Scan — Full website audit in 5 seconds

Imprint and privacy pages are checked for superseded statute references. Citations of § 5 TMG, § 13 TMG or the TTDSG have been outdated since 2024 — what applies today is § 5 DDG (Digital Services Act, DE) and the TDDDG. The scan flags such legacy references as a warning with a concrete update hint (e.g. § 5 TMG → § 5 DDG).

If a chat widget is embedded, the scan checks brand-neutrally whether an AI disclosure sits nearby. Under Art. 50 of the EU AI Act, AI systems interacting with people must be disclosed as AI from 02 Aug 2026. If no recognisable disclosure is present, an advisory with a recommendation appears — tied to the finding, not a blanket score deduction.

Since June 2025 the German Accessibility Reinforcement Act (BFSG) is relevant for many online offerings. The scan checks whether an accessibility statement is linked. This finding is deliberately NOT score-relevant for the legal-risk gauge — accessibility has its own BFSG/WCAG card — and instead appears as a separate item in the advisories list.

If fonts are loaded dynamically from an external provider, a data transfer to a third country occurs — a frequent reason for warnings. The scan detects the dynamic embed and recommends local (self-hosted) inclusion. As external resources are already scored, there is no second deduction here, just a clearly labelled additional advisory.

Instead of a single rigid expiry alert, XICTRAQ warns in stages. The cockpit display changes level at 60, 30, 14, 7 and 3 days of remaining validity (red from 3 days). Notification starts at the lead time you set in your settings (14 days by default, adjustable from 3 to 90) and repeats at every newly reached stage below it — 30, 14, 7, 3 and 1 day — rated critical from 3 days.

If a certificate runs longer than roughly 100 days, that points to manual issuance without automatic renewal (ACME). Background: the maximum permitted TLS lifetime is shrinking step by step (200 days since March 2026, max 100 days from 2027, max 47 days from 2029). The cockpit flags this risk and recommends automatic renewal — e.g. “Certificate runs 365 days — ready for the 47-day limit?”.

The scan reads the loaded HTML and finds every script and stylesheet served from a foreign domain without an integrity attribute. Each match is listed with its domain and type (script/style). Subresource integrity stores a hash of the file: if the provider changes the content, the browser blocks loading automatically. Without the hash, the browser loads even a tampered file unchecked. The recommendation is to add integrity (sha384-…) and crossorigin=anonymous — own content-hashed files (hash already in the filename) are excluded.

Setting a Content-Security-Policy is a start — what matters is how robust it is. The scan evaluates the policy (from the HTTP header or the meta-http-equiv tag) with a heuristic and assigns a grade from A to F. It checks, among others: whether unsafe-inline or unsafe-eval weaken protection, whether nonces or hashes are used, whether strict-dynamic is active, whether a default-src exists, whether object-src is set to none, and whether a report endpoint (report-to / report-uri) is configured. The individual criteria appear as green (good) and red (weak) chips next to the grade.

The scan reads the Alt-Svc response header and detects whether the site advertises HTTP/3 (h3) — modern browsers then switch to HTTP/3/QUIC automatically. It shows the status (advertised / no Alt-Svc) and the raw Alt-Svc value. Sober note: HTTP/3 is not universally faster; whether it helps depends on network, server and CDN. The HTTP-version detection was also corrected so the negotiated protocol version (HTTP/1.1, HTTP/2, HTTP/3) is labelled correctly in the result.

Detects the Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy and Cross-Origin-Resource-Policy headers including their values. This block is advisory only and lowers NO existing scores. Typical recommendation: “COOP: same-origin-allow-popups” is a risk-free quick win that isolates the browsing context without breaking popups or OAuth flows.

Checks whether a script of type speculationrules is embedded in the HTML. Speculation rules control prefetch/prerender and can noticeably improve perceived load time when navigating. If absent, the scan provides a copy-paste hint with an example snippet — without promising specific speed figures.

An informational note, not a hard detection: most server-side TLS clients do not yet negotiate post-quantum key exchange. If the negotiated TLS group/curve can be read cheaply it is included; otherwise it stays a neutral note that post-quantum TLS (e.g. X25519MLKEM768) is emerging and readiness depends on the CDN/server.

The scan checks whether a file is reachable at /llms.txt (short timeout, fail-safe). The presentation is deliberately neutral: an llms.txt can give AI crawlers structured hints, but its actual effect is disputed and it is not a ranking factor — so it appears purely as an optional advisory, without any promise of impact.

30 seconds before the customer meeting scan the domain and derive talking points from the red recommendations — e.g. a Google Fonts embed with legal risk as a concrete, sellable lead. Diff view against the prior scan shows progress after completed engagements.

Scan the competitor URL, the tech-stack card in the network tab reveals CMS, CDN, analytics tools, payment systems. Compare performance and SEO, analyse content structure and heading hierarchy — no manual research needed.

Before go-live run a scan — missing viewport tags, forgotten robots.txt, missing canonical URL or misconfigured HSTS become visible instantly. Prioritise recommendations by severity, fix criticals before launch.

Every executed scan is kept permanently in the scan history. Reopen later to document the state at a specific point in time — e.g. for compliance evidence or contract annexes.