Website damage assessment. Free. 60 seconds.
How bad is your website, really?
Paste a URL. We scan it, measure the blast radius from 0 to 100, and write a roast from what we find. The site gets roasted. The people behind it don't.
Passive scan: GET requests only. No logins, nothing that changes state.
About
nuking.site is a free website audit with a dry sense of humour. It runs a passive scan of any public website and checks 44 things across security headers, SEO, accessibility, WordPress, broken links and Google PageSpeed. You get a score from 0 to 100, where higher is worse, and a roast where every line is tied to a measured finding. Every finding, ranked, with fixes, costs $10.
What we check
- Security
- HTTPS, HSTS, Content-Security-Policy, clickjacking, mixed content, leaky headers.
- Speed
- Google PageSpeed on a mid-range phone: LCP, CLS, blocking time, the worst offenders.
- SEO
- Titles, descriptions, canonicals, headings, mobile viewport, noindex, broken links.
- Accessibility
- Alt text, page language, and Lighthouse's automated accessibility audit.
- WordPress
- Exposed versions, xmlrpc, readme, username enumeration, plugin versions.
- Copy
- Generic titles, missing headlines and other signs nobody proofread the homepage.
All 44 checks, with fixes, are in the website audit checklist.
Example
example-bakery.com · blast radius 64 · grade E
“No HTTPS. Anyone on the same coffee-shop Wi-Fi can read along.”
“LCP 6.1 s. Visitors see a blank page long enough to reconsider their choices.”
“Your page title is ‘Home’. So is half the internet.”
Questions
Is scanning safe for my site?
Yes. It's a passive scan: GET and HEAD requests only, at most 35 of them, no logins, no attacks, and we respect robots.txt for everything beyond the homepage. It's roughly what one curious visitor does.
How is the blast radius calculated?
Every check has a severity (high 12, medium 5, low 2). The blast radius is the weighted share of failed checks, blended 75/25 with Google's mobile performance score. Same site in, same score out.
What's in the $10 full damage assessment?
Every finding with its evidence, why it matters and exactly how to fix it (with WordPress-specific steps where relevant), plus a checklist ordered by impact vs effort. One-time payment, private link by email.
It's my site and I want the roast gone.
Prove you own the domain with a DNS record or a small file. We take down every roast of it and stop new ones. No questions asked, which is rare for us. Remove a roast