Skip to content

Changelog

What changed, newest first. Checks are added a few at a time; each one gets a guide.

  1. Page size, requests and load events in the speed results

    • The Speed module shows what GTmetrix and Pingdom lead with: the page size, the number of requests, and when the page was ready, loaded and fully loaded, with the weight split by type of file and by domain.
    • The waterfall lists every request: the first 30, the rest one click away.

  2. Rich results like Google shows them

    • The schema validator, and the Structured data module of every report, group your structured data by rich result the way Google’s Rich Results Test does: Product snippets, Merchant listings, Breadcrumbs, Article and more, each item valid or invalid, with critical and non-critical issues and every property it carries.
    • Microdata is checked as well as JSON-LD, and retired rich results such as FAQ say when Google stopped showing them.

  3. A clearer web hosting speed test

    • Time to first byte measured three ways (real visitors, our test, Lighthouse), each rated on its own, with the reason they differ and which cache answered the request.
    • Real visitors’ time to first byte now counts in the tool scores: a slow real-user first byte can no longer sit next to a score of 100.

  4. Live progress while a report runs

    • A running report shows the time so far, a moving ring per module and what is happening, and the grade waits until every module is in. The page now always switches to the finished report by itself.
    • Technology detection reads the page’s code, not its words: a page that writes about WooCommerce or WP Rocket no longer shows them as installed.

  5. Three tools that ask an AI assistant

    • The AI brand mention checker asks Claude, with live web search, the question your customers ask and shows whether the answer names your brand, cites your site, and which sites it cites instead.
    • The AI citation checker turns a page title into the question the page should answer and shows whether Claude cites the page for it.
    • The answer-first rewriter turns a paragraph into a direct answer of 60 words or less, using only your facts, and throws away any rewrite with a link to another site or an instruction to the reader.
    • Answers are shared for a week and capped by a daily budget, so the tools stay free. ChatGPT and Perplexity join once their terms are checked.

  6. Passage quotability checker

    • Paste text or Markdown and see which passages an AI assistant is likely to quote: each passage scored 0 to 100 on position, answer form, question heading, specific facts, standing on its own, readability and a date, with the reason and what to change. Runs in your browser; your text is never uploaded.

  7. AI referral tracking for GA4

    • Tick the AI assistants to count (ChatGPT, Perplexity, Gemini, Copilot, Claude, You.com, Meta AI) and copy a GA4 channel group regex, an Exploration filter and two Looker Studio formulas, with where to paste each. Runs in your browser.

  8. robots.txt AI rules generator

    • Allow or block 13 AI bots and tokens, each with its purpose and the trade-off explained, from three presets. Paste your current robots.txt to see which AI bots it already blocks, then copy the rules. Runs in your browser.

  9. Cloudflare AI bot settings

    • Say what you want from AI bots and which Cloudflare features are on, and get the settings to change step by step, with dashboard paths and WAF rule expressions to copy, checked against Cloudflare’s docs on 8 October 2026.

  10. AI bot IP verifier, NAP consistency and Wikidata checkers

    • The bot IP verifier tells you whether an address is really GPTBot, ClaudeBot, PerplexityBot, Googlebot or another crawler: it checks the IP lists the operators publish, and the reverse DNS check where Google, Bing and Apple document one, and shows the matching range as proof.
    • The NAP consistency checker reads your home, about and contact pages, your Organization schema and your Wikidata item, and compares name, address, phone, founding year, logo and profiles field by field, with a plain fix for every difference.
    • The Wikidata checker finds the item for your site or organisation name, shows its facts, Wikipedia articles and identifiers, lists what is missing, and explains Wikidata’s notability policy when there is no item.

  11. Image alt text checker

    • A new checker lists every image on a page with the alt text it has now, flags the ones that are missing, empty inside a link, a file name, too long or repeated, drafts a replacement for each from the caption, the link or the file name, and downloads the list as CSV. The accessibility scan of the full report runs alongside it.

  12. Favicon and app icon checker

    • A new checker fetches every icon your page declares, the manifest icons and /favicon.ico, measures them, and shows what a browser tab, a Google result and an iPhone home screen would display. It names the sizes still missing: 48 pixels for Google, 180 for iOS, 192 and 512 in the manifest, an SVG for sharp tabs.

  13. A UTM link builder and a share link generator

    • UTM link builder: campaign links with channel presets (Google Ads, Facebook ads, Instagram, LinkedIn, X, newsletter, partner, print, ChatGPT), the naming rules GA4 needs applied and explained, one link at a time or a pasted table with CSV export. Runs in your browser.
    • Share link generator: prefilled share links for X, LinkedIn, Facebook, WhatsApp, Telegram, Reddit, Pinterest and email, and an accessible snippet of share buttons that loads no script and sets no cookie. Runs in your browser.

  14. Social previews for every platform, and an Open Graph tag generator

    • The social preview checker (the former link preview checker) now draws one card per platform: Facebook and LinkedIn, X, Slack and Discord, and WhatsApp, each built with the tags and fallbacks that app uses. It says which tag each part came from, when X would show a plain link, and when an image is too small, too heavy or served over http.
    • New: an Open Graph and social tag generator. Fill in a short form, watch the four cards change as you type, and copy the og: and twitter: meta tags for your page. Runs in your browser; nothing is uploaded.
    • Every report lists whether the apps can build a preview card from the page at all (an informational check that does not change scores).

  15. Tools grouped by topic, with a filter and a page per category

    • The tools are now in six topic groups: Speed, SEO and crawling, Social and sharing, Security, privacy and accessibility, AI visibility, and WordPress. SEO and Speed are split into subgroups, so the hreflang checker sits next to the hreflang generator.
    • Tools that run on your computer carry a "Runs on your computer" pill instead of living in a separate group. Nothing you type or drop into them is uploaded.
    • /tools filters as you type, by category, by type (checkers, generators, bulk tools, monitors) and by where a tool runs, with the counts following. The filter also works without JavaScript and the address bar keeps it, so a filtered list can be shared.
    • Every category has its own page, such as /tools/seo or /tools/social, with its tools, the guides that teach them and a link from the menu.
    • Five social and sharing tools are announced and marked Soon: an Open Graph and social tag generator, a UTM link builder, an image alt text checker, a share link generator and a favicon and app icon checker. Each goes live with its own update.

  16. GitHub Action and a score card for your site

    • The getReport GitHub Action runs a checkup from your workflow and fails the build when the overall score or a module you choose drops below your minimum. The job summary links to the full report. It needs a free API key and is at github.com/getreport/action.
    • Embed your latest scores on your own site: a small card with your grade and every module, linking to the report. It loads no script and sets no cookie. The API page has the code.

  17. Sponsors on the funding page

    • Companies that sponsor getReport can appear with their logo on the funding page and in the site footer.

  18. Crawl results: 17 site-wide checks, and a page for every domain

    • A sitemap generator crawl now reports what it found: broken internal links, server errors, redirect chains and loops, duplicate titles and descriptions, near-duplicate text, orphan pages, deep and thin pages, canonical chains, language versions that do not link back, and the largest and slowest pages. Download the pages as CSV or JSON.
    • The crawl reads your sitemap too, and compares it with what links reach.
    • /site/{domain} lists a site’s reports and crawls, with ownership and the score badge. Links to single reports and crawls show only to the verified owner.

  19. Verify you own your site, without an email

    • Prove you control a site by adding a DNS record, a meta tag or a small file, then click Check now. No email and no account: the record itself is the proof, and it lasts 12 months.
    • Verified owners can let search engines index their report pages, and site crawls go up to 500 pages instead of 100. Every report links to the verify page.

  20. Google Analytics, only if you accept

    • A banner asks once whether Google Analytics may count visits. Reject and Accept are equal, nothing from Google loads before you choose, and Cookie settings in the footer changes your answer.
    • Google never gets the sites you check or anything you type: our code removes addresses and report titles from every request before it leaves your browser. Privacy explains what is sent.

  21. Donations through Ko-fi

    • Donations go through Ko-fi, once or monthly, by card or PayPal without a Ko-fi account.
    • The funding page, report footer and menus say which features are on and what donations switch on next.
    • Learn and guide pages load straight from the server without being rebuilt on each visit.

  22. Hosting speed check: your host against its peers

    • Hosting speed check: who serves your site (host, network, CDN) and how fast its server sends the first byte, next to the median of other sites we checked on the same host.
    • The host comparison is anonymous: every night we compute percentiles from the latest check of each site, store no site names, and show a number only once a host has 50 different sites. Reports on WordPress and other sites now include it in the speed section.

  23. Tech stack checker with known vulnerabilities

    • Tech stack & vulnerabilities: the CMS, frameworks, libraries, analytics, consent platform, CDN and server behind any page, with versions and the evidence for each.
    • Every JavaScript library with a readable version (jQuery, Bootstrap, Lodash, Moment.js, AngularJS and more) is matched against OSV.dev, the open vulnerability database. Each advisory shows its CVE, severity and the version that fixes it, and every report now flags vulnerable libraries.

  24. Compare your speed with competitors, and PageSpeed for 50 URLs at once

    • Competitor speed comparison: your site and up to four others side by side, on the PageSpeed score, real-visitor Core Web Vitals, LCP, TBT, CLS, server response, page weight and requests, with the best site in every row marked. Each column links to its full report.
    • Bulk PageSpeed checker: up to 50 URLs a day through Google PageSpeed Insights, mobile or desktop, with lab metrics, Chrome UX Report data and the biggest fix per page, sortable, filterable and as CSV.

  25. Three headless tools: JavaScript SEO, unused code, responsive screens and a CSP generator

    • JS rendering check: the HTML your server sends next to the page after JavaScript runs, field by field. It flags text, links and structured data that only exist after scripts run, and a canonical or noindex that JavaScript changes.
    • Unused CSS and JavaScript: Chromium code coverage for every script and stylesheet, with the unused share per file and third parties marked, next to the savings Google estimates.
    • Responsive check and CSP generator: screenshots at 360, 414, 768, 1024 and 1440 px, the element that makes a page scroll sideways, tiny text and small tap targets, and a Content-Security-Policy built from what the page actually loaded, inline scripts hashed.
    • Every report now includes these measurements: two new SEO checks for JavaScript rendering and a best-practices check for sideways scrolling.

  26. Thirty more guides: platforms, previews, trust signals and the 200 mark

    • Platforms: Cloudflare settings, Netlify and Vercel headers, Nginx and Apache configurations for an A grade, Caddy, Joomla and Drupal basics, Magento performance.
    • Social and structured data: Facebook App ID, debugging a cached preview, previews for PDF and file links, og:title, description and type; validating schema without Google's tools, schema for multilingual sites, structured navigation for large sites.
    • Accessibility and workflows: accessibility statements, the European Accessibility Act, alt text decisions; measuring before and after a redesign, picking which fixes to do first, a quarterly SEO review template.
    • Best practices and security: custom 404 pages, privacy policy and contact links, a cookie banner that passes, GA4 and Tag Manager cost, console errors and deprecated APIs, HTML validation errors, Safe Browsing flags, certificate chain errors, Lighthouse score vs Core Web Vitals, internal links that redirect. 206 guides in total.

  27. Thirty more guides: WordPress hosting and caching, hacked sites, speed, technical SEO

    • WordPress: LiteSpeed Cache and WP Rocket settings for Core Web Vitals, security headers without a plugin, choosing a host by measured TTFB, page builders vs Gutenberg, multilingual WordPress with WPML and Polylang, the WordPress migration checklist, staging with host tools and plugins.
    • Security: recovering a hacked WordPress site, the Japanese keyword hack, pharma and casino spam injections, Subresource Integrity, rate limiting and bot protection, backups that actually restore.
    • Speed: image CDNs, service workers and offline pages, system fonts vs web fonts, Core Web Vitals for news sites, speed budgets in CI.
    • Technical SEO and workflows: crawl budget for small sites, subfolder vs subdomain vs ccTLD, cross-domain canonicals, tracking parameters and canonicals, "Discovered - currently not indexed", Search Console vs getReport.
    • Accessibility and structured data: accessible tables, accessible modals and dialogs, motion and prefers-reduced-motion, Event schema, Recipe schema. 176 guides in total.

  28. Thirty more guides: platforms, WordPress settings, workflows and technical SEO

    • Titles and descriptions: page titles that rank and get clicked; meta description length, wording and Google rewrites.
    • WordPress: the Yoast SEO and Rank Math settings we recommend, Elementor and Divi performance settings, WooCommerce product schema, image optimisation plugins compared, WP-Cron and scheduled tasks.
    • Platforms: what you can and cannot fix on Shopify, Wix, Squarespace and Webflow; headers and caching for static sites (Hugo, Astro, Next.js).
    • Workflows: a monthly site health routine, an agency workflow with one report per client per month, writing a ticket a developer can act on, explaining a score to a client, staging sites without getting them indexed.
    • Speed and technical SEO: critical CSS in 2026, video on landing pages, Core Web Vitals for e-commerce, reading a waterfall chart and a filmstrip, orphan pages, redirect chains after a migration, 404 vs 410 vs redirect, the site migration checklist, faceted navigation, soft 404s. 146 guides in total.

  29. Thirty more guides: security, accessibility, structured data, social and WordPress

    • Security: Referrer-Policy, Permissions-Policy, Server and X-Powered-By headers, CORS wildcards, certificate expiry, TLS 1.0/1.1, security.txt, directory listings and exposed files, outdated CMS versions, WordPress security without a plugin.
    • Accessibility: link and button names, landmarks and skip links, focus order and keyboard traps, zoom and viewport, target size, language attributes.
    • Structured data and social: Article and BlogPosting, FAQ and HowTo after Google's changes, LocalBusiness, BreadcrumbList, duplicate entities; Twitter/X cards, og:url and canonical, previews in WhatsApp, Slack, LinkedIn and iMessage, generating OG images.
    • WordPress: duplicate SEO plugins, two caching plugins, abandoned and closed plugins, WooCommerce cart fragments and cart/checkout caching. 116 guides in total.

  30. Thirty more guides

    • Speed: web fonts without layout shift, WebP and AVIF, srcset and sizes, third-party scripts, DOM size, long tasks, resource hints, Speed Index and FCP, field vs lab data, mobile vs desktop scores, CDN basics, server response time on shared hosting.
    • Technical SEO: trailing slashes and www, URL structure, internal links, nofollow and sponsored, image alt text, thin content, duplicate titles, favicons, breadcrumbs, pagination, AMP, JavaScript-rendered content, hreflang in sitemaps and x-default, sitemap index files and lastmod, robots.txt patterns; plus the framing and nosniff headers.
    • Every guide has a screenshot from a real run of the tool it explains; code samples in guides are now keyboard-scrollable.

  31. Server log analyser, WordPress fix recipes and the page-builder check

    • Server log analyser: drop an Apache, Nginx, IIS or JSON access log (gzipped too) and see every bot, its hits per day, the URLs and 404s it fetches, how much of Googlebot's crawl went to redirects and parameter URLs, which AI crawlers read your content, and whether the Googlebot in your log is real. The file is processed in your browser and never uploaded; only the addresses you ask to verify go to our server.
    • WordPress fix recipes: when a report detects WP Rocket, LiteSpeed Cache, W3 Total Cache, Autoptimize, Yoast SEO, Rank Math, Elementor or WooCommerce, the findings show the exact screens and settings to change in that plugin, with the version the steps were verified on.
    • Page-builder weight: how much of a page's code and markup comes from Elementor, Divi, WPBakery, Bricks, Oxygen or Beaver Builder, and which of the builder's performance settings to switch on.
    • One more guide: your server logs, decoded.

  32. Core Web Vitals history and bulk URL checker

    • Core Web Vitals history: 40 weeks of real Chrome-user data for any site Google publishes it for, one chart per metric (LCP, INP, CLS, FCP, TTFB) against the good / needs-improvement / poor bands, the share of good visits, phone or desktop, whole site or one page, and the numbers as a table.
    • Bulk URL checker: paste up to 1,000 URLs and get the status after redirects, the final URL, the redirect chain and its type, time to first byte, content type, title, canonical and noindex for every one, with filters, a permanent run link and a CSV download. Private addresses are skipped by the safety guard; at most four requests at a time per host.
    • Two more guides: reading 40 weeks of Core Web Vitals history, and bulk URL checking for migrations.

  33. Cookie & consent scanner and WooCommerce checker

    • Cookie & consent scanner: every report now records the cookies and trackers a first-time visitor gets before touching the banner, clicks the banner's accept button (18 consent platforms, 20 languages) and records what changed. Four new checks: trackers before consent, cookies before consent, a reject option on the first layer, cookie lifetimes over 13 months.
    • WooCommerce checker: cart fragments on non-cart pages, a cart or checkout served from a page cache, Product schema without price, availability or rating, and out-of-stock products left indexable.
    • Two more guides: cookies before consent, and the WooCommerce checklist.

  34. AI crawler check and hacked site checker

    • AI crawler readiness check: which of 18 AI user agents (GPTBot, ClaudeBot, PerplexityBot, Google-Extended and more) your robots.txt allows, grouped by purpose; whether you have an llms.txt and if it follows the llmstxt.org format; noai and TDM opt-out signals.
    • Hacked site checker: the page is fetched as a visitor, as Googlebot and as a visitor from Google, and the copies are compared. Injected text, pharma and casino links, hidden links, foreign-script keyword spam and Google-only redirects are reported with evidence. Four new security checks run on every report.
    • Seven more guides, including the pre-launch checklist and the indexability checklist.

  35. Guides

    • A new Guides section: long-form, screenshot-backed guides that go beyond the /learn pages, with copy-paste configs for nginx, Apache, Caddy, Cloudflare and WordPress. The first 42 cover Core Web Vitals, technical SEO, security headers, accessibility, structured data, social previews and the WordPress rookie mistakes.
    • Every tool page lists its guides and every guide ends with the form, so a guide is never a dead end. Guides are written in Markdown with tool and check cards generated from the check catalogue, so their advice cannot drift from what the report says.

  36. WordPress Doctor (wave 1)

    • Reports of WordPress sites get a WordPress Doctor panel: detected theme, builder and plugins, the rookie-mistakes scan ("you made 4 of 8"), the cost of every plugin on the page, duplicate SEO, cache and schema plugins, and abandoned or closed plugins from the wordpress.org directory.
    • "Send to my developer": a fixes-only view of any report with a Markdown checklist and a Trello/Jira CSV export.
    • Two WordPress tools: health check and plugin detector.

  37. Six more tools (wave 2a)

    • Canonical checker, hreflang checker with return-link verification, XML sitemap validator with sampled status checks, HTTP/2 and HTTP/3 test, broken link checker (150 links, internal and external) and image size checker (100 images with real dimensions).
    • Nine new checks behind them: sitemap validity, sampled sitemap URLs, page in sitemap, hreflang return links and reachability, redirecting links, HTTP/2 negotiation, HTTP/3, heavy, oversized, unsized and broken images.

  38. Launch pack (M4)

    • Funding page with the unlock ladder and the supporters wall.
    • Donate page, thank-you page with a supporter badge.
    • Honest comparisons with GTmetrix, Pingdom, Semrush, SEOptimer and WebPageTest.
    • About, privacy, terms, crawler and status pages; this changelog.
    • Cookie-free analytics (Plausible, loaded only when configured); a nonce-based Content-Security-Policy.
    • Production images, one-command deploy, nightly backups, retention job.

  39. Exports, guides and tools (M3)

    • PDF export, OG image and score badge for every report.
    • Module tabs on desktop, accordion on mobile, deep links to modules and findings.
    • History strip when a domain has earlier reports; feedback thumbs stored.
    • Every passing check now reads as a goal met, not a failure.
    • 99 learn guides generated from the check catalogue; twelve single-purpose tools.
    • The Dial: new logo, favicons and social covers.

  40. Speed and rendering (M2)

    • Google PageSpeed Insights and Chrome UX Report field data, with a local Lighthouse fallback.
    • Chromium rendering: screenshot, console errors, request waterfall, axe-core accessibility scan, tech detection.
    • All seven modules live: speed, SEO, security, accessibility, structured data, social, best practices.

  41. First reports (M1)

    • Fetch pipeline behind the SSRF guard, 81 HTML checks, scoring and the live report page.
    • Report cache (12 hours), rate limits and Turnstile.

  42. Skeleton (M0)

    • Monorepo, design tokens, fixtures with 20 deliberately broken pages, CI.