Free DPDP website checker.
Enter a website and RuleFix checks it against 17 DPDP-relevant rules: privacy notice, grievance officer, data rights, consent before cookies and trackers, forms and security headers. No signup, nothing stored.
17 checks, from outside.
The same website rules RuleFix runs in the dashboard, limited to the ones that map to DPDP. Each finding links to the page it was found on and explains how to fix it.
Legal pages
· 6- No privacy notice linkedhigh
None of the pages RuleFix read link to a privacy policy or privacy notice.
- Privacy notice has no grievance contactmedium
The privacy notice doesn't mention a grievance officer, Data Protection Officer or a grievance redressal process.
- Privacy notice has no contact detailsmedium
The privacy notice contains no email address, contact link or phone number.
- Privacy notice doesn't explain data rightsmedium
The privacy notice doesn't mention how people can access, correct or erase their data, or withdraw consent.
- No cookie notice for cookies or trackers in usemedium
The site uses tracking cookies or scripts, but no cookie policy is linked and the privacy notice doesn't cover cookies.
- No terms of service linkedlow
None of the pages RuleFix read link to terms of service, terms of use or terms and conditions.
Cookies & trackers
· 3- Analytics or advertising cookies set before consenthigh
The server sets cookies that look like analytics or advertising cookies (e.g. _ga, _fbp, _gcl_au, _hj*) on the very first response, before the visitor could make any choice.
- Session cookie missing security flagsmedium
A cookie that looks like a session or authentication cookie is missing Secure and/or HttpOnly.
- Trackers load without a consent bannermedium
The page loads third-party analytics or advertising scripts (e.g. Google Analytics/Tag Manager, Meta Pixel, Hotjar, Clarity) and no recognisable consent manager or cookie banner with accept/reject choices was found in the HTML.
Forms
· 2- Form submits over insecure HTTPhigh
A form's action posts to an http:// URL, so whatever visitors type is sent unencrypted.
- Form collects personal data without a privacy noticemedium
A form asks for an email address, phone number or name, and there is no privacy link, notice text or consent checkbox in or next to it.
Security headers
· 6- Site isn't served only over HTTPShigh
The plain http:// address serves the page instead of redirecting visitors to https://.
- Insecure http:// resources on an HTTPS pagehigh
An HTTPS page loads scripts, styles, frames or media over plain http://.
- HSTS header missing or too shortmedium
The HTTPS response has no Strict-Transport-Security header, or its max-age is under 180 days.
- No Content-Security-Policymedium
The page sets no Content-Security-Policy header or meta tag (a Report-Only policy alone doesn't enforce anything).
- Page can be embedded by other sitesmedium
Neither X-Frame-Options nor a CSP frame-ancestors directive is set, so any site can load this page in a frame.
- No Referrer-Policy setlow
No Referrer-Policy header or meta tag is set, or the policy sends full URLs to other sites.
A website scan is only the start.
DPDP compliance is mostly about what happens to personal data after it's collected. These are outside what any outside-in website check can see.
- Your code, databases and APIs: how personal data is stored, logged, retained, encrypted or shared with processors.
- Pages behind a login, checkout flows or anything that needs JavaScript to render (the checker reads server HTML only and runs no scripts).
- Whether your consent banner actually blocks trackers after a visitor declines; the checker never clicks consent banners.
- Children's data and verifiable parental consent, Significant Data Fiduciary duties, breach-notification readiness and cross-border transfer rules.
- Whether the wording of your privacy notice is accurate, complete or in the languages your users need. That needs a human (and often a lawyer).
Check the code behind the site
RuleFix scans your repositories for personal data in logs, missing consent capture, weak encryption and retention gaps, then fixes them with your AI coding agent.
Questions about the checker.
Is the DPDP website checker free?+
Yes. It's free, needs no signup and saves nothing: RuleFix reads up to 6 public pages of the site, runs the checks and shows the results in your browser. To keep it fair, each visitor can run a few checks every ten minutes and each site can be checked once a minute.
What does the checker look at?+
Signals a visitor or regulator can see from outside: whether a privacy notice is linked, whether it names a grievance contact and explains data rights, whether analytics or advertising cookies and trackers load before consent, whether forms that ask for personal data link to a notice, and the HTTPS and security headers that protect data in transit.
Does a good score mean my website is DPDP compliant?+
No. The DPDP Act and DPDP Rules 2025 cover how you collect, use, retain and protect personal data across your whole organisation. This checker covers the publicly visible parts of a website only. Use it as a starting point, not as evidence of compliance, and get legal advice for your obligations.
Will the checker affect my website?+
It behaves like a polite crawler: it identifies itself as RuleFixBot, respects robots.txt, reads at most 6 pages with a few requests at a time and stops after 25 seconds. It never signs in, submits forms, clicks buttons or runs JavaScript.
Why was my site blocked or not reachable?+
The checker only reads public websites on standard ports and refuses addresses on private or internal networks. If your robots.txt disallows RuleFixBot, or a firewall or bot protection blocks it, the check stops and says why. Allow the RuleFixBot user agent to check the site.
How do I fix the issues it finds?+
Each finding includes the page it was found on and how to fix it. With a free RuleFix account you can monitor the site, track issues until they're resolved and scan your code too. If you use Claude Code, Cursor or another coding agent, the RuleFix MCP server lets the agent fix issues in your code and verify the fix.
Keep your site and your code DPDP-ready.
Monitor websites, scan repositories and fix issues with your AI coding agent. Free to start.