Proof: my own site audited in full, 18 August 2026

The score

My own crawler gives tropicagency.com.au a 99 out of 100 today. That number is worth almost nothing on its own, and I want to be straight about why. It is my tool, run on my site, and I fixed seven things this morning specifically because it told me they were broken. A score you produce with your own instrument is a starting point for a conversation, not evidence.

What is worth something is the list underneath it, and the detail of what is still missing. The tool raises five warnings on my own site. Four of them are the same warning about the robots.txt file that argues with itself, and that has its own section further down. I could clear those four this afternoon by changing one setting, and the reason I have not is the most useful thing on this page. The fifth is that my own business listing does not link out to any other profile of me, which is true, and stays true until there is another profile worth linking to.

What was broken, and for how long

None of this is flattering. All of it is true.

The site returned an error for months

Anyone who typed the address in got a Cloudflare 521 page. The cause was mundane: the server was only listening on an internal address, and Cloudflare was configured to require a proper certificate on the public one. Two settings that had never been made to agree. It was fixed on 14 August 2026. I do not know how many people tried the address in that window, because there was no analytics on a site that was not answering.

The contact form threw away enquiries and said thank you

There was a check in the form that measures how long you took to fill it in, meant to catch bots that submit instantly. It compared the clock on your device with the clock on my server. If your phone was running ahead of my server, even by a minute, the subtraction came out negative, the form treated you as a bot, and it deleted your enquiry. Then it showed you the confirmation message. You would have had no way to know. I found it by testing with a deliberately fast clock. Fixed 17 August 2026.

The pricing page contradicted itself

The comparison table said one figure for the Scale package and a quiz further down the same page said a different, much lower one. If you had asked me for the lower number I would have honoured it, which is exactly why it is the kind of mistake worth publishing rather than quietly deleting. Fixed 17 August 2026.

Every page was missing its security headers

This one I am including because it is the sort of thing that gets marked green on a checklist and is wrong anyway. The headers were configured, and if you asked the server for a file like robots.txt you got them. Ask for an actual page and they vanished. The reason is a rule in nginx that almost nobody knows: when you set a header inside a specific block, it silently discards every header inherited from the level above. The caching rule for HTML pages was doing exactly that. I found it this morning with the crawler and fixed it in twenty minutes. The site now also sends HSTS and a content security policy, which it never had.

The home page was written by a company that does not exist

It said "we" twenty six times, plus another six as "our" or "us". There is no we. The about page says Tropic is one person and that this is the point, and then the home page spent nine screens contradicting it. That is not a typo, it is the exact thing a small business can tell is fake within about four seconds. Rewritten 18 August 2026.

Fourteen blocks of my working notes were inside the published pages

In Spanish, as HTML comments, visible to anyone who opened the source. Notes to myself about schema I had not written yet. Removed 18 August 2026.

The sitemap was stale and incomplete

It listed fifteen pages, was missing two that exist, had no last modified dates on anything, and carried two fields that search engines announced years ago that they ignore. Rewritten 18 August 2026 with real dates taken from the files themselves.

I had numbers on this site that came from nowhere

The Mackay page carried search volumes for the local trades: plumbing at roughly 2,550 a month, dental at 1,650, and a total of thirteen to fifteen thousand across nineteen trades. On 18 August 2026 I went looking for the file those came from so I could re-run them. There is no file. They were repeated from memory into a published page.

They are down. In their place is what I actually measured, which is the state of thirty Mackay plumbing websites, with the method written out. Real volumes go back up when I have run them, with the date and the tool named.

The same page also said I had checked that the map box outranks everything in Mackay, and that the date was on this page. It was not on this page, because I never ran that check. That sentence now says plainly that it is my opinion and not a finding, and the check is on my list.

This is the least comfortable thing on this page and it is the one that most deserves to be here. The whole argument of this site is that I tell you what is actually true about your website. That is worth nothing if I do not hold my own pages to it.

And a week later the form threw away enquiries again, a different way

On 25 August 2026 I found that my database had been switched off. Not by me: the free plan pauses a project that goes several days without being used, and mine had gone quiet because nobody had filled the form in. Fair enough.

The part that is not fair enough is what my own code did about it. It tried to save the enquiry, failed, wrote a line in a log nobody reads, and returned the visitor a cheerful confirmation. Worse, that early exit sat above the code that emails me, so a database outage killed both ways of hearing about you at once. There is a comment in that file, written by me, that says in Spanish: never tell the visitor it failed.

That is the same fault I announced I had fixed on this page a week earlier. I had fixed the path I found and never checked whether there was another one.

It now works the other way round. The enquiry is written to disk immediately, the email goes out regardless with a warning in the subject line that it was not saved, and you are only told everything is fine if something actually caught it. If nothing did, you get told so, plus my email address so you are not left with nothing. And there is now a job that touches the database every night so it cannot go to sleep again.

The next morning I read every factual claim on this site, and pulled six more

On 19 August 2026 I went through all seventeen pages and pulled out every sentence that states a fact, a figure or a promise. Two hundred and thirty seven of them. Most are opinion and hold up fine. These did not.

Four pages sent you to a three question quiz that I deleted the same morning. Every one of them now points at the actual form, which asks six.
One page offered a free scan that has returned a not found error since the day I blocked it. It now offers what I really do, which is read your site myself and write it up.
The cost guide contained a customer who does not exist. An owner of an eight product clothing store, quoted fifteen to twenty thousand, coming online to ask if she was being had. The figure is real and comes from a published industry guide. The person was invented around it. She is gone, and the figure is now attributed to what it actually is.
Two more figures in that guide had no source I could find: a five hundred dollar website that got laughed at in a thread, and thirty thousand dollars that took a lawyer to escape. Both are out. The ones that stayed are traceable to threads I can point at.
The trades guide said I had audited a competitive local trade market. I had not. What I had audited was fourteen marketing agencies. That sentence now cites the thirty Mackay plumbers, which is real, dated and on this page.
A click on plumber was quoted at fifty seven dollars. That is Google's own number but it is the top of the range. The bottom is under fourteen. It now says both, because quoting only the scary end is the trick this whole site is against.

The claims that survived, survived on paper. The forum figures in the cost guide, the eight account managers in nine months, the graphs quote, and Google's own position on the special file for AI: all of those trace to a research document with dates and links.

The measuring instrument was wrong too

This is the part I would most like to leave out.

The tool I use to check websites had thirteen bugs in it. Two of them handed out passes that were not earned, on the check I talk about most, which is whether AI assistants are allowed to read your site. If your robots.txt file returned a not-found page that was technically labelled as a success, the tool recorded a pass and then recorded a pass for all five AI crawlers underneath it. It also looked for your sitemap on my own hard drive instead of on your server, so it told every website in the world that it had no sitemap.

The last one I found today. The compression check asked your server for its headers without ever saying it could accept compressed content, so no server on earth answered, and the tool concluded that nobody compresses anything. It had been reporting that as a fault on every site it had ever looked at, mine included.

All thirteen are fixed. I am publishing the list because a tool that gives everyone the same mediocre score is not measuring anything, and because if I found thirteen in my own code, you should assume a free instant audit from an agency that has never shown you its method has some too.

What is still wrong today

With the date I intend to fix it by. If a date passes and the line is still here, that is the point of putting the date there.

Only the home page carries the business schema. The other pages carry a breadcrumb and nothing else, and one of them was carrying a copy of another page's until this morning. By 30 September 2026.
My robots.txt contradicts itself in public, right now. It has its own section below. I am leaving it broken on purpose until the owner of the site, who is me, actually makes the decision rather than letting a default make it. By 30 September 2026.
I have not verified the Mackay search results myself, on a Mackay connection, on a dated day. Everything I say about where the map box sits is an opinion until I do. By 30 September 2026.
There are no search volume figures for the Mackay trades on this site, because the ones that were here had no source. Measured ones go up when the measuring budget resets. By 30 September 2026.
There is no phone number on this site. That is a decision, not an oversight. I am not putting my personal mobile on a public page, and I have not bought a business line yet. If you want to talk on the phone, use the quote form and I will call you.
There is no client work to show. No date on this one, because it is not mine to schedule. Tropic has no paying clients yet. When that changes it will be on the site with the client's name on it, and not before.
The pricing page still has an old quiz on it that ends in an email link instead of the quote form. It no longer shows the wrong price, but it is coming out. By 30 September 2026.

The file on my own site that argues with itself

I found this while writing this page, which is the only reason it is here.

Every website has a small text file called robots.txt that tells automated visitors what they are allowed to read. Mine says, in plain terms, that the AI crawlers are welcome. That is not decoration. Tropic sells being findable in AI answers, so blocking the crawlers that decide who gets recommended would be the whole business failing its own test.

Except that is not what my site serves. The company that sits in front of my site, Cloudflare, has a setting that quietly adds its own rules above mine. It is switched on. It sends a flat refusal for nine crawlers, six of which I explicitly welcome, and it does it above my section, which says the opposite. Anyone reading that file sees an AI search agency telling the AI crawlers no and yes on the same page.

Two things worth separating here, because almost every write up on this gets them mixed up. Some crawlers build the index an assistant searches when someone asks it a question. Others collect text to train the models themselves. Blocking the second kind costs you nothing in whether ChatGPT can find and cite you. Blocking the first kind makes you invisible. Cloudflare's default blocks only the training ones, which is a defensible position, and Google's training crawler in particular has no bearing on the AI summaries you see at the top of a search.

So the honest status is not "Cloudflare broke my site". It is that a real decision, whether my words may be used to train somebody's model, was made by a default that I never looked at, and I only noticed because I pointed my own tool at my own domain. I have rewritten my half of the file to spell out the difference and to say plainly that the conflict is live. I have not switched the Cloudflare setting off, because that is a decision about rights rather than a technical tidy up, and because leaving it visible here is more useful than resolving it quietly today.

If you take one thing from this page, take this: nobody had ever read that file. Not me, and I sell this.

The Mackay numbers

The same tool, pointed at the plumbing trade in Mackay on 18 August 2026. I started with the 48 plumbing businesses I have on file for the area. Nine have no website of their own, only a Facebook page or a directory listing. Seven are national chains or franchise networks whose website belongs to a head office somewhere else, so measuring them tells you nothing about Mackay. Two have a website that does not load at all, which I will come back to. That leaves thirty.

No business is named here and none will be. These are counts out of thirty.

19 of 30 do not tell a machine what kind of business they are. There is a small, standard block of code that says "this is a plumbing business, in this town, open these hours". Nineteen home pages do not have it. Google and the AI assistants have to guess from the words on the page.
13 of 30 have no share image. Paste their address into a text message or a Facebook post and it comes out as a grey box with no picture.
12 of 30 have their main heading wrong: either no page heading at all, or several competing ones.
6 of 30 have no robots.txt file.
Scores ran from 49 to 97, and the middle of the pack sat at 89.

That last line matters more than the rest, and it cuts against my own sales pitch, so here it is. Most plumbing websites in Mackay are technically fine. The median is 89. If someone tells you your website is a disaster and that is why the phone is not ringing, be sceptical, because for most businesses here it is not true. The gap is almost never the code. It is the Google profile, the reviews, and whether the site actually says what you do and where you do it.

The two that do not load

Two of the 48 have a website address on their listing that goes nowhere. One domain has been removed from the internet's address book entirely, which usually means it expired and was not renewed. The other still exists but its name servers do not answer. In both cases someone who searches for the business, finds it, and clicks through to the website gets a browser error. I checked both against a public resolver rather than only from my own server, in case the problem was at my end.

I am not naming them here. I am telling them, and it costs nothing.

How this page is meant to be used

If you are deciding whether to talk to me, the useful question is not whether my score is high. It is whether I told you about the form that deleted enquiries, the price that contradicted itself, and the thirteen bugs in my own tool, when nothing forced me to.

The other useful thing: everything above is a measurement of a page, not of a business. A brilliant plumber can have a 49 and a mediocre one can have a 97. I would rather say that out loud than let a number do the selling.

Get a quote

MY OWN SITE, AUDITED IN FULL. 18 AUGUST 2026.