# WatchTower can now audit sites that only exist on your machine
Until now, WatchTower could only audit sites its server could reach. A site running on `localhost`, behind a VPN, or using a development address such as `https://project.ddev.site` was invisible to it, and Google's PageSpeed service couldn't reach it either. That created an awkward gap: the moment a project is easiest to fix—while still in development—was precisely when WatchTower couldn't inspect it.
This release closes that gap. Here is what changed, how it works, and what comes next.
## What's new
### 1. Audit local and private sites
WatchTower now recognizes local and private addresses (`localhost`, `*.test`, `*.local`, `*.ddev.site`, private IP ranges) and handles them correctly:
- Sites can be registered with a local address, including a port.
- PageSpeed checks are skipped for local addresses rather than failing, so the audit finishes cleanly.
- Checks that make no sense on a development site, such as a missing HSTS header on plain HTTP, are no longer reported as findings.
### 2. Run WatchTower on your own machine and sync
Developers can run their own copy of WatchTower, audit local projects there, and push the results to the shared WatchTower the team uses.
The rule that keeps this simple is that every piece of data has exactly one owner:
| Data | Owned by | Direction |
| ---------------------------------------- | ------------------------------ | -------------------------- |
| Audits, crawl results, finding details | The machine that ran the audit | Local to shared |
| Triage (status, resolved, linked issues) | The shared WatchTower | Shared to local, read-only |
| Clients, sites, URLs | The shared WatchTower | Shared to local |
Because nothing is edited in two places, there's nothing to merge and no conflicts. Pushing is safe to repeat: sending the same audit twice never creates a duplicate. Each developer machine receives its own revocable token, limited to the clients its owner may access.
### 3. A browser extension for Chrome and Firefox
Not everyone wants to install and run the whole application. The new **WatchTower Crawler Agent** extension crawls a site from your browser, which can already reach your development sites, and sends the raw results to WatchTower. WatchTower then runs its usual analysis and creates the audit.
Key points:
- **One set of rules.** The extension only fetches pages. The findings come from the same analysis the server uses, so a page produces the same findings regardless of how it was fetched.
- **Only registered URLs.** It crawls the URLs already marked for audit in WatchTower. It does not follow links.
- **Anonymous by design.** Pages are fetched without your cookies or logins, and only an allow-list of response headers is sent. The device token goes only to your WatchTower.
- **You stay in control.** The browser asks for permission for each site's address before anything is fetched.
- **Robust.** Crawls can be canceled, resume if the browser suspends the extension, and can be re-sent without creating a duplicate audit.
## How well is it tested?
We tested the extension in real browsers, not only in unit tests:
- **Chrome:** a full crawl of a local site (including a redirect and a missing page) that ended with a created audit; verification that a revoked token is rejected; and a forced interruption mid-crawl that resumed correctly.
- **Firefox Developer Edition:** the same crawl, plus a run where Firefox repeatedly suspended the extension and the crawl still finished with every page fetched once.
These tests also found and fixed real problems before release: a race that could crawl twice after the extension woke up, a storage race that could lose a saved pairing, and a case where a permission refusal wrongly wiped the pairing.
## What is still open
We prefer to be direct about what has not been verified:
- The browser's **permission prompt** has not yet been clicked in either browser. Automated tests cannot click it, so it needs a manual check.
- **Firefox release** builds and **Edge** have not been tested. Release Firefox only accepts signed add-ons.
- The extension is currently installed as an unpacked developer build. It is not on any store yet.
## Roadmap
The order below reflects priority, not dates.
### Now
- Manual testing of the permission prompt in Chrome and Firefox.
- A safer deployment: today's deploy copies files but does not run database migrations. We are adding a migration and cache-clear step so a release cannot go live with code that expects a newer database.
- Review and merge the current work.
### Next
- **Signed distribution.** A signed Firefox build for permanent installation, and a managed Chrome or Edge distribution channel for the team.
- **Performance data for public addresses** submitted by the extension. PageSpeed cannot reach local sites, but it can reach public ones.
- **A ready-made ddev setup** for running WatchTower itself.
### Later
- **Audit pages behind a login**, using an explicit, opt-in approach rather than the browser's own cookies.
- **Link discovery**, so a crawl can go beyond the registered URLs.
- **Scheduled crawls**, so audits run without someone pressing a button.
- **Local performance measurement** (Lighthouse) for sites that PageSpeed cannot reach.
- **Smaller sync gaps:** propagating deletions of sites and URLs, and creating a new site from a local machine instead of on the shared instance first.
## Why this matters
Fixing an SEO or technical problem in development costs a fraction of fixing it after launch. Making local sites auditable, and giving every developer a path that fits how they already work (a full local copy, or just a browser extension), moves WatchTower earlier in the life of a project without giving up the single shared record the team relies on.
Documentation for both features is in the repository: `docs/local-first-sync.md` and `docs/browser-crawler-agent.md`.