SiteRadar

Evidence-based website technical inspection, security auditing, and accessibility analysis.

SiteRadar inspects web pages for security flaws, accessibility issues, performance bottlenecks, and SEO defects directly in your browser. It runs entirely on your local machine—no page content, source code, or browsing history is ever transmitted to remote servers. Open the popup on any tab to run an on-demand audit. SiteRadar inspects the active document, evaluates HTTP security headers, runs accessibility tests with axe-core, measures Core Web Vitals, and fingerprints runtime technologies. Every finding includes the affected DOM element or HTTP header, severity classification, and actionable remediation guidance. AUDIT MODULES Security & Transport • HTTP Security Headers: Content-Security-Policy (CSP), Strict-Transport-Security (HSTS), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. • Transport Security: HTTPS enforcement, TLS certificate status, and passive mixed-content detection. • Resource Integrity: Subresource Integrity (SRI) attributes across third-party scripts and stylesheets. • Form Security: Insecure target actions (HTTP endpoints on HTTPS pages) and unencrypted sensitive inputs. • Information Disclosure: Server header banners, runtime framework signatures, and cookie security flags (Secure, HttpOnly, SameSite). Accessibility (WCAG 2.1 & 2.2 Level A/AA) • Integrated axe-core engine (v4.14) evaluated directly against the live DOM. • Color contrast calculations for text and essential UI components. • Automated detection for missing image alt text and unlabeled form controls. • Structural audits: ARIA landmark roles, heading order hierarchy (H1–H6), and duplicate DOM IDs. • Keyboard focus indicator visibility and tap target sizing. Performance & Core Web Vitals • In-browser performance metrics via Navigation Timing and Paint Timing APIs. • Largest Contentful Paint (LCP), Cumulative Layout Shift (CLS), First Contentful Paint (FCP), and Time to First Byte (TTFB). • Diagnostic checks for render-blocking assets, font display strategies, explicit image dimensions, and payload compression. SEO & Metadata • Essential tags: title, meta description, canonical link verification, and viewport tags. • Social previews: Open Graph and Twitter Card validation. • Structured Data: Syntax validation for JSON-LD, Microdata, and RDFa schemas. • Indexing Directives: Robots meta tags, X-Robots-Tag headers, and robots.txt availability. Technology Detection & Asset Inventory • Identifies active web servers, frameworks (React, Next.js, Vue, WordPress), UI libraries, and runtime globals. • Complete asset inventory categorizing external scripts, stylesheets, fonts, and third-party origins loaded by the document. INSPECTION MODES • Quick Scan: Rapid verification of HTTP response headers, transport configuration, and primary page metadata. • Full Page Audit: Exhaustive DOM analysis, form inspection, structured data parsing, technology fingerprinting, and automated axe-core accessibility checks. • Multi-Page Audit: Validates discovered same-origin hyperlinks, identifying broken links, orphan routes, and missing meta tags across linked pages. REPORTS & EXPORTS • Standalone HTML: Self-contained single-file HTML reports with embedded styling. Zero external CDN dependencies—opens cleanly in any web browser. • Sanitized JSON: Structured, machine-readable export suitable for CI/CD pipelines, defect trackers, and compliance records. • Automatic Secret Redaction: In-memory sanitization masks bearer tokens, exposed API keys (Stripe, AWS, Slack), and credential fields prior to display or export. PRIVACY & SECURITY PRACTICES • 100% Client-Side: Audits run exclusively within your active browser tab. SiteRadar collects no analytics, browsing metrics, or user telemetry. • Ephemeral Data: Audit results reside strictly in memory during your active session. Closing the tab or clicking Clear immediately purges all audit data. • Local Network Protection: Inspection against RFC 1918 private subnets, loopback addresses (127.0.0.1, localhost), and link-local ranges is restricted by default to safeguard internal network environments. PERMISSIONS EXPLAINED SiteRadar adheres strictly to Chrome's principle of least privilege: • activeTab: Grants temporary access to inspect the active document only when you explicitly open the popup and initiate an audit. • scripting: Dynamically executes the local inspection routines on the active tab upon request. No scripts run passively in the background. • storage: Preserves client-side display preferences (such as dark/light mode) and audit presets locally. No audit findings or browsing data are written to persistent storage.