Free technical SEO checker
80 checks across indexability, Core Web Vitals, TLS, structured data, email DNS and AI-crawler directives — each with what it is, why it matters in 2026, and exactly where to change it on WordPress, Shopify, Wix/Squarespace, headless or raw HTML. No signup, no email, no card. No invented Google penalties: metrics Google calls meaningless stay informational and unscored.
One URL per audit · ~30–60 seconds · 10 audits per day while in beta · no sign-up · free PDF and shareable link with every report
Auditing
0%80 checks, ten categories, one honest score
Every check carries a severity weight (high 3 / medium 2 / low 1). The score is 100 × (1 − Σ(failed + ½·warnings) / Σ applicable). Informational, unavailable and errored checks are excluded from both sides. That is the honest arithmetic over what we could judge — but it would also let a data source we could not reach raise your number by deleting the checks it would have failed. So every report carries a coverage figure alongside the score: the share of scoring weight that actually produced a verdict. Below 80% the report says partial on its face, in the page, in the PDF and in the API.
Title, description, canonical, heading order, Open Graph and Twitter cards, language, favicon, document basics.
robots.txt through Protego, a parser built to Google's published robots.txt specification, sitemap validity and protocol limits, host canonicalisation, redirect chains, real vs soft 404.
TTFB, HTML weight, compression and minification measured directly; LCP / INP / CLS from Google PageSpeed Insights, scored on real-user CrUX data where Chrome has it.
Full TLS chain and expiry, active vs passive mixed content, HSTS, the four core security headers, HTTP/2 negotiated and HTTP/3 advertised.
Viewport, responsive CSS, tap-target size, and the frame Lighthouse actually rendered on an emulated phone.
JSON-LD parse validity, duplicate entity graphs, and honest annotations — FAQ rich results are gone, so we do not sell them back to you. Schema is not required either: we only flag its absence when the page's own content is a type Google actually renders a rich result for.
Broken outgoing targets (sampled live), anchor-text quality, protocol consistency, rel/target hygiene.
SPF, DKIM across 19 probed selectors, DMARC policy strength, BIMI, MTA-STS and domain age. Reported in full, scored at zero — these are mail deliverability facts, not search signals.
AI-crawler directives, llms.txt accuracy, content extractability without JavaScript, provenance signals.
Domain authority and referring domains from the Common Crawl web graph — informational, never scored against you.
Every check ships with the full guide: what it is, why it matters in 2026, copy-pastable code, the menu path on WordPress / Shopify / Wix / headless, and the common causes with their fixes.
Checks nobody else runs
Most free SEO checkers converge on the same twenty on-page items. These five are where 2026 actually broke, and we surveyed nine tools that skip them.
Your domain's brand-trust surface lives in DNS, and it is where spoofing gets stopped. We resolve SPF, probe 19 DKIM selectors (they are not discoverable, so they must be brute-forced), read the DMARC policy strength rather than its mere existence, and check BIMI and MTA-STS. Of the nine tools we surveyed, one checked SPF and none checked the rest.
Blocking GPTBot opts you out of model training. Blocking OAI-SearchBot stops OpenAI fetching your pages for ChatGPT Search — OpenAI says a URL and title can still surface from other sources, so what you lose is the substance of the citation. Opposite business decisions, one robots.txt line apart: we report them separately instead of counting "AI bots blocked" as a single number, and we cover each vendor's user-fetch bot separately too — Anthropic's ClaudeBot, Claude-SearchBot and Claude-User, and OpenAI's ChatGPT-User and OAI-AdsBot.
Interaction to Next Paint has no lab equivalent: Lighthouse never interacts with the page. Without real-user field data we report n/a and exclude it from the score on both sides, rather than substituting a proxy metric and calling it INP. Where Chrome has CrUX data for your exact URL, we score that and say so — where it only has origin-wide data, we show it as context and score nothing.
We fetch /llms.txt, confirm it is really served as markdown rather than as your 404 page, and report its size, heading and link count. What we do not yet do is fetch every URL it lists or diff it against robots.txt — when we add that, this card will say so. The check stays informational either way, because no AI vendor has committed to reading the file.
If your server sends an empty shell and JavaScript builds the page, most checkers either read the shell and report nonsense ("no H1 on the page") or quietly skip it. We detect it, and for those pages only we re-read the URL through a real headless browser and report both documents side by side: which title, description and canonical exist before the bundle runs, which headings and structured data appear only after it, and how the link and image counts differ. Content checks are then measured on the rendered document and say so on their face. We do not render every page — a server-rendered site never needs it, and never costs a browser — and if the daily rendering budget is spent those checks honestly report n/a instead of guessing. Client-side rendering stays a warning either way: Googlebot renders on a second, budgeted pass, and the AI crawlers and every social preview scraper read only what your server sent.
The questions worth answering
Is it really free?
Yes. Every audit, the full fix guidance, the PDF and the shareable report link are free — no account, no email, no card. The only limit is 10 audits per day per IP, which exists to keep the queue moving and to stay polite to the sites being audited. PureRank earns its money from a different product, the AI Spam Score scanner, not from this one.
What exactly gets checked?
80 checks in ten categories: meta and on-page (17), indexability and crawlability (12), performance and Core Web Vitals (17), security and server (9), mobile (4), structured data (5), links (4), email DNS (6), AI-era readiness (4) and authority (2). Core Web Vitals come from Google PageSpeed Insights — real-user CrUX data where Chrome has it, otherwise a throttled lab run that is clearly labelled as one. Everything else is measured directly from your URL, robots.txt, sitemap, TLS handshake and DNS records.
How is this different from every other free checker?
Five things almost nobody else runs: email-DNS trust records (SPF, DKIM across 19 probed selectors, DMARC, BIMI, MTA-STS); the AI-crawler distinction between opting out of training and deleting yourself from AI search; INP reported as n/a when no field data exists instead of a substituted lab proxy; llms.txt checked for accuracy rather than presence; and, for JavaScript-built pages, a side-by-side comparison of the HTML your server sends against the document a real browser ends up with. Plus a rule we hold ourselves to: no invented Google penalties. Multiple H1s are a consistency issue, not a penalty. FAQ rich results are gone, so we do not sell them back to you. Structured data is not required, so its absence is an opportunity we point out, not a score we take off.
My site is a React/Vue single-page app. Will the report be nonsense?
No. We detect that the HTML your server sends carries no content, and for those pages we re-read the URL through a real headless browser and measure the content checks on the rendered document — each result says which document it came from. You also get the served-versus-rendered comparison: what only exists after JavaScript runs, and who sees which version. We do not render every page (a server-rendered site does not need it), and if the daily rendering budget is spent the content checks report n/a rather than guessing. Client-side rendering still shows up as a warning, because reading your page ourselves does not change the fact that Googlebot renders on a delayed, budgeted second pass while AI crawlers and preview scrapers do not render at all.
Why won't it audit google.com?
Because the number would be meaningless. A global brand's homepage is hand-tuned by a team that deliberately leaves out things general best practice recommends — google.com ships no meta description and no structured data on purpose — so grading it against general best practice measures our rules, not the page. We politely decline for a curated list of major brands, exactly as our AI Spam Score scanner does, and nothing is stored. Your own site is what this tool is calibrated for.
Do you need my email?
No. There is no signup form, no email gate on the PDF, no newsletter and no drip sequence. Paste a URL, read the report, download the PDF, send the link to your developer.
Is the score a Google ranking prediction?
No — and no tool claiming otherwise can back it up. It is a weighted diagnostic of technical hygiene: 100 × (1 − Σ(failed + ½·warnings) / Σ applicable). Informational, unavailable and errored checks are excluded from both sides. Because that alone would let an unreachable data source inflate the number, every report also states its coverage — how much of the scoring weight actually answered — and is labelled partial below 80%. Email and DNS checks are reported but carry zero weight: a domain that sends no mail is not worse at SEO for it.
Technical hygiene is half the picture. A site can pass all 80 checks here and still read as mass-produced — which is the failure mode Google's June 2026 update made expensive. Same domain, different scanner: run an AI Spam Score scan →