Audit Live Snapshot
avstudio.ai · composite audit
—
0/100
—
Score of this run on the 0-100 scale
avstudio operating thresholds
TU · —
0 · min
50
100 · max
—
The 40, 70 and 90 thresholds are set by avstudio for this audit and match the grade cuts on the score card. They are not a market distribution and they do not say where this site stands against others: this audit measures only the domain you asked for. The external sources queried during the run are named inside each card, next to the figure they produced.
0/100
Composite score
Score aggregated from the public checks.
Rule of thumb: below 70 there are gaps that customers, search engines and technical audits can see.
limits of the free version →
01Security and reliability
The technical holes that expose the site to attacks, phishing and ranking penalties. Close these first.
Google Web Risk · Malware and phishing
Threat-list matches for public URLs
Checks Google lists for malware, phishing and unwanted software on the home page and final redirect URL. Shows checked URLs and dates: no matches does not certify the security of the entire site.
Check the public Google report
DMARC · Email anti-spoofing
Protection against brand impersonation
Checks whether a DMARC policy exists on the domain. Without DMARC an attacker can send email that appears to come from
the domain analysed. A real CEO fraud and business email compromise risk.
Open the public source
Email stack · SPF + MX + MTA-STS + BIMI
Deliverability + email provider
Full email stack lookup beyond DMARC: SPF (lookup count, 10-DNS rule), MX provider identification (Google Workspace, Microsoft 365, Aruba, Register and so on), MTA-STS policy, TLS-RPT reporting, BIMI brand indicator. For firms and established companies, email spoofing is business-critical.
Open MXToolbox
DNSSEC · Signed validation
DNS cyber posture
Checks whether the domain publishes
DS and DNSKEY records. DNSSEC does not replace HTTPS or DMARC, but it lowers the risk of DNS resolution tampering and it does come up in structured cyber assessments.
Open the public source
Security advanced · HSTS preload + security.txt + CAA + IPv6
Public hardening
Checks public technical signals: the HSTS header and preload-list status,
/.well-known/security.txt, CAA DNS records and IPv6 AAAA presence. Useful hardening, but on their own they are not full security nor compliance.
Check HSTS preload
Mozilla Observatory · Security Headers
HTTP security score
An audit of the public security headers: HSTS, CSP, X-Frame-Options, Referrer-Policy, X-Content-Type-Options and the other MDN checks. The A-F grade shows how mature the HTTP configuration is, not a full vulnerability assessment.
Data: MDN HTTP Observatory v2
Open the public source
TLS Posture · Encryption status
HTTPS configuration of the site
Checks HTTPS reachability, certificate acceptance by the TLS fetch and HSTS duration on the analysed host. Does not check cipher suites, all TLS versions or the complete chain. For an official SSL Labs grade, open the link below manually.
Data: avstudio Worker · cross-check SSL Labs
Open the public source
02GEO · Generative Engine Optimization
How ready the site is to be read, extracted and quoted by search engines and AI systems, with no promise of actual citations.
Schema.org · Rich Results
Structured markup of the site
Checks the JSON-LD on the homepage: brand identity through Organization/WebSite/BreadcrumbList, plus contextual schemas such as LocalBusiness, Product/Offer or FAQPage only where the page really has a location, a catalogue or FAQs.
Data: avstudio in-house parser · cross-check Google Rich Results
Open the public source
Schema quality · JSON-LD + required properties
Quality of the structured markup
Goes deeper into the JSON-LD blocks already found: parse validity, use of
@id, completeness of Organization, BreadcrumbList, FAQPage and LocalBusiness, and the properties Google requires for rich results. It is a technical signal, not a guarantee of a rich result.Data: avstudio shared JSON-LD parser · ref. Google structured data
Open the Schema Markup Validator
Public sitemap
Indexed URL catalogue
Shows the full site structure exposed to Google and to AI systems: page count, languages covered, content freshness.
Data: Direct fetch of sitemap.xml
Open the public source
Indexability · Canonical + Robots
Indexability: status, canonical, noindex
Checks the final URL after redirects, the redirect chain, meta robots, the X-Robots-Tag header, the canonical (self-referencing or external), robots.txt presence and the sitemap directive. A noindex homepage or a wrong canonical makes the site disappear from Google: a critical SEO risk.
Data: avstudio Worker · ref. Google Search Central Robots Meta
Open Search Console
SEO on-page · Title + Meta + Headings
SEO fundamentals of the page
Checks the on-page signals readable from the HTML: title, meta description, H1/H2/H3, image alt text, body text, internal and external links, social meta. The title and meta thresholds are heuristics for search snippets, not absolute ranking rules.
Data: avstudio HTML parser · ref. Google title + snippet docs
Open PageSpeed Insights
Technical SEO · canonical + freshness + images
Technical signals for crawlers
Groups the static signals that help crawlers and AI engines: canonical, slug, heading hierarchy, freshness
dateModified, image alt text and explicit dimensions where readable. Public technical heuristics, not absolute ranking rules.Data: avstudio HTML parser + indexability
Open URL
Local SEO · site + Google Maps
Site, locations and Google listing
Checks whether the site states its local presence well: schema.org LocalBusiness/AutoDealer or Organization with addresses and contacts, phone and WhatsApp links, maps, booking and reviews. It does not read or certify the Google Business Profile listing: it measures only the public signals on the site that help Google and AI connect brand, locations and contacts.
Search on Google
Conversion + Automation signals
Lead capture + automation opportunities
Spots forms, newsletter platforms (Mailchimp/Brevo/Substack), CRM pixels (HubSpot/Salesforce/Drift), e-commerce platforms (Shopify/WooCommerce/Magento), live chat (Intercom/Tawk/Tidio), payments (Stripe/PayPal/Klarna/Satispay) and booking. It suggests practical opportunities on the flows it finds, without pushing any particular tool.
Data: avstudio parser HTML
Explore avstudio automations
Legal pages · Privacy + Cookie + Accessibility + T&C
Coverage of the usual legal pages
Checks whether privacy, cookie policy, accessibility, terms and contact pages are online at the usual Italian and English paths. It does not establish legal obligations nor whether the EAA or the GDPR apply: it reports technical presence or absence only.
Check /privacy
SERP · Brand presence
Top 5 results for the brand
The first 5 search results when someone looks up the brand: title, URL and snippet. Source: DuckDuckGo HTML (Google offers no free SERP API).
Data: DuckDuckGo HTML
Open the public source
llms.txt + ai-robots · AI bot policy
Visibility to LLMs and AI bots
Checks the presence and the minimum quality of the
/llms.txt file plus the policy in robots.txt for GPTBot, ClaudeBot, PerplexityBot, Google-Extended and CCBot. It is a public technical signal for AI crawlers: it guarantees no citation, no ranking and no use by the models.Data: Fetch
Open the public source
/llms.txt + /robots.txtHreflang · Multilingual
Language tags and geo-targeting
Checks the
<link rel="alternate" hreflang="..."> tags for multilingual sites. Google uses them to serve the right version per country and language. Self-reference and x-default are recommended.Data: avstudio HTML parser · cross-check Google docs hreflang
Open the public source
Open Graph + Twitter Cards · Share preview
Social preview and AI citability
Checks the
og:* (Facebook, LinkedIn, WhatsApp) and twitter:* metadata (X, Slack). Perplexity, ChatGPT browsing and Claude use them too, to render citation cards. Minimum set for AI search: og:title + og:description + og:image + og:url + og:type + twitter:card.Data: avstudio HTML parser · cross-check OpenGraph.xyz
Open the public source
Gulpease index · Italian readability
Text readability for AI search
A readability index designed for Italian by Lucisano and Piemontese (Università La Sapienza, 1988). Scale 0-100: ≥80 = easy (primary school), 60-79 = medium (middle school), 40-59 = hard (high school), <40 = very hard (degree level). AI search prefers clear, quotable content: 60-80 is the B2B/B2C target.
Data: avstudio HTML parser · Gulpease index
Open the public source
AEO Entity · brand profile
Does AI understand who you are?
Rebuilds a deterministic business profile from public signals: title/H1/meta, Schema.org Organization/LocalBusiness/Service, sameAs, contacts, About page and legal details. It does not call ChatGPT: it measures whether an answer engine has enough context to describe the brand.
Data: avstudio HTML parser + legal-aeo-pack · heuristic check, no model calls
Open URL
AEO Extractability · answer-first
Answers an AI can extract
Checks whether the page holds blocks that are easy to quote: a clear opening paragraph, question-shaped headings, real FAQs, lists and tables, short sentences and server-rendered content. It does not observe whether an answer engine quoted or ignored the site: it measures only how quotable the text is.
Data: avstudio HTML parser · deterministic AEO heuristics
Open URL
AEO sources · verifiable evidence
Quotable, verifiable content
Measures the signals that make a site reusable as a source: figures, dates, authors, authoritative outbound links, pricing/case/comparison pages, reviews, trust pages and schema. av audit free shows the basic signals; av audit PRO checks the advanced ones.
Data: avstudio HTML parser + sitemap/legal pages · heuristic check
Open URL
AI sees this · extraction preview
What an AI crawler sees
Shows the summary profile that can be pulled from the initial HTML: title, H1, meta description, visible text and the SPA/JS-only risk. It is not “what ChatGPT says”: it is what a crawler can read without rendering the page.
Data: avstudio raw HTML extraction · no AI generation
Open URL
03Performance and infrastructure
Response speed, page weight and modern protocols: signals that shape user experience, conversion and how technically solid the site feels.
PageSpeed Insights · Core Web Vitals
Google mobile performance
A mobile PageSpeed Insights snapshot: Lighthouse measures LCP, TBT and CLS in the lab; CrUX can add field data such as INP when available. A variable technical signal, not a ranking guarantee.
Data: Google PageSpeed Insights API · Lighthouse mobile + CrUX where available
Open the public source
PageSpeed Insights · Page weight + resources
How heavy the site is · what visitors download
Total bytes transferred, number of requests and the Lighthouse breakdown by images, scripts, CSS, fonts and other resources. The quick wins are savings estimated by Google, not a full measurement of the backend.
Open the public source
Performance opportunities · JS/CSS + cache + terze parti
Priority Lighthouse opportunities
Pulls the public quick wins out of Lighthouse: unused JS/CSS, render-blocking resources, cache policy, third-party impact and image opportunities. It does not measure the backend, the logged-in area or the full runtime: it shows where to start.
Data: Google PageSpeed Insights API · Lighthouse audits
Open the public source
Edge profile · TTFB + protocollo + CDN
Server response and modern protocols
Single-shot TTFB measured by the Worker, compression of the HTML response and the CDN inferred from vendor headers. HTTP/3 is reported only when reliable headers announce it; when the Worker cannot verify it, we say so.
Data: avstudio Worker · single-shot Cloudflare edge
Open the public source
04Italian and EU legal compliance
Technical signals tied to Italian and European requirements: AI Act art. 50, the Italian DPA cookie guidelines of June 2021, visible company details and accessibility. It does not replace a legal audit.
AI Act art. 50 · Chatbot disclosure
AI chatbot: disclosure to check
Reg. EU 2024/1689 (AI Act) art. 50: where an AI system interacts with people, its artificial nature must be made clear before or during the interaction. The free version only spots signals in the public code and cannot confirm whether a web chat is AI or a human.
Data: avstudio HTML parser · ref. Reg. UE 2024/1689
Open the public source
Cookies · Italian DPA guidelines 06/2021
HTTP cookies and Italian DPA signals
Checks the cookies readable in the first HTTP response and flags non-technical tracking set before consent. The Italian DPA guidelines of 10 June 2021 require free, revocable consent for profiling cookies and non-essential tools. The free version does not replace a full CMP audit.
Data: avstudio Worker · ref. Italian DPA guidelines 10/06/2021
Open the public source
Italian company details · P.IVA + REA + PEC + VIES
Company details on show
Checks the Italian company details visible on the page or in the legal areas: VAT number, REA/company register entry, registered office and certified contacts. Where a VAT number is found, it is checked live against VIES. Certified email and e-invoicing codes are useful contact and billing signals, but whether to publish them is a question for your lawyer.
Open the public source
WCAG 2.2 AA · Basic public checks
Accessibility quick signals
A quick pre-screen of the WCAG 2.2 AA signals readable from the HTML: image alt text ≥95% (1.1.1), a valid lang attribute (3.1.1), a single H1 (1.3.1), heading order h1→h2→h3 (1.3.1), focus-visible not removed (2.4.7), buttons with an aria or text label (4.1.2), form inputs with a bound label (1.3.1). It is different from browser-rendered Lighthouse Accessibility and it does not replace a formal assessment. Who is covered and what is at stake: website accessibility audit.
Open the public source
IAB TCF v2.2 · Consent Framework
EU advertising compliance
Checks for the IAB Transparency & Consent Framework v2.2. It matters if the site monetises programmatic ad inventory or uses vendors that require a TC string. For corporate sites, professional firms and SaaS without programmatic advertising it may simply not apply.
Data: avstudio HTML parser · ref. IAB Europe TCF v2.2
Open the public source
Google Consent Mode v2 · GA4/Ads
Google Consent Mode signals
Checks the public signals of Google Consent Mode v2. For EEA/UK/CH traffic with Google Ads, remarketing or personalisation, Google requires parameters such as
ad_user_data and ad_personalization. The free version reports technical presence, it does not validate consent.Data: avstudio HTML parser · ref. Google Consent Mode v2
Open the public source
05Competitive exposure
What competitors, recruiters and attackers can find out about your infrastructure in public, without asking.
Certificate Transparency · log pubblici
History of public certificates
The global public log of every SSL certificate issued for the domain. It shows the history of certificate authorities, the subdomains issued and any orphaned or expired certificates.
Data: public Certificate Transparency logs · RFC 6962 · the source that answered is named in the result
Open the public source
Wappalyzer · Tech Stack Detection
Visible site technologies
Identifies the CMS, frameworks, CDN, analytics and libraries the site uses. Standard competitive intelligence: anyone can see it.
Data: avstudio in-house HTML/headers parser · cross-check Wappalyzer
Open the public source
DNS Map · Exposed subdomains
Map of the public DNS infrastructure
Subdomains, MX records, name servers and cloud dependencies that are public. A combination of Cloudflare DNS and Certificate Transparency logs.
Open the public source
06Reputation and heritage
How much history, authority and solidity the domain conveys to buyers doing due diligence and to generative AI systems.
WHOIS · Registrar e ownership
Legal transparency of the domain
Shows the registrar, registration date, expiry date and owner (unless hidden behind a privacy proxy). It points to the solidity of the digital brand and to the risk of letting the domain lapse.
Data: rdap.org · RFC 9082-9083
Open the public source
Wayback Machine · Brand heritage
Archived history of the domain
Shows every snapshot of the site archived by archive.org since the first crawl. The timeline is public: buyers and generative AI have full access to the brand's history.
Open the public source
Heritage score · Public signals
Heritage and authority of the domain
A proprietary score, not Moz Domain Authority. It combines verifiable public signals: domain age from RDAP, historical certificates, the first Wayback snapshot and the subdomains exposed. Estimated traffic needs third-party sources such as SimilarWeb or Search Console.
Data: RDAP + public Certificate Transparency logs + Wayback + public DNS · cross-check Tranco or SimilarWeb
Open the public source
Trust & freshness · About + contatti + date
Public trust and freshness
Checks the public signals of trustworthiness: an About or team page, contacts, sameAs/social profiles, legal details or a trust page, named authors and a last-updated date. A technical indicator of clarity, not a full reputation assessment.
Data: avstudio HTML + JSON-LD parser + legal pages
Open URL
Carbon estimate · SWDM v3
Climate footprint of the site
An estimate of the grams of CO₂ per visit based on page weight, the Sustainable Web Design Model v3 and green hosting verified by The Green Web Foundation. An environmental estimate, not a direct measurement of emissions.
Open the public source
07What this check did not look at
The checks above read the homepage. These three questions mean opening the other pages of the site and reading their text: they live in av audit PRO. We leave them here in the open so you know what you are not seeing.
av audit PRO · Privacy notice
Does the notice actually answer?
Not "a privacy page exists", which is what we measure above: whether that text names the data controller, the legal bases, the retention periods, the rights of the data subject and the channel to exercise them. Every item gets a verdict and the sentence from your site that justifies it.
Verdict in av audit PRO
Method: reading the page itself, not the link that points to it
av audit PRO · Scope of the documents
Which documents are really missing
Privacy, cookies, terms of sale, withdrawal and returns, contacts, accessibility statement: which ones exist, which are only an index pointing elsewhere, and which are absent. What is actually required depends on the kind of site and on what you do with it: where an item does not apply to your case we say so, instead of counting it as a gap.
Verdict in av audit PRO
Method: recognising the role of each page, with a second pass
av audit PRO · Coverage of the site
The whole site, not the shop window
Up to 31 pages of the same domain, the home page plus 30, one per template family, chosen the way someone who knows your CMS would choose them: one product page stands for all product pages. Up to 15 of them we open with a real browser, so with JavaScript executed, exactly as a visitor sees them.
Verdict in av audit PRO
Method: grouping by URL shape + a real browser
av audit PRO on this domain
The result is a document listing the findings, the sentence from your site that proves each one and the legal reference where there is one. We read it through by hand before delivery: what you receive has already passed under a person's eyes.
What changes with av audit PRO
€149 one-off · delivered within 1 business day
08What the free diagnosis leaves out
The metrics above are public, verifiable and equally visible to competitors, buyers and due diligence tools. The point of the free version is to show them straight away, with no login and without asking for sensitive data.
see what av audit PRO adds →
Optional · an operational report, priorities and a roadmap when the free version is not enough
The snapshot above is free and verifiable. The most significant problems will appear below once the audit ends, taken straight from the checks run on your domain and linked back to the cards above.
- Waiting Run the audit to see your 5 most serious problems, ordered by severity (from critical to important) and each one verifiable on its card above.
Try another domain
Run the same diagnosis on another site without reloading the page. The new result replaces the one above.
optional · after the free diagnosis
The free version shows the signals. av audit PRO turns them into a plan of work.
When you need to go beyond the public snapshot, av audit PRO adds advanced checks, a real browser where needed, priorities by severity and a roadmap of work. This stage is not recurring monitoring.
- A full report with findings ordered by severity.
- Operating instructions tied to the stack detected.
- Delivered within 1 business day, with a permalink and a readable summary.