Methodology

How scoring works and what the limitations are.

What happens when you scan a site

When you enter a URL, the server makes a single HTTP request to that page, the same way a browser would. It reads the HTML response and checks it against a list of known ranking signals. No JavaScript is executed during the scan. No additional pages are crawled beyond the one URL you submit.

What SEO means here

SEO (Search Engine Optimization) refers to the technical and content factors that affect whether a page appears in Google search results. The audit checks things like title tags, meta descriptions, heading structure, schema markup, HTTPS, mobile configuration, and page speed indicators.

What AEO means here

AEO (Answer Engine Optimization) refers to whether AI-powered search tools (ChatGPT, Google AI Overviews, Perplexity) can extract clear answers from your content and confidently attribute them to your site. The AEO score checks content structure, entity clarity, citation signals, and structured data.

How scores are calculated

Each check produces a score from 0 to 100. Checks are grouped into categories (Technical SEO, On-Page, AEO, Links, etc.). Each category has a weight that reflects its relative importance to search visibility. The overall score is a weighted average of all category scores.

Weights are based on publicly available research about ranking factor importance, Google's Quality Rater Guidelines, and confirmed signals from Google's 2023 antitrust trial documents. They are not proprietary to us.

What is directly measured

  • HTTPS presence
  • HTTP status code
  • Title tag, meta description, heading tags (presence, length, count)
  • Image alt text coverage
  • Schema markup (type and validity of JSON-LD)
  • robots.txt and sitemap.xml accessibility
  • Mobile viewport configuration
  • Internal and external link counts
  • Page load time (server response time, not full render)
  • Word count and content structure
  • Open Graph and Twitter Card presence
  • HSTS header
  • Technology stack indicators in HTML

What is estimated

  • Monthly traffic (derived from public rank data, clearly labeled as an estimate)
  • Core Web Vitals (approximated from load time; real CWV requires 28 days of Chrome user data)
  • Content quality signals (readability, answer structure, entity clarity)
  • AEO citation probability (no tool can guarantee AI citation)
  • Geographic audience (inferred from TLD, hreflang, language, currency)

What this tool cannot check

  • Backlink profile (requires a crawl index we do not maintain)
  • Domain authority or domain age
  • Exact keyword rankings
  • Real user engagement metrics (bounce rate, time on page)
  • Competitor comparison at scale
  • JavaScript-rendered content (scan reads initial HTML only)
  • Pages behind login walls or authentication

Why results may differ from other tools

Google Search Console shows data from Google's own index. Lighthouse runs a full browser render with JavaScript execution. Ahrefs and Semrush maintain their own web crawl indexes for backlink data. Each tool measures different things in different ways.

Smart Analytics checks what is visible in the initial HTML response. It does not execute JavaScript, maintain a link index, or access Google's internal data. Results are complementary to these tools, not a replacement.

How often scoring is updated

The scoring methodology checks official Google sources weekly via automated monitoring. When algorithm changes, new ranking signals, or deprecations are detected, scoring weights are adjusted. Changes are logged in the Knowledge Hub.

No guarantees

No score guarantees improved rankings or AI citations. Search engine algorithms are proprietary and change without notice. This tool identifies known issues and provides recommendations based on current best practices. Outcomes depend on competition, implementation quality, and factors beyond any tool's control.

What the vulnerability check does

The vulnerability check analyzes publicly visible security signals from your website. It reads the same information any browser sees when visiting your page: HTTP headers, HTML source code, and whether certain files respond at known paths. No intrusive testing, no port scanning, no exploit attempts.

Specific checks include: missing security headers (HSTS, CSP, X-Frame-Options), leaked credentials or API keys in page source, outdated JavaScript libraries with known vulnerabilities, cookie configuration, password field requirements, exposed configuration files (.env, .git), and AI content disclosure compliance.

AI content disclosure compliance

Three laws now require websites to label AI-generated content:

  • India IT Amendment Rules 2026 (SGI): requires prominent labelling and persistent metadata on all synthetically generated content
  • EU AI Act Article 50 (effective August 2, 2026): requires machine-readable markers on AI-generated content
  • California AI Transparency Act / CAITA (effective August 2, 2026): requires tamper-evident provenance data embedded in AI-generated media

The scan checks for visible disclosure labels, machine-readable meta tags, Schema.org markup indicating AI generation, and Content Credentials (C2PA) headers.

Why vulnerability details are PDF-only

Specific vulnerabilities are not displayed on screen. Showing them publicly would help attackers, not site owners. Full findings with fix instructions are only available in the downloadable PDF report that only the person running the scan can access.