Auditaar
Audit my website

Sample25 pages200+ checksAugust 22, 2026ran 8 min

northwind.dev

Needs work. Northwind scores 64 overall, a D grade, and the pattern is consistent: the technical and brand foundations are strong while the content layer that AI engines actually read is largely absent. The site is well known and well built, but it is not currently structured to be cited by AI search.

65

A-Score /100

Needs work

Fix next

In the plan's order, with the work that unblocks the rest scheduled first.

Six pillars

Always in this order. Open one for its checks and evidence.

Investigation notes

One agent per pillar added 44 evidence notes. Scoring stays deterministic: the agents add evidence, never a point of the A-Score.

AI Visibility

  • All named AI crawlers are allowed in robots.txtThe aiCrawler probe returned blockedSearchBots 0 and blockedTrainingBots 0, with GPTBot, ClaudeBot, PerplexityBot, Google-Extended, Applebot, Meta-ExternalAgent, Amazonbot, Bytespider and CCBot all listed as allowed. The only disallow rule is /api/* under User-agent: *, which does not touch content pages.
  • No llms.txt or llms-full.txt publishedThe aiCrawler probe returned llmsTxtFound false and llmsFullTxtFound false. The wellKnown catch-all test answers 404 for invented paths at both depths, so a 200 here would be a real file, meaning these are genuinely absent.
  • No sitemap declared in robots.txtThe aiCrawler probe returned sitemapDeclared false, so crawlers get no machine-readable index of the site's pages from robots.txt.
  • HTML text is readable without JavaScriptThe aiCrawler probe returned a jsDependency verdict of low, with 6581 bodyTextChars against 1818 scriptBytes, so AI crawlers can read the page without running JavaScript.
  • Answer readiness scored 3 across 25 pagesThe AEO probe returned score 3 with pagesChecked 25. The note's supporting counts (questionHeadings 0, comparisonTables 0, answerFirstPages 2, faqPages 1, no entity definition) are not present in the DATA shown.

Findability

  • Non-branded search drives most of the site's trafficThe demand probe splits 426,104 estimated monthly visits into 294,595 non-branded and 131,509 branded. Non-branded traffic carries an estimated value of $736,541 against $241,274 for branded.
  • Rankings cluster on page one, few on page twoOf 300 sampled keywords, 118 rank in positions 1-3 and 167 in positions 4-10. Only 14 sit in positions 11-20 and 1 in 21-50, so there is little page-two inventory to promote.
  • Keyword gap against three icon competitors is largeThe gap probe found 245,236 keywords the site does not rank for that glyphharbor.io, pictoset.io and markvault.co do. Individually that is 92,113 for glyphharbor.io, 79,420 for pictoset.io and 73,703 for markvault.co.
  • 172 gap keywords qualified, worth $219,988Of 600 gap keywords examined, 172 qualified after filtering, with a total opportunity value of $219,988. The largest single concentration is the term 'tm icon' at 26 percent share and $56,430.
  • One gap term carries inflated volumeThe probe flags 'pipeline symbols' as the worst volume inflation, reported at 12,100 against a median of 1,600.
  • Referring domains are shrinking despite new linksThe backlink history shows 40,904 new referring domains against 34,731 lost over the 12 months to 2026-08, a net flow of 6,173. The stock still fell from 130,326 to 127,415 domains, a change of -2,911.
  • Net referring-domain flow fell versus the prior yearThe prior 12-month window gained 37,439 and lost 22,519 referring domains, a net flow of 14,920. The current window's net flow of 6,173 is less than half that, and the worst month lost 7,223 domains.
  • 5,076 broken backlinks point at the siteThe backlink probe counts 5,076 broken backlinks among 11,763,865 total backlinks from 128,650 referring domains. The dofollow share is 0.97.

Conversion

  • Homepage value proposition reads as missingThe conversion probe returned valuePropClarity of missing across the 25 pages checked, so no clear value proposition was detected on the pages it read.
  • 69 CTAs across 25 pages, no phone or email visibleThe probe counted 69 CTAs and 0 pages without a CTA, so calls to action are plentiful. It also returned phoneVisible false and emailVisible false, so no phone number or email address was detected on the pages checked.
  • 21 forms found, no contact pageThe probe found 21 forms but contactPageFound false, so no contact page was detected. With no contact page and no visible phone or email, a pre-sale question has no obvious route in the pages checked.
  • Zero social proof signals on the pages checkedThe probe returned socialProofSignals of 0 and trustBadges of 0 across the 25 pages, so no social proof or trust badges were detected on the pages it read.
  • No live chat detectedliveChatDetected returned false, so no real-time chat channel was detected on the pages checked. With no contact page and no visible phone or email, the form is the only conversion path the probe found.
  • Pricing page exists, so the offer is reachablepricingPageFound returned true, so a pricing page was detected and a visitor can reach a price. The gap is not a missing price, it is the missing reason and proof around it.
  • Own paid search presence is not measurableThe paid media probe returned ownPaidKeywordsInIndex 0 and ownPaidSampled 0, with ownPlacements and ownLandingPages both empty. No ad-to-landing message match could be scored, so nothing can be said about whether ad copy matches the pages it points to.
  • Ad message match was not measuredadMessageMatch returned measured false with 10 ads having their destination withheld by the library. The probe states this is not measured rather than scored, so no claim about ad promise versus landing page can be made.

Experience

  • Real mobile LCP is 8,010 msChrome UX Report field data over a 28-day window shows LCP of 8,010 ms for real visitors, against a 2,500 ms good threshold.
  • Real mobile INP is 562 msField INP is 562 ms, against a 200 ms good threshold, so taps and clicks feel laggy for real users.
  • Real mobile CLS is 0.28Field CLS is 0.28, nearly three times the 0.1 good threshold, so the page visibly shifts as it loads.
  • Field FCP 7,550 ms and TTFB 1,313 msReal visitors see first contentful paint at 7,550 ms after a 1,313 ms server response.
  • Lab performance score 28/100 on the homepageOne throttled load of the homepage on a simulated mid-tier phone scored 28/100 with lab LCP of 30,527 ms and TBT of 1,806 ms.
  • LCP element is a modal paragraphThe largest contentful element is a paragraph inside the Icon Wizard 2.0 announcement modal, selector div.modal > article.icon-wizard-contest-announcement-modal-content > div.text-left > p.text-center.
  • Page weight 14,021,327 bytes over 129 requestsThe homepage transferred 14,021,327 bytes across 129 requests, with first-party Northwind CDN at 10,193,981 bytes and third parties at 3,827,346 bytes.
  • Third parties are 27.3% of attributed bytes32 third-party requests account for 3,827,346 bytes, 27.3% of attributed bytes, against 97 first-party requests.

Trust

  • No Content Security Policy is sentThe probe reports the CSP as absent, with 0 enforced and 0 report-only policies, so the browser has no instruction about where script may load from. The homepage loads 7 external scripts.
  • Two security headers missing on homepageThe homepage returns strict-transport-security, x-content-type-options, x-frame-options and referrer-policy, but content-security-policy and permissions-policy are absent.
  • One cookie measured, none flaggedThe probe measured 1 cookie and flagged 0, so no measured cookie was set without its flags.
  • TLS is current and HTTP/2 negotiatedThe certificate is valid to Nov 10 2026, 47 days out, with TLSv1.3 and HTTP/2 negotiated. Traffic is proxied by Cloudflare per the cf-ray response header.
  • No malware or vulnerable libraries detectedSafe Browsing flagged nothing across 25 URLs checked, and 0 vulnerable, end-of-life or unknown-version libraries were found among the 7 script URLs.
  • Domain is 13.9 years oldThe domain was created 2012-10-18 and expires 2031-10-18, so domain age is not a Trust weakness here.
  • Open-source authority not measuredNo GitHub organization login was available, so followers, stars and repo count were not collected. This area is unmeasured, not zero.

Measurement

  • No tag manager container in served HTMLThe tag-manager probe returned measured false with the reason that no Google Tag Manager container id appears in the served HTML. Container IDs found: 0, tags parsed: 0, so there is no configured-but-not-firing tag set to audit.
  • Consent Mode absent, confirmed by two probesThe analytics stack reports hasConsentMode false, and the consent probe reports consentMode.present false with version null. There is no mechanism to gate tags by region or user choice.
  • Pre-consent cookies on every page scannedThe consent probe found pre-consent cookies on 25 of 25 pages scanned, with 2 tags flagged as ungated. The pre-consent cookie count is 5.
  • No privacy opt-out APIs presentThe consent probe shows tcfApi false, uspApi false, gppApi false, gpcTokens 0, and gpcJson.present false. There is no IAB TCF framework and no US privacy API on the site.
  • No ads.txt and no declared cookiesThe consent probe reports adsTxt false and declaredCookies 0. The privacy policy at /privacy is reachable.
  • Martech stack has no duplicated tool categoryThe stack probe found 3 vendors in 2 groups with duplicatedRoles 0 and unclassifiedVendors 0. The only detected category is GA4 under Analytics, and hasAdsPixels is 0.
  • Campaign parameters dropped in the site's own redirectsThe campaign-parameter probe ran 5 requests across 3 probes and found probesLosingUtm 1 and probesLosingClickId 1. One of 3 tested URLs loses all five utm_ parameters in the site's own redirect chain.
  • Lead forms post to a single destinationThe form probe found 21 lead forms across 25 pages posting to 1 distinct destination. The stored HTML of 23 of those pages was cut at the crawler's size limit, so the count is a floor.

Suggested fixes

Auditaar wrote each of these from your site’s own markup and checked it is valid before suggesting it.

Suggested fixrobotsfor “robots.txt does not declare a sitemap”
Sitemap: https://northwind.dev/sitemap.xml
Suggested fixheaderfor “No Content Security Policy is sent”
default-src 'self'; script-src 'nonce-{RANDOM}' 'strict-dynamic' https: 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data: https:; connect-src 'self' https:; object-src 'none'; base-uri 'none'; frame-ancestors 'self'; form-action 'self'; report-uri /csp-report
Suggested fixmeta-titlefor “1 duplicate title tag”
Northwind: Icons, Fonts, and Toolkit