Carbon.txt Auditor

Audit one public page for web app manifest and favicon readiness. Checks manifest JSON, icons, name, start_url, display, theme_color, score, and recommendations.

Audit a public URL's HTTP compression headers for gzip, brotli, zstd, and deflate. Detects double-compression, re-compression of binary content, and missing Vary negotiation.

Audit a public page for Speculation Rules API usage: inline <script type="speculationrules"> blocks and the Speculation-Rules HTTP header. Returns per-rule analysis, eagerness, issues, score, grade, and Core Web Vitals recommendations.

Audit one public page for semantic HTML and ARIA landmark structure. Checks main, navigation, banner, contentinfo, repeated unlabeled landmarks, score, and accessibility recommendations.

Audit Set-Cookie response headers for Secure, HttpOnly, SameSite, cookie prefixes, Partitioned (CHIPS), tracking cookies, and privacy posture.

Audit a domain's SMTP MTA-STS transport security policy and TLS-RPT reporting record. Checks DNS, HTTPS policy file, MX matching, and returns a readiness score.

Audit one public URL for Content-Type accuracy, X-Content-Type-Options nosniff, and MIME confusion risk via magic-byte sniffing.

Audit one public page for buttons missing accessible names. Checks native buttons, button inputs, role=button controls, score, and accessibility fixes.

Audit a public page for resource hints (preload, prefetch, preconnect, dns-prefetch, modulepreload, prerender). Returns per-hint analysis, crossorigin gaps, duplicates, score, grade, and Core Web Vitals recommendations.

Audit a public XML sitemap for lastmod coverage, stale URLs, child sitemap indexes, score, grade, and SEO maintenance recommendations.