{"$schema":"https://scanoraai.com/.well-known/audit-methodology.json","engine":{"version":"v10.0","releaseDate":"2026-06","description":"ScanoraAI audit engine — 23 evidence sources, 5-run PSI median, AI-ranked fix list."},"signalInventory":{"total":23,"breakdown":{"externalProviders":10,"inHouseParsers":5,"inProcessProbes":8},"note":"23 = 10 external providers (PSI/Lighthouse, CrUX, Mozilla Observatory, SSL Labs, Safe Browsing, W3C Validator, Website Carbon, Wappalyzer, axe-core, Wayback Machine) + 5 in-house parsers (content-SEO, schema validator, robots/sitemap, image audit, internal-link graph) + 8 in-process probes (JS-shell detection, rendered-meta extraction, TLS certificate-chain inspection, CDN detection, cookie security audit, broken link sampling, exposed file detection, mixed content detection)."},"dataSources":[{"id":"psi","name":"Google PageSpeed Insights / Lighthouse","tier":"external","keyRequired":true,"runs":5,"strategy":"median"},{"id":"crux","name":"Chrome UX Report (CrUX)","tier":"external","keyRequired":false,"note":"Field data — 28-day real-user window. Absent for low-traffic sites."},{"id":"mozilla-obs","name":"Mozilla Observatory v2","tier":"external","keyRequired":false},{"id":"ssl-labs","name":"SSL Labs","tier":"external","keyRequired":false,"note":"fromCache=on&maxAge=24h. Cache miss returns null for this provider."},{"id":"safe-browsing","name":"Google Safe Browsing","tier":"external","keyRequired":true,"note":"Reuses PSI key."},{"id":"w3c","name":"W3C Markup Validator","tier":"external","keyRequired":false},{"id":"website-carbon","name":"Website Carbon","tier":"external","keyRequired":false},{"id":"wappalyzer","name":"Wappalyzer (open-source)","tier":"external","keyRequired":false},{"id":"axe-core","name":"axe-core (jsdom)","tier":"external","keyRequired":false,"note":"CSS not computed — colour-contrast not detected. Lighthouse accessibility audit is the complement."},{"id":"wayback","name":"Wayback Machine / Internet Archive","tier":"external","keyRequired":false},{"id":"content-seo","name":"Content-SEO parser (in-house)","tier":"in-house","keyRequired":false},{"id":"schema-validator","name":"Schema.org validator (in-house)","tier":"in-house","keyRequired":false},{"id":"robots-sitemap","name":"Robots/sitemap deep audit (in-house)","tier":"in-house","keyRequired":false},{"id":"image-audit","name":"Image format/lazy-load audit (in-house)","tier":"in-house","keyRequired":false},{"id":"link-graph","name":"Internal-link graph audit (in-house)","tier":"in-house","keyRequired":false},{"id":"js-shell","name":"JS-shell detection (in-process)","tier":"probe","keyRequired":false},{"id":"rendered-meta","name":"Rendered-meta extraction (in-process)","tier":"probe","keyRequired":false},{"id":"tls-chain","name":"TLS certificate-chain (in-process)","tier":"probe","keyRequired":false},{"id":"cdn-detect","name":"CDN detection (in-process)","tier":"probe","keyRequired":false},{"id":"cookie-sec","name":"Cookie security audit (in-process)","tier":"probe","keyRequired":false},{"id":"broken-link","name":"Broken link sampling (in-process)","tier":"probe","keyRequired":false},{"id":"exposed-files","name":"Exposed file detection (in-process)","tier":"probe","keyRequired":false},{"id":"mixed-content","name":"Mixed content detection (in-process)","tier":"probe","keyRequired":false}],"scoring":{"categories":[{"id":"performance","weight":0.35,"primarySource":"psi"},{"id":"seo","weight":0.3,"primarySource":"psi+content-seo"},{"id":"ux","weight":0.2,"primarySource":"psi+axe-core"},{"id":"design","weight":0.15,"primarySource":"psi+mozilla-obs"}],"overallFormula":"weighted_sum(category_scores, weights)","penaltyFormula":"priority = penalty × severityMultiplier × confidenceBoost ÷ effortMultiplier","severityMultipliers":{"critical":1.5,"medium":1,"low":0.5},"confidenceBoosts":{"verified":1,"estimated":0.85,"inferred":0.7},"effortMultipliers":{"quick":0.8,"medium":1,"hard":1.3},"categoryFloor":8,"note":"Penalties are additive within a category and capped at the category floor (8 points minimum per category)."},"reliability":{"psiRuns":5,"psiStrategy":"median","keyPool":4,"circuitBreaker":true,"backoff":"exponential with jitter","psiFailureBehavior":"continue with psiUnavailable=true — never fabricate a score"},"aiExplanations":{"primaryModel":"gemini-2.5-flash-lite","fallbackModel":"gpt-4o-mini","groundingCheck":true,"groundingCheckDescription":"Explanation must reference at least one number or technology name from the input context. Generic explanations are discarded.","labeled":true,"labelDescription":"Every AI explanation carries aiGenerated=true and cites the model used."},"evidenceLabels":[{"id":"measured","description":"Directly measured from a live HTTP response or API call."},{"id":"field","description":"Real-user data from CrUX (28-day Chrome opted-in window)."},{"id":"lab","description":"Synthetic lab data from Lighthouse (throttled CPU, simulated 4G)."},{"id":"observed","description":"Observed from static analysis of HTML/CSS/JS without execution."},{"id":"inferred","description":"Inferred from indirect signals — not directly observable."},{"id":"ai_explained","description":"AI-generated explanation of a verified finding. Never a score."},{"id":"unavailable","description":"Provider returned null or timed out. Score not affected."}],"knownLimitations":["Lab data vs real-user experience: Lighthouse runs in a controlled environment. CrUX field data is shown alongside when available.","Single-page scan: we audit the URL you provide. Internal pages may have different scores.","Server location bias: probe runs from a single region. Lighthouse/CrUX run on Google infrastructure.","Login-gated pages: we cannot audit pages behind authentication.","Score variance: Lighthouse scores can vary ±5 points between runs. We run 5 and take the median.","axe-core CSS limitation: colour-contrast violations not detected in jsdom. Lighthouse accessibility audit is the complement.","SSL Labs cache: always uses fromCache=on&maxAge=24h. Cache miss returns null for this provider in the current audit.","WP Stack Health scope: only reports on what is provably detectable from served HTML. Inactive/premium plugins not on wordpress.org will not appear."],"links":{"humanReadable":"https://scanoraai.com/methodology","transparency":"https://scanoraai.com/transparency","reliability":"https://scanoraai.com/reliability","selfAudit":"https://scanoraai.com/self-audit"},"generatedAt":"2026-07-29T00:32:45.959Z"}