My Own Audit Engine Scores This Site 88. Here Are the Four Things It Flags.

I sell a website audit. So the obvious question a prospective client should ask is: what does that audit say about your site?

Here's the answer, in full. On 7 July 2026 the production engine scored autoalphaadvisory.co.za 88 out of 100 across nine domains. Four of those domains sit below 85, and one of them is the weakest thing on the site. All of it is published on the audit page with the date attached, and it has been since the day it was measured.

I'm a CA(SA) who writes the production code, and the reason I publish the bad rows is not modesty. It's that a score with no weak rows is a score nobody checked properly. Here's the whole read, including the parts that make me wince.

The nine domains, as measured

That's the same engine, run the same way, that fulfils the paid audit. Not a Lighthouse screenshot, not a hand-assembled composite of whatever tools happened to agree with me.

Why the number is 88 and not 89

This is the part most vendors don't show you, and it's the part I'd actually judge a supplier on.

The engine was run five times against the live site. The deterministic base score came back 83, 83 before a round of quick fixes, then 88, 89, 89 after. The median of the post-fix runs is 89. The number on my site is 88.

I use the lower one deliberately. The rule, written into the data file that feeds the page:

"This file uses the CONSERVATIVE 88 (the run whose LCP measured at its typical/worse end), so a skeptic re-running never scores the site below what the plate claims."

If you ran the audit on my site yourself tomorrow, you should get 88 or better. That's the entire point of picking the pessimistic run. A number chosen from the best of five is marketing; a number chosen from the worst is a claim you can be held to.

There's a second discipline in there worth naming. Before those keyed runs, I did a diagnostic pass without an API key, and it returned 77. That number is wrong in the other direction — a keyless run can't reach PageSpeed or CrUX, so the Core Web Vitals rows fail as a rate-limit artifact rather than a real regression. The internal rule is blunt: never display 77 or any keyless number. Understating your own score isn't honesty either. It's just a different inaccuracy.

The four weakest domains, and what's actually wrong

Email Security — 78, and already out of date

The engine flagged two things: DMARC was set to p=quarantine rather than p=reject, and there was no MTA-STS policy.

DMARC tells receiving mail servers what to do with mail that fails authentication checks. Per dmarc.org, the three policy values are none (report only), quarantine ("consider quarantining non-aligned messages") and reject ("outright reject"). Quarantine means a forged email claiming to be from my domain probably lands in someone's spam folder. Reject means it never arrives. For a domain that sends client proposals, the second one is the correct answer, and I was on the first.

Both findings have since been fixed — DMARC moved to p=reject on 15 July, and the MTA-STS record and policy host are live. You can verify the first yourself right now: dig +short TXT _dmarc.autoalphaadvisory.co.za.

Which means the 78 on my own site is currently stale in my favour, and I'm telling you that rather than quietly re-running the engine and swapping in a nicer number. My own rule says a displayed score gets refreshed or removed at 90 days, or after any material change. This qualifies as a material change, so the plate is due a re-run — and until it happens, 78 is the number that stands. Publishing a dated score means living with the date.

Content — 81, no clickable phone number

The engine's content rubric expects a local business to put a tappable phone number on the homepage. Mine doesn't have one. That's a genuine finding against a genuine standard, and it's open.

I haven't fixed it because I don't take unscheduled calls — the funnel is a form and a booked slot, deliberately. But "I made a considered choice" and "the rubric says this is a gap" are both true at once, and the honest way to carry that is to leave the finding open and explain it, rather than tune the rubric until my own site passes. The moment you start adjusting the measuring stick to flatter the thing being measured, the measurement is worth nothing.

Performance — 82, and this one's real

No artifact, no excuse. Core Web Vitals are measured at the 75th percentile of real page loads, not in a lab. Google's guidance sets the thresholds at LCP ≤ 2.5s, INP ≤ 200ms and CLS ≤ 0.1, and states:

"Tools that assess Core Web Vitals compliance should consider a page passing if it meets the recommended targets at the 75th percentile for all three of the Core Web Vitals metrics."

That distinction is why an 82 here is honest and a Lighthouse score would not be. Lighthouse runs a simulation on one machine under lab conditions. The 75th-percentile field data is what your actual visitors experienced, including the ones on a mid-range Android on a patchy South African mobile connection. Lab numbers flatter; field numbers don't.

GEO — 84, author attribution and citable blocks

The generative-engine domain flagged that author attribution was missing from the page schema, and that only two of three content blocks both name the business and carry a checkable fact.

That second one matters more than it sounds. The Princeton GEO study (arXiv 2311.09735, KDD 2024) found that adding quotations, statistics and cited sources each measurably lifted how often a page got surfaced by generative engines — with the largest gains going to lower-ranked pages. Blocks that assert things without evidence are exactly the blocks an assistant declines to cite. Getting flagged on it, on a site that sells AI visibility, is the sort of thing you either publish or quietly hope nobody runs.

Why my own AI auditor scores 13 points higher than my own engine

Here's the finding from that audit round I found most useful, and it has nothing to do with my site specifically.

I have two ways of auditing a website. One is the deterministic engine — fixed rubric, machine-checkable rows, same input produces the same output. The other is an AI-driven audit that reads the site with several parallel reviewers. Run on the same site on the same day, the AI audit scored roughly 13 points higher than the engine.

Worse, the engine caught five machine-checkable gaps the AI pass missed entirely: missing alt text, hero-CTA detection, the phone number, an analytics check, and a missing og:modified_time. The AI audit read the site intelligently and formed a generous overall impression. The engine counted things.

Both have a role — the AI pass catches judgement-level problems no rubric encodes, which is exactly what I wrote about when 126 automated checks passed on a site whose headings were invisible. But if someone shows you an AI-generated audit with a headline score and no deterministic rubric underneath, treat the number as an impression, not a measurement. The W3C makes the same point about accessibility tooling: tools "can not determine accessibility, they can only assist in doing so."

What to ask when someone shows you a score

Four questions. They're the same ones I hold my own plate to.

"What date was this measured?" A score with no date is a claim, not a reading. Mine says 7 July 2026 on the page.

"Was the run authenticated?" Keyless runs understate performance and search domains. Mine understated by 11 points. If a supplier can't tell you, they don't know what they measured.

"Which run is this — the best of several?" Ask directly. If they ran it five times, ask which one you're looking at and why.

"What's still failing?" The most useful question. Every real audit has open items. The 2026 WebAIM Million found detectable WCAG failures on 95.9% of one million home pages, averaging 56.1 errors each. Against that baseline, a site with nothing wrong is a site nobody checked.

What is a good website audit score

Context matters more than the number. On my engine's rubric, 70+ is a passing band and 88 is good rather than exceptional. A score is only meaningful alongside its date, whether the run was authenticated, and the list of what's still open. Treat any score presented without those three as decoration.

Should I trust an AI-generated website audit

Partly. AI audits catch judgement-level problems — weak copy, confusing structure — that no fixed rubric encodes. But on my own site, my AI audit read about 13 points higher than my deterministic engine and missed five machine-checkable defects the engine caught. Use AI review as a second opinion on top of a fixed rubric, never as the rubric.

How often should a published audit score be refreshed

Mine gets refreshed or removed at 90 days, or immediately after any material change to the site. The email-security fixes described above are a material change, so my current plate is due a re-run. A score that sits on a page indefinitely stops being a measurement and becomes a decoration.

How much does a website audit cost in South Africa

A free automated read across nine domains costs nothing and takes about two minutes. The full report with expert narratives, keyword rankings and a prioritised 30/60/90 remediation plan is R1,490, one-time. Remediation work is scoped separately — see services.

The point

The reason I publish this is not that 88 is a good number. It's that the number is checkable, dated, taken from the pessimistic run, and shipped with its failures attached — and that combination is rare enough to be worth pointing at.

Any supplier can show you a green dashboard. Far fewer will show you the four rows that aren't green, tell you which one is stale in their favour, and hand you the command to verify it yourself.

If you want the same read on your own site, get my visibility audit — nine domains, dated, weak rows shown rather than smoothed. Or book a discovery call and we'll go through what the results actually mean for your business.