Free website check for builders and businesses
Whether you launched yesterday or years ago, find what your users run into: leaked keys, broken link previews, slow loads and forgotten trackers. In plain English, with the proof.
How it works
Your live app or landing page. No account, no API key, no install.
On an everyday phone and connection, reading only what any visitor's browser downloads.
The three things to fix first, in plain English, each with the evidence and how to fix it.
What we check
We check what quietly decides whether people sign up, share your link, or bounce.
Stripe, OpenAI and Supabase service keys, and database passwords, in the JavaScript your site sends. Always shown masked.
Your preview image and title, and whether X, LinkedIn and WhatsApp can see them without running JavaScript.
We load it on an everyday phone and connection, not your laptop on office Wi-Fi.
of JavaScript before the app can be used. Over 1 MB is heavy on phones.
JavaScript errors, API calls that fail, and requests to localhost that only work on your laptop.
Vite and webpack dev servers, development builds of React and Vue, and public source maps.
Analytics, ad pixels and session recording that start before anyone says yes.
Privacy policy and terms (Stripe and Google sign-in ask for both), security headers, login cookies, and icon buttons screen readers can't name.
Our promise
A check is only useful if you can trust it, so these are rules we always follow.
This page has no trackers and no cookies. Read every rule we follow
Before you check
Yes. It's also how Nilabh Studio meets builders: some ask for a second pair of eyes, most don't, and that's fine. The report is the same either way, and you can share it with anyone.
It loads your homepage like one visitor, twice at most if the speed needs confirming. Your app makes the same requests it makes for anyone, nothing more. We never log in, submit forms or guess hidden URLs.
It's masked the moment it's found and the full value is never stored. On this website we also don't say which file it's in, so a report can't help anyone else find it. Search your code for the last four characters shown, then revoke the key and move it to your server.
Yes. We check what your visitors receive, however it was built. Some checks, like dev mode and preview tags, are written for exactly those setups.
Yes. Add two lines to your robots.txt: "User-agent: Plainsight" and "Disallow: /". We read it before every visit and won't open your site. Each site is also checked at most three times an hour, however many people ask.
Plainsight is made by Nilabh Studio in Bangalore: an engineer who works on performance and reliability for large systems, and who builds small, fast sites like travelescape.in on the side.
Under a minute. No sign-up.