Every rule. No mystery score.

robots.txt exists and is valid

discoverability.robots-txt

Search-console ownership is verified

discoverability.site-verification

Published content offers a feed

discoverability.feed

robots.txt does not block the whole site

discoverability.robots-blocks-all

sitemap.xml exists and is reachable

discoverability.sitemap

Sitemap is declared in robots.txt

discoverability.sitemap-in-robots

No accidental noindex

discoverability.noindex

Canonical URLs are set and consistent

discoverability.canonical

No broken internal links

discoverability.broken-links

Enough internally linked pages

discoverability.internal-links

No long redirect chains

discoverability.redirect-chains

No orphan pages in the sitemap

discoverability.orphan-pages

Every page has a title

metadata.title-present

Language versions declare hreflang

metadata.hreflang

No framework default titles

metadata.title-default

Titles are a usable length

metadata.title-length

Titles are unique per page

metadata.title-duplicates

Every page has a meta description

metadata.description-present

Meta descriptions are a usable length

metadata.description-length

Meta descriptions are unique per page

metadata.description-duplicates

Exactly one H1 per page

metadata.h1

html lang attribute is set and plausible

metadata.lang

Content is readable without JavaScript

aeo.content-without-js

Answer engines are allowed to retrieve

aeo.ai-crawler-access

AI crawlers actually receive the page

aeo.crawler-reachability

Retrieval and training policy point the same way

aeo.crawler-policy-inversion

FAQPage schema where there are questions

aeo.faq-schema

A citable description near the top

aeo.definition-paragraph

Headings phrased as questions

aeo.answerable-headings

Passages stand on their own

aeo.passage-retrievability

The site states the same facts everywhere

aeo.entity-consistency

Real lists and tables, not styled divs

aeo.extractable-structure

Authorship and freshness signals

aeo.author-and-freshness

Declared dates are recent

aeo.content-freshness

llms.txt is present

aeo.llms-txt

og:title is set

social.og-title

Web app manifest and theme colour

social.web-manifest

og:description is set

social.og-description

og:image is set

social.og-image

og:image actually loads

social.og-image-reachable

og:url is set

social.og-url

Twitter card type is declared

social.twitter-card

Favicon exists

social.favicon

Apple touch icon exists

social.apple-touch-icon

JSON-LD structured data is present

structured-data.present

A recognised schema type is declared

structured-data.type

Schema required properties are filled

structured-data.required-fields

Privacy policy is linked

compliance.privacy-policy

Impressum is linked and reachable

compliance.impressum

Datenschutzerklärung is a separate page

compliance.datenschutz

No trackers fire before consent

compliance.tracker-before-consent

Consent banner present when third-party scripts load

compliance.cookie-consent

No fonts loaded from Google's CDN

compliance.google-fonts-cdn

Terms are linked

compliance.terms

Third-party processors are disclosed

compliance.subprocessors

Right of withdrawal is stated

compliance.withdrawal-right

Prices state whether tax is included

compliance.price-transparency

California opt-out link present

compliance.ccpa-do-not-sell

Subscription renewal terms are disclosed

compliance.auto-renewal

Form fields have labels

accessibility.form-labels

A skip link bypasses the navigation

accessibility.skip-link

Motion respects prefers-reduced-motion

accessibility.reduced-motion

Images have alt attributes

accessibility.image-alt

Links and buttons have accessible names

accessibility.named-controls

Pinch-zoom is not disabled

accessibility.zoom-enabled

Viewport meta tag is present

accessibility.viewport

Accessibility statement is published

accessibility.statement

Heading levels do not skip

accessibility.heading-order

Page has a main landmark

accessibility.landmarks

Element ids are unique

accessibility.duplicate-ids

No secret or sandbox keys in the page source

security.exposed-keys

No insecure subresources

security.mixed-content

Strict-Transport-Security is set

security.hsts

Content-Security-Policy is set

security.csp

Cookies carry the right flags

security.cookie-flags

No known-outdated front-end libraries

security.outdated-libraries

Baseline security headers

security.headers

Third-party scripts pinned with integrity

security.sri

No exact software versions in headers

security.version-disclosure

External links use rel=noopener

security.target-blank

security.txt for vulnerability reports

security.security-txt

Responses are compressed

performance.compression

Static assets are cacheable

performance.cache-headers

Web fonts do not block text

performance.font-display

Images are served at the size they are displayed

performance.responsive-images

No render-blocking scripts in the head

performance.blocking-scripts

Images declare their dimensions

performance.image-dimensions

HTML document is a reasonable size

performance.document-size

Modern image formats

performance.image-formats

Below-the-fold images are lazy-loaded

performance.lazy-loading

Third-party origins are preconnected

performance.preconnect

There is a way to capture an email

conversion.email-capture

Errors are reported somewhere

conversion.error-tracking

There is a way to make contact

conversion.contact-route

og:image is the right size

conversion.og-image-size

Analytics is installed

conversion.analytics

There is a recognisable call to action

conversion.call-to-action

Pricing is stated or reachable

conversion.pricing-visible

Some form of social proof

conversion.social-proof

SPF record is present and restrictive

deliverability.spf

DMARC record is present and enforcing

deliverability.dmarc

A DKIM key is discoverable

deliverability.dkim

The domain can receive mail

deliverability.mx

Served over HTTPS with a valid certificate

basics.https

Certificate is not about to expire

basics.certificate-expiry

Certificate covers apex and www

basics.certificate-hosts

Modern TLS version

basics.tls-version

HTTP redirects to HTTPS

basics.http-redirect

One canonical host (www or non-www)

basics.www-consistency

Missing pages return a real 404

basics.404-status

Domain registration is not about to lapse

basics.domain-expiry

Reachable over IPv6

basics.ipv6

Time to first byte

basics.ttfb