the free AEO + SEO readiness check We improve the scanner constantly — fixing checks, correcting mistakes and occasionally rebalancing how much a signal counts. Some of those changes move scores.
When a change could move a score, it is marked below. If your report shows a different number from last time and the change is listed here, some of that difference is us, not your site — and where we cannot tell the two apart, the report says so instead of guessing.
Score moved since your last scan? Rescan the page and compare it with the entry above.
46 changes, newest first
Our usage counts now include what gets clicked and tapped, how far down a page people scroll, how quickly pages load, and errors in our own page code, so we can find and fix the confusing parts faster. We still never record what you type or replay your visit, and the privacy page lists exactly what is collected.
Link to this entryWe now count how Bot Appétit gets used (scans run, site scans started and finished, sign-ups) with PostHog, on its European cloud, so we can see which parts earn their keep. The privacy page names it and says exactly what it receives and what it doesn't. It sets no cookie of ours and records no screens.
Link to this entryPick any two scans of a page, or two of your site scans, and see them side by side: both scores, every category's change and every check that moved. If our scoring changed in between, the change still shows, with a note that our scoring changed and a link to what we changed. If the pinned pages of a site changed between two site scans, we say their scores aren't compared instead of printing a number; each report still stands on its own.
Link to this entryUntil now only some of the checks had a page of their own. Every one does today, from the security basics to the agent and MCP readiness checks. Each page says what the check looks at and why a machine reading your page cares. The checks on your report link straight to their page, including the ones that sit outside your score, which now explain why they do. Nothing about how any check decides has changed.
Link to this entryShort guides at /help/ now answer the how-do-I questions in one place, from scanning a page and reading your report to scanning a whole site, sharing a scan, letting our scanner in and recovering from a scan that did not work. The Webflow SEO and AEO checklist has moved here from its old address, which now forwards to the new one. How it works, the FAQ and a page about who makes Bot Appétit have their own pages. The site also publishes llms.txt and llms-full.txt, built from the same pages, so an AI assistant can read all of this too.
Link to this entryIf your robots.txt disallows our scanner from some of the pages we sampled, the site scan report now says which pages and which rule matched. We still scan them and they still count; the report simply tells you that a machine honouring your rules would not have read them. This is a reporting change and it moves no score by itself, but our scoring version advanced with it, so a comparison across this date carries the usual note.
Link to this entryOur privacy page promised that deleting your account removes your details, and the deletion did not fully do that. It does now. When you delete your account, your email address, your sites, your pinned pages and your site scans are erased, along with the contact record we keep from sign-up. The results of page scans stay, because those belong to the page and not to you, and anyone who knows the address can scan it themselves.
Link to this entry/crawlers/ lists the AI crawlers our checks look for, with the company behind each one, what it is used for, what its maker says about robots.txt and the day we last read that page. You can filter by purpose and by robots.txt stance. It reads the same list the scanner uses, so the two cannot drift apart. The directory changes no score, but our scoring version advanced with it, so a comparison across this date carries the usual note.
Link to this entry/checks/ is now the front door to every check, with a hub for each course listing its checks and the words they use. A glossary at /glossary/ explains the terms in plain English, with a page each for the ones that deserve it, such as AEO, Web Bot Auth and schema.org. Performance has its own hub, written to say what we measure and nothing about where a page will rank.
Link to this entryYour sites is now a table with each site's score beside its history chart, and a site's own page opens with its score, what changed since the last scan, the shape of the site against its pages and every earlier scan. "What changed" shows the movement as bars, and a score that moved because our scoring changed says so. Sharing a scan now tells you what happened, and the person you share with never meets a sign-in wall. A homepage performance reading that is still being measured says "in progress" instead of "not recorded".
Link to this entryA page's report now draws its score history as a line, with the scan you are looking at beside the one before it. Every change in score is shown, small ones included, in the same chip on the report, in Your sites and on a site's page. When two scans were scored by different versions of our scoring, the chip still shows the number, says "our scoring changed" and links to this page. A report with no score now says "No score" and why, on every kind of report, and each error screen says whose side the failure was on.
Link to this entryThe header, footer and homepage were redesigned, and the scan box finally has a visible label. On the report, the verdict now leads on a band of its own with what to do next, and there is one score ring instead of two that looked alike. Results use the same four words everywhere, Pass, Worth a look, To fix and Couldn't judge, each with a symbol as well as a colour, so a status never rests on colour alone. "Rescan this page" rescans that one page. Everything that moves respects your reduced-motion setting, and the grey used for secondary text now passes AA contrast on our background.
Link to this entryYou can now pin pages to a site you track, from the site's page. Pinned pages are added to every later site scan and count towards the site score like any sampled page, so a checkout or a pricing page is never missed by the sample. The report marks the pinned pages, and history says when a score moved because the pins changed rather than the site. The signed-in scan form also lets you choose between a single page and a whole site.
Link to this entryA site scan is meant to measure your homepage's performance, and it was not doing so. It does now: when the scan finishes, the homepage's performance reading is added to its page scan and shown on the site's overview. A finished site scan also no longer waits for that reading before it tells you it is done. Other pages can still have a performance scan added from their own result, which runs a fresh scan of that page.
Link to this entryWhen a page answers that it is unavailable for legal reasons, such as a regional block or a court order, our report used to say bot protection had refused us and offered robots.txt lines that could not help. It now says the page is withheld for legal reasons, offers nothing to allow, and says the same applies to AI crawlers.
Link to this entryWhen a site scan stopped early, the summary said your firewall had begun blocking us, whatever had actually happened. A rate limit is now described as a rate limit, a page that asks you to sign in as a sign-in, and a paywall as a paywall, in the summary, the status and the page rows alike. Before, one report could describe the same event three different ways.
Link to this entrySome sites answer our scanner with a bot-check screen that looks like an ordinary page at a glance, with a title and a heading and nothing else. We were scoring that screen as if it were the site. It is now recognised as a wall, so the report says we were turned away and gives no score built from the wall.
Link to this entryPaste the link to a scan into a chat or a social post and it now previews as a card showing the score, the verdict, the page and the date. A scan with no score shows none, rather than a number we cannot stand behind. The card and the page title come from the same source, so they cannot disagree.
Link to this entrySome pages send almost nothing until JavaScript runs, so a crawler that reads only the first response sees an empty shell. A new check notices that, loads the page in a real browser and reports how much of your content only appears after scripts run. Where the browser cannot load the page the check says it could not judge rather than guessing. It works the same inside a site scan.
Link to this entryA site scan has a budget of pages it may read. Many scans stopped before spending it, even when the site had more pages worth sampling, so they covered less of the site than they could have. They now keep going until the budget is spent, which means a site scan can read more of your site than it used to and its score can differ from an earlier scan of the same site.
Link to this entrySome sites answer our scanner with a wall rather than a page — a firewall rule, bot protection, or a challenge screen — and until now a single-page scan just told you it happened. It now tells you what to do about it, and what to do depends on what actually stopped us: a refusal gets the two lines that allow our user agent and a note that an edge block happens before robots.txt is ever read; a rate limit gets "wait a few minutes", because we were slowed rather than refused; a page behind a login gets neither, because there is nothing to allow and that is itself the finding; and an address with nothing published at it is not treated as a block at all. Our bot page now carries the detail too, including the one case where a Cloudflare site cannot make an exception at all. Letting us in only lets us in — it changes nothing else about the report, and every finding in it still stands.
Link to this entryA site scan reads a sample of your pages rather than all of them, and groups pages built the same way so one finding can speak for the rest. Until today the report left a single page's score standing for its whole template — and when we measured that, it turned out to be too generous: on almost half the templates where we had read more than one page, those pages did not score the same, and on some sites the number you saw depended on which page we happened to pick. So the breakdown of your site now shows what the pages we actually read scored — the range, and where there are enough of them, the middle. Where the pages agreed, it says they agreed. Where your site has more templates than the breakdown can list, it says so and shows no ranges at all, rather than ones we cannot stand behind. Nothing about how we score changed, and no score moved.
Link to this entryOne number on your report was answering two different questions at once. "AI access" mixed whether AI can actually reach and read your pages — which is either true or it is not — with three optional extras you can declare for AI clients once they are in. A site whose access was completely fine could sit at three-quarters simply for not declaring the optional things, and a site that was genuinely turning automated visitors away could be propped up by declaring them. Neither reading was fair. From today they are two courses. "AI access" reports only whether AI can get in, so a good number there now means what it says. "AI signals" reports the things you tell AI clients — your crawler rules, your content-usage preferences, and the headers that point a machine at your sitemap. Every check we run is the same as it was yesterday, and every one of them still counts exactly as much toward your overall score, so that number has not moved. What moved is the two smaller numbers underneath it: most sites will see "AI access" rise, and sites that really were blocking automated visitors will see it fall to something closer to the truth. The advisory under your verdict is unchanged, and deliberately so — a missing optional extra is not a fault, so we do not call it one.
Link to this entryThree checks were reaching a verdict after looking in a single place, and all three could be wrong about a site that was doing the right thing. If you serve a clean, plain-text version of a page for AI assistants, we used to notice only if you offered it one particular way — so sites doing exactly what we recommend were told they were not. We now look both ways before saying it is absent. If your site tells us where your sitemap lives, we now follow that even when your address quietly redirects from the bare domain to the www one, and we still fall back to the usual location when what you published there does not lead anywhere. Between them those two things were the main reason a multi-page scan sometimes ended up following links from your homepage instead — a much shallower view of a site, because your navigation is not your content. When that does still happen we now say so on the report, and tell you that you can paste your sitemap's address straight into the scan box and run it again. Separately, when we judge whether AI crawlers can reach you, we now give less weight to turning away the fetchers whose own makers publish that our rule may not bind them — being blocked still gets said plainly, it simply counts for less toward "you cannot be cited" than blocking a crawler that genuinely obeys. In practice that changed no site's result today; it will matter for the sites where it would have been the wrong call.
Link to this entryA site score is built from the pages we sampled, and until today it was harsher than any of them. A check that was right on forty-nine pages and wrong on one counted the same as one that was wrong on forty-nine and right on one — so almost every site score sat below the score of every page beneath it, and some sites read a whole grade worse than the pages they were made of. That is now fixed: getting something right on most of your pages counts as getting it mostly right. The wording on each finding has not changed, and neither has the order of what to fix first — you will still see "passes on 41 of 50 pages" and know exactly where you stand. Alongside it, the files that belong to your whole site rather than to one page — your robots.txt, your sitemap and the rest — are no longer judged on an occasional request of ours that failed to land. We ask for them once per page we scan, and if a handful of those requests time out while the rest come back fine, we now go with what your site told us most of the time instead of with the worst answer we got. Site scores move up as a result, most of them by several points and some by considerably more. Individual page reports are untouched.
Link to this entryBot Appétit exists to answer one question: can a machine find, fetch, parse, trust and cite your page? Two changes bring the score closer to answering only that. Six checks that were never about it — things like the length of your title, whether an analytics tag is installed, and how well your images are compressed — no longer move your number. They are all worth getting right, so we still run them and still show you what we found; you will now find them grouped under "Good practice", apart from the checks that count. And in a site scan, pages you have explicitly told search engines to ignore are set aside rather than scored, because judging your site on them was measuring which pages we happened to sample rather than your site. The report says how many were set aside, and if every page we sampled turns out to be marked that way we keep them — at that point it is a fact about the site rather than an accident of our sampling. Most scores move by a point or not at all, and more go up than down. Individual page reports are unchanged: scan any URL directly and you still get its full result.
Link to this entryPerformance and the agent and MCP readiness checks are shown on your report but do not feed the headline, and until now they looked exactly like the categories that do, so fixing one and watching the score stay put made no sense. They are now labelled as measured but not counted. On a page's result, adding a performance reading runs a fresh scan of that page and adds a new line to its history, never a measurement attached to an older result. And the scans we run ourselves for testing no longer pad the public history of a page, so "scanned N times" counts real scans.
Link to this entryYour report history can now tell the difference between "your site changed" and "we changed how we measure". Older scans have been labelled retrospectively where we could establish it with certainty, and left unlabelled where we could not — we would rather say "we cannot tell" than guess.
Link to this entryWhen a page could not be read completely, some groups of checks never ran. Those groups were being shown as a red zero, which read as "you failed this" when the truth was "we could not look". They now show a dash, and say so. Overall scores are unaffected — the checks were already excluded from the maths.
Link to this entryOne technical check almost never found a real problem, so in practice every site was treated the same by it. We adjusted how much it counts, which moved most scores by a single point or not at all, and left a little more of the result resting on the answer-engine signals this tool exists to measure.
Link to this entryA site scan belongs to the account that ran it, and the list of pages in it stays private so a pasted list of unlisted addresses is never discoverable. The owner can now share the scan with a link. Whoever opens it sees the whole report without signing in, the link is not listed anywhere, and the owner can stop sharing at any time. The results of any single page stay public to anyone who knows its address, as they always were.
Link to this entryThis had been softened to a warning, which contradicted our published standard. We do not lower a bar because most sites do not clear it.
Link to this entrySeveral links can lead to one page. When they did, that page could be counted several times in a site's score. It is now counted once, however many URLs reach it.
Link to this entryIf your firewall turns us away, we can only see a handful of things — not enough to judge a site on. Rather than publishing a number built from fragments, we now publish none, and explain what happened and how to let us in.
Link to this entryYou can now create an account and scan a whole site rather than a single page. A site scan reads a sample of your pages in the background, so it can take a few minutes, and the results are tied to your account. Your sites lists every site you have scanned, with a page for each site that keeps its history. Scanning a single page still needs no account.
Link to this entryEach scan now has a link of its own that opens the report exactly as it was, without scanning again. A report also shows the history of the page it is about, whoever scanned it and whenever, with the change in score and a link into each earlier report. The link previews as a card for that scan, and the performance shown on an old report is the performance recorded at the time, not today's.
Link to this entry/bot/ documents our scanner for the people who see it in their logs: what it requests, how often and why. Our requests are now cryptographically signed with Web Bot Auth, the same way the big AI crawlers are, so a site's bot protection can verify them instead of guessing. Sites that turned us away on every address because they could not tell us apart from an impostor now have a way to recognise us.
Link to this entryA site that explicitly told the major AI crawlers to stay out could still score a top verdict, because its pages were well structured, which is exactly what a crawler never gets to see. Optimisation behind a locked door is not a degree of readiness, it is the absence of it, so a block on AI crawlers now holds the verdict down however well the rest of the page is built.
Link to this entryThe AI crawlers we look for now include the newer search and assistant crawlers from Anthropic, Perplexity, Mistral and DuckDuckGo, each confirmed against its maker's own documentation. Page weight and render-blocking resources are now taken from PageSpeed Insights and Lighthouse rather than estimated. The MCP server card check accepts all three ways the specification has described publishing one, and a check for agent registration, auth.md, was added earlier in the week. Checks that nothing displayed or measured were removed from the list.
Link to this entryA site could be strong at the things that matter least to this tool and score a green verdict while being weak at the one it exists to measure. The number stays honest, but the verdict is a promise, so it can no longer be better than your AI-readiness. When one course is much weaker than the rest, the report also says so under the verdict, so a good total cannot hide it.
Link to this entryWe added a check for a favicon, one for a meta refresh used as a redirect, one for a published security.txt contact file and one for breadcrumb structured data on inner pages, which is not expected on a homepage and so is not asked of it. A caching-headers check was added the same day. We considered a compression check and rejected it, because from where our scanner sits we cannot see it reliably, and a check we cannot trust is worse than none.
Link to this entryWhen a firewall or a bot-protection challenge stopped our scanner, we used to end on an error screen. A site that refuses an honest scanner usually refuses the AI crawlers that decide whether you are cited, so that refusal is the finding. The report now says the site is up but turned us away, shows the checks that read the site's published files, and leaves out the checks that need a real page. A banner at the top says so plainly. Unreachable sites and server errors are still errors.
Link to this entryThe scanner now samples the links on your page for broken and redirecting ones, checks the address against Google Safe Browsing, whether your content is in the HTML rather than built later, whether you have a useful 404 page, how you canonicalise your address, your language and character set, and whether your site serves a clean markdown version to machines. A new group, agent and MCP readiness, covers the emerging ways a site can tell an AI agent how to talk to it, such as OAuth and OpenID Connect discovery. It appears on your report as its own score and stays out of the headline, so a standard that few sites offer yet does not mark every site down.
Link to this entryReports now include a performance panel built on Google PageSpeed Insights. It shows the Core Web Vitals measured on real visitors where Google has enough of them, and a lab estimate where it does not, and keeps the two clearly apart. Performance arrives separately from the rest of the report, so a slow reading never holds up the findings, and while it is measuring the panel says so. A reading that does not come back in time says exactly that, which is not the same as a failure. It has its own score and does not feed the headline.
Link to this entryThe results page now shows your page's JSON-LD in a panel you can copy from, labels exactly which address was scanned, and links each category card to its breakdown. While a scan runs, a loader shows real progress. A page we could not reach gets its own error screen with a way to retry. You can book a call with us from the end of any report.
Link to this entryPaste a page's address and the scanner tells you whether a machine can find, fetch, read, trust and cite it. The first release checks security, SEO, structured data, answer-engine readiness, AI access and links, and turns what it finds into a score, a verdict and a list of what to look at, each finding explained in plain English. Scanning a single page needs no account.
Link to this entryWe do not publish the exact weights or thresholds behind a check — that calibration is the part that took hundreds of real sites to get right. What we will always tell you is that something changed, and whether it could have moved your number.