The Free SEO Stack for a New Dev Tool Site: GSC + Bing WMT + Ahrefs Webmaster Tools

April 11, 2026 · Leon Ting · 8 min read · Why $99/mo SEO tools are a waste at 10 days old

Taprun.dev is ten days old. Thirteen blog posts, one Chrome extension, a Deno CLI, and a growing list of Claude Code users who've started depending on it. One question has been in the back of my head the whole time: how do I know if any of this is working?

My first instinct was the obvious one: sign up for Ahrefs or SEMrush. Both come up in every SEO tutorial. Both start around $99/month. Both promise the one metric everyone talks about — Domain Rating, or Domain Authority, depending on which tool. I got as far as entering my credit card on Ahrefs's paid signup page before I stopped and asked a dumber question: what would I actually do with that data at ten days old?

The honest answer: almost nothing. And there's a free stack that covers everything that does matter at this stage.

Why paid tools are a waste on a new site

Domain Rating and Domain Authority are logarithmic scales. They move slowly by design. For a new domain, the progression roughly looks like this:

• Month 1: DR 0-1. Any fluctuation is noise.
• Month 3: DR 3-5, if you've been publishing consistently and gotten a handful of referring domains.
• Month 6: DR 8-12, if the content is actually good and people are linking.
• Month 12: DR 15-20 for a healthy niche dev tool site.

Paying $99/month to watch a number go from 0 to 1 to 2 is a bad trade. The data that would justify the subscription — competitor keyword research, batch content gap analysis, 10,000-row backlink audits — none of that is relevant when you have 13 posts and no rankings yet. At this stage, the job is to publish consistently and measure whether Google and Bing are picking up what you publish. That's all you need, and all of that is free.

The free stack

Four tools, each giving you a piece of data that isn't duplicated by the others:

The part that surprises most developers is Ahrefs Webmaster Tools. Ahrefs gives you the same Domain Rating number that paying customers see — but for free, as long as you verify you own the domain. They do this because it's a lead funnel: you see the data, you want more, you upgrade. For a new site where you're the only domain you care about, the lead funnel is the exact use case you need, and zero dollars is the exact price.

Google Search Console

If you don't already have GSC set up, stop reading and go set it up right now. It's the most accurate source for how Google specifically is seeing your site. Impressions and clicks come from Google's own logs, not a third-party crawl. Indexing status is authoritative. Every SEO decision you make should be cross-checked against GSC before you believe any other tool.

Bing Webmaster Tools

Bing is usually an afterthought, but it covers Bing, Yahoo, and DuckDuckGo — collectively around 10% of English-language search in 2026, and higher in some verticals. More importantly, Bing crawls and indexes fast. For a new site, Bing often picks up and ranks content within 24 hours, while Google can take a week or two. Seeing your content actually surface on a real SERP, even on Bing, is a morale boost that matters.

Ahrefs Webmaster Tools

The crown jewel. Free tier gives you: real DR, referring domains (who links to you), organic keywords you rank for, top pages, and a site audit running on a schedule you pick. The data refreshes within 48 hours of verification. You'll need to verify ownership, which you can do via Google Search Console OAuth (one-click if you're already in GSC), a DNS TXT record, an HTML meta tag, or by installing Ahrefs's analytics JavaScript snippet.

IndexNow

IndexNow is an open protocol backed by Microsoft, Yandex, and several smaller engines. You submit URLs via a single HTTP POST, and they crawl those URLs within minutes instead of waiting to discover them through sitemap diffing. It's the fastest way to tell Bing about new content. For a new site, every published post should be pushed through IndexNow within an hour of going live.

Setup walkthrough

I did all four on taprun.dev in a single Claude Code session, using Tap as the automation layer. The value of running it through an agent instead of by hand isn't about saving time on a one-off setup — it's about the automation being repeatable. Next month when I add a second domain, the same agent runs the same flow in the same order, and I don't have to remember what I did.

Bing WMT verification: XML file through Git

Bing offers several verification methods. For a GitHub Pages site, the simplest is their XML file: download BingSiteAuth.xml, drop it in your repo's docs/ directory, push, and click Verify. The whole round-trip is:

# 1. Add your site in Bing WMT, choose XML file verification, download BingSiteAuth.xml
# 2. Commit it to the Pages repo
git add docs/BingSiteAuth.xml
git commit -m "chore: add Bing Webmaster Tools verification file"
git push origin main
# 3. Wait ~30s for GitHub Pages to deploy
curl https://taprun.dev/BingSiteAuth.xml
<?xml version="1.0"?>
<users><user>...</user></users>
# 4. Click Verify in Bing WMT UI — done

Total time: under five minutes. From that moment on, Bing starts crawling and you start seeing the dashboard populate within a day.

Ahrefs WMT: the 19-file problem

Ahrefs offered me four verification methods: GSC OAuth, DNS TXT, HTML meta tag, or installing their Web Analytics snippet. I tried GSC first and hit a wall: the OAuth popup button in Ahrefs is triggered by a programmatic click from the Claude Code agent, and Chrome's popup blocker rejects programmatic window.open() calls that lack a real user gesture. This is a hard browser security rule, not a Tap limitation — Playwright and Puppeteer hit the same wall. OAuth flows fundamentally require a human click.

I switched to the analytics snippet method. Ahrefs provides a one-line <script> tag and says "paste this into the <head> section of your site". The catch: taprun.dev has nineteen hand-written HTML files. Every page needs the snippet. I ran this through Claude Code:

cd docs
SNIPPET='<script src="https://analytics.ahrefs.com/analytics.js" data-key="..." async></script>'
for f in *.html blog/*.html ns/*.html; do
  perl -i -pe "s|</head>|$SNIPPET\n</head>|" "$f"
done
git add docs/ && git commit -m "install ahrefs analytics" && git push

Nineteen files, one commit, one push. Ahrefs's crawler detected the snippet on the next check and flipped ownership to verified.

The deeper fix is a Jekyll _includes directory so I'm never editing nineteen files again. That's on my list for tomorrow.

The CDN cache gotcha

After I pushed, Ahrefs's Recheck button kept failing. I dug in. Here's what I found:

curl -sI https://taprun.dev/ | grep -iE "age|last-modified|cache-control"
age: 3474
last-modified: Sat, 11 Apr 2026 04:22:23 GMT
cache-control: max-age=3600

The page was 58 minutes old in Cloudflare's edge cache, and the last-modified timestamp was from before my push. GitHub Pages deployed my change within seconds, but Cloudflare was serving a stale version with a one-hour TTL. Cache-busted requests (?cb=123) returned the new HTML, proving the origin was fine.

Two fixes: wait an hour for the TTL to expire, or purge Cloudflare's cache. I purged via the Cloudflare dashboard, and within thirty seconds Ahrefs's crawler saw the new content.

Lesson: if you're on GitHub Pages behind Cloudflare and any tool is failing to see fresh content, suspect the CDN cache first, not the deploy. The fastest diagnostic is curl with a cache-buster query string — if the cache-busted response has the new content and the normal response doesn't, it's a cache issue, not a build issue.

IndexNow: push all URLs in one shot

IndexNow requires a key file at your domain root — you pick a key like mysite-key-123, write it to /mysite-key-123.txt, and any POST to IndexNow's API validates against that file. Once the key is in place, submission is one HTTP request per batch of URLs:

curl -X POST https://api.indexnow.org/indexnow \
  -H "Content-Type: application/json" \
  -d '{
    "host": "taprun.dev",
    "key": "<your-key>",
    "urlList": [
      "https://taprun.dev/",
      "https://taprun.dev/blog/",
      "https://taprun.dev/blog/latest-post.html"
    ]
  }'
HTTP/2 202 Accepted

202 Accepted means Bing, Yandex, and any other participating engine now has a queued job to fetch each of those URLs. I pushed fifteen URLs — the homepage, the blog index, the changelog, and all thirteen blog posts — in a single batch. Everything came back accepted in about two seconds.

What to actually measure at ten days old

Now that the stack is set up, here's what I'll be watching — in order of how actionable the signal is:

1. Indexed pages (GSC → Pages). This is the first thing to care about. If Google hasn't indexed a post, nothing else matters. Unindexed pages should be diagnosed same-day — usually a robots.txt issue, a noindex tag, or a canonical URL mismatch.
2. Impressions (GSC → Performance). Impressions mean Google is showing your page in search results, even if no one clicks. Zero impressions for a published post = the content isn't matching any query. That's a content problem, not an SEO problem.
3. Referring domains (Ahrefs WMT). Every new backlink is a compounding asset. A new referring domain this week matters more than any DR number. Track the count weekly.
4. Publishing cadence. The metric that's free to track and the most predictive of everything else. Google rewards consistency. A site that publishes one post per day for three months compounds enormously. A site that publishes in bursts and then goes quiet gets deranked.
5. DR (Ahrefs WMT, after 48h). Useful as a long-term thermometer. Don't check it more than once a week. Don't panic when it drops — it's a running average and can dip for structural reasons.

Notice what's not on that list: competitor keyword tracking, SERP position monitoring, content gap analysis, batch link building. Those are the features you pay for, and they're premature at this stage. Do them at DR 15+, not DR 0.

The pattern worth stealing

The one piece of this I'd recommend stealing even if you don't care about dev tool SEO: write your setup as a repeatable agent workflow, not a manual checklist. I did this whole flow through Claude Code and Tap. Every step I took is now a program I can replay for the next domain, the next blog, the next client. The fifteen-minute cost of running it through an agent the first time is cheaper than the ten-minute cost of running it by hand every single time I onboard a new site.

That's what Tap is for. Interface operations — verification flows, OAuth dances, sitemap submissions, cache purges — all the stuff that lives in dashboards and has no real API, compiled into deterministic programs. Once a flow works, it works forever, zero AI cost per run.

curl -fsSL https://taprun.dev/install.sh | sh