Only claims the crawler and the paid engines can prove.

Two different audits

Anyone can paste a URL on the homepage. That starts a public preview. It requests SEO and AI-visibility checks only. The API never sets security: true on an anonymous scan, so Hermes and Shodan do not run.

Every account with a verified email gets one free full audit, the same pipeline as a paid one. After that, a full audit starts only after the server confirms a Dodo payment and grants a credit. The checkout redirect does not start the expensive crawl. If a full audit fails, the free audit or credit it used is returned automatically.

What the free preview fetches

• A same-host HTML crawl with a small page cap (8 pages) and depth 2
• On-page SEO: titles, descriptions, canonicals, headings, robots, sitemap, broken crawled links
• AI-visibility (AEO): thin copy, identity signals, JSON-LD types, discoverability
• Scores plus the top 3 issues. No report markdown and no security findings

The preview does not fetch /llms.txt as its own pass, does not run Hermes, does not query Shodan, and does not call a SERP or GEO provider.

What a paid audit adds

After a verified payment, Siteory enqueues one durable paid scan for that URL:

• A deeper same-host crawl (default 25 pages, depth 3), still honoring robots.txt for User-agent: *
• The same SEO analyzer on that crawl graph, including duplicate titles, orphans, sitemap-unlinked URLs, depth limits, and canonical chains
• The same AEO analyzer, plus a dedicated fetch of /llms.txt and /llms-full.txt
• llms.txt structure, site identity, off-host links, stale same-origin links, and sitemap coverage. None of those are ranking claims
• Active security through Hermes when the scan requests security
• Internet-exposure intelligence through Shodan when a key is configured. Observations are not automatically vulnerabilities

Paid reports include crawl coverage: URLs discovered, pages analyzed, remaining URLs, and the reason the crawler stopped (page or depth limit).

What stays Unavailable

Siteory does not invent search rankings, AI-visibility share, or domain authority. Unless a licensed provider is configured on the server, the summary report prints Unavailable for:

• Search / SERP visibility
• GEO / AI-visibility ranking
• Authority / reputation (not a Domain Rating of 0)

Google Search Console, Ahrefs, and DataForSEO are not wired unless a licensed key already exists. Missing data is Unavailable. It is never scored as 0.

How scores are calculated

SEO, AEO, and security each start at 100. Confirmed findings subtract a fixed penalty by severity. Informational observations subtract 0. If the start URL was not fetched, the SEO or AEO score is not calculated. Security observations from Shodan do not change the score unless they are classified as findings.

We do not measure Core Web Vitals. The crawl records TTFB, HTML bytes, and transfer time only. We do not judge title or meta-description character counts. We do not claim that fixing a finding will raise Google rank or ChatGPT citations.

Security boundary

Hermes analyzes the submitted application. Shodan is third-party internet-exposure intelligence. Siteory correlates the two and keeps observations separate from confirmed findings. A paid security scan is not a penetration test and not a guarantee of complete coverage.

Payment and email

Credits are granted on payment.succeeded only. A subscription renewal event does not add credits. The paid scan is keyed by payment id so a webhook replay does not start a second crawl. When the paid report is ready, Resend emails the account holder once. Anonymous previews are not emailed.

The shorter product story is on how it works. Pricing is on pricing.