SEO, AEO, Security and Accessibility Audits for Any Website
Check a site for security, trust, Google spam policies, HTTP errors and accessibility, debug and generate schema, and see how people, Google and AI systems read your business. Pick a tool below: each card says what it checks and answers the common questions.
Established audits
Each of these audits has been tested on hundreds of live websites built on every kind of website platform, and each one checks your site against the official rules for its subject: accessibility for disabled visitors, Google's spam rules, the formats AI tools read (llms.txt and Markdown), structured data, Google's own guide to judging page quality, and the standards for security, server logs and page errors. Some of them check more than the well-known free tools do.
Accessibility Audit: checks things the engine behind Google Lighthouse's accessibility checks has no test for, such as whether keyboard users get stuck, whether they can see where they are on the page, and whether the page still works on a phone screen.
Security Audit: checks more than Mozilla's free security grader, which looks at the settings your site sends with each page and how it redirects visitors. It also checks your security certificate and when it runs out, the email and domain settings that stop people faking your emails or your domain, pages that mix secure and insecure content, and whether the software your site runs has known security holes.
Each of these audits has been tested on hundreds of live sites across every type of CMS, and each checks against a published standard: WCAG 2.2 Level A and AA, Google's spam policies, the llmstxt.org spec, current Markdown guidelines, schema.org and Google's structured data rules, Google's search quality rater guidelines, and the security, log and HTTP standards behind each check. Some of them go further than the widely used audits out there.
Accessibility Audit: tests WCAG 2.2 criteria that axe-core, the engine behind Google Lighthouse's accessibility checks, has no rule for, such as keyboard traps, visible focus and reflow on phones.
Security Audit: goes further than Mozilla's HTTP Observatory, which grades a site's HTTP headers and redirects. It also runs a real TLS handshake to check the certificate and its expiry, checks SPF, DMARC, DKIM, CAA and DNSSEC records, finds mixed content, and matches the server and CMS versions it detects against the NIST National Vulnerability Database for known vulnerabilities.
Security Audit
Checks the security settings any visitor's browser can see: security headers, the TLS certificate, cookies, mixed content, mail and DNS records, known vulnerabilities in detected software, and more.
Questions and answers about the Security Audit
How do I check if my website is secure?
Enter the address, choose This page or Whole domain, tick the box to confirm you own the domain or have permission, then press Run audit. It checks your security headers, TLS certificate, cookies, mixed content and DNS records, and scores each risk.
Which sites can I run the Security Audit on?
Domains you own or have written permission to scan. You tick a box to confirm this before the audit runs. The standard audit is passive and reads only what any visitor can already see; the extra active tests run only after you prove you control the domain.
How long does the Security Audit take?
The Security Audit usually returns results in well under a minute. It reads what a normal visit exposes, such as security headers, the TLS certificate, cookies and DNS records, so there is no long crawl to wait for. Choose This page to check one address, or Whole domain.
Passive checks of the HTTP response headers (how strict the Content-Security-Policy is, HSTS and preload, frame protection, Referrer-Policy and Permissions-Policy), a real TLS handshake (certificate validity, expiry with a 30-day warning, protocol version, HTTP to HTTPS redirect), Set-Cookie flags (Secure, HttpOnly, SameSite), mixed content, and server and CMS version disclosure matched against the NIST National Vulnerability Database for known CVEs. DNS checks cover SPF, DMARC, DKIM, CAA and DNSSEC, plus robots.txt and security.txt. The score starts at 100 and deducts by risk, so one critical failure outweighs many passes. Active tests (rate limiting, access control, header consistency, upload filtering) run only after you verify the domain, with bounded requests and no exploit payloads.
Google Spam Policy Audit
Reads your pages as a visitor, as Googlebot, on mobile and from Google, and reports signs that match Google's spam policies, with where each one is and how to fix it.
Questions and answers about the Google Spam Policy Audit
What is cloaking in SEO?
Cloaking means showing search engines different content from what visitors see, which breaks Google's spam policies. The Spam Policy Audit fetches each page as a normal visitor, as Googlebot, on a phone and from Google, and compares the responses to find it.
Which Google spam policies does it check?
17, including cloaking, sneaky redirects, hidden text and links, keyword stuffing, hacked content, link spam, user-generated spam, scaled content abuse, doorway abuse, site reputation abuse, expired domain abuse and spammy structured data. Machine-generated traffic, legal removals and personal information removals cannot be seen from a website, so they are marked for checking by hand.
What should I do with the signs the Spam Policy Audit finds?
Open each named URL and check the quoted item against the page, trace it to its source, such as a template, widget or plugin, so it is fixed once, then run the audit again with the same settings to compare.
Each URL is fetched as a normal visitor, as Googlebot, on a phone and as a visitor arriving from Google, and the responses are compared to find cloaking and sneaky redirects, including redirects made by scripts. Selected pages are also rendered in headless Chrome (10 signed out, 25 signed in). Every URL and every linked site is checked against Google Web Risk. Expired domain abuse is checked by comparing the domain's RDAP registration date with Wayback Machine snapshots of earlier sites. Hacked content checks look for spam terms in 11 languages, hidden iframes and suspicious scripts. URLs come from the homepage and the sitemaps, including sitemap indexes: up to 20 signed out or 100 signed in.
Real Traffic Audit
Reads your server access log and separates real people from AI crawlers, search engines, bots and your own server, then shows where people came from, what they read and the errors they hit.
Questions and answers about the Real Traffic Audit
How do I check bot traffic on my website?
Download the access log from your host and drop it into the Real Traffic Audit. Each request is sorted into your own server, AI crawlers, search engines, headless browsers, other bots and you, and what is left is graded as likely or confirmed people.
Which log files does the Real Traffic Audit accept?
Access logs in the combined format used by Apache, nginx, Plesk and cPanel, as .log, .txt, .gz, .tar or .tar.gz files, or files with no extension. You can add several at once. Use the access log, not the error log.
What does the Real Traffic Audit report show?
Real people (likely and confirmed), where they came from, what they read, AI crawlers and AI assistants, search engine crawlers, your own server and automated browsers, security events, the errors real visitors hit, and likely people per day. You can download the report as a PDF.
Parses access logs in the combined format used by Apache, nginx, Plesk and cPanel (.log, .txt, .gz, .tar, .tar.gz) entirely in your browser; nothing is uploaded. Each request is classified in order: your own server, AI crawlers, search engines, headless browsers and tools, other bots and scanners, and you and your team. What is left is graded as likely people or confirmed people. Optional Google Analytics and Search Console figures are fetched read-only through Google sign-in for comparison; only the date range is sent.
Accessibility Audit
Checks a page against WCAG 2.2 Level A and AA after its scripts have run, as your visitors see it, and also checks two more pages of your site.
Questions and answers about the Accessibility Audit
What does the accessibility report show?
Every one of the 55 WCAG 2.2 Level A and AA success criteria, each marked failed, with warnings, no problems found, needs a person to check, or not checked this time. Each problem says who it affects, shows examples from your page and explains the fix.
How do I read the accessibility report?
Start with the errors, which must be fixed, then the warnings. Passed checks found no problems, and notes explain anything that limited the audit. The report ends with a WCAG 2.2 coverage line counting every Level A and AA criterion.
How do I check if my website is accessible?
Enter the page address. The page is loaded in Chrome after its scripts have run and checked against all 55 WCAG 2.2 Level A and AA criteria: 35 are tested and 20 are marked for a person to check. Two more pages of your site are checked too.
The page is loaded in headless Chrome and audited after its scripts have run, using the full axe-core rule set plus the audit's own checks for criteria axe-core has no rule for: keyboard access and keyboard traps, focus that is visible and not hidden, reflow on phones, zoom, text spacing, contrast of text and of control edges, flashing, moving content, and consistent navigation and help across pages. Keyboard checks run in their own Chrome. Two more pages of the site are audited and compared. All 55 WCAG 2.2 Level A and AA criteria are reported; 35 are tested and 20 are marked as needing a person to check.
HTTP Error Audit
Crawls your site from the home page and records the status of every internal link, so you can find broken pages, server errors and redirects before visitors and search engines do.
Questions and answers about the HTTP Error Audit
Which status codes does the HTTP Error Audit report?
Client errors such as 404 Not Found, 410 Gone, 403 Forbidden and 429 Too Many Requests; server errors such as 500, 502, 503 and 504; and 301 and 302 redirects, which are listed separately so you can review redirect chains.
How much does the HTTP Error Audit cost?
10 pages for 10p, 50 pages for 50p, 100 pages for £5.00 and 1,000 pages for £39.99. Credits are only taken when the scan starts.
How do I find broken links on my website?
Run the HTTP Error Audit. It crawls your site from the home page, follows internal links and records the status of every URL, so 404s, server errors and redirects are listed. Results can be filtered and exported as a CSV file for Excel or Google Sheets.
Crawls the site from the homepage, following internal links, and records the HTTP status of every URL: client errors (401, 403, 404, 408, 410, 429), server errors (500, 502, 503, 504) and redirects (301, 302), which are logged separately so redirect chains can be reviewed. Page tiers of 10, 50, 100 or 1,000; credits are taken only when the scan starts. Results can be filtered and exported as CSV.
LLMs.txt Auditor
Fetches and scores your llms.txt against the llmstxt.org spec, then generates a corrected file using real data from your live site.
Questions and answers about the LLMs.txt Auditor
What does the LLMs.txt Auditor check?
Your llms.txt against the llmstxt.org spec: an H1 site name on the first line, a blockquote summary, H2 sections, links written as title, address and description, and links pointing to your own domain. It also checks whether llms-full.txt is present.
Can the LLMs.txt Auditor fix my file?
Yes. After the audit, the LLMs.txt Auditor fetches your homepage for real site data and generates a corrected llms.txt, plus llms-full.txt, llms.md and context files, ready to upload to your site root.
What is llms.txt used for?
llms.txt is a Markdown file at your site root that gives AI tools a short summary of your site and links to its key pages. It follows the llmstxt.org proposal rather than an official web standard. The auditor can also check a competitor's file.
Fetches /llms.txt from the domain root and validates it against the llmstxt.org spec: an H1 site name as the very first line, a blockquote summary, H2 sections, links written as - [Title](url): description, and links to your own domain only. It also checks llms-full.txt and robots.txt, flags an X-Robots-Tag: noindex header that conflicts with the file, and fetches the homepage for real site data to generate corrected files: llms.txt, llms-full.txt, llms.md and the context bundles.
Markdown Generator
Paste a URL and get a clean Markdown version of that page, ready for llms.txt or AI ingestion.
Questions and answers about the Markdown Generator
What are the Markdown Generator modes?
Full: an exact copy of the whole page, including menu and footer. Stripped: menu and footer removed, article content kept. Custom: you pick exactly what is removed, element by element.
Why is Markdown good for AI?
Markdown keeps headings, lists and links but drops the HTML code, scripts and styling, so AI systems read your content with less clutter. Use Stripped mode for AI that collects many pages at once, as it removes the menu and footer repeated on every page.
Which platforms does the Markdown Generator work on?
It has been tested on WordPress, Shopify, Wix, Squarespace, Webflow, Drupal, Ghost, BigCommerce and HubSpot CMS. Joomla works, but pages without a single clear top-level heading may score lower. Some Magento stores block automated fetching and cannot be read.
Fetches the page and converts it to Markdown in three modes: Full (the whole page, including menu and footer), Stripped (menu and footer removed, article kept) or Custom (you choose which elements are removed, including images, links, frontmatter and schema). Tested on WordPress, Shopify, Wix, Squarespace, Webflow, Drupal, Ghost, BigCommerce and HubSpot CMS. Joomla pages without a single clear top-level heading may score lower, and some Magento stores block automated fetching.
Combined Audit
Runs many of our audits against one website in a single pass and gives you the results as one PDF report.
Questions and answers about the Combined Audit
Should I run the Quick or the Full Combined Audit?
The Quick Audit runs up to 21 checks across technical SEO, structured data, speed, accessibility, images, crawling, international and local SEO, security, trust and GDPR, in about five minutes. The Full Audit adds 14 more, including Google Maps and Business Profile audits, backlinks, keywords, readability, E-E-A-T and AI visibility, in about ten minutes.
How do I do a full website audit?
Enter the address and choose the Quick Audit, about five minutes, or the Full Audit, about ten. Every check runs together and the results are merged into one PDF report, sent by a verified email link with an AI fix prompt.
What should I do with the Combined Audit report?
Read the summary first, fix anything that blocks visitors or crawlers, group findings that share one cause, then run the Quick Audit again after each batch of fixes.
Runs the single-purpose audits together and merges the results into one PDF. The Quick Audit runs up to 21 checks: meta tags, HTML, CSS, JavaScript, JSON, accessibility, images, redirect chains, robots.txt and sitemap, hreflang, page speed, Core Web Vitals, CLS, schema, rich snippets, GDPR, local SEO, security and HTTP errors work signed out, and the Site Crawler and Trust Audit are added when signed in. The Full Audit runs 35. The PDF is sent by a verified email link and comes with an AI fix prompt.
Trust Audit
Checks 22 signals that people and search engines use to judge whether a website can be trusted, from domain age and reputation to contact details, key pages and technology.
Questions and answers about the Trust Audit
Which signals does the Trust Audit score?
Domain age and registrar, Google Web Risk, backlink spam score and authority, contact email, phone and social profiles, Organization schema, About, Contact, Privacy and Terms pages, robots.txt and AI crawler access, the technology stack and TLD reputation.
Is the Trust Audit safe to run on any site?
It uses no active payloads and no port scans, only the same requests a normal browser makes. It works on public addresses only; private and internal addresses are rejected.
How do I know if a website is trustworthy?
Run the Trust Audit on its address. It scores 22 signals that people and search engines use, grouped under Domain, Reputation, Authority, Identity, Behaviour, On-Page, Technology and TLD, with a total score showing which group pulls it down.
Scores 22 signals in eight groups (Domain, Reputation, Authority, Identity, Behaviour, On-Page, Technology, TLD): domain age and WHOIS registrar, Google Web Risk, backlink spam score and authority, contact email, phone and social profiles, Organization schema, About, Contact, Privacy and Terms pages, robots.txt and AI crawler access, technology stack and TLD reputation. It uses only the requests a normal browser makes, with no active payloads or port scans; private and internal addresses are rejected.
Final checks
These audits have been tested and are going through final checks before joining the Established audits.
Schema Debugger
Checks the structured data already on any page, or JSON-LD you paste in, and scores each block for rich result eligibility, required and recommended fields, and AEO signals.
Questions and answers about the Schema Debugger
How do I check the schema markup on my website?
Enter the page address under Scan a URL and press Debug Schema, or paste JSON-LD and press Debug Pasted Schema. Each block is checked and scored, and its colour shows whether required or recommended fields are missing.
What do the Schema Debugger colours mean?
Green (80 or more) means good and eligible for rich results. Orange (50 to 79) means recommended fields are missing. Red (under 50) means required fields are missing and the block is not eligible for rich results.
Can I check schema before I publish it?
Yes. Paste the JSON-LD into the Schema Debugger under Or Paste JSON-LD Directly and press Debug Pasted Schema. It is checked and scored the same way as a live page, so you can fix problems before the code goes on your site.
Parses every JSON-LD block from a URL or from pasted code and scores each one from 0 to 100 against Google's rich result requirements: required and recommended properties, rich result eligibility, AEO signals and a full property tree. Bands: 80 and over is eligible for rich results, 50 to 79 is missing recommended fields, and under 50 is missing required fields and not eligible.
Schema Generator
Reads a live page, detects the right schema types and writes JSON-LD from the page's real content, for up to 1,000 items of each type.
Questions and answers about the Schema Generator
How do I add schema markup to my website?
Enter the page URL and press Generate Schema. Review the JSON-LD, fill in any missing fields you can, press Apply and Update Schema, then copy it into your page's HTML, or send it to the Schema Debugger to check first.
Which schema types does the generator support?
Auto-detect plus 90 named types: 21 general types, 17 local business types such as Dentist and Estate Agent, 14 other local business types, 8 food and drink types and 30 retail store types. If the detected type is wrong, you can switch it.
Can I change the detected schema type?
Yes. If a page is detected as one type but is really another, for example a plain WebPage that is really your shopfront, switch it to LocalBusiness and the schema is rebuilt for that type.
Reads the page title, meta description, H1, Open Graph image, canonical URL and body content, detects the schema.org type (auto-detect or one of 90 named types) and builds JSON-LD from that content, for up to 1,000 items of each type. Missing fields can be completed by hand; empty fields are left out rather than invented. The result can be sent straight to the Schema Debugger to check.
E-E-A-T Checker
Scores a page on Experience, Expertise, Authoritativeness and Trust, and lists what to improve.
Questions and answers about the E-E-A-T Checker
What is E-E-A-T in SEO?
Experience, Expertise, Authoritativeness and Trust: the qualities Google's search quality rater guidelines use to judge content. The E-E-A-T Checker scores each one; for Experience it looks for first-hand signs such as case studies, photos, dates and specific anecdotes.
What counts as Expertise and Authoritativeness?
Expertise is shown by credentials, citations, technical depth and author schema. Authoritativeness is shown by others vouching for you: backlinks, mentions, social proof, reviews and awards. The E-E-A-T Checker scores each one separately, with benchmarks.
What counts as Trust?
In the E-E-A-T Checker, Trust is scored from HTTPS, a privacy policy, a contact page and security headers: basic signs that a real, reachable business runs the site and protects its visitors.
Scores four categories from signals on the page and the site: Experience (case studies, photos, dates, specific anecdotes), Expertise (credentials, citations, technical depth, author schema), Authoritativeness (backlinks, mentions, social proof, reviews, awards) and Trust (HTTPS, privacy policy, contact page, security headers), with benchmarks and a list of improvements.
Work in progress
These audits still need testing, and each one is being tested on every type of CMS: WordPress, Wix, Shopify, Squarespace, Webflow, Joomla, Drupal, Weebly, GoDaddy, HubSpot, Ghost, Blogger, Duda, Jimdo, Magento, BigCommerce, Next.js, Gatsby, Hugo, PrestaShop and OpenCart. Offers to test them are welcome: run one on your own site and tell us what it gets right and wrong. Help us help you, rather than adding yet another audit full of false positives, free or £300 a month. Please note: these audits do not hallucinate. They are real-time, data-driven audits of your live pages.
Site Audit Pro
Crawls your site and checks every page for Core Web Vitals, duplicate titles, descriptions and content, structured data errors and internal link problems.
Questions and answers about the Site Audit Pro
How long does Site Audit Pro take?
A 50-page audit typically takes 5 to 8 minutes, and a 200-page audit 20 to 30 minutes. The time depends mostly on the number of pages, because every page is checked for Core Web Vitals, duplicates, structured data and internal links.
What does the internal link check find?
Site Audit Pro maps the links between your pages and finds orphan pages that no other page links to, broken internal links that lead to missing pages, and pages buried too many clicks from the home page, which search engines and visitors are less likely to reach.
How do I do a technical SEO audit?
Site Audit Pro crawls your site and checks every page for Core Web Vitals, duplicate titles, descriptions and content, and internal link problems. Every JSON-LD block is validated against schema.org, so a fault in a template that repeats across many pages shows up at once.
Crawls the site and reports Core Web Vitals for each page, cross-page duplicate titles, meta descriptions and content, and validates every JSON-LD block on every page against schema.org. Internal links are mapped to find orphan pages, broken internal links and pages buried too many clicks from the homepage. A 50-page audit typically takes 5 to 8 minutes and a 200-page audit 20 to 30.
Google Business Profile Audit
Finds every missing section, scoring gap and quick win on your Google Business Profile.
Questions and answers about the Google Business Profile Audit
What does the GBP Audit check?
Profile completeness: business name, address, phone, website, description, services, opening hours, photos, Google Posts and the Q&A section. It gives a completeness score, so you can see which missing sections to fill in first.
How do I optimise my Google Business Profile?
Fill in every section, such as services, opening hours, photos and posts, and reply to reviews and questions. The GBP Audit gives a completeness score, flags unanswered questions and shows your review response rate, so you know what to fix first.
Does the GBP Audit look at reviews?
Yes. The GBP Audit analyses your reviews, including how many you have replied to (your review response rate), and also includes a gap analysis and an attributes check.
Audits a Google Business Profile for completeness: name, address, phone, website, description, services, opening hours, photos, Google Posts and the Q&A section. It flags unanswered questions, analyses reviews and the review response rate, and adds a gap analysis and an attributes check.