Test Plugins
54 automated tests across security, performance, SEO, accessibility, and e-commerce.
Test Categories
Tests are organized into 6 tiers based on complexity and resource requirements:
Tier 1: HTTP-only Tests (Fast, no browser)
| Test | What it checks |
|---|---|
| security-headers | 6 security response headers (HSTS, CSP, X-Content-Type, etc.) |
| ssl-tls-check | Certificate expiry, weak protocols, HSTS preload |
| dns-health | A/AAAA/MX/CNAME/TXT resolution times, expected records |
| robots-txt | robots.txt presence, Googlebot blocking, sitemap reference |
| sitemap-validation | XML sitemap parsing, broken links, lastmod freshness |
| seo-meta-tags | Title, description, H1, canonical, OG tags, JSON-LD (multi-page) |
| cookie-compliance | Tracking cookies without consent, Secure/SameSite flags |
| response-time | Response time with p50/p95/p99 percentiles |
| mixed-content | HTTP resources loaded on HTTPS pages |
| open-port-scan | Unexpected exposed TCP ports |
| sensitive-file-exposure | Exposed .env, .git, backups, admin panels |
| image-optimization | Oversized files, legacy formats, lazy loading, alt text |
| analytics-audit | 21+ tracker detection (GTM, GA4, Meta Pixel, etc.) |
| ga4-data-health | GA4 real-time and daily data health via service account |
| ai-search-readiness | llms.txt, AI crawler policies, structured data depth |
| ai-citability-check | Passage-level AI citation readiness scoring |
| redirect-chain | HTTP redirect chains, loops, and temporary redirects |
| structured-data-validator | JSON-LD deep validation against Google Rich Results |
| http-protocol-check | HTTP/2 and HTTP/3 (QUIC) protocol support |
| email-auth-check | DMARC, SPF, DKIM email authentication |
| cache-header-audit | Cache-Control, ETag, Expires on HTML and static assets |
| cors-audit | CORS policy security (wildcard origins, credentials) |
| csp-deep-audit | Deep CSP analysis (unsafe-inline, unsafe-eval, wildcards) |
| payment-gateway-health | Nordic payment gateway availability (Vipps, Klarna, Nets) |
| w3c-html-validation | W3C HTML standard validation via Nu Html Checker |
Tier 2: Browser Tests (Playwright)
| Test | What it checks |
|---|---|
| mobile-friendliness | Mobile viewport rendering, tap targets, font sizes |
| broken-links | Full site crawl for broken internal links |
| accessibility-scan | WCAG violations via axe-core |
| core-web-vitals | LCP, CLS, FCP, TTFB via Performance Observer |
| visual-regression | Multi-viewport screenshots for baseline comparison |
| third-party-script-perf | Third-party JS performance impact analysis |
| accessibility-deep | Color contrast, keyboard nav, ARIA, heading hierarchy |
Tier 3: E-commerce Tests (Browser flows)
| Test | What it checks |
|---|---|
| custom-journey | User-defined multi-step Playwright test flows |
| checkout-flow | Full checkout: add to cart → cart → checkout page |
| product-page-health | Price visible, images load, add-to-cart button, JSON-LD |
| search-functionality | Search input discovery, multi-query testing, results |
| login-flow | Login page discovery, form analysis, HTTPS, error handling |
| contact-form | Contact form discovery, field analysis, validation |
| form-submission-validation | Form endpoint validation and spam protection |
Tier 4: API Tests
| Test | What it checks |
|---|---|
| api-health-check | Custom URL/method/headers with expected status |
| api-latency-benchmark | Latency distribution (p50/p95/p99) |
| graphql-introspection | GraphQL introspection exposure in production |
Tier 5: Heavy/Deep Scans
| Test | What it checks |
|---|---|
| deep-404-scanner | Full BFS crawl (up to 10K pages) with asset validation, SEO analysis, feature detection, external link checking |
Tier 6: AI-powered
| Test | What it checks |
|---|---|
| ai-source-review | AI source code security audit (secrets, debug artifacts, XSS vectors, hardcoded URLs) |
Weight Classes
| Class | Runtime | Priority | Examples |
|---|---|---|---|
| LIGHT | Seconds | Highest (run first) | security-headers, ssl-tls-check, response-time |
| MEDIUM | 10s–2min | Medium | broken-links, accessibility-scan, checkout-flow |
| HEAVY | Minutes | Lowest (queued last) | deep-404-scanner, ai-source-review |
Tests are staggered per weight class to avoid overloading your server: LIGHT tests start immediately, MEDIUM after ~30s, HEAVY after ~2 minutes.
Scheduling
Each test has a default schedule (e.g., every 4 hours, every 12 hours, weekly). You can adjust timing with:
- Schedule multiplier — Scale all intervals (0.5 = twice as often, 2.0 = half as often)
- Manual trigger — Run any test on-demand from the dashboard or CLI
Adaptive Orchestration
After each test completes, the system automatically triggers follow-up tests when relevant:
- Discovery-driven — Deep crawl finds a login page → queues login-flow plugin
- Performance-triggered — Slow response → queues Core Web Vitals check
- Platform-aware — Shopify detected → queues checkout-flow, product-page-health
- Security escalation — Failed security headers → queues sensitive-file-exposure
Note: Adaptive orchestration deduplicates against recent runs (1-hour window) so the same test isn't triggered repeatedly.