Ship deploys thatdon't silently break.
Paste any Vercel URL. Get a 40+ point deploy audit in under 30 seconds — security headers, caching, vercel.json, performance, SEO, a11y — with the exact code snippet to fix each finding.
Deploy Report · Preview
my-next-app.vercel.app
Overall Deploy Health
68/100
Score bar
Deploy
72
Perf
58
A11y
84
Sec
52
2
Critical
7
Warnings
31
Passed
Top Findings
Missing Content-Security-Policy header
CriticalNo CSP detected. XSS payloads can execute inline scripts.
Static assets served without Cache-Control
Warning/_next/static/* returns cache-control: public, max-age=0. Users re-download unchanged bundles.
+ 35 more findings with fix snippets →
The problem
Most Vercel deploys ship with 3–8 silent issues you'll only find after a user complains.
You pushed to prod on Friday. Your team's excited. But nobody checked the headers. Nobody diff'd the bundle size. Nobody tested from another region. Monday morning: support tickets, paid traffic under-converting, a security tweet.
Missing security headers
CSP, HSTS, X-Frame-Options are off by default on Vercel — you're shipping an attack surface.
Caching you forgot to set
Static assets served without Cache-Control mean slower TTFB, wasted Edge bandwidth, higher bills.
vercel.json misconfigured
Wrong regions, oversized functions, missing rewrites — users get 500s and cold starts you never see.
SEO meta tags empty
Deploy landed with blank og:image or missing canonical. Paid traffic converted worse since release.
Performance regression
Bundle size grew 40% in last deploy. Lighthouse dropped 20 pts. Nobody noticed the diff.
Env leaks in client bundle
A stray NEXT_PUBLIC_ pushed a DB string to the browser. You only found out because a screenshot went viral.
How It Works
A deploy audit in 3 steps. Zero setup.
No Github app, no Vercel token, no CLI. Run your first check before your coffee gets cold.
Step 1
Paste your Vercel URL
Drop in any deployed URL — app.vercel.app or custom domain. No install, no token, no config.
Step 2
We scan 40+ deployment checks
Deploy config, headers, caching, performance, a11y, SEO, security best practices — in under 30 seconds.
Step 3
Get a fix plan with code snippets
Every finding ships with a copy-pasteable next.config.js / vercel.json fix and Vercel docs link.
What's Checked
6 categories. 40+ rules. Actionable output.
Every finding comes with severity, impact, and a copy-pasteable fix — usually a vercel.json header block, a next.config.js stanza, or the exact meta tags to add.
Deploy Config
vercel.json best-practice audit
Regions, function sizing, rewrites, redirects, ISR params, Edge vs Node — we flag the defaults that hurt real users.
Performance
Lighthouse + Edge TTFB
Core Web Vitals from multiple regions. Bundle size regressions caught before they become a Friday night page.
Security
Headers + env leak scan
CSP, HSTS, Referrer-Policy, X-Content-Type, clickjacking protection, and client-bundle env leak detection.
SEO & Social
Meta, OG, and canonical
og:image sizes, Twitter cards, canonical URLs, noindex traps, sitemap/robots — the deploy-time SEO checklist.
Accessibility
A11y baseline
Landmark regions, color contrast, alt text, heading order, ARIA usage — the subset that ships regressions most often.
CI Integration
Block bad deploys
Run the doctor in GitHub Actions / Vercel Checks. Block the merge if score drops below your team's threshold.
What a report looks like
Not a vague dashboard.
A fix list with code.
Each finding has severity, category, impact, and a concrete recommendation — often with a vercel.json / next.config.js snippet you can paste and ship.
deploy.doctor/r/preview · my-next-app.vercel.app
Missing Content-Security-Policy header
No CSP detected. XSS payloads can execute inline scripts.
Recommended fix
Add CSP header in vercel.json with a strict default-src policy.
Static assets served without Cache-Control
/_next/static/* returns cache-control: public, max-age=0. Users re-download unchanged bundles.
Recommended fix
Add vercel.json header rule: `/_next/static/*` → `public, max-age=31536000, immutable`.
og:image missing or wrong size
og:image not set. Social shares fall back to empty preview — losing up to 30% CTR.
Recommended fix
Add a 1200×630 og:image and corresponding og:width/og:height meta tags.
Unused JS: 87 KB from vendor chunk
Largest contentful paint 2.8s — 430 KB JS of which 87 KB is unused in landing route.
Recommended fix
Split vendor bundle with dynamic imports. Consider route-level code splitting.
Who it's for
Built for the three people that care about deploys.
Indie hackers launching fast
Ship 5 Vercel projects a month? Don't let a caching misconfig or missing og:image tank your launch day conversion.
SaaS teams on paid traffic
Each deploy is a $ spend. You need to know — before the alert — that LCP regressed and forms are not focusable.
Agencies shipping client work
Deliver a deploy-quality report with every handoff. Turn 'looks fine on my machine' into a quantified artifact.
Simple, honest pricing.
Start free forever. Upgrade when you want scheduled checks, CI integration, and AI fix recipes. Cancel anytime.
Free
For indie hackers validating their latest deploy
$0
Starter
Early-bird · For solo founders shipping side projects
$12
$19
/mo
Growth
Early-bird · For product teams running paid traffic
$32
$49
/mo
Agency
Early-bird · For agencies delivering deploy quality to clients
$99
$149
/mo
All prices in USD. Early-bird discount locks in when you create an account during pre-launch.
FAQ
Questions teams usually ask first
Do I need to install anything or share Vercel tokens?
No. Paste any public Vercel URL. Deploy Doctor works from the outside in — no auth, no CLI, no Github app install. (CI/CD integration is opt-in, Growth and above.)
What exactly gets checked in one scan?
~40 checks across 6 categories: deploy config (vercel.json), HTTP headers & security, caching & performance, Lighthouse (PWA / A11y / SEO basics), meta/social tags, and common Next.js pitfalls. We add new rules every week.
How is this different from Vercel's built-in Analytics?
Vercel Analytics shows you traffic and Web Vitals after users arrive. Deploy Doctor runs pre-launch and tells you exactly which vercel.json / header / meta line to change — with the code snippet — before your next deploy ships.
Can I run it in CI to block bad deploys?
Yes. Growth plan exposes a small REST API. Point GitHub Actions or Vercel Checks at it, set a score threshold (e.g. overall >= 85, deployHealth >= 90), and the PR fails until the issue is fixed.
Is there a discount for early supporters?
Yes. During the pre-launch waitlist, all paid plans are 37% off forever. Lock in the early-bird price by creating a free account before GA.
Do you store the contents of my pages?
No. We fetch public HTTP responses, extract the metrics we need, and discard raw HTML within 24 hours. Only the aggregate score and findings are kept in your account.
Your next deploy ships tomorrow.
Make it the first one without regressions.
Join the pre-launch waitlist. Lock in a 37% lifetime discount. Your first check runs in under 30 seconds.