Cabana Engine docs
Connect your website, prove it is yours, and Engine reads every page, scores it, writes the fixes and puts the approved ones live, in Africa and worldwide.
Quick start
- Sign in to the console with your work email and add your website.
- Verify it. Engine starts reading it straight away.
- Review the score, the issues and the suggested fixes. Approve the ones you like, or switch on automatic approval for safe fixes.
- Install the snippet (one line) or use server-side fixes, so approved fixes go live.
- Connect Search Console to see the searches you appear for and your positions.
Verify your website
Engine only works on sites you have proven are yours. Use any one of these with the token in your console:
| Method | What to add |
|---|---|
| File (recommended) | https://yourdomain.com/<token>.txt containing the token. It also turns on instant indexing. |
| DNS record | A TXT record on your domain (or _cabana.yourdomain.com): cabana-site-verification=<token> |
| Meta tag | <meta name="cabana-site-verification" content="<token>"> on your home page |
Every day we check the record is still there and that the site is still the one you registered. If the record goes missing you have seven days to restore it.
How we read your site
Engine reads your pages as CabanaBot: Mozilla/5.0 (compatible; CabanaBot/1.0; +https://cabana.africa/engine/bot). It follows your robots.txt (rules for CabanaBot, then *), reads your sitemaps, and never fills in forms or signs in. See CabanaBot for details.
The snippet
One line before </head> on every page. The key is publishable and only works on your verified site.
<script async src="https://cabana.africa/engine/e.js" data-key="eng_pk_live_…"></script>It applies the fixes you approved for each page (title, description, canonical, preview cards, structured data, image alt text, language, viewport), then sends one anonymous page view: where the visitor came from, how fast the page was for them, and whether the page content changed. No cookies, no visitor ID and no IP address are kept. Do Not Track and Global Privacy Control switch the report off.
Google runs JavaScript and sees fixes the snippet applies. Some other crawlers and link previews (WhatsApp, for example) do not, so for those use server-side fixes too.
Where to paste it
- WordPress: a header and footer code plugin → Header.
- Shopify: Online Store → Themes → Edit code →
theme.liquid, before</head>. - Wix: Settings → Custom code → Head, all pages.
- Squarespace: Settings → Advanced → Code injection → Header.
- Webflow: Project settings → Custom code → Head code.
Server-side fixes
For sites that render on the server (Next.js, Nuxt, Laravel, Django, Rails…), fetch the ready-made tags for a page and print them in its <head>. Cache them for a few minutes.
curl "https://cabana.africa/api/engine/v1/fixes?url=https://yourdomain.com/safaris" \
-H "Authorization: Bearer eng_sk_live_…"
# → { "url": "…", "fixes": [ { "kind": "title", "value": { "text": "…" } }, … ], "head_html": "<title>…" }Approving fixes
Engine writes each fix from your own page: rewritten titles and descriptions never add a price, number or claim that is not already on the page. You choose: approve each one, or let Engine approve the safe kinds automatically (canonical, viewport, preview cards and structured data built from your content). A fix goes live within minutes of approval; undo it at any time.
Instant indexing
When a page changes or a fix goes live, Engine tells Bing, Yandex, Naver, Seznam and other IndexNow search engines at once, using your verification file as the key. Google finds changes through your sitemap and, if connected, Search Console.
Google Search Console
In the console, open your site → Rankings. Copy the service account address shown there and, in Search Console → Settings → Users and permissions, add it as a Restricted user. Engine then reads your searches, clicks, impressions and positions every day. It cannot change anything in Search Console, and you can remove it at any time.
Competitors
Engine finds the sites that actually rank for your keywords in your country and reads their pages the same way it reads yours, so you see their score next to yours, check by check. You can also name competitors yourself. Engine only reads their public pages, as CabanaBot, following their robots.txt.
Speed and traffic
With the snippet installed, each visit reports Core Web Vitals (LCP, CLS, INP), device type and where it came from: search engines, AI assistants, social, email or direct. Without it, Engine uses Google’s public Chrome UX Report when your site has enough traffic.
The Engine Score
Each page is checked against 49 checks in eight areas (technical, on-page, content, structured data, speed, social previews, AI search, and local & Africa) and scored from 0 to 100; the site score weights the pages that matter most. Bands: Excellent 90+, Strong 75–89, Fair 55–74, Weak 35–54, Critical below 35.
Authentication
Base URL https://cabana.africa/api/engine/v1. Send a secret key in Authorization: Bearer eng_sk_… (or X-Api-Key) from your server only.
Endpoints
Your websites with their score, band and last read.
One site: score, scores by area and a summary of the top issues.
Every page read, worst first, with its score and issues.
Read the site again now. Counts towards your plan’s reads.
Approved fixes and ready-made head tags for one page. See server-side fixes.
A free, quick check of any public page (no key, limited per minute). The same check as the box on our home page.
Webhooks
| Event | When |
|---|---|
engine.crawl.completed | A read of your site finished: new score, previous score, pages and top issues |
property.verified | A website was verified |
property.updated | Its standing changed in the daily look |
ping | A test from the console |
Each POST carries Cabana-Signature: t=<unix seconds>,v1=<hex>: an HMAC-SHA256 of t + "." + raw body under the endpoint’s signing secret. Reject anything older than five minutes. Failed deliveries are retried after 1, 5 and 30 minutes, then 2, 6 and 24 hours.
import { createHmac, timingSafeEqual } from 'node:crypto';
export function verified(rawBody, header, secret) {
const p = Object.fromEntries(String(header).split(',').map(x => x.split('=')));
if (!p.t || Math.abs(Date.now() / 1000 - Number(p.t)) > 300) return false;
const want = createHmac('sha256', secret).update(`${p.t}.${rawBody}`).digest('hex');
return want.length === String(p.v1).length && timingSafeEqual(Buffer.from(want), Buffer.from(p.v1));
}Errors and limits
Errors are JSON: { "error": "…", "code": "…" } with 400 (bad request), 401 (invalid_key), 402 (trial_ended), 403 (wrong_key_kind, origin_not_verified), 404, 429 (quota_exceeded). The free trial covers one site, 100 pages per read, 30 reads, 3 competitors and 1,000 API calls a month.
Privacy
Cabana Engine is operated by Cabana, Nairobi, Kenya. Contact engine@cabana.africa.
- Your website: we read your public pages, robots.txt and sitemaps, and keep what we need to score them and track changes.
- Your visitors: the snippet sends the page address, the referring site, speed measurements, device type and a fingerprint of the page text. No cookies, no visitor ID, no IP address kept, and nothing at all under Do Not Track or Global Privacy Control.
- Search Console: only if you add our service account; we read search performance for your site and nothing else.
- Service providers: hosting and database (Vercel, Supabase), email (Resend), AI writing (Groq, Cloudflare Workers AI, which receive your page text only), and search result data providers for competitor discovery.
- Your account: your team’s email addresses and activity, kept while your account is open.
- Your rights: to see, correct or delete your data. Write to us.
Terms of service
Please read these terms carefully. They explain what you can expect from us and what we expect from you.
1. About these terms
These terms are the agreement between you (the business or organisation that opens a workspace, “you”) and Cabana, operating Cabana Engine from Nairobi, Kenya (“we”, “us”). They apply to the Cabana Engine website, console, scripts, widgets, links, APIs, webhooks, sandbox and any email or support we provide for it (together, the “Service”). By creating a workspace, adding a website or app, creating an API key, or otherwise using the Service, you accept these terms. If you accept them for an organisation, you confirm you have the authority to bind it. If you do not agree, do not use the Service.
Cabana Engine is a separate service. It has its own terms, and nothing here gives you rights in other Cabana services.
2. Who may use it
You must be at least 18, be able to enter a contract, and use the Service for business, professional or organisational purposes, not as a consumer. You must give us true and current information when you sign up and keep it up to date. One person may manage several workspaces; each is a separate account.
3. Your workspace and your team
You are responsible for everything done through your workspace, your sign-in codes and your API keys, including by people you invite. Keep secret keys on your servers only, never in a web page, app or public repository. Tell us at once if you think a key or an email account has been compromised so we can help you revoke it. We may assume anyone using your keys or signed in as you is acting for you.
4. Proving you own your website or app
Nothing runs on a website or app until you prove it is yours, by a DNS record, a meta tag or a file for a website, or a declaration on your developer website plus your store listing for an app. You promise that you own or are authorised to manage every website and app you add, and that you will keep the proof in place. We re-check every day. If the proof disappears you have seven days to restore it before the property stops being verified. If a site stops matching what you registered, we may pause the Service on it, tell you why, and restore it once a person at Cabana Engine is satisfied. This protects the people who use your site and everyone else who uses the Service. You agree to this monitoring.
5. Acceptable use
You must not, and must not let anyone else:
- break any law, or use the Service for or on a website or app that is unlawful, deceptive, fraudulent or harmful (including gambling or adult content you are not licensed for, phishing, counterfeit or fake documents, investment fraud, drugs or weapons trade, or content that exploits children);
- run the Service against a website or app you do not own or manage, or pretend to be another business or person;
- probe, scan, overload or try to get around the security or the limits of the Service, or attempt to reach another customer’s data;
- copy, resell, white-label or build a competing service from the Service, or use its output to train a competing model, without our written agreement;
- share your keys, or use more than one free trial by opening several workspaces;
- use the Service in a way that breaches the rights of anyone else.
We may suspend or limit anything that breaks this section, immediately if there is a risk to people or to the Service.
6. What Cabana Engine does
Cabana Engine reads your website’s public pages, scores them against a set of search-engine checks, suggests fixes, applies the ones you approve (or the safe kinds you switch on for automatic approval), and reports how your pages are found. It also compares your site with competitors’ public pages and, if you connect it, reads your Google Search Console data. It does not promise any ranking, traffic or sales.
7. Crawling and CabanaBot
You authorise CabanaBot to read the pages of websites you verify, at the pace and frequency of your plan, following your robots.txt. Engine also reads a limited number of public pages of other sites that rank for your keywords, as CabanaBot, following their robots.txt, to compare them with yours. You will not ask us to read a site you are not entitled to compare, or use the comparison for anything unlawful. You can keep CabanaBot out of any site by robots.txt.
8. Fixes and the snippet
You decide which fixes go live. A fix is written from your own page and is not allowed to add a number or claim the page does not contain, but you must still check that anything published on your website is accurate and lawful, including prices, claims and structured data. Approved fixes are applied by the one-line snippet on your pages, or by the ready-made tags you place on your server. You can undo or remove any fix and can remove the snippet at any time. You are responsible for your website’s content and for how fixes interact with your own code and theme.
9. Search engines are not ours
Search engines (including Google, Bing and the AI assistants that cite websites) decide rankings with their own rules that change without notice. Engine improves what you can change; it cannot control them. Scores, rankings, competitor lists and estimates are provided to help you and may be incomplete or out of date. Your use of Google Search Console, IndexNow and third-party data is also subject to those services’ own terms.
10. Google Search Console
If you add our service account to your Search Console property, you allow us to read search performance data for that property, and nothing else. You can remove it at any time. We do not change anything in your Search Console.
11. Visitors to your website
If you install the snippet, it sends anonymous page-view information (page address, referrer, speed measurements, device type and a fingerprint of the page text), with no cookies, visitor identifier or IP address kept, and it does nothing at all when the visitor’s browser sends Do Not Track or Global Privacy Control. You are responsible for your own privacy notices to your visitors, and should mention the snippet in them.
12. Data protection
We read public pages and your account details, and, through the snippet and Search Console, aggregate visitor information about your site. For any personal data in them we act on your instructions and on these terms, and we handle it as set out in the privacy notice, which forms part of these terms. Each of us will comply with the data protection laws that apply to us, including the Kenya Data Protection Act, 2019, and, where they apply, the GDPR and similar laws.
13. Trial, plans and prices
Cabana Engine is free during the trial programme, with the limits shown in your console, for the period shown there. Paid plans and their prices are coming soon. We will announce them well before any charge, you will not be charged anything unless you choose a paid plan and agree to its price, and we will give you reasonable notice before the free trial or any free feature ends or changes. Limits may be adjusted to prevent abuse.
14. Our service, and changes to it
We work hard to keep the Service available and correct, but we do not promise it will be uninterrupted or error-free. We may change, improve or remove features, run maintenance, and set or change usage limits. If we make a change that materially harms you, we will give notice where we reasonably can. The sandbox and test keys are for building and are not for production use.
15. Intellectual property
We own the Service and everything in it, including its software, models, scores, designs, documentation and brand. You get a limited, non-exclusive, non-transferable, revocable right to use the Service during these terms, for your own business, in line with them. You keep everything that is yours: your websites, content, data and brand. You give us the rights we need to read, process and store them to run the Service for you, and, where these terms or the privacy notice say so, to improve our fraud and quality systems. Feedback you give may be used by us without obligation.
16. Confidentiality
Each of us will keep the other’s non-public information confidential, use it only for the Service, and protect it with reasonable care, except where we must disclose it by law or to our advisers and service providers who are bound to confidentiality. Information that is public, or that we learn lawfully from someone else, is not confidential.
17. Disclaimer
The Service is provided “as it is” and “as available”. To the fullest extent the law allows, we give no warranties of any kind, express or implied, including merchantability, fitness for a particular purpose, accuracy, non-infringement, or that results will be achieved. Outputs of automated systems, including AI, can be wrong; you are responsible for how you use them and for your own decisions. Nothing in these terms limits anything that cannot lawfully be limited.
18. Limits on our liability
To the fullest extent the law allows, we are not liable for indirect, incidental, special, consequential or punitive loss, loss of profit, revenue, goodwill or data, or business interruption, even if told it might happen. Our total liability to you for all claims arising from the Service in any 12 months is limited to the amount you paid us for the Service in the 12 months before the first claim, or, if you have paid nothing, to KES 10,000. These limits do not apply to liability that cannot be limited by law, including for fraud or for death or personal injury caused by negligence.
19. Your responsibility to us
You will compensate us for losses, claims, fines and reasonable costs that come from your breach of these terms, your breach of law, your content, or your use of the Service in a way we did not allow, including claims by people whose data you handled through the Service. We will tell you promptly of a claim, let you help defend it, and not settle it in a way that binds you without your agreement, which you will not unreasonably withhold.
20. Suspension and ending
You may stop using the Service at any time and ask us to close your workspace. We may suspend or end the Service for you if you break these terms, if the law requires, if keeping you would put people or the Service at risk, or if we stop offering the Service, and we will tell you why where we can. When a workspace ends, your keys stop working. We delete or anonymise its data as set out in the privacy notice, keeping only what we must by law or need to protect people from fraud. Clauses that by their nature should survive (including ownership, confidentiality, disclaimers, liability, compensation and governing law) do.
21. Notices and support
We will contact you at the email of your workspace owner, and by notices in your console. You can write to us at engine@cabana.africa. Please keep the owner email current: notices sent to it count as received.
22. Changes to these terms
We may update these terms. We will give notice of material changes in your console or by email before they apply, and the date at the bottom will change. If you keep using the Service after the change applies, you accept the new terms. If you do not agree, you may stop and close your workspace.
23. Law and disputes
These terms and any dispute about them are governed by the laws of Kenya. We will try to settle any dispute in good faith first. If we cannot, the courts of Kenya have exclusive jurisdiction, except that either of us may ask any court for urgent protection of its intellectual property or confidential information. If a part of these terms is found unenforceable, the rest still applies. Our failure to enforce a right is not a waiver of it. You may not transfer these terms without our written consent; we may transfer them as part of a merger or sale of the business. These terms, with the privacy notice, are the whole agreement for the Service.
Last updated 15 October 2026.