Technical SEO
Timbaly generates and serves sitemap.xml, robots.txt, llms.txt and an IndexNow key on your own domain, puts canonical, hreflang, Open Graph and JSON-LD on every page, pushes new and edited pages to the engines that accept a push, and connects Google Search Console and Bing Webmaster Tools in your name.
None of it is a checklist you work through. It is applied by code at publication time, which is the only way it survives month six.
The four moving parts
They are separate because they answer different questions and are trusted differently. Knowing which is which is what stops you from believing a number that does not exist.
| System | What it does | Credential needed | Gives you numbers? |
|---|---|---|---|
| IndexNow | Tells Bing, Yandex, Naver, Seznam and Yep a page is new or changed | None — a text file on your domain | No, it is a push |
| PageSpeed | Measures speed the way Google measures it, on mobile | Platform API key | Yes, lab data |
| Search Console | Real queries, indexing state, the canonical Google chose | OAuth with your Google account | Yes |
| Bing Webmaster | The same four figures across the Bing index | Your Bing API key | Yes |
On this page
Yours. When you connect Google Search Console, the property is created inside your own Google account, in your name. If you leave Timbaly it stays yours, with its sixteen months of history intact. The platform only keeps permission to read it, and you can revoke that from your Google account whenever you want.
That was not the convenient choice. It was the only one compatible with agencies: an agency cannot be the registered holder of its clients' search properties, and a platform that made itself the holder would be selling a hostage. The architecture followed from that constraint.
What Timbaly does do for you is the part where almost everyone gives up: the verification tag. It goes into the head of the site the platform itself serves, so there is nothing for you to paste anywhere. Verification is also retryable rather than one-shot, because Google and Bing fetch your homepage from their own address and a DNS record that has not propagated yet will fail and then succeed ten minutes later.
Multiple verification tags coexist deliberately. An agency and its client can each hold one, and replacing the first with the second would silently disconnect somebody else's console.
Four files, served per site on your own domain:
sitemap.xml — every published page, per language, with the alternates linked.robots.txt — the classic crawlers plus every AI crawler named explicitly: GPTBot, OAI-SearchBot, ClaudeBot, PerplexityBot, Google-Extended and the others. Silence is ambiguous; a named rule is a decision you made.llms.txt — a plain-text index of what the site is and which pages matter. A proposed convention, not a ratified standard: the honest guide is here.301 redirects are managed from the panel, which matters more than it sounds: when the audit proposes merging two pages that compete for the same query, the redirect is part of the same action rather than a separate thing to remember.
Canonical URL, hreflang for the linked translations, Open Graph tags, and JSON-LD structured data matching the visible text. Plus the deterministic hygiene that does not depend on a model behaving: fixed widths over 375px rewritten, iframes given an aspect ratio instead of hard dimensions, three-column grids given a mobile base, tables put inside a scrolling container, and a privacy consent checkbox inserted before any submit button that lacks one.
That last one is the clearest example of the principle. The instructions already ask for a consent checkbox and it is produced almost every time — but on a platform that publishes by itself, “almost every time” means some sites go live unlawfully. So it is enforced by code that does not reason.
Speed gets the same treatment from the other direction: the fonts your site uses are downloaded and served from your own domain rather than linked from Google, because a stylesheet in the head sends every visitor's IP address to Google before the cookie banner has had a chance to ask anything — and no consent script can arrive in time to stop it.
Google cannot be asked to index a page. Its Indexing API only covers job postings and broadcast events, and sitemap pinging was retired in 2023. Sitemaps and internal links are the whole mechanism. The screen says so, because otherwise the absence gets discovered as though it were a defect in the product.
Per-query totals never add up to the overall total. Search engines anonymise rare queries and simply do not return them. Timbaly labels those figures as partial — it is a number you can check in your own console, and not saying it would make us look like liars.
There is no field speed data on small sites. Google's real-user dataset needs traffic a local trade does not have. Timbaly measures in the lab and says it is lab data, rather than displaying zeros that read like a perfect score.
A site served with noindex is not submitted at all — which is every site on the free plan, since those live on a shared subdomain. €19 a month is what makes a site indexable.
Nothing here is a ranking guarantee. It is groundwork: necessary, insufficient on its own, and the part that reliably does not get done otherwise.
Common questions
You do. It is created inside your own Google account, in your name, and stays yours with its sixteen months of history even if you leave. Timbaly holds read permission only, revocable from your Google account at any time.
No, and neither can anything else. Google's Indexing API covers only job postings and broadcast events, and sitemap pinging was retired in 2023. On Bing, Yandex, Naver, Seznam and Yep the instant push does work, through IndexNow, with no credentials needed.
Because Google's field dataset needs a traffic volume most small sites never reach, so there is genuinely nothing to report. Timbaly measures in the lab with PageSpeed on mobile and labels it as lab data.
For the Bing Webmaster numbers, yes — the key is yours, like the Google connection. IndexNow reaches Bing regardless, on every site, without any key: two routes to the same effect, and only one of them needs credentials.
Import it. Timbaly reads the pages, keeps the content and takes over the technical layer. Head tags come across as they are and then get localised, so an existing Google Fonts link stops leaking visitor IPs. The import path is described here.
Start on the free plan to see what gets generated. The files, the structured data and the connections are the same on every plan — indexability is what €19 a month buys.