A complete website audit, with the evidence

Title is 46 characters (~373px): "How to audit a public web page | Example guide".

titleLength · observed · weight 2.2

{
  "title": "How to audit a public web page | Example guide",
  "length": 46,
  "pixelWidth": 373
}

Estimated SERP width ~373px (Google truncates around 580px).

titlePixels · observed · weight 0.8

Primary term "page" appears at position 26 in the title.

titleKeywordFront · heuristic · weight 1.2

Title uses a separator, suggesting a brand suffix.

titleBrand · observed · weight 0.5

Meta description is 134 characters.

metaDescLength · observed · weight 1.6

{
  "length": 134
}

The description lacks a call to action.

metaDescCta · heuristic · weight 0.6

Demo guidance: Add an action word (e.g. 'Discover…', 'Get…') to improve click-through.

Primary term "page" appears in the description.

metaDescKeyword · heuristic · weight 0.6

One <h1>: "How do you audit a public web page?".

h1Single · observed · weight 2

{
  "h1Count": 1
}

Primary term "page" is in the H1.

h1Keyword · heuristic · weight 1

3 headings form a clean outline.

headingOrder · observed · weight 1.2

{
  "headings": 3,
  "h2Count": 2
}

2 <h2> sub-heading(s).

h2Coverage · observed · weight 0.8

Primary term "page" → title:✓ H1:✓ intro:✓.

keywordTargeting · heuristic · weight 2.2

{
  "topKeywords": [
    {
      "term": "page",
      "count": 5,
      "density": 4.672897196261682
    },
    {
      "term": "check",
      "count": 4,
      "density": 3.7383177570093453
    },
    {
      "term": "audit",
      "count": 3,
      "density": 2.803738317757009
    },
    {
      "term": "html",
      "count": 3,
      "density": 2.803738317757009
    },
    {
      "term": "evidence",
      "count": 3,
      "density": 2.803738317757009
    },
    {
      "term": "labels",
      "count": 3,
      "density": 2.803738317757009
    }
  ]
}

Top term "page" is 4.7% of 107 content words.

keywordDensity · heuristic · weight 1

Demo guidance: Reduce repetition — over-using the keyword reads as spam to Google.

Recurring topical phrases: "form labels".

semanticDepth · observed · weight 1

{
  "phrases": [
    {
      "term": "form labels",
      "count": 2,
      "density": 1.8691588785046727
    }
  ]
}

Demo guidance: Cover the topic with related sub-topics and entities (LSI) so the page demonstrates depth.

Roughly 170 words of body text.

contentDepth · observed · weight 1.4

{
  "words": 170
}

Demo guidance: Thin content struggles to rank — expand to comprehensively cover the topic (600+ words for key pages).

Visible text is ~35.5% of the HTML payload.

textRatio · observed · weight 0.7

Clean URL path: "/audit-guide".

urlStructure · observed · weight 1

The page is set to noindex and will be excluded from search.

indexable · observed · weight 2.4

{
  "robotsMeta": "noindex,follow",
  "xRobots": ""
}

Demo guidance: Remove the noindex directive if you want this page to rank.

No page-level nofollow.

followable · observed · weight 0.6

No matching robots restriction for Googlebot on this URL.

robotsTxt · observed · weight 1.2

{
  "agent": "Googlebot",
  "allowed": true,
  "path": "/audit-guide"
}

Sitemap reachable at undefined.

sitemap · observed · weight 1

Canonical → https://example.org/audit-guide (self-referencing).

canonical · observed · weight 1.2

No hreflang tags (only needed for multi-language sites).

hreflang · not-applicable · weight 0.4

Demo guidance: If you serve multiple languages/regions, add hreflang alternates.

0/5 core Open Graph tags present.

openGraph · observed · weight 0.9

{
  "present": []
}

Demo guidance: Add og:title, og:description, og:image, og:url and og:type for rich social/chat previews.

0/3 Twitter card tags present.

twitterCard · not-applicable · weight 0.5

Demo guidance: Add twitter:card, twitter:title and twitter:image for better X/Twitter previews.

No JSON-LD structured data found.

structuredData · observed · weight 1.3

{
  "blocks": 0,
  "valid": 0,
  "types": []
}

Demo guidance: Add valid JSON-LD (Organization, BreadcrumbList, Article/Product as relevant) to qualify for rich results.

No breadcrumb structured data.

breadcrumbs · not-applicable · weight 0.4

Demo guidance: Add BreadcrumbList schema so search shows breadcrumb trails in results.

1/1 images have alt text.

imageAlt · observed · weight 0.9

6 internal and 1 external links (0 nofollow).

internalLinks · observed · weight 1

{
  "internal": 6,
  "external": 1,
  "nofollow": 0
}

0 generic anchor(s) like "click here" out of 8 links.

anchorQuality · observed · weight 0.6

viewport: "width=device-width, initial-scale=1".

mobileViewport · observed · weight 1.2

lang="en".

htmlLang · observed · weight 0.6

Primary term "page" appears in 3/5 key locations (title/H1/intro/URL/alt).

keywordDistribution · heuristic · weight 1.4

Demo guidance: Distribute your primary keyword across the title, H1, opening text, URL slug and an image alt for unambiguous topical relevance.

1/2 sub-headings include a top topical term.

h2KeywordCoverage · heuristic · weight 0.8

No og:image.

ogImageQuality · observed · weight 0.6

Demo guidance: Use an absolute og:image URL (1200×630) and declare og:image:width/height for reliable rich previews.

No tracking/session parameters in the canonical URL.

cleanUrlParams · observed · weight 0.5

8 unique anchors out of 8 links (100% diverse).

anchorDiversity · observed · weight 0.5

Page is noindex yet appears in the sitemap — conflicting signals.

indexSitemapConsistency · heuristic · weight 0.7

Demo guidance: Remove noindex pages from the sitemap (or make them indexable) to avoid sending crawlers mixed signals.

Title uses numbers/power words that lift CTR.

titleCtr · observed · weight 0.5

Meta description is distinct from body copy.

descUnique · observed · weight 0.4

No RSS/Atom/JSON feed announced in <head> (only relevant if the site publishes a feed).

feedDiscovery · not-applicable · weight 0.3

Demo guidance: If you publish a feed, announce it with <link rel="alternate" type="application/rss+xml"> so readers and agents can find it.

No JSON-LD — AI engines must guess the page's facts and entities.

structuredAnswers · observed · weight 2.4

Demo guidance: Add Article and Organization/Person JSON-LD (plus HowTo where relevant) so engines can lift facts verbatim and attribute you.

3 heading(s) phrased as questions.

questionHeadings · observed · weight 1.4

{
  "examples": [
    "How do you audit a public web page?",
    "What should you check first?",
    "How do you confirm an improvement?"
  ]
}

100% of paragraphs are answer-sized; 1 list(s), 0 table(s).

liftableContent · heuristic · weight 1.4

No data tables.

dataTables · not-applicable · weight 0.5

Demo guidance: Where you compare options or list specs, use <table> — engines extract tabular facts cleanly.

Authorship/attribution signals present.

authority · observed · weight 1.2

An About/Team/Company link is present.

aboutPage · observed · weight 0.5

Published/modified dates are exposed.

freshness · observed · weight 0.9

1 outbound citation(s) to other domains.

citations · observed · weight 0.9

Demo guidance: Cite primary sources — well-sourced pages are more likely to be trusted and cited.

No matching robots restriction for OpenAI Search, Perplexity or Claude Search. This is access eligibility, not proof of indexing or citations.

aiCrawlerAccess · observed · weight 1.6

{
  "blockedSearch": [],
  "decisions": []
}

Public markup cannot confirm indexing, snippet eligibility or the owner's Search Console AI inclusion setting. Google-Extended controls Gemini training and grounding; it does not control Google Search inclusion.

googleAiEligibility · not-tested · weight 0

Policy restrictions: none detected. Training, Gemini grounding and user-triggered agents have separate purposes. ChatGPT-User does not determine ChatGPT Search inclusion.

aiPolicyChoices · observed · weight 0

No /llms.txt found (optional — Google ignores it, but some AI agents read it).

llmsTxt · not-applicable · weight 0.4

Demo guidance: Consider publishing /llms.txt — a curated markdown map of your key content some AI agents read. Note it has no effect on Google Search or AI Overviews.

No discovery hints in the HTTP Link header (optional: lets agents find sitemap/llms.txt without parsing HTML).

linkHeaderDiscovery · not-applicable · weight 0.3

Demo guidance: Consider advertising sitemap/llms.txt/feeds via the HTTP Link header for agents that never read your HTML.

No Content-Signal directives in robots.txt (emerging, optional standard for declaring AI search/train permissions).

contentSignal · not-applicable · weight 0.2

Demo guidance: Optionally add Content-Signal directives to robots.txt to state explicitly whether AI may search, ingest or train on your content.

Uses 6 semantic landmark(s): main, article, section, nav, header, footer.

semanticStructure · observed · weight 1

Opens with a definitional, quotable statement.

directAnswer · heuristic · weight 0

170 words in the initial HTML. Short pages can be complete; text length does not establish content quality or citations.

serverRendered · observed · weight 1

0 statistic-like figures (0.0 per 500 words).

statDensity · heuristic · weight 0

Demo guidance: Use relevant, verifiable figures when they help readers. Statistics density is not a measured citation signal.

No comparison or tabular content detected.

comparisonContent · not-applicable · weight 0.6

Demo guidance: Where relevant, add comparison tables or 'X vs Y' sections — engines surface these for decision queries.

Opening is a self-contained, quotable definition.

selfContained · heuristic · weight 0

~57 words per section across 2 sub-headings.

chunking · heuristic · weight 0

No table-of-contents anchors.

tableOfContents · not-applicable · weight 0.4

Demo guidance: For long content, add a table of contents with in-page anchors — it maps your sections for AI navigation.

No named entities in schema.

entityConsistency · not-applicable · weight 0.5

2 question headings.

faqRichness · observed · weight 0.5

Demo guidance: Add a visible FAQ section answering 3+ real user questions — Q&A content is a top source of AI-answer citations. (FAQPage markup is optional; Google dropped FAQ rich results in May 2026.)

Content dated ~0 month(s) ago.

absoluteRecency · observed · weight 0.6

19 distinct proper-noun phrases (entities engines can link).

entityRichness · not-applicable · weight 0.4

Content isn't buried in tabs/accordions.

answerNotHidden · observed · weight 0.4

No A2A agent card (emerging spec; only relevant if the site exposes services for AI agents to call).

agentCard · not-applicable · weight 0.3

Demo guidance: If you offer agent-callable services, consider publishing an A2A agent card at /.well-known/agent-card.json.

No /.well-known/traffic-advice (optional: declares how prefetch proxies like Chrome's private prefetch may load your pages).

trafficAdvice · not-applicable · weight 0.2

Demo guidance: Optionally publish /.well-known/traffic-advice to control how prefetch proxies pre-load your pages.

No MCP server found (agents probe https://mcp.<your-domain>/ and /.well-known/mcp).

mcpServer · not-applicable · weight 0.4

{
  "location": null
}

Demo guidance: If you offer tools or services AI agents could call, serve an MCP endpoint (Streamable HTTP) at mcp.<your-domain> or /.well-known/mcp — the two locations agents probe for it.

No /openapi.json or /.well-known/api-catalog found (only relevant if you expose an API).

openApiSpec · not-applicable · weight 0.3

{
  "source": null
}

Demo guidance: If you expose an API, publish its OpenAPI spec at /openapi.json (or an RFC 9727 catalog at /.well-known/api-catalog) so agents can discover and call it unaided.

No /agents.md found (emerging convention: a markdown briefing for AI agents at the site root).

agentsMd · not-applicable · weight 0.3

Demo guidance: Consider publishing /agents.md — a short markdown briefing (what the site does, key URLs, machine-readable surfaces) that agents can read in one fetch.

No NLWeb surfaces (optional: schemamap in robots.txt plus an /ask endpoint let agents query your site in natural language).

nlweb · not-applicable · weight 0.3

{
  "schemamap": false,
  "askEndpoint": null
}

Demo guidance: Optionally adopt NLWeb: point agents at your structured data with schemamap: lines in robots.txt and answer natural-language questions at /ask.

Document response observed in 200 ms from this server; not real-user field data.

responseTime · observed · weight 2

{
  "ttfb": 200,
  "loadMs": 200
}

No redirect on the entry URL.

redirects · observed · weight 0.6

HTML is 3 KB uncompressed (0 KB on the wire).

htmlSize · observed · weight 1

{
  "htmlKb": 3,
  "transferKb": 0
}

Response compressed (br).

compression · observed · weight 1.2

Using Brotli (best ratio).

brotli · observed · weight 0.4

0 render-blocking script(s) and 0 stylesheet(s) in <head>.

renderBlocking · observed · weight 1.6

{
  "blockingScripts": 0,
  "headStyles": 0
}

No external scripts.

scriptLoading · not-applicable · weight 1

Demo guidance: Add async or defer to non-critical scripts so they don't block parsing.

~1 referenced resources (0 scripts, 0 styles, 1 images, 0 iframes).

requestCount · heuristic · weight 1

{
  "totalScripts": 0,
  "styles": 0,
  "imgs": 1,
  "iframes": 0
}

0 distinct third-party domain(s) referenced.

thirdParty · observed · weight 1

{
  "domains": []
}

0 preconnect, 0 dns-prefetch, 0 preload hint(s).

resourceHints · not-applicable · weight 0.8

Demo guidance: Add <link rel=preconnect> for critical third-party origins and preload key fonts/hero assets.

No raster images to optimise (vectors are resolution-independent).

imageOptim · not-applicable · weight 1.4

{
  "rasterImgs": 0,
  "lazy": 0,
  "rasterDimensioned": 0,
  "modern": 0,
  "responsive": 0
}

1/1 images declare width & height.

cls · observed · weight 1

No external web fonts detected.

fontDisplay · not-applicable · weight 0.6

0 KB inline CSS, 0 KB inline JS.

inlineWeight · observed · weight 0.7

HTML appears minified.

minification · observed · weight 0.5

No effective Cache-Control on the document.

caching · observed · weight 0.8

Demo guidance: Set Cache-Control on static assets (long max-age + immutable) and a sensible value on HTML.

No ETag or Last-Modified on the document — every revisit re-downloads the full body.

validators · observed · weight 0.5

Demo guidance: Send an ETag or Last-Modified header so browsers can revalidate with If-None-Match and get a cheap 304.

Modern HTTP advertised.

cdn · observed · weight 0.6

Demo guidance: Serve assets from a CDN to cut latency for distant users.

Server advertises HTTP/2 or HTTP/3 (alt-svc).

http2 · observed · weight 0.5

43 DOM nodes.

domSize · observed · weight 0.8

No @import in inline CSS.

cssImport · observed · weight 0.6

0 base64 data-URI(s), ~0 KB inlined into the HTML.

dataUriBloat · observed · weight 0.7

No duplicate script URLs.

duplicateScripts · observed · weight 0.5

The first image loads eagerly.

lcpImage · observed · weight 0.8

No fetchpriority hint for the LCP image.

fetchPriority · observed · weight 0.4

Demo guidance: Add fetchpriority="high" to your hero/LCP image so the browser fetches it first.

0/0 third-party origins are preconnected.

preconnectCoverage · not-applicable · weight 0.6

No heavy third-party embeds.

embedFacade · observed · weight 0.5

Largest inline <script> is 0.0 KB.

inlineScript · observed · weight 0.5

0 stylesheet(s) load render-blocking (no media scope / print).

mediaScopedCss · observed · weight 0.5

No legacy libraries blocking in <head>.

legacyHeadLibs · observed · weight 0.4

No BFCache blockers detected — back/forward navigations can restore instantly from memory.

bfcache · observed · weight 0.5

No Speculation Rules (optional: makes next-page navigations feel instant).

speculationRules · not-applicable · weight 0.3

Demo guidance: Consider a <script type="speculationrules"> block to prerender likely next pages on hover.

CSS containment not assessed — stylesheets are external and deep render is off.

cssContainment · not-applicable · weight 0.2

Demo guidance: Consider contain: content (or layout/paint) on self-contained widgets to limit style/layout recalculation scope.

scrollbar-gutter not assessed — stylesheets are external and deep render is off.

scrollbarGutter · not-applicable · weight 0.2

Demo guidance: Set scrollbar-gutter: stable on the root/scroll containers so the scrollbar appearing doesn't shift content sideways.

No View Transitions usage detected (optional: native cross-fade/morph between pages and states).

viewTransitions · not-applicable · weight 0.3

Demo guidance: Consider the View Transitions API (@view-transition / startViewTransition) for smooth page and state transitions without JS animation libraries.

No scroll-driven animation usage detected (optional: animation-timeline: scroll()/view()).

scrollDrivenAnimations · not-applicable · weight 0.2

Demo guidance: Consider CSS scroll-driven animations (animation-timeline) for scroll effects — they run off the main thread with zero JS.

No Server-Timing header on the document.

serverTiming · not-applicable · weight 0.2

Demo guidance: Emit a Server-Timing header (e.g. db;dur=42, cache;desc=hit) to surface backend timings in DevTools and RUM analytics.

No compression-dictionary headers (cutting-edge: Use-As-Dictionary lets returning visitors download only the diff of updated assets).

compressionDictionary · not-applicable · weight 0.2

Demo guidance: Consider Compression Dictionary Transport (Use-As-Dictionary on key assets) so returning visitors fetch deltas instead of full files.

No Link response header with preload/preconnect on the document.

earlyHintsReady · not-applicable · weight 0.3

Demo guidance: Send 103 Early Hints with Link headers (rel=preload/preconnect) on the main document so browsers start fetching critical assets before the HTML is ready.

lang="en".

lang · observed · weight 1.4

0/1 images missing an alt attribute.

imgAlt · observed · weight 1.8

{
  "total": 1,
  "missingAlt": 0
}

No generic alt text detected.

altQuality · observed · weight 0.6

0/1 fields have no associated label.

formLabels · observed · weight 1.8

{
  "total": 1,
  "unlabeled": 0
}

0 vague and 0 empty link(s) of 8.

linkText · observed · weight 0.9

0 button(s) without an accessible name.

buttonNames · observed · weight 0.9

Users can zoom.

zoom · observed · weight 1

Landmarks present: main:true nav:true header:true footer:true.

landmarks · observed · weight 1

A skip link is present.

skipLink · observed · weight 0.5

3 headings in order.

headingStructure · observed · weight 0.8

No focusable elements hidden from assistive tech.

ariaHidden · observed · weight 0.6

Natural focus order preserved.

tabindex · observed · weight 0.5

No autoplaying audio/video.

autoplay · observed · weight 0.4

No colour pairs to evaluate (colours likely set via external CSS — enable deep render to assess).

contrast · not-tested · weight 1.4

{
  "checked": 0,
  "failures": 0,
  "worst": null
}

10/10 interactive elements expose an accessible name.

accessibleNames · observed · weight 1.3

{
  "total": 10,
  "named": 10
}

All interactive elements use <a>/<button>.

semanticInteractive · observed · weight 1

No invalid nesting detected.

validNesting · observed · weight 0.7

No inline animations detected.

reducedMotion · not-applicable · weight 0.6

Exactly one main landmark.

landmarkUniqueness · observed · weight 0.6

All aria-labelledby/describedby/controls point to existing IDs.

ariaRefs · observed · weight 0.6

No empty headings.

emptyHeadings · observed · weight 0.5

No inline-sized interactive elements to assess.

touchTargets · not-applicable · weight 0.5

lang="en" is well-formed.

langFormat · observed · weight 0.4

No accessibility overlay detected.

a11yOverlay · observed · weight 0.8

No focus-outline removal detected.

focusRing · observed · weight 0.7

No inline lang attributes found — untagged foreign-language passages can't be detected statically.

inlineLang · not-applicable · weight 0.3

Demo guidance: If the page quotes or embeds text in another language, wrap it with lang="xx" (WCAG 3.1.2) so screen readers pronounce it correctly.

No translate="no"/notranslate markers found.

translateAttr · not-applicable · weight 0.2

Demo guidance: Mark brand names, code snippets and proper nouns with translate="no" so browser auto-translation doesn't mangle them.

Standards-mode <!doctype html>.

doctype · observed · weight 1

Charset declared within the first 1KB.

charset · observed · weight 1

html lang set.

lang · observed · weight 0.6

No deprecated HTML tags.

deprecatedTags · observed · weight 1

No deprecated presentational attributes.

deprecatedAttrs · observed · weight 0.6

0 elements (0.0%) use inline style attributes.

inlineStyles · observed · weight 0.9

No inline on* event handlers.

inlineHandlers · observed · weight 0.7

All element IDs are unique.

dupeIds · observed · weight 0.9

No empty links.

emptyElements · observed · weight 0.5

0 <div>s vs 7 semantic element(s) (0% divs).

semanticRatio · observed · weight 0.8

No insecure http resources on an https page.

mixedContent · observed · weight 1.1

{
  "mixed": 0
}

No TODO/console leftovers in output.

leftovers · observed · weight 0.5

0 HTML comment(s) in the output.

comments · observed · weight 0.3

No favicon declared.

favicon · observed · weight 0.4

Demo guidance: Add a favicon and apple-touch-icon.

43 DOM elements.

domSize · observed · weight 0.8

Maximum nesting depth ~7.

domDepth · observed · weight 0.5

No fingerprinted libraries.

outdatedLibs · not-applicable · weight 1

{
  "libs": []
}

No javascript: URLs.

jsUrls · observed · weight 0.6

No meta refresh.

metaRefresh · observed · weight 0.5

Exactly one html/head/body/title.

singletons · observed · weight 0.7

All in-page anchor links resolve.

brokenAnchors · observed · weight 0.5

0/1 form(s) missing a submit target or have unnamed fields.

formValidity · observed · weight 0.6

No obvious secrets or internal data in the markup.

noSecrets · observed · weight 0.7

0 !important declaration(s).

importantAbuse · observed · weight 0.5

Interactivity uses <a>/<button>.

semanticInteractive · observed · weight 0.6

No duplicate description/viewport tags.

dupMeta · observed · weight 0.4

Modern-CSS adoption not assessed (external stylesheets not fetched) — container queries, anchor positioning and text-wrap balance can't be detected from the served HTML alone.

modernCssAdoption · not-applicable · weight 0

Responsive viewport configured.

responsive · observed · weight 1.8

No inline media queries (may be in external CSS).

mediaQueries · not-tested · weight 0.6

3 action-oriented control(s) detected using the page language. Prominence is not assessed from HTML.

cta · heuristic · weight 1.5

{
  "ctas": 3,
  "purpose": "article",
  "pageLang": "en"
}

3 navigation link(s) inside <nav>.

navigation · heuristic · weight 1.2

No site search detected.

search · not-applicable · weight 0.4

Demo guidance: For content-heavy sites, add search to help users find things fast.

No breadcrumbs detected.

breadcrumbs · not-applicable · weight 0.3

Contact details/links present.

contact · heuristic · weight 0.8

No social links detected.

social · not-applicable · weight 0.4

Footer region present.

footer · observed · weight 0.4

Flesch Reading Ease 54.4 — fairly difficult (10th–12th grade); avg 9 words/sentence.

readability · heuristic · weight 1

{
  "flesch": 54.4,
  "grade": 7.9
}

0/4 paragraphs are very long (120+ words).

scannability · heuristic · weight 0.7

Font size was not measured; computed styles and external CSS are not evaluated in this check.

legibility · not-tested · weight 0.7

1 field(s): 1 with a specific type (email/tel/url/number/…), 1 autocomplete, 0 placeholder.

formUx · observed · weight 0.9

H1: "How do you audit a public web page?".

valueProp · heuristic · weight 0.9

3 section heading(s) and 1 image(s) establish rhythm.

hierarchy · heuristic · weight 0.8

Favicon + descriptive title give a polished browser-tab presence.

polish · heuristic · weight 0.3

Demo guidance: Add a favicon for a polished, trustworthy tab presence.

Estimated 0 click(s) to contact — contact form on this page.

clicksToContact · heuristic · weight 1.6

{
  "clicks": 0
}

3 distinct colours used in inline/embedded styles.

colorConsistency · heuristic · weight 1.1

{
  "colors": 3
}

No inline font sizes to assess.

typeScale · not-applicable · weight 1

{
  "fontSizes": 0,
  "fontFamilies": 0
}

0 distinct font families.

fontDiscipline · not-applicable · weight 0.7

1 visually-distinct button/CTA styles detected.

buttonConsistency · not-applicable · weight 1

1 distinct margin/padding/gap values.

spacingScale · heuristic · weight 0.7

0 !important declaration(s).

importantAbuse · observed · weight 0.5

Hero has headline:✓ supporting text:✓ CTA:✓.

aboveFold · heuristic · weight 1.2

No testimonials, logos, ratings or guarantees detected. This conversion check is not required for the inferred page purpose.

trustSignals · not-applicable · weight 0.9

0 distinct class names across 43 elements (ratio 0.00).

classSprawl · not-applicable · weight 0.6

theme-color ✗, color-scheme ✗.

themeColor · not-applicable · weight 0.3

Demo guidance: Add <meta name="theme-color"> to tint browser chrome to your brand, and <meta name="color-scheme"> so dark-mode users don't get a white flash before CSS loads.

No web app manifest (optional: controls name/icon/colours when users install or pin the site).

manifest · not-applicable · weight 0.3

Demo guidance: Add a manifest.json with name, icons and theme colours, linked via <link rel="manifest">.

No service worker detected (optional: only worth adding for app-like sites that benefit from offline/installable behaviour).

serviceWorker · not-applicable · weight 0.4

No recognized client-side analytics detected. The page may intentionally omit analytics or measure activity server-side; no score penalty.

hasAnalytics · not-tested · weight 2.4

{
  "analytics": [],
  "tagManager": false
}

Demo guidance: If measurement is needed, verify your server-side or client-side setup against your goals; analytics is optional for this score.

No advertising/marketing pixels — fine for a privacy-first site (only needed if you run paid acquisition).

conversionTracking · not-applicable · weight 1.2

Demo guidance: If you run paid acquisition, add the relevant pixels (Meta, Google Ads, LinkedIn) to measure ROI.

Few tags; a manager is optional at this scale.

tagManager · not-applicable · weight 0.8

No recognized profiling trackers; consent requirements were not assessed.

consent · not-tested · weight 2

{
  "consent": []
}

A privacy/cookie policy link is present.

privacyPolicy · observed · weight 0.8

0 distinct tracking tool(s) detected.

trackerCount · observed · weight 0.9

{
  "vendors": []
}

0 GA4 property.

duplicateAnalytics · observed · weight 0.6

No obvious PII in tracking calls or URLs.

piiLeak · observed · weight 1

No consent-requiring tracking to gate — GPC/DNT not applicable.

gpcDnt · not-applicable · weight 0.4

Tagging appears fully client-side/third-party.

firstPartyTagging · not-applicable · weight 0.4

No device-fingerprinting libraries detected.

fingerprinting · observed · weight 0.6

No dedicated cookie policy/settings link.

cookiePolicy · not-applicable · weight 0.4

Tracking tags load async/deferred.

trackerPlacement · observed · weight 0.4

The final URL is served over HTTPS.

https · observed · weight 3

No HSTS header.

hsts · observed · weight 1.4

Demo guidance: Set Strict-Transport-Security: max-age=31536000; includeSubDomains; preload.

No Content-Security-Policy.

csp · observed · weight 1.5

Demo guidance: Add a Content-Security-Policy (start in report-only mode) to mitigate XSS.

Missing X-Content-Type-Options: nosniff.

xcto · observed · weight 0.8

Demo guidance: Add X-Content-Type-Options: nosniff to stop MIME sniffing.

No clickjacking protection.

clickjacking · observed · weight 1

Demo guidance: Set X-Frame-Options: SAMEORIGIN or a CSP frame-ancestors directive.

No Referrer-Policy.

referrerPolicy · observed · weight 0.6

Demo guidance: Set Referrer-Policy: strict-origin-when-cross-origin to avoid leaking URLs.

No Permissions-Policy (recommended).

permissionsPolicy · not-applicable · weight 0.5

Demo guidance: Add a Permissions-Policy to disable unused features (camera, geolocation…).

COOP: —, CORP: —.

crossOrigin · not-applicable · weight 0.5

Demo guidance: Consider Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy to harden isolation.

No obvious version disclosure.

disclosure · observed · weight 0.6

No insecure http resources on an https page.

mixedContent · observed · weight 1

No forms post to an insecure http endpoint.

formAction · observed · weight 0.6

No eval/document.write in the served HTML.

dangerousJs · observed · weight 0.4

No security.txt found.

securityTxt · observed · weight 0.4

Demo guidance: Publish /.well-known/security.txt with a disclosure contact so researchers can report issues responsibly.

No permissive CORS header on the document.

corsWildcard · observed · weight 0.5

No outdated/known-risk client libraries detected.

vulnerableDeps · observed · weight 0.8

No Cross-Origin-Embedder-Policy (needed for full isolation / SharedArrayBuffer).

crossOriginIsolation · not-applicable · weight 0.3

Demo guidance: If you need cross-origin isolation, pair COOP with Cross-Origin-Embedder-Policy.

No Reporting-Endpoints header or CSP report-to — policy violations in the field go unseen.

reportingEndpoints · not-applicable · weight 0.3

Demo guidance: Add a Reporting-Endpoints header (plus report-to in your CSP) so real-world policy breakage reaches you.

No require-trusted-types-for CSP directive (optional hardening against DOM-based XSS).

trustedTypes · not-applicable · weight 0.3

Demo guidance: Consider CSP `require-trusted-types-for 'script'` to neutralise DOM-based XSS at innerHTML-style sinks.

DNS lookup unavailable — couldn't verify CAA records.

caaRecords · not-tested · weight 0.5

No Repr-Digest/Content-Digest header (RFC 9530 Digest Fields let clients verify response integrity — cutting-edge, mostly for APIs).

digestFields · not-applicable · weight 0.2