Audit and fix your app from your editor, over MCP

Insights

Getting a shipped app found

The part no builder does for you: making a deployed app crawlable, indexable and citable. These guides come from what Actuant checks on real apps — each one maps to a fix you can verify on your own URL.

Builder guides

Fix the launch gaps specific to Lovable, Bolt, v0 and other AI builders.

Why your Lovable app isn't showing up on Google

A Lovable app renders in the browser, so it looks live — but Google and ChatGPT often see a blank page. Here's what they actually receive, how to check it in 30 seconds, and the five fixes in the order that matters.

Why your Bolt app isn't showing up on Google

Bolt ships a working full-stack app in a browser tab, but a deployed SPA serves an empty HTML shell before JavaScript runs — and that's exactly what Googlebot and AI crawlers see. Here's what they actually receive and the four fixes in order.

v0 launch checklist: what's still missing after deploy

v0 generates Next.js, so your HTML renders on the server — but being readable isn't the same as being launch-ready. Here's the checklist for metadata, security headers, structured data and AI visibility that a generated app still ships without.

Replit app security: what your deployment exposes that your code doesn't

Replit takes an app from idea to a live URL without leaving the tab, but the deployed surface often exposes debug endpoints, env var leaks and missing headers that a code review can't catch. Here's what to check on the live URL before you share it.

Why your Lovable app's link previews are blank

You share your Lovable app on Twitter or in a group chat and the link unfurls as a blank card — no title, no image, no description. Here's why it happens, which tags fix it, and how to make every share show a real preview.

Base44 launch checklist: what to check before you share your app

Base44 lets you ship a real, data-backed app without writing code — but the launch details that decide whether anyone finds it happen outside the builder. Here's the post-deploy checklist for indexing, link previews, security and analytics.

Cursor app pre-launch audit: what your repo can't tell you

With Cursor you own the code and the repo, so your CI already checks the source — but the deployed URL can serve stale builds, miss headers, leak env vars and fail to index in ways a repo scanner can't see. Here's the deployed-surface checklist.

Technical SEO

Canonical tags, sitemaps, robots and structured data — the mechanics, done right.

Canonical tags: the rules that actually matter

A canonical tag tells Google which URL is the real one when a page is reachable at several addresses. Get it wrong and you split your ranking signals or deindex the wrong page. Here are the seven rules, and how generated apps break them.

sitemap.xml: what goes in it, what breaks it, and how to tell it's working

A sitemap tells search engines which URLs to crawl. Get it wrong and Google wastes its crawl budget on dead pages or misses your content entirely. Here's what belongs in it, how generated apps break it, and how to verify it.

robots.txt: the rules, the mistakes, and the one-line check

robots.txt tells crawlers which pages to skip. A misconfigured one blocks your entire site from being indexed — and it's a one-line mistake. Here's what to put in it, what to keep out, and how to check it in 10 seconds.

Meta descriptions: what they actually do and how to write one

A meta description has no direct ranking impact, but it's the snippet under your search result — and that snippet decides whether someone clicks. Here's what makes a good one, how generated apps break them, and the one test that catches every problem.

Open Graph tags: the minimum set that makes every link preview work

Open Graph tags power the preview card when you share a link — the image, title and description that shows on Twitter, Slack, iMessage and everywhere else. Without them your link unfurls blank. Here's the six tags you need and the image rules that decide whether they work.

Title tags: the one tag that decides whether anyone clicks

The title tag is the headline in every search result, browser tab and link preview. A generated app ships with a default or duplicate title — and that's the first thing a searcher sees. Here's how to write one per page, how long it should be, and the SPA mistake that titles every page the same.

Structured data: the JSON-LD that tells Google what your app is

Schema.org markup gives search engines structured facts — name, category, pricing, rating — instead of prose to interpret. A generated app ships with none. Here are the two schemas that matter most for a launched app and how to add them.

Core Web Vitals: the three numbers Google uses to judge your page

Core Web Vitals are the three metrics Google uses as a ranking signal: how fast the largest element paints, how quickly the page responds to input, and whether the layout jumps around while loading. Here's what each one means, what a passing score is, and how generated apps fail them.

HTTPS mixed content: what it is, why it blocks your page, and how to fix it

Mixed content is when an HTTPS page loads an HTTP resource — an image, a script, a font. Browsers block it, search engines penalize it, and visitors see a broken lock icon. Here's how to find every mixed-content request and fix each one.

Security

CSP, security headers, HSTS and security.txt — the headers and files every deployed app should have.

Content-Security-Policy: what it protects, how to write one, and the mistake that makes it useless

A Content-Security-Policy tells the browser which scripts, styles and connections to trust — it's your primary defense against XSS. A generated app ships with none. Here's how to write one that's strong enough to matter and test it without breaking anything.

Security headers: the six your app needs and what each one protects

Security headers are HTTP response headers that tell the browser how to defend your visitors. A generated deploy sets none of them. Here are the six that matter, what each one does, and how to check they're actually being served.

HSTS: the header that makes HTTPS stick

Without HSTS, the first visit to your domain goes over HTTP before the redirect to HTTPS kicks in — and that first request is unprotected. HSTS tells the browser to go straight to HTTPS on every future visit. Here's what it is, what the values mean, and why a redirect alone isn't enough.

security.txt: the one-page file that tells researchers how to reach you

security.txt is a standard that tells security researchers where to report vulnerabilities they find in your app. It takes two minutes to set up and it's the first thing a researcher checks. Here's what's in it and where it goes.

AI visibility

Get your app named by ChatGPT, Perplexity and Google's AI answers.

llms.txt: how to get your app cited by ChatGPT and Perplexity

AI assistants recommend products in their answers. llms.txt is one of the levers that decides whether yours is one of them. Here's what the file is, what to put in it, and the other three things that matter more than most people admit.

Schema.org for AI: how structured data gets your app cited

Structured data isn't just for Google's blue links — it's how AI assistants get unambiguous facts about your app instead of guessing from prose. Here's which schemas AI models read, how they use them, and what to add if you want to be cited.

App directories and AI citations: how being listed gets you cited

AI assistants cite apps from directories they already trust — Product Hunt, Toolify, There's An AI For That. Getting listed puts your app in the sources models retrieve from. Here's which directories matter, what a good listing looks like, and how to submit without wasting hours per directory.