Checks: verified facts under the scores

Every report carries a block of checks computed in code, not by the model. Each row has a status (pass, warn, info, or fail), a short label, and one evidence sentence you can verify yourself, such as "Exactly one H1: Plumbing you can call at 3am" or "http:// redirects to https:// in 1 hop". Info rows state a fact that is neither good nor bad on its own, like the number of internal and external links.

Site-wide rows come first, then one group per audited page. In the app, open the Checks tab beside Pages; on the hosted report it is the Checks section; in the PDF it is the final section, with site rows in full and each page trimmed to its warn, fail, and info rows.

HTTP & security: final status, redirect chain, HTTPS, time to first byte, HTML weight, compression, the HTTP to HTTPS redirect, the SSL certificate, and the security headers (HSTS, nosniff, clickjacking protection, Referrer-Policy, Content Security Policy).

On-page content, per page: title and meta description length, H1 count, heading order, word count, image alt text, declared image dimensions, modern image formats, language attribute, charset, viewport, favicon, text-to-HTML ratio, mixed content, render-blocking resources in the head, third-party script hosts, and exposed email addresses.

Indexability & crawling: robots.txt, whether crawling is allowed, the XML sitemap, URL hygiene, and per page the canonical tag, meta robots, the X-Robots-Tag header, and hreflang. Social & structured data: Open Graph, Twitter card, and JSON-LD validity. Links: counts, generic anchor text, empty links, and a bounded broken-link scan of up to 20 links from the homepage.

Privacy & tracking: which analytics and advertising scripts load as page markup, whether a consent management platform is present, whether trackers fire before consent, session-replay tools, and a privacy policy link. Agent readiness: a /llms.txt file, which AI crawlers robots.txt allows, and whether buttons and form fields carry accessible names.

Above the checks sits a card with what the site is made of: platform (WordPress, Shopify, Webflow, and so on), framework, hosting and CDN, nameservers, mail servers, SPF, DMARC, DKIM at common selectors, the SSL issuer and expiry, and the registrar. Every fact comes from headers, markup, DNS, one TLS handshake, or the public RDAP registry, and the card can show the exact header or record it read. Unknown means nothing recognizable was found, not that the site has none.

Checks do not move the six dimension scores. The scores stay the model's judgment so your history does not jump when a new check is added. The model does receive the checks as evidence, with the rule that a passing check is satisfied and must never be reported as missing, which keeps the narrative consistent with the rows.

Failed site-wide checks and failed homepage checks become action items on the Actions board after the model's top issues, with the evidence sentence as the description. Re-audits do not re-add an action that is already open.

The privacy section is a static scan of the HTML as served. It sees scripts written into the page and known consent platforms; it cannot see scripts injected later by a tag manager or whether a banner actually blocks a tracker until consent. Treat the rows as technical signals of the kind cited in privacy demand letters, not as legal advice or a compliance verdict.