Webmatik

A full audit scores eight categories — Performance, SEO, AI Readiness/GEO, UI/UX, Conversion, Retention, Accessibility, Security — built from 9 named data sources: Google PageSpeed (Lighthouse), Chrome UX Report (real-user Core Web Vitals), Google Search Console (paid plans), DataForSEO (keyword/traffic data), Mozilla Observatory (security headers), plus an AI vision pass over rendered screenshots, an LLM-generated action plan, sitemap analysis and a deep HTML scan. Category weights shift by detected site type (SaaS is weighted toward conversion, a blog toward SEO), which is a sensible design choice for a tool trying to replace several single-purpose checkers. Scope is capped: a free check covers the homepage only (UI/UX and Conversion scores are withheld because those need the AI vision pass); a full audit adds 3 inner pages on Free/Starter/AI Visibility/credits, 6 on Growth/Agency. It cannot audit anything behind a login.

Published and specific, confirmed on the pricing page 2026-10-07: Free (3 checks/month, estimated score range, no AI review); Starter $39/mo (25 audits, 10 tracked sites, 20 keywords, API access, no AI Search Visibility); AI Visibility $29/mo (10 audits/month each with a full ChatGPT+Gemini visibility run against 3 competitors, no API or Search Console); Growth $179/mo (100 audits, 50 tracked sites, AI Search Visibility, backlinks, CSV export); Agency $199/mo (Growth's feature set plus 5 seats, client portals, white-label PDFs, a lead-gen widget, 100 tracked sites). One-off credits exist for non-subscribers: a $9 starter pack (3 credits, once per account), then $25/10 credits or $60/30, never expiring, each opening one Starter-depth full audit. Credits don't apply to API usage.

webmatik.ai/api-docs lays out a real API: base URL, a single POST /api/v1/audit and GET /api/v1/audit/{id} endpoint pair, an OpenAPI spec at /openapi.yaml, webhook delivery with HMAC-SHA256 signatures, documented error codes (400/401/403/404/429/500), and a PDF-export endpoint. A separate guide walks through wiring it into Claude Code, Cursor and ChatGPT Codex. An MCP endpoint also exists at webmatik.ai/mcp (it returns HTTP 405 to a plain GET, consistent with a POST-only MCP transport, confirmed 2026-10-07) though it isn't documented on the same reference page. API access requires a Starter/Growth/Agency plan; audits run via the API count against the plan's monthly quota and credits don't cover it.

The domain webmatik.ai was registered 2026-03-08 (WHOIS, registrar Cloudflare, privacy-proxied registrant — no company name or address is published anywhere on the site, in its Terms, or in WHOIS) and the first Wayback Machine snapshot is from the same day, so the product is roughly seven months old as of this review. The homepage claims "Used by 3,200+ websites," "12,400+ audits run" and "86,000+ growth issues uncovered"; these are vendor-reported and not independently corroborated — there is no listing or review found on G2, Capterra or Product Hunt (Product Hunt and G2 both blocked automated access, so absence there isn't conclusive, but no independent review turned up through search either). The badges shown on the homepage (There's An AI For That, SaaSHub, Dang.ai) are self-submitted directory listings, not third-party evaluations.

Webmatik publishes a public leaderboard (by site type: SaaS, e-commerce, blog, etc.) ranking real audited sites by Growth Score, and sells "Featured" placement at the top (from $79, per the leaderboard page). As of 2026-10-07 the SaaS leaderboard's #1 spot, with a score of 89 ("Excellent"), is webmatik.ai itself — the vendor's own site, scored by the vendor's own audit engine, on a board the vendor built and curates. That isn't evidence the scoring is rigged, but it is a conflict a buyer should notice before treating leaderboard placement (their own or a competitor's) as third-party validation.

/docs, /changelog, /api (bare), /security and status.webmatik.ai all return 404 or fail to resolve; there's no public roadmap or release history. The closest thing to a security page is a line in the privacy policy naming Supabase, Stripe and Google as subprocessors and third-party audit APIs (Google PageSpeed, DataForSEO, Mozilla Observatory) as data recipients — there's no SOC 2, DPA or formal trust page. None of this is unusual for a seven-month-old solo-looking product, but it means there's no way to check uptime history or see what's changed release over release before buying.