Articles & deep dives
Comparisons, ratings frameworks, and marketplace strategy. Looking for a checklist? Browse guides →
Claude plugins & skills
Rate Claude Code plugins, skills, and MCP setups on install cost, routing, and trust.
A Claude Plugin Company Cut Token Spend 40% and Ran Skills 50% Faster
They already had a working plugin. The audit named the token waste. After they shipped the ranked fixes, skill runs used 40% fewer tokens and finished about 50% faster.
Read article →How to Rate Claude Plugins in 2026: A Practical Scorecard
A useful rating asks whether the plugin helps you ship safely, week after week. Star counts measure popularity, not quality.
Read article →Claude Code Skills vs Plugins: What to Install (and Audit)
People use “skill” and “plugin” interchangeably. In practice they behave differently, and you should audit them differently.
Read article →Best Claude SEO Tools & Skills: How to Compare Suites in 2026
SEO skill suites keep adding sub-skills. Compare architecture and evidence, not a skill-count badge — AuditHQ scores the plugin you install.
Read article →Claude MCP vs Skills: What to Audit Before You Connect Tools
Skills teach Claude how to think. MCP gives Claude new tools. Audit tool access more strictly than the instruction set.
Read article →Improve Claude Plugin Listing Quality: README, Commands, Trust Signals
Your listing is the landing page. If it is vague, people bounce — or worse, install with the wrong expectations.
Read article →Competitor Analysis for Claude Plugins: Compare Peers, Not Random Repos
Compare inside your category. An SEO skill should not be scored against a random Discord bot wrapper.
Read article →Schedule Claude Plugin Quality Scores (Stop Re-Auditing From Memory)
One brilliant review in January does not describe the plugin in August. Trends move; so should your scores.
Read article →What Is AuditHQ? Claude Plugin Audits First — Then Sites and Listings
AuditHQ’s primary job is measuring Claude plugins and skills — context cost, routing, permissions — then monitoring websites and store listings on a schedule.
Read article →Audit Claude Code Skills Before You Install Them (2026 Supply-Chain Checklist)
Community skills and MCP configs are a supply chain. Read the published surface before you grant tools — not after a surprise outbound host.
Read article →Claude Skill Context Cost: Progressive Disclosure That Actually Saves Tokens
Standing context is a product tax. Pay it only when the skill is selected — and only for files that run needs.
Read article →Claude Plugin Hooks and Local MCP: Document Them — Don’t Pretend They Aren’t There
Hooks that fire on install and MCP processes that start locally are not automatically defects — hiding them is.
Read article →Claude Plugin Eval in CI: Treat Skills Like Testable Infrastructure
Plugin evals turn Claude skills from clever prompts into versioned behavior you can gate in CI — cases, graders, baseline, threshold.
Read article →Claude Plugin Ecosystem 2026: Curation Beats Star Counts
Tens of thousands of plugins made discovery noisy. Production teams win by curating a short allow-list — not by chasing install charts.
Read article →Claude Skills Are Part of Your Software Supply Chain Now
Instruction files and scripts move together. Treat Claude skills as versioned artifacts with blast radius — not as disposable prompt paste.
Read article →Multi-Component Claude Plugins: A Scorecard for Skills, Hooks, and MCP
Bundles win installs when every component is clear. Score applicability, standing cost, hooks/MCP disclosure, and evidence — not skill-count badges.
Read article →Best Claude SEO Tool in 2026: Skills vs Audit Platforms
Claude SEO skills write and reason in-session. Audit platforms measure install cost and site health on a schedule. “Best” depends on the job.
Read article →Claude Skill Prompt Injection: The Risk Class Native to SKILL.md
If a skill reads a URL or issue body and then runs tools that change the machine, that is the native risk class for this format — not a side note.
Read article →Claude Plugin Install Supply Chain: @latest, postinstall, and Credential Paths
Install is when the damage happens. Pin versions, drop surprise lifecycle scripts, and never teach the agent to open ~/.aws for you.
Read article →Websites
Performance, Core Web Vitals, technical SEO, deep security scans, AI-ready reachability, waterfalls, and visual monitoring.
Competitor Website Audit & Analysis: Compare Performance and SEO
Compare products that share an audience and a job. Exclude CDNs, hosts, and unrelated footer links — then score them on a schedule.
Read article →Website Load Waterfall: Find the Requests That Kill Your LCP
A score without a waterfall is incomplete. The chart shows which URL is making visitors wait.
Read article →Website Screenshot Diff Monitoring: Catch Visual Regressions Early
Scores move slowly. Layouts can break overnight. Keep a visual history of the pages that convert.
Read article →AI-Ready Score: What to Measure Before ChatGPT and Claude Quote Your Site
Classic SEO gets you indexed. AI-ready checks ask whether agents and answer engines can read, cite, and summarize your pages without guessing.
Read article →Google AI Overviews in 2026: Strong SEO Beats GEO Hacks
Google says the same SEO fundamentals drive AI Overviews. Skip fake GEO hacks; keep crawlable HTML, bots policy, and honest structure — and use llms.txt for agents, not for Google rank.
Read article →How to Run a Competitor Website Audit (Free Side-by-Side Scores)
A competitor website audit is a repeated scorecard — not a one-time screenshot. Compare, save, schedule, then fix what the diagnosis ranks first.
Read article →Project-Specific AI Prompts vs Generic Audit Prompts: Which Actually Improves Scores?
The format can look similar, but the data source changes the result: project-specific prompts produce cleaner priorities and fewer wasted fixes.
Read article →Sleep After You Ship: Deep Security Scan for Vibe-Coded Sites
You shipped from a chat window. A stranger with DevTools can already see what you left in the bundle. This scan reads that same surface — plus health and crash-reporting signals — and tells you it is clear or what to rotate tonight.
Read article →Website Production Readiness Checklist for 2026
Ship with evidence: the same themes a production review covers, checked from what the public internet can already see — then a clear list of what still needs internal ops.
Read article →SPF and DMARC on Your Website Domain: Why Security Scans Flag Them in 2026
Missing SPF or DMARC is not a header bug — it is open season for anyone to send mail that looks like it came from you.
Read article →Copy an AI Fix Prompt Per Ops Theme — Not One Giant Security Dump
Agents work better on one theme at a time. Copy the prompt under Transport or Health — leave the full dump for when you want everything.
Read article →Why 100+ SEO Rules Beat a 10-Check Audit in 2026
Ten green checks feel comforting. A hundred+ stable SEO rules find the crawl and indexability debt that shallow tools skip.
Read article →TTFB and Document HTML: The Performance Layer SEO Tools Still Miss
If the HTML is late or blocked in <head>, image compression will not save your LCP — or your crawl rate.
Read article →Fix-First and Section AI Prompts: Copy Only the Audit Slice You Will Ship
The prompt must match the buttons you see: Fix-first for the spotlight, section for the whole panel, category for one group.
Read article →Crawl Budget in 2026: Host Probes, Soft 404s, and Sitemap Noise
Every soft 404 and parameter trap Googlebot hits is a URL that did not get a fresh pass of your money pages.
Read article →GPC and Privacy Observations in a Website Audit (Without Fake Legal Scores)
Privacy rows are measured signals — conspicuous controls, GPC acknowledgment, obvious trackers — not a compliance certificate.
Read article →Website Accessibility Audit for EAA and EN 301 549 (Without Fake Certificates)
EN 301 549 v4.1.1 points at WCAG 2.2, but a single HTML fetch still covers only a slice. AuditHQ runs AHQ-A11Y rules and lists what it cannot judge.
Read article →Semantic Accessibility Is SEO and GEO Infrastructure
AI content campaigns still need pages machines can parse. Accessibility structure is that parse layer — measured next to SEO, not as a separate vanity score.
Read article →AI Content Campaigns Still Need a Measurable Website Audit
If the campaign only ships drafts, the site still fails on TTFB, soft 404s, cookies before consent, and unlabeled forms. Measure those on a schedule.
Read article →From Audit Findings to a Ticket Board (and Clean Jira CSV)
Diagnosis without ownership dies in Slack. Enable the ticket board, assign work, export Labels as section tags only — ready for client Jira.
Read article →ePrivacy-Style Cookie Observations in a Website Audit (Not a GDPR Verdict)
EU teams care about cookies before consent and unequal Accept/Reject UI. We measure those shapes and refuse to stamp “you violate GDPR.”
Read article →Teams & company
Company seats, project access, and enterprise SSO readiness for shared audit workspaces.
WordPress plugins
wordpress.org listings, security, support forums, and peer comparison.
WordPress Plugin Support Forum Health: Response Time and Resolution
A five-star banner with an unanswered forum is a churn risk. Support is part of product quality.
Read article →WordPress Plugin Comparison: Ratings, Freshness & Competitor Audit
Compare inside your tag and job-to-be-done — not against every plugin that shares one keyword.
Read article →WordPress Audit Checklist 2026: Listing Health, Security & Peers
A WordPress audit for plugin authors is listing + package + peers — ratings, freshness, support, and hosts in published PHP — ranked so you know what to fix first.
Read article →Check WordPress Plugin CVEs Before You Install: Slug + Version Matters
Ratings do not equal patched. Match the exact slug and version to published advisories, then skim the zip for nopriv, uploads, and sslverify => false.
Read article →iOS apps
App Store listing audits, ASO, ratings recovery, and competitor shelves.
iOS App Store Optimization (ASO) Basics That Still Work in 2026
ASO is not stuffing every synonym into the title. It is matching intent with proof in the first screenshots.
Read article →iOS App Ratings and Reviews: Stop the Slide Before It Compounds
Ratings compound. A quiet month of one-stars after a bad release costs more than the engineering day you skipped.
Read article →iOS App Competitor Analysis: Compare Listings, Not Just Downloads
Downloads lag. Listing quality and ratings tell you who is winning the shelf today.
Read article →App Store Listing Security Without the IPA: Privacy, Reviews, and Linked Sites
You cannot check ATS or cert pinning from the listing — and you should say so. You can still catch missing HTTPS privacy pages, label contradictions, and a developer site full of open findings.
Read article →Android apps
Play Store listings, ASO, ratings, and side-by-side competitor reviews.
Android Play Store Optimization (ASO): Keywords Without the Spam
Play rewards relevance and conversion. Keyword stuffing in 2016 style mostly trains users to bounce.
Read article →Android Ratings and Reviews in Play Console: A Recovery Playbook
Play users write shorter reviews than iOS — but the stars still decide browse rank. Treat Vitals and ratings as one system.
Read article →Android App Competitor Analysis: Play Listings Side by Side
Category pages are a shelf. Study the shelf, not only your own package name.
Read article →Google Play Listing Security Signals: Data Safety, Privacy URL, and Reviews
Shoppers read Data Safety before they read your feature graphic. Contradictions and a dead privacy URL kill installs faster than a missing screenshot.
Read article →