Sharper scores and rankings, new free tools, two-factor sign-in and AI visibility upgrades

Numbers that changed

• AI referral visits, AI share and AI conversions. Google Analytics 4 sessions from its AI Assistant channel were dropped from the AI referral report, so a property with AI Assistant sessions could show 0 AI visits. These sessions are now counted, so those three numbers go up to match your analytics.
• Keyword rankings. Google started returning many results as redirect-style links, and a site that did rank was stored as not ranking. Those links are now resolved to the real site, so affected keywords show their true positions again.
• Average position and ranking counts. The Rank tab, client reports and owner emails averaged every found position down to #100, while Overview counted only the top 20, so one site read "average 103" in one place and "no keyword in the top 20" in another. Every average position and ranking count now uses the top-20 rule. Overview's weekly change compares only keywords that were in the top 20 in both weeks.
• Page score for unindexable pages. A noindexed, robots-blocked or erroring page lost only about 7 points and could still grade an A. It is now held at 59 (an F), and the score card, result header and score breakdown explain why and show what the score would be without the cap. Fixes are also ranked by severity first.
• CITED Score. The score no longer reads a fixed 10-page sample. It now checks every content page in your site's main language. Utility pages, other languages and noindex pages are left out and counted on the tab. The separate Internal Linking Structure row was removed because nearly every page passed it and it lifted Entity & Brand Clarity without meaning anything. Internal linking is now judged only through Site Architecture, so your CITED score may shift.
• Site-file checks (llms.txt, ai.txt, TDMRep, RSL, Markdown twins). A timeout, a server error or a 401/403/429 wall used to count as "file missing" and cost you the same as a real 404. Those cases are now reported as not measured, so affected scores no longer read too low. Fix verification also no longer marks a fix verified when the re-scan could not check it.
• Page count and llms.txt. A URL that redirected was stored as a second live page, so page counts ran one too high, duplicate-content pairs appeared and llms.txt could list a redirecting URL. Redirects are now reported as redirects and these numbers drop to the true figures.
• Crawler counts in the server-log report. Crawlers from OpenAI, Anthropic, Perplexity and Amazon were checked against reverse-DNS names they never documented. OAI-SearchBot was never confirmed, and some real Perplexity visits were marked spoofed and left out of every count. Crawlers are now verified against each vendor's published IP list, and real Claude-User traffic is no longer called spoofed.
• Buyer-intent word-count targets. Targets came from a scrape that returned the head term's results for long-tail phrases, so different phrases showed the same "median N words" figure. They now come from the Google results for your phrase in your research market, and old cached values are replaced.
• Modeled traffic value under AI Overviews. A keyword under an AI Overview that cites other sites kept the full no-Overview click rate, so its modeled traffic value was overstated. The AI Overview click-rate reduction now applies whenever an Overview is shown, so those values go down.
• Add-on prices. The keyword add-on price and yearly add-on billing on the pricing page were corrected, and the "Which tier do you need?" box now counts add-ons instead of only suggesting a plan.

Added

• Two-factor sign-in. You can protect your account with a passkey (USB key or phone) or an authenticator app, plus single-use recovery codes. It is optional for customers and required for admins.
• Free redirect checker. The new tool at /tools/redirect-checker follows a URL's redirects one hop at a time, across the http/https and www/bare versions. It flags loops, chains that are too long, temporary redirects, https downgrades and http left unredirected.
• Free website checks over MCP. Assistants can run ten free tools without an account: a start/poll pair for the free site check, single checks for structured data, meta tags, robots.txt and sitemap, security headers, SSL, DNS, AI search readiness and broken links, and a new check_redirects tool. A public /mcp-server page lists the endpoint, connect steps for Claude, ChatGPT/Codex, Claude Code and Cursor, every tool with its price, and the rate limits.
• MCP tools for your sites and keywords. list_tracked_sites and list_tracked_keywords return your own sites and keywords with the ids other tools need. Inactive sites and paused keywords are flagged rather than hidden.
• AI Overview state per keyword. Each tracked keyword on the Rank tab now shows what Google's AI Overview did over the last week: cited, cites others, no Overview, or not measured yet, with the day counts behind it and a suggested action. When an Overview cites someone else, it names the sites cited instead of you. Topic clusters show the mix of states per pillar and supporting page.
• AI visibility: where to get mentioned and citations vs visits. The AI visibility dashboard now suggests where to get mentioned for each keyword and shows a timeline of AI citations against AI visits, built from data already collected.
• Weekly competitor publish watch. Each tracked competitor's sitemap is read once a week, so the Competitors tab and the owner report show what each rival published.
• Image findings. The image scan now reports six new kinds of finding: alt text, filename quality, oversized files, CSS background images and robots-blocked images. Keyword stuffing in alt text is called only on clear patterns, the AI can veto a hit but never accuse alone, and the copy says it "may be seen as spam", matching Google's wording.
• More scanner findings. The scanner now flags internal links that point at a redirect, images missing width and height, conflicting schema @id values and a missing app category.
• Server-log report: AI files and robots.txt vs reality. For each uploaded log you see which AI crawlers fetched robots.txt, sitemaps, llms.txt, Markdown twins, feeds and licence files. The AI tab also compares what we can test with what verified real crawlers were served: blocked at the edge, let through, fetched despite robots.txt, or in agreement.
• Buyer-intent keyword research. Keyword Research has a new buyer-intent mode with modifier expansion, an intent filter and easiest-first scoring. It also adds a free finder at /tools/buyer-intent-keyword-finder, a word-count target in content briefs and a buyer-intent-first striking-distance list.
• Free plan trials and a starter credit. You can be invited to a free one-month Solo trial with no card and no invoice. New accounts get one free starter credit at signup, spendable once the email is verified.
• Rank tracking alerts for stuck keywords. Keywords that have not ranked for 4 weeks are now flagged.

Improved

• Agent Surface check. The full checker and the free Agent Surface tool now check what Cloudflare's isitagentready.com checks, so you see every row if you arrive with that score.
• MCP get_geo_citation_status. The tool now returns has_data and a reason (tracking off, not checked yet, or no usable answer). Previously a never-checked keyword returned the same zeros as a measured "never cited", and an assistant would report 0% as a finding.
• Honest crawler identity. Our scanner no longer impersonates AI crawlers in the weekly probe and scans. Requests go out under our own names (Kinetix-Auditor and Kinetix-Research), are cryptographically signed with Web Bot Auth so CDNs can verify them, and are described on a public /bot page. Our own research fetches also respect robots.txt.
• Bot walls reported as a result. A site that turns our scanner away, such as a 403/406/429 still blocked after a retry or a Cloudflare or JavaScript challenge, is now recorded as a bot wall instead of a bare failure.
• Findings CSV export. The export now includes Fix and Fix source columns carrying the fix shown in the page, with locked fixes marked as locked and fixes waiting on input labelled as such.
• Fix-impact analysis. Fix impact now measures from Google's typical recrawl of a URL, about 30 days, instead of from when you marked a fix done. It also works for fixes from single-page scans and retries while data is thin. Under 10 clicks it now reports insufficient data instead of a false verdict.
• Faster re-checks of known-problem pages. Search Console index coverage now re-inspects pages already known to be unindexed sooner, and inspects 30 pages per run instead of 20.
• Briefs and gap analysis open automatically. A freshly built content brief or semantic gap analysis now expands when it lands. The Show brief and Show gaps toggles are proper buttons.
• Marketing email is opt-in. Campaign coupons and trial invites go only to people who said yes. Your consent and every change to it are recorded.
• Keyword gaps refresh weekly. Competitor keyword gaps now refresh weekly per site, and sooner after you add a competitor or change your search market, instead of every night.
• Clearer wording. The finding about text in images no longer claims AI cannot see it, and now states what holds. The ChatGPT Visibility Checker FAQ and the citation archetypes explainer now name the engines actually read today. The product tour now keeps keyboard focus inside it.
• Better keyword relevance for AI answer gaps. Related sub-questions now stay on your topic's core words and your market's language, so briefs stop drifting to unrelated subjects.

Fixed

• Google sign-in security. Signing in with Google could link onto an unverified local account with the same email, which let someone who had registered your address with their own password keep it. This no longer happens. If Google sign-in does claim an unverified account, the owner now gets an email explaining what was removed as a precaution and how to set a password.
• Missed payments. A paid purchase whose payment notification never arrived could stay pending forever and never credit the customer. Temporary failures are now retried, and an hourly check re-fetches pending purchases and credits paid ones.
• Plan changes and renewals. A scheduled downgrade now starts only once its period is paid, and only a real payment settles a renewal invoice. Unpaid renewals stay as pro-formas, and plan changes that moved no money no longer mark invoices paid.
• Parallel result checks. Checks that run on a result in parallel could erase each other's data. They now merge safely, duplicate runs are refused and runs are throttled.
• Query fan-out runs. A Google error on one sub-question failed the whole AI answer gap run and refunded every lookup. Each question now retries once. If it still fails, it is listed as unmeasured and the run keeps its normal charge. Only a run where every question fails is refunded.
• Pages scanned as empty. The boilerplate stripper deleted whole pages when a root element's class merely contained words like header or nav, which hit sites such as Wikipedia, and it also removed Elementor content blocks. An article's own header and footer, with its H1, byline, date and hero image, are now kept too.
• Crawls and scans that found nothing. A crawl started from a hostname typed with capital letters found one page. Scans now also try www. when the bare domain never connects.
• CITED crawl lockout. A crawl that the AI provider refused mid-way no longer locks the site for a week. Knowledge Graph Presence lookups now work again after being blocked by Wikimedia, and failed brand lookups are retried after 10 minutes instead of cached for 7 days.
• CITED scoring misreads. Only real FAQ questions are now scored, and a page's own schema type decides its role.
• Hidden iframes and scaled content. Hidden iframes are now judged on the server HTML. Repeated text alone no longer flags a page as scaled content on rendered pages.
• Homepage thin-content check. The thin-content band for 400-599 words was meant to skip a site root, but it did not on first scans. Homepages are now skipped.
• AI-powered features failing. Structured AI analyses failed with an error after our move to newer Claude models. They work again.
• Bing connection errors. Throttled Bing calls no longer show a raw "ThrottleHost" error, search-tab reads are cached, and a throttled nightly sync no longer flips your connection to an error state while stored data is recent.
• GA4 connection card. After Google's consent screen, the card now opens on the GA4 property picker, also when you switch from Plausible or reconnect. It used to say "Not connected".
• ChatGPT account linking for MCP. The MCP tools now declare how to sign in, so ChatGPT offers account linking instead of reporting "tool not available".
• Badge preview. Opening an old result page no longer queues a badge re-scan that looked like an embed being viewed.
• Tools counter. The tools page no longer says "Showing 27 of 26 tools".