What does your shop do before a visitor says yes?
Enter your shop's address. Our check browser opens the homepage and one product page, just like a regular visitor. About a minute later you get a traffic light per area and your three most important findings in plain language.
Anonymous, no sign-up. Want the short report as a PDF? We'll e-mail it on request.
Four areas. One traffic light each.
Tracking
Which tags load: GA4, Tag Manager, Meta, Google Ads, TikTok. And whether any tag loads twice or counts twice on page view.
Consent setup
Does data flow to tracking services before a visitor consents? We never click the banner, so we see exactly what happens without a yes.
Performance
Load time and Core Web Vitals: our own measurement plus, where available, data from real Chrome users.
Basics
Shop system, browser console errors, HTTPS redirect and security headers.
Technical risks
Exposed keys and libraries with known vulnerabilities. Publicly we only say whether we found something. The details are part of the Shop Check.
What the self-check won't do.
The check behaves like a single visitor. It doesn't strain your shop and changes nothing.
No orders, no checkout tests
No form submissions, no logins
No clicks on the cookie banner
Three page views per check, tops
At most one fresh check per domain per day; later requests get the existing result
Questions you might have
Does the self-check cost anything?
No. It's free, no sign-up needed. If you want to dig deeper, the Shop Check comes with a price and an order form.
Who can see my result?
Anyone with the result link. The link is random and can't be guessed, and search engines don't index it. We delete the result after 30 days.
Why don't you show security findings?
Anyone can enter any address. A tool that reveals other people's security holes would be a how-to for attackers. So publicly we only say whether we found something. The details are part of the Shop Check.
What do you store?
The address you checked, the result and a pseudonymised identifier of your IP address for abuse limits, never the IP address itself. If you request the report by e-mail, your e-mail address too. Everything is deleted after 30 days. See the privacy policy for details.
What happens to the domain I checked?
We add checked shops to our ongoing observation of public shop signals (Profit Guard). For that, our scanner regularly opens a few public pages. We don't process data about the shop's visitors or customers. If you'd rather opt out, just drop us a line.
Why do I have to confirm that it is my shop?
The self-check is meant for shop owners and the people working for them. By confirming, you declare that you're allowed to have the shop checked.
How reliable is the result?
It's an automated snapshot from the viewpoint of a visitor who hasn't consented, measured from a data centre in Germany. It's neither legal advice nor a complete audit.