How LaunchScaler works

A URL is the only thing we ask for, and it stays the only thing. Paste it and the scan reads the page the way a browser and a crawler do, then works out the name, the tagline, the description, the category and the tags from what is already there. You never fill in a submission form, because the page has already answered it.

Seven checks run: Search, AI visibility, Backlinks, Security, Compliance, Does it work, and Speed & visual. Each returns its own score out of 100, and the seven roll into one readiness score weighted by how much of each we could actually measure. Anything we could not read is marked not measured rather than counted against you. How we scan has the method and the standard behind each check. What we check lists every individual test.

The moment the scan finishes, the domain has a public page and a full report, sitting there with nobody attached to it. No account was needed to make it and none is needed to read it. It waits, unclaimed, until somebody proves the site is theirs.

Every score carries the day it was measured. Fix what the report flagged, run the scan again, and the page moves with the new number. A standing nobody has re-run for three months is marked stale on the listing, so an old measurement never reads as a fresh one.

Claiming is what turns a public page into something you can edit, launch, monitor and sell from. Sign in, open the listing, and we give you a random one time token. Put that token somewhere on the domain we can read back, press verify, and the listing is yours.

Pick whichever of the three is easiest on your setup. They prove the same thing and none of them is preferred. The token is generated by us and tied to your account, so it cannot be guessed, and the first person to verify keeps the listing.

Type   TXT
Name   example.com
Value  launchscaler-verify=YOUR_TOKEN

One TXT record on the domain, with the whole value copied exactly. We look it up directly, so it works even if the site itself is behind a login.

<meta name="launchscaler-verify" content="YOUR_TOKEN">

Drop it anywhere in the head of your homepage. We fetch the homepage and read it with a real HTML parser, so formatting and attribute order do not matter.

https://example.com/.well-known/launchscaler-verify.txt

YOUR_TOKEN

Serve the file at that exact path, with the token as its entire contents and nothing else. Trailing whitespace is fine, anything else is not.

Verification can be tried up to twelve times an hour, which is more than enough for a DNS record to spread. If it keeps failing, the usual cause is a token that picked up a stray character on the way across, so copy it again from the claim page.

The badge puts your live readiness score on your own site, next to a link that lets anyone check it. Once your listing passes, open its badge page, choose light or dark, and copy the snippet.

There are two versions and they do different jobs. The inline one is self contained SVG: no script, no request to us, and the score frozen at the moment you copied it. The image one loads from us on every view, so it always shows today's number and only shows the check mark once we have confirmed the badge is really on your page.

<a href="https://launchscaler.com/v/example.com?t=YOUR_TOKEN" target="_blank" rel="noopener nofollow">
  <img src="https://launchscaler.com/api/badge/example.com/image?theme=light"
       alt="LaunchScaler readiness badge"
       width="272" height="58" loading="lazy">
</a>

We look at your homepage for the badge about once a week. If we cannot reach your site, nothing happens: we could not look, which is not the same as you not showing it. If we can read the page and the badge is genuinely gone three checks running, it is withdrawn, and you can put it back whenever you like.

A launch day is the day your product appears on the board with everyone else launching that day. You need a claimed listing that has passed the bar. There are two ways to get one.

The launch page carries your pitch as the page itself worded it, your tags, your gallery, your readiness score with the per check breakdown, and links to your listing, your full report and your review if you have one. The visit link goes to your site. Votes and comments sit beside the score and never move it, which is written on the page so nobody has to wonder.

Before the day arrives, anyone reading can press Notify me on the launch. On the morning it goes live they get an email and a notification, and the count of people waiting builds where you can see it. Discussion opens on the day itself.

When you approve an article, we deliver it to every destination connected to that website. Each destination is its own delivery, so one failing never holds up the rest. Every credential you give us is encrypted before it is stored and never shown again, and every address we call is checked first, so a destination can never be pointed at a private network.

The signed webhook

Give us an https endpoint and a signing secret and we POST the article to it as JSON. This is the connector behind Framer and every hand built site.

POST https://example.com/hooks/launchscaler
Content-Type: application/json
X-LaunchScaler-Timestamp: 1789012345
X-LaunchScaler-Signature: v1=6f1c…  (lowercase hex)

{
  "event": "article.published",
  "article": {
    "id": "8f2c0b1e-…",
    "title": "How to pick a payments provider",
    "summary": "One paragraph, ready for a meta description.",
    "body_md": "## The short answer\n\n…",
    "keyword": "payments provider",
    "domain_key": "example.com",
    "published_at": "2026-09-09T08:00:00.000Z",
    "cover_url": "https://…/cover.png",
    "cover_alt": "A card reader on a counter",
    "json_ld": { "@context": "https://schema.org", "@type": "Article" }
  }
}

Every key is always present. cover_url and cover_alt are null when the article has no cover, and json_ld is null when the article's facts did not support any structured data, which means emit nothing rather than emit an empty block.

import { createHmac, timingSafeEqual } from "node:crypto";

// `raw` is the request body EXACTLY as it arrived, before any JSON parsing.
export function verify(raw, headers, secret) {
  const timestamp = headers["x-launchscaler-timestamp"];
  const signature = headers["x-launchscaler-signature"];
  if (!timestamp || !signature) return false;

  // Five minutes, so a copied delivery cannot be replayed at you later.
  const age = Math.abs(Math.floor(Date.now() / 1000) - Number(timestamp));
  if (!Number.isFinite(age) || age > 300) return false;

  const expected =
    "v1=" + createHmac("sha256", secret).update(`${timestamp}.${raw}`).digest("hex");

  const a = Buffer.from(expected);
  const b = Buffer.from(signature);
  return a.length === b.length && timingSafeEqual(a, b);
}

Answer with any 2xx and we count it delivered. Tell us where it landed and we can link to it: reply with JSON carrying url or external_url, and optionally an id or delivery_id as your own reference. An X-Delivery-Id header does the same job. We only accept an http or https address.

HTTP/1.1 200 OK
Content-Type: application/json

{ "id": "post_4192", "url": "https://example.com/blog/pick-a-payments-provider" }

The other destinations

Four of these can publish straight to your live site, and none of them does unless you switch it on for that website. The switch is per website, so a shared account can publish live for your established site and stage drafts for the new one.

There are two kinds, and only one of them can be switched off. That split is the whole answer, so it is worth thirty seconds.

Every one of those carries an unsubscribe link at the foot, and your mail app shows an Unsubscribe button of its own next to the sender. Press either. One press stops all of them at once, with nothing to confirm and nothing to sign in to, and your receipts and alerts are untouched.

The weekly digest is a separate list with its own link. Unsubscribing there removes your address from it completely, so there is nothing left of you on that list to email.