Opportunity Scanner — a safe website-audit engine
Opportunity Scanner is a website-analysis system that helps agencies and service businesses find conversion, SEO, performance, mobile, trust, and accessibility opportunities on a prospect's site — turning a manual review into a repeatable, client-ready report.
Evidence class: internal project result and observed technical result. Audit output is deterministic; recommendations still require human review.
Observed technical result: a single URL produces a scored, prioritized report across six defined categories, with bounded AI explanations based on detected findings.
Every finding comes from a fixed rule, not a guess — the AI layer only rephrases what the rules already found, so the report stays correct and useful with or without it.
Add a click-to-call number in the header so mobile visitors can reach you in one tap.
Write unique descriptions so search results show a clear summary instead of raw page text.
Compress the hero image — it's slowing first paint on mobile connections.
Manually auditing a prospect's website is slow and inconsistent — every reviewer checks different things in a different order. Opportunity Scanner runs the same 43 checks every time, across six categories, so a lead's website review becomes a repeatable, client-ready report instead of an ad-hoc write-up.
- Scans a public website's homepage
- 43 deterministic audit rules across six categories (conversion, SEO, performance, mobile, trust, accessibility)
- Weighted scoring with prioritized fixes
- Optional AI-written plain-English recommendations layered on top of verified findings
- Client-ready printable report
- Reports stay fully usable when AI or PageSpeed is unavailable (graceful degradation)
- Structured data extraction (Cheerio) rather than storing raw HTML
- Next.js (App Router) + TypeScript (strict)
- Tailwind CSS 4
- Supabase / Postgres — server-role writes never exposed to client, RLS on anon key
- Zod validation + React Hook Form
- Hardened fetch boundary for untrusted URLs (src/lib/url-security.ts)
- Staged, retry-safe scan orchestration
- Anthropic API used only to rephrase verified findings (structured output)
- 216 passing Vitest cases + a Playwright end-to-end flow
AI is a bounded feature over deterministic, tested logic — never the source of truth. Every finding comes from a deterministic rule; the AI layer can only restate a verified finding in plain English, so a report is correct and useful even with AI turned off. Fetching arbitrary user-supplied URLs is done behind an SSRF-hardened boundary: it blocks private and reserved IPs, re-validates on redirect, and caps response size and time.
- Scans the homepage of a public URL, not a full-site crawl
- A deterministic heuristic audit, not a substitute for a hands-on manual review or Core Web Vitals field data
- PageSpeed and AI layers are optional enhancements
- Internal tool, not a public self-serve product
Secure processing of untrusted input, deterministic audit logic with typed data collection, background/staged processing, AI used as an optional explanation layer rather than a source of truth, and real test and security discipline.