Production check.
Enter the address of a live product. In a few seconds you get the gaps a browser, a search engine or an attacker would notice first, each with the fix. It's free and needs no account.
What it looks at.
The check is passive. It requests the page you give it, its http address, a page that doesn't exist, robots.txt and security.txt, and reads what comes back. It never logs in and never probes for files that shouldn't be public.
Transport
Whether plain http redirects to https, and whether browsers are told to stay on https.
Headers
Content Security Policy, framing protection, content-type enforcement and referrer policy.
Cookies
Whether cookies set on the first page are marked Secure and SameSite.
Behaviour
Response time, compression, a real 404 for missing pages, and robots.txt.
Disclosure
A security.txt that says where to report a problem, and no software versions in headers.
What it can't see.
Most of what decides whether a product holds up sits behind the sign-in: how sessions are handled, whether payments and the database agree, whether a backup has ever been restored, whether one customer can reach another's data. That takes reading the code.