Last updated: August 2026
Scoring algorithm v2.1.0How SEO-GEO Scoring and Metrics Work
In short
- · Four scores: SEO, GEO, WCAG (from v2.0) and Security (from v2.1), each 0–100 and mapped to a letter grade A–F.
- · Every category score = passed check weight ÷ total check weight × 100, rounded (from v1.3; critical checks count double).
- · SEO = Technical 30% + Content 30% + Structure 20% + Performance 20%.
- · GEO = AI Readability 35% + Authority 25% + Citations 20% + Freshness 20%.
- · WCAG = Perceivable 30% + Operable 30% + Understandable 25% + Robust 15%.
- · Security = Transport 30% + Headers 30% + Content 25% + Exposure 15%.
- · Combined score = the average of the SEO, GEO, WCAG and Security scores.
- · We analyze only on-site factors from raw HTML and response headers; no backlinks, no rankings, no JavaScript rendering, and no active penetration testing.
1. The crawl: how we collect data
Analysis starts with a focused crawl of your domain. After validating the URL (only public http/https hosts are allowed — private, localhost and cloud-metadata addresses are rejected for security), the crawler discovers pages via your XML sitemap (referenced in robots.txt) and by following internal links in the page structure.
- Page budget — free reports crawl up to 300 pages (the engine supports up to 500). Larger sites are sampled, not fully crawled.
- Fetch limits — each request times out after 10 seconds, with a short delay between requests and a dedicated
SEO-GEO-Bot/1.0user agent. - Structured HTML analysis — from v1.1 onward we parse the returned HTML as a document tree (titles, meta tags, headings, links, images, structured data) rather than scanning the raw markup with text patterns. This improves accuracy; we still do not execute JavaScript, so content injected only client-side is not measured.
- Site files — we additionally fetch
robots.txtandllms.txt, and record per-page load time, TTFB, size, internal/external links, broken links and orphan pages.
See how it works for the end-to-end flow from URL to report.
2. The scoring model
Each analysis runs independent category analyzers across four pillars — four categories each for SEO, GEO, WCAG and Security. Every analyzer runs a fixed set of pass/fail checks and produces a normalized score:
Each check has a weight (usually 1; critical signals such as HTTPS, indexability, author identity or LCP use weight 2). The passedChecks / totalChecks counts in the report and below still refer to the number of checks, not their weights. Category scores are then combined with fixed weights:
SEO score
- Technical — 30%
- Content — 30%
- Structure — 20%
- Performance — 20%
GEO score
- AI Readability — 35%
- Authority (E-E-A-T) — 25%
- Citations — 20%
- Freshness — 20%
WCAG score
- Perceivable — 30%
- Operable — 30%
- Understandable — 25%
- Robust — 15%
Security score
- Transport — 30%
- Headers — 30%
- Content — 25%
- Exposure — 15%
The combined score is the average of the four pillar scores: round((SEO + GEO + WCAG + Security) / 4). Reports generated before a pillar existed average only the pillars they include. Each 0–100 score maps to a letter grade using the scale below.
3. Grading scale
| Grade | Score range | Meaning |
|---|---|---|
| A | 90–100 | Excellent |
| B | 80–89 | Good |
| C | 70–79 | Average |
| D | 60–69 | Below average |
| E | 50–59 | Poor |
| F | 0–49 | Critical |
4. SEO checks in detail
Technical — 30% · 13 checks
Crawlability, indexability, delivery and a mini accessibility audit. Missing HTTPS, a non-200 homepage, a noindex tag, or a missing viewport are weighted as critical (2×) because they can block ranking outright. From v1.3 we also check for main/nav landmarks and form field labels.
| Check | Pass condition | Weight |
|---|---|---|
| HTTPS | Homepage is served over the https: protocol. | critical |
| Page loads (HTTP 200) | Homepage returns status code 200. | critical |
| Indexable | Homepage HTML does not contain a noindex directive. | critical |
| Canonical tags | Every crawled page has a rel="canonical" link (≤2 missing still passes as an info note). | 1 pt |
| Mobile viewport | Homepage declares a meta viewport tag. | critical |
| Hreflang | Homepage declares hreflang for language/region targeting. | 1 pt |
| Compression | Response uses gzip or brotli (content-encoding header). | 1 pt |
| No broken links | 0 broken internal links found (1–3 = warning, 4+ = critical). | 1 pt |
| Sitemap | A sitemap is referenced/discovered during the crawl. | 1 pt |
| robots.txt | A non-empty robots.txt exists at the domain root. | 1 pt |
| Main landmark | At least one crawled page exposes a <main> element or role="main". | 1 pt |
| Navigation landmark | At least one crawled page exposes a <nav> or role="navigation" landmark. | 1 pt |
| Form labels | All visible form inputs have an associated label or aria-label. | 1 pt |
Content — 30% · 13 checks
On-page fundamentals across all crawled pages: titles and descriptions (presence, length and uniqueness), heading hierarchy, image alt text, social metadata, and an English-coverage heuristic for international reach. From v1.3 the report also surfaces thin pages (fewer than 300 words) and flags when the declared html lang does not match the detected language of the homepage body — these appear as metrics and issues, not as additional scored checks.
| Check | Pass condition | Weight |
|---|---|---|
| Homepage title | The <title> tag is present and non-empty. | critical |
| Title length | Title is 30–60 characters (too short = warning, too long = info). | 1 pt |
| Titles on all pages | No crawled page is missing a title (>3 missing = critical). | 1 pt |
| Unique titles | No duplicate <title> values across pages. | 1 pt |
| Meta description | Homepage has a non-empty meta description. | critical |
| Description length | Homepage meta description is 120–155 characters. | 1 pt |
| Descriptions on pages | At most 1 crawled page lacks a meta description. | 1 pt |
| Single H1 | Homepage has exactly one H1 (0 = critical, >1 = warning). | 1 pt |
| H1 on all pages | No crawled page is missing an H1. | 1 pt |
| Image alt text | All images have a non-empty alt attribute. | 1 pt |
| Open Graph | Homepage declares og: tags for social sharing. | 1 pt |
| Twitter Cards | Homepage declares twitter: card tags. | 1 pt |
| English coverage | ≥80% of pages expose English content/translation (heuristic). | 1 pt |
Structure — 20% · 8 checks
Site architecture: URL hygiene, internal linking strength, orphan pages, breadcrumb navigation, structured-data presence and click depth (measured from URL path segments).
| Check | Pass condition | Weight |
|---|---|---|
| URL length | Average URL length ≤75 chars (≤100 = info, >100 = warning). | 1 pt |
| Clean URLs | No URLs contain underscores or uppercase letters. | 1 pt |
| Internal linking | Average ≥5 internal links per page (2–5 passes with an info note). | 1 pt |
| No orphan pages | Every page has at least one internal link pointing to it. | 1 pt |
| Breadcrumbs | More than half of pages expose breadcrumb navigation. | 1 pt |
| Structured data present | At least one page contains JSON-LD or microdata. | 1 pt |
| Crawl depth | Maximum click depth ≤3 levels (≤5 = info, >5 = warning). | 1 pt |
| Crawl completeness | The crawler reached all discoverable pages (up to the page cap). | 1 pt |
Performance — 20% · 7–10 checks
Server-side delivery speed averaged across crawled pages. Load time is the heaviest single check (worth 2 points). When a PageSpeed Insights API key is configured, three additional lab checks (LCP, CLS, INP on mobile) are measured for the homepage via Google Lighthouse — otherwise only crawler timings apply.
| Check | Pass condition | Weight |
|---|---|---|
| Load time | Average <1s scores full marks; <2s = half; <4s = warning; ≥4s = critical. | 2 pts |
| TTFB | Average time to first byte <200ms (<500ms = info, ≥500ms = warning). | 1 pt |
| Page size | Average HTML payload <500KB (<1MB = info, ≥1MB = warning). | 1 pt |
| Compression | Responses served with gzip or brotli. | 1 pt |
| Cache headers | Server sets Cache-Control or Expires headers. | 1 pt |
| Crawl sample | At least 5 pages were measured for reliable averages. | 1 pt |
| LCP (lab) | When PageSpeed API is configured: Largest Contentful Paint <2.5s on mobile (lab). | 2 pts |
| CLS (lab) | When PageSpeed API is configured: Cumulative Layout Shift <0.1 (lab). | 1 pt |
| INP (lab) | When PageSpeed API is configured: Interaction to Next Paint <200ms (lab). | 1 pt |
5. GEO checks in detail
AI Readability — 35% · 19 checks
How easily generative engines can parse and reuse your content. This category merges 16 on-page readability checks with 3 AI-access checks (robots.txt/llms.txt); structured-data coverage below counts for 2 of those points. From v1.3 we add four GEO signal checks: Article schema on blog URLs, Speakable markup, glossaries/definitions and quantified facts in body text. Blocking AI crawlers is critical: if GPTBot, PerplexityBot, ClaudeBot or Google-Extended are disallowed, your content cannot be cited at all.
| Check | Pass condition | Weight |
|---|---|---|
| Structured data coverage | JSON-LD on ≥50% of pages scores full marks; some pages = half. | 2 pts |
| FAQPage schema | At least one page uses FAQPage JSON-LD. | 1 pt |
| HowTo schema | At least one page uses HowTo JSON-LD. | 1 pt |
| Article schema | Article/NewsArticle/BlogPosting/WebPage schema present. | 1 pt |
| Lists | Average ≥2 <ul>/<ol> lists per page. | 1 pt |
| Tables | At least one <table> is used to structure data. | 1 pt |
| Table of contents | A ToC is detected (heading, id/class, or anchor). | 1 pt |
| Summary section | A "Summary", "Key takeaways" or "TL;DR" section exists. | 1 pt |
| Content Clarity (paragraphs) | Homepage paragraphs sit in the ideal 50–300 char range. | 1 pt |
| Answer-first sections | ≥50% of H2/H3 sections lead with a concise 40–60 word answer. | 1 pt |
| Question-style headings | At least one H2/H3 is phrased as a user question. | 1 pt |
| AI crawlers allowed | No AI bot is blocked by its own robots.txt group (impact 10). | critical |
| robots.txt not blocking all | No "User-agent: * / Disallow: /" rule (impact 10). | critical |
| llms.txt present | A curated llms.txt exists at the domain root. | 1 pt |
| Article schema on blog URLs | ≥50% of blog/article path URLs use Article/BlogPosting JSON-LD (skipped when no blog URLs found). | 1 pt |
| Speakable schema | At least one page declares Schema.org Speakable markup. | 1 pt |
| Glossary / definitions | A definition list (<dl>), glossary section or definition heading is present. | 1 pt |
| Quantified facts | ≥20% of pages contain concrete numbers, units or ISO dates in body text. | 1 pt |
Authority (E-E-A-T) — 25% · 12 checks
Experience, Expertise, Authoritativeness and Trust signals that make a source credible enough to cite: author identity and Person schema, organization identity, an entity graph via sameAs, contact and about pages, credentials and publication dates.
| Check | Pass condition | Weight |
|---|---|---|
| Author information | Visible author/byline signals on pages (impact 9). | critical |
| Person schema | Schema.org Person markup for the author. | 1 pt |
| Organization schema | Organization/LocalBusiness/Corporation/NGO schema. | 1 pt |
| sameAs entity links | JSON-LD sameAs links to external profiles (entity graph). | 1 pt |
| About page | A link to an about/company page is present. | 1 pt |
| Contact information | A visible email or contact reference is found. | 1 pt |
| Social profiles | Links to LinkedIn, X, YouTube, GitHub, etc. | 1 pt |
| Credentials | Expertise signals (certified, expert, PhD, years of experience…). | 1 pt |
| Publication dates | Pages expose publication date signals. | 1 pt |
| Named entity in schema | Organization/Person/WebSite JSON-LD includes a name field. | 1 pt |
| Brand in title or H1 | Schema entity name appears in the page title or main H1. | 1 pt |
| Consistent brand naming | Title, H1 and og:site_name use the same brand name. | 1 pt |
Citations — 20% · 7 checks
Evidence density. Generative engines prefer content backed by outbound links, references, attributed quotations and — most strongly — concrete statistics. Statistics are detected via percentages, large numbers with units, and phrases such as "according to" / "research shows".
| Check | Pass condition | Weight |
|---|---|---|
| External source links | Average ≥3 external links per page scores full marks; ≥1 = half. | 2 pts |
| References section | A "Sources"/"References"/"Bibliography" section exists. | 1 pt |
| Quotations | Attributed <blockquote>/<q> quotations are present. | 1 pt |
| Statistics present | At least one number, percentage or "according to…" phrase. | 1 pt |
| Statistics density | ≥3 statistical data points across the site (1–2 = info note). | 1 pt |
| Authority links | ≥1 link to .gov/.edu/Wikipedia/institutional domains. | 1 pt |
Freshness — 20% · 7 checks
Recency signals. Content age is derived from the newest valid datePublished/dateModified found — never from a stray date — and mentions of the current year ignore footers and copyright lines, where the year is usually auto-generated.
| Check | Pass condition | Weight |
|---|---|---|
| Publication date | datePublished present in Schema.org. | 1 pt |
| Modified date | dateModified or a Last-Modified header is present. | 1 pt |
| Content age | Newest date ≤365 days scores full marks; ≤730 days = half. | 2 pts |
| Current year mentioned | Current year appears in content (footer/copyright ignored). | 1 pt |
| NewsArticle schema | NewsArticle/LiveBlogPosting schema present. | 1 pt |
| Event schema | Event/BusinessEvent/SocialEvent schema present. | 1 pt |
6. WCAG accessibility checks (v2.0)
From v2.0 the report includes a dedicated WCAG branch aligned with the POUR principles (Perceivable, Operable, Understandable, Robust). It is a static HTML audit — we do not render CSS or execute JavaScript, so color contrast, focus order and keyboard traps require manual or browser-based testing (e.g. axe DevTools).
- Perceivable — alt text on images (WCAG 1.1.1),
langon<html>(3.1.1). - Operable — main/nav landmarks, skip-to-content link (2.4.1), form labels (1.3.1, 3.3.2), link purpose (2.4.4), button names (4.1.2).
- Understandable — page title (2.4.2), single H1, sequential heading hierarchy (1.3.1).
- Robust — unique IDs (4.1.1), table headers, iframe titles, ARIA on non-semantic elements.
The mini accessibility audit in Technical SEO (landmarks, labels) remains for backward compatibility; the WCAG branch provides the full score and prioritized recommendations.
7. Security checks (v2.1)
From v2.1 the report includes a fourth pillar: a Security audit. It is passive and static — we inspect response headers, the returned HTML and a few read-only probes (an HTTP → HTTPS redirect check, /.well-known/security.txt and common exposed-file paths). We never inject payloads, brute-force endpoints or run active penetration testing, and requests to private, localhost and cloud-metadata addresses are rejected. The score is weighted Transport 30% + Headers 30% + Content 25% + Exposure 15%.
- Transport (30%) — HTTPS on the homepage, an HTTP → HTTPS redirect, HSTS (
Strict-Transport-Securitywithmax-age,includeSubDomains,preload) and mixed-content references (http:// assets on an https:// page). - Headers (30%) —
Content-Security-Policy(and common weaknesses such asunsafe-inline,unsafe-eval, wildcard or missingobject-src), clickjacking protection (X-Frame-Optionsor CSPframe-ancestors),X-Content-Type-Options,Referrer-Policy,Permissions-Policy, cross-origin isolation (COOP/COEP/CORP) and overly permissive CORS. - Content (25%) — forms posting over HTTP, tabnabbing (
target="_blank"withoutrel="noopener"), iframes withoutsandbox, external scripts without Subresource Integrity, risky inline event handlers andjavascript:URIs, potential secrets in markup/comments and known outdated JavaScript libraries. - Exposure (15%) — cookie flags (
Secure,HttpOnly,SameSite), server and framework version disclosure (Server,X-Powered-By, CMS generator), sensitive paths inrobots.txt, a publishedsecurity.txtand accidentally exposed files (e.g..git,.env).
Because the audit is passive, it surfaces configuration and hardening gaps quickly and at scale, but it is not a substitute for a full penetration test or a review of server-side application logic.
8. Sub-algorithm: Content Clarity
Content Clarity is a 0–100 readability metric computed on the homepage and blended from three weighted components:
- Paragraphs (35%) — ideal length 50–300 characters; paragraphs over 400 chars lower the score.
- Sentences (40%) — ideal length 40–120 characters; sentences over 180 chars are penalized, extremely short ones slightly so.
- Structure (25%) — rewards at least 2 H2/H3 headings and roughly one heading per ~7 paragraphs.
9. Sub-algorithm: answer-first & question headings
Research on generative engines (Princeton, Aggarwal et al.) shows that AI systems preferentially cite passages that answer the heading's question in the first 40–60 words — so-called heading-to-passage anchoring. We extract every H2/H3 section and its leading paragraph, then:
- · A section passes if its lead is a concise, self-contained answer (roughly 10–80 words, ideal 40–60).
- · The answer-first ratio is the share of sections with such a lead; ≥50% passes the check.
- · Separately, headings phrased as real questions (starting with how/what/why… in EN or PL, or ending with "?") match conversational AI queries and score their own check.
10. Sub-algorithm: AI crawler access
We parse robots.txt into per-user-agent groups (honoring stacked User-agent lines) and check each known AI bot — GPTBot, OAI-SearchBot, PerplexityBot, ClaudeBot, anthropic-ai, Google-Extended, Applebot-Extended, CCBot, Bytespider and more. A bot counts as blocked when its own group has Disallow: / without an overriding Allow: /. Two failures here are critical (blocked AI bots; a site-wide User-agent: * / Disallow: /), and the presence of an llms.txt index is scored as a positive signal. The report also renders a full allowed/blocked table per engine.
11. Issues, severity and prioritization
Every failed (or partially failed) check produces an issue with a severity — critical, warning or info — and an impact value from 1 to 10. Severity does not directly subtract points (the score comes from the weighted pass ratio); instead it drives prioritization. Recommendations are sorted first by severity (critical → warning → info) and then by descending impact. From v1.3 the HTML report also groups recommendations into Quick wins (lower effort, impact ≥ 5) and Larger projects (higher effort or structural fixes) so you know what to tackle first.
12. Limitations
- Snapshot only — we analyze the site at crawl time. We do not track rankings or historical SERP data.
- No JavaScript rendering — we read server-returned HTML, so content injected only by client-side JS is not seen.
- No backlink or off-page data — scores exclude link authority and external signals; the focus is on-site.
- Crawl depth — free reports crawl up to 300 pages; larger sites are sampled and some pages may not be analyzed.
- Heuristics — signals such as language/English detection, author info and statistics use content heuristics and can occasionally mis-classify.
- GEO evolves — AI citation behavior changes; GEO criteria reflect current best practices and published research and will be updated.
- Passive security only — the Security branch inspects headers, HTML and read-only probes. It does not test server-side logic, authentication or run active penetration testing, so a good score is not a guarantee of security.
For more on what the tool is best used for, see use cases and FAQ.
Scoring algorithm versions
Every report is generated with a specific, versioned build of the scoring algorithm. The version is shown on each report and in the site footer, so you can tell exactly which rules produced a given score. When we change checks, weights or grading, we bump the version below and describe what changed. Reports keep the version they were generated with, so historical scores stay reproducible.
Current version: v2.1.0
v2.1.0
CurrentStatic security audit branch and combined SEO+GEO+WCAG+Security score.
- New Security branch: Transport (HTTPS/HSTS/mixed content), Headers (CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, CORS), Content (forms over HTTP, tabnabbing, iframe sandbox, Subresource Integrity, inline JS, secrets, outdated JS libraries) and Exposure (cookie flags, version disclosure, robots.txt sensitive paths, CMS version, security.txt, exposed files).
- Combined score is now the average of SEO, GEO, WCAG and Security scores (was SEO+GEO+WCAG).
- Report UI adds a Security score card with category breakdown and dedicated recommendations.
- Passive analysis only — active penetration testing and payload injection are out of scope.
v2.0.0
WCAG accessibility audit branch with POUR scoring and combined SEO+GEO+WCAG score.
- New WCAG branch: Perceivable, Operable, Understandable and Robust categories aligned with WCAG 2.x POUR principles.
- Checks include alt text, lang attribute, landmarks, skip links, form labels, link purpose, heading hierarchy, duplicate IDs and table headers.
- Combined score is now the average of SEO, GEO and WCAG scores (was SEO+GEO only).
- Report UI shows a third WCAG score card, category breakdown and dedicated accessibility recommendations.
- Static HTML analysis only — color contrast and keyboard traps require manual or browser-based testing.
v1.3.0
Sprint A: content depth signals, accessibility, GEO signals and weighted scoring.
- Content metrics now flag thin pages (<300 words) and detect language consistency with the html lang attribute.
- Technical category adds a mini accessibility audit (landmarks, form labels) alongside existing checks.
- AI Readability adds GEO signals: Article schema on blog URLs, Speakable markup, glossaries and quantified facts in body text.
- Recommendations in the report are grouped into quick wins and larger projects.
- Category scores now use impact-weighted checks — critical signals count more toward the final score.
v1.2.0
Core Web Vitals lab metrics and entity clarity checks for AI knowledge graphs.
- Performance category can include LCP, CLS and INP measured via Google PageSpeed Insights when an API key is configured — otherwise crawler-based checks apply as before.
- Authority category adds entity clarity: whether your brand name is declared in structured data and aligned across the page title, main heading and social metadata.
- New report metrics surface lab CWV values and an entity clarity score on the homepage.
- Scope unchanged: on-page SEO and GEO only.
v1.1.0
More accurate on-page analysis using structured HTML parsing.
- Page structure is read through a document parser instead of pattern matching on raw HTML — titles, meta tags, headings, links and images are detected more reliably.
- Navigation links in menus, headers and footers are discovered more consistently when mapping the site.
- Structured data, breadcrumbs and publication dates are taken from actual markup, reducing false positives from incidental text on the page.
- Heading hierarchy and section leads are evaluated with a clearer reading of the page layout.
- Scope unchanged: still on-page SEO and GEO only — no off-page or AI-visibility tracking.
v1.0.0
Initial public scoring algorithm.
- SEO score = Technical 30% + Content 30% + Structure 20% + Performance 20%.
- GEO score = AI Readability 35% + Authority 25% + Citations 20% + Freshness 20%.
- Combined score = average of the SEO and GEO scores.
- Each category score = passed checks ÷ total checks × 100, with a few high-impact checks weighted at 2 points.
- Letter grades A–F mapped from the 0–100 scale (A ≥ 90, B ≥ 80, C ≥ 70, D ≥ 60, E ≥ 50, F below).
Credibility and updates
We update this methodology whenever we change scoring or add checks. The "Last updated" date at the top reflects the last substantive change. The same rules run for every URL — there is no paid placement in recommendations. Our team and editorial approach are described on the About page.
Why we publish this (editorial transparency)
We believe audit tools should be transparent about what they measure and how. This page exists so you can interpret your report correctly and compare our approach with other tools (e.g. Ahrefs, SEMrush, Screaming Frog). Scores are calculated from the same rules for every URL. If you have questions, contact us or read our FAQ.