Know your website is healthy.
Zenith checks uptime, security headers, accessibility and search basics, then writes each fix as a prompt for Claude Code.
Every scan runs 14 checks, including
Monitoring and audits that explain themselves.
Zenith watches from outside your stack, the way a visitor or a search engine would, and shows its working.
Uptime checks as often as every minute.
Every check records the status code and response time. Pro and Agency check every minute; Free checks every 15 minutes.
48 checks agoSample dataNow One blip is noted. Two failures open an incident.
You get one email when an incident opens and one when the site recovers.
- 200Check passes
- 503Noted, no alert
- 503Incident opens
- 200Recovered
Four scores, every deduction listed.
Security, accessibility, search and performance are scored separately, so you know where the points went.
- Security
- 72
- Accessibility
- 81
- Search
- 93
- Performance
- 88
Every finding comes with a fix you can paste.
On paid plans, each prompt carries the evidence, the affected pages and a clear definition of done for Claude Code.
# Fix: Missing Strict-Transport-Security Evidence: header not sent on 12 of 12 pages Change: add max-age=31536000 to HTTPS responses Done when: the next audit no longer reports it
A public status page for the people who depend on your site.
Included from Solo upwards. It shows current state and incident history, and nothing private.
One check, followed from request to fix.
We request your pages the way a browser does.
Zenith reads public pages and their response headers. It never logs in, fills in forms or changes anything on your site.
Every response is read against written rules.
There are rules for headers, cookies, HTTPS, accessibility and search basics. The methodology page shows how each one affects your score.
Findings arrive with the evidence attached.
Each finding lists the pages it affects and what was observed, so you can confirm it before you change anything.
The fix comes as a prompt you can paste.
On paid plans, every finding includes a prompt with the evidence and a clear definition of done, ready for Claude Code.
Check library
What Zenith checks, and how.
These are the checks behind every score. Each one says what it catches, what it pairs with, and where our coverage stops.
Read the full methodologyShowing 14 checks
Every page is served over HTTPS, and a plain http:// request is sent there.
Without it, anyone on the same network can read or change what a visitor sees. Browsers also label the page Not secure.
- Works well with
- Strict-Transport-Security
- A single 301 redirect from http to https
- Avoid
- Redirect chains that hop through several addresses
- Links and assets that still point at http://
- How Zenith checks it
- Zenith requests the http:// address and follows where it goes. A page that stays on plain HTTP is marked critical.
Tells browsers to use HTTPS for your domain for a set time, even if someone types http://.
It closes the gap on a visitor's first insecure request. That's the moment a downgrade attack needs.
- Works well with
- An HTTPS redirect on every host
- A max-age of six months or more once HTTPS is stable
- Avoid
- includeSubDomains or preload before every subdomain serves HTTPS: it locks those subdomains out
- How Zenith checks it
- Read from the response headers of each HTTPS page. A missing header is marked high.
Lists which scripts, styles, images and frames a page is allowed to load.
If someone manages to inject markup, the browser won't run anything the policy doesn't allow.
- Works well with
- Report-only mode while you tune it
- Hashes or nonces for the inline scripts you keep
- Avoid
- 'unsafe-inline' in script-src: it switches off most of the protection
- How Zenith checks it
- Zenith checks that a policy is sent. It doesn't yet grade how strict the policy is, so a weak CSP won't be flagged.
Stops other sites from loading your pages inside a hidden frame.
A framed page can trick people into clicking controls they can't see. Think confirming a change on an account page.
- Works well with
- CSP frame-ancestors 'self'
- X-Frame-Options: DENY for older browsers
- Avoid
- X-Frame-Options: ALLOW-FROM: current browsers ignore it
- How Zenith checks it
- Passes when either X-Frame-Options or a frame-ancestors directive is present. Marked medium when neither is.
The value nosniff tells browsers to trust the Content-Type you send.
Without it, a browser can decide an uploaded file looks like a script and run it.
- Works well with
- Accurate Content-Type headers on every file you serve
- Avoid
- JavaScript served with the wrong type: with nosniff on, the browser blocks it
- How Zenith checks it
- Header presence on each page. Marked low when missing.
Controls how much of the current address is passed to the next site a visitor opens.
Full URLs can carry account IDs, search terms or reset tokens you didn't mean to share.
- Works well with
- strict-origin-when-cross-origin as a sensible default
- Avoid
- unsafe-url, which sends the full address everywhere, including over HTTP
- How Zenith checks it
- Header presence. Marked low when missing.
Turns off browser features you don't use, such as the camera, microphone or location.
If a third-party script is compromised, it can't ask your visitors for access you never needed.
- Works well with
- An explicit list of the features you do use
- Avoid
- Blocking something an embed relies on: payment forms may need the payment feature
- How Zenith checks it
- Header presence. Reported as information, not as a problem.
Meaningful images carry alt text that says what they show.
Screen reader users hear the description. Without it they hear a file name, or nothing.
- Works well with
- alt="" on purely decorative images, so they're skipped
- Avoid
- Starting with "image of", or repeating the caption beside it
- How Zenith checks it
- Finds images with no alt attribute on each crawled page and lists the pages they're on.
The lang attribute on the html element, such as en-GB.
Screen readers use it to choose pronunciation. Translation tools use it to detect the language.
- Works well with
- lang on any passage written in a different language
- Avoid
- A template's lang="en" left on a site written in another language
- How Zenith checks it
- Reads the html element on every crawled page.
A unique title and meta description for each page.
They're usually the first thing people read in search results, before they decide to click.
- Works well with
- One H1 that matches the page's purpose
- A canonical URL
- Avoid
- The same title on every page
- How Zenith checks it
- Flags missing titles as high. Very short titles, ones likely to be cut off, and missing descriptions are flagged lower.
A robots noindex instruction that hides a page from search engines.
It's often left on when a site moves from staging, and the page quietly drops out of search.
- Works well with
- noindex on pages that genuinely should stay private, like account settings
- Avoid
- Shipping a staging template's noindex to production
- How Zenith checks it
- Reads the robots meta tag on each page. A noindex is marked high.
How long your server takes to start sending the page.
Everything waits on it. Fonts, images and scripts can't start until the HTML arrives.
- Works well with
- Caching HTML at the edge where the page allows it
- Avoid
- Holding the response while slow third-party API calls finish
- How Zenith checks it
- Timed on every request Zenith makes. Slow responses are marked high, moderate ones medium.
A request to your site on a fixed schedule: every 15 minutes on Free, 5 on Solo, every minute on Pro and Agency.
You hear about an outage from Zenith, not from a customer.
- Works well with
- A public status page, included on every paid plan
- Avoid
- Monitoring an address that redirects to a login page: it can look up while the app is down
- How Zenith checks it
- An incident opens after two failed checks in a row, so one slow response won't page you.
The same report, two weeks apart.
Three header fixes moved security from 48 to 91. The report stays in the same format, so you can see exactly what changed.
What you can hold us to.
Passive by design.
Zenith reads public pages and headers the way a browser does. It doesn't log in, submit forms or try exploits, so it isn't a penetration test.
Verified before it's watched.
You prove you own a site with a DNS record, a file or a meta tag before scheduled checks begin.
It can't be aimed inward.
Zenith refuses to request private network addresses, so nobody can point it at internal systems.
Reports stay private.
Reports and screenshots sit in private storage and are only served to the account that owns the site.
Two-step sign-in.
Add an authenticator app from Settings, with backup codes in case you lose your phone.
Billing
Payments run through Stripe. Cancel from the billing portal whenever you like, and your plan runs to the end of the period you've paid for.
Refunds
Subscriptions aren't refunded for part-periods, and a Deep Audit can't be refunded once it has run. Your statutory rights still apply.
Refund policySupport
Email support@marcelipawlinski.co.uk. Security reports go to the address in security.txt.
Pricing
Start free. Pay for more sites and faster checks.
Billing
Yearly plans cost ten months, not twelve.
No VAT is added: the price shown is the total you pay. Plans renew until you cancel from the billing portal. Refund policy
Free
One site, to see what Zenith finds.
£0for good
- 1 website
- Checks every 15 minutes
- Monthly audit, 5 pages
- 30 days of history
Solo
For someone running their own site.
£9a month
- 3 websites
- Checks every 5 minutes
- Weekly audit, 25 pages
- Full fix prompts
- 1 status page
- 180 days of history
Pro
RecommendedFor sites that earn money.
£19a month
- 10 websites
- Checks every minute
- Daily audit, 100 pages
- PDF reports
- Priority audit queue
- 1 year of history
Agency
For studios looking after clients.
£49a month
- 50 websites
- Checks every minute
- Daily audit, 250 pages
- White-label reports
- 2 years of history
Deep Audit
One full audit with screenshots and every fix prompt. No subscription.
£19once
- Pages up to your plan's limit
- Screenshots
- Full fix prompts
Questions before you start.
Ask something elseNo. Zenith checks your site from the outside by requesting public pages, the same way a browser would.
The issue, the evidence, the pages it affects and a definition of done. Paste it into Claude Code, review the change, then run another audit to confirm it.
No. Zenith inspects what it can see from outside and never attempts an attack, and automated accessibility checks can flag barriers but can't certify WCAG compliance.
Yes, once you've verified you control each one. Agency covers up to 50 sites, with white-label reports.
Yes, from the billing portal at any time. Your plan stays active until the end of the period you've paid for.