SiteFit — Source library
Public documentation snapshot: 2026-09-08
Know exactly what to fix on your website first.
A scored, read-only audit of any website, plus the report you can hand straight to a client.
Know exactly what to fix on your website first.
Built for: A solo consultant who sells website audits and needs a deliverable that looks like a deliverable · A service business owner - law practice, clinic, trades, agency - whose site was built once and never looked at again · A nonprofit or community organisation with no budget for an agency retainer and no in-house web person · A local business that wants to show up in the map results and cannot work out why it doesn't
SiteFit exists because of this.
You have a website. Someone built it two or three years ago, or you built it yourself on a weekend, and since then it has mostly just sat there. You suspect it should be bringing in more calls, more enquiries, more foot traffic than it does. When you go looking for an answer you get two kinds of reply. A free online checker gives you a red letter grade and ninety findings in no particular order, most of them meaningless to you, none of them ranked. Or an agency quotes you a four-figure fee, disappears for three weeks, and comes back with a document that mostly restates the free checker in nicer fonts. Neither one answers the question you actually asked: what is broken, which of it matters, and what should I fix first. And a lot of the tooling quietly assumes you sell things online. Point it at a law practice, a plumbing company, a food bank or a two-person consultancy and half the report is about product feeds and catalog pages you will never have. The parts that would help you - whether search engines can even find your pages, whether your business shows up in the map results, whether the markup that identifies your organisation is correct - are buried under the parts that do not apply. Then there is the part nobody says out loud. To get a serious look at your site, you are usually asked to hand over the keys: an admin login, an add-on installed on the live site, a tracking script on every page, sometimes access to your analytics account. That is a real decision with real risk, and you are being asked to make it before you have any evidence the work is worth paying for. Plenty of good websites stay broken because the owner reasonably did not want to give a stranger that much access just to find out.
SiteFit exists because of this.
It reads only what any visitor can already see - no login, no add-on, no script on your pages - so you can commission an audit without granting anyone access to your site.
SiteFit exists because of this.
Drafted copy cannot skip review. The approval gate is enforced in code, which refuses to treat a draft as used until a person has approved it, rather than being promised in a contract.
SiteFit exists because of this.
The audit engine is shared with ShopFit, so a defect found while auditing one kind of site is fixed for both. Auditing ASL's own website surfaced a real structured-data reading defect that was fixed the same day.
SiteFit exists because of this.
It refuses to guess. When a measurement cannot be taken, or an optional paid data source is not in play, the report prints the reason instead of an invented number.
SiteFit exists because of this.
It will not score you on fashion. The AI answer-engine files are reported as information and never scored, with the reason stated: no major provider has committed to using them.
SiteFit exists because of this.
The deliverable is a document you own - PDF, Word or Markdown - not a dashboard login you lose access to.
SiteFit exists because of this.
The phone app performs the whole check on the device, keeps briefs encrypted locally, and blocks private and internal addresses so it cannot be aimed at something it should not read.
How SiteFit works, start to finish.
SiteFit takes one thing from you - a web address - and gives back a scored, ordered report on what search engines, crawlers and visitors can already see. It logs into nothing. It installs nothing. It never submits a form and never changes a byte on your site. Everything it reads is what any visitor's browser could request anyway, which is why an audit needs no admin account, no add-on, and no exception in anyone's security policy. The free audit scores fourteen areas out of ten, each with a plain sentence saying what it found, and adds two more when your site publishes a sitemap. Can crawlers reach you at all - is robots.txt there, is sitemap.xml there. Are your titles, descriptions and headings doing their job. Is the structured data that decides whether you get a rich result actually valid, including the packed single-block format that trips up a lot of readers. Do your images have alt text, do your share cards render, is the page too heavy, is anything obvious in the way of a screen reader. When a sitemap exists it also checks how stale the newest entry is and samples up to fifteen addresses out of it for dead links and needless redirect hops - the quiet failures that keep pages out of search for months and cost almost nothing to fix. For a business people search for by town, it scores the local business markup that map results depend on and reports which of the five identity fields - name, address, phone, opening hours, map coordinates - are present. Core Web Vitals, the page-experience scores Google publishes about your pages as a phone would see them, come back in the same report, so site speed stops being a separate conversation held with a different person. The report is the product. The audit console exports it as a PDF, a Word document or plain Markdown, laid out to be printed and read rather than scrolled. Consultants hand it to a client as the engagement deliverable; owners hand it to whoever maintains the site as a to-do list with the arguing already done. Every run is recorded against the site, so the next report shows the current score and how many points it moved since last time - and says plainly when a run is the first one rather than inventing a comparison. SiteFit can also be set up to re-run a site's audit on a schedule and email a short score digest after each run. If you also give SiteFit a short written description of the business - the name, what you do, your main offering - it can draft the growth pieces too: directory and citation listing copy, FAQ content, a plain-answer block for the AI engines that increasingly answer questions instead of listing links, and sample search-ad copy. Every one of those is written into a review queue first. The code refuses to treat a draft as used until a person has approved it, and nothing is ever published on your behalf. This is the newer half of the product: it is built and wired, ASL's own engineering notes record that it has not yet been run end to end, and ASL runs it by hand as a separate step rather than as part of the audit console. There is also SiteFit for Android: a real app that runs a twenty-signal readiness brief on the phone itself - response health, page weight, browser security headers, discovery and well-known files, page metadata, document structure, organisation markup and trust links. It needs no account and no credentials of any kind, keeps up to twenty encrypted briefs on the device that you can delete from the app, and refuses unencrypted addresses, non-standard ports, embedded credentials, and private or internal network addresses, so it cannot be pointed at something it has no business reading. On a Google Pixel 8 during device validation a full brief finished in 301 ms. It is the version you run in a car park five minutes before a client meeting.
Everything in the current release.
Each of these is built and working today. Nothing on this list is a roadmap item.
A free scored audit of any website
Give SiteFit a web address and it scores fourteen areas out of ten, each with a sentence saying what it found and why it matters, plus two more areas when your site publishes a sitemap. No account on your side, no catalog, no shopping platform, no credentials. It is the same first step whether you are a two-person consultancy or a charity with a ten-year-old site.
A report you can hand to a client
The audit console exports every run as a PDF, a Word document or plain Markdown, formatted for printing and reading rather than for a browser tab. Consultants use it as the deliverable in a paid engagement; owners hand it to whoever maintains the site. The numbers in the export are the same numbers in the report on screen - there is no second, prettier set.
Crawl and discovery checks
SiteFit checks whether robots.txt and sitemap.xml are there and make sense, how old the newest entry in your sitemap is, and samples up to fifteen addresses listed in it to find dead links and needless redirect hops. These are the quiet failures that keep pages out of search results for months without anyone noticing. They are also usually the cheapest things on the whole report to fix.
On-page and structured-data checks
Titles, meta descriptions, heading structure, image alt text, social share cards, favicon and manifest, and the schema markup that decides whether you get a rich result instead of a plain blue link. It flags placeholder values left in the markup, invalid JSON, and required fields missing from an entity. It reads sites that pack every entity into one block, a valid and widespread convention - auditing ASL's own website is what exposed a real defect in that reader, and it was fixed the same day.
Local business markup, scored against what map results need
If people find you by searching your town, SiteFit looks for the local business entity in your markup and reports which of the five identity fields it wants - name, address, phone, opening hours and map coordinates - are actually present. Be straight with yourself about one thing: this area is always scored, so a site with no local business entity scores zero there, and the report tells you in plain words to disregard it if you are not a local or physical business. ASL reads that area in context rather than treating a zero as a verdict.
Trust and experience signals
The report checks whether your pages carry an identifiable author byline or author markup, whether there is an about or team page to link to, and how complete the person or organisation entity in your markup is. For most service businesses these turn out to be the cheapest wins on the entire report: an about page that names real people, an organisation entity with a logo and real links, a byline on the content you publish.
Core Web Vitals in the same report
Performance, SEO, accessibility and best-practice scores from Google's public page-experience data appear alongside everything else, measured the way a phone sees your site, so speed is not a separate conversation with a separate supplier. When those numbers cannot be fetched, the report prints the reason out loud rather than showing you an invented figure.
AI answer-engine access, reported and never scored
SiteFit checks whether llms.txt and ai.txt - the files that tell AI answer engines what they may read - are present on your site, and reports it as information only. It is never scored, and the reason is written into the product: Google has said it does not use llms.txt, and no major AI provider has committed to treating either file as a ranking or citation signal. You get the fact, not a penalty and not a fashionable claim.
Score history and trend
Every run is recorded against the site, so the next report shows the current score and how many points it has moved since the last one, area by area. If you are paying someone to do this work, that line is the evidence it landed. The first run says it is the first run instead of inventing a comparison.
Scheduled repeat audits with a score digest
SiteFit can be set up to re-run a site's audit on a schedule and email a short digest: the latest score, whether it went up, down or is unchanged since the previous run, and which areas moved. The very first run never emails, because there is nothing yet to compare it to. Ask for the cadence you want - this is arranged per site with ASL rather than switched on by default.
Growth copy that cannot skip the approval step
Supply a short written description of the business and SiteFit can also draft directory and citation listing copy, FAQ content, a plain-answer block aimed at AI answer engines, and sample search-ad copy for your main offering. Each piece is written into a review queue, and the code will not let a draft be treated as used until a person has approved it - it refuses rather than skipping the step. Nothing is auto-published and nothing is sent anywhere. This is the newer half of the product and ASL runs it by hand as a separate step from the audit.
Read-only by design
SiteFit never signs in to your site, never installs anything on it, never submits a form and never edits a page. It reads only what a visitor's browser could already request. That means you can commission an audit without granting anybody an admin account, and without a change-control conversation about who touched the live site.
SiteFit for Android
A genuine Android app that runs a twenty-signal readiness brief on the phone itself: response health, page weight, five browser security headers, five discovery and well-known files, page metadata, document structure, organisation markup and trust links. It needs no account and no credentials, keeps up to twenty encrypted briefs on the device that you can delete from the app, and refuses unencrypted addresses, non-standard ports, embedded credentials and private or internal addresses. On a Google Pixel 8 during device validation a full brief finished in 301 ms. It is signed and validated on real hardware but has not been submitted to the Google Play Store.
Built for businesses with no online store
SiteFit deliberately leaves out everything that assumes you sell products online: no product feeds, no duplicate-description scoring, no shopping-platform readiness. That is a written engineering rule in the project, not an omission. If you do run a Shopify store, ShopFit is the sibling product that covers the catalog half using the same audit engine.
Numbers we can stand behind.
Every figure below comes from the product's own release record or test suite, not from a marketing estimate.
Numbers we can stand behind.
A score is treated as triage, not a verdict. The report states what it cannot prove as clearly as what it found, and ASL tells you which areas score presence rather than judgement.
Numbers we can stand behind.
ASL runs SiteFit against its own website before selling it to anyone.
Surfaces and status.
Status as of 2026-09-02. The audit console is deployed and responding at sitefit.autosecurelogin.com, confirmed by a live request on 2026-09-02 that redirected to ASL platform sign-in over HTTPS with strict transport, framing and content protections in place. The release running there is dated 2026-08-09, and on 2026-08-23 it was inspected read-only and its application files were confirmed to match the published source exactly. The audit itself has been run against real live websites including ASL's own since 2026-08-01, and that ASL run surfaced a real defect in the structured-data reader that was fixed the same day; the console that produces the PDF, Word and Markdown deliverables was deployed on 2026-08-04. A repeat-audit runner that records the score and emails a digest is part of the codebase, but no repeat schedule is currently running for anyone. SiteFit for Android 1.0.0 was signed and validated end to end on an emulator and a Google Pixel 8 on 2026-08-23; it is a separate app, is not part of the deployed console release, and has not been submitted to the Play Store. Read Available now as delivered as a service: reports are produced and handed over by ASL rather than through a customer sign-up. Dated
Worth more together.
Products on this platform share one sign-in, one support queue, and one engineering standard. These pair naturally with SiteFit.
ShopFit
If you do sell online through Shopify, ShopFit covers the half SiteFit deliberately leaves out - product copy, collection structure, feed readiness and catalog quality - built on the same audit engine, with the same rule that a merchant approves every change before it touches the live store.
ASL Scan
SiteFit tells you what the public web can see about your site. ASL Scan is the read-only security assessment for the machines and servers behind it, bounded by a signed scope naming exactly which systems may be looked at and when that permission expires.
Recent progress.
This product ships often. The most recent verified changes, newest first.
Recent progress.
2026-08-23 SiteFit for Android shipped as a signed 1.0.0 app - a twenty-signal readiness brief that runs entirely on the phone, up to twenty encrypted local briefs, strict refusal of unencrypted, non-standard-port, credential-bearing and private addresses, and a hand-off to the protected console in the system browser. It was validated end to end the same day on an emulator and on a Google Pixel 8, where a full brief finished in 301 ms, and on the same day the running release of the audit console was inspected read-only and confirmed to match the published source exactly. The app has not been submitted to the Play Store. Earlier in August the analytics and advertising groundwork was completed and locked down: read-only reporting, non-collecting validation only, everything created left paused and spending nothing, and live writes kept switched off.
Recent progress.
Pricing for SiteFit is quoted after a short conversation about your situation, because the right scope differs from one team to the next. There is no charge for that conversation.
What does it cost?
Pricing is not published, because SiteFit is delivered as a consulting engagement rather than a self-serve subscription - the work varies enormously between a five-page site and a five-hundred-page one. Ask for a quote and you get a fixed number before any work starts. The audit itself is the cheap part: it uses no paid data at all unless you specifically ask for the link-authority section.
Do I have to give you access to my website?
No, and this is the rule the whole product is built around. SiteFit reads only what a visitor's browser could already request from your public pages. There is no admin login to hand over, nothing to install, no script to add to your pages, and nothing that could change your site even by accident.
We already pay an agency. Why would we want this?
Use it as a second opinion you can put in front of them. The report is ordered by what matters, states the evidence behind each finding, and is written to be read by someone who does not do this for a living - which makes the next conversation with your agency a much shorter one. Because the score is recorded across runs, it also shows plainly whether the retainer you are paying is producing movement.
We already use a free online site checker. What is different?
Free checkers give you an unordered list and a grade. SiteFit gives you a scored report ordered by what matters, tells you in plain words which areas do not apply to your kind of business so you can set them aside, produces a document you can hand to somebody, and records the score across runs so you can see whether the work landed. And when a measurement cannot be taken, it prints the reason rather than filling the gap with a guess.
Is any of my data at risk?
SiteFit collects no visitor data, places nothing on your pages, and never receives an account credential of any kind. The Android app declares one permission - internet access - keeps its briefs encrypted on the device, and refuses to check unencrypted addresses, non-standard ports, addresses with credentials in them, or private and internal network addresses. Your report is a file you receive and keep.
What happens if we stop working with you?
Nothing breaks, because nothing was ever installed. Your reports are PDF, Word and Markdown files that are already yours, the fixes you made stay made, and there is no add-on to remove or account to unwind. There is no lock-in here because SiteFit never held anything of yours in the first place.
Is it actually ready, or am I paying to be somebody's first customer?
The audit and the report generation run today, behind a dated release, and have been used against real live websites including ASL's own. Two parts are honestly newer and you should hear them plainly: the drafted growth copy is built and wired to a review queue but ASL's own notes record that it has not yet been run end to end, and the advertising and analytics side is groundwork that runs no campaigns and spends nothing. The Android app is signed and validated on real hardware but has not been submitted to the Play Store. There is also no customer sign-up yet - ASL runs the audit and hands you the report.
Can you set it up to re-check my site automatically?
Yes, on request and per site. Once there is a first run to compare against, each scheduled run emails a short digest with the score, whether it moved up, down or not at all, and which areas changed. The first run never emails. Agree the cadence with ASL up front, because the digest reports after every scheduled run rather than only when something has changed.
Can you guarantee my rankings or traffic will improve?
No, and you should be wary of anyone who does. SiteFit tells you what is technically wrong and orders it by likely impact, which is the part that can be measured honestly. What a search engine does with a fixed site also depends on your competitors, your content and your market, none of which any tool controls.
What should I know before I rely on it?
We would rather you hear this from us than discover it later. As of 2026-09-02:
What should I know before I rely on it?
SiteFit reads what is publicly visible. It cannot see pages behind a login, and content that only appears after JavaScript runs may not show up in the check.
What should I know before I rely on it?
A score is a way of ordering work, not a verdict. It is not a certification, and it does not prove accessibility conformance, legal compliance, security, or that rankings or revenue will move.
What should I know before I rely on it?
Some areas score presence rather than judgement. A site that deliberately runs no analytics or tracking pixel, carries no review markup, or is not a local business will score low or zero in those areas even when nothing is wrong. Nothing is silently excluded from the total, so those areas have to be read in context - which is exactly what ASL does when writing up your report.
What should I know before I rely on it?
The local business check looks for a local-business-style entity in your markup. A site that identifies itself with a different entity type can read as not found even when its markup is otherwise fine, so treat that area as a prompt to look rather than as a finding.
What should I know before I rely on it?
Link health is sampled, not exhaustive: the audit checks up to fifteen addresses from your sitemap, so it finds patterns rather than every broken link on a large site. Sitemap freshness and link health only run at all if your site publishes a sitemap.
What should I know before I rely on it?
The link-authority section needs an outside data source that has to be paid for. Without one, that section is skipped cleanly and prints the reason - it is never estimated.
What should I know before I rely on it?
The drafted growth copy is the newer half of the product, and ASL's own engineering notes record that it has not yet been run end to end. It is built, it is wired to the review queue, and ASL runs it by hand as a separate step - it is not part of the audit console, and it is best treated as an extra rather than as part of the audit engagement.
What should I know before I rely on it?
The drafted growth copy needs a short written description of your business before it can be produced, and always requires a person to approve it. Nothing is published for you.
What should I know before I rely on it?
Scheduled repeat audits are arranged per site on request. Once a first run exists, the digest emails after each scheduled run and reports the score and its movement, including when nothing changed - it is not a silence-unless-something-moved alert, so agree the cadence you actually want.
What should I know before I rely on it?
Advertising and analytics work is groundwork only right now. SiteFit does not run campaigns, does not spend money, does not touch a live advertising account, and collects no analytics events from anyone's website.
Know exactly what to fix on your website first.
Prefer email? contact@autosecurelogin.com