Privacy and terms

What the tools fetch

When you run the Website Health Check, my server visits the public page of the address you entered (and follows up to 5 redirects). It also tests up to 20 links from the same website on that page, asks for the http:// version of the address to see whether it redirects to https://, and reads the security certificate of the website.

I only read public information. I never log in to anything, and I do not collect any information from your website's visitors. The speed score comes from Google (see "Other services" below).

What is stored, and for how long

Your results are not stored permanently. To keep the tool free and fast, a finished report and a finished Google speed result may be kept in a temporary cache (Upstash Redis) for up to 1 hour, so checking the same address again does not repeat all the work. The cache entry is stored under a scrambled (SHA-256) version of the address, and it is deleted automatically when the hour is over.

The server logs only the domain name and the outcome of a check (for example "ok" or "timeout"). It does not log full addresses with query strings, results or IP addresses.

If you use a link such as ?url=example.com, the address stays in your own browser history. I do not keep it.

Rate limiting and your IP address

To prevent abuse I limit how many checks one person can run (5 checks per 10 minutes) and how many checks the whole tool runs per day. To do that I use a scrambled (SHA-256 hashed) form of your IP address mixed with a secret value. The raw IP address is never stored by my code, and the scrambled version cannot be turned back into your IP address. These counters are kept in Upstash Redis and expire on their own, within 10 minutes for the per-person counter and within a day for the daily counter.

As my hosting provider, Vercel receives your request and handles IP addresses under its own privacy policy.

Accounts, cookies and analytics

There is no account and no signup. The site does not set cookies of its own. There are no advertising cookies and no advertising or tracking scripts.

I use Vercel Web Analytics, which counts page views and a few button clicks (for example, the contact buttons) without cookies and without identifying you. The only script the site loads comes from my own domain.

Other services that process data

Google PageSpeed Insights: the address you enter is sent to Google so it can measure mobile speed. Google's privacy policy applies to that request.

Upstash (temporary cache and rate-limit counters) and Vercel (hosting and analytics) process data on my behalf, as described above. Each of them has its own privacy policy.

The pages link to my LinkedIn profile and portfolio. Those sites have their own privacy rules.

Contacting me

If you email me or message me on LinkedIn, I use your message only to reply to you. If you want something removed, contact me and I will do my best to help.

Terms and disclaimer

• The Website Health Check is a quick automated check of public information. It is not a full audit, a security review or a malware scan.
• Results are provided as is, with no guarantee that they are complete or correct. They are not professional, legal or security advice. Please do not make business decisions based only on this tool.
• Only submit websites that you own or have permission to check. Each check sends a small number of ordinary requests (up to about 25) to the website, identified as ShahzaibWebsiteHealthCheck.
• I may limit, change or stop the tools at any time, and I may block use that looks abusive.

Questions

For a privacy question, email me at shahzaib.dev001@gmail.com, or message me on LinkedIn.