NarwhAI
Free instant check

Check your website in about ten seconds

Enter your website address for a free instant website compliance check. It reads your page the way a browser and a search engine do, then tells you what is missing against the Australian Privacy Principles, basic web security and accessibility. Built for Australian small business. No sign-up, no email required, nothing stored.

Only publicly available pages are read, exactly as any visitor or search engine would. Nothing is probed, scanned or tested beyond a normal page request. The address is used to run the check and is not stored or used for marketing. See the privacy policy.

What the free website check looks at

Twelve checks across four areas

The checker requests one public page from your website, exactly as a visitor or Google would, and reads what comes back. Here is every check it runs, so you know what the result does and does not cover.

Privacy and consent

The Australian Privacy Principles checks, and the ones most small business websites fail.

See these checks

Privacy policy link. Whether a link containing the word “privacy” appears anywhere on the page. If a search engine cannot find your privacy policy from your home page, neither can a customer or a regulator.

The policy actually loads. The checker follows the link and confirms it returns a working page. Broken and redirected privacy policy links are surprisingly common after a site rebuild, and they are the kind of thing nobody notices for years.

Policy date. Whether the policy shows any date. An undated privacy policy gives a customer no way to know whether it reflects how you operate now.

Data retention. Whether the policy says anything about how long information is kept. APP 11 expects you to destroy or de-identify personal information you no longer need.

Overseas disclosure. Whether the policy mentions sending information overseas. If you use a booking tool, an email platform or cloud hosting outside Australia, APP 8 applies to you, and most policies written before that was common do not mention it.

Collection notice at the form. Whether your enquiry or contact form explains, right there at the form, why you are collecting the details. This is APP 5, and it is the single most common gap found. A privacy policy linked in the footer does not satisfy it on its own, because nobody opens a policy before typing their name into a box.

Third-party services. Which external scripts and embeds load on your page: analytics, chat widgets, booking systems, pixels, font and map providers. Each one can see that a visitor was on your site. Where any of them receive personal information or sit overseas, that usually belongs in your privacy policy.

Cookie consent. Whether a recognised cookie or consent tool is present on the page.

Website security basics

The HTTPS and security header checks that take minutes to fix and are embarrassing to be caught without.

See these checks

HTTPS and SSL. Whether the site is served securely. A site still running on plain HTTP is flagged by browsers as “Not secure” and is pushed down in Google results.

HTTP redirects to HTTPS. Having a certificate is not enough if the insecure version of your site still answers. The checker confirms that visitors arriving at the http:// address are moved to the secure one.

HSTS. Whether your server tells browsers to only ever connect securely in future, which closes a real gap on public and cafe wi-fi.

Security response headers. Whether standard protective headers are present, including the ones that stop your site being loaded inside someone else’s page in a clickjacking attack, and the ones that limit what a browser will execute if content is ever injected into your pages.

None of this is penetration testing. Nothing is probed, scanned or attacked. The checker only reads the response your server gives to a completely ordinary page request.

Accessibility

The WCAG basics that affect both disabled visitors and your search ranking.

See these checks

Image alt text. How many images on the page have no alt attribute. A screen reader cannot describe those images to a blind visitor, and Google cannot read them either, so you lose on both accessibility and SEO at once.

Page language. Whether the page declares its language. Without it, a screen reader may read your English page using the wrong pronunciation rules, which can make it close to unusable.

Page title. Whether the page has a title at all. This is the first thing a screen reader announces and the blue line Google shows in search results.

Australian businesses are expected to work toward WCAG 2.2 Level AA. These three are the starting point, not the finish line. A full accessibility review looks at colour contrast, keyboard navigation, focus order, form labels and heading structure, none of which can be judged reliably from source code alone.

Legal and transparency

Whether a visitor can find the terms they are agreeing to.

See these checks

Terms link. Whether terms of service, terms of use or terms and conditions can be found from this page. If you sell, take bookings, take deposits or run a mailing list from your website, the terms are what you would rely on in a dispute, and they are worth nothing if a customer was never shown them.

This area is deliberately light in the free check. Whether your terms actually say what you need them to say, whether they match how you really operate, and whether they would survive contact with Australian Consumer Law are questions a page scan cannot answer.

Every finding is reported with a severity colour band so you can see at a glance which areas need attention first. The free check shows you where the gaps are. The paid review explains what each one exposes you to and how to close it.

Who uses this

Built for Australian small business websites

The free website compliance checker was written for the kind of business that has a perfectly good website built by a designer or an agency three or four years ago, has not looked at the privacy policy since, and has no idea whether any of it still holds up. That covers most small businesses in Australia.

It is used most often by allied health and medical practices taking patient details through an online booking form, NDIS and aged care providers handling sensitive information, childcare centres and tutoring services collecting information about children, builders, trades and engineering firms taking project enquiries, accountants, bookkeepers, mortgage brokers and law firms handling financial and identity documents, real estate agencies running application forms, and online stores that collect customer accounts and take payment through a third-party checkout.

It works for a business anywhere in Australia. NarwhAI is based in Canberra, ACT, and works with businesses across the ACT, NSW and nationally, remotely or in person.

Why now

What changes on 10 December 2026

The Privacy Act 1988 reforms commence on 10 December 2026. From that date, Australian businesses face new transparency requirements around automated decision-making, a statutory tort for serious invasions of privacy, and a new Children’s Online Privacy Code. The small business exemption, which has let businesses under three million dollars turnover sit outside most of the Act, is under active review and is widely expected to narrow.

You may well be covered already and not realise it. The exemption does not apply if you trade in personal information, provide a health service, are a contracted service provider to the Commonwealth, or are related to a larger business. A great many small operators fall into one of those categories without ever having checked.

None of that is a reason to panic. It is a reason to know where you stand, which takes about ten seconds and costs nothing.

Run the free check Does the Privacy Act apply to me?
What this does and does not do

Honest limits

Is it really free?

Yes. No sign-up, no email required, no credit card. You enter an address and the results appear on this page.

What does it actually look at?

It reads one public page the same way a browser would, then reports on privacy policy and terms links, whether forms explain why they collect information, HTTPS and security headers, third-party services loading on the page, and accessibility basics such as image alt text and page language. If it finds a privacy policy link it also checks the link works and whether the policy mentions a date, a retention period and overseas disclosure.

Does a clean result mean I am compliant?

No, and I would rather say so plainly. This reads one public page. It cannot see your booking system, your paper forms, who on your staff has access, or how long you keep records. It is an indicator of where to look first. It is not an assessment and it is not legal advice.

Do you store the address I enter?

No. It is used to run the check and discarded. Nothing reaches me unless you choose to use the enquiry form afterwards.

Is it alright to check a site I do not own?

The check only requests a page the same way any visitor or search engine does, so it is no different from opening the site in a browser. It does not attempt to log in, probe for vulnerabilities or test anything beyond a normal page request. Even so, this is built for checking your own site.