How the brief is made

Methodology

SiteRune is a configuration and content audit of what a polite crawler can see. It is not a penetration test, not a lab-only Lighthouse run, and not a rank-tracker.

What we fetch

The requested URL (SSRF-safe: no private or loopback addresses), then robots.txt, the sitemap declared there, llms.txt, security.txt, and a walk of same-origin links — preferring URLs listed in llms.txt. Guest and Observer walk 5 interiors; Operator 10; Studio 20. Launch signed-in uses 20. Each of those HTML responses gets the same chapters as the homepage (not a TTFB ping). We also record TTFB from this vantage point, response headers, cookies, TLS handshake (protocol, issuer, expiry), and the redirect chain.

What we score

• Performance: TTFB, compression, cache-control, script/image tax, inner-page TTFB drift.
• Security: HTTPS, HSTS, CSP, framing, cookie flags, mixed content, version banners. No exploits.
• Technical SEO: title, description, canonical, robots, sitemap, H1, schema, thin HTML.
• AI search: llms.txt quality, AI-bot robots policy, entity schema, question headings.
• CMS health: fingerprint plus builder/plugin collisions we can see in HTML.

What we ship

Scores are the trailer. The product is the sequenced playbook and paste-ready files (nginx / Vercel / WordPress mu-plugin, llms.txt, robots AI policy, security.txt). Review CSP before enforcing it.

What we will not do

We do not fuzz, brute-force, or weaponize findings. We do not invent staff, legal entities, or metrics that were not on the page. During Launch, completed scans are listed on Live briefs; you can unpublish a report to keep it off the sitemap.