How the analysis works
When you press Analyze, beancuit's own server function (running on Cloudflare) requests the page with a mobile or desktop browser User-Agent, follows each redirect one step at a time and reads up to 3 MB of HTML. It then lists the scripts, stylesheets, images and fonts, sends lightweight HEAD requests to up to 25 of them to learn their size, compression and caching, and fetches robots.txt, the sitemap, the http:// version and the www or non-www alternative. No API keys or outside audit services are used; every number is measured by our own code.
URL → redirects → HTML + headers → up to 25 files (HEAD) → robots.txt · sitemap · http:// · www → checks → scores
What is checked
- Speed: Time to first byte and HTML download time, HTML size and compression, redirects, render-blocking scripts and stylesheets, number of requests, estimated page weight, large images, uncompressed text files, short cache lifetimes, images without width and height, missing lazy loading, resource hints and third-party domains.
- SEO: HTTP status, title and meta description length, canonical URL, html lang, viewport, charset, H1 count and heading order, image alt text, Open Graph and Twitter cards, noindex, robots.txt rules, sitemap, hreflang, JSON-LD structured data and favicon.
- Security: HTTPS and the http:// → https:// redirect, HSTS, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options or frame-ancestors, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, cookie flags (Secure, HttpOnly, SameSite) and server version banners.
- Best practices: Mixed content (http:// files on an https:// page), www and non-www consistency, the HTML doctype and the CDN or web server detected.
How the score is calculated
Every check ends as pass, warning, fail or info. Within a category a pass counts 1, a warning 0.5 and a fail 0, multiplied by the check's weight (1 to 3); info items are not scored. The category score is the weighted share out of 100, and the overall score is the plain average of the four categories.
- Weight 3: time to first byte, compression, render-blocking scripts, HTTP status, title, viewport, noindex, robots.txt blocking, HTTPS, the https redirect and mixed content.
- Weight 2: HTML download time and size, redirects, blocking CSS, page weight, large images, text compression, static caching, meta description, H1, image alt text, HSTS, CSP and cookie flags.
- Weight 1: all other scored checks.
- Grade: A from 90, B from 80, C from 70, D from 60, F below 60.
What this tool can't measure
Timings are measured from a Cloudflare server, not from your device or network, and include that server's DNS lookup, connection and TLS setup. The page is not rendered and JavaScript does not run, so Largest Contentful Paint, Cumulative Layout Shift and Interaction to Next Paint are not measured; images without dimensions and blocking scripts are only flagged as risks. Content added by JavaScript, fonts referenced inside external CSS and files beyond the first 25 are not inspected. Some sites block or rate-limit automated requests, or serve different content to data-centre addresses.
Privacy
The address you enter goes to beancuit's server function only when you press Analyze or open a shared link containing url=. The function fetches the page and sends back the results; beancuit stores nothing beyond Cloudflare's standard request handling. Private and local addresses (localhost, 10.x, 192.168.x, 169.254.x and similar) are refused.
Standards and sources
- HTTP semantics and caching: RFC 9110 and RFC 9111
- HTTP Strict Transport Security: RFC 6797; Content Security Policy Level 3 (W3C)
- Robots Exclusion Protocol: RFC 9309; Sitemaps protocol 0.9 (sitemaps.org)
- HTML Living Standard (WHATWG): viewport, lazy loading, preload and preconnect
- The Open Graph protocol (ogp.me) and schema.org JSON-LD
Last reviewed October 12, 2026
Frequently asked questions
Is this the same as Google PageSpeed Insights or Lighthouse?
No. Lighthouse loads the page in a real browser and measures rendering. This tool is a lighter server-side audit: it reads the HTML, the HTTP headers and up to 25 linked files, so it is fast and needs no API key, but it does not measure LCP, CLS or INP. It flags the usual causes of slow or unstable pages instead, such as render-blocking scripts, large images and images without dimensions.
Why is the response time different from what I see?
The time is measured from the Cloudflare server running the check, which is usually in a data centre close to you, and includes DNS, connection and TLS setup. Your own connection, browser cache and location give different numbers, and a site's CDN cache can make the second run faster than the first.
Why does a site fail or look different?
Some sites block automated requests, show a bot check or rate-limit data-centre addresses. Pages that return something other than HTML, such as a PDF, are not analyzed, and private or local addresses are refused for security. Try the other device option, or check that the address opens in your browser.
Why are only some files checked?
Cloudflare's free plan allows a limited number of outgoing requests per check, so the tool checks the 25 most important files: blocking scripts and stylesheets first, then other scripts, fonts and the first images. The page weight is therefore an estimate.
Can I share or save the result?
Yes. After the analysis the address bar holds a link with url= (and device=desktop if chosen); opening it runs the check again. Copy as JSON gives you every check, header and resource in machine-readable form.
Is the address I enter stored?
No. It is sent to beancuit's server function only when you press Analyze or open a shared link, used to fetch the page and then discarded. The target site sees an ordinary request from a Cloudflare server.