Static Website Deploy Checker & Host Config Generator

About the Static Website Deploy Checker & Host Config Generator

Check a static site before you upload it. Drop the folder your build writes, or a ZIP of it (up to 500 MB and 20,000 files), and the page reads every page, style sheet and script the way a static web server serves them: each href, src, srcset, url(), @import and module import is resolved — a folder's index.html, an address without .html, a site served under a sub-path such as /project/ — and checked against the files that are really there. It finds missing files, letter-case mismatches that work on Windows and macOS but answer 404 on a case-sensitive server, accented names stored in another Unicode form, **file:// and drive-letter paths and localhost addresses left from your computer, root-relative links that break under a sub-path, mixed content** (http:// on an https:// page), module scripts browsers cannot load, a missing index.html or 404.html, pages without a title, description, language or viewport, images over 500 KB, files over the per-file limit you set, and files that must never be published: .env files, .git folders, database dumps and server code.

Then it writes the host configuration the site needs — the single-page-app fallback, the 404 page, redirects, clean URLs, the trailing slash, a year's cache for fingerprinted files, and security headers with a Content-Security-Policy built from what your pages load — as _redirects and _headers files, vercel.json, firebase.json, staticwebapp.config.json or an nginx server block. Redirect lists are checked with the rules of the Redirect Generator. Everything happens in your browser: the files are never uploaded.

Without a pass the result is a free preview: the summary counts and up to five findings with their files and lines, and the first lines of each config file; every finding, the fixed ZIP (case renames and link rewrites), the config files and the CSV and PDF reports unlock with a Pro pass.

Common uses

• Checking a build folder before its first upload, when a site that works on your computer shows unstyled pages and missing images on the host.
• Finding the letter-case and backslash mistakes that Windows and macOS hide and Linux servers do not.
• Moving a site to a sub-path (/project/) or to another host, and getting that host’s configuration file right the first time.
• Catching .env files, .git folders and database dumps before they go public with the site.
• Writing the single-page-app fallback, redirects and security headers without reading each host’s reference.

How addresses are checked

Each address is resolved as a browser resolves it — from the page’s folder, or from its <base href> — and looked up as a static server looks it up: the file itself, then a folder’s index.html, then (for pages) the address with .html added, which only hosts with clean URLs serve. A page is checked as it will be served: with Trailing slash: remove, a folder’s page answers at /blog and its relative links start one folder up; with clean URLs and add, about.html answers at /about/. Under a sub-path, an address that starts with / points to the top of the domain, not of the site. srcset candidates, url() and @import in style sheets and style attributes, module imports (followed from module to module), workers, service workers, the web app manifest and the sitemap are all read; only addresses written out in full are followed, not ones a script builds at run time. With Single-page app on, page links without a file extension count as the app’s own routes.

What the fixes change

• Addresses: an address that misses only by letter case, a backslash, a double slash, a sub-path or a module import without .js is rewritten to the file that exists, in its own form (relative stays relative). Only the characters of that address change: every other byte of the file stays as it was. A file that is not valid UTF-8, and an address written with character references or escapes, are left alone and listed.
• Renames: names stored in decomposed Unicode (as macOS stores some) are renamed to the composed form links use; optionally, a file every link spells the same other way is renamed instead of rewriting the links.
• Left out: .env files, keys, .git folders, database dumps and system junk; source maps if you choose.
• The config files you generate can go into the ZIP as well.

The host configuration

Pick the file your host reads. Redirects are read one a line (/old /new 301, /blog/* /news/* 301) and checked for duplicates, loops and chains, which can point straight at the final address; each file writes the status codes its format documents and lists the rules it cannot express. The security headers are X-Content-Type-Options, Referrer-Policy, X-Frame-Options, a Permissions-Policy that leaves open the camera, microphone or location your scripts use, Strict-Transport-Security and a Content-Security-Policy that allows the origins your pages load from and their inline scripts by hash. It starts report-only: it blocks nothing and lists in the browser console what it would block, so you can enforce it once the console stays quiet. Folders of fingerprinted files (app.3f2a9c1b.js) get a year’s cache; pages keep the host’s default. The header values follow the Security Headers Checker.

Limits

Hosts limit the size of one file and of a whole site, and the limits differ by host and plan: set the largest file your host takes under Settings (25 MB by default). Images over 500 KB (or the size you pick) are listed because they slow every page that shows them; the Image Compressor makes them smaller. One check reads up to 20,000 files and 500 MB; text files over 20 MB are counted but not read.

Limitations

• Nothing is fetched: links to other sites are not visited, and a page’s look is not shown.
• Addresses that scripts build at run time, and the routes of a client-side router, cannot be followed; only addresses written out in full are checked.
• Each host adds rules of its own: the files hold what each format documents. Try a deploy on a preview address before you move your domain.
• The free preview shows the summary counts and up to five findings.

Privacy

On this device: nothing is sent

Everything happens in your browser. What you enter or open here is not uploaded or stored by MySmartCoPilot.