WebTrustEngine
TREN
WEBSITE AUDIT, IMPROVEMENT AND DEVELOPMENT SERVICES

We audit your website, fix it, or build it correctly from the ground up.

WebTrustEngine measures security, accessibility, performance, SEO, structured data, privacy and AI readability readiness. It delivers a leadership-ready report, actionable fixes and a verified website through one evidence chain.

ENGINE CONTRACTEvery finding ships with its evidence file80CORE CHECKS+268GRANULAR CHECKS= 348 DETECTABLE CHECKSCLASSIFIED ACROSS 10 GOVERNANCE DOMAINSR5001Security02TLS·HTTPS03Technical SEO04Structured Data05Accessibility06Performance07AI·GEO·AEO08Cookies09Code Security10Delivery80 Core Checks · 268 Granular Checks · 68 Security Patterns26 SafeFix Generators · 53 Runtime Verification Bridges24 External Action RecipesEVIDENCE CHAINZIP and content hashes — the r20261028-03 baseline packageZIP 059d6436…6826 · content 734bc81b…1aaa01REVIEW02SAFE FIX03BUILD04DEPLOY-VERIFY

Every finding arrives with file-level evidence: leadership reads the report, your technical team verifies the annexes.

See what the audit produces: a sample executive report from a real run →

ENGINE CONTRACTEvery finding ships with its evidence file80CORE CHECKS+268GRANULAR CHECKS= 348 DETECTABLE CHECKSCLASSIFIED ACROSS 10 GOVERNANCE DOMAINSR500102030405060708091001 Security02 TLS·HTTPS03 Technical SEO04 Structured Data05 Accessibility06 Performance07 AI·GEO·AEO08 Cookies09 Code Security10 DeliveryR50 NUMBER ARCHITECTURE80 Core Checks268 Granular Checks68 Security Patterns26 SafeFix Generators53 Runtime Verification Bridges24 External Action RecipesEVIDENCE CHAINZIP and content hashes — the r20261028-03 baseline packageZIP 059d6436…6826 · content 734bc81b…1aaa01REVIEW02SAFE FIX03BUILD04DEPLOY-VERIFY

PRODUCT OVERVIEW

See where your website stands and decide what comes first

Detailed reading

WebTrustEngine examines your live website, your site archive or your local files. It brings the technical findings, the measurement gaps and the work to be done together in one place. The result is reporting leadership can decide on and an improvement plan your technical team can actually carry out.Measurement status is a separate indicator from the score: it states how many checks could be measured. Detail

Explore the audit service · Read the product guide

Live URL, ZIP and local-folder input · Executive report with technical annexes · Optional controlled improvement

Choose the starting point that fits your need

I want to know the condition of my website

See which problems come first, where further measurement is needed and which jobs your technical team can pick up straight away. Assess your current site, its state before a redesign, or the files your agency delivered.

Website audit and reporting

I want the problems on my existing site fixed

Turn findings into work that can be carried out. The applicable fixes are prepared on a separate working copy; you review the changed files, the re-measurement results and the rollback records together.

Improving an existing site

I want to develop a new website

Start from static site candidates built on your brand and content material. Review the page structure, the design and the technical readiness together, and settle the content migration, the integrations and the launch work up front.

New website design and development

What you have at the end of the audit

A decision brief for leadership. We gather the site's current condition, the priority findings, the measurement gaps and the recommended order of work into one narrative, so you can see the basis for allocating resources.

Actionable work for the technical team. Each finding reads as one unit: the affected pages or files, the observation behind it, the suggested action and the condition for retesting. We keep problems that spread through a shared template separate from one-off fixes.

Evidence you can inspect. We record which input, method, environment and date produced each result. Where the reporting flow allows it, we bind the Word and PDF documents, the technical records and the delivery-verification data to the same piece of work.

A way to judge what changed. We place the next audit alongside the earlier state with a comparable scope. Closed findings, new problems and the areas that could not be measured all stay visible.

Audit your website across domains that complete each other

DomainThe decision the audit helps you make
Technical SEO and contentWhich work comes first in page discovery, links, titles and content structure?
Structured data and organizational identityAre your organization, service and page details presented in a form machines can understand?
Security and infrastructureWhich security signals do your public responses and the supplied files carry?
Performance and resource useWhat loading and browser behaviour on the audited pages needs improvement?
Accessibility and usabilityWhat do the automated checks show, and which user tasks need separate assessment?
Mobile rendering and mediaHow do content, images, interaction targets and page layout behave in the selected viewport?
Privacy and third-party dataWhat storage and request behaviour was observed, and which further data would complete the assessment?
Project and change trackingWhat changed in the new release, and which work needs auditing again?

In the report we collect the topics in this table under the 10 domain headings further down this page. Which measurements actually run depends on the selected scope, the input, the tools and the data provided. The full feature index, the methods and the prerequisites live in the product guide.

Read the capabilities and their operating conditions

How the work proceeds

  1. We set the goal and the scope. Together we define the site address or the files, the purpose of the assessment, the page limit and the required measurements.
  2. We run the audit. The engine executes the applicable checks and records both the findings and the measurement gaps.
  3. We translate the results into decision language. We report the site assessment, the priorities, the need for further review and the technical work.
  4. We prepare the selected improvements. Where they are in scope, we apply the applicable SafeFix operations on the working copy; the remaining work goes into the relevant team's implementation plan.
  5. We measure the change again. We examine the effect of the fix and any regressions. Applying it to the live site and the decision to publish remain the responsibility of the authorised team.

If the fix scope is agreed at the outset, the engine can apply the applicable operations within the same run after the first analysis and re-check them before the final report.

From one finding to finished work

Suppose a form field is missing its accessible name. The audit points to the affected page and to the element itself. The technical team sets the right label; the re-check then assesses whether that same element meets the expected condition. Where more is needed to show that the form can be completed, the keyboard and assistive-technology tasks are examined separately as well.

Every technical sub-check is assessed together with the scope of the user task it belongs to.

Control over your data and your changes

WebTrustEngine works local-first. An offline ZIP or folder audit works only from the files you supply. Active security testing requires written authorisation and a separate scope document. The data requirements of any external services and additional measurements you choose are settled along with the scope.

A standard audit changes no source file. When you select SafeFix, we prepare the edits on a separate working copy. Decisions about content, design, integrations and going live stay with the people responsible for them.

What you may want to know before starting

Can a site that is not live yet be audited?

Yes. A file-level audit can run from a ZIP or a local folder. Live server, redirect and link behaviour is measured separately, once a suitable production or preview environment is available.

Does the audit fix every problem automatically?

Analysis and fixing are separate scopes. SafeFix can prepare the supported edits on a working copy once the information it needs is supplied. Content, infrastructure and application-development work is planned separately.

How should a high score be read?

Read a score together with the model used, the scope actually measured and the open findings. We show the areas that could not be measured, and the human judgements the remaining risk requires, separately.

How long does it take, and how is it priced?

Site size, the number of languages, the measurement scope, data preparation and the implementation needed determine the work plan. Duration, fees, support and delivery terms are settled on that scope.

Choose your first step

To learn where you stand, start with the audit scope. If you already hold a list of findings, look at the improvement process; if you are building something new, look at the design and development scope.

See the audit scope · See the improvement process · See the new-site scope

WHY GOVERNANCE?

The web is no longer a one-off project

Detailed reading

A website is now a human storefront plus a machine surface.

The page a visitor sees is simultaneously the input of dozens of automated readers. A page flawless for humans can carry missing headers, broken schemas and unclear identity signals for machines.

Even with great design, machine readability can be weak. Visual redesign projects rarely touch the meta layer, security headers or structured data; the site looks new while its audit surface stays old.

WHO USES IT

Who uses it, and when?

Four typical moments: an evidence-based snapshot before a corporate site renewal; independent acceptance of an agency delivery; a recurring governance round; and quick due diligence before a merger or transfer.

Detailed reading

WHAT IS R50?

Every published figure — counted from code

Detailed reading

R50 is WebTrustEngine's public capability set. Its distinguishing trait is number discipline: every published figure is counted from code.

NUMBER CONTRACT
348
detectable checks
80 core + 268 granular
R50
68
security patterns
static detection
R50
26
SafeFix generators
reversible
R50
53
runtime bridges
bind to live tools
R50
24
external recipes
platform actions

Claim safety

Every published claim is tied to code and an evidence file.

FOUR MODES

Review → SafeFix → Build → Deploy-Verify

Each mode produces its own evidence; no mode issues a live pass.

Detailed reading
  1. Review

    An evidenced baseline without touching a file: a score computed from eight scoring categories, plus findings classified across 10 domains.

    score + findings
  2. SafeFix

    Low-risk fixes in a working copy; every change is written to a manifest.

    fix manifestreversible
  3. Build

    A schema-ready static surface: meta, canonical, hreflang, JSON-LD, accessibility skeleton.

    static surfacereversible
  4. Deploy-Verify

    We pull live headers after upload and run the independent-tool recipes.

    live proof

The 10-domain audit and reporting model

We report findings under these ten headings. The overall score comes from the engine's eight scoring categories. Each domain's one-line scope follows; evidence, sample findings and boundaries live on the Score Model page.

01

Security Headers

HSTS · CSP · nosniff

02

TLS / HTTPS

encrypted transport

03

Technical SEO

meta · canonical · sitemap

04

Structured Data

JSON-LD identity

05

Accessibility

alt · label · heading

06

Performance

static readiness

07

AI / GEO / AEO

readability

08

Cookies

tracker visibility

09

Code Security

secrets · exposure · patterns

10

Delivery

deployment hygiene

Detailed reading

SAFEFIX

Not a rebuild — a safe improvement

Detailed reading
Evidence package visual of six deliverable cards.
The SafeFix evidence package: six delivery items.

The evidence package: files, not a score

We deliver the changed-files list, the rollback manifest and the before/after score together. Every change reverts in a single step.

See the process
Changed filesFlat list of every touched path.
FIX_MANIFEST.jsonPer-file before/after hashes.
ROLLBACK_MANIFEST.jsonThe single-step way back.

Every file in the evidence pack, explained →

DEPLOY-VERIFY

Producing files is not enough

Upload, cache purge, live header pulls and independent-tool recipes: we complete the evidence in production.

Detailed reading
Seven-step deployment verification flow.
The Deploy-Verify loop: seven steps from upload to the diff report.
  • Live header pull
  • robots/sitemap live
  • OG card refresh
  • Search Console submit
  • SSL Labs run

SECURITY BOUNDARY

Security review with no attack attempt — the boundary is in writing

In short: in an offline ZIP or folder audit the engine sends no requests to your site and looks for security signals only in the files you supply; in a live-URL audit it sends only passive, read-only requests to the target you designate.

A static security review is security analysis over source, configuration and output files without touching the target system. WebTrustEngine's security layer stays within this definition and has four blocks: secret scan (key/password/token leakage), exposed files (.env, backups, .git, config exposure), client-side risky patterns (eval, document.write, dangerous sinks) and server-side SAST classifications (SQLi/command/traversal/deserialization/SSRF/XXE markers).

SCA/CVE logic accompanies these: we flag the risky ranges of known library versions and bind each flag to an update recipe. CSP/HSTS readiness and OWASP mapping put findings into a shared language.

This product is not a penetration test. Any DAST-class behaviour requires written authorization, ownership verification and a separate scope document. So you know exactly what you bought and what must be ordered separately.

Boundary glossary — what does static scanning cover?
  • secret scan
  • exposed files
  • JS sink patterns
  • SCA/CVE flags
  • CSP/HSTS readiness
  • OWASP mapping
  • DAST = authorization + scope

Boundary

Active testing requires written authorisation; the engine offers static security review.

Get an evidenced snapshot without touching a single file.

Prepare an audit request

VISUAL SYSTEM

Detailed reading

The brand speaks its own visual language

Dark navy executive dashboard with three decision cards on top and a ten-domain strip below.Five-layer AI readability stack.Capability map of six large stat cards.Two panels separating static review from authorization-required active testing.Four-step bridge flow diagram.Four-stage content system flow.Five-step technical handoff flow.

Brand Center: 32+32 visuals, 24 banner sizes, logos →

Circular loop of four modes with a Deploy-Verify node at the center.
The governance loop: Review, SafeFix, Build and Monitor around a Deploy-Verify core. The rings in the diagram are the engine's working modes; there are three purchasable services (audit and report, improving an existing site, a new site).

Critical questions — quick answers

Detailed reading
Q: How do we start?

A: You share your site address or a site package (ZIP); the first review produces an evidenced snapshot. We set the scope and the schedule on that snapshot.

The request flow lives on the contact page

Q: What is delivered?

A: An executive brief plus a technical-annex report (DOCX/PDF) and a machine-readable evidence pack: changed files, manifest, checksums, rollback plan. Scanning and reporting are automated.

Every file in the evidence pack, explained in the Evidence Hub

Q: Why is there no price on the site?

A: Quotes follow scope: one site or a multilingual estate, with or without live verification. A fixed list price is therefore not published.

Scope components on the contact page

Q: What can it see without touching the live site?

A: All in-file signals in ZIP/local input: meta, schema, header readiness, accessibility markers, static security patterns.

Full answer in the FAQ

Q: ZIP vs live-URL analysis?

A: ZIP shows file truth; live URL shows response truth; headers and redirects finalize only live.

Full answer in the FAQ

Q: What if the site breaks after SafeFix?

A: The rollback manifest reverts in one step; the backup dir ships in the package.

Full answer in the FAQ

Q: How is the rollback manifest used?

A: Copy files back from the backup dir; the changed/created lists guide you.

Full answer in the FAQ

Q: Which changes are the owner's commercial call?

A: Meaning-changing content, brand/voice preferences and legal text are commercial decisions; the live publish decision also belongs to the owner.

Full answer in the FAQ

Q: Why are the figures never summed?

A: Checks, patterns, bridges, fixers and recipes count different kinds of work; different units are never merged into one total.

Full answer in the FAQ

Q: How is the 348 figure counted?

A: Counted from code by the CLI; the quality check and the release record report the same figure.

Full answer in the FAQ

WHY WEBTRUSTENGINE?

Quick preview: against the four closest products

Detailed reading

These four points are what make the difference in an evidence-bound decision file. The full table is 12 products × 16 capabilities on a separate page; every competitor cell is bound to an official product page.

  • URL, ZIP and local-folder input — we found no equivalent on hosted crawlers.
  • Hashes, manifests and number provenance — the same input yields the same number.
  • Reversible fixes with a rollback manifest.
  • Local, controlled data processing.

Open the full comparison

Ready for the first review?

Get an evidenced baseline without touching a file. Send your request through the topic lanes on the contact page and we will settle the scope and the quote together.