How the brief is made

Methodology

SiteRune is a configuration and content audit of what a polite crawler can see. It is not a penetration test, not a lab-only Lighthouse run, and not a rank-tracker.

What we fetch

The requested URL (SSRF-safe: no private or loopback addresses), then robots.txt, the sitemap declared there, llms.txt, security.txt, and a walk of same-origin links — preferring URLs listed in llms.txt. Guest and Observer walk 5 interiors; Operator 10; Studio 20. Launch signed-in uses 20. Each of those HTML responses gets the same chapters as the homepage (not a TTFB ping). We also record TTFB from this vantage point, response headers, cookies, TLS handshake (protocol, issuer, expiry), and the redirect chain.

What we score

• Performance: TTFB, compression, cache-control, script/image tax, inner-page TTFB drift.
• Security: HTTPS, HSTS, CSP, framing, cookie flags, mixed content, version banners. No exploits.
• Technical SEO: title, description, canonical, robots, sitemap, H1, schema, thin HTML.
• AI search: llms.txt quality, AI-bot robots policy, entity schema, question headings.
• CMS health: fingerprint plus builder/plugin collisions we can see in HTML.
• Authority & trust: domain age, registration expiry, link-graph authority, popularity rank, DNSSEC. Scored only when at least one source answered; otherwise the ring shows "—" and the overall score falls back to the six-chapter weighting.

Authority & trust sources

Alongside the crawl we query public sources about the registrable domain and origin. Answers are cached for seven days per host, every source has a four-second budget, and a source that does not answer is reported as not measured — never as a failure.

• DNS over HTTPS (Cloudflare): MX, SPF, DMARC policy, common DKIM selectors, CAA, and the DNSSEC AD flag. Mail findings fire only for domains that publish MX records.
• RDAP (rdap.org): registrar, registration and expiration dates. Expiry inside 30 days is flagged.
• Wayback Machine: earliest capture. Together with RDAP this gives domain age; under 180 days is flagged.
• crt.sh: hostnames in Certificate Transparency logs; obvious dev/staging names are flagged.
• Tranco: 30-day popularity rank aggregated from Umbrella, Majestic, Farsight, CrUX and Radar.
• Open PageRank: 0–10 link-graph authority from Common Crawl, referring domains, 12-month history. Below 2.0, under 20 referring domains, or a drop of 1.0+ are flagged.
• Chrome UX Report: origin-level p75 LCP / INP / CLS from real Chrome users, judged against Google's Core Web Vitals thresholds. No record means the origin is below the public-dataset traffic threshold.
• Google Web Risk: malware, social engineering and unwanted-software listings. A hit is critical.
• OSV.dev: known advisories for versioned front-end libraries (jQuery, Bootstrap, Lodash…) found in the HTML.

What we ship

Scores are the trailer. The product is the sequenced playbook and paste-ready files (nginx / Vercel / WordPress mu-plugin, llms.txt, robots AI policy, security.txt, dns-records.txt with SPF / DMARC / CAA lines). Review CSP before enforcing it.

Observed vs heuristic

• Directly observed: status codes, response headers, HTML we fetched, robots.txt and llms.txt bodies, JSON-LD that parses or fails, TTFB of this request.
• Heuristic: CMS fingerprint confidence, "thin HTML" word counts, whether a cookie looks session-like, whether a title is the "right" length.
• Third-party observed: CrUX field data, Open PageRank, Tranco, RDAP, Wayback, CT logs, OSV — printed with the source named, and omitted when the source did not answer.
• Not measured: full backlink profiles, keyword volume, exploit proof. We will not print those numbers.

What we will not do

We do not fuzz, brute-force, or weaponize findings. We do not invent staff, legal entities, or metrics that were not on the page. During Launch, completed scans may be listed on Live briefs; thin or failed reports are noindex. You can unpublish a report to keep it off the sitemap.