Measurement, not
opinion.
Most website graders are a thin wrapper around someone else's API, or a language model reading your page and forming an impression. This one runs its own checks and shows its work.
Why it exists
Ask any assistant whether your website is any good and it will answer confidently. It will also, usually, be guessing — inferring from whatever page text it can reach, unable to see your response headers, your robots rules, your structured data or whether your content survives without JavaScript. The answer sounds authoritative and is largely unfalsifiable.
The fix is not a better prompt. It is giving the model something real to work from. This tool exists to produce that: a reproducible measurement, with evidence attached and an explicit statement of what was not checked, in a form an agent can consume directly through the API.
Principles
Deterministic or it does not ship
Every check is a rule written by hand, applied to something we observed directly. No model judges anything and no result is sampled. The precise claim is narrower than "the same score forever": the same observations under the same ruleset produce the same result. A certificate expires, DNS changes, a server answers differently — the observation legitimately changes and so does the score. That is why the collector, ruleset and schema versions are published with every response.
Own the measurement pipeline
No third-party scanner, no external grader, no vendor that can change its terms, start charging or quietly alter its methodology. We query DNS ourselves and complete our own TLS handshake, so we know how every observation was collected and how the verdict was produced. The trade-off is real: no WHOIS, no CVE matching. We would rather do less and own all of it.
State the limits louder than the findings
Every report, every API response and every export carries an explicit list of what was not checked. A tool that lets a model over-claim on its behalf is worse than no tool.
Never invent a number
If a site blocks server-side requests, or renders entirely on the client, it is scored on what is genuinely reachable and the limitation is shown on the report. Filling the gap with a plausible-looking figure would make the whole thing worthless.
Explain, then rank
A list of problems is not much use. Every finding states what was tested, what was measured, why it matters and what to do — and the fixes are ordered by points recovered per unit of effort, computed from the same arithmetic that produced the score.
Collect as little as possible
No accounts, no cookies, no tracking scripts, no third-party analytics. Hostnames and aggregate counts, nothing more. The details are on privacy & security.
How it is built
A collector makes one bounded pass over the target and
gathers every artefact: the document, the redirect chain, headers, cookies, timings, robots.txt,
sitemaps, well-known files, discovered policy pages and a capped set of linked pages — plus a
direct DNS lookup and a real TLS handshake. Eighteen pure
scoring modules then receive that bundle and return {score, weight, checks[]}. Modules
never fetch anything themselves, which is what makes the whole thing reproducible and keeps one
category from influencing another.
HTML is parsed into a document tree in tolerant mode — the way a browser recovers from broken markup — but JavaScript is never executed. That is deliberate. What gets scored is what the server actually sent, which is precisely what search crawlers and AI retrieval systems consume.
Everything runs server-side, so no key is ever exposed to a browser and there is no CORS problem to work around. The full method, including all 200 checks, is documented on How it works.
Open in the ways that matter
The engine is not currently published as a repository, but the things that make a tool auditable are all public:
- Every check is documented — what it tests, why, and its weight — on How it works.
- The scoring formula is published in full, not described vaguely.
- Every audit exposes its raw evidence: the actual headers, tags and snippets behind each verdict.
- The complete result is downloadable as JSON, and available from the API without a key.
- Aggregate results across every site audited are published on public statistics.
If a verdict looks wrong, you can see exactly which rule produced it and what evidence it used — which is the part that actually matters.
/api/v1/llm returns a report already structured for a language
model to act on.