FixWeb

// docs / scans

Scan types

FixWeb is a non-security website-quality scanner. It separates public browser scans, owner-depth journeys, GitHub repo diagnosis, and owner-data enrichment so you can improve the right surface without mixing in site-security testing.

Passive

Available on every tier. A passive scan never submits forms or uses owner credentials — it fetches the URL like a normal browser, renders the page, and checks crawlability, JavaScript rendering, search presentation, navigation, structured content, media, performance, accessibility, forms, mobile/i18n, browser compatibility, consent/interstitial behavior, and runtime signals against 90+ quality signals.

Because it is read-only, passive can run against any URL you are authorized to scan. The trade-off is depth: passive misses private dashboards, account flows, checkout states, analytics context, Search Console data, and owner-only routes.

What passive catches

  • Crawl/indexation defects: robots, sitemap, noindex, canonicals, redirect chains, soft 404s, and broken rendered pages.
  • JavaScript rendering and progressive-enhancement gaps: blank no-JS pages, hidden primary content, blocked resources, and delayed links.
  • Search and information-architecture issues: weak titles, snippets, favicons, breadcrumbs, anchor text, navigation, faceted URLs, and pagination.
  • Semantic, machine-readability, and structured-data issues: headings, landmarks, main content, entity signals, and invalid JSON-LD.
  • Media and performance delivery risks: alt text, captions, image sizing, LCP pressure, render blocking, fonts, third-party scripts, and caching.
  • Accessibility, form, authentication-UX, conversion-flow, and status-message defects.
  • Internationalization, mobile, PWA, browser-compatibility, markup validation, console errors, failed-request, and blank-render signals.
  • Consent, interstitial, monetization, and live-monitoring signals that affect layout, interaction, or findability.
  • Heuristic content-quality, answerability, and repo-connected template patterns on paid plans.

Owner-depth Hobby+

Owner-depth scans reuse the website-quality modules against verified domains and, optionally, authenticated/private routes through a short-lived test-account header you provide. The roadmap also includes Search Console, GA4, CrUX, and release-context enrichment so findings can be ranked by real exposure and business impact. Available on paid tiers as each surface ships, and always requires domain ownership verification.

Why we gate it: the attestation flow

Owner-depth scans can crawl private URLs, account states, or owner-connected data when configured. We require you to:

  1. Verify the domain via DNS TXT or an HTTP file (Account -> Domains).
  2. Attest authorization — a single confirmation at scan-start time saying you own or have permission to scan the site. Server-stamped with your IP, user-agent, and timestamp; written to audit_logs.

For scheduled re-scans, the attestation is recorded once at first verification and inherited by every subsequent run until you disable the schedule. REST API and MCP starts remain passive-only; owner-depth scans must be started from the website UI.

GitHub repository Pro+

Repo scans skip the URL phases entirely. They pull a tarball of your default branch over the FixWeb GitHub App (or your OAuth token), process the source in memory, and emit findings against checks under the code.* namespace: crawl-control files, title/meta templates, image components, schema helpers, translation catalogs, form widgets, quality automation, and likely source causes for repeated page defects.

Repo scans never write to your repo and never persist source code — only finding evidence is stored. Quota: same scansPerMonth bucket as URL scans.

Trigger via API

curl
curl -X POST https://fixweb.app/api/v1/scans \
  -H "Authorization: Bearer fxw_..." \
  -H "content-type: application/json" \
  -d '{"target":"https://staging.example.com"}'

Owner-depth mode is not exposed via API — the attestation flow is on-site only, by design. Full reference: /docs/api.

Anonymous one-shot scans

The home page lets unsigned-up visitors run a single passive scan per browser session. These scans expire 24 hours after creation and can be migrated to a real account by signing up before they expire — the auth callback automatically attaches the anonymous scan to the new org.

Scan types — Docs · FixWeb