How audits work
An audit is a fixed, automated procedure. The same checks run against every site, and the report is their output and nothing else — no human opinion, no paid placement.
What audibot sends
For one audit, audibot makes these requests, identified as audibot/1.0:
- one
GETof the home page over HTTPS, following up to five redirects; - one
GETof the home page over plain HTTP, to see whether it redirects; /robots.txt, the sitemap it names (or/sitemap.xml), and/.well-known/security.txt;- public DNS lookups: A, AAAA, MX, TXT, CAA, NS and the
_dmarcrecord.
That is all. audibot does not scan ports, guess paths, submit forms, sign in, or try exploits. Those are penetration testing, which needs the site owner's permission — audibot only reports what any visitor's browser or DNS resolver can already see.
If robots.txt asks all crawlers, or audibot by name, to stay off /, the dimensions that read the page's content are skipped and the report says so.
How a score is calculated
Each check results in pass (1 point), warning (½ point) orfail (0). Notes and skipped checks do not count. A dimension's score is its average, out of 100; the report's score is the average of its dimensions. Grades: A from 90, B from 80, C from 65, D from 50, F below.
The checks read the HTML the server sends, before any JavaScript runs — which is also what search engines and link previews see first. A site that builds its page in the browser can score lower here than it looks in a browser; that difference is real for crawlers too.
Security headers
The protections a site asks the browser to enforce, and what it gives away about its software.
- Strict-Transport-Security
- Content-Security-Policy
- X-Content-Type-Options
- Clickjacking protection
- Referrer-Policy
- Permissions-Policy
- Software versions in headers
- Cookie flags
- security.txt
HTTPS and certificate
Whether the site is served securely, by default, with a certificate that will not lapse unnoticed.
- Certificate validity
- Days to expiry
- TLS version
- HTTP to HTTPS redirect
- Mixed content
DNS and email
Whether the domain is resilient, and whether someone else can send email pretending to be it.
- Name servers
- IPv6
- CAA
- SPF
- DMARC
Search visibility
What a search engine or a link preview reads from the home page before running any JavaScript.
- Title
- Meta description
- Canonical URL
- Main heading
- Indexable
- robots.txt
- Sitemap
- Link previews
- Structured data
Performance
How quickly the server answers and how heavy the first response is.
- Time to first byte
- HTML size
- Compression
- Redirects
- Render-blocking scripts
- Script count
Accessibility basics
The parts of accessibility that can be read from markup alone. Passing these is a floor, not a verdict.
- Page language
- Mobile viewport and zoom
- Image text alternatives
- Form labels
- Link text
Privacy and third parties
Who else a visitor's browser talks to on arrival, before they have clicked anything.
- Third-party hosts
- Trackers on arrival
- Cookies on arrival
- Privacy policy link
Net Promoter Score
Signed-in audibot users can answer "how likely are you to recommend this site?" from 0 to 10 on any report. The NPS is the share of 9s and 10s minus the share of 0–6s, shown once five people have voted. It is the opinion of audibot users, not of the site's own customers, and the report says so.
Removing a report
If you own a site and want its report taken down, tell us. An unpublished site's report, badge and sitemap entry disappear and it cannot be audited again.