Website intelligence for SEO agencies: a Windows desktop application for Managers, Team Leads and Agents to manage leads, run real technical SEO and passive security audits, deliver client reports, run audit-grounded email outreach and collaborate — backed by a secure API server.
Windows desktop (PySide6) ──HTTP(S) / WS──▶ Flask API (one process) ──▶ SQLite (this computer)
│ or PostgreSQL (team server)
└─ audit engine, audit queue, reports, import + email workers
The desktop client never connects to the database and contains no server secrets. See docs/architecture.md.
Download Rankly-Portable-3.0.0.zip, unzip it, double-click
Rankly.exe and choose On this computer: the app starts its own
built-in server (the same exe with --serve), creates its database and keys in
%LOCALAPPDATA%\Rankly\data, and asks for the first Manager account.
Nothing else to install. Or choose Connect to a team server.
Manuals: User Manual · Technical Reference.
:: 1. API server on the local SQLite database
set SEO_DB=sqlite
.venv\Scripts\python.exe scripts\dev_seed.py :: once; demo accounts -> server_data\dev_credentials.txt
run.bat :: http://127.0.0.1:5055
:: 2. Desktop client
run_desktop.batTo try the packaged first-run flow from source, set a throwaway profile first:
set SEO_AUDIT_PRO_PROFILE=dev-first-run (separate settings and data folder).
Build the Windows executable and the portable zip (and an installer, if Inno Setup 6 is installed):
build_exe.batProduction deployment, environment variables and first-Manager setup: docs/deployment.md.
| Area | Highlights |
|---|---|
| Access | Sign-in with lockout, forgot/reset password by emailed code, mandatory change of temporary passwords, refresh-token sessions stored in Windows Credential Manager, sign-out everywhere on password change |
| Roles | Manager, Team Lead, Agent — enforced by the API (see docs/security.md) |
| Lead Bank | Built for Google Maps scrapes (one niche + area per file, many files, millions of rows): multi-file CSV/XLSX import read on the person's own computer (only rows go to the server) with live progress; rows without a website and duplicates (by domain or phone, against the bank and within the file) removed and listed per file; niche → area navigator with counts; filters for unassigned / audited / contacted; select all matching across pages; assign to a person or team, or split evenly across a team; assignment history and conflict protection; CSV export; archive |
| Audits | One click from a lead, or bulk: select leads (or all matching) and queue up to 100 per run (500 for Managers); a saved queue; each audit runs on the computer of the person who queued it, 2 at a time by default (Managers can change it), single audits first, survives restarts and closed apps; Queue view with progress, time left and cancel; one notification per finished batch. Real progress from the engine; scored results, issue explorer with resolved/unresolved tracking, passive security findings, recommendations, crawled pages |
| Reports | Client and technical Word reports made on the auditing computer and stored for the whole team; PDF made on first open by the opener's computer (Word or LibreOffice) and stored for everyone; standalone HTML client report; JSON export. Results are stored compressed (~80 KB per audit) |
| Outreach | Email drafts generated only from real audit findings and always editable; attachments; encrypted SMTP (Gmail or company domain); rate-limited queue; bulk outreach with preview and confirmation; delivery activity |
| Collaboration | Direct messages and team channels with presence, typing, replies, edits, deletes, reactions and search; share a lead or an audit report in a message (no outside files in chat); notifications |
| Administration | Teams, users, immutable audit log, audit defaults |
Give it a website; it crawls the site and runs ~70 checks across ten weighted categories, plus PageSpeed Insights (lab + real-user CrUX data) and a passive security assessment.
| Category | Weight | Examples |
|---|---|---|
| Technical SEO | 16% | robots.txt, sitemap, canonicals, indexability, redirects, broken links, structured data, hreflang |
| On-Page SEO | 14% | titles, meta descriptions, headings, thin content, image alt, internal links |
| Performance | 14% | PageSpeed mobile/desktop, Core Web Vitals, render-blocking, compression, caching |
| Content | 10% | readability, depth, E-E-A-T signals, NAP |
| Mobile | 10% | viewport, responsive signals, tap targets, mobile speed |
| Security | 8% | HTTPS/TLS, certificates, HSTS, security headers, cookies, information disclosure, sensitive file exposure, known JS library CVEs, SPF/DMARC/DKIM, authentication surface, WAF, technology fingerprint |
| Local SEO | 8% | local business signals |
| Off-Page / Authority | 8% | estimated authority model (labelled as an estimate) |
| Accessibility | 8% | language, labels, link text, landmarks, Lighthouse a11y |
| UX | 4% | layout stability, interactivity, font loading |
Each check is pass (1.0) / warning (0.3) / fail (0.0); info and
not-applicable checks are excluded, categories without data are dropped and
weights renormalised, and honest penalties are applied. The security
assessment is passive: exposed sensitive files are reported only as "Publicly
accessible", never downloaded or quoted. Scoring and rules are documented in
docs/AUDIT_SCORING.TXT and
docs/SCORING_RULES.TXT.
| Document | Contents |
|---|---|
| docs/architecture.md | Components, request flow, structure |
| docs/desktop.md | Startup, sign-in flows, navigation, local data, design system |
| docs/api.md | REST and WebSocket reference |
| docs/database.md | Schema, constraints, migrations |
| docs/security.md | Authentication, RBAC matrix, data protection |
| docs/deployment.md | Server and client deployment |
| docs/testing.md | Automated and manual tests |
| docs/IMPLEMENTATION_RECORD.md | What was found, changed, fixed, and what remains |
docs/*.TXT |
Engine methodology notes (scoring, security headers, indexation, …) |