeness, and legal notice (Impressum) obligations under German law. We also check AI-generated content labeling requirements under the EU AI Act (Article 50). Missing or non-compliant legal elements expose operators to significant fines, Abmahnungen from competitors, and reputational damage.
How it works
Loads the page in Playwright, intercepts network requests before any user interaction to detect pre-consent tracking, and inspects the DOM for consent banner UI elements.
How it works
Probes common privacy policy URL patterns (/privacy, /datenschutz, etc.) and checks for privacy-related links in page footer and navigation.
How it works
Probes common Impressum URL patterns (/impressum, /imprint, /legal) and scans page links for legal notice references.
How it works
Intercepts all network requests during page load and matches request domains against a database of known third-party service fingerprints.
How it works
Downloads a sample of images from the page and analyzes their embedded metadata using ExifReader, checking for AI generation markers, C2PA credentials, and copyright fields.
Web accessibility ensures that all users — including those with visual, motor, or cognitive disabilities — can use your website effectively. The European Accessibility Act (EAA) requires most businesses to comply with WCAG 2.1 Level AA from June 2025 onward. We run five modules using the axe-core engine, DOM inspection, and Playwright at mobile viewport widths. Accessibility improvements also positively impact SEO: search engines treat well-structured, semantically correct HTML as higher-quality content.
How it works
Injects axe-core into the Playwright browser context and runs a full accessibility audit, capturing violations with WCAG success criterion references and impact levels.
How it works
Queries the rendered DOM for all img and svg elements, inspecting alt, aria-label, role, and title attributes for accessibility compliance.
How it works
Analyzes the rendered DOM for semantic HTML5 elements, aria-hidden usage, tabindex values, and form label associations.
How it works
Uses Playwright at 375px viewport width to measure interactive element bounding boxes and detect layout overflow beyond the viewport.
Search engine visibility directly determines how well users and AI agents discover your website. We audit six areas that influence crawlability, indexing, and ranking: meta tag completeness, indexing signals, mobile usability, URL structure, heading hierarchy, and load performance. Each check references the specific Google, W3C, or schema.org specification that defines the requirement. Generative engine optimization (GEO) signals like structured data are increasingly important as AI search replaces traditional SERP clicks.
How it works
Parses the page's <head> element to inspect all meta tags, link elements, and their attribute values against recommended ranges and requirements.
How it works
Fetches /robots.txt and /sitemap.xml and parses their content; inspects meta robots tags and X-Robots-Tag HTTP response headers.
How it works
Loads the page at both desktop (1280px) and mobile (375px) viewport widths, comparing layout behavior and inspecting meta viewport attributes.
How it works
Inspects canonical link elements and hreflang attributes from the page; resolves both www and non-www variants via HTTP to detect duplicate responses.
How it works
Parses the page DOM to extract and validate the heading outline, then parses all JSON-LD script blocks for syntax errors and validates required fields for 11 schema.org types.
How it works
Intercepts all network requests during a Playwright page load, analyzes resource types, compressed sizes, and loading attributes.
Digital services account for approximately 4% of global greenhouse gas emissions, and a single web page view averages 0.5–1 g CO₂. We measure page weight, request volume, server compression, and asset optimization to quantify the environmental impact of each page load. Our thresholds are aligned with the Web Sustainability Guidelines (WSG) 1.0. Sustainability improvements are directly correlated with faster load times, lower hosting costs, and better SEO rankings — making them a high-return investment.
How it works
Intercepts all network responses during a full Playwright page load and sums the compressed transfer sizes to compute total page weight.
How it works
Analyzes HTTP response headers for Content-Encoding and inspects link, img, style, and font elements for optimization attributes.