Beyond the Black Box: The Engineering, Math, and Architecture Behind Audityxe’s Deterministic Audits

Zelvior — Sat, 26 Sep 2026 00:04:51 +0000

Meta Description: An exhaustive, human-authored technical deep dive into Audityxe—how it replaces cached scans and LLM guesswork with live network probes, deterministic scoring math, AEO/GEO evaluation, and developer-first CI/CD tools.

If you have ever pasted a URL into a website audit tool, you have likely encountered two major frustrations:

The Stale Database / Black Box: Enterprise platforms that place your request into a slow queue, compare your site against cached database snapshots from weeks ago, and hand back an arbitrary score based on proprietary formulas no developer can inspect.
The LLM Hallucination: Modern "AI wrapper" tools that feed a brief page description into a Large Language Model and ask it to guess a score out of 100—producing completely different numbers every time you run the test against an unchanged page.

Neither approach works when you are shipping production code. Web developers, SEO strategists, agency owners, and security engineers need reproducible, evidence-based metrics derived directly from real-time network requests.

Audityxe was built by Zelvior to set a new standard for web diagnostics. Operating on a strict zero-black-box philosophy, Audityxe executes a live, deterministic inspection against your exact target URL every single time.

Here is the complete architectural breakdown of how Audityxe probes a site, calculates its scores, evaluates modern search frontiers like AI Answer Engine Readiness (AEO/GEO), crawls multi-page structures, and integrates into developer workflows via terminal and CI/CD pipelines.

1. The Instant You Submit a URL: Live Probing Pipeline

When you hit Analyze Now, there are no pre-cached lookups, background queue delays, or saved screenshot retrievals. The audit engine makes an immediate, direct HTTP request to the target URL—reading raw HTML and HTTP response headers exactly as a live browser or search engine crawler receives them.

                            [User URL Input]
                                   │
       ┌───────────────────────────┴───────────────────────────┐
       ▼                                                       ▼
[Live Direct HTTP Fetch]                             [Parallel Network Probes]
├── Follows HTTP Redirects                           ├── /robots.txt (AI crawlers & rules)
├── Hop Count Tracking                               ├── /sitemap.xml (Freshness & syntax)
├── HTTPS-to-HTTP Downgrade Check                    ├── /llms.txt & /llms-full.txt (AI declaration)
└── Raw Headers & HTML Parsing                       ├── /ads.txt (Monetization entries)
                                                     ├── Link Probe (Up to 10 via HEAD/GET)
                                                     ├── Image Probe (Up to 8 via HEAD)
                                                     └── og:image (Live asset resolution)
                                                               │
                                                               ▼
                                                     [Real Chrome Engine]
                                                     ├── PageSpeed Insights (Core Web Vitals)
                                                     └── CrUX Dataset (28-day Real User Field Data)

Direct Network Probes Executed

During a single audit execution, the engine fires a suite of parallel, lightweight network requests:

Target Page Fetch: Follows real HTTP redirects, measures the total redirect hop count, and flags security regressions (such as an insecure HTTPS-to-HTTP downgrade).
robots.txt: Fetched live to inspect crawl directives, detect blanket blocks (Disallow: /), verify sitemap cross-references, and check explicit rules for named AI crawlers (GPTBot, ChatGPT-User, ClaudeBot, Claude-Web, anthropic-ai, PerplexityBot, Google-Extended, CCBot, Bytespider, Applebot-Extended).
sitemap.xml: Checked for live HTTP status, XML structure validity, total URL count, and freshness indicators.
llms.txt & llms-full.txt: Examined for presence and structured text content designed specifically for LLM context ingestion.
ads.txt: Evaluated for monetization compliance where applicable.
Sub-Resource Link & Image Probes: Live samples up to 10 on-page internal/external links and 8 images using HTTP HEAD/GET requests to identify 404 Not Found, 410 Gone, or server error statuses.
Open Graph Asset Verification: The declared og:image URL is fetched live to confirm it resolves and returns a valid image payload (image/png, image/jpeg, etc.).
Chrome UX Report (CrUX) Field Data: Pulls 28-day real-user Core Web Vitals aggregated from actual Chrome users. This API call runs for all plans because it queries Google's public dataset directly rather than spawning a heavy browser instance.
Real Chrome Browser Pass (PageSpeed Insights): Renders the page inside Chrome via Google’s PageSpeed Insights engine to capture Core Web Vitals (LCP, CLS, TBT, FCP, Speed Index) and capture real viewport render screenshots.

2. Deterministic Scoring Math vs. Language Models

A primary engineering boundary in Audityxe is the complete separation between deterministic measurement and written commentary.

Feature	How It Operates in Audityxe	Why It Matters
All 6 Category Scores & Findings	100% Deterministic. Computed by fixed algorithms parsing raw HTML, response headers, DNS records, TLS certificates, and Lighthouse DOM trees.	Re-testing an unchanged page produces the exact same numerical score every single time.
Written Commentary & Verdicts	Powered by optional language models (or built-in fallback copy generators).	AI is used strictly for human-readable summaries and promo copy. An LLM never touches, influences, or guesses a numerical score.

The Mathematical Formula

Every check yields a status of pass, warn, or fail, accompanied by an explicit severity level (critical, high, medium, or low).

Each category score out of 10 is derived using a fixed mathematical deduction formula:

$$\text{Category Score} = 10 - \left( \frac{\text{Weighted Severity Loss}}{\text{Total Scored Findings}} \right) \times 10$$

Critical Mathematical Safeguards

Unverifiable Findings Are Never Penalized: If a third-party service times out or a DNS lookup encounters a temporary lookup issue, the check is explicitly classified as unverifiable. It is excluded from the mathematical denominator entirely—never scored as zero and never counted as a failure.
Zero-Data Safety (—): If every single check in a module is unverifiable, the system reports — (not scored) rather than manufacturing an artificial score out of thin air.
Critical Override: Any finding flagged with critical severity forces the entire module into a critical status regardless of arithmetic averages. Dangerous vulnerabilities (such as exposed .env files or active tabnabbing risks) cannot be hidden behind high scores in other areas.
Radar / Vector Visualization: In addition to standard score bars, Audityxe provides a vector radar view plotting all six categories simultaneously. This visualizer reads directly from the exact same category score array, ensuring total alignment across all views.
Moving Yardstick Protection: Audityxe applies the exact same strict benchmark to every single site. There is no curve per industry, no "lenient mode" for personal projects, and no manual override. A 7.5/10 means the exact same thing across two completely unrelated websites or across audits conducted months apart.

3. What Audityxe Scans: The 6 Core Categories & Deep Modules

Audityxe organizes page diagnostics into six scored primary categories, plus dedicated deep-audit modules.

                             ┌──────────────────────────────────┐
                             │          Overall Score           │
                             └────────────────┬─────────────────┘
                                              │
       ┌───────────────────┬──────────────────┼──────────────────┬──────────────────┐
       ▼                   ▼                  ▼                  ▼                  ▼
┌──────────────┐    ┌──────────────┐   ┌──────────────┐   ┌──────────────┐   ┌──────────────┐
│ Technical &  │    │  SEO & Crawl │   │ Security &   │   │  TLS & DNS   │   │ Accessibility│
│ Metadata     │    │  Foundations │   │ Headers      │   │  Integrity   │   │ (a11y)       │
└──────────────┘    └──────────────┘   └──────────────┘   └──────────────┘   └──────────────┘
                                              │
                                              ├─────────────────────────────────────┐
                                              ▼                                     ▼
                                     ┌──────────────────┐                  ┌──────────────────┐
                                     │ UX, Hygiene &    │                  │ AI Answer Engine │
                                     │ Core Web Vitals  │                  │ Readiness (AEO)  │
                                     └──────────────────┘                  └──────────────────┘

A. Technical & Metadata Health

Verifies essential page setup: <doctype html>, document language (<html lang>), charset declarations, mobile viewport configurations, title tag presence and length, duplicate <title> tag detection, meta description length and truncation risks, and canonical URL consistency (catching conflicting or duplicate canonical tags).

B. SEO Foundations & Crawlability

Heading Hierarchy: Enforces a single H1, validates logical nested H2/H3 order, and flags duplicate heading text.
JSON-LD Schema Validation: Parses, validates, and classifies structured data types, including Organization, Product, Article, FAQPage, BreadcrumbList, LocalBusiness, and WebSite.
Social Cards: Verifies Open Graph (og:image, og:title) and Twitter Cards (twitter:creator, twitter:image).
Live Discovery: Checks robots.txt and sitemap.xml live on the server, ensuring sitemap cross-references exist and function.

C. Security, Headers & Infrastructure

Directly inspects HTTP response headers, server flags, and filesystem exposes:

Response Headers: Audits Content-Security-Policy (CSP)—flagging dangerous directives like unsafe-inline, unsafe-eval, or wildcard sources—alongside HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, COEP, CORP, and Clear-Site-Data.
Cookie Flags: Inspects every cookie for Secure, HttpOnly, and SameSite attribute enforcement, flagging persistent tracking risks.
Server Footprint: Identifies version disclosure headers (Server, X-Powered-By) and tests dangerous HTTP methods.
Filesystem & Source Leakage: Scans for publicly exposed .env, .git, source maps (.map), and directory listings.
DOM Security: Detects target="_blank" tabnabbing risks (missing rel="noopener"), insecure forms submitting over plain http://, CORS wildcard misconfigurations, Subresource Integrity (SRI) on external scripts, and mixed content warnings.

D. TLS Handshake & DNS Integrity

Executes raw network queries against infrastructure:

TLS Handshake Inspection: Connects directly to analyze TLS protocol version, cipher suite strength, certificate issuer, validity window, remaining days until expiration, self-signed status, hostname matching, SAN count, and key length.
Email Authentication: Queries live SPF, DKIM, and DMARC DNS records to verify domain spoofing protection.
Domain Security: Verifies DNSSEC signatures, checks CAA records for certificate authority restrictions, inspects nameserver redundancy, parses security.txt vulnerability policies, and screens against 20+ known service footprints for subdomain takeover risks.

E. Accessibility (a11y)

Combines static DOM heuristic checks with rendered Lighthouse output:

Evaluates image alt coverage and identifies generic alt-text placeholders (e.g., "image.png" or "photo").
Verifies form input label associations, accessible names on buttons/links, and generic link text ("click here", "read more").
Focus Outline Suppression: Catches toxic CSS patterns that suppress the keyboard focus outline (outline: none or outline: 0) without supplying a visible alternative.
Checks skip-to-content links, ARIA root attributes, positive tabindex misuse, <iframe title> tags, landmark regions (header, nav, main, footer), and color contrast ratios.

F. UX, Performance & Core Web Vitals

Google PageSpeed Insights Engine: Renders the target URL inside headless Chrome to capture Core Web Vitals: Largest Contentful Paint (LCP), Cumulative Layout Shift (CLS), Total Blocking Time (TBT), First Contentful Paint (FCP), and Speed Index.
CrUX Real-User Field Data: Displays 28-day historical performance data from actual Chrome visitors.
Render Proof Screenshots: Displays real Chrome viewport screenshots (with independent mobile and desktop captures selected dynamically by the visitor's device size).
Technical Hygiene: Checks compression (Gzip/Brotli), cache headers, lazy-loading image patterns, render-blocking scripts, font weight overhead, inline base64 bloat, and touch icon configurations.

4. Deep Module: AI Answer Engine Readiness (AEO & GEO)

Search behavior is shifting toward conversational AI platforms like ChatGPT, Perplexity, and Claude. Audityxe evaluates two distinct dimensions of modern AI readiness:

                            ┌─────────────────────────────────────────┐
                            │    AI Answer Engine Readiness (AEO/GEO) │
                            └────────────────────┬────────────────────┘
                                                 │
                   ┌─────────────────────────────┴─────────────────────────────┐
                   ▼                                                           ▼
┌──────────────────────────────────────────────┐            ┌──────────────────────────────────────────────┐
│ Generative Engine Optimization (GEO - Crawl) │            │  Answer Engine Optimization (AEO - Content)  │
├──────────────────────────────────────────────┤            ├──────────────────────────────────────────────┤
│ • Named AI bot rules in robots.txt           │            │ • Citable Schema (FAQPage, HowTo, Speakable) │
│ • llms.txt & llms-full.txt existence         │            │ • Headings phrased as direct user questions  │
│ • X-Robots-Tag HTTP response header blocks   │            │ • Definition-first opening paragraphs        │
│ • Header vs Meta tag conflict detection      │            │ • Self-contained summary sections            │
│ • noai / noimageai opt-out directives        │            │                                              │
└──────────────────────────────────────────────┘            └──────────────────────────────────────────────┘

1. Crawl Access (GEO - Generative Engine Optimization)

Explicit Bot Rules: Scans robots.txt for explicit allow/disallow directives targeting named AI agents (GPTBot, ChatGPT-User, ClaudeBot, Claude-Web, anthropic-ai, PerplexityBot, Google-Extended, CCBot, Bytespider, Applebot-Extended).
llms.txt Parsing: Verifies the presence of /llms.txt and /llms-full.txt files containing clean, structured summaries for LLMs.
HTTP Header Directives: Inspects the X-Robots-Tag HTTP response header. Standard SEO audit tools only parse HTML <meta name="robots"> tags, completely missing index blocks enforced directly at the web server layer.
Opt-Out Directives: Flags noai and noimageai training restrictions.

2. Content Shaping (AEO - Answer Engine Optimization)

Citable Schema Types: Checks for schema structures designed for direct answer extraction (FAQPage, HowTo, Speakable).
Question-Phrased Headings: Evaluates whether headings are formatted as explicit user questions ("How does X work?") rather than passive labels ("Features"). AI models extract answers far more reliably when heading targets match conversational queries.
Definition-First Opening Paragraphs: Checks for concise, self-contained definition statements positioned immediately below primary headers—the exact structural pattern LLMs look for when generating brief summaries.

5. Site Crawl Engine: Fast vs. Deep Modes

While basic audits focus on a single landing page, Audityxe includes a multi-page site crawl module (lib/site-crawl.ts & lib/site-crawl-deep.ts) to discover orphan pages, broken internal links, and structural issues. Users can toggle between two modes:

Feature	Fast Crawl Mode (Default)	Deep Crawl Mode
Discovery Source	Homepage links + `/sitemap.xml` seeds	Multi-hop queue following links across visited pages
Max Pages Sampled	Up to 6 pages	Up to 25 pages
Crawl Depth	1 hop from homepage	Up to 3 hops deep
HTML Parser Engine	Lightweight Regex extraction	Real DOM traversal via `cheerio`
`robots.txt` Respect	Basic check	Parsed once; Disallow rules enforced before queuing
Request Retries	No retries	Automatic retry with exponential backoff on `429`/`503`
Concurrency Pool	3 parallel requests	5 parallel requests
Execution Budget	~2–5 seconds	Up to 40s internal budget (overall timeout scales to 60s)

6. Evidence-Based Fixes: No Generic Advice

Generic auditing tools often provide unhelpful summaries like "Improve your performance" or "Optimize meta tags."

Audityxe attaches an Evidence Line to every single finding. Deductions cite the exact header value, missing tag, or DOM element observed during the scan:

[FAIL] X-Content-Type-Options Header Missing
Severity: High
Evidence: Sent live GET request to https://example.com — response headers did not contain 'x-content-type-options: nosniff'.
Fix: Add 'X-Content-Type-Options: nosniff' to your web server configuration or HTTP response headers.

Fixes are template-based and include explicit before-and-after code snippets, allowing engineers to verify the issue in view-source, deploy the update, and re-audit to confirm the score update.

7. Developer Ecosystem: Terminal CLI, GitHub Actions, and REST API

Audityxe's deterministic engine is designed to run anywhere code is shipped—locally in the terminal, inside CI/CD pull request gates, or programmatically via API.

                           ┌─────────────────────────────────────────┐
                           │      Audityxe Deterministic Engine      │
                           └────────────────────┬────────────────────┘
                                                │
       ┌────────────────────────────────────────┼────────────────────────────────────────┐
       ▼                                        ▼                                        ▼
┌───────────────────────────────┐    ┌───────────────────────────────┐    ┌───────────────────────────────┐
│     Terminal CLI Package      │    │      GitHub Action Gate       │    │     OpenAPI 3.0 REST API      │
│     `audityxe-cli` on npm     │    │    `zelvior/audityxe@main`    │    │      `/api/audit` Endpoint    │
└───────────────────────────────┘    └───────────────────────────────┘    └───────────────────────────────┘

A. Terminal CLI (`audityxe-cli`)

Runs the full audit engine locally on your own machine. It requires no user account, no API keys, sends no data to remote servers, and has no rate limits.

# Run a quick terminal audit against any site
npx audityxe-cli https://example.com

# Enforce a score threshold in CI pipelines (exits with status code 1 if score < 80)
npx audityxe-cli https://example.com --deep --min-score 80

# Run a head-to-head comparison between two URLs
npx audityxe-cli https://example.com --compare https://competitor.com

# Save scores locally to track historical performance trends over time
npx audityxe-cli https://example.com --track
npx audityxe-cli history https://example.com

# Export machine-readable JSON for custom reporting
npx audityxe-cli https://example.com --json > report.json

B. Automated GitHub Action Gate

Block regressions before merging code by embedding Audityxe directly into your pull request workflows using action.yml:

name: Performance & Audit Gate
on: pull_request

permissions:
  pull-requests: write

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - name: Audit Staging Deployment
        uses: zelvior/audityxe@main
        with:
          url: https://staging.example.com
          min-score: "80"
          deep: "true"
          psi-key: ${{ secrets.PSI_API_KEY }}

C. REST API (`/api/audit`)

An OpenAPI 3.0 compliant endpoint (/api-docs) available for programmatic integrations. Pro plan users can generate atx_live_... API keys within the admin panel. Keys are authenticated using the x-api-key request header and inherit the account's daily quota limits.

curl -X POST https://audityxe.vercel.app/api/audit \
  -H "x-api-key: atx_live_your_api_key_here" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com"}'

8. Known Boundaries and Technical Limits

Audityxe explicitly outlines its operational boundaries to maintain measurement transparency:

JavaScript-Rendered Shells: Pure HTML parsing cannot evaluate content generated exclusively client-side via JavaScript before browser execution. (The real Chrome PageSpeed pass handles this gap for performance and accessibility metrics).
Ambiguous Status Codes (401/403/429): When sub-resource probes hit security filters that block automated requests, Audityxe classifies the response as Ambiguous rather than falsely reporting a dead link (404).
Environment Shifts: Re-running an audit against a URL with active A/B tests, feature flags, or edge routing changes will reflect those updates. This demonstrates real-time measurement accuracy rather than engine inconsistency.
Privacy Guarantees: Full audit payloads are never permanently saved on central servers. Aside from a minimal record (domain, score, date) maintained strictly to power embeddable /badge SVGs, reports are computed on-demand and delivered directly to the user's browser session.

9. Open-Source Licensing & Attribution Requirements

Audityxe is built and maintained by Zelvior. The project is published under the Audityxe Custom Open-Source License (ACOL-1.0):

Functional Source Code: The core audit engine, CLI package, mathematical scoring rules, and API endpoints are 100% open to use, modify, self-host, and build upon—even for commercial ventures.
Non-Negotiable Attribution: Any fork, public deployment, or derivative work must clearly and visibly credit Zelvior as the original author and include a direct link back to the canonical repository (https://github.com/zelvior/audityxe).
Visual Design Carve-Out (Section 1A): While the functional code is open, Audityxe’s unique UI design, layout, color tokens, visual identity, and brand assets are reserved and not open-source. Developers are encouraged to build custom interfaces around the underlying open engine.

NOTE: PLEASE READ THE LICENSE FIRST HERE AS IF IT MAYBE CHANGED Audityxe License.

Conclusion

Website auditing should be transparent, deterministic, and verifiable down to the individual HTTP header. By combining real-time network probing, real browser rendering, and strict algorithmic scoring, Audityxe gives developers an accurate, unvarnished benchmark for the modern web.

Test your domain today at Audityxe.
Read the live methodology at Audityxe Methodology.
Inspect the source code, CLI, and GitHub Action on GitHub.

DEV Community: Zelvior