Diagnose. Prove. Close.
Find local businesses with broken websites. Pitch with proof.
SiteAssay runs precision website assays across every technical health and commercial readiness signal the engine measures, translates vulnerabilities into estimated revenue impact, and equips your agency with client-ready white-label reports and evidence-grounded outreach that closes deals.
Free, no account, one URL at a time
- 234
- Diagnostic health signals across 11 scored categories
- 17
- Executive and technical sections in every client report
- 48
- Specialised audit adapters running against live sites
- 100%
- Human approval gate before any outreach message leaves
One run, end to end
Search a trade and a city. Get back the ones worth calling.
Six stages, each queued and resumable. The first two are the search; the rest run only on the businesses you choose, because pointing a scan at a business nobody picked is both wasteful and rude.
A worked example. Pick a stage to see what it produced.
The Pitching Gap
Generic cold emails get ignored. Diagnostic proof closes retainers.
Local business owners delete hundreds of template emails promising "better SEO" or "modern web design". SiteAssay changes the dynamic from a sales pitch into a diagnostic consultation anchored to indisputable public measurements.
See how outreach works- The generic agency template
- Vague claims ("We noticed your website could use an upgrade") sent in bulk. Ignored as spam by busy business owners.
- The SiteAssay diagnostic pitch
- "Your mobile site takes 5.4s to load, lacks DMARC spoof protection, and has 28 WCAG contrast errors." Concrete, measurable, and urgent.
- Human approval gate
- Every draft is queued for human inspection. Nothing sends autonomously, protecting your agency domain reputation.
- White-label leave behind
- Send an interactive branded web report and PDF that explains business impact in plain English.
What we actually look at
11 categories, each one scored 0–100 against a published standard and weighted by the work you sell. A security consultant and a web designer get different rankings from the same audit.
Performance
Core Web Vitals from a real headless browser, plus field data from real visitors where it exists.
Security
Response headers graded, TLS and certificate chain, exposed paths, secrets left in the JavaScript, and the SPF, DKIM and DMARC records that decide whether anyone can send mail as them.
SEO
Titles, headings, canonicals, schema, sitemap validity, and how far a reader travels before the answer.
AI visibility
Whether an answer engine is allowed to read the site at all, and whether there is anything quotable when it does.
AI trust
Authorship, freshness, citations and entity clarity: the signals behind being cited rather than merely crawled.
Conversion
A reachable call to action, a working form, tap-to-call, and the friction between a visitor and an enquiry.
Accessibility
WCAG 2.1 AA failures counted on the rendered page by severity, with alt-text coverage.
Technology
What built the site, what hosts it, which client-side libraries carry known CVEs.
Reputation
The public review corpus, its sentiment, and the complaints that come up more than once.
Google Business Profile
Claimed or not, hours, categories, photos and whether the listing says the business is closed. For a business with no website this is the only category with a score, and it is the one that unlocks the rest.
Build quality
JavaScript errors thrown at real visitors, dead-code bloat, hydration mismatches and placeholder copy left on the page. The visible footprints of a site assembled in a hurry.
Evidence, then the pitch
Fifteen companies built a scanner. The hard half is what comes after it.
A finding is not an email. SiteAssay picks the worst thing it measured on that specific site, researches the business behind it, and drafts a short message that quotes the number: a 4.8-second load, a certificate expiring in nine days, sixty-one accessibility failures. Then it stops and waits for you.
How the outreach works- Anchored to a measurement
- Smart severity rules rank the findings by impact and by the service line you sell, and the draft is written around the one that won.
- A person approves every send
- Drafting is automated. Sending is not, and it never will be. Deliverability and sender reputation are worth more than volume.
- From your own inbox
- Connect your work email over OAuth and messages leave your domain with your reputation behind them, not a shared relay.
- Compliance in the mechanism
- One-click unsubscribe on everything, a suppression list enforced when the draft is written as well as when it is sent, and automatic suppression on a complaint.
The deliverable
A document the business owner can read without you in the room.
17 sections, a letter grade, and for every finding: why it matters, what it plausibly costs, how to fix it, and how confident we are that we measured it rather than inferred it. It is a shareable link and a PDF, and on a paid plan it carries your name instead of ours.
What is in a report- Copy-ready fixes
- The SPF record for their actual mail provider, the nginx block, the schema snippet. Paste, do not translate.
- Confidence on every finding
- High where we measured it, medium where we inferred it. The difference is printed rather than smoothed over.
Who this is for
Same audit. Different ranking.
The scoring weights are a profile, so the same measured site sorts differently depending on what you sell. Pick the one that matches your work and the lead list reorders itself around it.
You sell builds and rebuilds
Conversion readiness, load time and build quality carry the most weight, and the segment with no website at all is a list of its own. Every lead arrives with a concrete reason the current site is costing the owner money.
You sell being found
Technical SEO and AI visibility lead the weighting. Being invisible to an answer engine is a finding an owner has usually never heard of, and it is the one that makes the call interesting.
You sell hardening and maintenance
Security and infrastructure dominate the score. Exposed configuration files, secrets shipped in the JavaScript, certificates about to lapse and hosting that sits on an abuse blocklist.
You sell local presence
Review volume, rating and sentiment lead, with the recurring complaints pulled out of the corpus so the pitch is about a named problem rather than a star count.
You are one person and time-poor
The default profile, a free plan that does not expire, and a queue of drafts to review rather than a database to search. Twenty warm conversations a month is the job, not ten thousand contacts.
Answer engines
Two different questions, and most tools only ask one.
Can an assistant reach and read this site, and would it cite it? They are separate problems with separate scores. A site that blocks GPTBot cannot be recommended no matter how good its content is, so that finding caps the rest of the category rather than averaging into it.
Read the AI-visibility notes- AI visibility
- Crawler access, structured data, answerable markup, a defined business entity, and whether an llms.txt exists at all.
- AI trust
- Authorship, dates, outbound citations, extractable structure, and how quickly a reader reaches something quotable.
- What we will not claim
- We do not measure how often an assistant mentions you, and we will not sell a number that pretends to. Nobody can measure that from outside.
- Including about llms.txt
- It is a weak signal and we say so on the report. Selling a client an llms.txt file as an AI strategy is selling them a deliverable, not an outcome.
AI shipped it. Nobody checked the deploy.
Sites assembled by an AI builder reach production with a recognisable set of mistakes, and all of them are visible from outside without asking anyone for access. We look for the artefacts, not the source code.
Keys in the bundle
Provider credentials matched inside the JavaScript the site hands to every visitor. Published, not hidden.
Rows anyone can read
A database with row-level security never switched on, read using the public key the app ships itself. Read-only requests, nothing written.
Source maps in production
The file that turns a minified bundle back into the code somebody wrote, left reachable on the live site.
Which builder made it
Builder and host fingerprinted separately, so the report speaks in the terms of the tool the owner actually used.
Scaffolding left in
Placeholder copy still on the page, the visible half of the same haste that left the rest of this list behind.
Run your first audit today
Start on the free plan, with enough searches to cover a city and enough audits to judge a shortlist. No card, and it does not expire.