Every check, with its failure mode written next to it.

The contents of the first <title> element: presence, length, whether it states what the product does, whether it is just the brand, and how it compares to the H1. A generic title such as “Home” or “Vite + React” scores zero.

The <meta name="description"> value: presence and length. It never falls back to og:description, because the two tags do different jobs.

How many H1 elements are in the raw HTML and whether the text describes the product rather than a greeting.

<link rel="canonical">: presence, whether it resolves, and whether it points at this page or somewhere else.

The meta robots tag and the X-Robots-Tag response header, for noindex, none and nofollow.

The lang attribute on the <html> element, and whether it is non-empty. Nothing else about language is inferred — no hreflang, no content translation.

Whether a rel=icon link exists, whether the file answers HTTP 200, and its declared content type.

Whether /sitemap.xml or /sitemap_index.xml returns readable XML, including a sitemap declared in robots.txt at a non-standard path.

A bounded sample (up to 4) of pages listed in your sitemap: their status, redirects, content type, robots directive, canonical and whether titles repeat.

Whether robots.txt is served and readable, whether it declares a Sitemap, and whether a declared sitemap can actually be read.

The og:title property and whether it reads as a headline rather than the site name.

The presence of the og:description property and whether it carries any real text. It never borrows the value from <meta name="description">, because the two tags are read by different audiences.

Whether og:image is declared, resolvable, and — since v4 — whether the image actually answers. We send a HEAD request to the URL and read its status, content type and declared size, next to any declared og:image:width/height/type.

Whether twitter:card is present and whether it asks for a large image.

Whether a twitter:image property is declared, and whether it resolves to an absolute URL. We do not re-fetch it here — og:image is the one we actually request.

robots.txt parsed into User-agent groups, then tested for five retrieval agents — OAI-SearchBot, ChatGPT-User, PerplexityBot, Claude-WebBot, anthropic-ai — against the audited page's path. Longest matching rule wins, Allow beats Disallow on a tie, an empty Disallow blocks nothing, and an agent with no group of its own falls back to the * group.

The same parse, for GPTBot, ClaudeBot and Google-Extended — the crawlers that collect material for future models.

How much text is in the HTML you were sent, plus two app-shell markers: a root container named root/app/__next/nuxt/svelte/vue/angular/application, and a noscript asking the visitor to enable JavaScript.

Whether /llms.txt is served, its size, and how many pointers it contains — Markdown links and bare URLs both count.

What the JSON-LD actually claims: the @type values found, whether the primary entity carries name, url and description, whether a product or organisation type is present at all, and — new in v5 — whether the name in the markup has any word overlap with the page's own title and H1.

How many <img> elements exist, how many carry an alt attribute, and whether the text is a real description. alt="" counts as handled: it is the correct way to mark decorative art. A filename used as alt does not.

The sequence of heading levels in document order and whether any level is skipped.

How much visible text the page carries and whether it states who the product is for and what it does.

Visible first-hand signals: screenshots or demos, numbers, named users, dated changelog entries, an author byline.

Author attribution, an about or team page in the navigation, and Person or Organization markup.

Links to recognised public profiles and outbound links to documentation, research or reference material on other hosts.

Whether the page links a privacy policy, terms and a contact route, and whether HTTPS is in place.

Whether each application/ld+json block parses as JSON, and how many fail.

How many links point to another path on the same host.

Presence of Strict-Transport-Security, a Content-Security-Policy, X-Content-Type-Options: nosniff, and a frame control (X-Frame-Options or CSP frame-ancestors) on the page response.

On an HTTPS page, subresource references still written as http:// — src, srcset, poster, data-src, background and url(...) in inline style.

Whether any <form action> on an HTTPS page points at an http:// endpoint.

Time to first response headers, measured from our server, once.

Bytes of HTML returned for this one URL.

<script src> elements inside <head> with no async, defer or type=module.

The presence and shape of <meta name="viewport">.

Whether the audited URL ends up on an https: connection.

How many <img> elements carry loading="lazy", against the total.