Skip to content
srSiteRune
Start free

CMS

Next.js Website Audit

Next.js audit: App Router, metadata, and headers()

· Configuration notes, not a newsroom.

SiteRune fingerprints Next from /_next and runtime markers. The playbook treats it as a server. We skip the bootcamp speech on sites that are already elite.

Next.js Website AuditNE

What SiteRune checks on this stack

  • CMS / framework fingerprint from HTML, headers, cookies, and generator tags — fingerprint-based, not a plugin inventory
  • Titles, meta descriptions, canonicals, H1, and robots on the homepage and walked interiors
  • Security headers a crawler can see: HTTPS, HSTS, CSP, framing, nosniff, Referrer-Policy, Permissions-Policy
  • HTML TTFB, compression, and Cache-Control on the document — not a Lighthouse filmstrip
  • AI-bot robots policy, llms.txt, and Organization / FAQ / Article JSON-LD

Common problems

  • Marketing homepage looks finished; interior templates ship empty titles or leftover noindex
  • Hosted CMS cannot set HSTS/CSP, so the brief tells you to put a proxy in front instead of inventing an admin UI
  • A security plugin's 'block AI' preset Disallows GPTBot on a site that wanted citations
  • Session cookies or no-store on every anonymous GET, so the CDN never caches HTML

Not a SPA with a framework sticker

Next.js sites fail this audit when the hero is a client component, generateMetadata is missing on money routes, and CSP never left next.config. The playbook: server-render the above-the-fold, generateMetadata on every indexable route, next/image, headers() in next.config for CSP/HSTS, app/sitemap.ts + robots.ts, a static /llms.txt route. We only mention vercel.json when response headers prove the origin is on Vercel. Next.js behind nginx is not Vercel.

We will not nag a 90

If the origin already looks elite — entity schema, llms.txt, sane cache, TLS 1.3 — we do not append a generic 'learn the App Router' bootcamp item. The brief should get shorter as the site gets better.

FAQ

How do you know this is my stack?

Fingerprints in HTML, headers, cookies, and generator tags. Confidence is a score, not a certificate. Unknown stacks stay generic — we will not invent a CMS.

Do I need an account?

Three guest scans, no card. Create a free account when you want history and more interiors.

Run it on a live URL

Same scan engine. Guest scans stay free.

https://