slopticgrades any live web app

Grade a deployed web app.

Give Sloptic a live URL. It scores how well the app holds up on the things every app should have, no matter what.

Running a hackathon? Rank a whole event.

What is Sloptic?

Sloptic is a black box web app grader. It checks the security, accessibility, quality, and performance traits that every app should get right, whatever it was built to do. Because those traits do not depend on an app's purpose, Sloptic can compare and rank apps against each other.

  1. 01

    Paste a URL. No setup needed.

  2. 02

    Sloptic opens it in a real browser and checks what any visitor sees.

  3. 03

    You get one score with a breakdown on every issue found and what was tested.

What it checks

every check

Sloptic checks the things every web app should get right, no matter what it does. Open an area to see what gets checked.

Note that in anonymous mode, we only run the passive checks, i.e. checks that do not alter the site, send attack payloads, or go fishing for secrets. To run the active ones, log in and prove the site is yours.

Getting this wrong costs the people who trusted your app, not you. Sloptic looks for missing defenses and secrets left in the code you ship, following OWASP.

See all 28 in this area.

What you get back

sample
https://example-hackathon-app.vercel.apppassive mode
42lower is better
security4/9/14
quality3/8/12
performance2/6/11

failed passed did not applyChecks that failed, out of those that applied, out of every check in this mode.

no content security policyNothing tells the browser which scripts may run, so an injected one would.+5
development build shippedThe live site serves a dev build, which exposes internals and runs slower.+8
slow first responseThe server took over a second to send the first byte.+3
clickjacking defenseThe app refuses to be framed by another site.0
images have alt textA screen reader can describe every image on the page.0

The score

One number, so you can see how your app is doing at a glance and compare it to others.

Lower is better

Like golf. A 0 means nothing was found. There is no maximum: a messier app just scores higher.

It only counts problems

You do not earn points for what you did right; the score only adds up what is wrong. An app with nothing to fix and an app that fixed everything both score 0.

Weighted by how much it matters

A serious security hole adds more than a small nicety, and the same problem repeated across ten pages counts once, not ten times.

Compared to real apps

Your score is ranked against a large set of real apps, so you see not just a number but where you stand.

Passive by default

Some checks would send real attack traffic at a site. Pointing those at a site you have not shown you own would be wrong, so by default Sloptic never does.

  1. Anyone

    no account

    The look-only checks run on any URL. They read what your app already shows the public, so they are safe to point at anything, and they are most of what the score is made of.

  2. Your own site

    verify the domain

    Sign in, then publish a token we give you at /.well-known/sloptic-verification.txt. Once we can fetch it back, the rest of the checks run and the result gets ranked. What verifying involves.

  3. Running an event

    verify the event

    Grade the web app entries in your hackathon on one scale, so they can be compared. How it works for organizers.

Why only some runHow the grade works

sloptic /ˈslɒp.tɪk/ noun

A coinage from slop, Merriam-Webster's word of the year for 2025 for the low-effort output that generative AI now produces in bulk, and optic, an instrument for bringing something into focus. The apparatus by which slop of the software kind, the app that ships functional but unhardened, is resolved into a single comparable number, serenely indifferent to whatever it was meant to be.