There's no single free tool that does everything well, and most of the popular ones are excellent at one narrow job. Pick the wrong one and you'll get a perfect speed score while your DMARC record is broken, or a clean SSL report on a site Google can't index. This guide compares eight free tools on what they actually check, where each one is the best choice, and where it falls short, including our own.
Key takeaways
- No single free tool does everything well, so combine a broad audit with specialist tools for whatever it flags.
- PageSpeed Insights shows real-user Core Web Vitals, while GTmetrix adds request waterfalls, video and a choice of test location.
- Google Search Console is the only tool that shows how Google itself sees your site, so every site owner should set it up.
- Use MXToolbox for email and blacklist checks, Security Headers for HTTP headers and SSL Labs for deep TLS analysis.
The short version
| Tool | Best at | Covers | Free limits (as of Oct 2026) |
|---|---|---|---|
| PageSpeed Insights | Real-user Core Web Vitals plus a Lighthouse lab test | Performance, accessibility, best practices, SEO basics | Free, no account |
| Lighthouse | Testing locally, behind logins, in CI | Same categories as PSI, lab only | Free, open source |
| GTmetrix | Waterfall analysis, testing from chosen locations, video | Performance | Account required; free tier is limited, more on paid plans |
| Google Search Console | Indexing, crawl errors, field CWV for your whole site | SEO, Google's view of your site | Free, must verify ownership |
| MXToolbox | Email and DNS lookups, blacklist checks | MX, SPF, DKIM, DMARC, blacklists, SMTP | Lookups free; one free monitor |
| Security Headers | Grading HTTP security headers | Response headers only | Free |
| SSL Labs | Deep TLS server configuration analysis | Certificates, protocols, ciphers, chain | Free |
| MakeItFlow | One combined report across layers | Performance, SEO, DNS, email, security headers, TLS certificate, exposed files | 5 scans/day free |
Now the detail.
PageSpeed Insights
Google's PageSpeed Insights (PSI) shows two kinds of data side by side:
- Field data from the Chrome User Experience Report (CrUX): what real Chrome users experienced over the previous 28 days, for LCP, INP, CLS, FCP and TTFB. If a URL doesn't have enough traffic, PSI falls back to data for the whole origin, or shows nothing.
- Lab data from a Lighthouse run in a Google data center, with a 0-100 performance score (90+ good, 50-89 needs improvement, under 50 poor).
Use it when: you want to know whether you pass Core Web Vitals in the eyes of Google, and get a prioritized list of performance fixes.
Where others are better: PSI tests one URL at a time from a location you don't choose, and its lab score can vary noticeably between runs. It doesn't keep history. It says nothing about DNS, email or most security settings. Our PageSpeed Insights score explained guide helps with reading the report.
Lighthouse
Lighthouse is the open-source engine behind PSI's lab data. You can run it in Chrome DevTools (Lighthouse tab), from the command line (npm install -g lighthouse), as a Node module in CI, or via PSI. It audits Performance, Accessibility, Best Practices and SEO.
Use it when: the page isn't public yet (localhost, staging, behind a login), or you want automated checks on every deploy.
Where others are better: results depend on your own machine and network, so they're best for comparing before and after a change rather than as an absolute number. It's lab-only: no real-user data, and DevTools runs are affected by browser extensions (use an incognito window). Like PSI, it doesn't look at DNS, email or certificates.
GTmetrix
GTmetrix runs Lighthouse-based tests in a real Chrome browser from its own test servers, and adds tools PSI doesn't have:
- A request waterfall and video playback, so you can see exactly which file is blocking what.
- Choice of test location. GTmetrix lists 28 locations worldwide, though the number available depends on your plan.
- Device and connection simulation, saved presets, and testing pages behind HTTP basic auth.
- The GTmetrix Grade, which combines a Lighthouse-based Performance score with GTmetrix's own Structure score.
- History and monitoring with alerts.
Use it when: you need to diagnose why a page is slow, or test from a region near your customers.
Where others are better: you need an account to test, and the free tier has tight limits. GTmetrix's own pages currently describe a free trial, with paid plans starting at $4.99/month billed yearly for 50 on-demand tests a month from five locations. It's lab data only, so it can't tell you whether real users pass Core Web Vitals; PSI or Search Console can. It's performance-only. See our GTmetrix vs PageSpeed Insights comparison for the detail.
Google Search Console
Search Console is the only tool that shows how Google itself sees your site: which pages are indexed and why others aren't, crawl errors, sitemaps, manual actions, search queries and clicks. Its Core Web Vitals report groups your URLs using CrUX field data and flags groups that fail LCP, INP or CLS.
Use it when: you care about search traffic. Every site owner should set it up.
Where others are better: you must verify ownership, so you can't use it on a prospect's or competitor's site. Data is delayed and sampled, and new or low-traffic sites may show "no data" for Core Web Vitals. It doesn't test DNS, email or security headers. For indexing issues, see crawled, currently not indexed.
MXToolbox
MXToolbox has been the default email-troubleshooting toolbox for years. Free lookups include MX records (queried directly against the authoritative server), SPF, DKIM (you supply the selector), DMARC, SMTP diagnostics and checks of a mail server IP against around 100 DNS blacklists. Free users get one monitor covering the top 30 blacklists; paid Delivery Center plans add DMARC report management, inbox placement testing and more monitoring.
Use it when: email is bouncing or going to spam, you need to check whether your sending IP is blacklisted, or you want to read DMARC aggregate reports.
Where others are better: each lookup is a separate test, so building a full picture takes many clicks. It's not a website performance, SEO or security header tool. For a walkthrough of what to check, see our email authentication checklist.
Security Headers (securityheaders.com)
Originally created by Scott Helme and now part of Snyk, Security Headers fetches a URL and grades its HTTP response headers from A+ to F, checking for headers such as Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy.
Use it when: you're configuring headers and want quick, focused feedback with explanations.
Where others are better: it only looks at headers on the URL you give it. It doesn't evaluate whether your CSP is actually effective, and it doesn't check certificates, exposed files or anything outside the response. Recent scans appear on public lists unless you tick "Hide results." Our HTTP security headers guide has copy-paste configs.
SSL Labs (Qualys SSL Server Test)
SSL Labs is the deepest free TLS analysis available. It tests every IP behind a hostname and reports supported protocol versions, cipher suites, certificate chain issues, known vulnerabilities and HSTS, with a letter grade.
Use it when: you need to prove your TLS configuration is solid, debug chain problems, or confirm old protocols are disabled.
Where others are better: a full test takes a minute or more per hostname, and it's TLS only. It's a detailed engineering report, which is more than most site owners need for a routine check. Tick "Do not show the results on the boards" to keep the test off its public lists.
MakeItFlow
Our tool is built to answer "what's wrong with this site?" in one pass. A single scan covers:
- Performance: PageSpeed Insights/Lighthouse score and Core Web Vitals
- On-page SEO: title, meta description, headings, canonical,
robots.txt, XML sitemap and a sample of internal links checked for breakage - DNS: A, AAAA, NS, MX, TXT, SOA and CAA records, plus DNSSEC
- Email: SPF, DKIM, DMARC, MTA-STS and BIMI
- Security: HTTP security headers, TLS certificate, and probes for exposed files such as
.envand.git - Technology detection
The result is an A-F grade, a prioritized fix list, a shareable link and a PDF. The free plan allows 5 scans a day; paid plans add history, scheduled re-scans, side-by-side competitor audits, white-label PDFs, bulk scanning, an API and a whole-site crawl.
Use it when: you want a single report that catches problems across layers, for your own site or a client's, without running six tools.
Where others are better, honestly:
- Our performance data comes from PageSpeed Insights, so for a request waterfall, video or a chosen test location, use GTmetrix.
- For full TLS protocol and cipher analysis, SSL Labs goes much deeper than our certificate check.
- We don't check IP blacklists or manage DMARC reports; MXToolbox does.
- Only Search Console can show what Google has actually indexed.
- We don't do minute-by-minute uptime monitoring or malware scanning. Rank tracking and backlinks come from your own Google Search Console and Bing Webmaster Tools data (a free rank tracker and a backlink checker for your verified sites), not from a third-party index of competitors.
See /compare for a side-by-side with other paid tools.
Which tools should you use?
A practical free stack for most small businesses:
- Search Console, set up once and checked monthly.
- A combined audit (such as running a free audit here) after any change and on a regular schedule, to catch cross-layer problems.
- The specialist tools when the audit points at something: GTmetrix or Lighthouse for a slow page, MXToolbox for email delivery problems, SSL Labs for TLS errors, Security Headers while configuring headers.
Frequently asked questions
Why do PageSpeed Insights and GTmetrix give different scores?
They run tests from different locations, on different hardware and network settings, and GTmetrix's headline grade includes its own Structure score. PSI also shows real-user field data, which GTmetrix doesn't. Compare each tool with itself over time rather than against the other.
Is Lighthouse the same as PageSpeed Insights?
PSI uses Lighthouse for its lab data, but adds real-user CrUX field data and runs the test on Google's servers. Running Lighthouse yourself gives results that depend on your own computer and connection.
Which free tool is best for checking email setup?
MXToolbox is the most complete set of individual email lookups and includes blacklist checks. A combined audit tool is faster for confirming SPF, DKIM, DMARC, MTA-STS and BIMI together alongside your MX records.
Do I need SSL Labs if my site already shows a padlock?
The padlock only tells you the browser accepted the certificate. SSL Labs shows whether older protocols or weak ciphers are still enabled, whether the chain is complete for all clients, and whether every server behind your hostname is configured the same way.
What to do next
Set up Search Console if you haven't, then run one combined audit to find the biggest problems across performance, SEO, DNS, email and security. Use the specialist tools above to dig into whatever it flags, and re-run the audit after each fix to confirm it worked.
Sources
Written by the MakeItFlow team
We build the website audit these guides are based on. Every fact is checked against the primary sources listed above and this guide was last reviewed on 31 October 2026 . How we research and check
Check your own site in 30 seconds
Run a free audit covering speed, SEO, DNS, email authentication and security headers — and get a prioritised fix list.
