Visibility engine
The visibility engine scores every build through four lenses: machine visibility, conversion, security and agent readiness.
Machine visibility splits into SEO, AEO and LLMO, which is why the report shows six scores rather than four. Most of it is read from the HTML a crawler actually receives rather than the source it was written from; security also reads the live response headers and the database directly, since it is checking exposure rather than markup. Every finding still comes back as a sentence and a button rather than as homework.
Visibility score
90/100
+11 since last build
Conversion
The repairs page asks for a booking twice and never says what it costs.
Fix this
AEO
Two pages open with background instead of the answer.
Fix this
Four lenses
They answer genuinely different things and are deliberately not forced into one shape. Three are measured here, on the built HTML, the live response headers and the database. The fourth is fetched from somebody else’s scanner, and the report says so.
Machine visibility
40%Twenty-four checks across SEO, AEO and LLMO, each weighted and each scored only against the kinds of page it applies to. A legal notice is not marked down for having no FAQ.
Whole site
Conversion
35%Six sub-pillars: intent, message match, proof, action, clarity and testing. It is the lens most audits skip, and the one that catches a page that is flawlessly indexed and still a dead end.
One page at a time
Security
15%Reads transport security, the response headers a browser enforces, and the content-security-policy itself, alongside whether sensitive paths such as .env or .git are reachable. Leaked secrets are reported as a count and never as a value, alongside database row-level security, edge protections and the agent-facing surface.
Whole site, live
Agent readiness
10%The only lens that is not computed here. It is fetched from a public agent-readiness scan of the published site, which returns a fix and a specification link for every check that fails.
Whole site, fetched
Those weights are the default and they are one setting per project. A site that genuinely intends to serve agents should raise the third one; a site that is a shop window can leave it where it is.
Insufficient data is never scored as zero. A file that could not be read, a scan that came back unparseable, a pillar with nothing to measure: each of those drops out of both sides of the average and is reported as not enough data. A zero says the site failed a test, which is a different claim from nothing having been measured.
Six scores
Machine visibility splits into three, which is what turns four lenses into the six bars on the report. One overall number is what you glance at; these are what tell you where the problem is.
SEO
Nine checks on the plumbing: title length, meta description length, canonical link, Open Graph, exactly one h1, heading order that does not skip, alt text coverage, the sitemap and the robots policy.
AEO
Answer Engine Optimisation. Seven checks on whether the page can be lifted: whether the first paragraph after the h1 answers the question, whether headings read as questions, and whether the visible Q&A is marked up.
LLMO
Large Language Model Optimisation. Eight checks on identity and depth: whether the site states its own purpose in machine-readable form, whether the publisher is declared once, and whether the crawler policy lets an answer engine in at all.
Conversion
Scored on one page at a time, over six sub-pillars. A page can be perfectly indexed and still be a dead end, so this lens asks whether the headline promises an outcome, whether the page has one primary next step, and whether anything measures what happened.
Security
Twenty-six checks across transport, headers, exposure, secrets and dependencies, the database and the edge, each skipped rather than scored as a fail when its evidence could not be gathered. A leaked-secret count is shown on the report; the secret itself never is.
Agent readiness
Increasingly the visitor is an assistant working for a person. Six checks are hygiene every site should pass. Ten more only count once the site has said it wants to be used by agents directly, because marking a brochure site down for publishing no API catalogue would be scoring it against somebody else’s ambitions.
Every check knows which kinds of page it applies to. A login screen is not marked down for having no meta description and a legal notice is not marked down for having no FAQ, because a page outside a check’s remit is excluded from the sum rather than failed by it.
The third lens
Security is computed here, the same as machine visibility and conversion, rather than fetched. It reads whether the site is served over HTTPS with HSTS set long enough to matter, the response headers a browser actually enforces, and whether the content-security-policy itself is present and not so loose that it would let arbitrary script run.
It also checks for exposure: whether a .env file, a .git folder, a source map or an admin route is reachable by anyone who asks. Any secret-shaped string it finds in the built output or the repository is reported as a count, never as the value, so the report itself cannot leak what it is warning about. The same pass checks database row-level security, so a private table refuses an anonymous read, the edge protections in front of the site, meaning a managed firewall and rate limiting on any public route that writes, and whether the site’s agent-facing surface matches what it has actually turned on.
A check whose evidence could not be gathered is skipped rather than scored as a fail, the same rule every lens follows. Its findings go through the same fix loop as the rest of the report: a missing security.txt file is mechanical and applies itself, a header or policy change waits for a nod because it changes what the site serves, and a finding like rotating a leaked key or turning on a database policy is the owner’s own infrastructure to act on, so the fix note says that plainly rather than pretending to have done it.
The fourth lens
Most audit tools stop at whether a person can find the page. This one also asks whether an assistant can act on it, which as far as we know is an unusual thing for a site builder to check at all.
The score is fetched rather than computed. It comes from a public agent-readiness scan of the published site, which ships the same checks as an unauthenticated MCP server and returns a fix and a specification link for every one that fails. Six of them are hygiene: robots.txt, a sitemap, explicit AI crawler rules, Content Signals, Markdown negotiation and link headers. Ten more are the agent-facing surfaces, and they only count once the project has said it wants them.
Two guards sit around it, because a confident wrong number is worse than no number. A scan whose host does not match the host that was asked for is discarded, since following a redirect into a sign-in screen scores the login page rather than the site. And a response that cannot be parsed is reported as unavailable rather than as a zero.
The fix loop
Most audit tools stop at the diagnosis, in a vocabulary that assumes you already know what a canonical link is for. That is fine for a developer and useless for the person who owns the site.
So each finding here is three things: what is wrong, in a sentence; why it costs you something, in another; and a button that sends it back to the builder as work. Approving a fix starts a build with the task already written.
01
The built HTML is read page by page. Nothing is inferred from the source.
02
Each finding says what it is and what it costs, without the jargon.
03
One click turns the finding into a build, and the next report shows whether it worked.
Every fix is a change to code or content. What differs is how much damage the wrong one could do, so findings are sorted into three buckets by consequence rather than by which check raised them.
Limits
A visibility tool that will do anything to raise its own number is a liability. These are the things this one refuses.
No FAQ markup without a visible FAQ. No rating without a rating. Both are penalties, and both are easy to get away with until you do not.
It checks whether a page has one clear topic, not whether a phrase appears often enough to look unnatural.
Search and citation crawlers stay allowed. Blocking them removes you from AI answers and protects nothing.
It will not publish an MCP card or an API catalogue to lift the agent score. That bucket needs the project to have opted in and then approved the change.
A check it could not run is reported as insufficient data, never as a zero.
It scores whether a page can be found, quoted and acted on. It does not pretend to know what it deserves.
Q&A
SEO is being findable in a list of links. AEO is being the passage an answer engine quotes when it answers instead of listing. LLMO is a model understanding what your site is for at all, so it reaches for you on the right topic. They overlap, but a page can pass one and fail another, which is why they are scored separately.
By default, machine visibility accounts for 40 percent of the score, conversion 35 percent, security 15 percent, and agent readiness 10 percent. Machine visibility and conversion remain the two heaviest factors because being found is worth nothing if the page does not convert, and a converting page nobody reaches is worth as little. Security sits above agent readiness because a leaked key or an ungated admin route is a real, present risk to the site owner, but it stays below the two commercial lenses because a hardened site nobody visits still fails its job. Agent readiness maintains its small share until a project indicates it intends to serve agents, at which point raising it is one setting.
It is left out of the score rather than failed. A file that could not be read, a scan that came back unparseable, a pillar with nothing to measure: all of them report as insufficient data and drop out of both sides of the average. A zero is a claim that the site failed a test, and saying that when nothing was measured is worse than saying nothing.
Because a component can look correct and still compose into a page with two h1 elements. Crawlers receive the output, so the output is what gets checked.
No. Marking up questions a reader cannot see is a penalty from Google, not a shortcut, and the same is true of a rating that does not exist. If the audit wants an FAQ it asks for a visible one with real answers, and that request waits for your approval rather than applying itself.
No. Anything that would publish a new agent-facing surface sits in a separate bucket that needs the project to have opted in and then approved the specific change. Until then the agentic checks are shown as opportunities rather than failures.
No, and any tool promising that is selling you something. The score measures whether the page is technically able to be found, quoted and acted on. Whether it deserves to rank is about what it says.
On every build, before you publish, and again on the published site. Each report is kept with a timestamp, so the score has a history you can watch move over time rather than only a current value.
Yes. Dismissed findings stay dismissed and stop appearing in the report. A tool that keeps re-reporting a decision you have already made is a tool you learn to stop reading.
The audit runs on the preview, not as a report you request afterwards. By the time you decide to publish, you already know what it costs you.