Audityxe

Technical Product Deep Dive

Audityxe: The Evidence-Based Website Inspection Engine

Zero-queue real-time network checks, Generative Engine Optimization (GEO) audits, deterministic scoring math, and open-source transparency.

📦 Repository: github.com/zelvior/audityxe

🧑‍💻 Creator: Zelvior Labs

📜 License: Custom Open Source (ACOL-1.0)

🚀 Status: Production Live

Executive Summary

Audityxe is an open-source, zero-delay website audit engine created by Zelvior Labs. Unlike conventional audit platforms that rely on cached database snapshots, artificial delay queues, or generative LLM halluncinations, Audityxe initiates live HTTP, TLS, and DNS network requests the exact instant a URL is submitted. It evaluates web properties across six distinct categories plus a comprehensive deep-crawl module, proving every flaw with raw header, selector, or record evidence.

How Audityxe Outperforms Traditional Audit Tools

Dimension	Standard Audit SaaS Platforms	Audityxe Engine
Data Pipeline	Stale cached indexes or estimations	Live socket connection made on demand
Reproducibility	Scores fluctuate unpredictably	100% Deterministic mathematical scoring
Evidence Quality	Generic advice ("Improve titles")	Exact header value, selector, or DNS record
Unverifiable Checks	Counts timeouts as immediate failures	Excludes timed-out items safely from score
Data Retention	Permanent server report storage	Privacy-first: Only domain, score, date stored

Deep-Dive Audit Engine: What Gets Inspected

Audityxe inspects every target URL without requiring paid third-party API credentials, running dozens of precise automated checks instantaneously.

1. SEO & Crawlability Inspection

• Title Tag Diagnostics: Checks existence, character counts, truncation risk, and flags duplicate <title> elements.
• Meta Description Validation: Measures ideal character ranges and snippet display safety.
• Canonical Tag Integrity: Detects conflicting, self-referential, or duplicate canonical declarations.
• Heading Hierarchy: Validates single <h1> usage, sequential heading levels (H1 → H2 → H3), and duplicate heading texts.
• Live robots.txt Parsing: Validates file presence, fetches rules live, identifies blanket-disallow directives, and checks cross-referenced sitemaps.
• XML Sitemap Audit: Verifies sitemap.xml accessibility, link count, and freshness timestamps.
• Social Graph Completeness: Evaluates Open Graph tags, Twitter Card metadata, live image URL resolution, and fb:app_id.
• Structured Data (JSON-LD): Parses and validates Schema typing for Organization, Product, Article, FAQPage, BreadcrumbList, LocalBusiness, and WebSite.
• Internal Link Sampling: Tests sample internal links for HTTP status integrity.

2. AI Crawler Readiness & Generative Engine Optimization (GEO)

• AI User-Agent Allowlisting: Checks robots.txt specifically for blocking rules targeting GPTBot, ChatGPT-User, ClaudeBot, Claude-Web, anthropic-ai, PerplexityBot, Google-Extended, CCBot, Bytespider, and Applebot-Extended.
• Emerging llms.txt Parsing: Verifies presence and contents of the /llms.txt and /llms-full.txt structural standards designed for Large Language Models.
• HTTP X-Robots-Tag Analysis: Uncovers indexing blocks served through response headers invisible to DOM-only parsers.
• Directive Conflict Detection: Uncovers contradictions between HTTP headers and HTML meta tag directives.
• AI Model Training Opt-Outs: Checks for explicit noai and noimageai directives.

3. Security & HTTP Header Analysis

• Content Security Policy (CSP): Checks for CSP presence and flags dangerous structural directives like unsafe-inline, unsafe-eval, or wildcard definitions.
• Security Header Hardening: Audits HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP/COEP/CORP, and Clear-Site-Data.
• Cookie Flag Inspection: Verifies Secure, HttpOnly, and SameSite flags per cookie, distinguishing session vs persistent tracking heuristics.
• CORS Misconfigurations: Flags dangerous combinations like wildcard origins coupled with credential support.
• Information Leakage: Detects version exposure in Server and X-Powered-By headers.
• Exposed Asset Probing: Safely probes for public exposure of .env, .git, configuration files, and open directory listings.
• Subresource Integrity (SRI): Checks whether cross-origin CDN scripts and stylesheets utilize integrity hashes.
• Source Map & Tabnabbing Risk: Detects publicly readable JavaScript source maps and missing rel="noopener" attributes on target="_blank" links.

4. TLS Handshake & DNS Infrastructure

• Live TLS Socket Inspection: Analyzes active cipher suites, protocol versions, issuer certificates, validity timeframes, expiry countdowns, SAN counts, key lengths, and flags self-signed certs.
• Email Authentication Suite: Queries live DNS records for SPF, DKIM, and DMARC policy enforcement.
• DNSSEC & CAA Records: Confirms zone signing integrity and Certificate Authority Authorization restrictions.
• Subdomain Takeover Vulnerabilities: Checks CNAME records against 20+ known vulnerable SaaS platform fingerprints.
• Nameserver Redundancy & security.txt: Assesses zone resilience and standard RFC 9116 vulnerability disclosure policies.

5. Accessibility (a11y) & Usability

• Image Alt Text Coverage: Detects missing, generic, or redundant placeholder image descriptions.
• Form Label & Accessible Name Association: Verifies button names, explicit form controls, and link labels.
• Generic Link Text Warnings: Flags uninformative link strings such as "click here", "more", or "read details".
• Keyboard Focus Outline Protection: Detects harmful CSS rules suppressing outline focus indicators without replacement.
• Landmark Regions & Language: Validates <html lang> declarations and proper placement of header, nav, main, and footer ARIA regions.

6. Performance, Core Web Vitals & Mobile Inspection

• Lighthouse Pass via Google PSI: Measures LCP (Largest Contentful Paint), CLS (Cumulative Layout Shift), TBT (Total Blocking Time), FCP, and Speed Index.
• Real-World CrUX Field Data: Automatically separates simulated lab metrics from actual Chrome User Experience Report field data when available.
• Adaptive Render Proof: Captures real Chrome screenshots. Utilizes CSS device queries so mobile visitors see the native mobile viewport capture while desktop users view the high-resolution desktop frame.
• Resource Optimization: Identifies render-blocking CSS/JS, uncompressed assets, missing cache headers, and excessive inline base64 strings.

7. Content Quality, UX & "Vibe-Coded" AI Pattern Detection

• Readability & Word Counts: Calculates Flesch-Kincaid grade level and estimated reading time.
• AI-Generated ("Vibe-Coded") Heuristics: Detects robotic content patterns including emoji-dense headings, corporate buzzword saturation, high em-dash frequency, stock UI gradients/grain, default font pairings, and unreplaced lorem ipsum text.
• Legal & Trust Signal Matching: Scans for privacy policy, terms, contact, refund, and shipping pages matched against identified site types.
• Tech Stack Fingerprinting: Identifies underlying web frameworks, CMS engines, analytics tools, hosting providers, and payment gateways.

The Scoring Model: Pure Deterministic Mathematics

Unlike AI-driven evaluation tools that invent scores based on probability, Audityxe utilizes a strict, repeatable mathematical formula.

Finding Statuses & Severities

Every check resolves into a clear status: Pass, Warn, or Fail.

Severities are categorized as critical, high, medium, or low.

Mathematical Formula

Module scores (0–10 scale) are computed as:

Score = 10 − (Weighted Severity Loss / Scored Findings) × 10

Unverifiable findings (e.g., DNS timeouts) are completely excluded from scoring math rather than penalizing the site.

Site Crawl Engine: Fast vs. Deep Modes

Audityxe offers two distinct internal crawling strategies tailored for different performance budgets:

Default Strategy

Fast Crawl Mode

• Scope: Up to 6 pages sampled from homepage & sitemap.
• Parsing: Light Regex-based extraction.
• Speed: Executes in 2–5 seconds.
• Concurrency: 3 in flight.

Deep Traversal Engine

Deep Crawl Mode

• Source: lib/site-crawl-deep.ts (Lazy imported).
• Scope: Up to 25 pages, 3 hops deep using real Cheerio DOM parsing.
• Compliance: Fetches robots.txt and respects Disallow rules.
• Resilience: Request queue, session UA rotation, and retries with backoff.

Export Ecosystem & Growth Loops

📄 PDF Reports

Branded client-ready PDFs compiled using jsPDF, containing category donuts, evidence logs, and embedded render screenshots.

🏷️ Live SVG Badges

Embeddable "Audited by Audityxe" badge (/api/badge/[domain]) linking back via clean dofollow links to drive organic backlink loops.

📝 Markdown & JSON

Raw structured payload for instant copy-pasting into GitHub Issues, PR descriptions, Notion, or automated CI pipelines.

Modern Technical Architecture

Audityxe is built with a high-performance, edge-ready tech stack designed for speed and security:

Core Framework: Next.js 14 (App Router) + React 18 + TypeScript

Styling & Animations: Tailwind CSS (Variable Design Tokens) + Framer Motion

Database & Auth: Firebase Firestore + Auth (Server & Client SDKs)

Monetization Engine: NOWPayments Crypto Gateway (HMAC-SHA512 IPN)

Performance API: Google PageSpeed Insights API

PDF & Utilities: jsPDF + Lucide React Icons

Deployment & Configuration Guide

To run Audityxe locally or deploy it to Vercel, clone the repository and configure your environment variables:

git clone https://github.com/zelvior/audityxe.git cd audityxe npm install cp .env.example .env.local npm run dev

⚠️ CRITICAL CONFIGURATION: PageSpeed Insights API Setup

When creating your PageSpeed API key in Google Cloud Console, you must set Application Restrictions to "None". Setting an HTTP Referrer restriction will break server-side API calls, resulting in permanent HTTP 403 errors, because server-to-server requests carry no browser Referer header.

Crypto Checkout & Webhook Security

Audityxe integrates crypto payments via NOWPayments hosted invoices. The Instant Payment Notification (IPN) handler in /api/payments/nowpayments/ipn implements bank-grade security:

• HMAC-SHA512 Verification: Signatures are calculated over recursively key-sorted JSON payloads and validated using constant-time string comparisons.
• Raw Request Buffer Matching: Verifies signatures directly against the raw body buffer to prevent payload key reordering bugs.
• Transactional Idempotency: Payment IDs are recorded in Firestore to prevent duplicate plan crediting during retries.
• Stackable Plan Time: Purchased standard/pro duration stacks onto remaining active user balance.

Licensing: Audityxe Custom Open-Source License (ACOL-1.0)

Audityxe is released under a custom source-available license designed to grant maximum freedom while protecting creator credit.

License Terms Summary

You are free to study, modify, deploy, fork, commercialize, and redistribute Audityxe under one mandatory condition:

Mandatory Attribution Rule:

You must clearly credit Zelvior as the original author in all deployments, forks, documentation, and media, providing a direct link back to the canonical source: https://github.com/zelvior/audityxe.

Experience Audityxe Today

Audityxe bridges the gap between opaque marketing tools and actionable engineering diagnostics. Test your site live, inspect the source code, or deploy your own instance today.

Launch Audityxe App Explore GitHub Repository

---

Created by Zelvior Labs with ❤ from Pakistan · GitHub · YouTube · Linktree