Passive
Every check-up runs these. A passive scan never submits forms or uses owner credentials — it fetches the URL like a normal browser, renders the page, and checks crawlability, JavaScript rendering, search presentation, navigation, structured content, media, performance, accessibility, forms, mobile/i18n, browser compatibility, consent/interstitial behavior, and runtime signals against 290+ quality signals.
Public scans do not require site ownership, subject to the Acceptable Use Policy. They do not cover private dashboards, authenticated journeys, or owner-only data.
What passive catches
- Crawl/indexation defects: robots, sitemap, noindex, canonicals, redirect chains, soft 404s, and broken rendered pages.
- JavaScript rendering and progressive-enhancement gaps: blank no-JS pages, hidden primary content, blocked resources, and delayed links.
- Search and information-architecture issues: weak titles, snippets, favicons, breadcrumbs, anchor text, navigation, faceted URLs, and pagination.
- Semantic, machine-readability, and structured-data issues: headings, landmarks, main content, entity signals, and invalid JSON-LD.
- Media and performance delivery risks: alt text, captions, image sizing, LCP pressure, render blocking, fonts, third-party scripts, and caching.
- Accessibility, form, authentication-UX, conversion-flow, and status-message defects.
- Internationalization, mobile, PWA, browser-compatibility, markup validation, console errors, failed-request, and blank-render signals.
- Consent, interstitial, monetization, and live-monitoring signals that affect layout, interaction, or findability.
- Heuristic content-quality, answerability, and template patterns.
Owner-depth
Owner-depth check-ups reuse the website-quality modules against verified domains and, optionally, authenticated or private routes through a short-lived test-account header you provide. They always need a verified domain and a signed-in account.
Why it needs your authorization
Owner-depth scans can crawl private URLs, account states, or owner-connected data when configured. We require you to:
- Verify the domain via DNS TXT or an HTTP file (Account -> Domains).
- Attest authorization — a single confirmation at scan-start time saying you own or have permission to scan the site. Server-stamped with your IP, user-agent, and timestamp; written to
audit_logs.
REST API and MCP starts are passive only; start owner-depth check-ups from the website.
GitHub repository
Repo scans skip the URL phases entirely. They pull a tarball of your default branch over the FixWeb GitHub App (or your OAuth token), process the source in memory, and emit findings against checks under the code.* namespace: crawl-control files, title/meta templates, image components, schema helpers, translation catalogs, form widgets, quality automation, and likely source causes for repeated page defects.
Repo scans never write to your repo and never persist source code; only finding evidence is stored. Repo scans are not available on current plans.
Trigger via API
curl -X POST https://fixweb.app/api/v1/scans \
-H "Authorization: Bearer fxw_..." \
-H "content-type: application/json" \
-d '{"target":"https://staging.example.com"}'Owner-depth check-ups can't be started through the API, because they need your confirmation on the website. Full reference: /docs/api.
Anonymous one-shot scans
The home page lets unsigned-up visitors run a single passive scan per browser session. These scans expire 24 hours after creation and can be migrated to a real account by signing up before they expire — the auth callback automatically attaches the anonymous scan to the new org.