Methodology

What an Antileak scan measures, how it measures it, and what it refuses to claim.

The core idea

The biggest AI crawlers — OpenAI's GPTBot, Anthropic's ClaudeBot, PerplexityBot — fetch a page's raw HTML and stop. They do not execute JavaScript. Whatever a site loads or renders after that first response is invisible to them. So Antileak measures a site the same way: one HTTP fetch of the homepage, no JavaScript executed, and everything we report is a statement about what that fetch returned.

What one scan does

robots.txt first. We fetch and parse robots.txt with the same group-precedence rules the crawlers use (a named group beats the wildcard group), and we report which AI crawlers are blocked, by name. We also obey it ourselves: our scanner announces itself as AntileakBot, and a site that disallows us is not scanned — see antileak.io/bot.
The homepage, as an AI crawler receives it. We fetch the page once, without executing JavaScript, and read the returned HTML: how much readable text it carries, whether the phone number, street address and opening hours appear anywhere in it, and whether the markup is an application shell that JavaScript fills in later.
Structured data, field by field. We parse JSON-LD on the page and report whether LocalBusiness markup exists and which of the fields AI answers are built from — name, address, telephone, opening hours, geo, price range — actually carry a value. Empty markup is reported as what it is.
Fundamentals. HTTPS, a mobile viewport declaration, the presence of a <title>, meta description and H1, response time and page weight, and broken links among the homepage's own links (capped by a fixed request budget so we never hammer anyone's server).
How the page presents itself elsewhere. A canonical link, Open Graph title and description, a social share image, and how many of the homepage's images carry no alt attribute. All of it read from the same homepage HTML above — no extra requests. An alt="" is not counted as missing: that is the correct way to mark an image decorative, and we are not going to tell anyone to break it.
An XML sitemap. Read from the Sitemap: line in the robots.txt we already fetched. Only if there isn't one do we send a single HEAD /sitemap.xml. If the request budget has already run out, we report nothing rather than reporting an absence we didn't check.
Email authentication. Public DNS lookups for SPF, DKIM and DMARC records on the domain. DKIM is looked up at six common selectors (default, google, zmail, s1, selector1, selector2), so a negative result means we found no key at those selectors — not that none exists anywhere. No mail is sent to check any of this; DNS is public.

The rules the numbers obey

Measured, or absent. If a scan could not read a site, we say so and report nothing about it. A site that timed out is never described as "missing a viewport" — nobody read it. Findings are only ever restatements of something the scan observed on that site.

No borrowed benchmarks. Aggregate pages state averages and shares computed from our own scans, with the group size and scan date range on the page. We do not blend in third-party industry statistics and present them as ours.

Aggregates never name anyone. Public statistics on the data pages cover groups of at least 30 sites and never identify an individual business or domain. A business's own scan results are shown to whoever ran the scan, at an unlisted report link, and to no one else.

Coverage is counted, not assumed. Older scans predate some checks. On aggregate pages every metric names how many sites it was actually measured on, and a metric measured on fewer than 30 sites in a group is not shown for that group.

What the scan does not do

It does not render the page in a browser, so it cannot say what appears after JavaScript runs — only what is present before. It does not cross-check business details against Google or directories, read certificate expiry dates, or inspect trackers and consent banners. Where a page of ours lists capabilities, unbuilt ones are labelled as not built; we don't charge for them or claim them.

Scores

The health score is a weighted 0–100 roll-up of the measured checks above — presence of structured data, crawler access, fundamentals, email authentication, and response behaviour. It exists to make one site comparable to itself over time. It is our scale, computed only from our own measurements, and a score is never published for a named business.

Opting out

Site owners can block AntileakBot in robots.txt — we check before any request and honour it — or ask never to be scanned at services@antileak.io, which also removes any stored report for the domain.

Questions about this methodology: services@antileak.io. When the method changes, this page changes with it.