I audited my own site, and it was embarrassing
Broken share cards on every page, a publish button that did not publish, first paint waiting on Google, and a chat endpoint anyone could have billed to my API key. Everything an afternoon of looking properly turned up.
I sell an audit. I had never run one on my own site.
That is the whole confession. I have spent months telling other people to check what their site actually does, while never pointing the same thing at mine. So I did. I pointed Claude at the repo and asked it one question: what is broken here?
It came back with a list. I did not enjoy the list.
Every share card was broken
Every page on this site told Facebook, LinkedIn, Slack and X to use an image at /og-default.png. That file has never existed. Not once, not since the site went up.
So every link I have ever shared — every product, every post, every "have a look at this" in a DM — showed up as a blank rectangle. Months of it.
Worse, and I genuinely did not see this coming: the homepage had no share tags at all. Not a broken one. None. The single most-shared URL I own was handing link previews nothing to work with.
The blog could not publish
I built a little writing tool at /blog/new. Type a post, hit save, done.
Except the save wrote the post to the database, and the blog pages were built once at deploy time and never looked again. So a post I "published" would sit in the database, invisible, until something else happened to trigger a rebuild.
I had a publish button that did not publish. I would have found that out the hard way, mid-post, wondering why nothing appeared.
Nothing painted until Google answered
The fonts were loaded with a CSS import pointing at Google Fonts. That sounds harmless. It is not.
The browser has to fetch my stylesheet, read it, discover the import, go and ask Google for another stylesheet, read that, and only then fetch the actual font files. Nothing appears on screen for the whole of that chain. And because the request is buried inside a stylesheet, the browser cannot even guess at it early.
My first paint was waiting on a company I do not control, over a network I do not control. Self-hosting the files removed both round trips. Same fonts, same look, no third party.
Anyone in the EU reading this also no longer pings Google's servers just to look at my writing, which is a nice side effect.
The one that made me wince
There is a chat on my CV page. You ask it something, it answers as me.
It took whatever you sent, and forwarded it straight to Claude on my API key. No limit on how much you could send. No limit on how often. No check that the request came from my site at all.
Which means it was not really a CV chat. It was a free Claude account, open to the internet, billed to me. Anybody who noticed could have pointed a script at it and run up my bill all weekend.
Nobody did. I got lucky. That is not the same as being careful.
The thing that was fine
One finding I want to be straight about, because it cuts the other way.
I had assumed my images were a problem. There is 43MB of client work in the repo and I had half-planned an afternoon of converting it all to WebP. So we measured it instead of guessing. A real project page transfers about 51KB — the framework was already resizing and lazy-loading everything properly.
An afternoon of work I would have felt very productive doing, that would have changed nothing. Measuring first is not glamorous but it is the bit that saves you.
What I actually learned
None of these were hard problems. Every one of them was a small thing that quietly went wrong and then sat there, because the site kept loading and I kept not looking.
That is what makes them worth finding. A site that is properly broken tells you. A site that is slightly broken just underperforms, forever, and you assume that is the ceiling.
I fixed all of it in a day. The share cards now generate themselves per page. The publish button publishes. The fonts are mine. The chat has limits on it. And the eleven things I sell now tell Google what they cost, which they never did before.
If you would rather not squint at your own site — that is what the AI Search Visibility Audit is for. I check Google, Maps and the AI answers against your competitors and tell you the five things worth fixing first.
Turns out I should have run it on myself months ago.