Fewer false alarms: audits now see the page your visitors see

A founder ran an audit on their product and checked every finding by hand. Four were wrong: a file we called missing was there, links we called broken worked, and the analytics and video we reported absent were both on the page. Chasing those down led to the changes below. The short version: before we tell you something is broken, we now make sure it is.

We read the page your visitors see

Many modern sites build their content in the browser with JavaScript. The HTML the server sends can be almost empty, and until now that raw HTML is what our presence checks looked at. On one site in testing the source contained no video at all; the rendered page had fourteen.

Checks for video, analytics, live chat and social links now run against the page after it has rendered in a real browser. This pass can only move a check toward passing — never the other way — so it cannot create new false alarms.

"Missing" now has to be confirmed

To check whether a file or link exists we used a lightweight request that asks for the headers only. Some servers answer that request with an error while serving the real page perfectly well, and we believed the error. That alone produced "llms.txt is missing" and a full list of "broken" links on a site where everything worked.

Every "missing" file and "broken" link is now confirmed with a full request before it reaches your report. Two related fixes in the link checker: in-page anchors like #pricing are no longer checked as if they were separate pages, and a page no longer reports a link to itself as broken.

New check: HEAD request handling

If your server does get that lightweight request wrong, we now tell you directly instead of quietly working around it. It matters more than it sounds: link checkers, uptime monitors and some crawlers use exactly that request, so they will see working pages as dead — and you will never notice in a browser. It is usually a one-line routing fix.

Cookie consent is not missing analytics

If your analytics loads only after a visitor accepts cookies, that is GDPR working as intended. A crawler never clicks "accept", so it never sees the script. When we find a consent banner and no analytics, the check now says we could not verify it and is left out of your score, instead of telling you to install analytics you already have.

Advice that fits how your product converts

Some products convert by letting people straight in: a playground, an editor, a chat you can start as a guest. Telling those sites to add a lead-capture form, a newsletter box and an exit-intent popup applies a sales-led playbook to a self-serve product — and a popup in front of the very action you want is actively harmful.

When your main call to action repeatedly sends visitors into the product itself, those three checks are no longer scored against you, and the report explains why. "Book a demo" and "Contact us" do not count — those are sales-led, and there a lead form is exactly right.

Social proof without faces

Named testimonials are the default advice, but nobody signs their name to a review of a product they use privately. The social-proof recommendation now offers the alternative that works there: aggregates such as number of users, conversations or ratings. And it says plainly never to invent testimonials.

Smaller fixes

• Google Analytics detection no longer mistakes CSS class names like g-switch for a tracking ID.
• The mini-game you can play while an audit runs now works on phones: tap to jump, a hero you can actually see, and no more "Press Space" on a device without a keyboard.

What you need to do

Nothing — but existing reports keep the findings they were generated with. Run a fresh audit to see the corrected results.