Checker › About & Methodology
About SiteCredly — and exactly how the checker scores
SiteCredly is an independent free-tools project: one checker, four guides, no accounts, no uploads. This page is the methodology in full, because a score you can't audit is just an opinion with a number on it.
What the checker reads
The checker parses one file at a time, in your browser, and reads only declared provenance:
- C2PA manifests — JUMBF boxes in JPEG (APP11), PNG (
jumbchunk) and MP4 (UUID box), including theclaim_generatorfield. - XMP packets — including
xmp:CreatorToolanddc:creator. - EXIF fields — the disclosure-relevant subset: Software, Artist, Make, Model, UserComment.
- Generator text indicators — known generator and provenance-tool names found in the file's raw bytes, reported as text traces, not structured proof.
- Ad copy — disclosure wording in the copy you paste, matched in English, Spanish and Italian against the phrase patterns the rule packs recognize.
Those signals are checked against three rule packs — EU AI Act Article 50, US Google Ads synthetic-content rules, and China's AI labeling measures (rules data v2026.10.2) — plus two base checks that apply everywhere: is there any provenance at all, and is the generator named?
The arithmetic
| Severity | Points lost | Grade bands | |
|---|---|---|---|
| CRITICAL | 30 | A | 90–100 |
| HIGH | 20 | B | 75–89 |
| MEDIUM | 10 | C | 60–74 |
| LOW | 5 | D | 40–59 |
| F | below 40 |
Every finding names the obligation it belongs to and the fix. The two canonical examples: a bare creative with no provenance and no label scores 40/D under the EU pack; a creative with an XMP-named generator and visible disclosure copy scores 90/A, losing 10 only for the missing C2PA upgrade. Both sample files ship with the checker so anyone can reproduce the numbers.
Honest limits
- The checker reads declarations; it does not detect AI generation. A file with no provenance may be a film photo from 2009.
- Pixel-level watermarks (e.g., SynthID) cannot be verified by file parsing. Every report says so.
- Platforms strip metadata. A score measures the file you hand it — which is also, not coincidentally, the file a regulator or ad platform would examine.
- A passing score is a disclosure check, not legal advice and not a compliance guarantee for any specific campaign.
Why free, and what's around it
Disclosure failures are usually production accidents, not intent — the export preset that strips metadata, the label that lived in a caption doc instead of the creative. A free checker that runs in the browser removes every excuse for not looking. SiteCredly is maintained as a standalone project; readers who want to go further into the surrounding territory — scanning, provenance, and compliance tooling — can explore more AI security and compliance tools collected in one place.
Frequently asked questions
How is the SiteCredly score calculated?
Every check starts at 100. Each finding subtracts points by severity — 30 for critical, 20 for high, 10 for medium, 5 for low — and the result maps to a grade: A from 90, B from 75, C from 60, D from 40, and F below 40.
Does the checker decide whether an image was made by AI?
No. It reads declared provenance — what the file and its copy say about themselves — and measures disclosure gaps against the rule packs. Detection of undeclared AI generation is a different, unreliable art, and this tool does not pretend to do it.