DEV Community

Amit Feldman
Amit Feldman

Posted on

I built a one-command website auditor because discovery calls were eating my afternoons

#automation #freelance #productivity #python

The discovery-call scramble

If you freelance or run a small agency, you know this moment: a prospect gets on a call and asks, "So what's wrong with our current site?" And you need a credible, concrete answer — not "well, I'd have to dig into it," and not forty minutes of manually opening dev tools, checking headers with curl, running PageSpeed, and eyeballing the source for a meta description.

I got tired of the scramble, so I wrote it down as a checklist, then turned the checklist into a script. It's called siteprobe: one Python file, zero dependencies, standard library only. Point it at a URL and it audits the things clients actually care about — speed, security headers, TLS certificate, and on-page SEO — in about five seconds. Add one flag and it emits a polished HTML report you can attach to a proposal.

python3 siteprobe.py https://example.com
Enter fullscreen mode Exit fullscreen mode

No install, no API keys, no accounts. Python 3.9+ is the only requirement.

What one run actually tells you

Speed, broken down usefully. "Your site is slow" is useless; "your TLS handshake is 800ms because the cert chain is misconfigured" is a fix. siteprobe measures with raw sockets and reports each phase separately:

⏱ Timing
  DNS resolution     12 ms
  TCP connect        34 ms
  TLS handshake      87 ms
  Time to first byte 412 ms
  Total              545 ms
Enter fullscreen mode Exit fullscreen mode

Security headers, with fixes. It checks the six headers on every audit checklist — HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy — and every missing one comes back as a PASS/WARN/FAIL finding with copy-paste fix advice, not just "missing."

TLS certificate expiry. Issuer, expiry date, days remaining, negotiated protocol and cipher. It warns under 30 days and fails on expired. If you've ever had a client's site go down because nobody tracked a cert renewal, you know why this is its own line item.

On-page SEO signals. Title tag (with length check), meta description, H1 count, images missing alt attributes, canonical link, viewport meta — plus live checks that /robots.txt and /sitemap.xml actually exist and respond.

The terminal output ends with a summary count, so a run looks like:

✓ 9 passed   ⚠ 3 warnings   ✗ 2 failed
Enter fullscreen mode Exit fullscreen mode

Follows redirects automatically too (up to 10 hops, with the per-hop status codes shown), so python3 siteprobe.py http://github.com tells you the whole story of the redirect chain.

The part that's actually worth paying for

The terminal audit is nice. The deliverable is the point:

python3 siteprobe.py https://client-site.com --html report.html
Enter fullscreen mode Exit fullscreen mode

--html writes a self-contained HTML report — inline CSS, no external assets, no branding to strip out — with styled tables and an overall verdict banner at the top. It's designed to be forwarded to a client or attached to an invoice exactly as it lands on disk. The discovery-call scramble becomes: run one command before the call, attach the report to the proposal after it.

It's also cron/CI-friendly. Exit codes are 0 (all passed), 1 (warnings only), 2 (at least one failure), so a weekly cron job that re-audits your client sites and alerts on exit code 2 is about four lines of crontab. That turns a one-off audit into ongoing monitoring — cert expiry warnings especially.

Honest limitations

  • It's not a crawler. siteprobe audits the URL you give it (plus robots.txt and sitemap.xml). It doesn't spider the whole site, so per-page SEO issues on page 47 won't show up.
  • TTFB, not full rendering. The timing is server response, measured with raw sockets. It doesn't run a headless browser, so Core Web Vitals, layout shift, and JS-bundle bloat are out of scope — that's Lighthouse/PageSpeed territory, and the two tools complement each other fine.
  • Header checks are presence-and-sanity, not policy review. It will tell you CSP is missing; it won't audit whether your existing CSP is well-designed.
  • Single URL per run. Script it in a loop if you want a batch; there's no built-in site list mode.

Getting it

siteprobe is $12 (pay-what-you-want, $12 minimum) on Gumroad: https://afeldman2.gumroad.com/l/chwsxj?utm_source=devto&utm_medium=article&utm_campaign=siteprobe-launch

You get the single MIT-licensed Python file plus a test suite that spins up a local HTTP server and covers fetching, timing, redirects, header detection, SEO parsing, and HTML report rendering — no network needed to verify it works. If one audit report helps you close one proposal, it's paid for itself several times over.

Top comments (0)