“No docs, no tests, and the person who built it left.”
Start with the technology list, the map of pages read, and the proposed functional cases. In one read you know what is under the hood and where to begin.
A guided tour
Your page is already talking. Here is how we listen.
Every public page says a lot before anyone writes a test: what it is built with, what search engines and AI assistants can read, what it tracks, how it protects visitors, who it leaves out, and how fast it answers. QA-lab URL Review writes that down for you, then proposes the test cases your team would want on paper before shipping.
This tour takes about five minutes. No sign-up is needed to read it.
Who it is for
Maybe one of these sounds like your week
A review is most useful when somebody has to make a decision about a site they did not build, or did not build recently.
“The build is green. Does the public page still read right?”
Run it on the staging or production address the day before. The fix-first list tells you what is worth fixing now and what can wait for the next sprint.
“Marketing asked if ChatGPT and Perplexity can cite our site.”
The GEO score and the AI crawler matrix show which assistants your robots.txt lets in, and the text they see when JavaScript does not run.
“Playwright or Cypress? We have not written a single test.”
Pick the frameworks you already use or are considering. Every proposed case comes with a starting script for each one, so the team compares on real cases, not opinions.
“I need a clear, honest first look before I quote.”
Review your client's public site with their address and your reason. The report is a snapshot and a proposal that you can walk through with them, never a certification.
“Do we track people before they say yes?”
A headless browser records the tags that fire before and after it presses Reject on your cookie banner, once. You see what loads without consent.
The five-minute tour
From the first checkbox to the last export
-
Read what the review will and will not do
Every control on the review page stays off until you accept the disclaimers. They take a minute, and they explain the rules for Colombia, where the service is operated, and for the country of the site you submit. Why we ask: a review reads someone's public pages. You should know exactly what happens before a single address is opened. -
Say who is asking
Give your name, an email at the same domain as the site, and the reason for the review. If you review a client's site, add the client's name, email, and website. Why we ask: there is a record of who asked, a site owner can ask us to stop and delete the report, and you can ask for a copy or deletion at any time. -
Paste one public address and pick your frameworks
One https address, plus the frameworks your team uses: Playwright, Cypress, Robot, Selenium, WebdriverIO, CodeceptJS, Selenide, TestNG, Watir, Cucumber, Behave, Reqnroll, Jest, Vitest, Mocha, Appium, Maestro, JMeter, Gatling, or k6. Tip: choose only the frameworks you would really run. Fewer frameworks make the export easier to read. -
Watch the read happen
The review reads up to twenty pages, two links deep. It opens up to three of them in a headless browser from an EU address, runs axe-core, checks phone and tablet widths, keeps three screenshots, and asks Google PageSpeed Insights to score the start page. Good to know: in that browser it presses a cookie banner's reject button once and nothing else. Google receives the start address for the PageSpeed score. -
Read your report
Six scores from 0 to 100: SEO, GEO, analytics, security, accessibility, and performance. Every check is marked fails now, at risk, passes, or needs a person, with the evidence, a fix, and an effort estimate. You also see your Google result, your share card, a map of the pages read, and what to fix first. Remember: the report is shown once. Take your notes, or keep it, while it is open. -
Take the cases home
Export the proposed cases to a ZIP of automation scripts, Excel, TestRail, Xray, Zephyr Scale, Jira, Azure Test Plans, MantisBT, JSON, plain text, or PDF. The export also brings a GitHub Actions workflow and a fix kit with header files, a Report-Only content security policy, and drafts for structured data, llms.txt, security.txt, and DNS records. The scripts are yours to run. The review never runs them against your site.
How to read the report
We reviewed ourselves first
These are the real scores from this site's own review on October 19, 2026: ten pages read, 72 cases proposed, overall 86 out of 100. It is the same report you can open as the sample report. To compare, the live reports show the same review on more than a hundred public sites.
What the four marks mean
Fails now is a problem a visitor or a crawler can hit today. At risk works, but is fragile or incomplete. Passes is done well, and worth protecting with a test. Needs a person is a judgment a machine should not make for you, such as whether a third-party script is worth its weight.
Where to start
Read the fix-first list from the top. It ranks findings by how much they hurt and how little they cost to fix. Our own weakest area was security, at 54. The six fixes at the top were all response headers, a few lines of configuration each.
Care for your site
What a review will never do
The review reads what any visitor can read. That is the whole point.
Sign in
It never asks for or stores a password.
Submit forms
Your contact form and checkout stay untouched.
Generate load
No load tests and no bots hammering your pages.
Run the cases
It proposes them. Running them is your call.
Tips from real reviews
Small things that keep showing up
Security headers are cheap
HSTS, nosniff, Referrer-Policy, and frame protection are configuration, not code. Many hosts let you add them in an afternoon.
AI search reads without JavaScript
If your key facts only appear after scripts run, many answer engines never see them. Put the facts in the HTML.
Consent means before, too
Check what loads before the visitor chooses. A tag that fires before Reject is the most common analytics finding.
Your share card is a first impression
A missing og:image turns every shared link into a grey box. The report shows the card people actually see.
Accessibility is a test, not a feeling
axe-core findings come with the element and the rule. Turn the passing checks into tests so they stay passing.
Speed is per page
The report shows milliseconds for each page in the order it read them. The slowest page is rarely the home page.
Questions people ask
Before you start
How much of a site does the first review read?
Your first review is included: up to twenty pages, two links deep. A wider or deeper read asks for payment before it starts, and you see the amount first.
Can I review a site I do not own?
You can review any public https address with a real reason, and the email domain check records who asked. A site owner can ask this service to stop and to delete the report. Please do not republish their content from a shared report.
Is the score a certification?
No. The report is a snapshot and a proposal from one public read. It is not proof that a site is safe, fast, or compliant.
What about signed-in pages?
The public review never signs in. A verification that runs cases behind a login is a separate request to [email protected], with a login you are allowed to use.
Which languages can I read it in?
The review page is written in English and can be read in Spanish, Portuguese, German, French, and Italian.
Let your page do the talking
One public address. Six scores. A list your team can start from on Monday.