The brief
Most small business owners find out their site is broken when a customer mentions it. Most customers don't mention it. They just call the next place. We wanted a free way in that answers one question in about a minute: what is wrong with my site right now. No card, no sign-up, no sales call, and it only reads the public homepage.
It is also the front door to two paid offers. Anything it finds can be fixed at a fixed price, and a site that comes back clean gets pointed at the nightly Watch plan.
What we made
- A check page at givemeprompts.com/check with one address field and one button
- A checking engine that reads the homepage and tests up to 20 of its own links
- Plain-English findings, problems first, each one with its fix and price next to it
- A score out of 100 (6 points off for each thing to check, 15 for each real problem)
- A results button that fills in the contact form with the exact list of problems
- Six unit tests, all passing on 2026-11-04
How it works
The engine runs as a serverless function behind /api/check. It follows up to six redirects, then looks at the status code, HTTPS and the http-to-https redirect, the browser security headers and cookie flags, how fast the homepage answered, the phone setup tag, the title and search description, image descriptions, forms, tap-to-call links and files loaded over insecure http. Then it requests up to 20 same-site links. If the whole check runs past 25 seconds, it stops and says so.
It only reads, and it refuses anything that isn't a public website: IP addresses, localhost, internal names, odd ports, addresses with a password in them. Each connection gets 10 checks per 10 minutes. Missing security headers come with a line saying the site has not necessarily been hacked, because scaring an owner is a bad way to start.
We ran it on our own site on 2026-11-04. It scored 94: one thing to fix (no form on the homepage), two notes and eight passes, and all 20 links it tested worked.
The results then branch three ways. If there are problems, the owner sees "Want these fixed?" and the contact form arrives with the list already written. A clean site gets the Watch plan. A site that blocks robots gets a free check by hand.
What we threw away
The first version believed every error code. We ran it over 555 local business homepages and it reported 81 of them as returning an error. They weren't down. Every one of those 81 answers was a 403, 429 or 502, the codes a firewall or bot wall sends a script, not what a person in a browser sees. The broken-link count had the same fault.
So the rule became: only report what a visitor would also get. When a site answers with a wall, the engine tries again as a normal browser, and if the wall stays up it says the site blocks automated checks and offers a hand check. Only 404, 410 and 500 count as a broken link. Timeouts and bot walls don't. On the second pass over the same 555 homepages, 44 of the 81 loaded fine, the other 37 were reported as blocking checks, and 52 of the 90 broken-link failures went away.
Limits
It reads the homepage only, and it reads the raw HTML without running JavaScript. A site that adds its phone setup tag with JavaScript gets a warning it may not deserve, and the finding says so. It can't read certificate expiry dates. The speed figure is how long the homepage took to answer the server running the check, not a full page-load test. The rate limit is held in memory, so it is light protection. The 555-site figures come from our own outreach scan and no business from it is shown. The screenshots show the real page and the real engine, run on our machine against our own site, because we did not submit the public form for this write-up.
