33 automated checks · 8 regulation views
Know where your website stands before anyone else does.
Scan any website for security, accessibility, privacy and legal compliance issues. Get a clear score, a prioritised fix list, and monitoring that tells you when something breaks.
No credit card required. Free plan available.
- automated scanners
- 33
- automated scanners
- areas of coverage
- 8
- areas of coverage
- regulation and standard views
- 8
- regulation and standard views
- ways to get the results
- PDF · API · CI
- ways to get the results
Everything a website audit needs, in one place
Stop stitching together a dozen tools. One scan covers the areas that regulators, customers and attackers look at first.
Security
Headers, TLS, content security policy, cookies and sessions, exposed APIs, known-vulnerable CMS and libraries, and domain reputation, checked the way a browser sees your site.
Accessibility
Automated WCAG 2.1/2.2 A and AA tests, EN 301 549 mapping for the European Accessibility Act, and the markup quality assistive technology relies on.
Privacy and consent
GDPR, ePrivacy and CCPA signals. A real browser visits your site before and after consent to catch trackers and cookies that fire too early.
Monitoring and alerts
Scheduled scans, score history, and alerts the moment a score drops or a new critical issue appears. Send them to e-mail, Slack, Teams or a webhook.
Reports people actually read
Clear scores, prioritised fixes with copy-ready remediation, PDF reports, evidence packs, and expiring share links for clients and auditors.
Built for developers
REST API, a CLI, a GitHub Action with SARIF output, and deployment-triggered scans so a regression is caught the day it ships.
From URL to fixed in three steps
Step 1: Add your website
Enter a URL. Verify the domain to unlock deeper scans, scheduling and signed-in scanning.
Step 2: Run a scan
Choose a quick scan, a full scan of all 33 checks, or pick the regulations you care about.
Step 3: Fix what matters
Work through a prioritised list with remediation guidance, assign owners and deadlines, and let the next scan confirm the fix.
Scan by the regulation you care about
Pick a framework and WCS runs the checks that speak to it, then shows results grouped the same way.
GDPR / ePrivacy
EU / EEA, UKConsent, tracking before consent, cookie banner behaviour, privacy notice, third-party data flows.
CCPA / CPRA (US states)
California and other US statesPrivacy notice, opt-out signals (Global Privacy Control), advertising trackers, cookie practices.
Accessibility: WCAG 2.1/2.2 (ADA, Section 508)
Global; US ADA and Section 508Automated WCAG A/AA tests and the markup quality assistive technology relies on.
European Accessibility Act (EN 301 549)
EUWCAG 2.1 AA mapped to EN 301 549 clauses, plus the accessibility statement and feedback route.
PCI DSS (payment pages)
Global card paymentsTransport security, security headers, script control and session cookies on pages that take payments.
OWASP Top 10 (web security)
GlobalBrowser-visible security: misconfiguration, headers, TLS, session cookies, API exposure, known-vulnerable software, reputation.
E-commerce and consumer law
EU / UK / USSeller identity, policies, pricing and checkout information, privacy and governance pages.
Open-source licence compliance
GlobalLibraries shipped to the browser and their licences and notices.
Automated checks show where a website falls short of a framework. They cannot certify compliance or replace legal, audit or accessibility-expert review.
Made for the people who answer for the website
Agencies and consultants
- Client portals on your own domain
- Your logo and colours on reports
- Portfolio view across every client site
Engineering teams
- GitHub Action, CLI and REST API
- Scans on every production deploy
- Jira and Linear tickets from findings
Security and compliance
- Evidence packs and an audit log
- SSO (OIDC, SAML), SCIM and enforced 2FA
- Role-based access and IP allow-lists
Simple plans that grow with you
Start free. Upgrade when you need every scanner, more sites or a team workspace.
Free
Free
Basic compliance checks for one site, no card needed.
Pro
from $24.17/mo
billed annually
Every scanner for one person running regular audits.
Teams
from $124.17/mo
billed annually, 5 seats included
Shared workspace, pooled scans and enforceable 2FA.
Enterprise
Custom
SSO, SCIM, per-seat scan allowance and a dedicated agreement.
Built to be trusted with your data
Stored credentials are encrypted, scans are fenced off from private networks, every sensitive action is audited, and access is role-based with optional enforced two-factor and SSO. Read how it works, and what we do not claim.
Frequently asked questions
Does a good score mean my site is compliant?
No. WCS reports what an automated scan can see from the outside. It is not a certification, an audit or legal advice, and some requirements (for example half of WCAG, or whether your privacy notice is accurate) need a person. Every report says what was and was not covered.
Do I need to install anything?
No. Scans run from our servers against your public URL. For pages behind a login, you give WCS a dedicated test account on a plan that includes signed-in scanning.
Is it safe to scan my site?
Scans are read-only by default and respect robots.txt unless you choose otherwise. We only follow links on the site you entered, and we ask you to verify domain ownership before deeper scans.
Who can see my results?
Only members of your workspace, plus anyone you choose to share a link with. Share links expire, can be password-protected, and can be revoked at any time. Reports of signed-in scans can never be shared publicly.
Can I cancel at any time?
Yes. Cancel from Settings > Billing; your history stays available on the Free plan. See the refund policy for details.
Do you offer SSO and a data processing agreement?
Enterprise includes SSO (OIDC and SAML) and SCIM. Our Data Processing Addendum and subprocessor list are public.
Run your first scan in under a minute
Create a free account, enter your URL, and see your score.