Why it’s different
QA that isn’t your test suite over again
It tests behind the login
Most of what breaks in a real app breaks on authenticated pages a logged-out scanner never sees. QAtesting signs in with a real user login and works through them like a person.
No tests to write
It drives your live app in a real browser — nothing to script, nothing to re-record when your UI changes. Point it at a URL and it finds what a user would hit.
It catches regressions
Turn on a weekly re-scan and every report shows what changed since last time: what’s new, what came back after a fix, and what you’ve resolved.
It shows its work
A coverage sitemap records every page it reached and how — so you can trust the scope, not just the findings.
What it finds
Real, user-facing defects — with the receipts
A deterministic pass over every page it reaches. Accessibility, SEO, and security-header checks run on every scan — nothing to switch on.
Console & network errors
JavaScript exceptions and failed requests as a user triggers them
Broken images & dead links
missing assets, 404s, and redirect loops
Layout & mobile overflow
content that breaks out of the viewport or overlaps
Placeholder & untranslated copy
lorem ipsum, TODOs, “coming soon”, mojibake, missing translations
Dead controls & broken forms
buttons that do nothing, validation that never clears or never enforces
Slow APIs & stuck loading
sluggish calls and spinners that never resolve
Accessibility — WCAG 2.2 AA
text contrast, touch-target size, heading order, document language
SEO & mobile hygiene
page title and mobile viewport everywhere; canonical link, meta description and Open Graph tags on your public pages
Security response headers
HSTS, CSP, X-Frame-Options and friends, on the entry page
Stuck loading indicator on /reports
A loading indicator ("Loading reports…") is still visible 2.5s after load — the feature never finishes loading.
Dead control "Save preferences" on /settings
Clicking "Save preferences" changed nothing and the control has no click handler bound — it appears dead.
Validation error never clears on /profile
After correcting the field and resubmitting, the validation error "Enter a valid email." was still shown — the form never clears stale errors.
Real findings, verbatim, from a scan of Bugpen — the deliberately-buggy demo app we test the engine against. Your report renders them the same way, each with a repro and a screenshot.
An optional security lens can ride the same authenticated crawl to check whether sensitive data is exposed through your data API — read-only, on backends you name, and an inconclusive result is never reported as “secure.” It’s a signal, not a full audit.
What you get
A report you can act on and hand to your team
- A transparent 0–100 quality score, with a trend line across your past scans
- A “Fix first” queue of the highest-impact issues
- Every finding ranked by severity, each with a reproduction and an evidence screenshot
- A page-by-page drill-down of exactly what was found where
- A “what we checked and passed” panel — the clean checks, not just the failures
- The full coverage sitemap
- One-click export to CSV, JSON, or PDF
See a complete one: the sample report, from a real scan of Bugpen. The coverage sitemap is how it proves what it tested — see how coverage works.
How it works
Three steps to your first report
Trust & safety
Built to be safe against your production site
- Read-only by default. Once signed in, a network guard blocks anything that isn’t a normal page navigation — no probing, no writes. Write mode is opt-in per scan: it submits only the create forms you promote, with obviously fake data, plus one edit of each record it creates — and a form that changes existing records or sends messages only if you also allow that for the scan (off by default; not offered on every account).
- Your own site only. You verify ownership before scanning, and it’s re-checked live every run.
- Credentials protected. Encrypted before storage, and optional per scan — keep them or don’t.
- Evidence sanitized. Emails, card and account numbers, and tokens are redacted and masked in screenshots before they’re sealed.
- Yours to delete. Scans and their evidence are kept until you delete them — any finished scan, from its page — or close your account.
More detail in the FAQ.
How we know it works
Held to a bar before it ever sees your site
Tested against apps built to fool it
Every release must find all 19 planted defects in our deliberately-buggy test apps — one classic multi-page app, one single-page app — with zero false positives. Miss one and the release doesn’t ship.
Validated on real software
Run against a real open-source project (Gitea), it reported only true positives across 20 authenticated pages — no noise to wade through.
Read-only by default
A network guard armed right after login blocks anything that isn’t a normal page navigation. The one exception is write mode, which you turn on per scan: it submits only the create forms you promote, with obviously fake data, and edits each record it just created to check that saving works. A promoted form that changes or deletes an existing record, pays or sends a message is submitted only if you also allow that for the scan — off by default, and not offered on every account.
Pricing
Pay per scan, or subscribe a domain
$100 per scan
$70 per scan
$60 per scan
4 scans a month · $50 per scan
per domain, with weekly re-scans
Credits work on any of your domains and don’t expire. A scan that fails costs nothing — it’s refunded automatically. Full pricing is in the FAQ.
Launch promo: your first scan is free — use code freescan at checkout (first 20 new customers, applies to the 1-credit pack).
Run your first scan
Create an account, verify a domain, and see what’s breaking behind your login.