Uptern
I write a line in these audits that lands harder than anything else in the document. Some version of: the donation experience is quietly working against you.
It works because it's usually true and nobody has ever said it out loud. A nonprofit's donate flow is the most consequential page they own, and it is almost never the page anyone is watching. It just sits there, losing a percentage of everyone who meant to give, year after year, with no alarm attached.
Finding that takes judgment. Finding the four hundred pages with missing meta descriptions does not. And once I noticed I was charging the same hourly rate for both, I had a product problem.
A real site audit splits cleanly in two, and the halves are worth wildly different amounts.
Roughly sixty percent of it is mechanical: crawl the site, find the missing metas, catch the broken links, flag the images with no alt text, measure the Core Web Vitals, check the security headers. It's genuinely valuable and it is completely uncreative. A machine should do it, because a machine can do it at three in the morning for free, and every hour I spend on it is an hour billed at a rate that insults us both.
The other forty percent is why anyone hires me. Whether the donate button is fighting the newsletter signup for attention. Whether the recurring-giving option is buried where nobody will find it. Whether the content answers what people actually search at 2am when they've just been diagnosed. Those are judgment calls, and they don't survive automation.
So the question wasn't "should I build a tool." It was: which sixty percent do I hand to the machine, and what am I protecting on the other side of that line?
The audit came before the software, on purpose. A full independent crawl, every link verified rather than trusted, live search rankings checked by hand, medical citations validated against their actual sources, a prior vendor's claims tested against live data. It's hard to automate a process you've never actually run, and I wanted to know where the tedious parts really were before deciding what to build.
Rather than guessing at features, I benchmarked the tool against the audit I'd actually delivered, dimension by dimension, and measured the gap. That produced an honest number: about sixty percent of the audit's data points are automatable, including the three highest-effort fixes. Everything else stays human because it should.
The fix engine drafts changes; it doesn't apply them. Every suggestion enters an approve, edit, or skip queue, and the previous value is captured before anything is written. Restores bypass the plugin abstraction entirely and write straight back to the original field, so a client who switches SEO plugins later can still undo what I did.
The plugin never holds an AI vendor key. Every AI call routes through a proxy I control, authenticated by license. Keys rotate centrally, and a lapsed license cuts off access server-side rather than relying on an install to behave. It also means a client site being compromised doesn't hand anyone my credentials.
The report is the product a client actually holds. Ten dimensions, each with its own severity counts and a status they can read at a glance, sitting above the detail. It's the difference between handing someone a hundred-page PDF and handing them a decision.
Real report, fictional client. Every organization name, domain, score, and finding here is invented. The structure, dimensions, and severity model are the live ones.
Ten dimensions, each with its own checks and its own reason for existing:
The tool ships eight working modules against that spec. Three run the full loop of detect, draft, approve, write, and keep a backup: meta descriptions, alt text, and a live 404 logger that watches real traffic rather than crawling for hypotheticals and proposes redirects once a URL is actually being hit. Five diagnose only: PageSpeed with nightly rotation and score history, competitive SERP analysis, AI citation tracking, a chronological timeline of every change, and tokenized client reporting.
Accessibility is the honest one. Automated checks catch about thirty percent of WCAG criteria. The scores confirm real gaps, but they cannot clear a site, and any report that implies otherwise is lying to the client.
Most of the interesting decisions on this project were about what the software is not allowed to do.
Conversion and UX calls stay manual on purpose. Not because they're impossible to automate badly, but because they're the reason a client renews. The tool gets them eighty percent of the report at near-zero marginal cost. The last twenty percent is a person who has looked at their donate flow and has an opinion.
AI drafts, a person approves, the old value is captured first. An SEO tool that rewrites two hundred meta descriptions unattended isn't a time-saver, it's an incident waiting to be discovered three weeks later by someone's traffic report.
A deliberate reversal partway through. Clients see findings, statuses, and history. The fix engine is vendor-gated, because it isn't a client feature. It's my own labor-saving machinery, and giving it away means giving away the thing that makes the engagement viable.
Automated accessibility checks catch about thirty percent of WCAG. Domain authority isn't automatable in-plugin at all. Where the machine is partial, the report says so. A number presented as complete when it isn't is worse than no number.
The audit is the sales artifact. The tool is the retention artifact.
A one-time audit wins the engagement; the installed system that keeps producing that report every month is what turns it into a relationship. Which means the software's job was never to replace me. It was to make the boring sixty percent cost nothing, so what a client is actually paying for is the part only a person can do, and so that what I'm selling stops being hours and starts being judgment.
Data points captured in a single audit, before the SEO and SEM opportunity map is built on top.
The methodology won a web health and remediation engagement, now underway, and runs as a service while the software that automates it is in active development.
About sixty percent of the audit's data points can be gathered automatically, measured against a delivered engagement rather than estimated. The rest is reading them together, which is the part worth paying for and the part that stays manual.
The most valuable thing I own turned out to be the part I won't automate, which I did not expect going in. It would be easy to build a tool that generates the whole report. Plenty exist. They produce a hundred-page PDF nobody reads, because a list of every problem with your website is not the same as knowing which three to fix first, and the second thing is the entire job. The tool's ceiling isn't technical. It's that a checklist can't tell you the donation experience is quietly working against you.
So the line I drew is the business model. Machine does the counting. I do the looking. A client who pays for counting will leave the moment something cheaper counts; a client who pays for looking stays, because looking is the thing that's actually scarce.
The other lesson is smaller and more uncomfortable: I built this because I was annoyed at how I was spending my time, and being annoyed turned out to be better product research than any market analysis I could have run. The spec wrote itself the moment I stopped guessing at features and started measuring the tool against work I'd already done for someone who paid me.
Willet
A nonprofit's conference app kept treating a homecoming like foot traffic. So I built the alternative.
Read the case study →
St. Baldrick's
Sixteen years as a shavee before I ever worked on the brand. Then the joy started draining out of the marketing.
Read the case study →