Methodology
How we decide CLEARED, HOLD, or DENIED.
Inspection Criteria
Every scan runs the following checks against your URL. Each finding is classified as a Blocker, Warning, or Pass based on its impact on your site going live.
HTTPS Encryption
Your site must serve over HTTPS. Plain HTTP exposes all visitor data to interception.
Strict-Transport-Security (HSTS)
HSTS tells browsers to always use HTTPS, preventing first-visit downgrade attacks.
X-Content-Type-Options
Prevents MIME-type sniffing that can lead to XSS via drive-by downloads.
Clickjacking Protection
X-Frame-Options or CSP frame-ancestors prevents your site from being embedded in malicious iframes.
Referrer-Policy
Controls how much URL information leaks to third-party sites via the Referer header.
robots.txt — Full Block
A blanket Disallow: / in robots.txt makes your entire site invisible to search engines.
XML Sitemap
A sitemap helps search engines discover all your pages. Missing sitemaps may cause incomplete indexing.
Noindex Meta Tag
A noindex tag explicitly tells search engines to remove your page from results. The silent killer of launched sites.
Page Title
Every page needs a descriptive title. Latin titles ideally 10–70 chars; short CJK brand names (e.g. 淘宝) are accepted.
H1 Heading
A visible H1 anchors the page topic for users and crawlers. Missing H1 is common on JS shells that forget semantic headings.
Meta Description
A meta description (50-160 chars) controls your search result snippet. Without it, engines auto-generate often irrelevant text.
Canonical URL
A canonical tag prevents duplicate content issues from URL variants (www/non-www, trailing slashes).
Open Graph Tags
og:title, og:description, and og:image control how your site appears when shared on social media.
Favicon
Recognizes rel=icon, apple-touch-icon(-precomposed), and a valid /favicon.ico (including CDN redirects).
Security Headers (merged)
HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy are reported as one finding and ranked below launch accidents.
Preview / Staging Domain Leak
Canonical, Open Graph, or sitemap pointing at *.vercel.app / *.netlify.app (or clearing a preview host as if it were production) sends crawlers and share cards to the wrong deploy.
Trust Pages
Privacy, Terms, and Contact links should exist on the homepage and resolve (not 404). Broken legal links kill trust on launch day.
Analytics
Detects GA4, Plausible, Vercel Analytics, Alibaba mmstat, Baidu Tongji, and other common snippets.
Placeholder Copy
Leftover lorem ipsum, TODO, yourdomain.com, or coming soon copy that makes the site look like a staging build.
Sitemap Quality
Detects missing sitemaps, soft-404 HTML error pages that return 200, empty <loc> lists, preview hosts inside sitemaps, and missing robots Sitemap: directives.
Severity Definitions
Will cause immediate, visible damage if you ship. Your site won't be found, won't be secure, or won't work as intended. Must fix before launch.
Won't break your launch, but will hurt SEO, security posture, or user experience. Should fix soon after launch.
Check passed. No action needed.
Clearance Decision
The clearance verdict has three stamps:
- ✓CLEARED (Ship It) — Zero blockers and zero warnings. Safe to launch.
- !HOLD (Fix Then Ship) — No blockers, but warnings remain. Fix the top priorities before you promote the launch.
- ✗DENIED (Don't Ship) — One or more blockers found. Do not go live until they are cleared.
The score (0-100) is calculated as: 100 - (blockers × 25) - (warnings × 5)