- works — every form, button and flow, exercised in a real browser. silent failures surface here.
- responsive — 390 / 820 / 1440px viewports: overflow, tap targets, unreadable text.
- performance — Core Web Vitals: LCP, CLS, TTFB, transfer weight, render-blocking resources.
- a11y — axe-core against WCAG 2.2 AA. screen-reader traps and missing alt text.
- security — passive only: HTTPS, HSTS, CSP, cookie flags, exposed keys and files, auth boundaries.
- seo — titles, descriptions, canonicals, OG tags, structured data, sitemap coverage.
every FAIL ships with a fix prompt you paste into Cursor, Claude or Bolt.