Methodology
Every number in a SiteAssay report is a live measurement of the prospect's own site, checked against a published standard. That is a deliberate constraint: a diagnostic that cannot be independently verified is an opinion, and opinions do not close deals.
What we measure against
| Area | Standard | What it establishes |
|---|---|---|
| Performance | Core Web Vitals | Lab measurement in a real headless browser via Lighthouse, plus field data from Google's Chrome UX Report when a PageSpeed Insights key is configured, so these are real visitors rather than a simulation. |
| Accessibility | WCAG 2.1 Level AA | Automated conformance failures on the rendered page, counted by severity, alongside alt-text coverage. |
| Security | Known-vulnerability signatures | Vulnerabilities and misconfigurations matched against a continuously updated signature set. Read-only checks only, and nothing exploitative is ever run. |
| Transport security | TLS protocol, cipher & chain analysis | Protocol support, cipher strength, certificate chain and the well-known TLS weaknesses. |
| Dependencies | CVE / OSV | Published vulnerabilities affecting the client-side JavaScript libraries detected on the page. |
| SPF, DKIM, DMARC, BIMI | Published DNS policy records, and whether they are actually enforcing rather than merely present. | |
| Domain | RDAP / WHOIS | Domain age, registrar and expiry date, and an expiring domain is one of the most reliable neglect signals there is. |
| Structured data | Schema.org | Validity and coverage of the markup that decides how a business appears in search and answer engines. |
| Link integrity | Full-site crawl | Broken internal and external links across the crawled pages. |
| Rendering | Real browser execution | Full-page rendering, console errors, layout screenshots, and what the site actually looks like on a phone. |
Principles
Only public, first-party signals
Everything measured comes from the business's own website and its public DNS, TLS and registry records, or from a public listing. No data broker, no purchased list, and no source that requires logging in to a platform.
Fail soft, and say so
If a tool is missing, times out or errors, the audit records that in a tool-status map and carries on with the rest. A report never silently substitutes a guess for a measurement, and a missing check is shown as missing rather than as a pass.
Measured beats inferred
Findings carry a confidence label. A Core Web Vital read from real Chrome UX data is high confidence; a heuristic that infers a CMS from an asset path is not, and it is labelled that way on the report.
Efficient layered scanning
Every site gets a fast baseline scan. Deep browser and multi-signal passes run only against domains that respond, keeping scans fast and resource-efficient.
Rate-limited and identifiable
Audits are throttled, sequenced per host, and identify themselves in the user agent. The point is to measure a site, not to load-test it.