Rescue
The demo worked.Then people arrived.
It was built with AI over a weekend, and it looks alright. Then the form stops sending, the keys turn out to be in the bundle, and Google will not rank it.
We run these same checks on our own site, and we do not pass all of them either.
What we find
Nearly every time, in some combination.
None of this is a criticism of building fast. It is what building fast leaves behind, and it is all findable in an afternoon if you know where to look.
API keys shipped to the browser
Anyone who opens the developer tools can read them.
A form that posts nowhere
Or into a folder no one has opened since launch.
Four megabytes of hero image
Uncompressed, on a phone connection, before anything else loads.
No security headers at all
The default grade for a site nobody configured.
Six versions of the same button
None of them the same size, none of them on purpose.
Text a screen reader cannot read
On a site the EU requires to be readable.
HTML that does not validate
So Google is guessing at the structure of your pages.
Nothing measured
Nobody knows how many people arrive, or where they leave.
What it is costing now
It looks finished. That is the expensive part.
A site that looks broken gets fixed. A site that looks fine gets traffic sent to it — from ads, from a launch, from everyone you tell — and quietly loses most of it on the way through.
The form is the usual one
It posts nowhere, or into a folder nobody has opened since launch. Every enquiry since then is gone, and there is no record that any of them existed.
The keys are already public
If they were shipped to the browser they have been readable by anyone who opened the developer tools, for as long as the site has been up. Rotating them is the fix; knowing is the first step.
You are paying to send people there
Ad spend, a launch post, a newsletter, a conference badge. All of it lands on the version that does not work on a phone.
13checks
Our published definition of done. Five of them machine-verified against external standards, so we cannot mark our own homework.
30routes
We crawl the whole site rather than the homepage, and rank fixes by how many pages carry them. A fault on twenty pages is one template.
0invented
Every finding cites a public standard — Google, W3C, OWASP, WCAG. You can re-run all of it without us, and you should.
What we do about it
Four passes. You pick how far it goes.
The security pass
Keys out of the browser and onto a server, headers switched on, forms behind a real check rather than a hidden field.
The keys stop being public. That is the one that cannot wait.
The speed pass
Images, fonts and the render path. Usually the single cheapest thing that changes how the site feels.
The cheapest thing that changes how the whole site feels.
The design pass
One type scale, one spacing scale, one button. Most vibe-coded sites are not ugly, they are inconsistent.
It stops looking like four people built it in four weekends.
The rebuild
Sometimes the fastest fix is not a fix. If patching costs more than starting again, we will tell you that.
Costed honestly against patching, before you commit to either.
How it starts
We crawl the whole site, not the homepage.
Then we rank the fixes by how many pages they appear on, because a problem on twenty pages is a template problem and worth fixing once. You get the list before you get a price.
We check the same things on our own site and we do not pass all of them either — this one currently ships without share images, which is on our list before it was on yours.
When it is not worth it
If the site is a weekend project with no visitors, do not pay anyone to harden it. Get people to it first, then come back.
Send us the URL and what is bothering you.
You do not need to know what is wrong. That is the part we are for.