Matan· Founder & DeveloperLast updated: July 8, 2026

Last updated: August 2026

Scoring algorithm v2.1.0

How SEO-GEO Scoring and Metrics Work

This page documents the exact algorithms behind your report: how we crawl a site, every check we run, how checks turn into 0–100 category scores, how categories are weighted into SEO, GEO, WCAG and Security scores, and the limitations of the analysis. Everything here mirrors the rules applied to every URL.

In short

  • · Four scores: SEO, GEO, WCAG (from v2.0) and Security (from v2.1), each 0–100 and mapped to a letter grade A–F.
  • · Every category score = passed check weight ÷ total check weight × 100, rounded (from v1.3; critical checks count double).
  • · SEO = Technical 30% + Content 30% + Structure 20% + Performance 20%.
  • · GEO = AI Readability 35% + Authority 25% + Citations 20% + Freshness 20%.
  • · WCAG = Perceivable 30% + Operable 30% + Understandable 25% + Robust 15%.
  • · Security = Transport 30% + Headers 30% + Content 25% + Exposure 15%.
  • · Combined score = the average of the SEO, GEO, WCAG and Security scores.
  • · We analyze only on-site factors from raw HTML and response headers; no backlinks, no rankings, no JavaScript rendering, and no active penetration testing.

1. The crawl: how we collect data

Analysis starts with a focused crawl of your domain. After validating the URL (only public http/https hosts are allowed — private, localhost and cloud-metadata addresses are rejected for security), the crawler discovers pages via your XML sitemap (referenced in robots.txt) and by following internal links in the page structure.

  • Page budget — free reports crawl up to 300 pages (the engine supports up to 500). Larger sites are sampled, not fully crawled.
  • Fetch limits — each request times out after 10 seconds, with a short delay between requests and a dedicated SEO-GEO-Bot/1.0 user agent.
  • Structured HTML analysis — from v1.1 onward we parse the returned HTML as a document tree (titles, meta tags, headings, links, images, structured data) rather than scanning the raw markup with text patterns. This improves accuracy; we still do not execute JavaScript, so content injected only client-side is not measured.
  • Site files — we additionally fetch robots.txt and llms.txt, and record per-page load time, TTFB, size, internal/external links, broken links and orphan pages.

See how it works for the end-to-end flow from URL to report.

2. The scoring model

Each analysis runs independent category analyzers across four pillars — four categories each for SEO, GEO, WCAG and Security. Every analyzer runs a fixed set of pass/fail checks and produces a normalized score:

categoryScore = round( passedWeight / totalWeight × 100 )

Each check has a weight (usually 1; critical signals such as HTTPS, indexability, author identity or LCP use weight 2). The passedChecks / totalChecks counts in the report and below still refer to the number of checks, not their weights. Category scores are then combined with fixed weights:

SEO score

  • Technical — 30%
  • Content — 30%
  • Structure — 20%
  • Performance — 20%

GEO score

  • AI Readability — 35%
  • Authority (E-E-A-T) — 25%
  • Citations — 20%
  • Freshness — 20%

WCAG score

  • Perceivable — 30%
  • Operable — 30%
  • Understandable — 25%
  • Robust — 15%

Security score

  • Transport — 30%
  • Headers — 30%
  • Content — 25%
  • Exposure — 15%

The combined score is the average of the four pillar scores: round((SEO + GEO + WCAG + Security) / 4). Reports generated before a pillar existed average only the pillars they include. Each 0–100 score maps to a letter grade using the scale below.

3. Grading scale

GradeScore rangeMeaning
A90–100Excellent
B80–89Good
C70–79Average
D60–69Below average
E50–59Poor
F0–49Critical

4. SEO checks in detail

Technical — 30% · 13 checks

Crawlability, indexability, delivery and a mini accessibility audit. Missing HTTPS, a non-200 homepage, a noindex tag, or a missing viewport are weighted as critical (2×) because they can block ranking outright. From v1.3 we also check for main/nav landmarks and form field labels.

CheckPass conditionWeight
HTTPSHomepage is served over the https: protocol.critical
Page loads (HTTP 200)Homepage returns status code 200.critical
IndexableHomepage HTML does not contain a noindex directive.critical
Canonical tagsEvery crawled page has a rel="canonical" link (≤2 missing still passes as an info note).1 pt
Mobile viewportHomepage declares a meta viewport tag.critical
HreflangHomepage declares hreflang for language/region targeting.1 pt
CompressionResponse uses gzip or brotli (content-encoding header).1 pt
No broken links0 broken internal links found (1–3 = warning, 4+ = critical).1 pt
SitemapA sitemap is referenced/discovered during the crawl.1 pt
robots.txtA non-empty robots.txt exists at the domain root.1 pt
Main landmarkAt least one crawled page exposes a <main> element or role="main".1 pt
Navigation landmarkAt least one crawled page exposes a <nav> or role="navigation" landmark.1 pt
Form labelsAll visible form inputs have an associated label or aria-label.1 pt

Content — 30% · 13 checks

On-page fundamentals across all crawled pages: titles and descriptions (presence, length and uniqueness), heading hierarchy, image alt text, social metadata, and an English-coverage heuristic for international reach. From v1.3 the report also surfaces thin pages (fewer than 300 words) and flags when the declared html lang does not match the detected language of the homepage body — these appear as metrics and issues, not as additional scored checks.

CheckPass conditionWeight
Homepage titleThe <title> tag is present and non-empty.critical
Title lengthTitle is 30–60 characters (too short = warning, too long = info).1 pt
Titles on all pagesNo crawled page is missing a title (>3 missing = critical).1 pt
Unique titlesNo duplicate <title> values across pages.1 pt
Meta descriptionHomepage has a non-empty meta description.critical
Description lengthHomepage meta description is 120–155 characters.1 pt
Descriptions on pagesAt most 1 crawled page lacks a meta description.1 pt
Single H1Homepage has exactly one H1 (0 = critical, >1 = warning).1 pt
H1 on all pagesNo crawled page is missing an H1.1 pt
Image alt textAll images have a non-empty alt attribute.1 pt
Open GraphHomepage declares og: tags for social sharing.1 pt
Twitter CardsHomepage declares twitter: card tags.1 pt
English coverage≥80% of pages expose English content/translation (heuristic).1 pt

Structure — 20% · 8 checks

Site architecture: URL hygiene, internal linking strength, orphan pages, breadcrumb navigation, structured-data presence and click depth (measured from URL path segments).

CheckPass conditionWeight
URL lengthAverage URL length ≤75 chars (≤100 = info, >100 = warning).1 pt
Clean URLsNo URLs contain underscores or uppercase letters.1 pt
Internal linkingAverage ≥5 internal links per page (2–5 passes with an info note).1 pt
No orphan pagesEvery page has at least one internal link pointing to it.1 pt
BreadcrumbsMore than half of pages expose breadcrumb navigation.1 pt
Structured data presentAt least one page contains JSON-LD or microdata.1 pt
Crawl depthMaximum click depth ≤3 levels (≤5 = info, >5 = warning).1 pt
Crawl completenessThe crawler reached all discoverable pages (up to the page cap).1 pt

Performance — 20% · 7–10 checks

Server-side delivery speed averaged across crawled pages. Load time is the heaviest single check (worth 2 points). When a PageSpeed Insights API key is configured, three additional lab checks (LCP, CLS, INP on mobile) are measured for the homepage via Google Lighthouse — otherwise only crawler timings apply.

CheckPass conditionWeight
Load timeAverage <1s scores full marks; <2s = half; <4s = warning; ≥4s = critical.2 pts
TTFBAverage time to first byte <200ms (<500ms = info, ≥500ms = warning).1 pt
Page sizeAverage HTML payload <500KB (<1MB = info, ≥1MB = warning).1 pt
CompressionResponses served with gzip or brotli.1 pt
Cache headersServer sets Cache-Control or Expires headers.1 pt
Crawl sampleAt least 5 pages were measured for reliable averages.1 pt
LCP (lab)When PageSpeed API is configured: Largest Contentful Paint <2.5s on mobile (lab).2 pts
CLS (lab)When PageSpeed API is configured: Cumulative Layout Shift <0.1 (lab).1 pt
INP (lab)When PageSpeed API is configured: Interaction to Next Paint <200ms (lab).1 pt

5. GEO checks in detail

AI Readability — 35% · 19 checks

How easily generative engines can parse and reuse your content. This category merges 16 on-page readability checks with 3 AI-access checks (robots.txt/llms.txt); structured-data coverage below counts for 2 of those points. From v1.3 we add four GEO signal checks: Article schema on blog URLs, Speakable markup, glossaries/definitions and quantified facts in body text. Blocking AI crawlers is critical: if GPTBot, PerplexityBot, ClaudeBot or Google-Extended are disallowed, your content cannot be cited at all.

CheckPass conditionWeight
Structured data coverageJSON-LD on ≥50% of pages scores full marks; some pages = half.2 pts
FAQPage schemaAt least one page uses FAQPage JSON-LD.1 pt
HowTo schemaAt least one page uses HowTo JSON-LD.1 pt
Article schemaArticle/NewsArticle/BlogPosting/WebPage schema present.1 pt
ListsAverage ≥2 <ul>/<ol> lists per page.1 pt
TablesAt least one <table> is used to structure data.1 pt
Table of contentsA ToC is detected (heading, id/class, or anchor).1 pt
Summary sectionA "Summary", "Key takeaways" or "TL;DR" section exists.1 pt
Content Clarity (paragraphs)Homepage paragraphs sit in the ideal 50–300 char range.1 pt
Answer-first sections≥50% of H2/H3 sections lead with a concise 40–60 word answer.1 pt
Question-style headingsAt least one H2/H3 is phrased as a user question.1 pt
AI crawlers allowedNo AI bot is blocked by its own robots.txt group (impact 10).critical
robots.txt not blocking allNo "User-agent: * / Disallow: /" rule (impact 10).critical
llms.txt presentA curated llms.txt exists at the domain root.1 pt
Article schema on blog URLs≥50% of blog/article path URLs use Article/BlogPosting JSON-LD (skipped when no blog URLs found).1 pt
Speakable schemaAt least one page declares Schema.org Speakable markup.1 pt
Glossary / definitionsA definition list (<dl>), glossary section or definition heading is present.1 pt
Quantified facts≥20% of pages contain concrete numbers, units or ISO dates in body text.1 pt

Authority (E-E-A-T) — 25% · 12 checks

Experience, Expertise, Authoritativeness and Trust signals that make a source credible enough to cite: author identity and Person schema, organization identity, an entity graph via sameAs, contact and about pages, credentials and publication dates.

CheckPass conditionWeight
Author informationVisible author/byline signals on pages (impact 9).critical
Person schemaSchema.org Person markup for the author.1 pt
Organization schemaOrganization/LocalBusiness/Corporation/NGO schema.1 pt
sameAs entity linksJSON-LD sameAs links to external profiles (entity graph).1 pt
About pageA link to an about/company page is present.1 pt
Contact informationA visible email or contact reference is found.1 pt
Social profilesLinks to LinkedIn, X, YouTube, GitHub, etc.1 pt
CredentialsExpertise signals (certified, expert, PhD, years of experience…).1 pt
Publication datesPages expose publication date signals.1 pt
Named entity in schemaOrganization/Person/WebSite JSON-LD includes a name field.1 pt
Brand in title or H1Schema entity name appears in the page title or main H1.1 pt
Consistent brand namingTitle, H1 and og:site_name use the same brand name.1 pt

Citations — 20% · 7 checks

Evidence density. Generative engines prefer content backed by outbound links, references, attributed quotations and — most strongly — concrete statistics. Statistics are detected via percentages, large numbers with units, and phrases such as "according to" / "research shows".

CheckPass conditionWeight
External source linksAverage ≥3 external links per page scores full marks; ≥1 = half.2 pts
References sectionA "Sources"/"References"/"Bibliography" section exists.1 pt
QuotationsAttributed <blockquote>/<q> quotations are present.1 pt
Statistics presentAt least one number, percentage or "according to…" phrase.1 pt
Statistics density≥3 statistical data points across the site (1–2 = info note).1 pt
Authority links≥1 link to .gov/.edu/Wikipedia/institutional domains.1 pt

Freshness — 20% · 7 checks

Recency signals. Content age is derived from the newest valid datePublished/dateModified found — never from a stray date — and mentions of the current year ignore footers and copyright lines, where the year is usually auto-generated.

CheckPass conditionWeight
Publication datedatePublished present in Schema.org.1 pt
Modified datedateModified or a Last-Modified header is present.1 pt
Content ageNewest date ≤365 days scores full marks; ≤730 days = half.2 pts
Current year mentionedCurrent year appears in content (footer/copyright ignored).1 pt
NewsArticle schemaNewsArticle/LiveBlogPosting schema present.1 pt
Event schemaEvent/BusinessEvent/SocialEvent schema present.1 pt

6. WCAG accessibility checks (v2.0)

From v2.0 the report includes a dedicated WCAG branch aligned with the POUR principles (Perceivable, Operable, Understandable, Robust). It is a static HTML audit — we do not render CSS or execute JavaScript, so color contrast, focus order and keyboard traps require manual or browser-based testing (e.g. axe DevTools).

  • Perceivable — alt text on images (WCAG 1.1.1), lang on <html> (3.1.1).
  • Operable — main/nav landmarks, skip-to-content link (2.4.1), form labels (1.3.1, 3.3.2), link purpose (2.4.4), button names (4.1.2).
  • Understandable — page title (2.4.2), single H1, sequential heading hierarchy (1.3.1).
  • Robust — unique IDs (4.1.1), table headers, iframe titles, ARIA on non-semantic elements.

The mini accessibility audit in Technical SEO (landmarks, labels) remains for backward compatibility; the WCAG branch provides the full score and prioritized recommendations.

7. Security checks (v2.1)

From v2.1 the report includes a fourth pillar: a Security audit. It is passive and static — we inspect response headers, the returned HTML and a few read-only probes (an HTTP → HTTPS redirect check, /.well-known/security.txt and common exposed-file paths). We never inject payloads, brute-force endpoints or run active penetration testing, and requests to private, localhost and cloud-metadata addresses are rejected. The score is weighted Transport 30% + Headers 30% + Content 25% + Exposure 15%.

  • Transport (30%) — HTTPS on the homepage, an HTTP → HTTPS redirect, HSTS (Strict-Transport-Security with max-age, includeSubDomains, preload) and mixed-content references (http:// assets on an https:// page).
  • Headers (30%)Content-Security-Policy (and common weaknesses such as unsafe-inline, unsafe-eval, wildcard or missing object-src), clickjacking protection (X-Frame-Options or CSP frame-ancestors), X-Content-Type-Options, Referrer-Policy, Permissions-Policy, cross-origin isolation (COOP/COEP/CORP) and overly permissive CORS.
  • Content (25%) — forms posting over HTTP, tabnabbing (target="_blank" without rel="noopener"), iframes without sandbox, external scripts without Subresource Integrity, risky inline event handlers and javascript: URIs, potential secrets in markup/comments and known outdated JavaScript libraries.
  • Exposure (15%) — cookie flags (Secure, HttpOnly, SameSite), server and framework version disclosure (Server, X-Powered-By, CMS generator), sensitive paths in robots.txt, a published security.txt and accidentally exposed files (e.g. .git, .env).

Because the audit is passive, it surfaces configuration and hardening gaps quickly and at scale, but it is not a substitute for a full penetration test or a review of server-side application logic.

8. Sub-algorithm: Content Clarity

Content Clarity is a 0–100 readability metric computed on the homepage and blended from three weighted components:

clarity = paragraphs × 35% + sentences × 40% + structure × 25%
  • Paragraphs (35%) — ideal length 50–300 characters; paragraphs over 400 chars lower the score.
  • Sentences (40%) — ideal length 40–120 characters; sentences over 180 chars are penalized, extremely short ones slightly so.
  • Structure (25%) — rewards at least 2 H2/H3 headings and roughly one heading per ~7 paragraphs.

9. Sub-algorithm: answer-first & question headings

Research on generative engines (Princeton, Aggarwal et al.) shows that AI systems preferentially cite passages that answer the heading's question in the first 40–60 words — so-called heading-to-passage anchoring. We extract every H2/H3 section and its leading paragraph, then:

  • · A section passes if its lead is a concise, self-contained answer (roughly 10–80 words, ideal 40–60).
  • · The answer-first ratio is the share of sections with such a lead; ≥50% passes the check.
  • · Separately, headings phrased as real questions (starting with how/what/why… in EN or PL, or ending with "?") match conversational AI queries and score their own check.

10. Sub-algorithm: AI crawler access

We parse robots.txt into per-user-agent groups (honoring stacked User-agent lines) and check each known AI bot — GPTBot, OAI-SearchBot, PerplexityBot, ClaudeBot, anthropic-ai, Google-Extended, Applebot-Extended, CCBot, Bytespider and more. A bot counts as blocked when its own group has Disallow: / without an overriding Allow: /. Two failures here are critical (blocked AI bots; a site-wide User-agent: * / Disallow: /), and the presence of an llms.txt index is scored as a positive signal. The report also renders a full allowed/blocked table per engine.

11. Issues, severity and prioritization

Every failed (or partially failed) check produces an issue with a severity — critical, warning or info — and an impact value from 1 to 10. Severity does not directly subtract points (the score comes from the weighted pass ratio); instead it drives prioritization. Recommendations are sorted first by severity (critical → warning → info) and then by descending impact. From v1.3 the HTML report also groups recommendations into Quick wins (lower effort, impact ≥ 5) and Larger projects (higher effort or structural fixes) so you know what to tackle first.

12. Limitations

  • Snapshot only — we analyze the site at crawl time. We do not track rankings or historical SERP data.
  • No JavaScript rendering — we read server-returned HTML, so content injected only by client-side JS is not seen.
  • No backlink or off-page data — scores exclude link authority and external signals; the focus is on-site.
  • Crawl depth — free reports crawl up to 300 pages; larger sites are sampled and some pages may not be analyzed.
  • Heuristics — signals such as language/English detection, author info and statistics use content heuristics and can occasionally mis-classify.
  • GEO evolves — AI citation behavior changes; GEO criteria reflect current best practices and published research and will be updated.
  • Passive security only — the Security branch inspects headers, HTML and read-only probes. It does not test server-side logic, authentication or run active penetration testing, so a good score is not a guarantee of security.

For more on what the tool is best used for, see use cases and FAQ.

Scoring algorithm versions

Every report is generated with a specific, versioned build of the scoring algorithm. The version is shown on each report and in the site footer, so you can tell exactly which rules produced a given score. When we change checks, weights or grading, we bump the version below and describe what changed. Reports keep the version they were generated with, so historical scores stay reproducible.

Current version: v2.1.0

  1. v2.1.0

    Current

    Static security audit branch and combined SEO+GEO+WCAG+Security score.

    • New Security branch: Transport (HTTPS/HSTS/mixed content), Headers (CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, CORS), Content (forms over HTTP, tabnabbing, iframe sandbox, Subresource Integrity, inline JS, secrets, outdated JS libraries) and Exposure (cookie flags, version disclosure, robots.txt sensitive paths, CMS version, security.txt, exposed files).
    • Combined score is now the average of SEO, GEO, WCAG and Security scores (was SEO+GEO+WCAG).
    • Report UI adds a Security score card with category breakdown and dedicated recommendations.
    • Passive analysis only — active penetration testing and payload injection are out of scope.
  2. v2.0.0

    WCAG accessibility audit branch with POUR scoring and combined SEO+GEO+WCAG score.

    • New WCAG branch: Perceivable, Operable, Understandable and Robust categories aligned with WCAG 2.x POUR principles.
    • Checks include alt text, lang attribute, landmarks, skip links, form labels, link purpose, heading hierarchy, duplicate IDs and table headers.
    • Combined score is now the average of SEO, GEO and WCAG scores (was SEO+GEO only).
    • Report UI shows a third WCAG score card, category breakdown and dedicated accessibility recommendations.
    • Static HTML analysis only — color contrast and keyboard traps require manual or browser-based testing.
  3. v1.3.0

    Sprint A: content depth signals, accessibility, GEO signals and weighted scoring.

    • Content metrics now flag thin pages (<300 words) and detect language consistency with the html lang attribute.
    • Technical category adds a mini accessibility audit (landmarks, form labels) alongside existing checks.
    • AI Readability adds GEO signals: Article schema on blog URLs, Speakable markup, glossaries and quantified facts in body text.
    • Recommendations in the report are grouped into quick wins and larger projects.
    • Category scores now use impact-weighted checks — critical signals count more toward the final score.
  4. v1.2.0

    Core Web Vitals lab metrics and entity clarity checks for AI knowledge graphs.

    • Performance category can include LCP, CLS and INP measured via Google PageSpeed Insights when an API key is configured — otherwise crawler-based checks apply as before.
    • Authority category adds entity clarity: whether your brand name is declared in structured data and aligned across the page title, main heading and social metadata.
    • New report metrics surface lab CWV values and an entity clarity score on the homepage.
    • Scope unchanged: on-page SEO and GEO only.
  5. v1.1.0

    More accurate on-page analysis using structured HTML parsing.

    • Page structure is read through a document parser instead of pattern matching on raw HTML — titles, meta tags, headings, links and images are detected more reliably.
    • Navigation links in menus, headers and footers are discovered more consistently when mapping the site.
    • Structured data, breadcrumbs and publication dates are taken from actual markup, reducing false positives from incidental text on the page.
    • Heading hierarchy and section leads are evaluated with a clearer reading of the page layout.
    • Scope unchanged: still on-page SEO and GEO only — no off-page or AI-visibility tracking.
  6. v1.0.0

    Initial public scoring algorithm.

    • SEO score = Technical 30% + Content 30% + Structure 20% + Performance 20%.
    • GEO score = AI Readability 35% + Authority 25% + Citations 20% + Freshness 20%.
    • Combined score = average of the SEO and GEO scores.
    • Each category score = passed checks ÷ total checks × 100, with a few high-impact checks weighted at 2 points.
    • Letter grades A–F mapped from the 0–100 scale (A ≥ 90, B ≥ 80, C ≥ 70, D ≥ 60, E ≥ 50, F below).

Credibility and updates

We update this methodology whenever we change scoring or add checks. The "Last updated" date at the top reflects the last substantive change. The same rules run for every URL — there is no paid placement in recommendations. Our team and editorial approach are described on the About page.

Why we publish this (editorial transparency)

We believe audit tools should be transparent about what they measure and how. This page exists so you can interpret your report correctly and compare our approach with other tools (e.g. Ahrefs, SEMrush, Screaming Frog). Scores are calculated from the same rules for every URL. If you have questions, contact us or read our FAQ.

Get your free SEO & GEO report

Enter your URL and receive a full audit with scoring and recommendations. No sign-up required.