How we score readiness. Evidence first.

isitready.dev turns public website signals into a readable report: what was observed, what was inferred, what was unavailable, and which production fixes should happen first.

  • Public evidence only
  • Weighted priority fixes
  • Coverage shown in every report
01

Collect public evidence

Normalize the URL, block unsafe targets, then fetch the homepage, markdown variant, robots.txt, same-origin sitemap data, and representative public pages.

02

Classify each signal

Every result is labelled observed, heuristic, or unavailable so a report never pretends private, missing, or ownership-gated data was measured.

03

Score by impact

Scoreable checks use configured weights. Unavailable checks stay visible, while failing high-weight checks become the priority queue.

Evidence model

Every signal gets a confidence class.

Reports separate direct evidence from reasonable inference and unavailable data so teams can trust what the score is actually saying.

Observed

Direct public HTTP fetches, response headers, parsed metadata, DNS records, well-known resources, and configured third-party API responses.

Heuristic

Representative crawl checks, duplicate detection, policy interpretation, and public product beacons that indicate likely readiness.

Unavailable

Private, credentialed, ownership-gated, rate-limited, or missing external data is shown explicitly and excluded from weighted score math.

Scoring

Weighted scores, explicit gaps, no mystery math.

Checks produce a 0-100 score, status, weight, evidence, remediation, and resource links. The report then calculates category scores, readiness level, and the highest-weight failures.

  • Category scores are weighted averages of scoreable checks in that category.
  • The overall score is the weighted average of all scoreable checks across the report.
  • Unavailable checks remain visible but do not lower the score.
  • Priority fixes list failing checks from highest weight to lowest.
85-100Level 4

Trusted

70-84Level 3

Production-Hardened

50-69Level 2

Bot-Aware

0-49Level 1

Foundational

What we use

The evidence set behind the report.

These are the public inputs and enrichment sources used across the five readiness categories.

HTTP and HTML

Homepage responses, sampled pages, headers, status codes, redirect behavior, titles, meta descriptions, canonicals, heading hierarchy, indexability directives, social metadata, JSON-LD, hreflang, internal links, image metadata, sitemap consistency, and content fingerprints.

Agent surfaces

robots.txt, sitemap discovery, Link headers, markdown negotiation, API catalogs, OAuth metadata, MCP cards, A2A agent cards, Agent Skills, WebMCP, and commerce discovery.

Performance data

PageSpeed Insights mobile Lighthouse performance and CrUX p75 LCP, INP, and CLS field metrics when those public data sources are available.

Security posture

HTTPS, HSTS, X-Content-Type-Options, Content-Security-Policy, AI bot policy, Content Signals, Web Bot Auth, and MDN HTTP Observatory output.

Cloudflare and DNS

Cloudflare edge headers, cache and challenge markers, trace fields, product beacons, DNS service signals, DNSSEC, HTTPS/SVCB, CAA, MX, and TXT records.

Operational hygiene

Discovery Link headers, sampled page status hygiene, duplicate titles, crawl coverage mode, and public evidence for machine-readable production quality.

What we evaluate

The five categories behind every report.

Each category has its own focus, but every check follows the same evidence-first scoring model.

02

Technical SEO

Crawlability, canonical integrity, structured metadata, and indexability signals.

Whether crawlers and search engines receive stable, indexable, canonical public pages.

Checks use adaptive page sampling to inspect titles, meta descriptions, canonicals, heading hierarchy, indexability directives, internal links, image accessibility, hreflang, sitemap consistency, structured data, and content depth.

Boundaries

What the score means, and what it does not.

A high score means the public surface exposes strong readiness signals. It does not prove private backend quality, internal incident response, paid analytics, or authenticated product flows.

No private access

The scanner does not log in, bypass paywalls, solve ownership gates, or use private analytics. It grades public production evidence.

Bounded crawl

Discovery uses the homepage, robots.txt, up to three sitemap candidates, nested sitemap indexes, and homepage internal links before selecting the scan sample.

External data may be absent

PSI, CrUX, Observatory, trace, and DNS enrichment can be unavailable because of API access, rate limits, target coverage, or upstream errors.

Evidence over guesses

When a signal cannot be proven from the public surface, the report records that state instead of filling the gap with invented certainty.

Read the report like an operator

Start with coverage. Then fix the highest-weight failures.

Confirm whether the crawl was sampled or exhaustive, inspect unavailable enrichments, then work through priority fixes from highest weight to lowest.