ENPTESTry it free
Product

A complete diagnosis of the site, the Google Business Profile and Bing, with proof for every number.

Performance and searchCore Web VitalsTechnical SEOStructured dataSemantic SEO
AI and trustAI readinessAI and search botsE-E-A-T and trustPrivacy and security
Local presenceGoogle Business ProfileBing analysis
Follow-upSearch Console and GA4Monitoring and alertsReportsGoogle rankingsKeyword researchSEO and AI goals
Who it's for

Agencies, consultants and companies that need to show what is wrong with a site and follow the fix.

SegmentsAgencies and consultanciesServices and educationE-commerceSaaS and startupsHealthcare and clinicsReal estate and local
Start hereSample reportFree diagnosisPlans and pricing
Help

Straight answers, a real report to explore and real people on the other side.

LearnFrequently asked questionsSample reportAll featuresFree toolsAboutCookie policy
Talk to usContact usWhatsAppEmailSign in to the app
Try it free
Privacy and security

Learn what your site exposes and what it collects without asking

Website privacy and security are the data a site collects from visitors and the doors it leaves open: consent, headers, certificates, email DNS and exposed credentials. Path Ranker checks from the outside, like a visitor, the LGPD and GDPR points visible on your site, the security headers and certificate, your email DNS and whether any credential is in plain sight. Each finding comes with its evidence and, where there is one, the command to repeat the measurement.

Try it freeSee pricing

How it works

01

Reads pages and headers

The crawl goes through the site’s pages, forms, scripts and links. On the home page, the HTTP headers and the TLS certificate are read straight from the server.

02

Loads the page in a real browser

A headless Chrome loads the page without clicking anything and records which trackers are called before any consent.

03

Queries DNS and looks for leaks

It reads the domain’s SPF, DMARC and CAA records and tests 30 sensitive paths, such as .env, .git and database backups. A file only counts as exposed when its content confirms it.

What it checks

Privacy policy and terms

Looks for the site’s own privacy policy (reCAPTCHA or third-party links do not count), the terms of use and the cookie policy.

Consent before trackers

Shows which trackers (Google Analytics, Meta, Hotjar, Clarity, LinkedIn, TikTok and others) fire before consent. Without the browser reading, the item is marked as not verified and does not affect the score.

Forms that collect personal data

Flags forms that ask for a name, email, phone number or company without a privacy notice in the form itself, and forms that submit outside HTTPS.

Data controller and data subject rights

Checks whether the site shows a company registration number (CNPJ, NIF or EIN) and a channel for data subject rights, such as the DPO’s email.

Security headers and certificate

HSTS, CSP, X-Frame-Options, X-Content-Type-Options and Referrer-Policy, plus the validity, issuer and days to expiry of the TLS certificate.

Exposed credentials

Looks for private keys, database passwords and tokens for services such as AWS, Stripe or GitHub in the site’s own HTML and scripts. The report shows only the start and end of each value.

Open doors

Detects login pages open to anyone (wp-login.php, xmlrpc.php, /administrator/), directory listings, mixed content (http on an https page) and the server version in the headers.

Email and domain

Checks SPF and DMARC when the domain is used for email, a DMARC policy of p=none, the CAA record and the redirect from http to https.

What it does not do

  • It measures from the outside, like a visitor: it reads public pages, headers and DNS. It does not access your server, code or admin panel, and it changes nothing.
  • It is not a penetration test: it does not try passwords or exploit flaws. The credential search only sees what the site serves publicly.
  • Consent is checked on the first load, with no clicks. What happens after a visitor accepts or rejects is not tested.
  • It points out technical LGPD and GDPR signals. It does not replace a review by a legal professional.

Which plans include it

Part of the full analysis on the Starter, Pro and Enterprise plans. These plans can also run just the E-E-A-T (trust) and privacy group or the headers, certificate, DNS and email group. The Free plan runs a reduced analysis without privacy, security or DNS.

See pricing

Frequently asked questions

  • No. It points out the technical signals that can be checked from the outside, such as the policy, consent and forms. Compliance also depends on internal processes and a legal professional’s review.
  • No. Each value is masked on the spot, keeping only the first 6 and the last 4 characters, so the report can be shared without spreading the key. Rotate the key anyway, because it has already been public.
  • Open the site in a private window, open DevTools (F12) on the Network tab and reload without accepting the cookie notice. If analytics or ad scripts load, they fire before consent.
  • It makes read requests, like a visitor: the crawled pages, the site’s own scripts and the 30 known paths. It does not submit forms or try to log in.
  • No. Those findings only appear when the domain has an MX record, that is, when it is set up to receive email.

Other features

See what your site shows to anyone looking from outside

Run an analysis and get every privacy and security point with its evidence and the fix.

Try it free