v0.4.0 — OmniRank finds where your site contradicts itself 🔍

[bemoshiur]

🔍 v0.4.0 — OmniRank finds where your site contradicts itself

---

Most SEO defects need an opinion — is 58 characters really too long for a title? v0.4.0 goes after a different category: defects a site proves against itself, no opinion required. A canonical pointing at a page marked noindex. A sitemap URL that robots.txt forbids crawling. An hreflang alternate that can't be indexed. Every one of these is two files on the same site disagreeing with each other, so precision is the whole claim — and the whole reason this release exists.

🪞 Five gates, one theme: self-contradiction

Gate	Catches	Severity
🗺️	A sitemap URL its own robots.txt disallows	error
🔗	A canonical pointing at a noindexed page	error
🕳️	A canonical pointing at a page that 404s or 410s	error
↪️	A canonical pointing at a page that redirects	warning
🌐	An hreflang alternate that's itself noindexed	error

We ran it against danluu.com as a real-world test and it caught something genuine: the post "In defense of simple architectures" self-canonicalises to /simple-architecture — no trailing s. That URL 404s.

<link rel=canonical href=https://danluu.com/simple-architecture>
$ curl -sI https://danluu.com/simple-architecture
HTTP/2 404

Not a style nitpick. Every ranking signal that page earned is nominally being handed to a URL that doesn't exist. No external database, no crawler API, no judgement call — just the page's own tag checked against the page it points at.

One honest caveat: seo.robots-sitemap.disallowed depends on Python's own robots.txt matcher, and that matcher genuinely behaves differently across versions we support (CPython rewrote it for RFC 9309 in 3.14, with a partial backport in 3.13). Rather than guess, the gate runs a live behavioural probe and reports matcher-unsupported when it can't be sure — a refusal, never a wrong answer.

🛡️ A new security layer

📋	Four header checks are inventory, not grades — HSTS, nosniff, CSP presence, Referrer-Policy. We report what's there and stay quiet about whether it's enough, because that's a threat-model question, not an SEO one. Mozilla Observatory already does this well; we didn't need to do it worse.
🚫	Mixed content is split by what your browser actually does about it. A <script src=http://...> on an https page is blocked outright — error. An <img src=http://...> is silently upgraded first and only fails if no https version exists — warning, because claiming it's broken would often just be false.
↩️	A missing http→https redirect is error. It gives every page a live duplicate at a second URL and splits your canonical signal in half.

🐛 What review caught — and we'd rather tell you than bury it

Final review found the new scoring formula wasn't monotone. Each layer's budget now divides by how many gates that layer has (fairer than the old flat 100 points — a tiny security layer used to floor unreasonably fast). But an early version of that change let harmless info-only findings widen the denominator for free, which means adding a header-missing notice could make a real error look less bad.

Reproduced against danluu.com with the identical mixed-content/https-redirect errors present the whole time: security scored 87 under the buggy code, and the correct 67 only after the fix. Same defects. Worse-looking headers, somehow inflating the score. Report.score() promises adding a finding can never raise a score — we now assert that with a 40,000-trial property test that fails against the old code within its first 400 trials.

We're telling you this because a tool whose whole pitch is "we only report what's provable" has to hold its own scoring to the same bar, and this is what that actually looked like in review.

📊 The numbers

67 finding ids (up from 48), 42 --fail-on gate names (up from 28), 5 audited layers instead of 4. Full list, generated straight from the registry so it can't drift: Finding Reference.

omnirank audit https://your-site.com

Still writes nothing — omnirank fix previews diffs, no --write flag exists yet. Auditing better is zero-risk; a richer audit is what earns the right to edit files later.

💬 Tell us

• Did a contradiction gate fire on your site and get it wrong? This whole category's value is precision — if robots-sitemap, canonical-target, or hreflang-noindex flagged something that wasn't actually a contradiction, we want the URL and the reason. A false positive here is a bigger problem than a missed one.
• Which framework should the locator support next? next-app-router, static, jekyll and hugo resolve today; everything else honestly reports none rather than guessing. Astro, Nuxt, SvelteKit, WordPress — say which you'd actually use.

_{Full notes in the CHANGELOG · Docs · Wiki}