Collect public evidence
Normalize the URL, block unsafe targets, then fetch the homepage, markdown variant, robots.txt, same-origin sitemap data, and representative public pages.
isitready.dev turns public website signals into a readable report: what was observed, what was inferred, what was unavailable, and which production fixes should happen first.
Normalize the URL, block unsafe targets, then fetch the homepage, markdown variant, robots.txt, same-origin sitemap data, and representative public pages.
Every result is labelled observed, heuristic, or unavailable so a report never pretends private, missing, or ownership-gated data was measured.
Scoreable checks use configured weights. Unavailable checks stay visible, while failing high-weight checks become the priority queue.
Evidence model
Reports separate direct evidence from reasonable inference and unavailable data so teams can trust what the score is actually saying.
Direct public HTTP fetches, response headers, parsed metadata, DNS records, well-known resources, and configured third-party API responses.
Representative crawl checks, duplicate detection, policy interpretation, and public product beacons that indicate likely readiness.
Private, credentialed, ownership-gated, rate-limited, or missing external data is shown explicitly and excluded from weighted score math.
Scoring
Checks produce a 0-100 score, status, weight, evidence, remediation, and resource links. The report then calculates category scores, readiness level, and the highest-weight failures.
Trusted
Production-Hardened
Bot-Aware
Foundational
What we use
These are the public inputs and enrichment sources used across the five readiness categories.
Homepage responses, sampled pages, headers, status codes, redirect behavior, titles, meta descriptions, canonicals, heading hierarchy, indexability directives, social metadata, JSON-LD, hreflang, internal links, image metadata, sitemap consistency, and content fingerprints.
robots.txt, sitemap discovery, Link headers, markdown negotiation, API catalogs, OAuth metadata, MCP cards, A2A agent cards, Agent Skills, WebMCP, and commerce discovery.
PageSpeed Insights mobile Lighthouse performance and CrUX p75 LCP, INP, and CLS field metrics when those public data sources are available.
HTTPS, HSTS, X-Content-Type-Options, Content-Security-Policy, AI bot policy, Content Signals, Web Bot Auth, and MDN HTTP Observatory output.
Cloudflare edge headers, cache and challenge markers, trace fields, product beacons, DNS service signals, DNSSEC, HTTPS/SVCB, CAA, MX, and TXT records.
Discovery Link headers, sampled page status hygiene, duplicate titles, crawl coverage mode, and public evidence for machine-readable production quality.
What we evaluate
Each category has its own focus, but every check follows the same evidence-first scoring model.
Content discoverability, markdown signals, agent protocols, and machine-readable readiness.
Whether agents can discover, understand, and safely use public machine-readable surfaces.
Checks probe robots.txt, markdown negotiation, API discovery, OAuth metadata, MCP or A2A signals, agent skills, WebMCP, and commerce discovery.Crawlability, canonical integrity, structured metadata, and indexability signals.
Whether crawlers and search engines receive stable, indexable, canonical public pages.
Checks use adaptive page sampling to inspect titles, meta descriptions, canonicals, heading hierarchy, indexability directives, internal links, image accessibility, hreflang, sitemap consistency, structured data, and content depth.HTTPS posture, response headers, cookies, and externally validated transport safeguards.
Whether public transport and policy signals reduce avoidable browser, crawler, and agent risk.
Checks combine direct header inspection with trusted public security tooling when available.Page speed, loading quality, and public lab or field performance evidence.
Whether users and agents receive fast, stable pages backed by lab, field, and cache evidence.
Checks use PageSpeed Insights and CrUX-style signals when available, without inventing private metrics.Reliability, metadata consistency, broken signals, and operational polish on the public web.
Whether the public site looks consistently deployable, discoverable, and operationally tidy.
Checks focus on production-facing best practices, broken public signals, consistency, and crawl-surface quality.Boundaries
A high score means the public surface exposes strong readiness signals. It does not prove private backend quality, internal incident response, paid analytics, or authenticated product flows.
The scanner does not log in, bypass paywalls, solve ownership gates, or use private analytics. It grades public production evidence.
Discovery uses the homepage, robots.txt, up to three sitemap candidates, nested sitemap indexes, and homepage internal links before selecting the scan sample.
PSI, CrUX, Observatory, trace, and DNS enrichment can be unavailable because of API access, rate limits, target coverage, or upstream errors.
When a signal cannot be proven from the public surface, the report records that state instead of filling the gap with invented certainty.
Read the report like an operator
Confirm whether the crawl was sampled or exhaustive, inspect unavailable enrichments, then work through priority fixes from highest weight to lowest.