9 August 2026

I pointed a scanner at my own sites first

Before showing anyone a tool that grades websites, it seemed fair to run it against my own. Three of my sites are below, including the one that scored a D and the one whose entire content library is invisible to Google.

The grades

The D is a live client site. Its security is actually fine — 80/100. What dragged it down was visibility: 21 out of 100. Ten words of server-rendered HTML, no structured data, nothing for a crawler to hold onto. It looks perfect in a browser and nearly empty to anything that doesn't run JavaScript.

The one that actually stung

monasabaty.com is a wedding and events directory with 2,499 real vendors across Beirut, Tripoli, Dubai, Riyadh, Doha, Cairo and Casablanca. It has 591 programmatic landing pages and 1,182 URLs in its sitemap.

I checked what Google had actually indexed.

The homepage. That was it.

My first instinct was that something was broken on the site. So I went through the checklist:

• robots.txt — correct, allows everything, references the sitemap
• Sitemap — valid, 1,182 URLs, auto-generated
• Hub page linking into the page set — present
• Internal linking — 62 cross-links per page
• Structured data — JSON-LD on every page
• Server-rendered content — real vendor listings in the initial HTML

All of it fine. Which meant the problem was not on the page at all.

The site has no inbound links and no brand mentions anywhere on the web. Google had no reason to believe the domain was worth crawling deeply, so it didn't. The 591 pages weren't rejected — they were never seriously considered.

What I'd check on your own site

None of this needs a tool, though the scanner does it in about two seconds:

• View source, not the rendered page. Disable JavaScript and reload. What's left is roughly what a crawler sees. If it's a loading spinner, that's your ranking.
• Search site:yourdomain.com. Count the results against how many pages you think you have. The gap is the real story.
• Check whether you're blocking AI crawlers. Plenty of sites disallow GPTBot, ClaudeBot and PerplexityBot in robots.txt without realising it, then wonder why they're never cited in AI answers.
• Grep your JS bundles for keys. Anything starting sk_live, AKIA, or a service-role JWT that reached the browser is public, whatever your backend does.
• Look for published source maps. If .js.map files are served in production, your original source — comments included — is downloadable.

Why I'm publishing my own bad grades

Because a scanner that only ever shows other people's problems is a sales pitch, and one that starts with its author's is a measurement. The D is mine. The invisible directory is mine. The fixes are in progress, and the same tool will tell me whether they worked.