highSecurity
Password reset links never expire
- What we saw
- A reset link from a week ago still let us set a new password.
- Suggested fix
- Expire reset tokens after a short window and after first use.
elf-audit · first report free
Before you go live, let our elf's check.
elf-audit sends a fleet of testing agents through your website end to end, then hands you a clear report: what to improve, and which security loopholes to close before launch.
elf-audit report
yourproduct.com
82
UX68
Speed74
Access59
Security- highPassword reset link never expires
- mediumCheckout button hidden on small phones
- mediumHero image is 4.2 MB
- low6 images missing alt text
Ready to launch?After 3 fixes
What we check
The whole product, not just the homepage
Our elf's click, type, scroll and probe the way real visitors do — and the way attackers do.
User experience
Sign-up, checkout and every key flow, walked end to end. Dead ends, confusing steps and broken states.
Performance
Slow pages, heavy assets and the moments where visitors wait too long.
Accessibility
Keyboard paths, contrast, labels and screen-reader snags that shut people out.
Content
Broken links, typos, missing metadata and copy that contradicts itself.
Security loopholes
Exposed data, weak spots in forms and auth, and misconfigurations worth closing before launch.
Go-live readiness
A plain answer to the question that matters: is this good enough to ship, and what's in the way?
How an engagement works
Four steps to launch-ready
Run like a consulting engagement, staffed by a fleet of agents — with people on hand to walk you through it.
- 01
Request & verify
Share your website and what's in scope. We confirm you control the domain and agree the scope in writing before anything runs.
- 02
Fleet runs
A fleet of testing agents works through your site, end to end.
- 03
Report delivered
A prioritized report: improvements to make and loopholes to close.
- 04
Walkthrough & fixes
We walk you through the findings and can help with the fixes.
Sample findings
Findings you can act on today
Every finding comes with what we saw, why it matters and a suggested fix. Here's the shape of it — illustrative examples, not a real client.
mediumUX
Checkout button falls off small screens
- What we saw
- On narrow phones the Pay button sits below the fold with no hint to scroll.
- Suggested fix
- Pin the primary action to the bottom of the viewport on mobile.
mediumPerformance
Hero image is 4.2 MB
- What we saw
- The homepage waits on one oversized image before anything feels loaded.
- Suggested fix
- Serve a compressed, responsive image and lazy-load the rest.
lowAccessibility
Icon buttons with no labels
- What we saw
- Screen readers announce the search and menu buttons as just “button”.
- Suggested fix
- Add an accessible name to every icon-only control.
Who it's for
For anyone about to hit publish
Founders before launch
A second pair of eyes — well, a fleet of them — before the first real users arrive.
Teams shipping a redesign
Catch what the new look broke before your customers find it for you.
Agencies handing over
Hand clients a site with a report that shows it was checked properly.
Free first report
Get your free report
Tell us where your product lives. We'll confirm the scope with you before a single test runs.
- A one-time report, free — no card, no commitment
- Prioritized findings across UX, performance, accessibility, content and security
- A walkthrough of the results, and help with fixes if you want it
FAQ
Good questions
Is the first report really free?
Yes. Your first report is free, with no card and no commitment. If you'd like help fixing what we find, we can talk about that separately.
Will testing break my site?
Our tests are designed to be non-destructive: they observe and probe without changing your data. You authorize the scope in writing before anything runs — which pages, which flows, and whether we test production or a staging copy. Any testing carries some risk, so we recommend a staging copy where you have one.
What do you need from me?
Your website, the scope you're happy for us to test, and a quick check that you control the domain (an email at that domain or a DNS record). If parts of your product sit behind a login, a test account helps our elf's reach them. We only test sites whose owners have authorized it.
What's in the report?
Prioritized findings across UX, performance, accessibility, content and security. Each one says what we saw, why it matters and what we'd suggest doing about it.
Who reads the results with me?
We do. Once the report is in, we'll walk you through it and point out where to start.