Writing
Findings
In one sentence
Findings are short case studies written from real measurements — a robots.txt that answered 200 with a challenge page, a site whose GPTBot traffic came from one address wearing seven crawler names, a homepage that was two percent readable text, a contact email that bounced for one published character — each with the bytes that showed it, and none naming a scanned third-party domain.
Measurements from the corpus, and cases worth writing down. Nothing here names a scanned domain.
2026-09-10
The Denver Post publishes coordinates that put its newsroom 10,668 km away
One character. The address in the same block says 5990 Washington St., Denver. The coordinate two lines below it says northern China, and every check we run passed it as valid.
Read the measurements →
2026-09-09
Our scanner counted 14 placeholders and none of the 13 photographs
A lazyload plugin puts a grey placeholder in src and the real URL one attribute over. Our image reader took the placeholder at face value and reported a page of webp photographs as having no modern images at all.
Read the measurements →
2026-09-08
Our proofs said “pending” for 26 days. The anchoring was fine.
Every timestamp file this site served was a calendar receipt rather than a finished Bitcoin proof. The record was unbroken the whole time; the artifact handed to a reader did not show it.
Read the measurements →
2026-09-08
Our scanner said the viewport tag was missing. It was there all along.
A page scored 0 out of 100 on the mobile section with a valid viewport meta in its head. The attribute was unquoted, and four of our extractors only matched quoted attributes.
Read the measurements →
2026-09-05
Your schema lists service areas your sitemap has pages for a fraction of them
Four home-service sites we operate declare 19–23 service areas each in structured data. Three of them have real landing pages for one or seven. A coverage claim lives in two files, and the pages are the ones a search engine can land on.
Read the measurements →
2026-09-02
The state of AI visibility, September 2026: what 1,364 scans say a crawler actually receives
Seven findings from the open dataset: the most common defect is a stale cache, a quarter of sites carry a grade-capping finding, opt-outs travel by copy-paste, and a third of crawler traffic is forged.
Read the measurements →
2026-09-02
A tree-service lead arrived with utm_source=chatgpt.com. Here is what that does and does not prove.
A quote request on a Denver tree-service site carried the tag ChatGPT appends to links it hands out. One lead is not a rate, but it is the first outcome point on a record that had only measured inputs until today.
Read the measurements →
2026-09-01
llms.txt returned 200 and was a login wall: why status codes lie about machine files
The same page that answered a nonexistent path answered /llms.txt. One layer of our scanner noticed; the other called it present.
Read the measurements →
2026-09-01
A Worker cannot fetch its own host: the sameAs profile we called dead
A customer's schema pointed at a page on our own domain. From outside it answered 200. From inside the scanner it answered nothing, and we reported it dead.
Read the measurements →
2026-09-01
Our placeholder check accused a newspaper of publishing NaN. The NaN was in a URL.
A self-audit rule that scans every stored record for the token NaN found three of them. All three were inside the letters of one URL slug.
Read the measurements →
2026-09-01
E-E-A-T is not on the wire. Here is what a scanner can measure instead.
Experience, expertise, authoritativeness and trust are judgements an evaluator makes. A fetch cannot make them. It can check whether the evidence for them exists in a form a machine can find.
Read the measurements →
2026-09-01
Accessibility from the delivered HTML: nine things a screen reader needs before contrast matters
Not a WCAG audit. A check on whether the structure assistive technology depends on exists in the document the server returned.
Read the measurements →
2026-09-01
We reviewed all 150 scored rows against seven site types. Here is what we unscored, and why.
A threshold that fails a lean personal blog is not measuring quality. A row that scores the mechanism when another row scores the outcome counts one defect twice.
Read the measurements →
2026-08-29
Our canonical tag was correct and the site was still served twice
Every page on this site existed at two addresses for months. The canonical pointed at the right one. That turns out not to be the part that matters.
Read the measurements →
2026-08-29
93% of our arrivals sent no referrer
Across five sites and 1,104 recorded arrivals, 1,026 carried no referrer at all. Every claim about where AI traffic comes from is being made on the remaining seven per cent.
Read the measurements →
2026-08-28
The web server that gained and lost 43 million sites
Netcraft counts 66 million sites running OpenResty. W3Techs does not list it at all. Both are measuring honestly, and the gap between them is the lesson.
Read the measurements →
2026-08-27
We clicked a real Google result to test the goto redirect. The referrer cannot tell you.
Reports say google.com/goto is at near-100% rollout. From an ordinary browser we saw zero wrapped links — and even if we had, the arriving referrer would look identical.
Read the measurements →
2026-08-26
We measured a 225% spread between two Lighthouse runs of the same page
Nothing on the page changed. Blocking time came back 2,643 ms, then 812 ms. First paint moved 69%. If your report shows one lab number as a fact, it is overclaiming.
Read the measurements →
2026-08-26
Our audit labelled one page and measured another for weeks
Every scan of a specific URL actually measured the homepage. The report header showed the right path. The numbers underneath belonged to a different page.
Read the measurements →
2026-08-26
AI text watermarks only work if the model's provider opted in
Watermarking is real and the mechanism is sound. But it covers one vendor's models, you cannot run the detector, and paraphrasing removes most of the signal.
Read the measurements →
2026-08-21
CRLF corruption: a save that returned success and rewrote every newline
The write reported success. Read back, the file was 16,330 bytes larger — exactly the number of newlines it contained. A store confirming it accepted your bytes is not the same as confirming it kept them.
Read the measurements →
2026-08-21
Thin-content checks miss parking pages: 783 words, still parked
Scanners grade parked domains as if they were sites. The obvious fix — flag pages with almost no text — fails, because commercial landers are not thin. What works is identifying the operator serving the page.
Read the measurements →
2026-08-21
An analytics script added 650 ms to every request: how we found it
A first-party beacon reported that 70% of our LCP was time-to-first-byte. The cause was three telemetry writes awaited before routing — next to a comment explaining why they could not be moved. The comment was wrong.
Read the measurements →
2026-08-21
Your new cache rule did not fix the object it was written for
A robots.txt served with a one-year browser cache, 7.6 days old, on a zone whose cache rule capped the edge TTL at one hour. The rule was fine. It just does not apply to anything already in the cache.
Read the measurements →
2026-08-21
LLMs ignored our schema and still identified us: what actually got read
We publish a four-node JSON-LD graph. Two unrelated tools that turn pages into text for language models both dropped the whole of <head>, and with it every node. Both still named the company correctly. Then we measured our own ten sites: 87% of our structured data sits where neither of them looks.
Read the measurements →
2026-08-20
AI visibility scores measure an API, not what anyone sees in ChatGPT
The answers these tools record are real. The label on top of them — “your visibility in AI search” — describes something that was never measured.
Read the measurements →
2026-08-20
Cache negative lookups too: a miss that is never cached repays forever
A cache that only records successes speeds up the requests that were already fast and does nothing for the ones that hurt.
Read the measurements →
2026-08-20
Duplicate @id in JSON-LD: one node parsed twice, not two businesses
An @id is the identifier. Two records carrying the same one are, by definition, the same record appearing twice.
Read the measurements →
2026-08-20
AI visibility tools that grade you 100% and still sell you the fix
When the call to action fires regardless of the result, the result was never the point.
Read the measurements →
2026-08-19
Is your host blocking ClaudeBot? Group the 403s by IP first
A 57% block rate in our own access logs looked like a hosting provider shutting out AI crawlers. Grouped by source address, almost all of it was one machine wearing seven different crawler names.
Read the measurements →
2026-08-19
33 AI visibility tools scanned: a third publish llms.txt, none an entity map
Thirty-three SEO and AI-visibility vendors, run through the same scanner they would point at you.
Read the measurements →
2026-08-19
Firewall or website? When an AI visibility scanner grades your WAF
We published a failing grade for a competitor. The grade was wrong, and the way it was wrong is the most useful thing this scanner has taught us.
Read the measurements →
2026-08-18
Why a self-identifying crawler header must never clear a check
A marker anyone can send must never be able to clear a check. It can label a request; it can never absolve one.
Read the measurements →
2026-08-18
When an LLM summarises your audit report and gets the grade wrong
It decided we were docking a site's grade for things we admitted we could not measure. We were not. But our report made that the natural reading, and that is our defect, not the reader's.
Read the measurements →
2026-08-18
Our AI-crawler forgery rate was counting our own browser extension
Our extension forges a crawler user-agent on every probe — by design. To this site's own telemetry that is indistinguishable from a stranger doing the same thing, so for weeks our users inflated the number we publish about everyone else.
Read the measurements →
2026-08-18
Which AI crawlers publish IP ranges, and which cannot be verified
251 of 950 requests claiming a named crawler came from operators who publish no address range at all. Those requests are not forged — they are unfalsifiable, which is a different and more permanent problem.
Read the measurements →
2026-08-18
Fake GPTBot and ClaudeBot requests are scanning for .env and .ssh files
Of 874 recorded requests from clients claiming to be a named AI crawler, 69 asked for a file that holds secrets — cloud credentials, Terraform state, .env files. Across 66 distinct paths, none of which any real crawler requests.
Read the measurements →
2026-08-15
How much AI crawler traffic is forged? Checked against IP ranges
A user-agent string is a claim, not an identity. Every request here that claims a named crawler is checked against the IP ranges that operator publishes — and a measurable share of claims fail the check.
Read the measurements →
2026-08-15
Site audits go stale: the day you audited it is not the finding
Measuring the same sites every day produces a number a one-off audit structurally cannot: how many were broken at least once. The gap between “broken today” and “ever broken” is the case for a series over a snapshot.
Read the measurements →
2026-08-15
Generic AEO scores penalise sites for checks that do not apply to them
A public checker deducted seven points from a tree service for having no OAuth server, no payment endpoint and no MCP card — after its own output had already said the site was not a commerce site.
Read the measurements →
2026-08-14
The meta tag 1.65 million sites carry and the top 10,000 refuse
MobileOptimized is a Microsoft tag for Internet Explorer Mobile. Adoption across the whole web is climbing. In the top million it is falling, and in the top ten thousand it has never appeared at all.
Read the measurements →
2026-08-14
agents.md template inheritance: is the file on your domain yours?
Strip the brand and the domain out of two unrelated agents.md files and they become the same document. Neither owner wrote a word of it.
Read the measurements →
2026-08-14
GPTBot, ClaudeBot, PerplexityBot: what each AI crawler is actually for
The eight most-blocked AI crawlers on the web sit within 12% of each other. Eight independent operators do not get blocked in near-lockstep by eight independent choices.
Read the measurements →
2026-08-14
llms.txt adoption rate: how many sites actually publish one
Declaring an entity is common. Declaring the specific facts an assistant is asked for is an order of magnitude rarer.
Read the measurements →
2026-08-13
What answer engines receive from local business sites: mostly not text
Three findings from a corpus of sites measured byte by byte, and why none of them appear in a validator.
Read the measurements →
2026-08-13
Your cache purge returned 200 and evicted nothing
Four successful-looking cache purges cleared zero objects. Here is the two-request test that catches it, and the script that runs it.
Read the measurements →
2026-08-13
robots.txt returned 200 and no crawler could read it: challenge pages
A robots.txt that answers HTTP 200 with a bot-challenge page is read as allow-everything by most crawlers. Why every validator missed it, and the two-request test that catches it.
Read the measurements →
2026-08-13
Which AI crawlers actually visit a small business site
Not a probe: real, unasked-for visits to sites we operate, each checked against the operator's published IP ranges. Which AI crawlers turned up, how often, and which were forged.
Read the measurements →
2026-08-13
Email bounce case study: every contact address failed for one character
A contractor site linked the same misspelled address on every page. Two DNS lookups proved it, and the fix took one line.
Read the measurements →