How it works.

WHAT WE SCANFive checks of your homepage

The Arena uses five parts of a be1st.ai audit, plus the screenshots and the favicon for the ID card.

• Technology fingerprint: the framework, CMS or shop platform your public page is built with, and the hosting, CDN, analytics, payment, font and social tools it loads.
• Performance: how fast your server answers (time to first byte) and how heavy the page is: HTML size, page weight, number of requests, images, unused CSS and JavaScript. It is not a Lighthouse or Core Web Vitals test.
• SEO: 30 checks such as titles and descriptions, headings, canonical and robots tags, structured data, image alt texts, broken links, sitemap, HTTPS and language tags.
• Security: HTTPS and the certificate, security headers (HSTS, CSP, X-Frame-Options and others), mixed content, cookie flags and the browser’s security warnings. It only reads what your server sends.
• AI readiness: 22 checks of how well AI assistants can read you: structured data, the rules for AI crawlers in your robots.txt, llms.txt, answer-first text, FAQs, lists and tables, a Markdown version and semantic HTML.

WHAT WE READExactly what the audit loads

Public addresses that any visitor could open. The homepage is the only page whose content is read.

• Your homepage: its HTML and response headers, and the page itself loaded in a real browser (Chromium) on a desktop and a phone-sized screen, scripts included.
• Screenshots: the top of the page and the full page, on desktop (1440 px wide) and on a phone (375 px).
• Public files: robots.txt, your sitemaps (the addresses they list are recorded, not opened), llms.txt and llms-full.txt, your favicon, a Markdown version of the homepage if you offer one, and /wp-json/ when the site looks like WordPress.
• Your own code: up to four of your JavaScript files and three CSS files (more chunks on Next.js sites), to recognise the framework and its version.
• Links on the homepage: one status request per link, internal and external, to find broken ones. The linked pages are not read.
• Certificate and server: the TLS certificate, and a few unusual requests that show which web server answers: a page that does not exist, a request with an empty or an oversized header, and one to the server’s bare IP address.
• Cookies: the names and security flags of the cookies your page sets, never their values.

HOW IT VISITSOne visit from the outside

• Like a visitor’s browser: the pages load on be1st.ai’s servers in a headless browser that runs your scripts, analytics and ads included. An audit usually takes one to two minutes.
• Cookie banners: to take clean screenshots, the browser clicks the Accept button of your cookie banner, so your analytics may count the visit.
• AI helpers: an AI model (through OpenRouter) writes the report’s summary from your address and results. When an audit includes content analysis, an AI model also reads your homepage text to name its main themes, the ones on the ID card.
• AI visibility: some be1st.ai audits also ask AI assistants questions about your topic and brand. The Arena does not use that score.
• be1st.ai’s own tools: its product analytics and team notifications record which website was audited and by which account.

WHAT WE STOREWhat is kept, and for how long

be1st.ai keeps the audit in its database. Nothing expires on its own: an audit stays until the be1st.ai account that ran it deletes it.

• Scores and findings: the five scores, the result of every check and a written summary.
• What was detected: your technologies, the page title, description and other meta tags, your robots.txt rules, the addresses in your sitemaps, the links on your homepage with their text, and your llms.txt.
• Page text: when the audit includes content analysis, the visible text of your homepage, with anything it shows. No separate list of emails or phone numbers is made, and the raw HTML is not kept.
• Images: four screenshots and your favicon, in a public storage bucket.
• The Arena itself: writes nothing about your website to a database. Its server keeps lookups in memory for minutes (the class numbers for an hour); your fighter, looks and fights stay in your own browser until you clear it.
• Early access: your email, the website you add (optional), the language, which form you used, your browser’s user agent and a salted hash of your IP address, never the IP itself.

PUBLIC IN THE ARENAWhat other visitors see

When the Arena opens, anyone who visits sees these for a website that joined it, from its Arena audit. Until then the Arena shows only labelled demo fighters: an audit run on be1st.ai on its own never appears here.

• Identity: the domain, its favicon and the top of its homepage as desktop and phone screenshots.
• Numbers: Fighter Score and tier, the four stats against the class median, the audit date and the change since the previous audit.
• Class and gear: the class, and the detected tools by name: hosting, server type, CDN, analytics, payments, social networks and font providers, the framework’s major version, the certificate issuer and TLS version.
• Main theme: the page title and description, the website type and up to six themes of its content.
• Fights: battle pages show both fighters’ cards and stats, and a challenge link shows your domain to anyone who has it.
• Class numbers: each class’s median scores and number of websites, without names, from every website be1st.ai has audited.

NOT SHOWN IN THE ARENAWhat the Arena leaves out

The Arena’s pages and its API never show these. They remain part of the full be1st.ai report.

• Findings: the individual issues and failed checks, security findings included, and the written summary.
• Page content: your homepage text, robots rules, sitemap addresses and the links on your page.
• Details that help attackers: software versions beyond the framework’s major version, the server’s version and operating system, and the certificate’s expiry or problems.
• Who asked: the be1st.ai account that ran the audit.
• Early access details: readable only by be1st.ai’s admins.

WE NEVER ACCESSWhat the scan cannot touch

The audit is a visitor from the outside, with no password, no account and no access to your systems.

• No logins: it never signs in, fills in a form or sends data to your site. No accounts, no admin area.
• No hidden paths: it does not try secret files or admin pages such as /.env, /.git or /wp-admin, and it does not scan ports.
• No private systems: your server, database, hosting panel, DNS settings, email, analytics and payment accounts are out of its reach. It sees only what your website sends to anyone.
• No other pages’ content: only the homepage is read; other pages get at most a status check.
• No private networks: the Arena’s check refuses private and internal addresses, so it can only reach public websites.

WHY WE NEED ITWhat each part becomes

• Technology fingerprint: picks your class: the robot, its colours and the logo on its back. The tools become gear on the ID card. Never part of a fight.
• Performance: becomes Speed (round 1) and 20% of the Fighter Score.
• SEO: becomes Visibility (round 2) and 55% of the Fighter Score.
• Security: becomes Armor (round 3) and 25% of the Fighter Score.
• AI readiness: becomes AI Power (round 4).
• Screenshots, favicon, title: make your fighter recognisable: the favicon on its chest, the screenshots on the ID card, the main theme. Never part of a fight.