Questions, answered
directly.

It fetches your page the way a search engine or an AI crawler would, then runs 200 individual checks across 18 categories — SEO, security, privacy, AI readiness, content quality, credibility and more. You get a score out of 100, every finding explained, and a ranked list of fixes with the exact number of points each one is worth.

Free, and there is no account, no cookie and no tracking script. The HTML of an audited page is analysed in memory and discarded — page content is never stored. What is retained is a small aggregate record per audit (hostname, score, category scores, failed check ids) plus a history snapshot at most once per site every six hours. Privacy & security sets out exactly what that contains.

Usually one to eight seconds. A deep crawl fetches additional pages and takes longer. The engine works to a strict time budget and returns what it has rather than hanging.

Fast audits the single URL you gave, plus the site-level files every audit needs (robots.txt, sitemaps, policy pages, well-known paths). Deep crawl additionally fetches up to ten linked pages, which improves sitemap coverage, canonical consistency and NAP-consistency findings.

Yes. Paste the full URL. Page-level checks apply to that page; site-level checks such as robots.txt and sitemaps still apply to the whole domain.

Open the Fixes tab — it is ordered by points recovered per unit of effort, so the top item is the single highest-value thing you can do. Each entry shows what was measured, why it matters and precisely how many points it is worth.

No. Some checks will not apply to your kind of site, and the report marks those as not applicable rather than failing them. Weight matters more than count: one critical security failure costs far more than several low-weight warnings.

Because GEO now means something else. In current search and AI usage it stands for Generative Engine Optimization — being visible to AI answer engines. The old category was about physical place, so it is now Local & Regional, and the AI-visibility work lives in the AI Visibility category. The old /api/v1/geo endpoint still resolves to the renamed one so existing integrations keep working.

They tell you how much to trust a result. measured was observed directly in a response — a header was there or it was not. derived was computed deterministically from observations, such as resolving a robots.txt rule against a path. inferred is a heuristic that can be wrong, like the machine-generated-filler score. Nothing is currently external, because no third-party data source is used.

That we could not reach a verdict, and it is deliberately distinct from a pass or a failure. The specific states are unknown (we looked and could not tell), blocked (the target refused), timeout, inconclusive, and requires_browser (it would need JavaScript we do not run). None are scored. Every report also states its coverage — the share of checks that reached a verdict at all — so an agent knows how complete the picture is.

DNS records and the TLS certificate are first-party observations: we query the records directly and complete a real handshake. DNSSEC validation needs a resolver that reports the authenticated-data flag, which this host does not expose — so it is reported as unknown rather than guessed at. Likewise DKIM, which cannot be enumerated without knowing the selector name.

No. Every check is deterministic server-side code: a direct observation plus a rule we wrote. No language model is involved in producing any score. Stated precisely, the guarantee is same observations + same ruleset = same result — not that a score never moves. A certificate expiring or a DNS record changing legitimately changes the observation and therefore the result, which is why the collector and ruleset versions are published with every response. That is the entire premise — an AI assistant asked "is my SEO good?" should get a measurement rather than an opinion.

Because they measure different things. Lighthouse runs your page in a real browser and measures rendering performance. This tool never executes JavaScript — it analyses what the server actually sent, which is what crawlers and AI retrieval systems consume. The two are complementary, not competing.

It is correct, and it is the finding that matters most. Most crawlers and nearly all AI retrieval systems read raw HTML without running JavaScript. If your content only exists after hydration, it is genuinely invisible to them. The fix is server-side rendering or pre-rendering.

That happens, and the report tries to say so. Blocking AI crawlers, for example, is reported as a warning with a note that it may well be deliberate. Read the reasoning and ignore the ones that do not apply to you — the score is a tool, not a verdict.

It is a transparent heuristic, not a classifier, and the report says so. It measures things like stock-phrase frequency, sentence-length uniformity, entity density and templated heading patterns, then shows you the exact evidence behind the number. Treat it as a prompt to look, not as proof.

Yes — every one of them is documented on the How it works page, including what it tests, why it matters and how it is weighted.

A small SVG you can put in your footer showing that your site has been checked, optionally with the score. It links through to a live audit so visitors can verify the claim themselves rather than taking a graphic at face value. Build one on the badge page.

Not meaningfully. The image is rendered by our server from a real audit of your domain, and it links to a live re-run. Anyone can click it and compare. You could of course host a static picture instead — but then it is just a picture, and the link would not resolve.

No. It is a cached SVG served with long-lived cache headers and loaded lazily. No JavaScript runs on your page and nothing else is loaded.

The result is cached for six hours. If your score drops, the badge drops with it — which is exactly what makes it worth anything to the person reading it.

Yes to both. You can pick which metric it reports (overall, security, privacy, SEO, AI readiness, content, performance, design or credibility), choose a verified-style badge with no number, set light or dark, and write your own label.

Yes, and it needs no key. GET /api/v1/summary?url=example.com returns the score plus ranked fixes. There are per-category endpoints for SEO, security, privacy, AI readiness and the rest, plus /api/v1/llm which returns the whole audit as Markdown written for a language model. See the API documentation.

Because an assistant asked to assess a website otherwise has to guess from whatever page text it can see. This gives it a measurement instead: real headers, real robots rules, real structured data, with an explicit list of what was not checked so it cannot over-claim.

Yes: 40 audits per hour and 200 per day per client. Each audit makes dozens of requests to the target site, so the limits exist to stop the service being used as a scanning proxy rather than to sell you a bigger plan. Results are cached for ten minutes, so repeating the same URL costs nothing and does not consume quota. Successful responses include your remaining allowance.

You get HTTP 429 with a Retry-After header and a JSON body showing your current usage against both windows. Nothing is lost — wait and retry.

Yes. Audit your own sites, your clients' sites, or build the checks into your own tooling.

Only the hostname, never the full URL, path or query string — and only to produce aggregate counts on the public statistics page. The audited page content itself is never stored.

No cookies, no fingerprinting and no third-party analytics. Visitor counts use a hash that includes a salt rotated daily, so the same person is countable within a day but cannot be followed across days.

The tool only reads what a site publicly serves, exactly like any browser or search engine crawler. It does not attempt to log in, submit forms, or access anything not publicly reachable.

Reading public pages is what every browser and crawler does. The exposed-path probe requests a small set of conventional locations such as /.git/config and reports whether they are publicly served; it never exploits anything it finds. If you are uncomfortable with that, audit only sites you control.