See what your website actually does - from the outside.
An independent assessment of your public website's marketing technology, tracking, consent behaviour, technical SEO, security hygiene and accessibility. No access to your systems needed. Every finding comes with the evidence and who should fix it.
Request an assessment See a sample
Fixed price A$2,500. Read by a person before you see it.
The problem
Most organisations cannot answer simple questions about their own website:
- Which tracking and advertising tools are actually running - not the ones in the plan, the ones in the browser?
- Does tracking wait for consent, or start before anyone is asked?
- Is the analytics data your reports rest on shaped the way your platforms expect?
- What would a security reviewer, a search engine or a screen-reader user notice first?
The answers sit across marketing, analytics, privacy, IT and agencies, and nobody owns the whole picture. Site Criterion gives you that picture from the one place everyone can agree on: what your website actually sends to a visitor's browser.
What you get
One assessment of your site, delivered as:
- A prioritised fix list. Each finding says what was observed, what it costs, what to do, and who does it - a setting in a tool you already run, a content edit, or a code change.
- The stack as observed. Every recognised tag, pixel and vendor on the pages assessed, which pass it appeared in, and whether it sent data.
- Consent behaviour, pass by pass. The site loaded four ways - before any choice, after accept, after reject, and with the browser's opt-out signal - so you see what changes and what does not.
- Views for each reader. A marketing view, a privacy view and a security view of the same evidence.
- A walkthrough call. A 45-minute walkthrough call with Jack to go through the findings with your team.
- The evidence. Every finding can be traced to the recorded capture it came from, and contested.
About 100 automated checks across six areas: tagging and analytics, advertising technology, consent and privacy, technical SEO and performance, security hygiene, accessibility.
What it is not
We are precise about this, because a report that overclaims is worse than none.
- An assessment aid, not a certification. It says what an automated visitor was served, and what the tool's rules made of it.
- Observed behaviour, not legal advice. Consent findings describe what the site did. Whether a law was met is for your privacy adviser or lawyer; this gives them the evidence.
- Hygiene, not a penetration test. Security checks read certificates, headers and public paths once, from outside.
- Automated accessibility checks, not WCAG conformance. They cover part of what a person using assistive technology would meet.
- A sample of pages, not a full crawl. The pages assessed are named; findings are about those pages.
- What could not be seen is stated, never counted. A check that reached no verdict says why, and is neither a pass nor a fail.
Sample
Excerpt from a real assessment
An Australian online retailer, assessed September 2026. Identifying details removed; findings shortened. This sample predates later improvements to the tool and shows the format, not current figures.
Coverage: 5 pages loaded and assessed, desktop and phone. 31 of 100 checks reached no verdict, each with its reason. Score 62.6, likely range 30 to 82, resting on 60% of checks - a prioritisation aid, not a grade.
What to fix first (3 of 8 critical findings):
| Check | Result | What was observed | What to do | Who |
|---|---|---|---|---|
| Does tracking start before people agree? | Fail (critical) | Tracking observed on first load, before any consent choice was made | Gate the listed tags behind the consent state | Code change |
| Does remarketing wait for consent? | Fail (critical) | A remarketing endpoint called on 5 pages in the no-choice and reject passes | Hold remarketing pixels until consent is given | Code change |
| Are the events your business model needs there? | Fail (critical) | Ecommerce site; no view_item or add_to_cart events observed |
Add the expected events; tell us if the business type is wrong | Code change |
Stack as observed (excerpt): 14 vendors across advertising, analytics, remarketing, programmatic advertising and tag management; 2 loaded code but were never seen sending data.
Also found: a vendor script throwing errors that can stop later tags; no ads.txt file; page weight about six times the budget; missing clickjacking protection and no Content Security Policy.
How it works
- You tell us the site and anything we should know: markets, sections that matter, your consent platform.
- We scan it from outside - no logins, no forms submitted, robots.txt respected. The scanner identifies itself in every request.
- A person reads every finding before you see it.
- You get the report and a walkthrough, within 5 business days.
Price
A$2,500 per assessment, fixed. Includes the report views, the evidence, and the walkthrough call.
Site Criterion is not registered for GST; no GST is charged.
Repeat assessments after fixes, and assessments of several sites, by arrangement.
Who is behind it
Site Criterion is run by Jack Donda, a MarTech and digital analytics lead with more than 15 years across Australia and Asia-Pacific, most recently MarTech Lead (FVP) at UOB, before that Citi Asia-Pacific. He led the first Adobe Real-Time CDP implementation in Southeast Asia and multi-market attribution programmes.
He built Site Criterion because the question every martech review starts with - "what is actually on the site?" - usually takes weeks of meetings to answer.