What does QA-lab URL Review do?

You sign in on the device you run it from, with email or an account you already have (Google, Microsoft, GitHub, Yahoo, or X). QA-lab URL Review then fetches a public https address, describes the response, and proposes test cases. It does not run those cases, sign in to your site, submit forms, or generate load.

Do I need to sign in?

Yes. You sign in on the device that runs the review, with email (a 6-digit code or a link, valid for 15 minutes on the same device) or an account you already have: Google, Microsoft, GitHub, Yahoo, or X. Your email comes from that sign-in. Signed-in runs are listed on your account page.

What does the report score?

Six areas from 0 to 100: SEO, GEO (whether AI search and answer engines can read and cite the site), analytics, security, accessibility, and performance. Each check is marked fails now, at risk, passes, or needs a person, with the evidence, a fix, and an effort estimate. You also see how the site looks in a Google result and a shared link, which AI crawlers its robots.txt lets in, a map of the pages analyzed, and what to fix first. A headless browser loads up to three pages from an EU address in Belgium: it records tracking before and after a cookie choice, runs axe-core, compares the HTML text with the rendered page, checks phone and tablet widths, and keeps three screenshots. It also checks chat widgets and AI chatbots (consent, weight, and keyboard access), the accessibility statement, imprint, and privacy pages, outdated front-end libraries, Google Safe Browsing through Web Risk, domain expiry and transfer lock through RDAP, and MTA-STS, TLS-RPT, and BIMI for mail, and estimates the carbon of one visit. A site whose bot protection refuses the plain request is analyzed in headless Chrome.

Which tools can a review name?

Playwright, Cypress, Robot, Selenium, WebdriverIO, CodeceptJS, Selenide, TestNG, Watir, Cucumber, Behave, Reqnroll, Jest, Vitest, Mocha, Appium, Maestro, JMeter, Gatling, and k6 are the frameworks. axe-core runs in the review's headless browser on up to three pages, and Lighthouse runs on the start page through Google PageSpeed Insights. BrowserStack, Applitools, Percy, Provar, and Copado are named when they apply and are not launched against your site.

Which languages can the page be read in?

The page is written in English and can be read in Spanish, Portuguese, German, French, and Italian. The news strip follows the country of the connection and the language of the page. A review analyzes a public page, tells you what it found, and suggests test cases your team can use. The disclaimers explain how that works, including what applies in the country of the site you are reviewing.

Can it write Playwright or Cypress tests from a URL?

Yes. It proposes test cases from one public https address and writes each one for the frameworks your team uses, from Playwright and Cypress to Selenide, Cucumber, Jest, Appium, and k6. The case export includes a starting script per framework and a ZIP with one suite each. The scripts are yours to run; the review never runs them.

Does a review touch my site?

It only analyzes public pages. It does not sign in to your site, submit forms, or generate load, and it does not run the cases it proposes.

How much of a site does a review analyze?

Your first review is included: up to twenty pages, two links deep. Want a wider or deeper look? You see the price before anything starts.

Where can the cases go?

Automation scripts as a ZIP, Excel, TestRail, Xray, Zephyr Scale, Jira, Azure Test Plans, MantisBT, JSON, plain text, or PDF. Every format carries the scripts for your frameworks. Case export is priced on the page.

Does a review check for phishing, malware, and hacking?

Every review also looks for trouble a visitor would not see. It checks the address with Google Safe Browsing through Web Risk and with Cloudflare URL Scanner, which reuses a scan from the last day or submits one that becomes public on Cloudflare Radar. Every outside host the page loads scripts, frames, or forms from, or links to, is checked with Web Risk too; a listed script host is a critical finding. It looks for signs of a hacked site: spam injected into search results, pages that show Googlebot something else, and hidden spam links. It lists lookalike domains registered to imitate yours that have a website or a mail server, checks the domain and its mail and web servers against free spam blocklists such as SpamCop, Mailspike, and NordSpam, and examines SPF, DMARC, and DKIM in detail. Once you prove you own the site, it also looks for files left in the open, such as .env, .git, and backups.

What if a review can't be finished?

Sometimes a review stops for a reason on our side, such as a site that turns away cloud servers. We keep your email, run it again another way, and email you the full report as soon as it is ready, usually within 48 hours. For the trouble, you get a code for 20% off your next review, valid for 90 days. If the report is still not ready after 48 hours, we write to tell you and keep trying: a report that finishes within 14 days still reaches you, and the code stays valid.

Can you fix what the report finds?

Ask us to fix it, in one of four ways. Fix it yourself: Ask the report writes the fix, and a paid report gets one free re-check once your changes are live. Ask for a quote: Carlos replies within two working days. Order a fixed-price package. Or book a call. Packages at launch prices until December 10, 2026; list prices apply after: security headers US$99 (about 3 working days), email and DNS US$89 (3), TLS and redirects US$69 (2), accessibility quick fixes US$169 (5), performance basics US$199 (5), and SEO meta and structured data US$119 (4). You pay with PayPal; discount codes do not apply to packages. When the fix is done, we review the site again for free and email you a before and after that marks each finding fixed, still open, or needing a person.

QA-lab URL Review: SEO, GEO, and QA test cases from a URL

What a review is

A public analysis, and a list of cases: You sign in on the device you run it from, with email or an account you already have (Google, Microsoft, GitHub, Yahoo, or X). QA-lab URL Review then fetches a public https address, describes the response, and proposes test cases. It does not run those cases, sign in to your site, submit forms, or generate load.
Sign in: You sign in on the device that runs the review, with email (a 6-digit code or a link, valid for 15 minutes on the same device) or an account you already have: Google, Microsoft, GitHub, Yahoo, or X. Your email comes from that sign-in. Signed-in runs are listed on your account page.
What the report scores: Six areas from 0 to 100: SEO, GEO (whether AI search and answer engines can read and cite the site), analytics, security, accessibility, and performance. GEO measures whether the site can be read and cited, not whether ChatGPT, Perplexity, or Google AI Mode cite it today. Each check is marked fails now, at risk, passes, or needs a person, with the evidence, a fix, and an effort estimate. You also see how the site looks in a Google result and a shared link, which AI crawlers its robots.txt lets in, a map of the pages analyzed, and what to fix first. A headless browser loads up to three pages from an EU address in Belgium: it records tracking before and after a cookie choice, runs axe-core, compares the HTML text with the rendered page, checks phone and tablet widths, and keeps three screenshots. It also checks chat widgets and AI chatbots (consent, weight, and keyboard access), the accessibility statement, imprint, and privacy pages, outdated front-end libraries, Google Safe Browsing through Web Risk, domain expiry and transfer lock through RDAP, and MTA-STS, TLS-RPT, and BIMI for mail, and estimates the carbon of one visit. A site whose bot protection refuses the plain request is analyzed in headless Chrome.
Safety checks: Every review also looks for trouble a visitor would not see. It checks the address with Google Safe Browsing through Web Risk and with Cloudflare URL Scanner, which reuses a scan from the last day or submits one that becomes public on Cloudflare Radar. Every outside host the page loads scripts, frames, or forms from, or links to, is checked with Web Risk too; a listed script host is a critical finding. It looks for signs of a hacked site: spam injected into search results, pages that show Googlebot something else, and hidden spam links. It lists lookalike domains registered to imitate yours that have a website or a mail server, checks the domain and its mail and web servers against free spam blocklists such as SpamCop, Mailspike, and NordSpam, and examines SPF, DMARC, and DKIM in detail. Once you prove you own the site, it also looks for files left in the open, such as .env, .git, and backups.
If a review cannot finish: Sometimes a review stops for a reason on our side, such as a site that turns away cloud servers. We keep your email, run it again another way, and email you the full report as soon as it is ready, usually within 48 hours. For the trouble, you get a code for 20% off your next review, valid for 90 days. If the report is still not ready after 48 hours, we write to tell you and keep trying: a report that finishes within 14 days still reaches you, and the code stays valid.
After the report: Ask us to fix it, in one of four ways. Fix it yourself: Ask the report writes the fix, and a paid report gets one free re-check once your changes are live. Ask for a quote: Carlos replies within two working days. Order a fixed-price package. Or book a call. Packages at launch prices until December 10, 2026; list prices apply after: security headers US$99 (about 3 working days), email and DNS US$89 (3), TLS and redirects US$69 (2), accessibility quick fixes US$169 (5), performance basics US$199 (5), and SEO meta and structured data US$119 (4). You pay with PayPal; discount codes do not apply to packages. When the fix is done, we review the site again for free and email you a before and after that marks each finding fixed, still open, or needing a person.
Frameworks and tools: Playwright, Cypress, Robot, Selenium, WebdriverIO, CodeceptJS, Selenide, TestNG, Watir, Cucumber, Behave, Reqnroll, Jest, Vitest, Mocha, Appium, Maestro, JMeter, Gatling, and k6 are the frameworks. axe-core runs in the review's headless browser on up to three pages, and Lighthouse runs on the start page through Google PageSpeed Insights. BrowserStack, Applitools, Percy, Provar, and Copado are named when they apply and are not launched against your site.
Automation scripts: It proposes test cases from one public https address and writes each one for the frameworks your team uses, from Playwright and Cypress to Selenide, Cucumber, Jest, Appium, and k6. The case export includes a starting script per framework and a ZIP with one suite each, a GitHub Actions workflow that runs them, and a fix kit with header files for common hosts, a Report-Only content security policy, and drafts for structured data, llms.txt, security.txt, and DNS records. The scripts are yours to run; the review never runs them.
Your site: It only analyzes public pages. It does not sign in to your site, submit forms, or generate load, and it does not run the cases it proposes.
How far it goes: Your first review is included: up to twenty pages, two links deep. Want a wider or deeper look? You see the price before anything starts.
Where cases go: Automation scripts as a ZIP, Excel, TestRail, Xray, Zephyr Scale, Jira, Azure Test Plans, MantisBT, JSON, plain text, or PDF. Every format carries the scripts for your frameworks. The full report opens the case export.
Language: The page is written in English and can be read in Spanish, Portuguese, German, French, and Italian. The news strip follows the country of the connection and the language of the page.
Next to other tools: How these checks and the fix packages compare with Sucuri, Wordfence, MxToolbox, the free header, TLS and speed testers, SEO audits and attack-surface services, from each vendor's own pages: URL Review next to other site checkers.
Rules: A review analyzes a public page, tells you what it found, and suggests test cases your team can use. The disclaimers explain how that works, including what applies in the country of the site you are reviewing.
Elsewhere: Films and notes on YouTube, TikTok, Instagram, Threads, LinkedIn, X, Facebook, Bluesky, Mastodon, Reddit, DEV, Telegram, and r/QALabLiveReports.; By language: @qalaburlreview posts in English, German, French, and Italian, and @qaurlreview in Spanish and Portuguese.

Review log

Lines appear here while the pages are being analyzed. Stop keeps the pages already saved and writes that stop into the report.

Enter the public address, then sign in on this device with email or an account you already have.
Pick a reason and press Review. Each step shows up here as it happens.
The report opens on this page when the review ends, and stays in Your reviews.

Before a single address is analyzed.

Find the leaks, breaks and blocks before customers or regulators do.

Real sites. Real reviews. Open any of them.

What a review is

The request

Review log

Take this list with you

Choose a file

This report was already shown

The total for this review

Another review