site-spec

Audit the machine-readable layer underneath a website: crawl policy, structured data, canonical and noindex signals, response headers, accessibility semantics, and the tracker surface. Deterministic checks, no account, no score out of 100.

Website URL Audit

What this checks

• robots.txt is present
• robots.txt uses current crawler tokens
• AI search agents are not blocked
• sitemap.xml is present
• llms.txt is present
• a real 404 page is served
• security and cache headers are set
• no dead or harmful header config
• CSP report-only has a report endpoint
• HSTS does not carry preload
• Cache-Control is declared
• the site is not accidentally noindexed
• every page has a title
• every page has a meta description
• every page declares a canonical URL
• structured data (JSON-LD) is present
• structured data parses as valid JSON
• no self-serving review markup
• Open Graph card is present
• large-image social cards have an image
• exactly one h1 per page
• content is server-rendered, not JS-only
• viewport does not block zoom
• images have alt text
• images declare width and height
• the first image is not lazy-loaded
• no insecure http subresources
• no inline event handlers
• fonts are not served from Google's CDN
• analytics and tracker surface
• cookie writes

What this does not check

Broken internal links and missing assets. A partial crawl cannot prove a file is absent from the server, so these checks are disabled here. The CLI runs them against a local directory.

Anything that needs a real browser: JavaScript-rendered content, layout, contrast, focus order. The engine reads HTML as text.

Full WCAG accessibility. The CLI's `npm run verify:a11y` drives axe-core in a real browser; this endpoint only does the markup-level subset above.

HTML validity and schema.org vocabulary validation. Those are the CLI's html-validate and schemarama gates.

Page speed, Core Web Vitals and real load timing.

Pages beyond the crawl cap, non-HTML resources, and any origin other than the one you submitted.

Whether your content is accurate, useful, or true.

Limits

Up to 4 pages per audit, 400 KB per response, 20s total. Public hosts only: requests to private, loopback and link-local addresses are refused. Rate limited per IP.