User Guide
Enter any domain
Type or paste a domain — example.com, www.example.com or a full https://example.com/page URL all work. The tool strips the protocol, the www. and anything after the host, so you always audit the site’s homepage. Press Enter or click Analyse Site.
Wait a few seconds
Four requests go out: the homepage itself, robots.txt, the XML sitemap, and an RDAP lookup for the domain’s registration record. Most sites finish in two to four seconds. Nothing is queued and nothing is stored — the report is built fresh each time you press the button.
Read the score first
The ring gives a single figure out of 100 with a grade beside it: Excellent at 90+, Good at 75+, Needs work at 55+, Poor below that. Underneath, the tally splits the result honestly — how many checks passed, how many need attention, how many failed. A warning is worth half a point, never a pass.
Scan the four headline numbers
Domain age comes from the registry’s own record. Server response is how long the raw HTML took to arrive. Page size is the weight of that HTML alone. Word count is the visible text on the homepage with scripts and styles stripped out. Together they tell you in one glance whether you are looking at a mature, fast, substantial site or a thin new one.
Start with “Fix these first”
Above the detail, the audit lists every failure and then every warning in severity order, numbered, each showing the area it came from and why it matters. That is your work queue — you do not have to read forty rows to find the three that need attention. Below it, every row still carries a coloured dot (green passed, amber needs attention, red failed, grey a neutral fact), the measured value on the right and a plain-English line explaining it. Grey rows are facts, not marks, and never count for or against the score.
Filter, then export
Red rows are actively costing you traffic — a noindex tag, a missing title, no mobile viewport. Amber rows work but could be better. The filter above the results shows only the failures, only the warnings, only the passes or only the neutral facts, and areas with nothing left to show get out of the way. Score by area tells you whether the weakness is on-page, performance or security. Then Copy summary for a message, Download CSV for a spreadsheet, or Download report for the full text file, and re-run once the fixes are live.
About the SEO Site Audit
This tool runs a live technical SEO audit on any public website and reports more than thirty-five individual checks across six areas: the domain and its hosting, whether search engines can crawl and index the page, on-page SEO, performance, security, and mobile and structured-data readiness. Every figure is measured at the moment you press the button, by fetching the site and reading what it actually returns. Nothing is estimated, cached from a previous visit or bought in from a third party.
It is free with no sign-up, no email capture and no daily limit. That is deliberate: almost every comparable audit tool shows you a score and then asks for an address before it will tell you what is wrong. Here the whole report is on screen immediately, ordered so the problems come first, and three buttons let you take it away — a summary to paste into a message, a CSV for a spreadsheet, or the full report as a text file for whoever is going to fix it.
How the score is calculated
The score is arithmetic, not opinion, and it is worth understanding before you act on it. Every check resolves to one of four states. A pass earns one point. A warning — something that works but could be better — earns half a point. A failure earns nothing. Rows shown in grey are facts, not judgements: your IP address, your registrar, the number of external links. They are excluded from the arithmetic entirely, so a site is never penalised for, say, having no hreflang tags when it only serves one language.
The score is then the points earned divided by the number of graded checks, expressed as a percentage. A site with 32 passes and 4 warnings out of 36 graded checks scores (32 + 2) ÷ 36 = 94. The tally beneath the ring always reports passes, warnings and failures separately, so the headline figure can never quietly inflate itself by counting half-credits as wins.
One thing the score is not: a prediction of how well the site will rank. It measures how well the site is built. A three-month-old domain with flawless technical hygiene will score in the nineties and still rank nowhere, because ranking is mostly about links, content and competition — none of which any free tool can measure. Read the score as “have I made avoidable mistakes?”, not “will I win?”.
Domain & Hosting — where the site comes from
Registration facts come from RDAP, the IETF’s structured replacement for WHOIS, queried directly against the registry that owns the domain’s extension. That gives you the registration date, the expiry date, the registrar and, from a DNS lookup alongside it, the site’s IP address, its nameservers and whether it has mail exchanger records configured.
Domain age is the check that carries weight here: a domain over a year old passes, a younger one is flagged amber. This is not superstition. New domains take longer to accumulate the crawl history and links that ranking depends on, and if you are auditing a site that has existed for three months, that context changes how you should read everything else. The expiry date is graded too — anything inside sixty days is flagged, because a lapsed registration takes every ranking with it and the recovery is brutal.
Indexability & Crawling — can Google actually use this page?
This is the section to read first when traffic has disappeared, because everything in it can silently switch a page off. The audit reports the HTTP status the homepage returns, whether a noindex directive is present in the robots meta tag, whether a canonical tag is declared and what it points at, whether robots.txt exists, and whether an XML sitemap can be found.
The sitemap is located the way a crawler locates it: the audit reads the Sitemap: directive out of robots.txt first, and only falls back to /sitemap.xml if there isn’t one. It then distinguishes between a sitemap index — a file listing other sitemaps — and a plain urlset listing pages, and labels the count accordingly. That distinction matters: a site whose index points at nine child sitemaps has nine sitemaps, not nine pages, and tools that count blindly will tell you otherwise.
A red row in this section is an emergency. A stray noindex left over from a staging site is the single most common cause of a site vanishing from Google overnight, and it takes ten seconds to find here.
On-Page SEO — the tags that decide your search snippet
The audit reads the page title and measures it, flagging anything outside 30–65 characters, which is roughly what Google displays before truncating. The meta description gets the same treatment against a 110–165 character window. Both the actual title and the actual description are printed underneath the row, so you can see exactly what a searcher would see rather than trusting that your CMS output what you typed.
Beyond the tags, it counts H1 headings — exactly one passes, none fails, several is flagged amber because multiple H1s dilute the signal about what a page is for. It counts H2 subheadings, counts the visible words on the page with scripts and styles stripped out, and flags anything under 300 words as thin. It counts internal and external links, treating ten or more internal links as healthy, because internal links are how ranking signal moves around a site and thin internal linking is one of the most common and most fixable problems on a large site.
Images are checked for missing alt text, and the check is deliberately precise: an image with alt="" is not counted as a fault, because an empty alt attribute is the correct way to mark a decorative image. Only images with no alt attribute at all are flagged. That distinction matters for accessibility auditing and most tools get it wrong in the noisy direction.
Performance — and what “server response” really means
The performance section reports how long the raw HTML took to arrive, how large it is, whether compression is enabled, what server software answered, and whether a cache-control header is set. Under 1.5 seconds passes, under 3 seconds is flagged amber, anything slower fails. HTML over 1 MB is flagged, and a missing compression header is flagged because gzip or Brotli typically cuts HTML transfer by around seventy per cent for the cost of a single configuration line.
The timing figure is labelled server response time rather than load time, and the distinction is not pedantry. It measures one thing: how long our server waited for the HTML. It excludes stylesheets, JavaScript, images, fonts and all rendering. A site can return HTML in 0.1 seconds and still take eight seconds to become usable in a real browser. For that measurement — the one Google actually ranks on — use the Website Speed Test, which runs the site through Google PageSpeed Insights and returns genuine Core Web Vitals.
Security & HTTPS — the headers most sites never set
HTTPS and certificate validity are verified as part of the audit request itself; if the certificate were untrusted or expired, the fetch would fail and the audit would tell you so rather than reporting a pass. The page is then scanned for mixed content — images loaded over plain http:// on an https:// page, which triggers browser warnings and undermines the padlock.
After that come five response headers that most sites never configure: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options and Referrer-Policy. None of these is a direct ranking factor, and this page will not pretend otherwise. They matter because they are cheap, they are visible to anyone auditing your site, and two of them — HSTS and X-Frame-Options — close real attack routes. Amber rows here are a short conversation with whoever runs the server, not an emergency.
Mobile, Social & Structured Data
The last section checks the mobile viewport declaration — its absence is a hard fail, because without it a site is not mobile-friendly and Google indexes mobile-first — along with the declared page language, the character set, and whether a favicon is linked. It counts Open Graph and Twitter Card tags, which control how your links render when someone shares them, and it reads any JSON-LD structured data on the page and lists the schema types it finds by name: Organization, WebSite, Article, Product and so on. If no JSON-LD is present but microdata is, that is reported instead. Naming the types is more useful than a yes/no, because it tells you at a glance whether your rich-result markup is the markup you intended.
What this audit cannot see — stated plainly
Four honest limits, because an audit you cannot trust the boundaries of is worse than no audit.
It reads the HTML your server sends, and does not run JavaScript. If your site renders its content client-side — a React or Vue application with an empty HTML shell — the word count, headings and links will read low or empty here. That is not a bug in the audit; it is very close to what a crawler sees on its first pass, and if this tool cannot find your content there is a fair chance search engines are having to work for it too.
It audits the homepage only. One URL, not a crawl of the site. The homepage is usually representative of template-level problems — missing viewport, absent structured data, no canonical — but a specific product or blog page can differ, and this tool will not tell you about it.
It requires HTTPS. The audit is fetched over https:// and there is no fallback to plain HTTP. A site that is HTTP-only will report as unreachable, which in 2026 is itself the finding.
It cannot measure links or authority. Nothing here counts backlinks, referring domains or any link-based authority score. The next section explains why, because it is the question this page gets asked most.
Why there is no Domain Authority score
Domain Authority is Moz’s proprietary metric, calculated from Moz’s own private crawl of the web’s link graph. Ahrefs’ Domain Rating, Majestic’s Trust Flow and Citation Flow, and Semrush’s Authority Score work the same way — each is a commercial product built on an index that costs millions to maintain and is sold by subscription.
No free tool can compute any of them. A free tool showing you a DA number is doing one of two things: reselling a limited quota of paid API access, or generating a plausible-looking number from nothing. The second is more common than most people realise, and it is impossible to tell them apart from the outside.
We would rather show you thirty-five things we can prove than one number we cannot. Everything in this report is verifiable — open your browser’s view-source, run curl -I against your own domain, look up your own RDAP record, and you can check every line of it yourself. If you genuinely need Domain Authority for client reporting, buy it from Moz; if you need Domain Rating, buy it from Ahrefs. Neither is available free from anyone, including us.
What to do after the audit
Fix red rows first — they are actively costing traffic. Then work through the ambers in whatever order is cheapest for you. When you are ready to go deeper, the rest of the toolkit picks up where this audit stops: Website Speed Test gives you real Core Web Vitals from Google’s own infrastructure, Broken Link Checker crawls for dead links across the site rather than just the homepage, and Keyword Density Checker examines whether a page is actually about what you think it is about.
For the fixes themselves: Meta Tag Generator writes correctly-formed title, description and Open Graph tags, Robots.txt Generator builds a valid robots file with the right sitemap directive, and XML Sitemap Generator produces the sitemap to point it at. If the audit flagged a heavy homepage, Image Compressor is usually where the weight is hiding. Re-run this audit once the changes are live — it takes seconds, and watching the score move is the fastest way to confirm a fix actually shipped.
Frequently Asked Questions
Is this SEO audit really free, with no sign-up?
Yes. There is no account, no email capture, no credit card and no daily limit, and the complete report appears on screen immediately rather than behind a form. Copy summary, Download CSV and Download report save the same detail in three formats. Nothing about the audit is held back or upsold.
Can I see only the checks that failed?
Yes. The filter above the results switches between all checks, failures only, warnings only, passes only, and the neutral facts. Whole areas disappear when nothing in them matches, so filtering to “Failed” on a healthy site shows you an empty report rather than six empty headings. The “Fix these first” list does the same job in priority order without you touching the filter.
How do I hand the results to a developer?
Download CSV opens in any spreadsheet with one row per check — area, check, result, status and the explanatory note — which is the easiest form to turn into tickets. Download report is the same audit as plain text, with the prioritised fix list at the top. Copy summary puts just the score, the tally and the first twelve things to fix on your clipboard, which is usually what you want in a chat message.
How many checks does the audit run?
More than thirty-five, across six sections: Domain & Hosting, Indexability & Crawling, On-Page SEO, Performance, Security & HTTPS, and Mobile, Social & Structured Data. The exact number varies slightly by site, because some rows only appear when the data exists — a domain whose registry does not publish an expiry date simply has one fewer row.
Why doesn’t it show a Domain Authority score?
Domain Authority is Moz’s proprietary metric, computed from their private index of the web’s links, and the same is true of Ahrefs’ Domain Rating, Majestic’s Trust and Citation Flow and Semrush’s Authority Score. None can be calculated without paying for access to that index, so no free tool can honestly provide one. We show thirty-five things that can be measured and verified instead of one number that cannot.
How is the SEO score out of 100 calculated?
Each graded check is worth one point for a pass and half a point for a warning; failures score nothing. Neutral facts shown in grey — your IP address, registrar, external link count — are excluded from the calculation entirely. The score is points earned divided by graded checks. The tally under the ring always reports passes, warnings and failures separately so half-credits are never presented as passes.
Does a high score mean my site will rank well?
No, and it is important not to read it that way. The score measures how well a site is built, not how competitive it is. Ranking depends mostly on links, content quality and how strong the competition is for a given query — none of which any free tool can measure. Treat the score as “have I made avoidable technical mistakes?” rather than a ranking forecast.
Can I audit a competitor’s website?
Yes. Every check is performed against publicly available information — the HTML the site serves to any visitor, its robots.txt and sitemap, its public DNS records and its public domain registration record. Nothing private is accessed and the site being audited is not notified. It is a useful way to see how a competitor has configured their structured data, headings and meta tags.
Why does my JavaScript site show almost no words or headings?
Because the audit reads the HTML your server sends and does not execute JavaScript. If your content is rendered client-side, it is not in that HTML. This is close to what a search crawler sees on its first pass, so a near-empty result here is worth investigating rather than dismissing — it often means search engines are having to work harder to find your content than you assumed.
What is the difference between server response time and page load time?
Server response time — what this audit reports — is how long the server took to return the raw HTML. It excludes CSS, JavaScript, images, fonts and rendering entirely. Real page load time includes all of that and is usually many times longer. For genuine Core Web Vitals measured the way Google measures them, use our Website Speed Test, which runs the page through Google PageSpeed Insights.
Can it audit an entire site, or just one page?
Just the homepage. That is usually enough to catch template-level problems — a missing viewport tag, absent structured data, no canonical, weak internal linking — because those apply site-wide. For site-wide crawling of dead links, use the Broken Link Checker.
Why does it say my site is unreachable?
Three common reasons. The site may be HTTP-only, and the audit requires HTTPS with no fallback. The certificate may be expired or untrusted, in which case the audit refuses the connection rather than reporting a false pass. Or the site may be blocking automated requests at firewall level. Local addresses and private IP ranges are also blocked by design.
How is domain age worked out, and is it accurate?
It comes from RDAP, the IETF’s structured replacement for WHOIS, queried directly against the registry that operates the domain’s extension. That is the authoritative source — the same record the registrar itself writes to. Some registries redact or omit certain dates for privacy reasons, in which case the row simply does not appear rather than showing a guess.
My sitemap says 9 URLs but my site has hundreds of pages. Why?
Your sitemap is a sitemap index: a file that lists other sitemaps rather than listing pages. The audit detects this and labels the row “Child sitemaps listed” instead of “URLs in sitemap”, so nine means nine child sitemaps, each holding its own list of pages. If you see the row labelled “URLs in sitemap” instead, that is a plain urlset and the number really is pages.
Does running this audit affect the site being checked?
No. It makes four ordinary GET requests — the homepage, robots.txt, the sitemap and an RDAP lookup — which is far less traffic than a single real visitor generates. Nothing is written, nothing is submitted and no forms are touched. It will appear in server logs as a handful of page views and nothing more.