Engine & Scoring Documentation
How Nyrolo evaluates pre-launch websites, calculates the 0–100 Readiness Score, assigns delivery verdicts, and safely executes bounded crawls.
1. The 100-Point Scoring Engine Formula
Nyrolo’s Readiness Score is calculated as an additive weighted index across 5 deterministic diagnostic pillars. Every audit begins at a score of 100 points. Penalties are deducted based on detected issues within each pillar:
Evaluates internal and external hyperlinks. Broken internal 404 links incur high severity penalties; external dead links incur medium penalties.
Validates unique page title tags, meta descriptions, canonical URLs, Open Graph tags (og:title, og:image, og:description), and Twitter cards.
Checks HTTPS enforcement, valid TLS certificate status, HSTS (Strict-Transport-Security), X-Content-Type-Options, X-Frame-Options, and mixed content.
Detects robots.txt, sitemap.xml, custom 404 page, single H1 heading hierarchy, image alt text attributes, favicon presence, contact form detection, and placeholder text like Lorem Ipsum.
Inspects HTML payload size, server response latency (Time to First Byte / TTFB), gzip/brotli compression headers, and inline script density.
2. Delivery Verdict Thresholds
Every report returns one of three objective verdicts designed to help agency project managers make unambiguous ship/no-ship launch decisions:
Zero critical blockers detected. All links resolve, SSL and security headers are sound, and SEO tags are complete. The website is safe to deliver and point to production DNS.
No critical blockers, but several medium-severity warnings exist (such as missing social cards, absent image alt attributes, or minor speed issues). Safe to publish if these items are queued for a post-launch sprint.
One or more critical blockers found: 404 links on primary navigation, missing SSL certificate, placeholder Lorem Ipsum copy, or robots.txt blocking all crawlers. Must be resolved before client review.
3. Crawler Architecture & SSRF Protection
Nyrolo operates a purpose-built, sandboxed HTTP audit engine. To protect cloud infrastructure against Server-Side Request Forgery (SSRF) and DDoS reflection, every outbound crawl request passes through our multi-layer SSRF firewall:
- IP Whitelisting & DNS Pinning: Hostnames are resolved to IPv4 and IPv6 addresses before connection. Nyrolo immediately rejects loopback addresses (
127.0.0.1,::1), private subnets (10.0.0.0/8,172.16.0.0/12,192.168.0.0/16), cloud metadata services (169.254.169.254, Google Cloud metadatametadata.google.internal), and link-local ranges. - Obfuscated IP Normalization: Decimal IP representations (
2130706433), hexadecimal notation (0x7f000001), and octal encodings are decoded and rejected. - Redirect Chain Validation: Every 301, 302, 307, or 308 redirect target URL is independently re-validated through the SSRF guard to block redirect-based internal port probing.
- Bounded Resource Limits: Max page size: 2MB; per-page socket timeout: 8 seconds; max concurrency: 3 concurrent requests; max crawl depth bounded by user plan (Free: 25 pages, Pro: 100 pages).
- Robots.txt & User-Agent: Respects
robots.txtcrawl directives and identifies itself asNyroloBot/1.0 (+https://nyrolo.com/crawler-info).
4. What We Check vs. What We Cannot Check
What We Check
- Server-rendered HTML DOM structure
- HTTP status codes & redirect headers
- SSL certificate expiry & TLS version
- Security response headers (HSTS, CSP, X-Frame)
- Meta tags, Open Graph, Twitter cards, Canonical
- Robots.txt and sitemap.xml presence
- Placeholder copy & single H1 enforcement
What We Cannot Check
- Client-side JavaScript SPAs rendered exclusively via client hooks without SSR
- Authenticated pages behind username/password portals
- Database transaction integrity & backend business logic
- Full WCAG AAA screen reader audio rendering
- Complex payment gateway checkout webhooks
Notice: Nyrolo provides automated pre-launch hygiene scans. We never claim “100% confidence” or complete legal compliance guarantee. Nyrolo reports should complement, not replace, human quality assurance.