Fx

Paid machine-API discovery rollup — link rel=alternate (oembed/atom/rss/jsonfeed) + HTTP Link header + JSON-LD Action/EntryPoint/Service + declared-spec-path probes (/llms.txt, /openapi.json, /swagger.json, /graphql, /.well-known/ai-plugin.json) + spec_ui script detection + machine_readability_score 0-100 with A-F grade + citations_api boolean via x402

Paid unified structured-data audit — JSON-LD + Microdata + RDFa aggregated into unique schema.org types + parent-class hierarchy + 21 rich-result candidate detection + machine_readability_score 0-100 with A-F grade via x402

Paid canonical URL consensus audit — link rel=canonical + HTTP redirect final + og:url + twitter:url + JSON-LD url/@id/mainEntityOfPage + hreflang x-default compared, consensus URL + agreement_count + canonical_health_score A-F grade + findings via x402

Paid legal/ethical disclosure completeness audit — Terms/Privacy/Cookie/Affiliate/AI-policy links + FTC affiliate language detection + EU AI Act Art. 50 AI-disclosure detection + CCPA 'Do Not Sell' link + gdpr_legal_compliant + ftc_affiliate_compliant + eu_ai_act_art50_compliant + disclosure_score 0-100 with A-F grade via x402

Paid Schema.org JSON-LD validator + recommended-properties audit (30-type catalog with required/recommended property checks, type-specific anti-pattern detection, ISO 8601 / ISO 4217 / phone-format checks, weighted required+recommended scoring, sd_validator_score 0-100 A-F grade) via x402

Paid publishing-velocity audit via Wayback CDX API — monthly distinct content-URL capture over 12 months, cadence classification (regular/bursty/dormant/irregular), burst + dormant detection, decay_trend (warming/stable/declining), velocity_score 0-100 with A-F grade via x402

Paid citation-density + source-quality audit — counts anchor + JSON-LD + cite + blockquote + soft-text outbound references, classifies by tier (primary .gov/.edu/standards / secondary news+publishers / tertiary blogs / self), returns citation_score 0-100 with A-F grade via x402

Paid domain contactability audit — email/phone/physical-address/contact-page/social-profile/live-chat/contact-form detection with contactability_score 0-100 A-F grade via x402

Paid institutional trust-anchor audit (beyond EEAT) — legal entity suffix + regulatory mentions (SEC/FINRA/HIPAA/GDPR/SOC2/etc) + jurisdictional signals + 11 trust seals + copyright + legal pages + trust_anchors_score 0-100 A-F grade via x402

Paid affiliate-program presence detection — 17-path landing-page probe with content signals + 16-network fingerprint (ShareASale/CJ/Impact/PartnerStack/Awin/Rakuten/ClickBank/Refersion/FirstPromoter/Tolt/LemonSqueezy/Gumroad/Rewardful/Tapfiliate/Tune/Everflow) + 2 outbound affiliate-link patterns + FTC disclosure language detection + partner-nav header scan + verdict + affiliate_program_score 0-10

Paid HTTP cache-control audit — probes favicon/robots/sitemap headers (Cache-Control+max-age+s-maxage+immutable+stale-while-revalidate / ETag / Last-Modified / Vary / Surrogate-Control / CDN-specific) returns cache_validator_score 0-100 A-F grade via x402

Paid Subresource Integrity (SRI) audit — per-external script+stylesheet integrity/crossorigin/referrerpolicy capture, CDN host breakdown, top untrusted-CDN list, missing-SRI risk scoring, sri_score 0-100 A-F grade via x402

Paid deep robots.txt audit — per-UA directive counts, sitemap, 34 AI-bot directive detection (GPTBot/ClaudeBot/Google-Extended/CCBot/PerplexityBot/Meta-ExternalAgent/Bytespider/etc), crawl-delay, anti-pattern flags, robots_score 0-100 A-F grade via x402

Paid CSS surface audit — external stylesheet counts + inline-block sizes + Cache-Control quality + dark-mode + reduced-motion + a11y @media coverage + framework fingerprint (Tailwind/Bootstrap/Bulma/Foundation/Materialize/Tachyons/OpenProps) + render-blocking detection, css_audit_score 0-100 A-F grade via x402

Paid server/fingerprint/debug/cache response-header audit — Server + X-Powered-By info-leak detection, framework-version-disclosed (X-AspNet-Version/X-Generator/X-Drupal-Cache), debug-headers-in-prod (X-Debug/X-Runtime), 8 request-id/correlation-header inventory, cache-status indicators (CF-Cache-Status/X-Cache/X-Vercel-Cache/Age), Set-Cookie enumeration, server_headers_score 0-100 A-F grade via x

Paid per-image alt-text quality audit — per-img verdicts (missing/decorative/present), length scoring (3-125 chars ideal), 'image of X' redundant-prefix detection, keyword-stuffing detection (>3 comma phrases), ALL-CAPS detection, duplicate-alt grouping (>5 occurrences), aria-labelledby/aria-label/figcaption fallback detection, image_alt_score 0-100 A-F grade via x402

Paid cookie banner UX + dark-pattern audit — 19-CMP fingerprint + Accept/Reject parity + Manage-preferences link + pre-ticked toggles + cookie-wall + Reject click-depth + CCPA Do-Not-Sell + granular categories, cookie_banner_score 0-100 A-F grade via x402

Paid page weight audit — HTML+CSS+JS+image+font byte breakdown (compressed + uncompressed) + per-category bytes + third-party resource ratio + render-blocking resource count + HTTP/2/3 ALPN detection + transfer-vs-uncompressed ratio + data-economy A-F grade, page_weight_score 0-100 via x402

Paid network-timing breakdown for a URL — DNS resolve + TCP connect + TLS handshake + TTFB (time to first byte) + total download phase-by-phase milliseconds + CDN/edge-region detection from CF-Ray/X-Amz-Cf-Pop/X-Vercel-Id + body_bytes + verdict (fast/moderate/slow/very_slow) + ttfb_score 0-100 A-F grade via x402

Paid mobile/responsive viewport meta audit — viewport tag (width=device-width,user-scalable), apple-mobile-web-app-capable, theme-color, format-detection, apple-touch-icon + manifest.json detection, touch-icon coverage, mobile_score 0-100 A-F grade via x402

Paid exhaustive meta-tag coverage audit — title + meta_description + meta_robots + meta_keywords + meta_author + meta_generator + meta_theme_color + meta_viewport + 17 OG fields (og:title/description/image/url/type/site_name/locale/determiner + article:* + og:image:width/height/alt + og:video/audio) + 10 Twitter Card fields + canonical + hreflang + manifest + favicon + apple-touch-icon + apple-mob

Paid deep WCAG 2.1/2.2 AA accessibility audit — forms+inputs (label/aria-label/aria-labelledby/placeholder), autocomplete token validity, button+link accessible-name, heading hierarchy (skip-level + multiple-h1 detection), landmark structure (main/nav/header/footer + ARIA roles), skip-nav link detection, iframe title attribute, inline color-collision heuristic, :focus-visible CSS hint, table <capt

Paid comprehensive DNS audit — parallel A/AAAA/MX/NS/TXT/CAA/SOA/DS queries via Cloudflare DoH, email-auth rollup (SPF/DKIM/DMARC + bulk-sender Gmail/Yahoo compliance), nameserver diversity, CAA policies, DNSSEC DS hint, dns_score 0-100 A-F grade via x402

Paid main-content markdown extractor for RAG ingestion — strips noise (script/style/nav/aside/header/footer/ads/comments), picks <main>/<article>/content div, converts headings/paragraphs/lists/code/links/images/tables to markdown, returns markdown text + word_count + char_count + heading_outline + sections_count + images_count + links_count + code_blocks_count + is_mainstream_content + markdown_q

Paid deep HTTP redirect chain analyzer — per-hop latency_ms + headers (server/content-type/cache-control/x-cache/cf-ray/cf-ipcountry/vary/set-cookie count/hsts) + status sub-type classification (301/302/303/307/308) + cross-domain + redirect-loop detection + geo-redirect heuristic + HTTP->HTTPS upgrade + intermediate-page body sniff (title/meta-refresh/JS-redirect cloaked detection), redirect_comp

Paid security exposure-surface audit — HSTS preload-list membership via hstspreload.org API + HSTS header detection, RFC 9116 security.txt presence+format-validity (Contact/Expires/Canonical/Preferred-Languages), 18-path sensitive-file probe (/.env/.svn/.git/HEAD/.aws/credentials/.ssh/id_rsa/wp-admin/wp-login.php/phpmyadmin/backup.zip/dump.sql/server-status/.DS_Store), directory-listing fingerprin

Paid Open Graph + Twitter Card spec validator — required OG detection (og:title/type/image/url), recommended (description/site_name/locale/image:width/image:height/image:alt), og:type enum validation (website/article/book/profile/music.*/video.*), og:locale format check (xx_XX), og:image HEAD-probe content-type verification, twitter:card enum validation, missing_required + missing_recommended list

Paid subdomain enumeration via HackerTarget hostsearch + urlscan fallback — discovered subdomains with IP + total count + dedup + top-subdomain-prefix frequency + takeover-risk heuristics (disposable-cloud/known-vulnerable/stale-unusual detection), subdomain_enum_score 0-100 A-F grade via x402

Paid OpenAPI 3.x / Swagger spec diff — accepts two URLs (url_a + url_b) or two inline payloads (spec_a + spec_b) as JSON or YAML, reports breaking changes (removed paths, removed operations, type/format changes, enum narrowing, removed required request fields, added required request fields) + additive changes (added paths/operations, removed required fields, new response fields) + info changes (su

Paid WAF/IDS/CDN-edge fingerprint detector — 28-vendor catalog (Cloudflare/Fastly/Akamai/Imperva/Sucuri/CloudFront/ALB/Azure-FrontDoor/Vercel/Netlify/StackPath/KeyCDN/BunnyCDN/F5-BIGIP/Barracuda/Citrix-NetScaler/ModSecurity/Wordfence/Shape/Kasada/PerimeterX/DataDome/etc), response-header fingerprint + body-marker scan + malformed-payload probe (SQLi+path-traversal query string), primary_vendor + c

Paid per-cookie security-flags deep audit — parses every Set-Cookie individually for SameSite (Strict/Lax/None/missing/Lax-by-default-heuristic) + Secure + HttpOnly + Path + Domain (broad-domain detection) + Max-Age + Expires + Session-cookie detection + __Host- + __Secure- prefix validation (RFC 6265bis) + SameParty + Partitioned (CHIPS), flags samesite_none_without_secure (rejected-by-browsers),

Paid security.txt RFC 9116 deep audit — path discovery tries /.well-known/security.txt then /security.txt, parses all fields with line-continuation support, strict Contact format validation (mailto: + https://), strict Expires RFC 3339 format + future-dated window + 7d-soon + 365d-too-far flags, Canonical URL must match security.txt URL itself, Preferred-Languages BCP 47 / ISO 639-1 validation, Ac

Paid Subresource Integrity hash-match verifier — fetches every <script src=> + <link rel=stylesheet/modulepreload/preload href=> with integrity attribute, SHA-256/384/512-hashes the bytes and compares to declared base64 digest, returns resources_checked + resources_matched + resources_mismatch + resources_failed + crossorigin_proper count + per-resource sha384_actual_b64/match_algo/mismatch_reason

Paid HTTP-method policy + dangerous-method exposure audit — OPTIONS Allow/DAV/ACAO/ACAM + TRACE echo-back + CONNECT + PUT/DELETE/PATCH write exposure + 4 method-override header sniffing (X-HTTP-Method-Override/X-Method-Override/X-HTTP-Method/X-Method) + CORS preflight probe (Origin evil.example + Access-Control-Request-Method DELETE), returns http_method_score 0-100 A-F grade via x402

Paid deep Content-Security-Policy analyzer — parses ALL 4 CSP delivery mechanisms (header + meta + report-only variants), classifies each source value (wildcard/scheme/host/nonce/hash/unsafe-inline/unsafe-eval/strict-dynamic/wasm-unsafe-eval/inline-speculation-rules), checks 22 critical directive coverage (default-src/script-src/style-src/img-src/object-src/frame-ancestors/base-uri/form-action/etc

Paid form security + accessibility audit — per-form action analysis (empty/#/javascript:/data:/mixed-content http-on-https), method (GET with passwords = credential-in-URL), enctype (text/plain CRLF injection), target=_blank tabnabbing, CSRF token detection (named csrf/csrfmiddlewaretoken/authenticity_token + 32+ char base64 heuristic), hidden-field enumeration, password-field autocomplete (off =

Paid CORS policy audit — baseline GET captures all Access-Control-* response headers (ACAO/ACAC/ACAM/ACEH/ACMA/ACRPN/ACEP/ACEN), dangerous-combo detection (ACAO=* + ACAC=true, ACAO='null', attacker-origin echo), preflight probe (Origin: https://evil.example + Access-Control-Request-Method: DELETE), Vary: Origin detection, cors_policy_score 0-100 A-F grade via x402

Paid cache-freshness strategy audit — probes HTML page + /favicon.ico + /robots.txt + /sitemap.xml + first stylesheet URL + first script URL; for each captures Cache-Control directives + ETag + Last-Modified + Age + Vary + Expires + Surrogate-Control + CDN headers + Set-Cookie count, scores per-asset cacheability_score 0-100 A-F, aggregate cache_freshness_score 0-100 A-F grade via x402

Paid deep TLS handshake probe — TLS version (1.0/1.1/1.2/1.3) + cipher suite classification (aead-strong/strong-fs/weak/legacy-fs) + ALPN negotiation (h2/http1.1) + Alt-Svc h3 HTTP/3 endpoint discovery + key_exchange group (ECDHE/DHE/static-RSA) + signature scheme (rsa_pss/ecdsa) + OCSP-stapling detection + session-ticket + cipher_security grade, tls_handshake_score 0-100 A-F via x402

Paid robots.txt vs meta robots vs X-Robots-Tag conflict detector — 4 conflict types (robots-disallow-vs-meta-index, robots-allow-vs-meta-noindex, X-Robots-Tag-noindex-vs-meta-index, X-Robots-Tag-index-vs-meta-noindex) + AI-bot-specific robots.txt directive capture (30+ AI crawlers) + redundant-signal flagging (defense-in-depth OK) + effective-path directive resolution, robots_meta_conflict_score 0

Paid JavaScript sourcemap exposure audit — fetches every external <script src> + probes inline-script //# sourceMappingURL= references + tries each .map URL via HEAD to surface public source-leak risk, sourcemaps_referenced + sourcemaps_publicly_fetchable + sourcemaps_blocked + ratio + sourcemap_score 0-100 A-F via x402

Paid JavaScript tracker/network fingerprint classifier — scans inline+external+meta+noscript for ~100 analytics/ad-pixel/session-replay/chat/heatmap/a-b-test/social-pixel/consent/tag-manager signatures across 10 categories, privacy-friendliness grade privacy-respecting/mixed/tracker-heavy, tracker_classify_score 0-100 A-F grade via x402

Paid URL safety audit (sandbox-friendly) — 12-signal heuristic preflight for AI agents deciding whether to render/embed a URL: scheme allowlist (http = medium risk, mailto/file/javascript/data = high), Suspicious-TLD catalog (52 Freenom/free-tld per Spamhaus style: tk/ml/ga/cf/gq/xyz/top/click/download/loan/work/review/country/stream/science/date/racing/win/account/bid/cricket/faith/trade/party/st

Paid CDN-edge fingerprint detector — 24-vendor catalog (Cloudflare/CloudFront/Fastly/Akamai/Vercel/Netlify/Google Cloud CDN/Azure Front Door/StackPath/BunnyCDN/KeyCDN/Cloudflare Workers/F5/WordPress VIP/Rackspace/Edgecast/VelocityEgress/Sucuri/SiteGround/SquareSpace/Wix/Shopify CDN/AHA-SLOWLY CDN), parses response headers + cookie-domain fingerprint + Server/X-Powered-By + edge-region via cf-ray/x

Paid structural-diff between two URL snapshots — fetches both with 10s timeout, extracts 17 comparable dimensions (title/description/canonical/OG title/desc/image/h1-count/heading-count/image-count/link-count/word-count/JSON-LD types/microdata types/response-bytes/status/content-type/redirect-chain-length), returns per-field changed+delta+severity-high/medium/low/none, changed_count/unchanged_coun

Paid PWA Web App Manifest audit via x402

Paid DNSSEC chain-of-trust audit via x402

Paid Certificate Transparency log auditor (cycle 85, x402 $0.001) - GET ?domain=<DOMAIN> queries crt.sh for issued certificates and reports issuer distribution, certificate records, first/last-seen timestamps and an A-F graded ct_score. via x402

Paid rate-limit policy inference + adaptive burst probe — parses RFC 9239 RateLimit-* + X-RateLimit-* + X-Rate-Limit-* + Retry-After + vendor-specific headers (GitHub/Shopify/Anthropic/OpenAI) + optional N-request burst (default 8, max 30) to surface 429 ratio + Retry-After pattern; classifies policy fixed_window / sliding_window / leaky_bucket / token_bucket / explicit_rfc9239 / none_detected; re

Paid Wayback Machine CDX-API archive availability audit — snapshot_count, first_snapshot, last_snapshot, age_at_first_snapshot_days, age_at_last_snapshot_days, years_active, snapshots_per_year, is_archived, is_recently_archived (last capture <=365d), wayback_machine_url, ai_cache_present, dnt_year_intensity (top 10 years), http_response_code_newest, wayback_snapshot_score 0-100 A-F grade via x402