Sitelemetry/BlogTHE WEB, EXPLAINED
Discover the ideas that make websites clear, fast and easy to use. Learn how the pieces work together through everyday examples and practical guidance.
A website audit covers six areas: security, SEO, AI readiness, accessibility, performance and integrations. Follow one customer journey through all six and turn what you find into a short, prioritized plan.
Read the guide21 guides · 9 languages
A website audit covers six areas: security, SEO, AI readiness, accessibility, performance and integrations. Follow one customer journey through all six and turn what you find into a short, prioritized plan.
Read the guideA practical way to audit the security of a website: follow one customer journey, check sign-in, permissions, HTTPS and response headers, and keep a record you can repeat after each change.
Read the guideFollow one page from discovery to indexing: internal links and sitemaps, status codes, JavaScript rendering, canonical URLs and titles, and how to confirm the result in Search Console.
Read the guideMake pages that answer a specific customer question, state clearly who you are and show where the facts come from, then record what actual AI answers say about you.
Read the guideCheck a website for accessibility by following one booking with a mouse, a keyboard and a screen reader: labels, focus order, headings, alt text, contrast and reflow.
Read the guideHow loading, interaction and layout stability map to LCP, INP and CLS, what counts as good for each, and how to compare lab and field data before and after a change.
Read the guideFollow one booking through the website, analytics and advertising services to define events, use a data layer, apply consent choices and confirm that each action is recorded as intended.
Read the guideWhat TLS certificates, Content Security Policy, HSTS and cookie attributes each do during an HTTPS visit, and how to introduce them without breaking sign-in, payments or embedded services.
Read the guideHow SPF, DKIM and DMARC work together to authenticate mail sent from your domain, where CAA and MTA-STS fit, and how to verify the setup with real messages and DMARC reports.
Read the guideWhat robots.txt can and cannot do, when to use noindex or sign-in instead, how Google matches Allow and Disallow rules, and how to test a crawling policy after publishing.
Read the guideMCP, the Model Context Protocol, is an open protocol that lets AI applications use tools and data from other services. Learn how hosts, clients and servers work, what tools, resources and prompts do, and where OAuth fits in.
Read the guideShort definitions of 50 terms that come up in website audits, grouped by delivery, search, security, evidence, performance, accessibility, integrations, AI and connected assistants.
Read the guideSecurity headers are instructions your server sends with its responses: which resources a page may load, whether the browser must insist on HTTPS, who may put the page in a frame. Here is how to read them yourself, what each one does, safe starting values and a rollout order that lets you test each change before you enforce it.
Read the guideHow to look up and read SPF, DKIM and DMARC records yourself, which mistakes break them, how to move a DMARC policy from none to reject, and what the large mailbox providers require from senders.
Read the guideEight passive checks to run before a launch and after a migration: why each one matters, how to verify it with a browser, dig, curl or openssl, what a good result looks like and the usual fix.
Read the guidellms.txt is an informal proposal for a Markdown file that points AI agents to a site's most useful pages. It does not control crawling or indexing, Google Search ignores it, and as of October 2026 OpenAI, Anthropic and Perplexity do not document reading it to rank or cite sites. For documentation-heavy sites it is still a cheap, useful index.
Read the guideA Content-Security-Policy tells the browser which scripts may run on your pages. Three working example policies, the parts that make a policy strict (nonces, hashes and strict-dynamic), the directives default-src does not cover, violation reporting and a staged rollout that starts in Report-Only mode.
Read the guideThe HSTS preload list builds your domain into browsers so that even the first visit uses HTTPS, for every subdomain. Joining takes one form; leaving takes months. Here are the exact requirements, the risks that make it a one-way decision, a staged max-age plan and the commands to check your header and your list status.
Read the guideA step-by-step path from a monitoring-only DMARC record to quarantine and reject: what the reports show, how to find every service that sends as your domain, when relaxed alignment is enough, why pct no longer stages a rollout and what replaced it, how subdomains are covered, and how to roll back when legitimate mail fails.
Read the guideWhy an SPF record can return permerror even when every entry looks right: which terms cost a DNS lookup, how to count them through nested includes, the separate limit on void lookups, and safe ways to get back under ten without breaking legitimate mail.
Read the guideAn AI website audit pairs an AI agent with structured, evidence-backed checks across security, technical SEO, AI visibility, accessibility, performance and integrations. Learn what an agent can and cannot do on its own, what to check in each area, a step-by-step workflow over MCP from audit to re-audit, and how to judge any AI website audit tool.
Read the guideSITELEMETRY
Explore your website’s structure, settings and signals with Sitelemetry.
