Competitor tracking

Add any competitor URL. XICTRAQ creates the competitor entry in your dashboard; if no name is given, the hostname is used. You trigger the first scan across all 22 sections by click; after that the automatic scan runs via cron depending on your plan. Internal, private or non-resolvable addresses are rejected server-side (SSRF protection).

Enter your industry and postal code. XICTRAQ resolves the postal code into coordinates via OpenStreetMap Nominatim and then searches businesses with a registered website via the Overpass API within a selectable radius (5 to 100 km, default 20 km). Matches are ranked by relevance to the industry, cleaned of your own domain and already-tracked competitors, and shown as a suggestion list (up to 20) -- you add fitting entries by click.

Competitors with auto-scan enabled are re-scanned via cron as soon as the last scan is older than the plan interval: Agency every 6 hours, Business every 12 hours. The cron run processes the oldest first (up to 200 competitors per run, 25-minute time budget). You can toggle auto-scan per competitor; regardless, you can trigger an on-demand scan by click at any time.

Instead of individual real-time alerts per change, XICTRAQ aggregates the detected changes from the last 24 hours into a single daily digest email. The mail lists, per competitor, the number of changes and the affected types (e.g. tech stack, structured data, infrastructure, security, prices) and links straight into the dashboard. The digest only includes competitors for which the change alert is enabled. Which change types it covers is set under Settings → Notifications → Competitor changes; messaging shift, WAF, ad and CTA changes are switched off there by default and then only appear in the Changes tab.

Availability and status code plus timing breakdown (response time, TTFB, DNS, TCP, TLS, download size). SSL status with issuer and remaining validity in days. Security header score of 0--100 from HTTPS plus six headers (HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy). If the competitor is rejected by an anti-bot WAF with 403/503, the scan recognises this and still marks it reachable.

SEO metadata per scan: title tag (with 30--65 character length check), meta description (100--165 characters), H1 count, viewport, canonical, OG and lang attribute checks. From these a 0--100 SEO score. Changes to title, description and H1 appear in the changes tab with before/after diff.

Detection of Google Fonts, Google Analytics and Meta Pixel, count of third-party domains, plus an imprint and privacy-policy link check. From these a 0--100 privacy risk score that drops with each additional tracker and with missing mandatory legal links.

CMS, framework, CDN, CSS and analytics detection, extended by the TechDetector with over 1900 signatures. Robots.txt presence and sitemap analysis including URL count. Open Graph and Twitter card tags, social media profiles, favicon and RSS/Atom feed.

Content volume measures word, link, image and H2 count per scan. In addition, up to 20 individual URLs of a competitor can be watched (e.g. a pricing or product page): XICTRAQ compares the extracted content by hash and shows a text diff on change. With an optional CSS selector hint (class or id), XICTRAQ reads a specific price value and reports price changes separately.

The careers detector probes typical paths (/careers, /jobs, /karriere, /stellenangebote) and detects whether a jobs page exists -- a possible growth signal. The messaging shift captures H1 and meta description and reports a significant shift (similarity below 80 percent) as a hint of changed positioning.

A changed SSL issuer or a security-score drop of more than 20 points versus the last scan is treated as a security incident. Additionally, recently issued certificates are captured via the Certificate Transparency log (crt.sh). The Schema.org analysis reads JSON-LD structured data (including @graph and nested objects) and reports changes per type and field.

Core Web Vitals (LCP, CLS, INP) are taken by XICTRAQ as 75th-percentile field data from the Chrome UX Report -- provided data exists for the origin. The 0--100 accessibility score checks eight criteria (lang attribute, alt-text coverage, heading hierarchy, form labels, skip link/landmarks, zoom allowed, link-text quality, button labelling).

Resolving IP, up to four nameservers and a hosting hint from reverse DNS. Email infrastructure: MX hosts, SPF and DMARC presence plus a mail provider hint. An IP change is only reported as an infrastructure change if the new IP is not in the current DNS A/AAAA records -- so load-balancer and CDN rotation is not flagged as a false alarm. Nameservers are queried at the zone apex; if the query returns nothing the state counts as not measured and is neither displayed nor reported as a change. A nameserver change names the old and the new list.

Social proof detection covers review platforms, trust seals, ISO certifications, customer-count claims, testimonials and partner logos. Forms are classified (newsletter, login, search, contact) and CTA texts extracted. Ad detection probes eight advertising pixels (incl. Google Ads, Meta Pixel, LinkedIn, Microsoft). Page weight estimates the total weight in KB from HTML size plus CSS, JS and image count.

On every scan XICTRAQ captures screenshots in three viewports (desktop, mobile, tablet) and compares them against the previous shots. If the aligned image difference exceeds 5 percent, a visual change entry with a diff image is created; severity depends on the percentage (above 20 percent critical, above 10 percent warning).

At the top a reference bar of your own website with key metrics. Below, each competitor gets a card with six dimensions (performance, security, GDPR, SEO, technology, accessibility), plus SSL remaining validity, response time, page weight, tech badges, ad platforms and compliance indicators. A mini sparkline shows the security-score trend of recent scans. A quick-insights block summarises the top-3 ranking and the latest changes.

The compare tab switches between table and leaderboard. The table lines up your own site and competitors column by column across all metric groups. The leaderboard ranks all participants by a selectable metric; default is the overall score -- a 0--100 score combining security, GDPR, accessibility, SSL and response time. Alternatively, sort by individual metrics such as response time, TTFB, LCP or sitemap size. A collapsible activity heatmap shows change frequency per competitor over the last 12 weeks.

The changes tab shows every detected change chronologically. Depending on the field, a concrete diff appears: text diff for content, URL diff for sitemap, line diff for robots.txt, type/field diff for structured data and diff images for visual changes. Each change carries a severity (info, warning, critical).

The narration uses only the already-detected change data (no raw scans, no personal data) and stays deliberately factual -- no “better/worse” comparisons, no disparagement. It is purely informational and does not trigger alerts itself; the separate change digest remains responsible for that. Available from the Business plan; if AI is unavailable a deterministic short text from the count of critical, warning and info changes is used.

Generate a complete competitor report: own website, comparison table of all competitors (status, response time, security, privacy, SSL, sitemap, WAF) and the recent changes. The report opens in the browser for printing -- via the “Save as PDF” dialog you get a PDF file for pitches, quarterly reviews or management presentations.

Export all competitors with their core metrics (name, URL, status, response time, TTFB, SSL, security and privacy score, sitemap, title/description/H1, tech stack, change count) as CSV -- open straight in Excel, Numbers or Google Sheets. Values from third-party websites are neutralised against CSV formula injection.