Kolteo Beta

Changelog

What changed in Kolteo, newest first.

  1. A limit on manual SEO analyses

    The "Run SEO scan" button now allows one analysis every 5 minutes and 20 over 24 hours per account. All accounts share the same browser to render pages: this keeps analyses quick for everyone.

    When the limit is reached, the button shows how long to wait. Scheduled analyses (weekly by default) are not affected and do not count toward the limit.

  2. Shorter PDF reports, with the sections you choose

    The page report and the monthly report have a new, condensed layout: the key figures and summary at the top, then one table per topic. A monthly report that took seven pages now fits in four.

    • Choose the sections: when you download a report from your account, untick what your client does not need, such as the technologies or the activity of the month. Every section is ticked by default.
    • Pages and issues on their own page: in the monthly report, the list of pages and the issues to fix each start on a new page, so long lists stay easy to read.
    • Score history: the page report shows the score of each analysis as bars, with the lowest and highest score.

    The report sent on the 1st of each month and the one on the public status page still have every section.

  3. A fuller monthly report

    The monthly report sent to your clients now covers the whole site:

    • Technologies and language: the software seen on the pages, by category, with its version when the site shows it, a warning when it no longer gets security fixes or has an update, and the declared language, text language and other languages of each page.
    • Accessibility and eco-design: for each page, the accessibility rules failed (and how many are serious) and the eco-design grade from A to G, with the page's requests and weight.
    • Activity this month: changes found on the site, such as robots.txt, the sitemap, a software version, SPF or DMARC records, the certificate or the domain name.

    The page report now keeps to the page itself: the site-wide checks, the certificate and the domain name are in the monthly report.

  4. A failed analysis says why

    A failed SEO analysis only showed "Failed". From now on:

    • The reason is given, with what to do: the site did not answer (unknown name, refused connection, invalid certificate), the page took too long to load, or our analysis browser was unavailable, in which case there is nothing to change on the site.
    • The exact error message shows under the explanation, for the less obvious cases.
    • Every analysis shows how long it took in the list of a page's analyses.
    • A stuck analysis fails after 30 minutes instead of staying "running".

    When our checks change, the analysis page also says so in the comparison with the previous analysis, and a score drop caused by that change does not alert.

  5. History of the site-wide checks, and an alert when SPF or DMARC goes

    The site-wide checks (missing pages answer 404, one address for the site, SPF, DMARC) are read again every day. Until now only the latest result was kept. From now on:

    • Every change is recorded in the domain's Activity tab, with its date: "DMARC added", "SPF record changed", "the www. address no longer redirects".
    • The text of the SPF and DMARC records is kept: you see the old and the new one when it changes, for example the day a new email sending service is added.
    • When a check that passed starts failing (SPF or DMARC record removed, www. redirect broken, missing pages answering 200), the domain's contacts and you get an alert by email, Discord or Slack.

    A failing check is read a second time before it is recorded, so a brief DNS outage does not alert.

  6. An alert the day your PHP or WordPress stops getting security fixes

    Until now, software without security fixes only showed in the next analysis of a page, up to a week later. Kolteo now checks it every day, without a new analysis and without contacting your sites:

    • The versions seen by the last analysis (WordPress, PHP, Drupal, Apache…) are compared each morning with the current support lists.
    • The day a version stops getting security fixes (PHP reaches its end of life, WordPress marks a release insecure), the contacts of the domain and you get an alert, and it goes in the domain's Activity tab.
    • More software is judged: Drupal, TYPO3, Joomla, Magento, Apache, Laravel, Symfony, Django, Next.js, Nuxt, React, Vue.js, Angular, jQuery, Bootstrap and more, from the end-of-life data of endoflife.date.
    • A late patch release of PHP or a CMS now shows with the latest release of its branch, such as "PHP 8.3.2 (latest: 8.3.36)".

    A version built by a Linux distribution (such as "PHP/8.1.2-1ubuntu2") is not judged: the distribution keeps patching it after the official end of life.

  7. Technologies and language of each page, and software without security fixes

    Each analysis now shows a Language and technologies block, grouped by category like a browser extension would: CMS, frameworks, JavaScript libraries, analytics, cookie banner, web server, programming language…

    • Versions show when the site gives them away (response headers, generator tag, JavaScript libraries). Nothing is probed: we only read what any visitor receives.
    • Software without security fixes: a PHP version past its end of life, or a WordPress version marked insecure, now counts in the security score. A WordPress that is behind but still patched counts as "to improve".
    • Versions shown publicly (PHP in the X-Powered-By header, the WordPress generator tag, a server version) are a new check, with how to hide them.
    • Language: the lang attribute is compared with the language the text is written in, and hreflang links are checked (valid codes, the page listing itself).
    • A version change (PHP 8.3 → 8.4) goes in the domain's Activity tab.

    These checks start with the next analysis of each page.

  8. Domain activity, and an alert when robots.txt blocks your pages

    What happened to a site was spread across alerts and notifications. Each domain now has an Activity tab that keeps it in one place:

    • robots.txt is read every day and compared with the day before. A change shows with the lines added and removed.
    • If robots.txt starts blocking a monitored page, the contacts of the domain and you get an alert right away. A "Disallow: /" left over from a staging site can otherwise drop the whole site out of search results.
    • The sitemap is counted every day: it shows when it loses or gains many addresses, or disappears.
    • Outages, returns, SEO regressions, certificate and domain expiry are listed with their date.

    Entries are kept 400 days, like the checks. The history starts today.

  9. See where the response time goes

    A slow page could come from DNS, the network, the server or simply a heavy page, and the response time alone did not say which. Every check now splits its response time into steps:

    • Redirects, DNS lookup, connection, TLS handshake, server and download are measured on each check, along with the size of the page.
    • A page's overview shows a new "Where the time goes" chart, stacked by step, over 24 hours, 7 days or 30 days, with the average page size.
    • A domain's dashboard compares its pages side by side: one bar per page, split by step, over the last 7 days.

    The steps are recorded from today: older checks only have their total response time.

  10. Down alerts wait for a second failed check

    A server that stopped answering for a few seconds was enough to send a "down" alert, then a "back up" one a few minutes later. A failure is now confirmed before it alerts:

    • A failed check is still checked again 20 seconds later, then once more a minute later instead of after the page's usual interval.
    • The alert goes out only if that check fails too. If the page answers, nothing is sent.
    • A short blip is not an incident. It still counts in the uptime percentage, since the page did not answer, but it no longer shows in the incident lists, the status page or the reports.
    • Incident durations are measured, from the first failed check to the first successful one, instead of counting one full check interval per failure.
    • The cause is more precise: a DNS error or a refused connection now shows as such instead of "No response (timeout)".

  11. One alert per site when it goes down, at most one every 15 minutes

    When a server went down, every page it serves sent its own alert: ten pages meant ten "down" emails, then ten "back up". Alerts are now per site:

    • One "down" names every page that fails, in a table with the time each one started failing and its last error (503, no answer, certificate...).
    • One "back up" once every page answers again, with how long the site was down.
    • At most one of each every 15 minutes. A site that drops three times in ten minutes sends two messages, not six. An alert held back goes out when the 15 minutes are over if the site is still in that state, so the last message you read is always true.

    The same rule applies to the emails, Discord, Slack, the bell of your client area and push notifications.

  12. A blog and this changelog

    Two new pages on the site, in English and French:

    • This changelog, with every notable change of Kolteo, newest first.
    • A blog, with guides on SEO, accessibility, eco-design and uptime for the sites you build, and their sources at the end of each article. An RSS feed follows it.

    Both are linked from the footer of every page.

  13. A fuller page report, with a table of contents

    The PDF report of a page, the one you can share with a client from its status page, grew into a complete document:

    • A table of contents on the second page, with the page number of each section.
    • What changed since the previous analysis, and how the page shows in search results.
    • Accessibility with the standards of each issue, eco-design, and the technical details of every check.
    • A glossary at the end, for the clients who do not speak SEO.

    Your own copy, downloaded from your client area, also lists the cookies set before consent. The copy shared with clients never does.

  14. Accessibility standards, cookies before consent and eco-design in every analysis

    Three new blocks on each page analysis, kept outside the SEO score:

    • Accessibility standards. Every issue found by the WCAG audit now shows the criteria it relates to in WCAG 2.2, the European standard EN 301 549 and the French RGAA 4.1, so you can answer a client who asks "are we compliant?" with facts.
    • Cookies and trackers before consent. The page is loaded like a first visit, without clicking any banner, and we list the cookies (names only, never their values) and the known trackers that are already there. These are findings to look at, not a legal opinion.
    • Eco-design. A grade from A to G inspired by the EcoIndex method, from the page's number of elements, requests and weight, with an estimate of greenhouse gases and water per visit.

  15. Status pages, reports and alerts in your client's language

    Each domain now has a language, and everything its client receives follows it:

    • the public status pages of its pages,
    • the PDF reports, of a page and the monthly one,
    • the alerts sent to its contacts by email, Discord or Slack.

    Five languages to start with: English, French, German, Spanish and Italian. A new domain takes the language you read the site in, and you can change it in the domain's settings. Your own client area stays in English.

    The public site is also available in these five languages.