Read-only · six disciplines · evidence on every finding

The independent record of what a website actually does.

A security questionnaire to answer. A demand letter to scope. A portfolio you did not build. One read-only scan returns every finding with the page it sits on, the element behind it, and how sure we are.

Free, read-only, results in minutes. By scanning you confirm you’re authorized to scan this site and agree ClearSite retains results for de-identified industry research. See a sample report.

  • Privacy & tracking
  • Search & findability
  • Security posture
  • Accessibility
  • Speed & mobile
  • Claims & trust
Accessibility · Form accessibilityconfidence 85/100
High

Form fields without labels on 1 page(s) — unusable with a screen reader

What we saw/contact — 1 field with no programmatic label (no <label>, aria-label, or equivalent).
Why it mattersA form is where a visit turns into an enquiry. A field with no label is announced as “edit text”, so someone using a screen reader cannot tell which box wants their phone number — and the enquiry never arrives.
Next stepAssociate every field with a visible <label for=…> (or aria-label where a visible label is impossible); placeholders alone do not count.
Certainty observed · regulatoryRule WCAG 1.3.1 / 4.1.2Verify re-scan after the change

A real finding, in the product’s own words, from a 2026 scan of a medical practice’s public site. The site is not named.

6disciplines, one read-only pass
10rule packs, every finding with its evidence
26regulatory sources watched daily
25regulations tracked with a status
33enforcement actions on record, 28 verified
Noneinstalls, tags, or logins required

Four steps, start to finish

Type your web address

That’s all we need. Nothing to install, no code on your site, no account to start.

We read your site like a visitor would

A real browser loads your pages and records what actually happens — every request, form and header.

Your report is ready in minutes

What we found, where we found it, and what to do about it — in plain English, with the evidence.

You fix it. We check your work.

Re-scan when the changes are in, and every item on your plan comes back with a verdict. Nothing is marked closed just because we stopped looking.

Who it is for

Built for the people who answer for a site they did not build.

The report is an asset to the person who needs it to exist — the one whose deal, matter, or portfolio depends on knowing the real state of a website today.

Vendor readiness

A buyer just asked for WCAG on the security questionnaire.

You sell into health systems, and the vendor review wants an accessibility answer you cannot give from memory — plus the privacy and security questions on the same form.

You get: every page of your public surface, the accessibility defects with the element that fails, the headers and third-party requests, and a plain statement of what an automated scan cannot determine.

Counsel

The letter lists five barriers. You need the real number, on every page, this week.

A demand letter cites a handful of defects on one page. Before you answer you want the whole surface, evidence you can hand to a developer, and a re-scan that shows what closed.

You get: the finding, the page, the element, the confidence, and after the fix a dated verification of every change on the plan you were handed — scored against that plan, so the work you finished does not vanish because you finished it.

Portfolio owner

You bought forty practices. You own whatever their websites have been sending to third parties since 2019.

A roll-up, a franchise, a health system with seventeen sites and no instrument. You need one baseline across all of them and a monthly record that it is moving.

You get: per-site reports, monitoring that alerts when a new third party appears or a fix regresses, and a change report that compares only what both scans checked.

How it works

A real browser, one pass, and a finding you can check yourself.

No install, no tag, no access to your hosting. We load the public site the way a visitor’s browser does, record what happens, and write each finding the same way.

  1. We load your pages in a real browser

    Every request, cookie, storage write, header, DNS and TLS detail, the served HTML and the rendered page — across your site, not one URL. The crawl honours robots.txt and crawl-delay, and it reports its own coverage: pages reached, pages that answered with an error, pages left unvisited.

  2. What we saw

    The observable fact, with the page and the element, request or header behind it. If we did not observe it, it is not a finding — things we cannot see from outside (a signed vendor agreement, a server setting) are marked verify, never asserted.

  3. Why it matters, and how sure we are

    Each finding carries a severity, a confidence out of 100, and whether the fact was observed or inferred. Regulated disciplines roll up to a band, never a number.

  4. The rule it touches, and the record

    Where an obligation exists we name it and its status; where an enforcement action has cited the same pattern on another site, we attach it — as context from the public record, never a verdict on yours.

  5. What to do, then proof it landed

    A technical next step, ordered into a worklist. Make the change, re-scan, and each item reads closed, partly done or still open — or not checked, when a re-scan could not cover the same ground. Monitoring repeats this on a schedule and tells you when something new appears.

Accessibility · Form accessibilityconfidence 85/100
High

Form fields without labels on 1 page(s) — unusable with a screen reader

What we saw/contact — 1 field with no programmatic label (no <label>, aria-label, or equivalent).
Why it mattersA form is where a visit turns into an enquiry. A field with no label is announced as “edit text”, so someone using a screen reader cannot tell which box wants their phone number — and the enquiry never arrives.
Next stepAssociate every field with a visible <label for=…> (or aria-label where a visible label is impossible); placeholders alone do not count.
Certainty observed · regulatoryRule WCAG 1.3.1 / 4.1.2Verify re-scan after the change

The same finding, as it appears in the report and the portal.

What you receive

A document, a portal, and a record over time.

The report

A designed PDF with a cover, contents and page numbers — a verdict-first summary, then one chapter per discipline, then the ordered worklist. Two voices in one document: plain English for the general findings, counsel-adjacent for the regulated ones.

  • Every finding with evidence
  • What we checked and found clean
  • What we did not check, stated

The portal

Where you stand, one page per discipline with the evidence behind the verdict, your documents, and the fix worklist. Built to be handed to a developer, a vendor, or a board.

  • Six discipline pages, category by category
  • Evidence tab per discipline
  • Verified-fix re-scan

Monitoring

Weekly re-scans anchored to your first scan, an email when something changes, and a change report that compares only what both scans checked — so a fix that landed reads as closed and nothing else pretends to.

  • New third party or tracker on a page
  • Fix regressed
  • Regulatory movement in your world

Verification

After the fix, we check your work.

A list of problems is easy to sell and easy to ignore. Re-scan once the changes are in and every item on the plan you were handed comes back with a verdict — scored against that plan, so the work you finished doesn’t disappear from the report because you finished it.

Closed

None of the findings behind this change are observed any more.

Partly done

Some are gone, some are still there. We name which.

Still open

Every finding behind it is observed exactly as before.

Not checked

This scan could not compare it. We withhold the count rather than guess.

“Not checked” is not a fourth verdict. It is the absence of one — which is why it is the only outlined chip in the product. A finding can disappear for two very different reasons: it was fixed, or we didn’t look at it this time. Reporting the second as the first would tell you that work you never did is done, so a change is never marked closed by silence. Monitoring then repeats the same comparison on a schedule and tells you if something you closed comes back.

What we are measured against

The tools that define each discipline, run as our referees.

Each of these is single-purpose and mostly looks at one page at a time. We benchmark check-by-check against each tool’s own published catalogue, on every page, in one pass.

Accessibility
axe-core, IBM Equal Access, Lighthouse, HTML CodeSniffer
both major open-source engines — axe-core is what most accessibility tools run underneath
Privacy
Blacklight, Disconnect, DuckDuckGo Tracker Radar, WhoTracks.me
+ eight things none of them report: whether the consent banner actually stops the tracking
Security
Internet.nl, SSL Labs, Mozilla Observatory, securityheaders.com, retire.js + OSV.dev
the Dutch government’s standards test — it reaches DNS and the TLS handshake, not just headers
SEO
Screaming Frog, Google Lighthouse
the crawler every SEO knows, measured against its full published issue list
Performance
Google Lighthouse, CrUX field data
the audit set behind PageSpeed Insights and GTmetrix, plus what real visitors actually experienced
Claims & Trust
the FTC / FDA / DOJ enforcement record
the one pillar no other scanner benchmarks at all

We hold a measured, check-by-check coverage figure for every tool named here and will walk you through it on request — it belongs in a technical review, not a headline. Accessibility is the machine-detectable subset of WCAG; no automated tool covers all of it.

The only audit that doesn’t pretend compliance is a number

Regulated risk is reported as a qualitative band — a verdict, not a false precision. Findability and speed, where a number is honest, get a 0–100 score. You see both, side by side, and nothing is averaged into one grade.

CriticalHighModerateLow

Straight answers

What we can tell you, and what we can’t.

Each of these is a sale available by saying yes. Here is why we say no instead — and what you get in its place.

So are we compliant?

We can’t answer that, and nobody scanning from the outside can. It depends on things we cannot see — your internal policies, your vendor agreements, how the product behaves behind a login. What we can tell you is exactly what we observed, on the pages we scanned, on the date we scanned them. That is the input to the decision. Your counsel makes the decision.

Can you give us a VPAT?

No, and here is why rather than talking around it. That document needs manual testing by a qualified evaluator, because automated tooling reaches only part of WCAG. Anyone selling you a scan as one is selling you something that will not survive a procurement review. If you need it, we will introduce you to a shop that does them properly.

Will this stop a lawsuit?

No, and we would not sell it that way. What it does is find and document the defect classes that turn up in these matters, so you can fix them and show your work. Anyone promising you more than that is promising something they cannot deliver.

Pricing

Start free. Pay when you want the detail.

Every plan includes all six disciplines. What changes as you go up is how often we look, and how deeply we read what we find.

$0

The scan

A real scan of your key pages: the verdict, the counts by severity and area, and the scores.

Run a free scan

$99/mo

Monitoring

Weekly re-scans, a change report each run, and an email when something moves. Priced per site; cancel any time.

Compare the plans

Portfolios, agencies and aggregators: email us and we’ll scope it with you. Full pricing, and what each plan adds →

What this is, and isn’t. ClearSite reports observable technical facts about a website with a confidence level for each finding. It does not determine legal compliance, does not assert violations of any law, and is not legal advice. Items we can’t observe from the outside (such as whether a vendor has signed a Business Associate Agreement) are flagged to verify, never asserted. Remediation offers are technical changes, not legal outcomes.

See what your website actually does.

One read-only scan. Minutes. Nothing to install.