Starting with what the server actually returns is the step most audits skip. I've seen a site score 95 while the CDN served a stale noindex header to bots for weeks. Checking raw headers with curl before trusting any dashboard score saves a lot of guessing.