Coverage
The whole engine, with the cover off.
Most tools ask you to trust the score. Here's everything behind ours — every data source we connect to, how often we scan and watch, each individual check we run, and exactly how our crawler touches your site. Nothing marked live that isn't.
Integrations
Every external source we pull from or query. We show them Live, Beta or Planned— because a coverage page that hides what isn't finished isn't coverage, it's marketing.
Cadences
How often a full scan runs by plan — and the automated jobs that run around the clock, whether you're logged in or not.
| Scout | Six-pillar welcome scan, then five-pillar recurring Recurring monthly |
| Starter | Full six-pillar Weekly + continuous monitoring |
| Pro | Full six-pillar Weekly + continuous monitoring |
| Agency | Full six-pillar Weekly + continuous monitoring |
| Recurring-audit scheduler (picks up every site that's due) | every 2 min |
| Accessibility drift monitor (re-drives your critical flows) | every 30 min |
| Security & lifecycle drift monitor | every 30 min |
| Search Console traffic ingest | daily |
| SSL & domain-expiry sweep | daily |
| Vulnerable-component (CVE) catalog refresh | weekly |
| AI-citation sweep across the answer engines | monthly |
| Consolidated alert digest (one email, deduplicated) | hourly |
Every check we run between scans
An audit is a photograph. Between scans, these run on their own cadence, compare against the last reading, and alert you only on a regression — never noise for the sake of a notification.
Accessibility (ADA) drift
every ~3 days
- Keyboard-drive your cart, checkout, login, search and contact flowsalert: a new or worse keyboard trap / critical or serious violation appears
Security posture
daily
- HSTS headeralert: present → absent
- Content-Security-Policy headeralert: present → absent
- X-Frame-Options headeralert: present → absent
- X-Content-Type-Options (nosniff) headeralert: present → absent
- HTTPS / certificate validityalert: valid → broken
- TLS protocol versionalert: downgraded (e.g. 1.3 → 1.2 → 1.1)
- SPF email policyalert: weakened or removed
- DMARC email policyalert: weakened (reject → quarantine → none → off)
Certificate transparency & DNS
daily · takeover scan weekly
- New certificate issuer for your domainalert: a cert appears from a CA you don't use
- New hostname in the CT logsalert: an unexpected subdomain is certified
- Subdomain-takeover scan (17 hosted services)alert: a subdomain points at a dead service an attacker could claim
Vulnerable components (CVE)
on every scan · catalog refreshed weekly
- Every fingerprinted JS library, WordPress plugin & theme, version-matched against the CVE catalogalert: a loaded component has a known vulnerability
Lifecycle
daily
- SSL certificate expiryalert: 10 / 5 / 2 days out
- Domain registration (WHOIS) expiryalert: 30 / 14 / 7 days out
AI visibility
monthly
- Brand-level citation count across the answer enginesalert: you drop out of answers you used to win
When several of these move in the same window, we group them into a single incident — one deploy, one root cause, not three separate fires.
How we touch your site
Every point of contact, in the open. Nothing hidden, nothing intrusive.
Our crawler
SEOLZ-Bot/1.0 crawls from one fixed IP (3.12.80.13), obeys robots.txt, caps itself at 8 requests per domain, never submits a form or logs in, and stops at 500 pages. Its full identity and WAF-allowlist recipes live on our public /bot page.
A real browser
We render your pages in headless Chromium — the same engine your visitors use — so we see what actually paints, run accessibility checks against the real DOM, and drive interactions like a keyboard user.
Six pillar scanners
SEO structure · AEO answer-engine schema · WCAG accessibility · OWASP security · GEO AI-visibility · Lifecycle freshness — one pass, scored as one whole.
The answer engines, on your behalf
We ask Perplexity, ChatGPT, Gemini and Brave about your brand and topics. We store only the metadata — whether you were cited and where — never the answer text.
Report rendering
Your exports are rendered by the same Chromium that renders your dashboard, so a PDF or interactive HTML report never drifts from what you see on screen.
Re-test access
After you allowlist SEOLZ-Bot, one polite request confirms we can reach you again — no crawl, no cost.
Getting a 0-page scan because a firewall blocked our bot? Our /bot page has the exact allowlist rule for your WAF.
Now you know exactly what you're getting.
Point it at your site and see the whole surface scored in one pass — free.
Scan your site free →Automated technical signals — not a determination of legal or regulatory compliance.