Question 1

What is Scanlyz?

Accepted Answer

Scanlyz is an AI-powered website audit tool that scans publicly accessible websites for security header misconfigurations, WCAG/ADA accessibility violations, legal compliance gaps, SSL issues, cookie consent problems, and technical trust signals. It generates instant plain-language reports with prioritized fix guidance. No technical background required.

Question 2

Who is Scanlyz for?

Accepted Answer

Scanlyz is for digital agencies and professionals who need to deliver professional website reports to their clients quickly and efficiently.

Question 3

Is Scanlyz free to use?

Accepted Answer

Yes. Your first scan is completely free with no credit card required. You get an instant preview of key findings across security, accessibility, and compliance. Paid plans unlock full detailed reports, PDF downloads, multi-site management, and scheduled scans.

Question 4

Do I need to create an account to run a scan?

Accepted Answer

You can start a scan without an account. After your free scan preview, you'll need to create an account to access the full report, download PDFs, or save results for future reference.

Question 5

How do I scan my website?

Accepted Answer

Enter any publicly accessible URL into the Scanlyz scanner on the home page. No installation, no browser extension, and no code changes to your website are required. The scan runs automatically and delivers results within minutes.

Question 6

How long does a scan take?

Accepted Answer

Most scans complete within 1 to 3 minutes, depending on the size of the site and server response times. Large sites with many pages or slow servers may take slightly longer.

Question 7

Do I need to install anything or add code to my website?

Accepted Answer

No. Scanlyz is a fully hosted service. You do not need to install a plugin, add a script tag, or make any changes to your website. Simply enter your URL and Scanlyz handles the rest.

Question 8

What does Scanlyz scan for?

Accepted Answer

Scanlyz checks security headers (CSP, HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy), WCAG 2.1 and 2.2 accessibility violations, legal compliance signals (privacy policy, cookie consent, terms of service), SSL certificate health, mixed content, cookie security attributes, mobile responsiveness, Open Graph completeness, and technical trust signals.

Question 9

What security headers does Scanlyz check?

Accepted Answer

Scanlyz checks Content-Security-Policy (CSP), HTTP Strict Transport Security (HSTS), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and cross-origin isolation headers (CORP, COOP, COEP). Each header is rated by severity and comes with specific fix instructions.

Question 10

Does Scanlyz check for WCAG accessibility compliance?

Accepted Answer

Yes. Scanlyz checks for WCAG 2.1 and WCAG 2.2 accessibility signal violations including missing image alt text, incorrect heading hierarchy, color contrast failures, missing form labels, non-descriptive link text, missing language attributes, ARIA usage errors, keyboard navigation indicators, and missing skip navigation links.

Question 11

Does Scanlyz check for GDPR compliance?

Accepted Answer

Scanlyz checks the key technical GDPR signals: presence of a privacy policy, a cookie consent banner that fires before tracking scripts load, accessible data controller contact information, and cookie attributes that prevent unauthorized tracking. These are informational signals. Formal GDPR certification requires a separate legal audit.

Question 12

Does Scanlyz check SSL certificates?

Accepted Answer

Yes. Scanlyz checks SSL certificate validity and expiry, certificate chain completeness, weak cipher suite indicators, and mixed content issues (HTTP assets on HTTPS pages). Mixed content breaks the SSL padlock and triggers browser security warnings.

Question 13

Does Scanlyz check cookie consent banners?

Accepted Answer

Yes. Scanlyz checks whether a cookie consent mechanism is present and whether it appears to fire before tracking scripts load, as required under GDPR and CCPA. It also checks individual cookie attributes (HttpOnly, Secure, SameSite) for security misconfigurations.

Question 14

What trust signals does Scanlyz check?

Accepted Answer

Scanlyz checks mobile responsiveness, sitemap presence, robots.txt configuration, canonical URL setup, Open Graph tag completeness (og:title, og:description, og:image), Twitter Card tags, structured data (JSON-LD) presence, and broken internal links.

Question 15

How do I check if my website is WCAG compliant?

Accepted Answer

Enter your URL on Scanlyz. The scanner automatically checks for WCAG 2.1 and 2.2 violations including missing image alt text, incorrect heading hierarchy, color contrast failures, missing form labels, non-descriptive link text, and missing ARIA attributes. You receive a prioritized report with plain-language fix guidance for each issue.

Question 16

What is an ADA compliance checker for websites?

Accepted Answer

An ADA compliance checker scans your website for accessibility violations that could expose you to ADA Title III lawsuits. Under ADA Title III, websites open to the public must meet WCAG 2.1 AA accessibility standards. Scanlyz checks for the most common ADA accessibility failures: missing alt text, broken heading structure, color contrast issues, and inaccessible keyboard elements.

Question 17

Which WCAG version does Scanlyz check?

Accepted Answer

Scanlyz checks WCAG 2.1 Level A and AA in full, WCAG 2.1 Level AAA partially, and WCAG 2.2 including the new criteria: 2.4.11 (Focus Not Obscured), 2.4.12 (Focus Not Obscured Enhanced), 3.2.6 (Consistent Help), 3.3.7 (Redundant Entry), and 3.3.8 (Accessible Authentication).

Question 18

Can Scanlyz help me avoid ADA lawsuits?

Accepted Answer

Scanlyz identifies the most common technical accessibility failures that trigger ADA Title III litigation, including missing alt text, color contrast failures, form labeling issues, and keyboard accessibility gaps. Addressing these findings significantly reduces risk. However, Scanlyz provides automated informational signals, not formal legal certification. Consult a certified accessibility auditor for formal compliance documentation.

Question 19

What specific accessibility violations does Scanlyz find?

Accepted Answer

Scanlyz detects: images missing alt text (WCAG 1.1.1), incorrect heading hierarchy (WCAG 1.3.1), color contrast failures at AA (4.5:1) and AAA (7:1) thresholds, form inputs without labels (WCAG 1.3.1), non-descriptive link text like 'click here' (WCAG 2.4.4), missing HTML lang attribute (WCAG 3.1.1), incorrect ARIA roles and labels, and missing skip-to-main-content links (WCAG 2.4.1).

Question 20

Does Scanlyz check color contrast ratios?

Accepted Answer

Yes. Scanlyz checks foreground-to-background color contrast ratios against both WCAG AA (minimum 4.5:1 for normal text, 3:1 for large text) and AAA (7:1 for normal text) thresholds. Contrast failures are one of the most common and easily fixable accessibility issues.

Question 21

How do I fix missing security headers on my website?

Accepted Answer

Scanlyz identifies which security headers are missing or misconfigured. Each finding includes a plain-language explanation of the risk and specific fix instructions for Nginx, Apache, Cloudflare, and other CDN-level configurations. Common fixes include adding a Content-Security-Policy directive, setting HSTS max-age to at least 31536000, and adding X-Frame-Options: DENY.

Question 22

What is Content Security Policy (CSP) and why does it matter?

Accepted Answer

Content Security Policy (CSP) is an HTTP response header that controls which resources a browser is allowed to load on your page. A missing or overly permissive CSP is the leading vector for Cross-Site Scripting (XSS) attacks, where attackers inject malicious scripts into your pages. Scanlyz detects missing CSP headers and flags policies that use unsafe-inline or wildcard (*) directives.

Question 23

What is HSTS and why is it important?

Accepted Answer

HTTP Strict Transport Security (HSTS) is a header that tells browsers to always use HTTPS when connecting to your site, preventing SSL stripping and downgrade attacks. A missing or short HSTS max-age leaves users vulnerable to man-in-the-middle attacks on insecure networks. Scanlyz checks for HSTS presence, max-age value, and whether the includeSubDomains directive is set.

Question 24

What is X-Frame-Options and why does it matter?

Accepted Answer

X-Frame-Options prevents your website from being embedded in an iframe on another domain. Without it, attackers can use clickjacking to trick users into clicking hidden elements on your page; overlaying your login button with a transparent iframe is a classic example. Scanlyz detects missing X-Frame-Options and flags sites that can be freely framed.

Question 25

How do I check if my website has dangerous security gaps?

Accepted Answer

Enter your URL in Scanlyz. The scanner checks all major HTTP security headers, SSL configuration, cookie security attributes, and mixed content, which cover the main security risk vectors for most business websites. Each finding is rated by severity (critical, high, medium, low) so you can prioritize fixes.

Question 26

Does Scanlyz do penetration testing or vulnerability scanning?

Accepted Answer

No. Scanlyz checks publicly observable security signals (HTTP headers, SSL configuration, and cookie attributes) using non-intrusive, read-only methods. It does not perform active exploitation, injection attacks, or network-layer scanning. For penetration testing, you need a dedicated pen-test tool or certified security firm.

Question 27

How do I check GDPR compliance of a website?

Accepted Answer

Scanlyz scans for the key technical GDPR signals: presence of a privacy policy linked from the homepage, a cookie consent banner that fires before tracking scripts load, accessible data controller contact information, and cookie attributes that prevent unauthorized cross-site tracking. These are informational signals. Formal GDPR certification requires a legal audit by a qualified professional.

Question 28

What is CCPA and does Scanlyz check for it?

Accepted Answer

The California Consumer Privacy Act (CCPA) requires websites serving California residents to disclose data collection practices and provide opt-out mechanisms. Scanlyz checks for CCPA-relevant signals including privacy policy presence, cookie consent mechanism, and third-party tracking cookie exposure. These are technical signal checks, not a formal CCPA audit.

Question 29

Does Scanlyz check for a privacy policy and terms of service?

Accepted Answer

Yes. Scanlyz checks whether a privacy policy is present and linked from the homepage, a legal requirement in most jurisdictions (EU, UK, US, Australia). It also checks for terms of service presence and link accessibility. Missing privacy policies are flagged as high-severity compliance findings.

Question 30

What is cookie consent and why does it matter for compliance?

Accepted Answer

Under GDPR and CCPA, websites must obtain user consent before placing non-essential tracking cookies (analytics, advertising). A cookie consent banner must appear before any tracking scripts fire. Scanlyz checks whether a consent mechanism is present and whether tracking cookies appear to be set before consent is given, one of the most common GDPR violations.

Question 31

Does Scanlyz provide formal compliance certification?

Accepted Answer

No. Scanlyz provides automated informational scans based on publicly accessible technical signals. Results do not constitute legal certification, regulatory approval, or formal compliance documentation. A formal legal audit by a certified professional is required for regulatory certification under GDPR, WCAG/ADA, HIPAA, or PCI-DSS.

Question 32

Is Scanlyz a substitute for a legal or formal audit?

Accepted Answer

No. Scanlyz is a first-pass technical diagnostic tool. It identifies the most common technical gaps that would fail any formal audit, helping you prepare before engaging a certified auditor. Think of it as the pre-flight checklist, not the inspection itself. For regulatory certification, you need a qualified legal or compliance professional.

Question 33

What is the EU AI Act?

Accepted Answer

The EU AI Act (Regulation 2024/1689) is the European Union's risk-based framework for artificial intelligence. It sorts AI systems into tiers: unacceptable-risk uses that are banned outright, high-risk systems with strict duties, limited-risk systems with transparency obligations, and minimal-risk uses. It entered into force in August 2024 and applies in phases through 2026 and beyond. Scanlyz surfaces the publicly detectable signals related to it; it does not provide legal advice.

Question 34

What are the key EU AI Act deadlines?

Accepted Answer

The main milestones are: the Act entered into force on 1 August 2024; bans on prohibited AI practices applied from 2 February 2025; obligations for general-purpose AI models applied from 2 August 2025; and most high-risk system obligations apply from 2 August 2026. Timelines and guidance continue to evolve, so treat these as orientation, not legal advice, and confirm your own obligations with a qualified professional.

Question 35

What are the penalties under the EU AI Act?

Accepted Answer

Enforcement is tiered. The most serious breaches, such as using a prohibited AI practice, can carry fines up to 35 million euros or 7 percent of total worldwide annual turnover, whichever is higher. Other breaches carry lower caps. The exact exposure depends on the organization and the infringement, so specific risk assessment belongs with a qualified advisor.

Question 36

Does Scanlyz check for EU AI Act transparency requirements?

Accepted Answer

Scanlyz surfaces publicly detectable transparency signals relevant to the Act's limited-risk obligations, for example whether an AI chatbot or assistant appears to be disclosed as AI, and whether AI-generated or synthetic content looks labeled. These are informational signals based on what is visible on your public pages, not a formal audit or legal certification.

Question 37

What are prohibited AI practices under the Act?

Accepted Answer

The Act bans a set of unacceptable-risk uses, including manipulative or deceptive techniques that distort behavior, exploitation of vulnerabilities, untargeted scraping of facial images to build recognition databases, social scoring, and certain biometric categorization and emotion-recognition uses. Most of these are backend practices that a public-page scan cannot fully observe, so Scanlyz frames them as awareness signals to review with counsel.

Question 38

What counts as a high-risk AI system?

Accepted Answer

High-risk systems include AI used in areas such as biometric identification, critical infrastructure, education and exams, employment and recruitment, access to essential services and credit, law enforcement, migration, and the administration of justice. These carry duties like risk management, data governance, human oversight, and documentation. Scanlyz raises this as educational awareness; whether a system is high-risk and what it must do is a determination for a qualified professional.

Question 39

Is Scanlyz a substitute for an EU AI Act legal assessment?

Accepted Answer

No. Scanlyz provides automated informational signals based on publicly accessible content. It can help you spot obvious transparency gaps early, but it does not determine whether the Act applies to you, classify your systems, or produce compliance documentation. A formal assessment requires a qualified legal or compliance professional.

Question 40

What does the free scan include?

Accepted Answer

The free scan includes an instant preview of key findings across security, accessibility, and compliance categories. You can see which areas have issues and their severity levels. No credit card is required. To access the full detailed report with every finding, fix guidance, and downloadable PDF, a paid plan is required.

Question 41

What does a paid plan unlock?

Accepted Answer

Paid plans unlock: full detailed reports showing every finding with plain-language explanations and fix guidance, PDF download for sharing with teams or clients, multi-site management from a single dashboard, and scheduled recurring scans. Agency plans also include white-label PDF branding for client delivery.

Question 42

Can I download my audit report as a PDF?

Accepted Answer

Yes. Paid plan subscribers can download full audit reports as professionally formatted PDFs. Agency plan subscribers can white-label these PDFs with their own branding for client delivery.

Question 43

What is the difference between the Starter and Business plans?

Accepted Answer

The Starter plan is designed for individual developers and freelancers managing a single website, with full reports and PDF downloads. The Business plan supports multiple sites, scheduled recurring scans, and team access, suited for SMBs and growing teams that need ongoing compliance monitoring across several properties.

Question 44

How do I upgrade my plan?

Accepted Answer

You can upgrade your plan from the billing section of your Scanlyz dashboard at any time. Upgrades take effect immediately. If you have questions about which plan fits your needs, contact us at the contact page and we'll help you choose.

Question 45

Does Scanlyz work for agencies managing multiple client websites?

Accepted Answer

Yes. Scanlyz Agency plans are built for digital agencies and consultancies managing compliance audits across multiple client websites. Features include bulk site management, white-label PDF reports branded for client delivery, and multi-site oversight from a single dashboard.

Question 46

Can I manage multiple websites from one dashboard?

Accepted Answer

Yes. Business and Agency plans include a multi-site dashboard where you can track scan history, compliance status, and findings across all your websites in one view. You can add new sites, view past reports, and monitor for regressions over time.

Question 47

Do you offer white-label PDF reports for client delivery?

Accepted Answer

Yes. Agency plan subscribers can generate white-label audit PDFs with their own agency branding. These are designed to be shared directly with clients as part of a website audit service, maintenance retainer, or pre-launch checklist.

Question 48

Can I schedule recurring scans for client websites?

Accepted Answer

Yes. Business and Agency plans include scheduled recurring scans so you can automatically monitor client websites for new compliance issues, security header regressions, or SSL expiry without running manual scans each time.

Question 49

What is the difference between Scanlyz and Google Lighthouse?

Accepted Answer

Google Lighthouse is a developer browser tool that checks performance, basic SEO, and partial accessibility. It does not check security headers (CSP, HSTS, X-Frame-Options), cookie consent banners, privacy policy presence, or legal compliance signals. Lighthouse is a local browser tool requiring Chrome DevTools; Scanlyz is a hosted service requiring only a URL, and generates shareable PDF reports with AI-powered plain-language explanations.

Question 50

What is the difference between Scanlyz and WAVE?

Accepted Answer

WAVE (by WebAIM) is an accessibility-only tool. It does not check security headers, SSL certificates, cookie consent, legal compliance signals, or trust factors. WAVE requires a browser extension or manual URL submission with no batch capabilities. Scanlyz covers all of these categories in one scan and generates AI-written fix guidance without requiring any browser setup.

Question 51

What is the difference between Scanlyz and Qualys SSL Labs?

Accepted Answer

Qualys SSL Labs tests SSL and TLS certificate configuration only: cipher suites, certificate chain, protocol support. It provides no accessibility checking, compliance signals, security header analysis, or broader website audit coverage. Scanlyz includes SSL checking as one of several scan categories alongside security headers, accessibility, and legal compliance.

Question 52

What is the difference between Scanlyz and Detectify?

Accepted Answer

Detectify is an enterprise-grade attack surface management platform starting at approximately $300 per month, oriented toward penetration testing and security operations teams. It does not cover WCAG accessibility, cookie consent, or legal compliance signals. Scanlyz is affordable, self-serve, and designed for non-security-specialist users including developers, agencies, and compliance teams.

Frequently Asked Questions