We pointed our own audit at ourselves. Here's what it found.

The night we turned the camera around

We build a website-audit tool. People type in a URL, we hand back a health score and a list of what's hurting their conversions. Standard stuff.

Then one evening someone on the team asked the obvious, uncomfortable question: what does our own tool say about our own sites?

So we ran it. On TheUnhacked.com, our content site. On the ProofPilot storefront itself — the page that literally sells the audit.

The storefront scored 77.9. The content site scored 75.5.

Lower is healthier, by the way — think golf, not exams. So those weren't disasters. But they weren't the clean bill of health you'd hope for from the people selling the checkup, either.

Both got flagged for the same thing: no trust proof above the fold.No “licensed,” no “5-star,” no review badge, no certification — nothing in the first screen a visitor sees that says these people are legit.

We were selling trust signals while missing our own. Caught red-handed by our own machine.

Here's the part that matters more than the score

You might be thinking: of course the tool flagged its makers' sites — it's their tool, they can make it say whatever they want.

You can't, actually. And that's the point of this whole story.

ProofPilot's engine has no AI writing the findings. None. It's not a chatbot guessing what might be wrong with your site. It's a set of plain, boring yes/no checks that read the actual code your site sends back:

Every single finding points at a specific fact in your page's source. You can open your own code and check it yourself. Run the audit twice, ten times, next Tuesday — same site, same answers. Every time.

Why does that matter? Because the “AI website audit” tools flooding the market right now can make things up. That's not a slur; it's how those tools work. A language model generates plausible-sounding feedback, and sometimes the plausible thing is just wrong. It'll confidently tell you about a problem that isn't there.

Ours can't do that. There's nothing to invent. A check either matches the fact in your HTML or it doesn't. No generation means nothing to hallucinate.

So when our tool flagged our own homepage, we couldn't argue with it. The trust badge genuinely wasn't there. The machine wasn't being mean. It was being correct.

We stress-tested it on the giants, too

Before we'd trust our own number, we pointed the audit at sites built by some of the best engineers alive: Apple. Stripe. Vercel. Berkshire Hathaway.

They got flagged too — mostly for “no trust proof above the fold.”

Now, Apple's site is not broken. So we dug in, and we found the honest limit of the tool: it reads the code a site sends before JavaScript fills in the rest. Big modern sites like Apple's build half their page after the fact, with code our engine doesn't run. So it sees a fact that's technically true (“that badge isn't in the first chunk of code”) but doesn't matter for a company like Apple.

We could have buried that. Instead we did two things.

First, we taught the engine to notice when it's looking at one of those build-it-later sites and say so out loud — “heads up, I could only read your initial code, this might undercount you” — instead of silently dinging it. That fix shipped, with tests to keep it honest.

Second, we recognized that this limitation only matters if you're Apple. Local dentists, plumbers, law firms, and boutique agencies — the people who need conversion audits most — almost always serve their critical content in the initial HTML, because they're not running React apps with delayed rendering. The tool works exactly as intended for the people it's built for.

What we did with the finding

We fixed it. Added the trust strip to the storefront homepage within the same day. The content site's fix is still queued as of this writing — we're not going to claim it's done until it is. When it ships, we'll re-run the audit and update this post, because the underlying fact in the HTML will have changed.

That's how it's supposed to work. Fix the thing, re-run, watch the number move. Not a subjective judgment call from a consultant. A verifiable fact from the code.

Why you should care

Here's the uncomfortable truth about your website: you can't see it the way a stranger does. You built it. You know where everything is. Your brain auto-fills the trust you already feel about your own business.

A first-time visitor feels none of that. They land, they scan the top of the page for half a second, and they decide whether you're real. If your phone number's buried and there's no proof you're legit up top, a chunk of them leave — and you never even know it happened.

We didn't know it was happening to us until we ran the numbers. That's the thing about blind spots. They're invisible by definition.

The audit makes them visible. Not with a guess. With a fact you can verify.

Try it on the one site you've stopped seeing clearly

Run the free audit on your own homepage right now. It takes about a minute. No card, no signup wall — just the same honest read we ran on ourselves.

See how LeakRadar compares to AI audit tools → · How the audit works → · Find your industry's audit →