You asked what features would make your SEO audit the most thorough and most actionable audit on the internet at any price. Seven research agents went looking. Six came back with evidence, one came back arguing you should not do it at all, and the honest answer sits somewhere between them.

The short version: thoroughness should be your input, not your output. Run two hundred checks, show five findings. The sentence that sells is "we checked everything so you only have to read five things," and almost nothing in the research supports adding checks for their own sake. The genuinely defensible ground is measuring what nobody else measures, refusing to fake what cannot be measured honestly, and turning a one-off report into a cheap recurring sentinel.

The finding that changes the question

A free, open-source, no-signup tool already does most of what the paid product does. It crawls up to five hundred pages, runs fifteen specialist agents, and returns a scored, prioritized audit covering technical SEO, Core Web Vitals with INP, schema validation including retired rich-result types, AI crawler access, local SEO, and a seven-by-seven Google Maps geo-grid. It was updated within the last week. I verified the repository is real and live.

That does not kill the product. It kills one specific strategy: competing on breadth of coverage. Breadth is the one axis where the competition is zero dollars and improving weekly.

Three findings compound it:

  • Google keeps deleting the things audits check. FAQ rich results were removed for all sites on 7 May 2026, the Search Console report retired in June, and Search Console API support for FAQ ends in August 2026. Seven structured data types were retired in a single June 2025 announcement. HowTo and Sitelinks Searchbox are gone. Every added check is a standing subscription to Google's changelog.
  • One silent parameter removal multiplied every rank tracker's costs tenfold. Google dropped the num=100 URL parameter over 8 to 10 September 2025 with no warning and no documentation. Tools needed ten requests where one had done. AccuRanker responded by capping tracking at the top twenty. Funded companies absorbed it by degrading their products. A solo operator has no absorption capacity.
  • The traffic estimates the whole industry prints are wrong by roughly half. Studies against Search Console ground truth put average error near fifty percent, worst on low-traffic sites, which is exactly your buyer. One documented case had Semrush estimating fifteen thousand monthly visits against an actual three thousand.

What to build, ranked

These are ordered by uniqueness multiplied by feasibility on a Cloudflare Worker with the APIs you already have. Every one is either free or costs cents.

1. The bot-perspective response matrix

Fetch a sample of pages as Googlebot, GPTBot, OAI-SearchBot, ClaudeBot and PerplexityBot, and diff the status codes, byte lengths and challenge pages against a plain browser request.

This is the single best feature on the list. Every crawler on the market fetches from its own IP with a spoofable user agent, so none of them sees what Cloudflare actually does to a real bot. Around twenty-seven percent of sites block LLM crawlers at the CDN layer even with a perfectly correct robots.txt, and forty-one percent of B2B sites block at least one major AI bot, mostly as leftover panic from 2023. Since 1 July 2025 every new Cloudflare domain blocks GPTBot, ClaudeBot and PerplexityBot by default, and from 15 September 2026 new domains block Training and Agent categories by default on ad-bearing pages. Cloudflare fronts roughly a fifth of the public web.

Cost: one HTTP request per user agent. It is deterministic, it is frequently a genuine unknown-unknown for the owner, and it directly explains a bad AI citation score, which ties your two existing differentiators together. This belongs in the free tier as the acquisition hook.

2. The three-way render diff

Independent analysis across more than five hundred million GPTBot fetches found no evidence of JavaScript execution. GPTBot downloads JavaScript files in about 11.5 percent of requests and ClaudeBot in about 23.8 percent, and neither runs them. Google's Gemini is the exception because it rides Googlebot's rendering service.

So fetch each page three ways: raw with no JavaScript and a generic agent, raw with each AI crawler agent, and fully rendered. Report the delta as a percentage of extractable main content, and name the elements lost. Pricing tables, reviews, FAQ accordions, tabbed content and infinite-scroll listings are the usual casualties.

The output is a screenshot-able artifact: side by side, what a human sees against what ClaudeBot sees. That sells the report on its own.

3. Business-impact prioritization computed from real data

This is the loudest complaint in the entire category and the least fixed. Aleyda Solis polled 534 people ahead of her BrightonSEO talk on why SEO processes fail, and the top five causes all concerned execution rather than analysis. Her diagnosis of the deliverable: audits are "non-personalized, not strategical, not prioritized, not solution focused, not easily actionable."

With Search Console connected you can compute rather than assert. Every finding gets "affects N URLs carrying X clicks a month." Sort by observed impressions at risk, not by tool severity. Tools agreed on issue severity only thirty-four percent of the time in head-to-head testing, and Screaming Frog's own documentation concedes its priorities "lack context."

4. Schema that contradicts the visible page

Every validator on the market checks syntax and required properties. None checks whether the markup describes what is actually on the page, which is precisely the failure Google treats as a spam policy violation: five thousand reviews in the JSON-LD, five reviews on the page.

Cross-reference the JSON-LD field values against the rendered DOM text. Does the price appear on the page, does the review count match, does the author appear anywhere, does the published date match the visible byline. Also check ISO-8601 date validity: in a five-thousand-site audit, invalid date format was twenty-four percent of all schema errors, and it silently passes most tools while Google rejects it.

5. The daily sentinel (and the business model that follows)

Seven checks, run daily on ten key URLs, costing about eleven HTTP requests with no AI calls and no paid APIs:

  • robots.txt changed against a stored copy
  • noindex appeared, in the X-Robots-Tag header as well as the HTML
  • canonical flipped or lost its self-reference
  • SSL certificate expiring
  • sitemap URL count or lastmod age moved sharply
  • a redirect chain appeared
  • a schema type vanished from a template

Every one has a documented catastrophic failure. The story to lead with is Glenn Gabe's case study: a company lost category rankings because its CMS provider was adding directives to robots.txt without the owner's knowledge, on a site with tens of thousands of indexed URLs. The pitch is not "you might make a mistake." It is "your developer, your plugin or your host might, and you would never know."

Two facts make this a business rather than a feature. First, 78.2 percent of SEO providers charge a monthly retainer, per an Ahrefs survey of 439 providers, while one-off audits are either free or over a thousand dollars. Your 49 to 299 dollar band is the dead zone. Second, Semrush gates historical data between its 117 and 208 dollar tiers, which is direct evidence that people pay for history.

Also worth knowing: TLS certificate lifetimes drop from 398 days to 47 days by March 2029 under an approved CA/Browser Forum phase-down. Expiry monitoring gets more valuable every year between now and then, with no work from you.

6. Change over time, free and retroactive

Three free time-series sources nobody joins: the Wayback CDX API (every historical version of every URL on a domain, with content fingerprints, so you can tell when content actually changed rather than when it was crawled), the CrUX History API (real-user performance history, retroactive, so your first audit can show months of trend), and Search Console's sixteen-month history.

Joined, they produce a sentence no competitor writes: your title on this page changed on 14 March, clicks fell 41 percent in the 28 days after, and LCP degraded from 2.1 to 3.4 seconds in the same month.

7. Competitor diffing, the clearest white space found

Semrush, Ahrefs and Sistrix all do competitive keyword and visibility comparison well. None ships a technical diff. Nobody tells you "they have Product, Review and FAQ schema, you have Organization only," or "their LCP is 1.9 seconds and yours is 4.1, both measured on real users," or "in this section they have 340 indexable pages and you have 12."

All of it is computable from one crawl of a few dozen competitor pages plus two free CrUX calls. Stay logged out, honor robots.txt, identify the crawler and rate-limit, and the legal footing is solid after hiQ v. LinkedIn and Meta v. Bright Data.

8. Free sources nobody uses

Certificate Transparency logs enumerate every subdomain ever issued a certificate, which finds the forgotten staging and dev subdomains competing with production. No crawler-based tool discovers these, because nothing links to them.

Cloudflare's URL Scanner gives 5,000 free scans a month and returns the full network request log, detected technologies, categories and a screenshot per page. That is a free headless browser audit, enough to produce a ranked third-party script inventory.

The honesty moat

This may be the most defensible thing in the whole analysis, because it is genuinely hard for a funded competitor to copy. Their marketing has already committed to the opposite position.

Ship a section that names the checks other audits sell that you deliberately do not run, with the evidence:

  • llms.txt. Ahrefs studied 137,000 domains: 28 percent publish the file, and 97 percent of those got zero requests in May 2026. AI bots never request one that does not exist, so they are not looking. Twelve percent of the requests that did arrive came from the GEO tooling industry auditing itself. Google has said it does not support it.
  • FAQ and HowTo schema. Retired. Zero search lift.
  • Featured snippet optimization. Down to 0.24 percent of searches per Semrush Sensor in March 2026. Recommending it signals a 2019 template.
  • AI content detection scores. 61 to 69 percent accuracy, near zero on hybrid human-AI text which is what nearly all real content now is, and documented bias against non-native English speakers. Putting this in a paid report is malpractice.
  • Automated GEO rewriting. A survey of 45 studies found body-only optimization cut top-20 retrieval presence about 9 percent, post-rerank top-10 presence 16 percent, and final citation 6 percent, with automated tools performing worse than manual. An entire product category is measurably harming its customers.
  • Information gain scores. Computed internally by Google per query against a candidate set you cannot observe. Any number a tool prints is invented. The honest version is embedding overlap against the current top ten, called "content differentiation versus the ranking set."

Three disclosures that cost nothing and read as expertise:

  1. Search Console impressions were inflated from 13 May 2025 until about 27 April 2026 by a logging error Google confirmed and is fixing forward only, never backfilling. Clicks were unaffected, but CTR and average position are derived from impressions, so both are unreliable across that window. Clean year-over-year comparisons do not exist again until roughly May 2027.
  2. Search Console's AI Overviews data is UI-only. It launched in June 2026 with no API and no BigQuery export. Any tool implying it has that data from Google is scraping or bluffing.
  3. Average position is not a rank. It averages across devices, locations and every query a page surfaces for.

Two corrections to things already shipped

The AI citation engine should run each prompt more than once. Research on 815,000 prompt-page pairs found only 2.3 percent of citations stayed consistent across three runs of the same prompt. A single run is one draw from a noisy distribution presented as a measurement. Three runs, reporting a frequency and a range, would put the methodology ahead of tools charging 199 to 828 dollars a month.

Label the engine honestly. Querying through OpenRouter hits the API build, not the consumer product: different system prompt, web search often off. The honest label is "model X via API, web search off," not "ChatGPT."

Never print a dollar figure

The published click-through-rate curves disagree by an order of magnitude, not a rounding error. First Page Sage puts position one at 39.8 percent. Backlinko puts it at 27.6 percent. Ahrefs, measuring aggregated Search Console data on informational keywords, measured position one at 7.6 percent in December 2023 and 3.9 percent in December 2025. Same metric, ten times apart, and the highest numbers are the most widely quoted.

So build the curve from the customer's own Search Console data. A first-party curve automatically absorbs their branded and unbranded mix, their industry, their device split and their SERP environment. Then split branded from unbranded before showing it, because Advanced Web Ranking states plainly that the two curves differ substantially and branded navigational searches flatter everything.

The honest hierarchy of impact claims, best to worst:

  • Best: "This page gets 12,000 impressions a month at a 1.1 percent click rate, against your own site average of 2.4 percent at the same position."
  • Fine: "These 40 URLs are non-indexable and receive zero clicks despite matching queries you rank for elsewhere."
  • Shaky: "Moving from position 8 to 3 would be worth roughly X clicks." Requires assuming a rank change you cannot promise.
  • Snake oil: multiplying that by an assumed conversion rate and order value to produce "47,000 dollars a year in lost revenue." Three stacked guesses presented as one confident number.

Google now actively encourages businesses to file FTC complaints about fraudulent SEO services. Refusing to fabricate revenue numbers is both the safe position and a sales position with agency buyers who know the difference.

What the contrarian thread got right

I asked one agent to argue against the whole premise. Its strongest points survive scrutiny and should shape the plan:

  • Comprehensiveness is the documented failure mode in audit delivery, not the goal. Agencies that hand over "a report with 300 flagged items" have created a prioritization crisis, not delivered value.
  • Free audits are the industry's standard lead magnet, which structurally anchors the artifact at zero. When competitors must give away the thing you sell, your price ceiling is set by their customer acquisition budget.
  • Specialists reportedly command two to three times generalist rates with better retention. Narrowing to one vertical also shrinks the check surface: a dentist audit needs local signals done impeccably, not two hundred generic checks.
  • The agency and white-label channel is the one buyer segment where "most thorough" genuinely sells, because breadth is their sales collateral. Wholesale white-label runs 300 to 900 dollars a month for local, resold at two to three times with 45 to 65 percent margin.

Where it overreaches: it treats the free tool as a full substitute. It is a substitute for technically capable buyers who will install a Claude Code skill. It is not a substitute for a small business owner who needs a hosted report, and it cannot access anyone's Search Console.

Recommended sequence

  1. Build the bot-perspective matrix and put it in the free tier. Cheapest, most unique, most alarming, and it feeds the AI citation story you already sell.
  2. Fix the citation engine to three runs per prompt and relabel it honestly. This is a correctness fix, not a feature.
  3. Add the three-way render diff with a side-by-side visual. This becomes the signature check.
  4. Compute impact from Search Console rather than asserting it, and cap the report at the top ten findings with the rest in the CSV you already ship.
  5. Write the honesty section. It costs nothing but discipline and it is the hardest thing on this list to copy.
  6. Ship the seven-check daily sentinel as a monitoring tier. This is the answer to the dead-zone pricing problem.
  7. Then decide on the vertical and the white-label channel. Both are strategy calls that are yours, not mine.

Confidence and gaps

High confidence: API quotas and pricing (read from vendor documentation), Google's deprecation record, the num=100 incident, the llms.txt adoption data, the Search Console impressions bug, Aleyda Solis's criticism (read at source), the CTR curve disagreement, competitor tool pricing.

Medium confidence: the AI crawler blocking percentages and the five-thousand-site schema audit, both single-source and vendor-adjacent, though corroborated in direction. Enterprise pricing, which is universally quote-only. The specialist-versus-generalist percentages, which come from agency marketing without a traceable primary source.

Known gaps: nobody bought a Fiverr audit to see what the deliverable actually is, which would cost about 165 dollars and is the highest-value primary research remaining. Reddit was inaccessible to the search tools, so practitioner community voice is thin. No SEO-audit-specific litigation was found, so the liability case is inferred from FTC posture rather than demonstrated.

One systematic bias worth naming: most AI-visibility statistics come from companies selling AI-visibility products. The two least conflicted datasets found, SparkToro's clickstream across 41 platforms and Whitespark's practitioner survey, both point away from AI being the dominant story. Google still holds 73.7 percent of US desktop searches, and Amazon, Bing and YouTube each field more desktop search activity than ChatGPT. AI belongs in the audit as a leading indicator and a conversion-quality story, not as the headline score.