Why a website check works as a lead magnet
Classic lead magnets are white papers, checklists or webinars. They trade general knowledge for an email address. A website check works differently: it gives the visitor an immediate finding about their own website. All they have to reveal is the address they want to check. That lowers the barrier and gives the agency a concrete topic for a conversation if the visitor gets in touch later.
Almost every potential client has the object of the check. 92 percent of Bavarian companies with at least ten persons employed had their own website in 2025 (Bavarian State Office for Statistics). The survey covers Bavaria only and only companies with ten or more persons employed; the release gives no figure for smaller businesses. For agencies selling to small and mid-sized companies, the direction is still clear: the website exists; its condition is the open question.
That condition is rarely flawless, which is why a check often finds a starting point. Encryption is now the norm: 97.3 percent of homepages requested on mobile were served over HTTPS in 2025 (HTTP Archive Web Almanac 2025). Security headers are a different story. A Strict-Transport-Security header appeared on 36 percent of pages requested on mobile (HTTP Archive Web Almanac 2025), and adoption of Content Security Policy stood at 21.9 percent (HTTP Archive Web Almanac 2025). A security score that rates the response headers therefore shows room for improvement on many websites.
The Web Almanac values describe the public web as a whole, not German small and mid-sized businesses, and show a trend, not an expectation for any single website. A missing header is not automatically a gap either; only a look at the specific site can tell.
What the audit widget checks and shows
XICTRAQ® offers the website check as an embeddable audit widget in the Agency plan for agencies. One line of JavaScript embeds a public website quick check with the agency logo and colors on the agency’s own site (XICTRAQ, page for agencies). On the pricing page, the audit lead magnet widget is listed only in the Agency plan.
<script defer src="https://www.xictraq.com/check-widget.js"
data-token="YOUR_USER_ID"
data-lang="en"
data-title="How healthy is your website?"
data-button="Check now"></script>The data-token attribute carries the user ID of the agency account, from which the server resolves the branding. With data-title, data-button and data-placeholder you adjust the heading, the label of the check button and the placeholder, and data-lang sets the interface language. The handbook on the widgets describes all attributes and endpoints.
The widget shows whether the website responds and the response time in milliseconds. If the connection times out, it reads “Unreachable” instead of “Offline”, because many servers block requests from data centers. Why a site loads for some people and not for others is covered in the article Works for us, not for the customer.
The check reports whether the SSL certificate is valid and raises the question of who keeps an eye on expiry and renewal.
The score rates the security headers of the response, plus HTTPS and visible version details in the server header, on a scale from 0 to 100 (XICTRAQ handbook). What each header does is explained in the article on HTTP security headers.
The visitor downloads the result as a PDF with the agency logo, colors and company name, and the file name carries the brand name. Once a company name is set, the reference to XICTRAQ® is dropped.
The result comes from the same quick check as the public scan and is cached on the server for 10 minutes (XICTRAQ handbook). The check is a snapshot, not continuous operation. Watching a website on an ongoing basis takes the security scan on a fixed schedule and availability checks, which is exactly the service the agency can sell afterward.
Logo, colors and company name come from the white-label settings of the account. Without the Agency plan, the widget shows the XICTRAQ® default colors (XICTRAQ handbook) and records no leads.
Where the widget belongs on the agency site
A check field on the homepage is easily overlooked because it competes with the service overview, references and contact details. A page that makes the check its subject works better, because there the check matches what the visitor came for.
- Maintenance and security service page: the check shows what the service addresses, and the form below asks for a conversation.
- Guide article: an article on security headers or certificates with the check at the end lets readers try what they have read on their own site.
- Separate domain for campaigns: the lead list stores the source domain, not the path. Anyone who wants to evaluate campaigns separately needs a separate domain or subdomain for each.
The text around the widget matters. Without your own settings, the heading reads “Free website check” and the button “Check”; both can be changed via data-title and data-button (XICTRAQ handbook). One sentence below the field should say what is checked, that the check runs from the outside and that the checked address is stored. That belongs in the privacy notice anyway, as described below.
What a lead contains and what it does not
Every successful quick check and every PDF download through the embedded widget is recorded as a lead of the agency account, deduplicated per hour per checked address and visitor (XICTRAQ handbook). Only calls from an embedded page count: the domain of the embedding page is recorded, while calls without an embedding and XICTRAQ® preview pages are ignored.
| Item | In the lead | What it means for sales |
|---|---|---|
| Checked address | yes | Which website was checked, not who owns it |
| Country | yes, derived from the IP | Rough origin with the blur of any IP mapping |
| Source domain | yes | Which of your domains the widget ran on |
| Time | yes | When the check took place |
| IP address | only as a hash with a daily key, not retrievable | Used solely for deduplication |
| Name, email, phone | no | No contact channel and no consent |
The list is available in the dashboard and, while logged in, through the API. It holds the newest 100 leads, optionally with counts for the total, the last 7 days and the 7 days before (XICTRAQ handbook). The list does not return the IP hash, which is built with a daily key and can no longer be traced back to the IP once the day is over (XICTRAQ handbook).
The country is a derivation, not something the visitor entered. IP databases map address ranges to places, and mobile networks and large access providers in particular put many visitors at placeholder locations. Why a visitor suddenly appears to be in Frankfurt is explained in the article on IP locations and placeholder cities. For the lead list, the country is therefore good for a rough classification, not for regional attribution.
A lead from the website check is a checked address, not consent. It says that someone checked a website. It does not say who that was, whether that person belongs to the website and whether they want to hear from you.
A lead is not consent: what Section 7 UWG requires
Section 7(2) no. 2 UWG classifies advertising using electronic mail without the prior express consent of the addressee as an unreasonable nuisance per se (UWG). The provision makes no distinction between consumers and businesses. An advertising email to the contact address from the legal notice of the checked domain is therefore not permitted without prior express consent, whether the recipient is a trade business or a corporation.
For phone calls, the law draws a distinction: an advertising call to a consumer requires prior express consent, a call to other market participants at least presumed consent (UWG). Whether an anonymous scan suggests that the site owner is presumably interested is a matter of judgment, and the starting point argues against it: who ran the check is unknown.
The exception for existing customers does not help either. Section 7(3) UWG allows email advertising without consent only if a business obtained the electronic mail address from the customer in connection with the sale of goods or a service and further conditions are met, including notice of the right to object (UWG). A scan is not a sale, and the visitor did not leave an email address in the process.
A common error concerns the relationship with the GDPR. According to its Recital 47, processing personal data for direct marketing purposes may be regarded as carried out for a legitimate interest (GDPR). That concerns the data protection side of the processing. Whether an advertising email may be sent without consent is answered separately by Section 7 UWG, and there a legitimate interest is not enough.
Anyone can check any address: the owner, a service provider, a competitor or someone trying out the widget. Writing to the contact in the legal notice of the checked domain is therefore wrong twice over: legally under Section 7 UWG and practically, because the recipient may not even know the reason for the message.
The figures on phone advertising show how seriously the authority takes unsolicited advertising. In 2025, the Bundesnetzagentur, Germany’s Federal Network Agency, received 39,842 written complaints about unsolicited phone advertising, 6 percent more than in 2024 with 37,561 (Bundesnetzagentur). In the same year, it handled 13 major fine proceedings (Bundesnetzagentur); in total, it imposed fines of more than 1.099 million euros (Bundesnetzagentur). For the first time, it sanctioned violations of the obligation to document and retain advertising consents (Bundesnetzagentur).
Section 20 UWG sets the range of fines: up to 300,000 euros for advertising calls to consumers without prior express consent, and up to 50,000 euros if such consent is not documented or not retained for at least 5 years (UWG). The documentation duty itself is laid down in Section 7a UWG. Section 20 UWG provides no fine for email advertising without consent. That does not make it harmless: under Section 8 UWG, competitors among others can demand removal and injunctive relief, and if an agent commits the violation, the claim is also directed against the owner of the business (UWG). Anyone who outsources acquisition to a service provider can therefore face injunction and removal claims themselves.
From scan to inquiry: shaping the visitor’s path
If the agency may not write to the visitor, the visitor has to take the next step. That is not a disadvantage. Anyone who gets in touch after the check has seen the result, knows what it is about and expects an answer. A reply to an inquiry is generally not unsolicited advertising, as long as it sticks to the inquiry. The agency site has to make that step the obvious one.
- Explain the result: below the widget, explain in two or three sentences what status, certificate and security score mean and what the check does not cover, such as content, accessibility or data protection.
- Offer a conversation: a contact form right next to the result, with a field for the checked address and the question of what you can help with. Whoever submits it is making an inquiry.
- Ask for the newsletter separately: anyone who also wants advertising by email gives a separate consent that is not preselected. A confirmation email with a click on a link shows that the address belongs to the person making the inquiry.
- Document consent: store the time, the wording of the consent and the confirmation. Where processing is based on consent, the controller must be able to demonstrate that the data subject has consented (GDPR).
- Let the PDF do its work: anyone who passes on the PDF with your logo internally also passes on your name, without you writing to anyone.
For this path to work, the form has to deliver reliably. An inquiry that ends up in a spam filter is lost. How to monitor submission and delivery of the contact form is described in a separate article.
The lead list is not an address book but a statistic: if the number of scans rises while the number of inquiries stays flat, the problem lies between result and form, not in the check. The counts for the last 7 days and the 7 days before (XICTRAQ handbook) make this comparison possible without extra effort.
Extending the agency’s privacy policy
With the widget, the agency processes data of visitors to its own website. According to the handbook, it processes checked URLs and the resulting leads as the controller, and the legal assessment in each case lies with the agency (XICTRAQ handbook). Where personal data are collected from the data subject, Article 13 GDPR requires, at the time of collection, among other things information on the controller, the purposes and legal basis, the legitimate interests where processing relies on them, and the recipients (GDPR).
A checked address can relate to a person, for example the website of a sole proprietor; then there are the country, the time and the IP hash. The XICTRAQ® privacy policy describes the roles: when a visitor checks a domain through an embedded component, XICTRAQ® records for the operating customer which address was checked, which page the call came from and which country it originated in. This processing is carried out on behalf of the embedding customer under Article 28 GDPR (XICTRAQ privacy policy). In addition, XICTRAQ® logs every check to prevent abuse and removes the IP address, browser identifier, referring page and language setting from these entries after 90 days at the latest (XICTRAQ privacy policy).
- Purpose: website check for visitors and evaluation of the checks as a source of inquiries.
- Data processed: checked address, source page, derived country, time and a hashed identifier of the IP address.
- Legal basis: the one you have chosen; for legitimate interests, naming those interests.
- Recipients: XICTRAQ® as processor, with a reference to its own logging for abuse prevention.
- Retention period: how long you keep leads in the list and in downstream systems.
- Objection: anyone who uses data for direct marketing must observe the right to object under Article 21 GDPR; after an objection, the data are no longer processed for that purpose (GDPR).
How supervisory authorities currently read privacy policies and where they find gaps is covered in the article on privacy policy transparency as an enforcement focus. The section on the website check belongs in the policy before the widget goes live.
The widget sets no cookies and loads no third-party fonts (XICTRAQ handbook). Section 25 TDDDG, the German telecommunications and digital services data protection act, generally ties storing information on the end device and accessing it to consent, with exceptions for strictly necessary operations (TDDDG). Whether your site needs a consent banner depends on its other components; no blanket statement about legal compliance follows from this, and the assessment remains with the agency.
If the agency site itself sets a strict Content Security Policy, the widget needs allowances: www.xictraq.com in script-src, api.xictraq.com in connect-src, data: in img-src for the logo and api.xictraq.com in form-action if the policy sets that directive (XICTRAQ handbook). How such a policy is structured and introduced step by step is shown in the article on configuring a Content Security Policy.
Content-Security-Policy: default-src 'self';
script-src 'self' https://www.xictraq.com;
connect-src 'self' https://api.xictraq.com;
img-src 'self' data:;
form-action 'self' https://api.xictraq.comPreventing abuse, keeping the list clean
A public check field invites mass checks, checks of internal addresses and inflated lead lists. The widget has several safeguards against this. A time-based challenge token must be between 2 and 120 seconds old, and the visitor must stay on the page for at least 2 seconds before the first check (XICTRAQ handbook). The rate limits are 10 requests per minute and 60 per hour per IP, shared between scan and PDF (XICTRAQ handbook). Addresses to be checked are matched against internal and private IP ranges so that the widget cannot be turned against internal networks.
Binding leads to the embedding helps against fake leads. The ID in the embed code is public; it appears in the source of every agency page. That is why a lead only counts if the call comes from an embedded page, and the source domain appears in the list. If a domain you do not know shows up there, someone has copied your code. A volume limit per account and source additionally caps how many leads a single source can generate per hour, and a suspended account collects no leads.
Anyone who moves the list into a CRM flags each entry as a check, not as a contact. The consent field stays empty until the visitor grants consent themselves, for example through the form next to the result.
Turning a finding into an offer
When the inquiry arrives, the result is already on the table. A missing HSTS header, a certificate close to expiry or long response times are concrete points for discussing a first job. The real offer is ongoing monitoring: availability, certificates and security headers on a fixed schedule, with alerts on changes and a report the client understands.
This is where agencies move from one-off projects to recurring revenue. How to offer and price monitoring under your own brand is described in the article on white-label monitoring for agencies. The guide on website monitoring for agencies gives an overview of the areas an agency should cover for client websites, and the article on automated client reports shows how measurements turn into regular reports.
Set up HSTS, Content Security Policy and frame protection and measure the effect again with the free security score test.
Instead of a one-time snapshot, checks on a fixed schedule from several locations, with alerts, so the agency ideally learns of an outage before the client does.
Status pages and PDF reports under your own logo through reporting and status pages, so the client sees the ongoing work.
A check against WCAG 2.2 also works as a conversation starter, as the article on the test profile for the new EN 301 549 shows.
Launching the website check on your agency site
A website check as a lead magnet brings inquiries when three things fit together: a result the visitor understands, a contact path right next to it and a lead list that is used as statistics, not as an address list. Technically, the embed is one line; the real work lies in the page copy, the form and the privacy policy.
Embedding, attributes and protection mechanisms are described in the handbook on the audit widget, and the Agency plan features on the page for agencies. A test on a separate test domain shows in the lead list how the source is recorded.
This article draws on: German Act against Unfair Competition (UWG), Sections 7, 7a, 8 and 20, version on gesetze-im-internet.de; Regulation (EU) 2016/679 (GDPR), Articles 7, 13, 21 and 28 and Recital 47; German Telecommunications and Digital Services Data Protection Act (TDDDG), Section 25; Bundesnetzagentur, press release “Bundesnetzagentur verzeichnet erneuten Anstieg der Beschwerdezahlen” of 26 January 2026; HTTP Archive, Web Almanac 2025, Security chapter; Bavarian State Office for Statistics, press release of 30 January 2026 on ICT use in enterprises in 2025; XICTRAQ®, handbook “Embeddable widgets”, page for agencies, pricing page and privacy policy (section 8e). This article does not replace legal advice.