Open source SEO tools that are actually maintained

Open source SEO tools are mostly crawlers, log parsers, validators and libraries rather than the all in one suites they keep getting compared to. There is no open source Semrush, and there is a good structural reason for that. This page names what each project actually does, what it will not do, and whether anybody is still maintaining it.

Getting this wrong wastes an evening twice. Once when you install something that has not shipped a release in two years and spend the night fixing dependencies, and again when you discover the software was never the expensive part. The software is free. The index underneath it is what the vendors are actually selling, which is why an SEO audit costs money and a crawler does not.

What counts as an open source SEO tool

Open source means the source code is published under a license that lets you read it, change it and redistribute it. The test is mechanical. There is a repository you can clone, and there is a license in it that grants those rights. Free to use is a different claim entirely, and most of the tools marketed as free SEO software are hosted products with a generous tier, not software you can hold.

That is the line between this article and its sibling. Our comparison of free SEO tools and what their scores mean covers hosted products you sign into, their free tier limits, and how to triage a report that hands you forty findings. It is written for somebody who wants a result without installing anything. This one is about software you install, run and are responsible for, judged on license, maintenance and what the code does. Nothing here is graded on its free tier, because there is no tier. There is a repository and your own server.

Apply that test and the category shrinks. What survives is single purpose infrastructure. Crawlers that fetch URLs and record what came back. Runners that execute an audit engine across a site. Parsers that read your web server logs. Validators that check markup. Libraries that give you the primitives and leave the analysis to you. Each does one job properly, and none of them will tell you what to fix first.

How to tell whether a project is still alive

Three signals, read in this order. Each lies in a different direction if you read it alone.

• Last code push. The strongest single signal and the easiest to read. A repository pushed this week is being worked on by somebody
• Latest release. Tells you whether that work has reached a version you can install, which is a separate question from whether the code moves
• Issue and pull request activity. The only one of the three that shows whether a human responds to you when the thing breaks

Here is where each one misleads. A project with no release objects at all can be under daily development, so a checker that reads only the releases endpoint will score it dead. A project can push code constantly and cut releases rarely, which reads as stale and is not. The SEO Framework had code pushed on 14 September 2026 while its most recent release, 5.1.4, is dated 10 December 2025. That is nine months between shipped versions on a repository that is plainly active.

The reverse is worse and harder to spot. Greenflare, a desktop SEO crawler that still shows up on recommendation lists, no longer has a project site. Fetching greenflare.io on 16 September 2026 returns a bare Apache directory index listing a sitemap file and a folder. The domain resolves, the server answers, and there is no product behind it. That is the specific failure this article exists to avoid, because a dead repository recommended as live costs you an afternoon before you work out it was never going to install.

Star counts tell you none of this. Stars are cumulative and nobody removes theirs when a project goes quiet, so popularity records the past rather than the present.

The open source SEO tools worth running

Ordered by job rather than by popularity. Every license and date below was read from the project’s own repository on 16 September 2026.

Two projects on that list are trying to be the suite everybody asks for. Seo Panel describes itself as the world’s first SEO control panel for multiple websites, with 6.0.0 released on 26 March 2026. OpenSEO is the newer attempt and bills itself as an “Open source alternative to Semrush and Ahrefs”, with a hosted subscription its own repository prices at $10 a month. Its September 2026 release was v0.1.8. Read that version number as the statement it is, and judge it on where it gets to rather than where it ranks today.

Open source crawlers and what they will not do

An open source SEO crawler fetches URLs, follows links and records what came back. That is the whole job, and it is the part of a commercial site auditor that is genuinely commoditized. LinkChecker does recursive, multithreaded checking and writes results to text, HTML, CSV, XML or SQL. Scrapy and Crawlee are frameworks rather than tools, which means you get the fetching, the queueing, the retry logic and the concurrency, and you write the rules about what counts as a defect. Apache Nutch sits further up again, aimed at building a search index rather than auditing a site.

What none of them does is the second half of a commercial crawl. There is no severity model, no score, no ordered list of what to fix. You get a table of URLs, status codes, titles, canonicals and whatever else you told it to extract. Turning that into a decision is your work, and if you want to see what that decision layer looks like when it is done properly, our website checker comparison shows what a severity model looks like once a vendor builds one.

The second gap is JavaScript. A plain HTTP crawler sees the HTML the server sent, which on a client rendered site can be an empty shell. Crawlee ships headless browser support for exactly this, and rendering every page through a browser costs far more in time and memory than fetching it. That trade is why commercial crawlers charge for rendering, and it does not go away because the code is free.

Running Lighthouse yourself instead of pasting a URL

Lighthouse is Apache-2.0 licensed and installs with npm. Most people only ever meet it through a hosted page speed checker or the Chrome DevTools panel, which hides the fact that it is a command line tool you can point at anything, including a staging site behind basic auth that no hosted checker can reach. Its own documentation lists the categories you can run in isolation as “accessibility, best-practices, performance, seo”, so an SEO only pass is one flag.

Running it yourself buys three things a hosted checker cannot. You can audit pages that are not public. You can run the same audit a hundred times and keep the JSON, which is the only way to tell a real regression from measurement noise. And you can put it in CI, which is what Lighthouse CI does, failing a build when a score drops. Check the dates before you commit to that one. Lighthouse CI last had code pushed on 27 March 2026 and its most recent release, v0.15.1, is dated 26 June 2025, while Lighthouse itself shipped v13.4.1 on 20 July 2026. The engine is moving faster than the wrapper.

Unlighthouse solves the other problem, which is that Lighthouse audits one URL and you have a site. It scans the whole thing with sampling and puts the results in one interface. sitespeed.io takes a different route again, describing itself as “an Open Source web performance tool” and producing Core Web Vitals, a HAR waterfall, a video of the page loading and what it calls the Coach’s advice. What the scores out of 100 mean, and how Lighthouse weights the audits behind them, is covered in the free tools comparison rather than repeated here. For turning any of it into work that gets done, our guide to measuring SEO performance step by step is the sequence we use.

Log file analysis is where open source genuinely wins

This is the one category where the open source option is not a compromise, and it is the one almost nobody uses. Your web server access log is the only record of what Googlebot actually requested, how often it came back, and what status code it got. No crawler can tell you that, because a crawler records what happens when you fetch a page, not what happened when Google did.

GoAccess describes itself as “an open source, real-time web log analyzer and interactive viewer that runs in a terminal on *nix systems or directly in your browser”, and it reads Apache, Nginx, Amazon S3, Elastic Load Balancing and CloudFront formats out of the box, plus any custom format string you give it. It is MIT licensed and had code pushed on 16 September 2026. advertools covers the same ground inside Python, which matters if you want to join log data to a crawl rather than look at a dashboard.

The questions logs answer are the ones that decide whether anything else matters. Which of your URLs has Googlebot never requested. How much of its attention is going to parameter variants and paginated archives instead of the pages you sell from. Whether the 301 chain you left in place last year is still being crawled every day. Those findings change a plan, and they sit in a file most site owners have never opened. Our breakdown of what goes into an SEO report covers where this fits alongside the rest.

Validators you can wire into your own build

Markup validation is the least glamorous item here and the easiest to automate away permanently. The Nu Html Checker is the engine behind the W3C’s own validator, it is MIT licensed, and its documentation is explicit that you can “deploy your own instance of the vnu checker as a service”. It runs as a jar against files, a directory or a URL, which means it drops into a build script without any of the rate limits a public validator has to impose.

Structured data is the messier half. The Structured Data Linter is published under the Unlicense and had code pushed on 17 April 2026, but its most recent release is 3.27.2 dated 3 October 2024. That is the exact pattern worth pausing on, because the repository reads as active while the installable artifact is two years old. Schema.org’s vocabulary has moved in that time. Treat a stale validator’s silence as a lack of information rather than a pass.

Invalid HTML rarely costs you rankings on its own, and invalid structured data absolutely costs you rich results, because that is a parser with a strict contract rather than a browser being forgiving. So validate markup because it is nearly free to automate, and validate schema because it is load bearing. Both belong in the same pass as the rest of a website audit, not as a separate ritual.

Why open source rank tracking is the hardest piece

SerpBear is the clearest illustration in this whole article of what open source can and cannot give you. It is MIT licensed, it is a genuinely nice self hosted rank tracker, and it cannot see Google. Its own README says “The App uses third party website scrapers like ScrapingAnt, ScrapingRobot, SearchApi, SerpApi, HasData or Your given Proxy ips to scrape google search results”. The software is free. Every position it reports is bought from somebody or scraped through infrastructure you rent.

The README goes further than most vendors would. Its table of scraping providers lists costs starting at $50 a month for one and $40 a month for another, and marks two of the cheaper options with the note “Doesn’t work Anymore”. That is a maintainer telling the truth about a dependency he does not control, and it is the whole economic argument in one table. The part of a rank tracker that costs money is the part that talks to Google, and open sourcing the interface around it changes nothing about that.

This generalizes. Anything that needs an index of the web behaves the same way. Keyword volumes, backlink profiles, competitor traffic estimates and share of voice all rest on a crawl or a clickstream panel no volunteer project can build or maintain. You can open source the software that queries such an index. You cannot open source the index. That is why the suites have no open equivalent, and why every honest list of open source SEO tools stops at the point where external data starts. For what the numbers mean once you have them, our piece on SEO visibility covers how to read movement without over reacting to it.

Analytics is the one category with a real replacement

Web analytics is the exception that proves the rule above, because the data is yours. Nobody has to crawl the web to tell you what happened on your own site, so the software is the entire product and open source competes on level terms.

Matomo is the mature option, GPL-3.0 licensed, with 5.13.0 released on 16 August 2026 and code pushed on 16 September 2026. Its own pricing page splits the product cleanly. Matomo On-Premise is a free download you host; Matomo Cloud is the paid version where somebody else runs it. Plausible is AGPL-3.0 and Umami is MIT, both lighter and both self hostable, aimed at people who want counts and trends rather than a full analytics platform. All three had code pushed within two days of 16 September 2026.

Two cautions before you migrate. Historical data does not come with you, so run both in parallel for a quarter rather than cutting over. And self hosting analytics means you now own a database that grows with your traffic, plus the upgrades, the backups and the tracking script. That is a real ongoing cost, paid in your time instead of a subscription, which is a trade worth making deliberately rather than by default.

Libraries beat tools once you can write a loop

This is where a developer gets more out of open source than any commercial product will, and it is why this article is not a list of apps. advertools is a Python library rather than a tool. It parses robots.txt and sitemaps, crawls, reads log files and handles SERP work, and it hands you a dataframe. Version 0.18.0 went to PyPI on 17 June 2026 and the repository had code pushed on 30 June 2026. It publishes no GitHub release objects, which is a good reminder that the releases endpoint is not the only place software ships from.

The payoff is not that you can rebuild a suite. It is that the specific question you actually have is usually ten lines away and is not a feature in any product. Which of these 4,000 URLs is in the sitemap but returns a 404. Which pages changed their canonical between the crawl in March and the crawl today. Which of our template types has a title pattern that truncates. A commercial auditor answers the questions its product manager chose. A library answers yours.

The cost is honest and should be stated plainly. You are writing code, so you own the bugs, and a wrong join in a notebook produces a confident answer that is simply false. A commercial tool at least has other users hitting the same defect. If you are not going to write and check that code, the library route gives you nothing a hosted crawler would not give you faster.

Where the maintenance burden actually lands

Every item below is a cost that does not appear on an invoice and does appear in your week.

• Somewhere to run it. A server or container for anything self hosted, plus TLS, a domain and whatever keeps it from being publicly readable
• A database and its backups. Matomo, SerpBear and Seo Panel all keep state. State you have not backed up is state you will lose
• Version upgrades. Nobody applies them for you, and a security fix in a PHP application exposed to the internet is not optional
• The external bills. SERP API calls, proxies and any hosted service a tool depends on, which is the real cost of self hosted rank tracking
• The person who understands it. If the developer who set all this up leaves, everything above becomes an archaeology project

There is a second burden that is not yours but lands on you anyway, which is the maintainer’s. Most of these projects are one person or a small group working unpaid, and the funding model behind a project tells you something about how it will age. sitespeed.io and Lighthouse have organizations behind them. A single maintainer repository does not, and a life change on their end is a dependency change on yours. That is not an argument against using it, it is an argument for knowing which of your tools has one point of failure.

Notice who curates the lists, too. The most visible catalog of SEO tools on GitHub is published by SerpApi, which sells a SERP API. That does not make the list wrong. It does mean the person assembling the map also sells one of the roads.

What we would run, and when hiring anyone is worth it

If you are a developer looking after your own site, here is the honest stack and the honest conclusion. Run Lighthouse from the CLI against a sample of templates and keep the JSON. Crawl with Scrapy, Crawlee or advertools and write the checks you care about. Point GoAccess at your access logs, which is the highest value hour on this list. Put the Nu Html Checker in CI. Self host Matomo if you want analytics you own. That covers technical SEO end to end, and it costs you server time and a few evenings.

We are an agency, so state the obvious before it gets stated at us. Most of what a technical SEO retainer delivers in its first month is work that stack does, and a competent developer with the tools above does not need us to find a redirect chain or a missing canonical. Anyone telling you otherwise is selling you the crawl, which is the cheapest part of the job. We publish our retainer prices and our technical SEO audit scope for the same reason, so you can see what you would be paying for and decide it is not worth it.

Three things do not come out of a repository. Knowing which of forty findings changes revenue, which is judgment against your business rather than against a rule list. Competitor and keyword data, which needs an index nobody can open source. And the hours, because the reason technical debt sits on most sites is not that the owner could not find it. If none of those three is your bottleneck, you genuinely do not need an agency, and this article has done its job. If one of them is, that is the conversation worth having.

Start with the logs. Pull 30 days of access logs, run GoAccess over them, and see what Googlebot has actually been doing on your site. If what you find raises a question the tools cannot settle, a free website audit is where we will read it with you.