# bolt.new builds the site in two minutes. Getting it found is still your job, and that part is already free bolt.new's paid SEO boosting is a pre-rendered copy of each page; its 93 help pages never mention sitemaps or schema. What it leaves you, and how to do it on the AI plan you have. Author: J.A. Watte Published: September 18, 2026 Source: https://jwatte.com/blog/bolt-new-seo-aeo-geo-do-it-yourself/ --- On 18 September an invitation from Stripe landed in my inbox: a recorded fireside chat with the CEO and founder of bolt.new, billed as the story of how the product "attracted 60,000 users on Day 1 and scaled to 7 million users a year later." The pitch to the audience was growth strategy. The pitch to a small business owner, if you follow the link through to the product, is simpler: describe the site you want, get it in under two minutes, publish with one click, $25 a month. I wanted to know what that $25 actually buys, and specifically what it buys for the part of a website that decides whether anyone ever sees it. So I walked the product the way I'd audit a client site: the homepage, the pricing page, the small business page, the AI website builder page, every one of the 93 pages in the help center, the release notes, and the company blog back to the v2 launch. Everything below is quoted from those pages as they read on 18 September 2026, with links in the fact-check section at the end. The short version: bolt.new is an app builder first, and its "SEO" is one feature that fixes one problem its own architecture creates. The rest of the getting-found work, the part agencies charge for, is not in the product. It is also not something you need to pay anyone for, because the tools to find the problems are free on this site and the tool to fix them is the AI subscription you are probably already paying for. ## What bolt.new is, in plain terms bolt.new is a website and app builder that runs in a browser tab. You type what you want, an AI agent writes the code, you watch it appear in a preview, and you keep typing corrections until it looks right. It is made by StackBlitz and runs on their WebContainers technology, which is what lets a full development environment run inside a browser tab with nothing installed. The help center's own description is "an AI-powered builder for websites, web apps, and mobile apps." A few facts about what comes out the other end, all from the product's own pages: - The website builder page says it "generates modern web websites using React, Vite, Tailwind CSS, and Node.js by default," and adds that "You can also request other stacks or frameworks in your prompt." The default is a JavaScript application, not a set of HTML pages. Hold that thought, it matters in a minute. - The supported technologies page says "Bolt only supports JavaScript-based backends, so languages such as PHP or Python aren't compatible." If you were hoping to move an existing WordPress site into it, that is a rebuild. - Bolt Cloud, the hosting and database layer, is "Powered by trusted platforms like Netlify and Supabase." The help center's Netlify page adds that hosting used to run through Netlify and is now built in, with Netlify kept as an option you connect yourself, and a bolt database can later be claimed in Supabase. Either way you are paying for familiar infrastructure through bolt's interface. - The FAQ says "Bolt doesn't currently have a public API, CLI, or SDK to control it programmatically from outside the product." - You choose between two agents, Standard (all plans) and Max (paid plans), and "Bolt handles model selection behind the scenes." A third agent, Bolt Forge, arrived on 14 September running open-source models; it is a research preview until 14 October, included with Pro during the preview, and the release note says "Prompts and code sent through Forge are anonymized and shared with Bolt's partners to help train open-source models." What it is built for is the application side: sign-in, a database, file storage, a Stripe checkout, an admin dashboard, a booking calendar. The small business page leads with exactly that: "Build me a custom CRM with the fields I actually use, a booking calendar for my services, and invoice reminders for late payments." If that is the job, bolt is a reasonable tool for it and I'll come back to when it is the right call. ## What it costs, in the unit that actually matters The pricing page has four columns. The numbers below are from that page and the billing and tokens pages in the help center. | Plan | Price | Tokens | What you give up | |---|---|---|---| | Free | $0 | 300,000 a day, 1 million a month | "Bolt branding on websites", no custom domain, 10 MB uploads, site goes offline when it hits the bandwidth cap | | Pro | $25 a month, or $18 a month billed yearly | "Start at 10M tokens per month" | nothing on the list, but see the tiers below | | Teams | $30 per member per month, $27 yearly | per-member allotment, not pooled | | | Enterprise | custom | | | Pro is not one price. The billing page walks through "Pro 10M" at $25, "Pro 26M" at $50, a 55M tier the page calls "Pro 100" at $100 and a "Pro 200" tier, with annual versions at $216 and $540 a year for the first two. Which one you need depends on a unit the pricing page never defines: tokens. The pricing page FAQ is candid about where they go: "most token usage is related to syncing your project's file system to the AI: the larger the project, the more tokens used per message." Every message you send re-reads your project. So the cost per edit rises as the site grows, and the free plan's 300,000 daily cap is a real ceiling on a real site. The tokens page in the help center says the same in fewer words, and tells you what happens when you stop paying: "When you cancel your paid plan, you lose access to all allocated tokens (including rollover tokens) when the billing cycle ends." Subscriptions are "non-refundable," in both the FAQ and the billing page, and the only payment method is a card. Two more lines to read before you decide the free tier is free. Hosting plans: "Free plan sites stop serving content once they hit their monthly data limits. When that happens, they stay offline until usage resets at the start of the next billing cycle." The cap is 10 GB and 333,333 requests a month across every site on the account, which the same page estimates at around 10,000 to 15,000 monthly visits. And the analytics you get on paid plans: "Analytics data currently includes visits and actions from web crawlers and bots. At this time, there is no built-in way to separate crawler traffic from visits by real users." The two pages disagree on the annual discount. The pricing page banner says "Save up to 28% with yearly billing" while the billing page says "You can save 10% by subscribing to an annual plan." Both are right for different tiers. The $18 yearly figure against $25 monthly works out to 28%, but the billing page's own worked example prices the next tier, Pro 26M, at $540 a year against $50 a month, which is 10%, and the yearly Teams seat at $27 against $30 is 10% too. The discount shrinks as you go up. Check the live number for your tier before you commit to a year. ## What bolt means when it says SEO The homepage promises "SEO optimization so your project ranks from day one." The Pro column on the pricing page lists "SEO boosting" as a paid feature, with no definition. The intro page says marketers can "Build high-performing campaign pages, with SEO and hosting included." So I went looking for what the feature does. The definition is on the company blog, in the Bolt v2 launch post: "SEO Boosting creates a ready-to-go HTML version of each page ahead of time. When search engines visit your site, they get the full page instantly, making it easier to index your site and show it in search results." The Bolt Cloud post says the same thing in different words: "Automatic SEO pre-rendering ensures your pages are lightning fast, fully crawlable, and production ready from day one." That is pre-rendering. It is a real and useful thing, and it exists because of the first fact above. A React application built with Vite ships an almost empty HTML file and a bundle of JavaScript that draws the page after it loads. A crawler that does not run JavaScript, or runs it later, sees the empty file. Pre-rendering writes out a finished HTML copy of each page so crawlers get content instead of a shell. So the paid SEO feature repairs a disadvantage the tool's default output introduced. A plain HTML page, the kind a $20 AI plan can write for you in one message, never had the problem and does not need the fix. That is the only definition bolt publishes for the feature. I searched all 93 help center pages for the vocabulary of the work an owner actually has to do. Sitemap: zero pages. robots.txt: zero. Structured data, schema.org, JSON-LD: zero. Meta description: zero. Canonical: one hit, describing a CNAME record. Open Graph: one hit, as an example of what a server function could generate. Search Console: zero. Core Web Vitals: zero. WCAG: zero. GPTBot, ClaudeBot, llms.txt, ai.txt, anything about being read by AI answer engines: zero as a feature for your site. (The help center itself publishes an llms.txt so AI agents can read its docs. The file is just not offered as something your site gets.) The words "Google Business Profile": zero. What the help center does have is four thin surfaces. The prompt library has "Built-in prompts Bolt provides for common development tasks like SEO, accessibility, dark mode implementation, and error handling." The skills page lists a Bolt-curated "SEO/GEO" skill, off by default, which "you can't edit or remove," and whose contents are not published anywhere I could find. The visual editor lets you type alt text on an image, "for screen readers and search engines." The domain aliases page adds that forwarding extra domains to one primary domain helps "with SEO and avoiding duplicate content issues," which is a redirect, not a feature you configure for content. That is a prompt, a black box, one field and a redirect. To bolt's credit, its own writers say as much. The landing page tutorial on the company blog: "Strong AI-built landing pages still need human checks for mobile layout, load speed, SEO basics, and working lead capture." And its FAQ answer to whether AI-built pages are good for SEO: "They can support SEO when the output includes real fundamentals. Check that the page has an editable title and meta description, clean heading structure, appropriate indexing signals, and strong load performance." Check. Their word. Nothing in the help center describes the product doing that check for you. ## Where bolt is the right call, and how to build the same app for free I want to be fair to the product, because the app side is real. If your business needs customers to log in, book a slot against a live calendar, pay a deposit and see their own records, that is an application with a database, authentication and server code. bolt generates all three in one project, offers a security audit from the Publish menu on paid plans (it checks "who can see and change your data," public information leakage, sign-in flow, misuse, input validation and stored keys), and hosts the result. For an owner who wants a working booking form this afternoon and does not want to hear the word "migration," that is a fair trade for $25. It is not the only path, and it is not the cheapest, because every piece bolt rents you is available directly, most of it on a free tier, and the coding agent in your $20 plan already knows how to wire them together. The pieces, with the free-tier terms as published on 18 September 2026: - **Cloudflare Pages and Workers** for the site and the server code. The Workers Free plan is 100,000 requests a day with 10 milliseconds of CPU per request, and Pages Functions bill as Workers. A Worker can run on a cron schedule, which is how nightly jobs happen without a server. The site's own guide is [The Cloudflare Developer Platform, explained like you're going to ship on it](/blog/cloudflare-developer-platform/). - **D1** for the database. It is SQLite, with numbered migration files that live in your repo. Free plan: 5 million rows read and 100,000 rows written a day, 5 GB stored, and Cloudflare's own FAQ answers "Will D1 always have a Free plan?" with "Yes, the Workers Free plan will always include the ability to prototype and experiment with D1 for free." - **Durable Objects** for the one place you need "only one at a time" (a rate limiter, a counter, a lock). Available on the free plan with the SQLite storage backend. - **Sign-in.** Clerk's Hobby plan is free up to 50,000 monthly retained users per app with prebuilt sign-in and profile screens; the site's walkthrough is [Clerk: the fastest way I've found to ship real SSO](/blog/clerk-easier-sso/). Or skip the vendor: an emailed one-time code plus an authenticator app (TOTP) with printed recovery codes is a few hundred lines a coding agent writes well, and it leaves you with no auth bill and no auth vendor to lose. - **Stripe** for card entry and the webhook that confirms a payment, at 2.9% + 30¢ per successful card charge with "No setup fees, monthly fees, or hidden fees." - **Resend** for the email the app sends (receipts, invoices, notices, sign-in codes): free for 3,000 emails a month, 100 a day, on up to three domains, and it hands you the SPF and DKIM records to publish. [Replace Mailchimp with a Claude agent, a free GitHub cron, and Resend](/blog/claude-agent-email-newsletters-resend/) covers the sending side. - **Calendly** if the booking calendar is the whole app. The Free plan is "Always free": one event type, one calendar connection, unlimited one-on-one meetings and a customizable booking page. Embed it on a static page and you have bolt's headline example with no app at all. Earlier this year I built a billing portal for a small storage business on exactly that stack, with Claude Code doing the typing. What it does: a public pay page where a customer types a unit number and name, sees the fee for each payment method, and pays by card through Stripe's Payment Element; a customer account for autopay and statements; a staff console; a Worker on a nightly cron trigger that runs autopay and sends invoices seven days before they are due through Resend; an append-only ledger in D1 under 26 numbered migrations; and the electronic-notice paperwork Regulation E requires when a customer authorizes bank drafts. The public lookup is rate-limited by an atomic Durable Object because the first version, a plain KV counter, let a burst of 16 requests through when it should have stopped at 8, which we measured. Staff sign-in started on Clerk in test mode and moved to emailed codes plus TOTP with printed recovery codes, so the last vendor key is being deleted. The security headers went into the Pages `_headers` file, which is one paragraph of the prompt. It carries 50 test suites with about 6,100 assertions and a health check that runs 37 probes against the live site. The management software it replaces was about $275 a month; the Cloudflare bill sits at the free tier. It is still in test mode with a sandbox processor while the owner finishes go-live, which is the honest state of most first versions, bolt-built ones included. The prompt that gets you there is not long, but it has to say the quiet parts. Name the stack (Pages, Pages Functions, D1 with numbered migrations, a cron Worker for scheduled jobs). Name the sign-in (email code plus optional TOTP with recovery codes, sessions signed and stored in D1, fail closed). Name the payment flow (Stripe Payment Element, webhook signature verified, a bad signature stops the request and is never logged and waved through). Name the email (Resend, from a sending subdomain, with the DNS records published before the first send). And name the security items one by one: HSTS, CSP, X-Content-Type-Options, X-Frame-Options, a rate limit on every public lookup, an authorization check on every write that confirms the record belongs to the person asking. [What AI coding agents leave out](/blog/blog-what-ai-coding-agents-skip/) is the checklist for that last sentence, and the rule it teaches applies to bolt's agent as much as to Claude Code: what you do not ask for, you do not get. For the hosting math across Cloudflare, Netlify and Vercel, [What hosting a new business site actually costs in 2026](/blog/serverless-hosting-cost-comparison-2026/) has the numbers, and [Going frameworkless on Cloudflare](/blog/blog-cloudflare-frameworkless-vendor-lockin/) is the argument for building it plain. Two things stay true whichever way you build the app. The marketing pages that need to rank do not have to live inside it; a static homepage and service pages on free hosting, with the app on a subdomain, give the crawlers plain HTML and give you the app. And every item in the list below still applies to the app's pages too, because pre-rendering makes a page readable and does nothing about what it says. ## The list bolt leaves on your desk Here is the work, category by category, with what bolt's own pages say about each one, the free tool on this site that finds the problem, and the posts that explain it. Every tool below opens in your browser with nothing to install and no account; a few reach your site through a server-side fetch so they can see it the way a crawler does. Most of them end with a button that copies a fix prompt, with your findings already inside it, for the AI plan you already pay for. Six posts per category are linked here; the count of the rest is stated with a search link, because the honest answer to "is there a post on that" was, in every category, yes, and usually dozens. ### What the crawler actually sees This is the category bolt's SEO feature actually touches, so it goes first. Its pre-render feature means Googlebot gets an HTML copy of each page instead of a JavaScript shell, and the publish page confirms a public site is one "search engines can find and list." What the product never shows you is whether that copy matches the page a visitor sees, whether robots.txt lets the right crawlers in, whether there is a sitemap with honest lastmod dates, or what Search Console thinks of any of it. Its help center has no page on sitemaps, robots.txt, canonical tags, Search Console or IndexNow. The only crawler-side data it offers is a list of 404s in paid analytics that, by its own note, cannot tell a bot from a person. The tools below fetch your page the way a crawler does and put the two versions side by side. **Run, free, in your browser:** - [Index Coverage Delta](/tools/index-coverage-delta/): Crawls the live site from the home page, diffs the crawled URL set against sitemap.xml, and lists orphans, ghosts, broken and redirecting sitemap URLs, canonical conflicts and noindex-in-sitemap, then emits an IndexNow-ready URL list and a GSC fix prompt. - [Search Console + Bing Importer](/tools/search-console-importer/): Takes a Google Search Console Pages/Coverage or Performance CSV export plus your sitemap URL (and optionally a Bing Webmaster Tools CSV, which is only counted, not cross-referenced), fetches the sitemap, and lists sitemap URLs GSC reports as not indexed grouped by status, sitemap URLs missing from the GSC export, GSC URLs missing from the sitemap, and generates a copyable AI fix prompt. - [Sitemap Auditor + URL Probe](/tools/sitemap-audit/): Fetches /sitemap.xml (or a pasted sitemap URL), follows up to five sitemap-index children, HEAD-probes up to 900 listed URLs (default 200) for HTTP status, lists 4xx and 3xx entries, flags missing, stale (over 90 days) and future-dated lastmod values, and pre-flags GSC "Page with redirect" risk patterns; it does not check image or news sitemap tags despite the hero copy. - [robots.txt Simulator](/tools/robots-txt-simulator/): You paste a robots.txt, a list of URLs and pick a bot (Googlebot, Bingbot, GPTBot, ClaudeBot, PerplexityBot, Google-Extended, Applebot-Extended, Bytespider or *); it parses the file in the browser, applies the bot's exact-token group over the * group and longest-path-match with * and $ wildcards, and reports per URL ALLOW or DISALLOW with the matching rule, a simplified RFC 9309 model. - [Internal Link Auditor + Auto-Rewriter](/tools/internal-link-auditor/): Crawls up to 150 pages of a site (30 by default), probes every unique internal destination, and lists the ones that return 4xx/5xx with the page each appears on; emits a fix-links.sh that lists each broken href as a manual-review comment with a grep hint (no automatic rewrite is produced in practice) plus a copyable AI fix prompt. - [Redirect Chain Audit](/tools/redirect-chain-audit/): Paste up to 200 URLs; it follows each redirect chain (up to 8 hops) and reports the start URL, final URL and final 2xx/4xx/5xx status, flagging http-to-https upgrades, https-to-http downgrades, cross-origin and www flips, a meta-refresh tag on the final page, and a canonical that does not match the final URL; intermediate hops are not listed and the long-chain (>2 hops) counter cannot trigger. **Read:** - [Why a New Website Doesn't Show Up in Search, and the Free Stack That Fixes It](/blog/blog-new-website-discoverability-stack/): The priority-ordered list of free steps (sitemap submission, IndexNow, GBP, citations) that gets a brand-new business site into Google and Bing, with how long each step takes. - [Automated Hosting & Indexing Health Checks: Fix Google Search Console Errors Before They Tank Your Rankings](/blog/blog-hosting-indexing-health-checker/): Explains the GSC errors an owner actually sees (Page with redirect, Duplicate without canonical, Alternate page with proper canonical) and gives www/non-www and /index.html fixes per host. - [Index Coverage Delta, The Diff Between What GSC Sees and What You Actually Publish](/blog/blog-tool-index-coverage-delta/): Turns 'Discovered - currently not indexed' into a concrete punch list by comparing what the site links to, what the sitemap lists, and what GSC has seen. - [Search Console + Bing Importer: Cross-Reference Your Coverage Data Before It Costs You Traffic](/blog/blog-gsc-bing-csv-importer/): Shows how to export GSC and Bing Webmaster CSVs and merge them against the sitemap to find pages neither engine is indexing, with no API access. - [Your Coverage Report And Your Sitemap Disagree. Here's How To See Where.](/blog/blog-tool-search-console-importer/): The three-way diff (sitemap claims vs GSC reports vs Bing reports) and what each kind of disagreement means for the fix. - [Sitemap Delta: Finding the URLs Your Site Links To That Are Not in Your Sitemap (and Vice Versa)](/blog/blog-sitemap-delta-orphans-detection/): A real case where the sitemap listed 34 deleted pages that kept crawlers hitting 404s, and how to find and clean that drift in minutes. 52 more posts on this topic: [search the blog for "crawl"](/blog/?q=crawl). ### Titles, descriptions, headings and the tags on every page A title tag, a meta description that fits in the pixels Google allows, one H1, a canonical URL, Open Graph tags for when the page is shared: none of this is exotic, and nothing on bolt's pages says any of it is generated for you unless you ask. bolt's landing-page tutorial tells you to "Add the SEO title" and "meta description" in your prompt and, at publish time, to "add the page title and meta description," which is the right advice and a sign that the builder does not do it unless asked. The visual editor gives you one field, alt text on an image. Everything else is a prompt you have to know to write, and then a check you have to know to run. **Run, free, in your browser:** - [Meta + OG Inspector](/tools/meta-og-inspector/): Fetches a page and checks its title and meta description by character count, canonical, meta robots, five Open Graph tags (og:title, og:description, og:image, og:url, og:type), twitter:card and link icons, then renders one generic social-share card preview and builds a copyable AI fix prompt from the findings. - [SERP Snippet Preview](/tools/serp-snippet-preview/): Fetches (or lets you paste) a page's title, meta description and URL, measures them in canvas pixels using Arial at Google-like sizes, renders desktop and mobile SERP cards, and flags truncation against 600 px desktop / 460 px mobile titles and 920 px desktop / 680 px mobile descriptions, plus missing-tag warnings. - [Headings Outline Audit](/tools/headings-outline/): Fetches a URL, lists every heading H1 through H6 in order, and flags a missing H1, more than one H1, skipped levels and empty headings. - [Image Alt Audit](/tools/image-alt-audit/): Lists every image on a page and grades its alt text as present, missing, empty, a filename, too short or long, or duplicated, and flags missing width and height, with a button that writes an AI prompt to draft the alt text. - [Duplicate Title / Meta Description Audit](/tools/duplicate-title-meta-audit/): Fetches every URL in your sitemap (up to 500) and cross-compares the titles and meta descriptions to find exact duplicates, missing values, and character-length problems (titles outside 30-60, descriptions outside 120-160), with a copyable AI fix prompt. **Read:** - [The SpotHopper Website Checklist for Restaurant Owners: What to Check and What to Fix](/blog/spothopper-website-checklist-restaurant-owners/): Walks an owner on a managed restaurant platform through counting H1 tags, checking meta description length, page titles and broken sharing metadata, and sorts what they can fix themselves from what needs a support ticket. - [The Pre-Launch Audit Loop: Eight Things to Check Before You Tell Anyone the Site Exists](/blog/pre-launch-web-audit-loop/): Its 'Technical SEO fundamentals' dimension names titles, descriptions, canonicals, heading structure, Open Graph and internal links and points to the free tool for each, as part of a launch checklist an owner can run in an afternoon. - [Your pages look broken on social media because nobody checked the meta tags](/blog/blog-tool-og-twitter-card/): Lists the four Open Graph tags and the Twitter Card tag every shareable page needs so links posted to Facebook, LinkedIn or X show the right image and title. - [WCAG 1.1.1 Plus CLS Risk In One Pass, Image Alt Audit](/blog/blog-tool-image-alt-audit/): Covers what good alt text looks like (present, descriptive, 5-125 characters, not a filename) and the missing width/height attributes that shift the layout. - [Duplicate Title and Meta Description Audit: The SEO Problem Hiding in Plain Sight](/blog/blog-tool-duplicate-title-meta/): Explains how templates produce identical titles and descriptions across many pages, why search engines then guess which page to rank, and how to find every instance from the sitemap. - [Why a Duplicate Title and Meta Description Audit Exists](/blog/blog-tool-duplicate-title-meta-audit/): Ties the GSC 'Duplicate without user-selected canonical' report to hard-coded template descriptions and shows how the crawl finds the clusters. 32 more posts on this topic: [search the blog for "meta description"](/blog/?q=meta%20description). ### Structured data, the part that makes you a business and not a page Structured data is the JSON-LD block that tells Google and every AI engine that this page is a LocalBusiness with these hours, this phone number, these reviews, and that the FAQ on the page is a FAQPage. It is how you get a knowledge panel, a rich result, and a citation instead of a mention. The word "schema" appears in bolt's documentation only as a database schema. Nothing in 93 help pages or the company blog mentions JSON-LD, schema.org, LocalBusiness, FAQPage or rich results. This is the single largest gap between what bolt calls SEO and what a search engine calls a business, and it is entirely paste-able: the generators below write the block, the validators check it, and your AI plan puts it in the page. **Run, free, in your browser:** - [Schema.org / JSON-LD Validator](/tools/schema-validator/): Paste a URL or a JSON-LD block; it pulls out every @graph node, names its @type, and checks each type against the fields Google requires for a rich result, including missing @id links. - [Schema Fix Bundle](/tools/schema-fix-bundle/): Pick one or more page types and enter your page URL and identity details to get a single JSON-LD @graph with Google's rich-result required fields pre-filled with REPLACE placeholders, plus Organization + WebSite + BreadcrumbList + Person (author) nodes linked by @id, and a copyable AI prompt that fills the placeholders from your real page content. - [Rich Results Eligibility Audit](/tools/rich-results-eligibility-audit/): Fetches a URL, parses every JSON-LD block on the page (including @graph and nested nodes), and checks each of 15 rich-result schema types against a built-in list of Google's required and recommended fields and minimum item counts, so you learn why a valid block still gets no rich result, then emits a copyable fix prompt. - [FAQ Schema Parity Audit](/tools/faq-schema-parity/): Enter a URL or paste page HTML; it lists every Question in the page's FAQPage JSON-LD side-by-side with every visible question (details/summary, ?-headings, dt/dd, accordions), flags ghost schema-only entries, visible-only questions missing from schema, and matched answers with more than 30% text drift, and writes a single drop-in FAQPage JSON-LD block containing a Question for each missing question. - [JSON-LD Graph Linter](/tools/schema-jsonld-graph-linter/): Treats your JSON-LD as a graph: checks that every @id points at a real node, that no node is orphaned, and that paired properties like author and creativeWork point both ways. - [JSON-LD Schema Graph Visualizer](/tools/schema-graph-visualizer/): Fetches a page, parses every application/ld+json block, builds a node/edge graph from property nesting with @id references merged into shared nodes, draws it as a static concentric-ring SVG with a @type count table, and flags edge-less nodes (when more than one), blocks missing @context, and graphs where over half the nodes lack @id. (Report only; this one has no fix-prompt button.) **Read:** - [Structured data is not optional anymore and most of yours is broken](/blog/blog-tool-structured-data/): Plain explanation of what structured data does for rich results, knowledge panels and AI overviews, and the common ways it breaks. - [geo.position, LocalBusiness Schema, and og:locality: The Location Signal Triplet](/blog/blog-geo-meta-local-business/): Shows a local business the three location signals (geo meta, LocalBusiness schema with coordinates, og:locality) that Apple Maps, Bing, Siri and AI answer engines need. - [Every Place Your Business Needs a URL, and the One Line of Schema That Ties Them Together](/blog/business-listing-sameas-url-map/): Walks through the free business listings and the one sameAs line in Organization schema that tells a machine they are the same business. - [Schema Fix Bundle, Pick a Page Type, Get Complete JSON-LD Ready for AI Fill](/blog/blog-tool-schema-fix-bundle/): Explains the thirteen page-type presets and how to get a complete, linked JSON-LD graph without hand-writing it. - [A Schema.org Validator That Knows Google Rich-Results Requirements Per Type](/blog/blog-tool-schema-validator/): Explains why a generic validator passes schema Google will not use, and how to check per-type required fields. - [You have schema markup. Google still won't give you a rich result. Here's why.](/blog/blog-tool-rich-results-eligibility/): Covers partial schema, missing required fields, wrong nesting and incomplete types as reasons a rich result never appears. 45 more posts on this topic: [search the blog for "schema"](/blog/?q=schema). ### Answer engines: the FAQ that gets quoted and the one that gets ignored Answer engine work is about whether a paragraph on your page can be lifted out and used as the answer to a question, by a featured snippet, a People Also Ask box, a voice assistant or an AI Overview. It comes down to question-shaped headings, short direct answers under them, and FAQ markup that matches the visible questions word for word. bolt's pages have no hit for featured snippet, People Also Ask, FAQ schema, speakable, answer engine or AI Overview. The curated SEO/GEO skill might address some of it, but its contents are not published, so you cannot know from the docs. **Run, free, in your browser:** - [FAQ Answer Extractability Scorer](/tools/faq-answer-extractability/): Fetches a URL, pulls every Q&A pair from FAQPage JSON-LD,
blocks and question-shaped headings, and scores each answer 0-100% on 8 heuristic language checks (40-300 characters, subject-first opener, pronoun density under 6%, fact density, question subject echoed, declarative opener, direct-answer verb, self-contained first sentence) that predict featured-snippet and AI-answer lift, then emits an AI rewrite prompt for the weak answers. - [Featured-Snippet Extractability Audit](/tools/featured-snippet-extractability/): Fetches a URL (or pasted rendered HTML) and scores its structural readiness for each featured-snippet shape: question-shaped H2s, a 30-80 word answer paragraph directly under each, extractable lists (3-10 items), properly-headed tables, a leading "X is / refers to / means" definition pattern, FAQPage/HowTo/Question schema presence, H2 count, and noindex or max-snippet:0 directives that block snippets, then emits a copyable fix prompt. - [FAQ Harvester](/tools/faq-harvester/): Takes a target query plus up to 10 user-pasted top-ranking URLs, fetches each page, pulls every question from their FAQPage JSON-LD, details/summary accordions and question-shaped headings (with the following paragraph as the answer), dedupes them by Jaccard similarity, clusters them by interrogative lead, and outputs a ready-to-paste FAQPage JSON-LD block for the top 10 questions plus a copyable AI rewrite prompt. - [Speakable Schema Generator](/tools/speakable-generator/): Fetches a URL, extracts each H1/H2/H3 heading and the first paragraph after it, pre-selects the answer-shaped pairs (paragraph 60-320 chars), and emits a WebPage JSON-LD block with a nested SpeakableSpecification whose cssSelector list tells Google Assistant and AI engines which heading and answer-paragraph elements to read aloud or quote, with a copyable LLM implementation prompt. - [SERP Feature Opportunity Matrix](/tools/serp-feature-opportunity-matrix/): Fires up to 6 target queries at DuckDuckGo and Bing, heuristically detects 12 SERP feature types (including Featured Snippet and People Also Ask), and renders a feature-by-query matrix (Bing first, DuckDuckGo as fallback) plus your Bing organic rank per query and how-to-qualify/schema advice for each feature that fires on half or more of your queries. (Report only; this one has no fix-prompt button.) - [SGE Readiness Audit](/tools/sge-readiness-audit/): Scores a page on 18 signals for Google AI Overviews, including whether the first paragraph is a concise direct answer, whether H2s are written as questions, and whether FAQPage or HowTo schema is present. **Read:** - [The Hidden FAQ-Schema Bug Killing Your Rich Results (and the Tool That Finds It)](/blog/blog-tool-faq-schema-parity/): Explains the Google rule that one ghost question or drifted answer in FAQPage schema suppresses the whole rich result, and walks through the parity audit's four-state diff and drop-in JSON-LD fix. - [Your FAQ schema probably doesn't match what's actually on the page](/blog/blog-tool-faq-schema/): Shows the four ways FAQ schema drifts away from the visible FAQ (content edits, CMS plugins, JS accordions, ghost questions) and how to keep both in sync from one data source. - [Featured snippets follow a pattern. If your content doesn't match it, you won't get one.](/blog/blog-tool-featured-snippet/): Gives the exact page shape that wins Position Zero: a question-shaped H2 followed immediately by a 40-60 word answer paragraph, and why most business pages fail it. - [FAQPage Schema Alone Won't Get You Featured, Answer Quality Does](/blog/blog-tool-faq-answer-extractability/): Shows with a good/bad example pair why an answer that opens with 'It means...' never gets lifted, and lists the 8 answer-writing rules the scorer checks. - [Harvest Every FAQ From the Google Top 10, Deduped and Ready to Implement](/blog/blog-tool-faq-harvester/): Tells an owner how to find the questions the top-ranking competitors already answer (the source of People Also Ask and AI Overview answers) and get them back as a FAQPage block to answer better. - [SpeakableSpecification: The Schema Tag That Tells AI What to Quote](/blog/blog-speakable-schema-ai-citations/): The site's main voice-search post: what Speakable markup is, a complete JSON-LD example, and how to pick the two or three quotable sentences on a page for voice assistants and AI citations. 20 more posts on this topic: [search the blog for "AEO"](/blog/?q=AEO). ### Being read by ChatGPT, Claude, Perplexity and Google's AI Generative engine work starts with a question bolt's pages do not raise: are the AI crawlers even allowed in? GPTBot, ClaudeBot, PerplexityBot and Google-Extended each read robots.txt and each can be blocked by a host's bot challenge without anyone noticing. After access comes the files those engines look for (llms.txt, ai.txt), the clarity of the entity they are reading about, and whether your sentences are specific enough to cite. bolt's help center uses an llms.txt for its own documentation and can ingest one you upload as design-system context; it says nothing about publishing one for your site, and nothing about any AI crawler by name. **Run, free, in your browser:** - [AI Bot Policy Generator](/tools/ai-bot-policy-gen/): Pick allow or block per AI crawler, separately for crawling (robots.txt) and training (ai.txt), and it generates copyable robots.txt (with per-bot blocks and a Content-Signal line) and ai.txt text to serve at both /ai.txt and /.well-known/ai.txt, for 22 AI bots (29 with legacy search bots), plus curl verification commands and a per-bot intent matrix. (Writes the file itself, so there is no prompt to paste.) - [AI Posture Audit](/tools/ai-posture-audit/): Fetches robots.txt, ai.txt (root and /.well-known/), the page's meta robots tag and the X-Robots-Tag header, builds a per-AI-crawler matrix showing where the crawl sources disagree and where ai.txt denies training, live-probes each bot's User-Agent to catch CDN challenge blocks, sweeps llms.txt / llms-full.txt / agent-card / MCP / AGENTS.md discovery files, and has Copy master prompt and Copy prompt buttons. - [AI Bot Allowlist Validator](/tools/ai-bot-allowlist-validator/): Sends a real HTTP request to your URL as GPTBot, OAI-SearchBot, ChatGPT-User, ClaudeBot, PerplexityBot, Applebot, Googlebot, bingbot, Bytespider, CCBot, Meta-ExternalAgent, Amazonbot and other live-probeable AI crawler User-Agents, compares each response to a desktop-browser baseline, and reports per bot whether it got full content, a partial/stripped body, a Cloudflare/WAF challenge page, or a hard block; UA-only, so IP-verified allowlists are not simulated. - [LLMs.txt Generator](/tools/llms-txt-generator/): Builds a spec-shaped /llms.txt from your sitemap (H1, blockquote description, H2 sections by path, titled links) and diffs it against the file you already serve. (Writes the file itself, so there is no prompt to paste.) - [Agent Ready Audit](/tools/agent-ready-audit/): Runs 17 probes (12 scored) on a URL, robots.txt, sitemap, Link headers, Accept: text/markdown negotiation, per-bot robots.txt rules for GPTBot / OAI-SearchBot / ClaudeBot / PerplexityBot / Google-Extended, Content-Signal directive, Web Bot Auth directory, API Catalog (RFC 9727), OAuth/OIDC discovery, MCP server card, Agent Skills index, WebMCP, and four informational commerce protocols, mirroring the Cloudflare Agent Readiness Score, with a copy-AI-fix-prompt button for failed checks. - [Mega AEO Analyzer](/tools/mega-aeo-analyzer/): One URL, 13 answer-engine probes in a single pass (schema density, attribution coverage, passage retrievability, freshness, crawler accessibility via meta robots and X-Robots-Tag, tokenizer efficiency, prompt-injection defense, noai bot posture, Speakable, author E-E-A-T, NLWeb, WebMCP, UCP/ACP agent commerce) with an averaged AEO health score, Fix / Audit / Learn links per finding, and a copyable AI fix prompt. **Read:** - [Cloudflare is blocking AI crawlers from your site. Here's how to fix it without weakening bot protection.](/blog/blog-cloudflare-ai-crawler-allowlist/): Shows why a Cloudflare challenge page makes a site invisible to ChatGPT, Claude and Perplexity and how to allowlist the bots without turning protection off. - [Does Your robots.txt Agree With Your ai.txt? The Silent AI-Crawler Misconfig Most Sites Have](/blog/blog-ai-posture-consistency/): Explains the four places (robots.txt, ai.txt, meta robots, X-Robots-Tag) that tell AI bots what they may do and why they must agree. - [Your AI Bot Policy Lives In Three Files, And They Probably Disagree](/blog/blog-tool-ai-bot-policy-gen/): Short walkthrough of generating one consistent robots.txt + ai.txt + .well-known/ai.txt policy instead of three contradicting files. - [I shipped a tool that probes your site as ChatGPT, Claude, Perplexity, and 13 other bots so you can see exactly who is being blocked](/blog/blog-tool-ai-bot-allowlist-validator/): Tells an owner how to prove, not guess, which AI bots actually get through their CDN. - [Vercel BotID and Cloudflare Bot Fight Mode Silently Block AI Search, Now Auto-Detected](/blog/blog-mega-analyzer-bot-challenge-detector/): Names the default-on host settings (Vercel, Cloudflare, WAFs) that bounce GPTBot, OAI-SearchBot, ClaudeBot and PerplexityBot. - [Your Site Might Be Invisible To ChatGPT For A Reason That Never Shows Up In Google Search Console](/blog/blog-499-ai-search-eligibility-cloudflare/): Explains the 499 timeout: real-time AI fetchers give up on slow origins, so a slow site is cut from AI answers even when Google is fine. 86 more posts on this topic: [search the blog for "GEO"](/blog/?q=GEO). ### Local: the Business Profile, the map pin and the directories For most small businesses the search result that pays is the map pack, and the map pack is decided by Google Business Profile, the consistency of your name, address and phone across directories, your reviews, and the LocalBusiness schema on your site. bolt's blog writes about home services and trades, contractors and HVAC companies among them, as the owners building on it, and neither those posts nor the small business page mentions Google Business Profile, Bing Places, Apple Maps, citations or NAP. The closest the product pages get is a prompt card on the website builder page for a "Google Maps embed," which is a map on your page, not your pin on the map. This is also where the browser agent in your plan earns its keep: claiming and finishing a Business Profile is a form-filling job, and Claude in Chrome or Gemini's auto browse can sit in the tab with you. **Run, free, in your browser:** - [Mega GEO Analyzer](/tools/mega-geo-analyzer/): Paste one business URL and it fetches that single page and runs ten local SEO checks on it (NAP, LocalBusiness schema, areaServed service area, review/AggregateRating signals, hyperlocal city/ZIP mentions, opening hours, geo coordinates, multi-location structure, service categories via makesOffer, and sameAs directory-profile links), averages them into a 0-100 GEO Health Score, and lists the fixes. - [GBP + Review Signal Audit](/tools/gbp-review-audit/): Fetches your website and grades 16 on-site GBP-parity signals plus two non-detectable process reminders (review-response cadence, Google Posts cadence), then builds a copyable GBP fix prompt from the fails and warnings. - [NAP Consistency Checker, Local Listings](/tools/nap-consistency/): Paste your canonical name, phone and address, then paste each listing as a pipe-separated line (Listing | Name | Phone | Address); it normalizes formatting (phone punctuation, street-suffix and directional abbreviations, Suite/Ste, trailing LLC/Inc, spacing) and flags the substantive name, phone or address differences that remain, then builds a copyable AI prompt listing the fixes per platform. - [Local Directory Coverage Check](/tools/local-directories/): Opens name-plus-city search queries on 12 local directories (Yelp, BBB, Bing Places, Yellow Pages, Foursquare, Nextdoor, Apple Maps, Facebook, Angi, HomeAdvisor, Thumbtack, TripAdvisor) in new tabs so you can tick which ones already list your business, then generates a copyable AI prompt asking for add-a-business URLs, requirements and verification steps for the directories you left unticked; it performs no automated lookup itself. - [Google Maps Listing Audit](/tools/google-maps-audit/): Paste a Google Maps place URL and it fetches the signed-out public preview, regex-extracts the title, og:description, hero image, rating, review count, phone and address, then runs about 19 pass/fail map-pack checks and emits a copyable AI fix prompt; category is not extracted as a field and hours are only presence-tested, not pulled. - [Apple Business Connect Audit](/tools/apple-business-audit/): A self-scored 24-signal checklist for an Apple Business Connect / Apple Maps listing (category, name, logo/hero/photos, hours, Showcases, Action items like Order/Menu/Reserve/Gift Card, Apple Pay, Siri, Look Around, attributes) that, with up to 5 competitor profile URLs, builds a Markdown competitive gap worksheet and a copyable AI brief for a 90-day action plan. **Read:** - [Google, Apple, Yelp, Bing. The Four Local-Presence Platforms Every US Small Business Needs to Own](/blog/blog-tool-local-presence-matrix/): Explains why owning only Google misses roughly 40-45% of US local search and walks the four listing platforms with the signals each one needs. - [Your Google Business Profile Is Leaking Revenue. 18 On-Site Signals That Fix It](/blog/blog-tool-gbp-review-audit/): Lists the 18 website signals Google uses to verify a Business Profile and which GBP dashboard field each one has to match. - [All Local SEO Probes In One Orchestrator](/blog/blog-tool-mega-geo-analyzer/): Describes the ten local SEO dimensions the free orchestrator scores and ranks them by ranking impact, replacing paid BrightLocal and Local Falcon subscriptions. - [Review Velocity for Local Businesses: The Cadence, Response Targets, and Aggregators That Actually Move Rankings](/blog/blog-local-review-velocity-cadence/): Gives monthly review floors and response-time targets per business type and says which review aggregator tier is worth paying for at each size. - [Your listing links to a working website that is not yours any more](/blog/blog-what-directories-believe-about-your-business/): Shows how to audit what third-party directories and open places datasets (including OpenStreetMap) hold about your business, why dead website URLs pass link checkers, and how to fix the records. - [NAP Consistency for Local Rank, Why "Street" vs "St." Costs You Map-Pack Position](/blog/blog-tool-nap-consistency/): Explains how a single spelling or phone-format difference splits your business into duplicate identities across listings and how to pick one canonical NAP. 34 more posts on this topic: [search the blog for "local SEO"](/blog/?q=local%20SEO). ### Trust: who is behind this site, and can a machine confirm it Google's quality guidelines and every AI engine's retrieval layer want to know who wrote the page, whether the business is real, and whether the same entity shows up on LinkedIn, Wikidata and the Business Profile. That means an About page with a person on it, Person and Organization schema with sameAs links, visible dates, a privacy policy and terms, and reviews marked up so they can be read. bolt's prompt examples mention team bios and testimonials as page sections; the landing-page tutorial's advice stops at replacing generic testimonials and invented company names before you publish, and nothing in its documentation says what makes those sections credible to a machine. **Run, free, in your browser:** - [E-E-A-T Analyzer](/tools/eeat-analyzer/): Scores one URL 0-100 on each of the four E-E-A-T pillars (Experience, Expertise, Authoritativeness, Trustworthiness) from its JSON-LD (Person/Organization fields, sameAs depth and quality, dates, contact and review markup), rel="me" links, About/policy/contact link presence, body-text credential and first-person cues, and crawlability files (robots.txt, sitemap, security.txt), then derives a Knowledge Panel readiness tier. - [E-E-A-T Workbench Generator](/tools/eeat-generator/): Pick an industry, type in your business, author, profile-URL, review and credential details, and it writes the Organization/LocalBusiness and Person JSON-LD (with sameAs), rel="me" links, an author-bio partial and trust-badge partial you paste into your site, plus an on-page six-phase action-plan checklist. (Writes the file itself, so there is no prompt to paste.) - [Trust Signal Surface Audit](/tools/trust-signal-surface-audit/): Fetches a target page plus its /about, editorial-policy, corrections, /contact, /privacy, /terms, /authors and /team paths and scores 16 checks: the 12 GNI-model trust artifacts plus a visible "Updated on [date]" body-text stamp, a visible street address and hours of operation in body text, and a resource-hints (preconnect/preload) performance check, then emits a copyable AI prompt to draft the missing pages. - [Author Authority per Article](/tools/author-authority-per-article/): Fetches a single article URL and scores it 0-8 on authorship signals: Article/BlogPosting schema type, author name and author.url in the Article JSON-LD (reporting the author's @type), rel=author, visible byline, byline link to an /author/ page, author photo, an author-bio text marker, and datePublished/dateModified, then emits a copyable AI fix prompt. - [E-E-A-T Author Entity Graph](/tools/e-e-a-t-author-entity-graph/): Fetches a site's homepage (or pasted rendered HTML) plus up to 10 same-origin author/team/about pages, extracts every JSON-LD Person (plus rel=author fallbacks) with its hasCredential, knowsAbout and sameAs links, draws a static SVG author-entity graph, and flags gaps through color-coded stat tiles and a 0-100 author-entity score; it does not read plain-text bylines. - [About-Page Conversion Audit](/tools/about-page-conversion-audit/): Fetches an About page and runs 14 trust and conversion checks (founder photo alt/filename, tenure and quantified experience, credentials, press mentions, Person/Organization/AboutPage schema with sameAs, email/phone contact path, booking link, CTA, team link, origin story, values, video, affiliations, physical address), scores it out of 100, and emits a copyable AI fix prompt. **Read:** - [E-E-A-T Authority for Brands: What It Is and Why Google Demands It (Part 1 of 5)](/blog/blog-eeat-authority-foundations/): Plain explanation of the four pillars and why consistent identity across platforms is the base of everything else in this category. - [Building Your E-E-A-T Profile Network: Google, Wikidata, LinkedIn & More (Part 2 of 5)](/blog/blog-eeat-google-wikidata-profiles/): Step-by-step setup of the seven free profiles (Wikidata, GBP, LinkedIn, Crunchbase, ORCID, etc.) that become the sameAs targets on an owner's Person and Organization schema. - [E-E-A-T Schema Markup: The JSON-LD That Makes Google Understand Your Brand (Part 3 of 5)](/blog/blog-eeat-schema-structured-data/): The exact Person and Organization JSON-LD blocks with sameAs and knowsAbout an owner can copy into the site head. - [E-E-A-T Reviews & Social Proof: How to Build Trust Signals Google Can Verify (Part 4 of 5)](/blog/blog-eeat-reviews-social-proof/): How to collect reviews by platform, add AggregateRating schema and use testimonials as verifiable trust signals. - [How to Trigger a Google Knowledge Panel: The E-E-A-T Endgame (Part 5 of 5)](/blog/blog-eeat-author-authority-knowledge-panel/): The combined signal set (Wikidata, schema, external profiles) that gets a person or brand its own Knowledge Panel. - [E-E-A-T Is Content. Trust Signals Are Infrastructure.](/blog/blog-tool-trust-signal-surface-audit/): Lists the 12 ship-once trust artifacts (author bio, editorial and corrections policy, About depth, visible dateModified, address, phone, privacy, terms, review link) a site should carry. 44 more posts on this topic: [search the blog for "E-E-A-T"](/blog/?q=E-E-A-T). ### Speed and Core Web Vitals Core Web Vitals are Google's three field-measured speed numbers, and a React application built with a bundler has to work harder to hit them than a plain page does: more JavaScript, more layout shift risk, more third-party scripts. bolt's Cloud post promises pages that are "lightning fast" and pre-rendered; its help center has no page on Core Web Vitals, caching headers or render-blocking resources, and no way to measure any of them. Its images page says AI-generated images are converted to WebP and lists the upload formats it accepts, and stops there. The landing-page tutorial on the company blog does tell you to open PageSpeed Insights and check all three Core Web Vitals, which is the right instruction and the only one. The tools below pull real Chrome user data where it exists and run the lab checks where it does not. **Run, free, in your browser:** - [Core Web Vitals Audit](/tools/cwv-audit/): Fetches a page's HTML and scores heuristic LCP, CLS and INP (0-100 each) from HTML document size, render-blocking scripts (no async/defer) and stylesheets, eager-loaded image count, images missing width/height, @font-face without a preload or font-display:swap, total and inline script counts, and GTM presence, with no Google API key, then emits a copyable AI fix prompt. - [CWV Fix Generator](/tools/cwv-fix-generator/): Parses pasted CWV audit text by keyword (or takes checked issues) and emits generic, copyable HTML/CSS/JS template patches for LCP, CLS and INP plus font-display, content-visibility, preconnect, lazy loading, AVIF/WebP picture markup, Cache-Control headers and Brotli/gzip config, bundled with the issue list into an AI remediation prompt. - [CrUX Field Data Probe](/tools/crux-field-data-probe/): Calls the public PageSpeed Insights v5 API for mobile or desktop and shows the Chrome UX Report real-user p75 LCP, INP, CLS, FCP and TTFB for the URL (falling back to origin-wide data when the URL lacks traffic), rates each against Google's thresholds, and emits a copyable AI fix prompt. - [Image LCP Candidate Audit](/tools/image-lcp-candidate-audit/): Fetches a page, treats the first in source order as the probable LCP candidate, and flags loading="lazy" on it, missing width/height, missing srcset, missing fetchpriority="high", legacy JPG/PNG/GIF instead of WebP/AVIF, and missing alt, then counts lazy, undimensioned and legacy-format images across the first six, counts render-blocking stylesheets, and emits a copyable AI fix prompt. - [Third-Party Script Cost Audit](/tools/third-party-script-cost/): Fetches a page, lists every cross-origin script tag, fetches each script to report its uncompressed body size, flags whether each tag is async, defer, or parser-blocking, rates each host high/medium/low from a curated table of ~40 known third parties, ranks by that rating and size, and emits a copyable fix prompt; it does not measure main-thread time or model LCP/INP directly. - [Edge Cache Effectiveness Probe](/tools/edge-cache-effectiveness-probe/): Probes up to 30 pasted URLs through a server-side fetch, reads the CF-Cache-Status, X-Cache, Cache-Status and Age headers to classify each as edge HIT, MISS, aged, dynamic or unknown, reports the overall edge-hit ratio, and flags unversioned URLs served with immutable or month-plus max-age Cache-Control. **Read:** - [Auditing Core Web Vitals, A Client-Side Approach Without the PSI Quota](/blog/blog-tool-cwv-audit/): Explains the three numbers Google scores you on (LCP, INP, CLS), the thresholds, and the usual causes, then points at a free audit that needs no API key. - [CWV Fix Generator, LCP, CLS, INP Patches From a Core Web Vitals Audit](/blog/blog-tool-cwv-fix-generator/): Turns a bad CWV number into the exact HTML, CSS and JS to paste, covering image formats, srcset, width/height, defer, Cache-Control and compression. - [Your Lighthouse score is lying to you. Here's what Google actually measures.](/blog/blog-tool-crux-field-data/): Tells an owner why a green Lighthouse score can still lose rankings and which real-user metrics to check instead. - [Your Lighthouse Score Is Green But Real Users Are Suffering](/blog/blog-tool-cwv-field-vs-lab-gap/): Shows how to compare lab and field numbers per metric and what to fix for each kind of gap. - [Why CrUX Field Data Probe Exists](/blog/blog-tool-crux-field-data-probe/): Companion to the probe that pulls Google's real-user p75 data without paying for a monitoring tool. - [Your hero image is lazy-loading. That's why your LCP score is terrible.](/blog/blog-tool-image-lcp-candidate/): The most common self-inflicted LCP failure on small sites, with the fetchpriority fix and WebP/AVIF picture markup. 45 more posts on this topic: [search the blog for "Core Web Vitals"](/blog/?q=Core%20Web%20Vitals). ### Accessibility, which is also legal exposure An inaccessible site is a demand letter waiting to happen, and an AI-generated React app is not accessible by default: contrast, focus order, form labels and toggle states all need to be asked for and then tested. bolt's prompt library has an accessibility category and the visual editor has an alt text field; the help center never mentions WCAG. The audit below checks against WCAG 2.2 AA and, like the rest, hands you a fix prompt. **Run, free, in your browser:** - [WCAG Accessibility Audit, WAVE-Style, with 2.1 / 2.2 AA + 3.0 Draft Coverage](/tools/wcag-accessibility-audit/): Fetches a URL's static HTML, runs roughly 50 conditional WCAG 2.1/2.2 AA and 3.0-draft checks, exports HTML/CSV/PDF, batch-compares up to 20 URLs with a combined CSV, and builds a copyable AI fix prompt; the page itself states it cannot verify rendered color contrast, focus order, keyboard traps or screen-reader announcements. - [ADA Litigation Risk Score](/tools/ada-litigation-risk/): Fetches one page and scores it on the signals plaintiff firms lead demand letters with (missing alt count, unlabeled form inputs, linked PDFs, uncaptioned video, no accessibility statement, overlay widget, modal keyboard-trap indicators, html lang, skip link, single-H1 check, inline light-gray hex colors) plus a state jurisdiction lens with California Unruh Act highest, rolls them into a HIGH/MODERATE/LOW composite, and writes a copyable remediation prompt. - [WCAG Fix Generator](/tools/wcag-fix-generator/): Takes pasted output from the WCAG Accessibility Audit (CSV, JSON or free text) or manually ticked failures from a built-in WCAG 2.2 A/AA/AAA success-criterion grid, then emits one copyable AI prompt asking for per-failure HTML/CSS/ARIA/JS patches grouped by file plus a conformance checklist, and separately generates a local 30-day remediation roadmap against a selectable WCAG 2.2 target level. - [Form Conversion Audit](/tools/form-conversion-audit/): Parses every form on a page, counts fields, flags inputs with no label or aria-label (placeholder-only is called out as a WCAG failure), missing autocomplete hints, and required fields that should be optional, then emits a priority fix list. - [User Preference Media Queries](/tools/prefers-color-scheme-audit/): Fetches a page and its inline styles plus up to five linked stylesheets, counts @media rules for prefers-color-scheme (dark and light), prefers-reduced-motion, prefers-contrast, forced-colors (Windows High Contrast) and prefers-reduced-data, checks for the color-scheme property or meta tag and a manual dark-mode toggle selector, then warns on missing dark-mode, color-scheme and reduced-motion support, marks the rest as info, and emits a copyable AI fix prompt. - [Legal Pages Generator](/tools/legal-pages-generator/): From business name, site URL, contact email and effective date, generates a paste-ready Accessibility Statement alongside Privacy, Cookie, Terms, Disclaimer, Refund and DPA pages that vary by business type, jurisdictions and data collected, in Markdown and copy-as-HTML, with a master AI customize prompt; the page says template only, not legal advice. **Read:** - [Why I Built the WCAG Audit Tool (and Why You Probably Need It More Than You Think)](/blog/blog-why-the-wcag-audit-exists/): Sets out the 5,000-lawsuit-a-year reality, the $11,500 yoga-studio settlement, the FTC accessiBe overlay fine, and a three-step self-test an owner can run in fifteen minutes with no signup. - [ADA Web Accessibility Lawsuits Hit 4,500 Filings in 2024. Most Targets Are SMBs Under $25M](/blog/blog-tool-ada-litigation-risk/): Walks the 12 signals plaintiff firms put at the top of demand letters, in order, with the fix for each and why California, New York and Florida carry most of the filings. - [Why I Built a WCAG 2.1 / 2.2 AA + 3.0 Draft Accessibility Audit Tool (and How to Fix Every Issue It Finds)](/blog/blog-wcag-accessibility-audit/): Lists what every WCAG check in the audit looks for, grouped by principle, with the fix for each, and is explicit that a static scan cannot verify contrast or keyboard behavior. - [WCAG Fix Generator, Turn the Audit's Failure List Into an AI Remediation Prompt](/blog/blog-tool-wcag-fix-generator/): Shows how to turn a 50-failure audit into one AI prompt of per-failure patches and a 30-day roadmap ordered by lawsuit exposure, so the list actually gets finished. - [Most forms fail accessibility before anyone ever fills them out](/blog/blog-tool-form-accessibility/): Explains missing labels, autocomplete hints and focus order on contact and checkout forms, the UsableNet filing numbers behind form complaints, and the checklist to run. - [If your text contrast fails WCAG, one in twelve male visitors can't read it](/blog/blog-tool-text-contrast/): Gives the 4.5:1 and 3:1 thresholds, why placeholder text is the worst offender, and how to answer a designer who says AA looks too harsh. 20 more posts on this topic: [search the blog for "WCAG"](/blog/?q=WCAG). ### Security headers, TLS and the email your domain sends bolt does document this side better than any other: it issues SSL certificates for connected domains, it has a DNS record editor in project settings, and on paid plans it runs a real security audit of your app's data access, sign-in and stored keys. What it does not cover is the response the browser sees (HSTS, CSP, X-Content-Type-Options and the rest of the header set) or the records behind the email your domain sends. Its send-emails page has you paste whatever DNS records Resend hands you and never names SPF, DKIM or DMARC, the three records that keep invoices from you out of spam and stop someone else forging them. In the study that inspired one of the posts below, five AI coding tools built fifteen apps and zero shipped a security header. Name them in the prompt. **Run, free, in your browser:** - [Mega Security Analyzer](/tools/mega-security-analyzer/): Runs one URL through eight security layers at once: TLS version and cipher, post-quantum hybrid key exchange, security header coverage (HSTS, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, clickjacking), CSP strictness grading, SPF/DKIM/DMARC/CAA DNS records, MITRE ATT&CK mapping, CWE/OWASP pattern scan and outdated JavaScript/npm versions, then re-probes the critical header and file-exposure failures three times server-side to drop CDN false positives, and emits a copyable AI fix prompt. - [Security Headers + Cookie Audit](/tools/security-headers-audit/): Fetches a URL, scores HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP/COEP/CORP and Cache-Control (no cookie-flag checks despite the title), and emits a paste-ready header config for ten targets: Netlify, Cloudflare Pages, Cloudflare Workers, Vercel, nginx, Apache, Caddy, AWS CloudFront, DigitalOcean App Platform and Express/Node. - [DNS + Email Authentication Audit](/tools/dns-email-audit/): Queries DNS-over-HTTPS for a domain's SPF, DKIM (auto-scanning 76 common selectors in parallel), DMARC, CAA and MX records, recursively counts SPF lookups against the 10-lookup limit, estimates DKIM key strength, flags weak DMARC policies, reads the DMARCbis tags (np, psd, t, sp), checks MX hosts against five RBL blacklists, and scores MTA-STS, BIMI and TLS-RPT into a BEC posture score. - [DNS Records Generator](/tools/dns-records-generator/): Takes an apex domain, a DMARC report address and an email provider preset, and writes out SPF, MX, DKIM (selector pre-filled, public key as a placeholder), DMARC, CAA, optional BIMI and MTA-STS/TLS-RPT records in BIND, Cloudflare Terraform, DigitalOcean doctl/Terraform, AWS Route53 CLI-JSON/Terraform and Google Cloud DNS gcloud/Terraform syntax, plus per-provider DNSSEC enablement instructions. (Writes the file itself, so there is no prompt to paste.) - [SSL Grade](/tools/ssl-grade/): Runs a server-side TLS handshake against a site (plus a second handshake probing hybrid X25519MLKEM768 key exchange) and scores protocol version, AEAD cipher, certificate chain validity, key strength, days to expiry, OCSP stapling and post-quantum readiness, adds an HSTS max-age check from a separate HTTPS header fetch, and rolls the result into an A+ to F letter grade. (Report only; this one has no fix-prompt button.) - [Uptime + Response-Time Diagnostic](/tools/uptime-check/): Probes any public URL once via a server-side fetch and reports HTTP status, round-trip response time, final URL after redirects, Content-Type, Server and Cache-Control headers, negotiated TLS protocol version and certificate days-to-expiry; a one-shot diagnostic, not a continuous monitor (no HSTS or other security-header checks). (Report only; this one has no fix-prompt button.) **Read:** - [How to Send Email That Actually Gets Delivered: A Small-Business Infrastructure Playbook](/blog/blog-email-infrastructure-small-business/): The full setup for a business domain's email: which sending lane to use, SPF/DKIM/DMARC on the DNS host, a secondary domain, and a 21-day warmup so mail lands in the inbox. - [HSTS, CSP, and the Security Header Bundle: The Trust Signal You Send With Every Response](/blog/blog-security-headers-trust-bundle/): The six-header bundle to ship on every site, with the exact values and the Netlify config to deploy them. - [The Six Security Headers Every Site Should Ship in 2026. And The Three That Actually Matter](/blog/blog-modern-security-headers/): The 2026 baseline for CSP, HSTS, X-Content-Type-Options, Referrer-Policy and the COOP/CORP pair, and which ones to skip. - [DNS Records Generator, One Email Setup, Five Provider Syntaxes, Zero Typos](/blog/blog-tool-dns-records-generator/): Explains the eleven DNS records a small-business email setup needs and why each DNS host's syntax trips people up. - [The Domain You Don't Send Email From Is Still Spoofable: Locking Down Parked Domains](/blog/blog-parked-domain-email-lockdown/): The two DNS records (SPF -all and DMARC p=reject) that stop scammers from forging invoices from a domain you own but never email from. - [DMARCbis Is Here: What the New DMARC Standard Actually Changes for Your Domain](/blog/dmarcbis-the-new-dmarc-standard/): What the May 2026 DMARC re-publication changed (pct removed, t and np added, DNS tree walk) and what to do to an existing record. 34 more posts on this topic: [search the blog for "security headers"](/blog/?q=security%20headers). ### Content, keywords and what the top ten already do Before you write the services page, it helps to know what the ten pages already ranking for your service in your town look like: their headings, their schema, their word count, the questions they answer. That is what an agency's content brief is, and it is what the keyword and SERP tools below produce from a query and a list of URLs. bolt has a Writing Guidelines skill and an SEO prompt category; the help center publishes the contents of neither, though the prompt text does show in the product when you hover over a prompt name. It has nothing that looks at a search result. **Run, free, in your browser:** - [Keyword Inspection](/tools/keyword-inspection/): Paste a search term, your page URL and up to ten top-ranking Google URLs; it fetches each page, compares titles, H1-H3 headings, JSON-LD schema types, word count and rich features (FAQ, HowTo, tables, lists, media) against your page, tags the query's intent and funnel stage, lists the keyword, heading-topic, schema and depth gaps, and emits a copyable AI rewrite prompt built from those gaps. - [Content Velocity Monitor](/tools/content-velocity/): Save a snapshot of a list of URLs today, re-run later, and see word-count changes, added or removed H2s, schema changes and publish-date drift, all stored in your browser. - [SERP Feature Coverage Tracker](/tools/serp-features/): Paste the raw HTML of a Google SERP with your domain and up to 10 competitor domains; it regex-detects 14 SERP feature signatures, ranks hostnames by mention count, shows which features each competitor appears near (proximity heuristic), flags the features competitors sit near that you do not, and builds a copy-ready 8-section AI strategy prompt. - [Competitor Gap Matrix](/tools/competitor-gap-matrix/): Enter your URL and up to 3 competitor URLs; it fetches each page and runs the same six-dimension heuristic audit (on-page hygiene, schema, security headers, performance signals, AEO markup, trust signals) on all of them, renders a matrix highlighting who wins each dimension, lists your top 5 score gaps, and emits a copyable fix prompt. - [Content Gap TF-IDF Analyzer](/tools/content-gap-tfidf/): Enter a keyword and optionally your URL; it pulls the top DuckDuckGo results (3-10 competitors, default 8), runs TF-IDF over unigrams and bigrams, and lists up to 25 phrases the ranking pages use that your page does not, plus phrases you under-use and over-use, with a copyable fix prompt. - [Heading Gap Audit](/tools/heading-gap-audit/): Enter your article URL and 1-5 competitor URLs; it fetches each page, extracts every H2 and H3, fuzzy-clusters the competitor headings into subtopics, marks which subtopics you cover or miss (with how many competitors cover each), scores your coverage percentage, lists headings unique to your page, and emits a copyable AI prompt to draft the missing sections and a revised outline. **Read:** - [Launching a New Site? Run Keyword Inspection Before You Write the Homepage](/blog/blog-keyword-inspection-launch/): Shows an owner how to read the ten pages that already rank and build the homepage, URL structure and schema around them before writing a word. - [Who Owns the AI Overview, Featured Snippet, and PAA for Your Query, A Free Tracker](/blog/blog-tool-serp-features/): Tells an owner which SERP features fire for their query and which competitor owns each, so they know whether ranking alone will bring clicks. - [Which SERP features do your queries trigger? The matrix tells you in 60 seconds](/blog/blog-tool-serp-feature-opportunity-matrix/): Walks through detecting 12 feature types across six target queries and picking the feature to target instead of just chasing rank. - [What Topics Your Competitors Cover That You Don't, Heading Gap Audit](/blog/blog-tool-heading-gap-audit/): Gives the free version of the Clearscope subtopic-gap check: which H2/H3 topics competitors cover that your article misses. - [Why Content Gap TF-IDF Analyzer Exists](/blog/blog-tool-content-gap-tfidf/): Explains the TF-IDF phrase-gap method paid content editors sell and how to run it free against the top 10. - [Word-Level TF-IDF Gets You Close. Structural Fit Gets You There.](/blog/blog-tool-canonical-winning-shape/): Turns the top 10 into a content brief by shape: heading depth, schema, media ratio, word-count band and link density a new page must match. 47 more posts on this topic: [search the blog for "keyword"](/blog/?q=keyword). ### Running all of it at once, and the fix prompt that does the work You do not have to run the categories above one at a time. The Mega Analyzer runs the single-URL checks in one pass and grades them; Mega Batch does ten URLs side by side; the Mega SEO and Mega Security analyzers go deeper on their own axes. Each one ends with a single prompt that carries every finding, which is the whole trick: the audit is free, the fix is the plan you already have, and the code diff generator will even write the patch itself for the mechanical ones. bolt's one audit, the security audit on paid plans, is a good feature and it audits the application; it does not look at anything on this list. **Run, free, in your browser:** - [Mega Analyzer](/tools/mega-analyzer/): You paste one URL and it fetches the page as desktop and mobile plus robots.txt, sitemap.xml and llms.txt, runs every single-URL check it has, scores the buckets (SEO, schema, E-E-A-T, voice, mobile parity, performance and AI), attaches Learn / Fix / Audit-this pills to each failed check, and gives you a copy-paste AI fix prompt. - [Mega Batch](/tools/mega-batch/): You paste up to 10 URLs, one per line; each is fetched and scored across the Mega Analyzer's six buckets, shown as a side-by-side score matrix with the weakest bucket tagged per row, plus one combined prompt covering the whole set. - [Mega SEO Analyzer](/tools/mega-seo-analyzer/): Three modes in one page: paste one URL and it scores eight dimensions plus real-user CrUX field data from the PageSpeed Insights API, returns an impact-vs-effort ranked fix list with an auto-generated 0/30/60/90-day roadmap; switch to Site-wide mode to sample-crawl up to 25 URLs of a site, or Competitor mode to enter your URL plus up to three competitors for a per-dimension gap matrix. - [Batch Compare](/tools/batch-analyzer/): You enter up to 20 site URLs and it fetches each one, scores them side-by-side across nine buckets (SEO, GEO, AEO, schema, E-E-A-T, links, social, accessibility, hosting) plus a crawl-validation pass, then offers Copy AI Fix Prompt (a clipboard prompt for Claude / ChatGPT / any LLM), Save as PDF via print, CSV and HTML report downloads, and localStorage snapshots for before/after deltas. - [Link Graph](/tools/link-graph/): You give it a seed URL and it crawls your site, charts the internal link topology as an SVG, lists hubs, in-degree-0 orphans, dead ends and noindex pages, diffs the crawl against sitemap.xml (sitemap-only vs crawl-only URLs), and lets you export a CSV or HTML report and copy an AI fix prompt. **Read:** - [One URL, Every Audit in One Pass, The Mega Analyzer](/blog/blog-tool-mega-analyzer/): Explains the six-bucket single-URL audit, the one letter grade, and the one copy-paste AI fix prompt that replaces running nine separate tools. - [Score Ten Sites Across Every Dimension in One Run, The Mega Batch](/blog/blog-tool-mega-batch/): Shows how an owner with several sites or a client roster gets a score matrix, a weakest-bucket tag per site, and one combined fix prompt for the whole set. - [How to Compare 10 Websites at Once: The Batch Analyzer for SEO, GEO, and AEO](/blog/blog-batch-site-analyzer/): Step-by-step walkthrough of pasting up to 10 URLs (or a spreadsheet column), reading the color-coded table, exporting reports and copying the AI fix prompt. - [Generate AI Fix Prompts From Any Site Audit: Let ChatGPT or Claude Write Your Code](/blog/blog-ai-fix-prompt-tool/): Defines the fix-prompt pattern: the audit's own data goes into a prompt you paste into ChatGPT, Claude or Gemini, which then writes the exact code fixes for a non-developer. - [Why I turned Mega SEO Analyzer into a v2 and stopped paying $99-$500/mo for Ahrefs-adjacent tools](/blog/blog-mega-seo-analyzer-v2-paid-tool-parity/): Lays out the five things paid SEO suites sell (field data, site crawl, competitor context, history, prioritization) and how the free tool covers each. - [Seven Security Layers In One Scan. Mega Security Analyzer](/blog/blog-tool-mega-security-analyzer/): Explains the one-pass TLS, headers, DNS, CWE/OWASP and MITRE scan and the 3-probe revalidation that keeps CDN transients out of the fix list. 31 more posts on this topic: [search the blog for "Mega Analyzer"](/blog/?q=Mega%20Analyzer). ### What others found when an AI built the site None of this is a complaint about bolt in particular. It is what happens when a code generator is asked for a website and not asked for the rest. The posts below are the site's earlier looks at the same pattern from other angles: what coding agents skip unless told, why a platform subscription is not a build check, what a brand new domain needs on day one, and what to do when a managed host will not let an auditor in. **Run, free, in your browser:** - [Single Site Gen](/tools/single-site-gen/): Generates a complete AI site-build prompt with the SEO, schema, E-E-A-T, crawl, WCAG, Core Web Vitals, security-header and AI-search rules already written in, for pasting into Claude or ChatGPT. - [Platform Audit](/tools/platform-audit/): Detects which hosted platform(s) a site runs on from HTML signatures and response headers (Shopify, Squarespace, Wix, Webflow, Framer, Ghost, BigCommerce, HubSpot CMS, Drupal, Magento, plus API-driven CMSs, Jamstack frameworks and other builders), runs the platform-specific checks for the primary and any co-detected platforms alongside a short generic SEO baseline, hands WordPress off to the dedicated WP+Woo audit, and emits a copyable platform-native fix prompt. - [Site Analyzer](/tools/analyzer/): Audits a URL in one report across three scored buckets (Launch: HTTPS, meta, security headers, conversion; Agency: on-page SEO, schema, social cards, accessibility; Network: indexing, feeds, AI-crawler readiness, entity signals, hosting health), detects the platform, and emits LLM-ready prompts via Copy AI Fix Prompt, Copy LLM Fix Prompt and an AI Site Builder "Copy Build Prompt" that drafts a new site from the analyzed one. - [Rendered DOM Paste Audit](/tools/rendered-dom-paste-audit/): Lets you paste your browser's rendered outerHTML so a JavaScript-built or bot-protected site can still be audited, running nine SEO checks on the paste and, if you also supply the URL, fetching the server HTML to diff static vs rendered and expose the SPA gap; a site-wide fallback script adds a "Copy AI fix prompt" button for pasting failing findings into Claude or ChatGPT. - [Migration Analyzer](/tools/migration-analyzer/): Detects the current CMS or vendor, catalogs what is portable versus locked at the template level, scores migration risk across five dimensions and generates an AI prompt for the rebuild. - [Site Migration Gen](/tools/site-migration-gen/): Fetches an existing site's homepage plus robots.txt, sitemap.xml and llms.txt, detects the current platform, then writes a copyable prompt telling Claude or ChatGPT to rebuild it on Eleventy, Hugo, Astro, Next.js or plain HTML with the same business name, content, images and branding, a 301 redirect map, and toggleable SEO, schema, E-E-A-T, WCAG, Core Web Vitals, security-header and AI-readiness modules baked in. **Read:** - [What AI Coding Agents Leave Out (and How to Put It in Your Prompt)](/blog/blog-what-ai-coding-agents-skip/): Lists what Claude Code, Codex, Cursor, Replit and Devin left out of 15 test builds (security headers, rate limiting, CSRF) and gives the prompt lines that make an AI builder include them. - [The AI Quick Start for Launching a Business: What to Install, What to Pay For, and What You Will Not Own](/blog/ai-quick-start-for-launching-a-business/): The under-$100 stack: one subscription and a terminal agent do the market research, write the site, make the brand assets and run the audits, with current prices and the copyright limits. - [The Expensive Website You Are Quoted For Is Mostly A Design Decision And A Data Feed. Here Is How To Copy The First Part Yourself, For Free.](/blog/parse-premium-sites-beginner/): Measures what vertical website platforms charge ($89 per user to $1,299 a month, 13 of 15 unpriced) and shows how to reproduce the design layer with an AI assistant and a free host. - [Why Paying For A Website Platform Does Not Mean Your Site Is Actually Built Right](/blog/why-audit-your-own-website-platform-subscription/): Explains why a monthly platform fee buys a baseline, not structured data, security headers, accessibility or AI-answer readiness, and gives a 20-minute self-audit. - [Squarespace, GoDaddy, And The Markdown For Agents Warning, What You Can And Cannot Fix](/blog/blog-fix-markdown-for-agents-squarespace-godaddy/): Spells out which HTTP-level fixes closed builders (Squarespace, GoDaddy Website Builder, Wix, Shopify) cannot do and what the partial workaround is. - [A Platform-Aware Audit. Shopify, Squarespace, Wix, Webflow, Ghost, BigCommerce](/blog/blog-tool-platform-audit/): Describes the platform-specific failure points the Platform Audit checks on Wix, Squarespace, Webflow, Framer and others. 31 more posts on this topic: [search the blog for "AI coding"](/blog/?q=AI%20coding). ### Building and hosting it yourself If you would rather not rent the builder at all, the site has the long-form versions of the path in the loop above: the $97 launch, the terminal kickstart scripts that install a coding agent on Windows, macOS or Linux in one run, the Claude in Chrome setup and safety notes, the MCP servers worth connecting for a small business, and the generators that write the files a new site needs (policies, sitemap, robots, llms.txt, uptime checks) so you are pasting, not writing. **Run, free, in your browser:** - [Monoclone Generator](/tools/monoclone-generator/): Picks a static-site framework (11ty/Astro/Hugo/Next/SvelteKit/Jekyll/Nuxt/Gatsby/plain HTML), a host (Netlify, Cloudflare Pages, GitHub Pages, Vercel, Firebase, AWS Amplify, Azure SWA, Render, Surge, or self-hosted VPS) and a site count, then emits eight copy-paste starter files (sites.json, package.json, generate-all.mjs, deploy-all.mjs, site.js, base layout, README, .gitignore) tailored to those choices plus one big copyable prompt that tells Claude Code / Cursor / Codex to build the whole multi-site network. - [DIY Uptime Alert Generator](/tools/diy-uptime-alert-generator/): Generates drop-in uptime and alert configs for 11 stacks (Netlify scheduled function, Vercel cron, Cloudflare Workers cron, GitHub Actions cron, shell+cron+mailx, Uptime Kuma, ntfy.sh, Gatus, Prometheus+Alertmanager, Healthchecks, Monit) with your URL, alert email, interval and optional Slack webhook filled in, so you can monitor your own site without a paid monitoring SaaS. (Writes the file itself, so there is no prompt to paste.) **Read:** - [AI Terminal Kickstart, Set Up Claude Code, Codex, ChatGPT CLI & GitHub Copilot On A Fresh Box](/blog/blog-ai-terminal-kickstart/): One-shot install scripts (macOS/Windows/Linux) that put Claude Code, Codex, Copilot CLI and the Netlify CLI on a fresh machine so an owner can build and deploy a site from a terminal. - [What Hosting a New Business Site Actually Costs in 2026: Cloudflare, Netlify, and Vercel, With the Real Numbers](/blog/serverless-hosting-cost-comparison-2026/): States that a brochure site is free to host and shows exactly what each of Cloudflare, Netlify and Vercel meters before a bill appears. - [Where Should a Small Business Host Its Website and Apps? (Part 2 of 5)](/blog/blog-smb-web-platform-choice/): Matches Cloudflare, Netlify and Vercel to a brochure site, a booking app and a many-sites operator, with the lock-in points named. - [Single Site Gen, The AI Build Prompt That Already Passes Our Audits](/blog/blog-tool-single-site-gen/): Explains the 16-module build prompt that makes the first deploy of a self-built site pass the site audits without a fix round. - [I Measured Every File In The 110,000-Star DESIGN.md Catalog. Fifty-Four Of Them Say "WCAG" And Not One States A Contrast Ratio.](/blog/design-md-and-the-five-files-that-ship-a-site/): Measures the DESIGN.md catalog and supplies the markdown kit (design, indexing, schema, WCAG, hosting) that lets an AI agent ship a whole site from files in the repo. - [Going Frameworkless on Cloudflare, and Why You Still Reach for Vercel, Netlify, and Square](/blog/blog-cloudflare-frameworkless-vendor-lockin/): How to ship plain HTML/CSS/JS on Cloudflare with no build step and free static requests, and where Vercel, Netlify or Square still earn their place. 40 more posts on this topic: [search the blog for "Netlify"](/blog/?q=Netlify). ## The plan you already pay for does the fixing Every audit tool on this site ends the same way: a button that copies a fix prompt, with your findings already pasted into it, for whatever AI you use. That is where the $20 subscription comes in, and the point is that you do not need a second one. Here is what each of the three big consumer plans includes as of 18 September 2026, from their own pricing pages. | | Free | Around $20 | What on that tier does this job | |---|---|---|---| | Claude | $0: chat, web search, files, code, memory, Artifacts | Pro $20 a month ($17 on annual) | Claude Code, Claude in Chrome, Claude Design, Slides and Docs, Projects, Research, scheduled tasks. Max from $100 for 5x or 20x usage | | Google | $0: Gemini app, Deep Research, Canvas, Gems | Google AI Pro $19.99 a month | Jules ("asynchronous coding agent"), Google Antigravity, "Gemini in Chrome: Access Chrome auto browse," Gemini in Gmail and Docs. Ultra $99.99 / $199.99. There is also a $4.99 AI Plus tier | | ChatGPT | $0: GPT-5.6 Luna, limited Codex | Plus $20 a month (Go is $8 and "may include ads") | GPT-6 Astra, "Expanded Codex usage," Projects, scheduled tasks, custom GPTs, ChatGPT Work on desktop. Pro from $100 | Read that table against bolt's. A bolt Pro seat is $25, $50 or $100 a month, with a "Pro 200" tier above that, all on top of whichever of these you already have, for an agent whose model you do not choose, whose token meter climbs with the size of your site, and whose output needs the paid pre-rendering step before crawlers get finished HTML. The plan you already pay for includes a coding agent (Claude Code, Codex, Jules) that writes plain HTML, a browser agent (Claude in Chrome, Gemini's auto browse, or ChatGPT Work, which OpenAI says "uses your apps, files, tools, browser, and approved business context" from the desktop app) that can fill in Search Console and Google Business Profile forms with you watching, and a chat window that takes a pasted audit prompt and hands back corrected code. The free tiers are not nothing, either. A free Claude or Gemini account will rewrite a meta description, produce a LocalBusiness JSON-LD block, or draft a robots.txt from an audit prompt. The paid tier buys you the agents and the usage headroom to do a whole site in a sitting. ## Hosting it for free, correctly If you build plain HTML with the plan you have, you need somewhere to put it. Three options, with the terms as published on 18 September: - **Netlify Free.** "$0 forever," "Add Custom domains with SSL," global CDN, "300 credit limit / month," and "The free plan is always free, with hard monthly limits that cannot be exceeded or incur any costs." Credits are the catch: a production deploy is 15, bandwidth is 20 per GB, requests are 2 per 10,000. A small brochure site that deploys a few times a month and serves a few gigabytes fits. A busy one wants the $9 Personal plan. This is, incidentally, one of the two platforms bolt's Cloud page says it is "Powered by," and the one bolt used for hosting before it brought hosting in-house. - **Cloudflare Pages.** The product page says "All plans come with unlimited sites, seats, requests, and bandwidth." The free limits are 500 builds a month, one build at a time, 100 custom domains per project and 20,000 files per site. For a static business site that is effectively no limit. - **GitHub Pages.** Do not use it for this. GitHub's own limits page says it "is not intended for or allowed to be used as a free web-hosting service to run your online business, e-commerce site, or any other website that is primarily directed at either facilitating commercial transactions." Portfolio, yes. Business, no. Compare the failure mode. A free bolt site "stop[s] serving content" when it hits 10 GB, and stays down until the month resets. A free Netlify site has hard limits too, but you are not paying $25 a month to lift them, and Cloudflare Pages has no bandwidth limit to hit. ## The loop, end to end 1. **Write the pages** with the plan you have. Ask for plain HTML and CSS, one file per page, no framework. Give it your services, hours, address, phone and the three questions customers ask most. Ask for a LocalBusiness JSON-LD block, a title and meta description on every page, and an FAQ section whose questions match the schema word for word. If you need bookings, embed a free Calendly page; if you need accounts and payments, the Cloudflare stack above is the prompt. 2. **Put it on free hosting** with your own domain and HTTPS. Netlify's drag-and-drop deploy or Cloudflare Pages from a folder both take minutes. 3. **Run the audits.** Start with the Mega Analyzer on the homepage, then the specific tools for whatever it flags. Nothing to install, nothing to sign up for, and the checks run in your own browser. 4. **Paste the fix prompt** each tool produces into Claude, Gemini or ChatGPT. Replace the file it hands back. Redeploy. 5. **Verify what a crawler sees**, not what you see. The rendered-DOM and pre-render parity tools exist because the two are routinely different. 6. **Tell the engines.** Submit the sitemap in Search Console and Bing Webmaster Tools, ping IndexNow, then claim and finish the Google Business Profile with the browser agent sitting beside you. 7. **Repeat monthly**, or when you add a page. The tools are free every time. If you want the whole map in one place rather than a tool at a time, that is what The $20 Dollar Agency is: the same loop, written for an owner who has just been quoted a retainer. ## Fact-check notes and sources All bolt.new, plan and hosting pages were read on 18 September 2026. Quotes are verbatim from the pages as they rendered that day; if a number has changed since, the page is the authority. - **The invitation**: Stripe's event page for the recorded conversation with bolt.new's CEO and founder, "attracted 60,000 users on Day 1 and scaled to 7 million users a year later": [go.stripe.global/AI-boom-on-Stripe-2-amer](https://go.stripe.global/AI-boom-on-Stripe-2-amer) - **What bolt is**: help center intro and FAQ (WebContainers, StackBlitz, "doesn't currently have a public API, CLI, or SDK"): [support.bolt.new/get-started/intro-bolt](https://support.bolt.new/get-started/intro-bolt) and [support.bolt.new/concepts/faq](https://support.bolt.new/concepts/faq) - **"React, Vite, Tailwind CSS, and Node.js by default"**: [bolt.new/use-cases/ai-website-builder](https://bolt.new/use-cases/ai-website-builder) (also "3.8M+ websites created," "<2 min avg. build time") - **JavaScript only, no PHP or Python**: [support.bolt.new/concepts/supported-technologies](https://support.bolt.new/concepts/supported-technologies) - **Netlify and Supabase underneath**: [support.bolt.new/cloud/bolt-cloud](https://support.bolt.new/cloud/bolt-cloud) - **Agents and Forge**, including "anonymized and shared with Bolt's partners": [support.bolt.new/building/using-bolt/agents](https://support.bolt.new/building/using-bolt/agents), [support.bolt.new/account-and-subscription/bolt-forge](https://support.bolt.new/account-and-subscription/bolt-forge) and [support.bolt.new/release-notes](https://support.bolt.new/release-notes) (Sep 14 to Sep 20 entry) - **Pricing page** (Free, Pro $25 / $18 yearly, Teams $30 / $27, "SEO boosting," "Bolt branding on websites," "Save up to 28% with yearly billing," and the FAQ line "most token usage is related to syncing your project's file system to the AI"): [bolt.new/pricing](https://bolt.new/pricing) - **Pro tiers, annual prices, "save 10%," non-refundable, card only**: [support.bolt.new/account-and-subscription/billing](https://support.bolt.new/account-and-subscription/billing) - **Tokens** (file-sync consumption, 300K daily cap, rollover, loss on cancellation): [support.bolt.new/account-and-subscription/tokens](https://support.bolt.new/account-and-subscription/tokens) - **Hosting caps and "stay offline until usage resets," 10,000 to 15,000 visits estimate, Made in Bolt badge**: [support.bolt.new/cloud/hosting/plans](https://support.bolt.new/cloud/hosting/plans) - **Analytics include bots**: [support.bolt.new/cloud/hosting/analytics](https://support.bolt.new/cloud/hosting/analytics) - **Small business page** ("9.5M+ small business projects," "63% of builders have never written code," "$25 a month for Pro"): [bolt.new/solutions/ai-for-small-business](https://bolt.new/solutions/ai-for-small-business) - **"SEO optimization so your project ranks from day one"**: [bolt.new](https://bolt.new/) - **"SEO Boosting creates a ready-to-go HTML version of each page ahead of time"**: [bolt.new/blog/introducing-bolt-v2](https://bolt.new/blog/introducing-bolt-v2) - **"Automatic SEO pre-rendering"**: [bolt.new/blog/scale-with-bolt-cloud](https://bolt.new/blog/scale-with-bolt-cloud) - **Prompt library SEO category**: [support.bolt.new/building/prompt-library](https://support.bolt.new/building/prompt-library) - **Curated SEO/GEO skill, "you can't edit or remove"**: [support.bolt.new/building/skills](https://support.bolt.new/building/skills) - **Alt text field in visual edits**: [support.bolt.new/building/visual-edits](https://support.bolt.new/building/visual-edits) - **Help center term search**: the 93 pages listed at [support.bolt.new/llms.txt](https://support.bolt.new/llms.txt) were each read in full and searched case-insensitively for sitemap, robots.txt, structured data, schema.org, JSON-LD, meta description, Open Graph, canonical, hreflang, Search Console, IndexNow, llms.txt, ai.txt, GPTBot, ClaudeBot, Google Business, Core Web Vitals, WCAG, Lighthouse and title tag. Counts for the terms named in the text are as stated there. - **Security audit checks and 30-a-day limit**: [support.bolt.new/building/security](https://support.bolt.new/building/security) - **"still need human checks for mobile layout, load speed, SEO basics"** and the SEO FAQ answer: [bolt.new/blog/build-a-landing-page-with-ai-in-under-an-hour](https://bolt.new/blog/build-a-landing-page-with-ai-in-under-an-hour) - **bolt's own cost comparison** (freelance $1,500 to $8,000, agency $6,000 to $15,000, AI builder $20 to $200 a month): [bolt.new/blog/save-20k-build-your-business-website-with-ai](https://bolt.new/blog/save-20k-build-your-business-website-with-ai) - **Claude plans**: [claude.com/pricing](https://claude.com/pricing) - **Google AI plans**: [gemini.google/subscriptions](https://gemini.google/subscriptions/) - **ChatGPT plans**: [chatgpt.com/pricing](https://chatgpt.com/pricing/) and, for what ChatGPT Work is, [chatgpt.com/work](https://chatgpt.com/work/) - **Netlify Free** (300 credits, credit costs, hard limits): [www.netlify.com/pricing](https://www.netlify.com/pricing/) - **Cloudflare Pages** ("unlimited sites, seats, requests, and bandwidth"; free-plan build, domain and file limits): [pages.cloudflare.com](https://pages.cloudflare.com/) and [developers.cloudflare.com/pages/platform/limits](https://developers.cloudflare.com/pages/platform/limits/) - **Cloudflare Workers Free plan** (100,000 requests a day, 10 ms CPU, Pages Functions billed as Workers): [developers.cloudflare.com/workers/platform/pricing](https://developers.cloudflare.com/workers/platform/pricing/) - **D1 Free plan** (5 million rows read, 100,000 written a day, 5 GB, and the "always have a Free plan" FAQ): [developers.cloudflare.com/d1/platform/pricing](https://developers.cloudflare.com/d1/platform/pricing/) - **Durable Objects on the Free plan** (SQLite backend only): [developers.cloudflare.com/durable-objects/platform/pricing](https://developers.cloudflare.com/durable-objects/platform/pricing/) - **Clerk Hobby plan** (free, 50,000 MRU per app): [clerk.com/pricing](https://clerk.com/pricing) - **Resend Free plan** (3,000 emails a month, 100 a day, 3 domains): [resend.com/pricing](https://resend.com/pricing) - **Stripe card pricing** (2.9% + 30¢, "No setup fees, monthly fees, or hidden fees"): [stripe.com/pricing](https://stripe.com/pricing) - **Calendly Free plan** ("Always free," one event type, one calendar connection, unlimited one-on-one meetings): [calendly.com/pricing](https://calendly.com/pricing) - **The storage-business portal**: figures (26 migrations, 50 suites, about 6,100 assertions, 37 health probes, the 16-request burst test, the $275 a month it replaces) are from my own build notes for a client project that is not named here; the client is anonymized on purpose. - **GitHub Pages prohibition on business sites**: [docs.github.com/en/pages/getting-started-with-github-pages/github-pages-limits](https://docs.github.com/en/pages/getting-started-with-github-pages/github-pages-limits) ## Related reading **[What AI coding agents leave out, and how to put it in your prompt](/blog/blog-what-ai-coding-agents-skip/)**: five AI coding tools built fifteen apps and none shipped a security header. The same rule applies to a site builder: what you do not ask for, you do not get. **[Why paying for a website platform does not mean your site is built right](/blog/why-audit-your-own-website-platform-subscription/)**: the 20-minute self-audit for anyone whose site lives on a monthly subscription, bolt included. **[The pre-launch web audit loop](/blog/pre-launch-web-audit-loop/)**: the eight-dimension routine to run before you tell anyone the site exists. **[The AI fix prompt: how every audit here turns into a paste](/blog/blog-ai-fix-prompt-tool/)**: the pattern that makes a $20 plan do the agency's job. **[Claude for Small Business, a plain-English walkthrough](/blog/blog-claude-for-small-business-walkthrough/)**: what is in the box on the Claude side of the plan table above, and the under-$100 stack it fits into. **[The new-website discoverability stack](/blog/blog-new-website-discoverability-stack/)**: the files and records a brand new domain needs on day one so the engines can find it at all. *This post is informational, not SEO consulting, legal or financial advice. bolt.new, StackBlitz, Stripe, Netlify, Supabase, Cloudflare, GitHub, Anthropic, Google and OpenAI are mentioned as nominative fair use; no affiliation is implied and none of them reviewed this piece. Prices and limits are as published on 18 September 2026 and change without notice.* --- Canonical HTML: https://jwatte.com/blog/bolt-new-seo-aeo-geo-do-it-yourself/ RSS: https://jwatte.com/feed.xml JSON Feed: https://jwatte.com/feed.json Hero image: https://jwatte.com/images/bolt-new-seo-aeo-geo-do-it-yourself.webp