SEO & GEO
Why the site is not being found — in classic search, locally, and in AI answer engines. Its own run, its own report.
Free website check — no sign-up
Website check: SEO, GEO, security, privacy and accessibility
Is your site found on Google? Does it show up in answers from ChatGPT and Perplexity? Does it load trackers before anyone agreed? Does it meet the European Accessibility Act? Enter the address — first answers in about half a minute.
Before you start
Is my data stored?
Stored are the address you entered, your declaration, the time and the result — for 30 days. After that a nightly run deletes them. Your IP address is not stored: a checksum is derived from it so the number of requests per visitor can be limited, and the address cannot be reconstructed from that checksum.
Will the check disrupt my site or my shop?
No. The home page is fetched once, the way a visitor fetches it. No load test, no injected input, no login attempts, no checkout flow. You do not need a maintenance window for it.
What will I see in my server log?
One request carrying an identifier that names conct. What the request was, why it happened and how to object is set out on the Scan traffic page.
May I enter someone else's website?
No. By submitting you declare that you are responsible for the site or act on behalf of the responsible party. That declaration is recorded together with the address and the time — it is the evidence that the request was authorised.
Is the number a grade?
No. 0 means nothing was found within this scope. The number is good for comparing one site with itself over time, not for comparing two sites — they differ in size, in technology and in what the law requires of them.
What does it cost, and where is the catch?
Nothing, and there is none. The scope is deliberately small: one page, only what a visitor triggers anyway, and only findings that cannot serve anyone as instructions. Everything beyond that is the commissioned audit.
- individual checks across three separate profiles
- 97 individual checks across three separate profiles
- separate reports: security and privacy, discoverability, accessibility
- 3 separate reports: security and privacy, discoverability, accessibility
- trackers, cookies and scripts on conct.de
- 0 trackers, cookies and scripts on conct.de — we check others for this, so we run none on our own site
What the quick check covers
What the quick check covers
- Transport encryption: HTTPS reachable, redirection from HTTP, certificate validity and remaining lifetime
- Security headers and cookie attributes
- Third parties and cookies loading before any consent
- Google Fonts served from foreign servers
- Indexability, title, headings and the basics of discoverability
- Whether robots.txt blocks generative crawlers
What only a commissioned audit does
- The active requests for publicly reachable configuration and backup files — those need explicit authorisation in the engagement
- Credentials in shipped frontend code, CORS misconfiguration, stack traces and matching against vulnerability databases
- The comparison between the services that demonstrably load and the ones your privacy policy names
- The WCAG accessibility audit with 21 individual checks, and ten more at the extended level
- A report with location, evidence and a concrete fix for every finding
Why the quick check holds back
It fetches your page exactly the way any browser does — and nothing beyond that. Anything that actively probes requires an engagement; there is deliberately no switch here that bypasses it. Please only check sites you are responsible for. The result is shown to you and not published.
The four audits
Security and privacy run together in a single pass. Discoverability and accessibility have their own runs and their own reports — different trades with different people, and nobody should have to scroll past findings meant for someone else.
-
-
Security
Transport encryption, security headers, exposed credentials and known vulnerabilities in detected libraries — tested against what the server gives away by itself.
-
Privacy
What loads before any consent, which cookies get set — and whether your privacy policy names the services that demonstrably run.
-
Accessibility
WCAG and the German Accessibility Act in two levels: 21 checks in the standard run, ten more when the page is actually operated.
How an audit runs
No onboarding project, no agent on your servers. What we need is a domain and a signed engagement.
-
Engagement and authorisation
No scan runs without an entry in the audit scope — there is deliberately no override switch. Which domains are released, and whether the active path requests are included, is named in the engagement text rather than buried in the small print.
-
Collection in a single pass
A real browser opens the page, alongside HTTP, TLS and DNS. All raw data is fetched once; the individual checks work on that without making requests of their own. That keeps the load on your system small.
-
Report
Two files per run: a self-contained HTML report that loads not a single resource from a foreign server, and a JSON file as a machine-readable basis. Findings sorted by weight, each with location, evidence and a concrete fix.
-
Review before it goes out
Every report is read before it is sent. Findings that miss the mark get marked as such — the system remembers, and grows more accurate with every finding that is judged.
Why it works this way
-
No report goes out unread
The checks run by machine — that makes them thorough, repeatable and affordable. The report itself is read by a human before it reaches you. Findings that miss the mark are marked as such and flow back into the rule set. You get a reviewed list, not a scanner dump.
-
Evidenced, not asserted
Every finding names the location, the evidence and a concrete fix. The most persuasive one in practice is the comparison between the services that demonstrably load and the ones your privacy policy names — concrete, verifiable and fixable without argument.
-
Traceable, not trained
Deliberately no trained model. For an audit we stand behind, every finding has to be justifiable; an assessment without a traceable reason is worthless in a dispute. Instead a rule set whose state is readable as a file at any time.
-
The line is not crossed
No fuzzing, no injected input, no login attempts, no load testing. Every check establishes what the server gives away or permits by itself. That is why the scan runs without a maintenance window and without a liability discussion.
-
More accurate with every audit
A hit rate is computed continuously for each check and folded into the assessment. A check that regularly misses stands out by itself — before it spoils a client meeting.
Where the audit reaches its limit
Machine testing reliably finds what is testable — and only that. A scanner spots a missing alternative text but not whether an existing one meaningfully describes the image. It sees a tracker firing before consent but not whether a given processing rests on a different legal basis. For accessibility, machine testing covers roughly 30 to 40 per cent of the success criteria, 55 to 65 at the extended level. The homepage is what gets audited, not the whole site, and areas behind a login are invisible to the tool. All of that is in every report — a report claiming completeness is the more dangerous product.
State, not guesswork
Tell us the domain and what the evidence is needed for — we will come back with a proposed scope.
Get in touch