Google's rulebook 23
Spam policies and current Search guidance.
- Back button hijacking (spam policy, enforced Jun 2026)
- History manipulation in page scripts (verify)
- noindex robots meta inside <body>
- HTML exceeds Googlebot's 2MB indexing limit
- Unedited AI output on page (scaled content abuse risk)
- Conditional JavaScript redirect (sneaky redirect risk)
- Possible hidden text (verify)
- Location list stuffing (doorway / keyword stuffing signal)
- Keyword repetition in body copy
- Affiliate or paid links missing rel="sponsored"
- Generic filler phrasing (low-effort content signal)
- Keyword-stuffed title tag
- Title likely truncated in results
- Keyword-stuffed meta description
- Meta description too short
- Meta description likely truncated
- Structured data dates are in the future
- dateModified is earlier than datePublished
- Snippets suppressed (also removes page from AI Overviews)
- Markup for retired rich results
- Favicon is SVG only
- No favicon declared
- No WebSite site-name markup on homepage
Site-wide crawl 26
Patterns only a full crawl can see.
- Indexable pages with no search impressions
- Canonical host differs from crawled host
- Templated near-duplicate pages (doorway page risk)
- Large share of site is templated pages (scaled content risk)
- Possible site reputation abuse sections (verify)
- Keyword-stuffed titles across pages
- Markup for retired rich results across the site
- Server errors (5xx) found in crawl
- Internal links point at broken pages
- Broken pages (4xx) found in crawl
- Pages failed to fetch during crawl
- Duplicate titles across pages
- Duplicate page content across URLs
- Duplicate meta descriptions across pages
- Orphan pages (no inbound internal links)
- Thin content pages across the site
- Slow server responses (>2s) in crawl
- Internal links resolve through redirects
- Sitemap lists redirecting URLs
- Same page indexable with and without trailing slash
- Indexable pages missing a title
- Indexable pages missing a meta description
- Indexable pages missing an H1
- Titles likely truncated in results
- Meta descriptions too short or too long
- Sitemap lists broken URLs
SEO essentials 30
Indexing, crawling and the basics.
- noindex on a checkout/cart/account page (expected)
- Page is set to noindex
- Missing title tag
- Missing meta description
- Missing H1 heading
- Multiple H1 headings
- Missing canonical URL
- No structured data found
- No Open Graph tags found
- X-Robots-Tag noindex on a checkout/cart/account page (expected)
- Header-level noindex (X-Robots-Tag)
- Canonical points to a different host/scheme
- noindex page canonicalises to another URL
- Meta-refresh redirect in use
- Possible intrusive interstitial / pop-up (verify)
- No next-gen image formats
- Images missing width/height (CLS risk)
- robots.txt blocks render resources (CSS, JS)
- JS-only navigation links (not crawlable)
- Many faceted / parameter URLs exposed to crawlers
- Pagination may not be crawlable
- No sitemap found
- Sitemap contains invalid XML
- Sitemap contains no URLs
- Sitemap contains URLs from other domains
- Sitemap missing lastmod dates
- Duplicate URLs in sitemap
- Sitemap lists non-HTML files
- Sitemap exceeds 50,000 URLs
- Sitemap not referenced in robots.txt
Structured data 11
Schema validity and rich-result eligibility.
- No structured data found
- Invalid JSON in structured data
- Missing or invalid @context in structured data
- Unknown @type in structured data
- Missing required properties in structured data
- Duplicate @type in structured data
- BreadcrumbList entry missing item URL
- Self-serving review markup (policy violation)
- Video present but no VideoObject schema
- VideoObject missing required properties
- No video key-moments markup
Content and trust 22
Quality signals and E-E-A-T.
- Thin content detected
- Placeholder text detected
- Title and H1 do not share key terms
- Content readability is very high grade level
- Content readability is very low grade level
- Empty paragraphs found
- High heading-to-content ratio
- Outdated copyright year
- Title and meta description are identical
- YMYL topic : apply highest E-E-A-T scrutiny
- High ad density relative to content
- Low information-gain / originality signals
- No published/updated date
- No concise lead answer (featured-snippet/AEO)
- Review lacks first-hand evidence
- Not optimised for Google Discover
- No author byline on content
- No author markup (Person / Article author)
- Trust pages (About, Contact, Privacy) not linked
- No Organization entity markup
- Organization entity missing sameAs
- No outbound citations
AI search 16
Answer engines, citations and query fan-out.
- AI answer engines blocked in robots.txt
- AI training bots blocked (deliberate opt-out?)
- No llms.txt manifest
- Low extraction-readiness for AI answers
- Weak entity signals for AI grounding
- llms.txt present but thin
- llms.txt links repeat the same URLs
- No Wikidata entity found for
- Not cited by Perplexity for any tested query
- Low AI citation rate across tested queries
- Competitor sites answer engines trust for your queries
- Community platforms are citation channels for your queries
- No AI answer-engine crawlers seen in the logs
- Some answer engines not yet crawling
- AI crawler mostly hitting errors (4xx/5xx)
- Low query fan-out coverage
Security 18
Headers, secrets and exposed files.
- Mixed content detected
- External links missing rel="noopener"
- Missing Content-Security-Policy header
- Missing Strict-Transport-Security header
- Missing X-Frame-Options header
- Missing Referrer-Policy header
- Missing Permissions-Policy header
- Secret exposed in page source (Stripe, AWS, GitHub, Slack, Anthropic, OpenAI, private keys)
- Google API key in page source : verify restrictions
- CSP present but weakened (unsafe-inline, unsafe-eval, wildcards)
- HSTS max-age too short
- HSTS missing includeSubDomains
- Cookies set without Secure, HttpOnly or SameSite
- Server version disclosed
- Cross-origin scripts without Subresource Integrity
- Source maps referenced in production
- Exposed sensitive path (.env, .git, dumps and more)
- No /.well-known/security.txt
Infrastructure 11
TLS, DNS and email authentication.
- SSL certificate invalid or missing
- SSL certificate expiring soon
- DNSSEC not enabled
- Missing CAA DNS record
- No CDN detected
- HTTP/2 support unverified
- HTTP/2 not detected
- Missing SPF record
- DKIM not verifiable from DNS (selectors unknown)
- Missing DMARC record
- DMARC policy is set to none (weak)
Privacy and consent 5
Consent and policy coverage.
- No cookie consent banner detected
- No privacy policy link found
- No cookie policy link found
- Tracking may load before consent
- No data controller information found
Analytics and tracking 10
What actually fires, double counting and conversions.
- No tracking fires before cookie consent
- No analytics hits fired
- Universal Analytics still installed (dead since July 2024)
- Tracking tag loads but sends nothing
- GA4 records no page views
- GA4 counts every page view more than once
- Meta Pixel fires PageView more than once
- Several GA4 properties collecting
- Same gtag config runs more than once
- Thank-you page fires no conversion event
Accessibility 6
Can everyone use it.
- Images missing alt text
- Missing lang attribute on <html>
- Form inputs without labels
- Missing skip navigation link
- Empty headings found
- Missing <main> landmark
Performance 17
Speed, scripts and app readiness.
- Render-blocking scripts detected
- No resource hints found
- Large HTML document
- No lazy-loaded images
- Large inline JavaScript
- Images not served as next-gen / responsive (often build-locked)
- Heavy JavaScript libraries detected
- Too many external scripts
- Scripts missing async or defer attributes
- No ES module scripts detected
- Large inline script content
- No bundler detected
- No web app manifest found
- No theme-color meta tag found
- No Apple touch icon found
- No service worker registration found
- No viewport meta tag found
Links 9
Link health and money-page linking.
- Empty or placeholder href attributes found
- Broken anchor fragment links detected
- External links missing rel="noopener"
- No internal links found
- Invalid mailto link format
- No links found on page
- Excessive number of links
- Money-page link gap
- Further money-page link gaps
Local business 12
Main-street visibility.
- Missing LocalBusiness structured data
- LocalBusiness schema missing NAP details
- No Google Maps embed found
- No click-to-call tel: link found
- No prominent call-to-action found
- No opening hours found
- No service area defined
- No review or rating schema found
- No trust signals detected
- No Google Business Profile link found
- No WhatsApp contact link found
- No directions link found
E-commerce 12
Product pages and store trust.
- Missing Product structured data
- Product schema is incomplete or missing offers
- No cart elements detected
- No payment trust signals found
- Missing BreadcrumbList schema
- No SSL trust badge detected
- Merchant listing enhancements missing in Product schema
- Product schema missing GTIN/MPN/SKU identifier
- No shipping information on the product page
- No return/refund policy on the product page
- Out-of-stock product not marked in schema
- No related/cross-sell product links
International 7
Languages and hreflang.
- Missing lang attribute on <html> element
- No hreflang tags found
- Missing x-default hreflang tag
- No self-referencing hreflang tag
- Invalid language codes in hreflang tags
- Missing Content-Language HTTP header
- RTL language detected without dir="rtl"
Search Console and data 6
Google's own data, update timing and model-verified triage.
- Manual action in Search Console
- Security issue reported by Google
- Rich-result errors in Search Console
- Traffic drop across a Google core or spam update
- Location pages judged as template copy (model-verified)
- Fan-out sub-queries not answered (model-verified)
Generated from the finding titles in the plugin source on every build. Some titles include the specific value found, shown here as "…". Design taste is judged, not pattern-matched, so it is not in this list: see the design file.
FAT Agent
