Skip to content
srSiteRune
Start free

CMS

WooCommerce Website Audit

WooCommerce audit: product schema, not a cart crawl

· Configuration notes, not a newsroom.

SiteRune fingerprints WooCommerce assets on WordPress. We skip cart and checkout. The brief is headers, cache, and JSON-LD Product — not a SKU indexer.

WooCommerce Website AuditWO

What SiteRune checks on this stack

  • CMS / framework fingerprint from HTML, headers, cookies, and generator tags — fingerprint-based, not a plugin inventory
  • Titles, meta descriptions, canonicals, H1, and robots on the homepage and walked interiors
  • Security headers a crawler can see: HTTPS, HSTS, CSP, framing, nosniff, Referrer-Policy, Permissions-Policy
  • HTML TTFB, compression, and Cache-Control on the document — not a Lighthouse filmstrip
  • AI-bot robots policy, llms.txt, and Organization / FAQ / Article JSON-LD

Common problems

  • Marketing homepage looks finished; interior templates ship empty titles or leftover noindex
  • Hosted CMS cannot set HSTS/CSP, so the brief tells you to put a proxy in front instead of inventing an admin UI
  • A security plugin's 'block AI' preset Disallows GPTBot on a site that wanted citations
  • Session cookies or no-store on every anonymous GET, so the CDN never caches HTML

Shop stack, still WordPress

WooCommerce fires as its own slug when plugin paths are visible, but WordPress often wins the fingerprint on weight. Either way the playbook is the same dialect: full-page cache that does not cache /cart and /checkout, product JSON-LD left intact, images with width, kill unused payment and review apps that dump JS on every template.

SiteRune will not walk cart, checkout, account, or wp-admin. A polite crawler with SSRF guards is not a catalog dump. If /shop is thin HTML behind a faceted UI, seo-thin still fires — the Designer looking full does not count.

Headers and bots

Security headers still belong on nginx or a must-use plugin, not the theme. Wordfence 'block AI' presets that Disallow GPTBot will show up in the AEO chapter. That is a product decision. Own it, or open public catalog URLs and keep admin fenced.

FAQ

How do you know this is my stack?

Fingerprints in HTML, headers, cookies, and generator tags. Confidence is a score, not a certificate. Unknown stacks stay generic — we will not invent a CMS.

Do I need an account?

Three guest scans, no card. Create a free account when you want history and more interiors.

Run it on a live URL

Same scan engine. Guest scans stay free.

https://