The questions people actually ask first.

Four things that only matter together. It finds local businesses from a trade and a city; measures each website live against published standards; ranks the findings by the work you sell; and writes a report the business owner can read without a developer, under your own brand. A list of businesses is a commodity and a scan is a commodity. The join between them is not.

Agencies and freelancers who sell web design, SEO and content, security and IT maintenance, or local reputation work. The scoring weights are a profile you choose, so the same audited site sorts differently depending on what you sell, so a security consultant and a web designer get different rankings out of identical measurements.

Yes. The free tools run against any address with no account and no card: a full Tier 0 website audit, and single-purpose checkers for exposed API keys, source maps, security headers, email deliverability and Supabase row-level security. If you want the full report on a site, buy it for $19 straight from the scan, no plan needed.

Only when you choose to. Outreach drafts an email about what the audit found on that business's own website, and nothing is sent until you approve it. It goes from your own mailbox (Outlook directly, or Gmail and any other provider over SMTP) with a one-click unsubscribe and a daily limit, and an address that opts out is never mailed again. SiteAssay does not sell, rent or export contact details, and produces no contact list in any format.

A REST API that starts audits rather than only reading them, an MCP server your coding agent can drive with the same token, SARIF 2.1.0 output for GitHub code scanning, and HMAC-signed webhooks with an event id so a retry cannot be counted twice. One thing is deliberately absent: there is no discovery endpoint, because a rate-limited scraping surface behind an API key is somebody else's outage and our ban.

Yes: owners, admins and members, with each audit assignable to a person and a pipeline board everyone shares. Seat counts include invitations you have sent but nobody has accepted yet, so the number on the billing page is the number of seats you are actually holding.

A small SVG that a business whose site you have fixed can embed on their own page, linking back to a page that confirms the grade it claims. It is deliberately the one thing that is never white-labelled: a verification whose issuer name has been swapped for the issuer's customer is a self-issued certificate, and worth nothing to the person reading it.

The default checks make ordinary GET requests for pages and files the site already serves to anybody, and read what comes back. Nothing is written, changed or deleted, and nothing is fetched that a browser would not fetch on its own. Audits are throttled, sequenced one at a time per host, and identify themselves in the user agent. The handful of checks that actively probe anything are switched off by default.

Because neither of those is a pass and neither is a failure, and printing them as either would be a lie. A check ends in one of five states: it ran and measured something; it ran and there was genuinely nothing to report; it tried and could not finish; the tool behind it is not installed on this deployment; or it was deliberately excluded, by your plan tier or by the gate that stops a heavy scan running against a domain with no site behind it. The report prints which, every time.

The free tools run the quick checks: HTTP, DNS, TLS, redirects, SEO, structured data, AI visibility, conversion readiness, cookies, email authentication and platform fingerprinting. The full audit in your workspace adds deep Core Web Vitals lab and field performance measurements, WCAG accessibility conformance analysis, and multi-page crawl verification.

Two separate things, because they fail independently. Whether an assistant can reach and read the site at all, meaning what robots.txt says about GPTBot, ClaudeBot, PerplexityBot and the rest, whether there is structured data describing the business, whether anything is shaped as an answer. And whether it would cite the site once it has read it: authorship, dates, outbound citations, extractable structure, a clearly defined business entity. A site that blocks the crawlers cannot be recommended however good its content is, so that finding caps the category rather than averaging into it.

How often an assistant mentions a business. Nobody can measure that from outside the assistant, and anyone selling you the number is selling you a sample of prompts they chose. We also check for an llms.txt file and say plainly on the report that no major assistant has committed to reading one, and selling a client an llms.txt as an AI strategy is selling them a deliverable rather than an outcome.

11 categories, each scored 0 to 100 against something published you can go and look up, then weighted by the service line you sell and combined into one composite with a letter grade. Every finding also carries a confidence label: high where it was measured, medium where it was inferred. The difference is printed rather than smoothed over.

Re-audit and the two runs are diffed, classified by why the change is material rather than by which number moved. Put a site on a monitor, daily, weekly or monthly, and you are told when a critical finding appears, when the score moves, or when a batch of things change at once. That alert is usually the reason for the next conversation.

It depends on the plan: 30 days on Starter, three months on Solo, and from Pro upward the link does not expire. The links are unguessable and need no login, so a client can open one on a phone, and because they are unlisted rather than public, the whole path is kept out of search indexes.