HealthAuditor — sample report

HEALTH REPORT · RULESET v0.2.0

http://demo.example.com/landing

10/31/2026, 1:25:46 PM · 60 rules · 0.0s · Static analysis only — no Core Web Vitals key configured

3/100

Website Health

poor

9/100

Performance

0/100

SEO

0/100

Accessibility

0/100

Best Practices

0/100

Security

3critical

11high

14medium

12low

1passed

ℹ️ This is a sample report generated from a bundled demo page — no website was contacted.

🔴 Fix first

Ranked by impact × how many elements are affected × how easy the fix is. The formula is documented on the methodology page.

1
This page tells search engines not to index it.Impact: High · Effort: Easy · SEO-006
2
This page is served over plain HTTP.Impact: High · Effort: Easy · SEC-001
3
2 form fields have no accessible label.Impact: High · Effort: Medium · A11Y-003
4
This page has no title tag.Impact: High · Effort: Easy · SEO-001
5
This page has no usable mobile viewport tag.Impact: High · Effort: Easy · SEO-004
6
1 image on this page has no alt attribute.Impact: High · Effort: Easy · A11Y-001
7
The page does not declare a language.Impact: High · Effort: Easy · A11Y-002
8
1 link has no readable text.Impact: High · Effort: Easy · A11Y-004

⚡ 6 quick wins

Meaningful impact, little effort.

✓
Remove the noindex directive if this page should appear in search results.This page tells search engines not to index it.
✓
Install a TLS certificate (Let's Encrypt is free) and redirect all HTTP traffic to HTTPS.This page is served over plain HTTP.
✓
Write a unique, descriptive title of roughly 50–60 characters that contains the page's main topic and your brand.This page has no title tag.
✓
Add <meta name="viewport" content="width=device-width, initial-scale=1"> to the <head>.This page has no usable mobile viewport tag.
✓
Describe what the image conveys in its alt attribute, or use alt="" if it is purely decorative.1 image on this page has no alt attribute.
✓
Set the document language, e.g. <html lang="en">.The page does not declare a language.

📊 Performance measurements

Not measuredLargest Contentful PaintHow long until the largest visible element (usually the hero image or headline) has rendered. Good: under 2.5 s.

Not measuredInteraction to Next PaintHow quickly the page responds when someone taps or clicks. Good: under 200 ms.

Not measuredCumulative Layout ShiftHow much the layout jumps around while loading. Good: under 0.1.

Not measuredFirst Contentful PaintHow long until the first text or image appears. Good: under 1.8 s.

Not measuredTotal Blocking TimeHow long the main thread was blocked and unable to respond to input during load. Good: under 200 ms.

Not measuredSpeed IndexHow quickly the visible part of the page fills in. Good: under 3.4 s.

not measuredmeasured page weight

6resources referenced

1 KBHTML document

not measuredimages

not measuredJavaScript

0 msserver response (TTFB)

🧾 All findings

This page tells search engines not to index it.

CriticalEasy fixSEO-006

Why it matters

A noindex directive removes the page from search results entirely. It is usually left behind by accident after a staging deploy.

Evidence

Observed<meta name="robots" content="noindex, nofollow">

ExpectedNo noindex directive

Meta robots: noindex, nofollow
X-Robots-Tag: none

Impact

Severe impact on how well search engines can find and present this page.

How to fix

Remove the noindex directive if this page should appear in search results.

Was this finding incorrect?

This page is served over plain HTTP.

CriticalEasy fixSEC-001

Why it matters

Without HTTPS, everything between the visitor and the server can be read or modified in transit, and browsers mark the site as 'Not secure'.

Evidence

Observedhttp://demo.example.com/landing

Expectedhttps:// with a valid certificate

Final URL: http://demo.example.com/landing
Protocol: http:

Impact

Severe impact on the security posture of the site.

How to fix

Install a TLS certificate (Let's Encrypt is free) and redirect all HTTP traffic to HTTPS.

Was this finding incorrect?

2 form fields have no accessible label.

CriticalMedium effort2 affectedA11Y-003

Why it matters

An input without a label is announced as just "edit text". Users of screen readers cannot tell what to type.

Evidence

Observed2 of 2 fields unlabeled

ExpectedEvery field has a label, aria-label or aria-labelledby

Field 1: <input type="email" name="email">
Field 2: <input type="password" name="password">

Impact

Severe impact on people using assistive technology or keyboard navigation.

How to fix

Associate a visible <label for="…"> with every field, or provide aria-label when a visible label is impossible.

Technical details

Rule: A11Y-003 — Form inputs have labels
Category: accessibility
URL: http://demo.example.com/landing
Element: <input type="email" name="email">
Priority score: 12.1

<label for="email">Email address</label>
<input id="email" type="email" name="email">

Was this finding incorrect?

This page has no title tag.

HighEasy fixSEO-001

Why it matters

The title is the clickable headline in search results and the label of the browser tab. Search engines weigh it heavily when matching a page to a query.

Evidence

ObservedNo <title> element found in <head>

ExpectedA unique title of about 50–60 characters

Element: <title>
Found: none

Impact

Affects how the page appears in search results and how well it matches searches.

How to fix

Write a unique, descriptive title of roughly 50–60 characters that contains the page's main topic and your brand.

Technical details

Rule: SEO-001 — Page title
Category: seo
URL: http://demo.example.com/landing
Priority score: 9.6

<title>Your page topic | Brand name</title>

developers.google.com

Was this finding incorrect?

This page has no usable mobile viewport tag.

HighEasy fixSEO-004

Why it matters

Without a viewport meta tag mobile browsers render the page at desktop width and zoom out, which hurts both mobile usability and mobile search performance.

Evidence

ObservedNo viewport meta tag

Expectedwidth=device-width, initial-scale=1

Element: <meta name="viewport">
Content: none

Impact

Significant impact on how well search engines can find and present this page.

How to fix

Add <meta name="viewport" content="width=device-width, initial-scale=1"> to the <head>.

Technical details

Rule: SEO-004 — Viewport meta tag
Category: seo
URL: http://demo.example.com/landing
Priority score: 9.6

<meta name="viewport" content="width=device-width, initial-scale=1">

developer.mozilla.org

Was this finding incorrect?

1 image on this page has no alt attribute.

HighEasy fixA11Y-001

Why it matters

Screen readers announce the alt attribute instead of the image. Without it, users hear a file name or nothing at all.

Evidence

Observed1 of 2 images missing alt

ExpectedEvery <img> has an alt attribute

Image 1: <img> → /hero.png

Impact

Blocks screen-reader users from understanding image content, and removes an SEO signal.

How to fix

Describe what the image conveys in its alt attribute, or use alt="" if it is purely decorative.

Technical details

Rule: A11Y-001 — Images have alt text
Category: accessibility
URL: http://insecure.example.com/hero.png
Element: <img>
<img>: http://insecure.example.com/hero.png
Priority score: 9.6

<img src="…" alt="Describe the image content">  <!-- decorative: alt="" -->

www.w3.org

Was this finding incorrect?

The page does not declare a language.

HighEasy fixA11Y-002

Why it matters

The lang attribute tells screen readers which pronunciation rules to use and helps browsers offer translation.

Evidence

Observed<html> has no lang attribute

Expected<html lang="en"> (or the correct language code)

Element: <html>

Impact

Significant impact on people using assistive technology or keyboard navigation.

How to fix

Set the document language, e.g. <html lang="en">.

Technical details

Rule: A11Y-002 — Page language declared
Category: accessibility
URL: http://demo.example.com/landing
Priority score: 9.6

<html lang="en">

Was this finding incorrect?

1 link has no readable text.

HighEasy fixA11Y-004

Why it matters

A link with no text (often an icon-only link) is announced as "link" with no destination, and gives search engines no anchor context.

Evidence

Observed1 empty links

ExpectedEvery link has text or an aria-label

Link 1: href="/broken"

Impact

Significant impact on people using assistive technology or keyboard navigation.

How to fix

Add visible link text, or aria-label describing where the link goes.

Technical details

Rule: A11Y-004 — Links have discernible text
Category: accessibility
URL: http://demo.example.com/landing
Priority score: 9.6

<a href="/cart" aria-label="View your shopping cart"><svg …></svg></a>

Was this finding incorrect?

1 button has no accessible name.

HighEasy fixA11Y-005

Why it matters

A button with no name is announced only as "button", so nobody using a screen reader knows what it does.

Evidence

Observed1 of 1 buttons unnamed

ExpectedText content or aria-label on every button

Button 1: <button>

Impact

Significant impact on people using assistive technology or keyboard navigation.

How to fix

Give every button visible text or an aria-label.

Technical details

Rule: A11Y-005 — Buttons have accessible names
Category: accessibility
URL: http://demo.example.com/landing
Priority score: 9.6

<button aria-label="Close dialog">×</button>

Was this finding incorrect?

1 form submit data over insecure HTTP.

HighEasy fixSEC-011

Why it matters

A form that posts to an http:// endpoint sends whatever the user typed — including passwords — in plain text.

Evidence

Observedhttp://example.com/login

Expectedhttps:// form actions

Form 1: http://example.com/login

Impact

Significant impact on the security posture of the site.

How to fix

Point the form action at an https:// endpoint.

Was this finding incorrect?

1 script in the page head block rendering until they finish loading.

HighMedium effortPERF-001

Why it matters

A <script src> in the <head> without async or defer stops HTML parsing until the file is downloaded and executed, delaying first paint.

Evidence

Observed1 blocking <script src> in <head>

Expectedasync, defer, or scripts loaded at the end of <body>

Script 1: /js/tracker.js

Impact

Significant impact on how fast the page feels to visitors.

How to fix

Add defer (or move the script to the end of <body>) unless it must run before the page renders.

Technical details

Rule: PERF-001 — Render-blocking scripts
Category: performance
URL: http://demo.example.com/landing
Priority score: 8

<script src="/js/app.js" defer></script>

Was this finding incorrect?

Text "Low contrast text" has a contrast ratio of 2.85:1.

HighMedium effortA11Y-011

Why it matters

Text needs a contrast ratio of at least 4.5:1 against its background (3:1 for large text) to stay readable for low-vision users and in bright sunlight.

Evidence

Observed#999999 on #ffffff = 2.85:1

ExpectedAt least 4.5:1 for body text

Foreground: #999999
Background: #ffffff
Ratio: 2.85:1

Impact

Significant impact on people using assistive technology or keyboard navigation.

How to fix

Darken the text or lighten the background until the ratio is at least 4.5:1.

Technical details

Rule: A11Y-011 — Inline text contrast
Category: accessibility
URL: http://demo.example.com/landing
Priority score: 7.4

www.w3.org

Was this finding incorrect?

2 images do not declare width and height, which can make the layout jump while loading.

MediumEasy fix2 affectedPERF-IMG-003

Why it matters

Without width and height (or a CSS aspect-ratio) the browser does not know how much space to reserve, so content jumps as images load. That is measured as Cumulative Layout Shift.

Evidence

Observed2 of 2 images without dimensions

Expectedwidth and height attributes on every <img>

Image 1: <img> /hero.png
Image 2: <img> /images/photo.jpg

Impact

Moderate impact on how fast the page feels to visitors.

How to fix

Add width and height attributes matching the image's aspect ratio.

Technical details

Rule: PERF-IMG-003 — Images declare dimensions
Category: performance
URL: http://demo.example.com/landing
Element: <img>
Priority score: 6.9

<img src="/images/hero.webp" width="1200" height="630" alt="…">

Was this finding incorrect?

The HTML delivered by the server contains only 17 words of text.

HighLarger projectSEO-014

Why it matters

If the HTML response contains almost no text, search engines that do not execute JavaScript see an empty page. Client-side-only rendering is the usual cause.

Evidence

Observed17 words in the server-rendered HTML

ExpectedMeaningful content present in the initial HTML

Words in HTML: 17
HTML size: 1 KB
Detected framework: unknown

Impact

Significant impact on how well search engines can find and present this page.

How to fix

Server-render or pre-render the main content so it exists in the initial HTML response.

Was this finding incorrect?

No Content-Security-Policy is enforced.

HighLarger projectSEC-003

Why it matters

A Content-Security-Policy restricts where scripts, styles and frames may come from. It is the strongest available defence against cross-site scripting.

Evidence

ObservedNo CSP header or meta tag

ExpectedAn enforced Content-Security-Policy

Header: Content-Security-Policy
Value: absent

Impact

Significant impact on the security posture of the site.

How to fix

Start with a report-only policy, tighten it until nothing is reported, then enforce it.

Technical details

Rule: SEC-003 — Content-Security-Policy
Category: security
URL: http://demo.example.com/landing
Priority score: 5.5

Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'self'

developer.mozilla.org

Was this finding incorrect?

This page has no meta description.

MediumEasy fixSEO-002

Why it matters

The meta description is the snippet search engines usually show under your title. A good one improves click-through rate even though it is not a direct ranking factor.

Evidence

ObservedNo <meta name="description"> tag

ExpectedA 120–160 character summary of the page

Element: <meta name="description">
Found: none

Impact

Affects click-through rate from search results.

How to fix

Add a 120–160 character description that summarises the page and invites the click.

Technical details

Rule: SEO-002 — Meta description
Category: seo
URL: http://demo.example.com/landing
Priority score: 5.5

<meta name="description" content="A short, specific summary of this page in about 150 characters.">

developers.google.com

Was this finding incorrect?

No canonical URL is declared.

MediumEasy fixSEO-003

Why it matters

A canonical link tells search engines which URL is the master copy of a page, preventing duplicate-content dilution across parameter and protocol variants.

Evidence

ObservedNo <link rel="canonical"> tag

Expected<link rel="canonical" href="http://demo.example.com/landing">

Audited URL: http://demo.example.com/landing

Impact

Moderate impact on how well search engines can find and present this page.

How to fix

Add exactly one absolute canonical link pointing at the preferred version of this page.

Technical details

Rule: SEO-003 — Canonical URL
Category: seo
URL: http://demo.example.com/landing
Priority score: 5.5

<link rel="canonical" href="http://demo.example.com/landing">

developers.google.com

Was this finding incorrect?

No XML sitemap could be found.

MediumEasy fixSEO-008

Why it matters

A sitemap helps search engines discover every page you care about, especially pages that are not well linked internally.

Evidence

Observedrobots.txt, /sitemap.xml and /sitemap_index.xml returned no sitemap

ExpectedA reachable XML sitemap

Checked: http://demo.example.com/sitemap.xml
robots.txt sitemaps: none

Impact

Moderate impact on how well search engines can find and present this page.

How to fix

Publish an XML sitemap and reference it from robots.txt.

Was this finding incorrect?

The heading structure skips levels 1 time.

MediumEasy fixA11Y-006

Why it matters

Screen-reader users navigate by heading level. Skipping levels (h2 → h4) makes the document outline confusing.

Evidence

Observedh1 → h4 at "Jumped heading level"

ExpectedHeading levels increase by at most one

Skip 1: h1 → h4 at "Jumped heading level"

Impact

Moderate impact on people using assistive technology or keyboard navigation.

How to fix

Use heading levels in order; style them with CSS rather than picking a level for its size.

Was this finding incorrect?

1 iframe has no title.

MediumEasy fixA11Y-009

Why it matters

Screen readers announce iframes by their title. Untitled frames are announced as just "frame".

Evidence

Observed1 of 1 iframes untitled

ExpectedA descriptive title attribute on each iframe

Frame 1: /embed

Impact

Moderate impact on people using assistive technology or keyboard navigation.

How to fix

Add a descriptive title, e.g. <iframe title="Location map">.

Technical details

Rule: A11Y-009 — Frames have titles
Category: accessibility
URL: http://demo.example.com/landing
Priority score: 5.5

<iframe src="…" title="What this frame shows"></iframe>

Was this finding incorrect?

Nothing stops other sites from embedding this page in a frame.

MediumEasy fixSEC-008

Why it matters

Without frame restrictions, an attacker can embed your page in an invisible iframe and trick users into clicking things they cannot see.

Evidence

ObservedNo frame-ancestors directive and no X-Frame-Options header

Expectedframe-ancestors 'self' or X-Frame-Options: SAMEORIGIN

CSP: absent
X-Frame-Options: absent

Impact

Moderate impact on the security posture of the site.

How to fix

Add frame-ancestors 'self' to your CSP (X-Frame-Options: SAMEORIGIN is the legacy equivalent).

Technical details

Rule: SEC-008 — Clickjacking protection
Category: security
URL: http://demo.example.com/landing
Priority score: 5.5

Content-Security-Policy: frame-ancestors 'self'

Was this finding incorrect?

The page has no doctype, so browsers render it in quirks mode.

MediumEasy fixBP-001

Why it matters

Without <!DOCTYPE html> browsers fall back to quirks mode, where layout and CSS behave differently from every modern expectation.

Evidence

Observed<html>

Expected<!DOCTYPE html>

Document start: <html> <head> <script src="/js/tracker.js"></script> <link rel="stylesheet" href="/css/site.css"> <link rel="stylesheet"

Impact

Moderate impact on the robustness and correctness of the page.

How to fix

Make <!DOCTYPE html> the very first line of the document.

Technical details

Rule: BP-001 — HTML5 doctype
Category: best-practices
URL: http://demo.example.com/landing
Priority score: 4.9

<!DOCTYPE html>

Was this finding incorrect?

No character encoding is declared.

MediumEasy fixBP-002

Why it matters

If the encoding is not declared early, browsers may guess wrong and display mojibake instead of accented characters and symbols.

Evidence

ObservedNo meta charset and no charset in Content-Type

ExpectedUTF-8 declared via <meta charset="utf-8">

Content-Type: text/html

Impact

Moderate impact on the robustness and correctness of the page.

How to fix

Put <meta charset="utf-8"> as the first element inside <head>.

Technical details

Rule: BP-002 — Character encoding declared
Category: best-practices
URL: http://demo.example.com/landing
Priority score: 4.9

<meta charset="utf-8">

Was this finding incorrect?

Reaching this page takes 2 redirects before the real content loads.

MediumMedium effort2 affectedSEO-012

Why it matters

Each redirect adds a round trip before anything renders and dilutes crawl budget. Chains of two or more are worth collapsing.

Evidence

Observedhttp://demo.example.com/landing → http://demo.example.com/l → http://demo.example.com/landing

ExpectedAt most one redirect

Hop 1 (301): http://demo.example.com → http://demo.example.com/l
Hop 2 (302): http://demo.example.com/l → http://demo.example.com/landing

Impact

Moderate impact on how well search engines can find and present this page.

How to fix

Point the first URL directly at the final destination so only one hop (or none) remains.

Was this finding incorrect?

Structured data is present but invalid, so search engines will ignore it.

MediumMedium effortSEO-011

Why it matters

Structured data lets search engines understand entities on the page and can unlock rich results such as breadcrumbs, FAQs and product cards.

Evidence

ObservedBlock 1: invalid JSON

ExpectedValid JSON with @context and @type

Problem 1: Block 1: invalid JSON

Impact

Moderate impact on how well search engines can find and present this page.

How to fix

Add valid schema.org JSON-LD that describes what this page represents.

Technical details

Rule: SEO-011 — Structured data (JSON-LD)
Category: seo
URL: http://demo.example.com/landing
Priority score: 4.2

schema.org developers.google.com

Was this finding incorrect?

ARIA attributes are used incorrectly on this page.

MediumMedium effortA11Y-008

Why it matters

Invalid ARIA roles are ignored, and aria-hidden on a focusable element creates a control that keyboard users can reach but screen readers cannot describe.

Evidence

ObservedUnknown role="thingamajig"

ExpectedValid ARIA roles and no focusable content inside aria-hidden

Problem 1: Unknown role="thingamajig"

Impact

Moderate impact on people using assistive technology or keyboard navigation.

How to fix

Use a valid role (or native HTML instead), and never put aria-hidden on interactive elements.

Technical details

Rule: A11Y-008 — ARIA usage
Category: accessibility
URL: http://demo.example.com/landing
Priority score: 4.2

www.w3.org

Was this finding incorrect?

1 element use a positive tabindex and jump ahead in the keyboard order.

MediumMedium effortA11Y-010

Why it matters

A positive tabindex forces an element ahead of everything else in the tab order, which almost always produces a confusing keyboard experience.

Evidence

Observedtabindex="3"

Expectedtabindex="0" or no tabindex at all

Element 1: tabindex="3"

Impact

Moderate impact on people using assistive technology or keyboard navigation.

How to fix

Use tabindex="0" (or no tabindex) and rely on DOM order for focus sequence.

Was this finding incorrect?

1 inline script use document.write().

MediumMedium effortBP-006

Why it matters

document.write() blocks parsing and can be ignored entirely by browsers on slow connections, which silently breaks whatever it injected.

Evidence

Observed1 document.write() call sites

ExpectedDOM insertion APIs instead of document.write()

Script 1: document.write("<b>hello</b>"…

Impact

Moderate impact on the robustness and correctness of the page.

How to fix

Insert nodes with DOM APIs, or load third-party scripts asynchronously.

Was this finding incorrect?

Shared links will look plain: og:title, og:description, og:image are missing.

LowEasy fix3 affectedSEO-009

Why it matters

Open Graph tags control the title, description and image shown when the page is shared on social platforms and messaging apps.

Evidence

ObservedMissing: og:title, og:description, og:image

Expectedog:title, og:description and og:image present

og:title: missing
og:description: missing
og:image: missing

Impact

Minor impact on how well search engines can find and present this page.

How to fix

Add og:title, og:description, og:image and og:url to the <head>.

Technical details

Rule: SEO-009 — Open Graph metadata
Category: seo
URL: http://demo.example.com/landing
Priority score: 3.4

<meta property="og:title" content="…">
<meta property="og:description" content="…">
<meta property="og:image" content="https://…/share.png">

ogp.me

Was this finding incorrect?

This page has 2 H1 headings, which blurs the page's main topic.

LowEasy fix2 affectedSEO-005

Why it matters

The H1 is the main on-page heading. Search engines and screen readers use it to understand what the page is about.

Evidence

Observed2 H1 elements

ExpectedExactly 1 H1

H1 1: First title
H1 2: Second title

Impact

Minor impact on how well search engines can find and present this page.

How to fix

Use exactly one H1 that describes the page content.

Was this finding incorrect?

Response headers reveal the server software and version.

LowEasy fix2 affectedSEC-009

Why it matters

Version numbers in response headers tell an attacker exactly which known vulnerabilities to try. Hiding them is free.

Evidence

ObservedServer: nginx/1.18.0; X-Powered-By: PHP/7.4.3

ExpectedNo version information in headers

Server: nginx/1.18.0
X-Powered-By: PHP/7.4.3

Impact

Minor impact on the security posture of the site.

How to fix

Strip version details from Server and remove X-Powered-By entirely.

Was this finding incorrect?

Web font loading can be improved: 1 font stylesheet without a preconnect hint and no font-display strategy detected.

LowEasy fixPERF-007

Why it matters

Web fonts fetched from a third-party domain need a fresh DNS lookup and TLS handshake; without font-display the text stays invisible while they load.

Evidence

Observed1 font stylesheet without a preconnect hint; no font-display strategy detected

Expectedpreconnect to the font host and font-display: swap

Font resource 1: https://fonts.googleapis.com/css2?family=Inter

Impact

Minor impact on how fast the page feels to visitors.

How to fix

Add <link rel="preconnect"> for the font host and use font-display: swap (or self-host the font).

Technical details

Rule: PERF-007 — Web font loading
Category: performance
URL: http://demo.example.com/landing
Priority score: 3

<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
<link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Inter&display=swap">

Was this finding incorrect?

The page uses 2 deprecated elements (<center>, <font>).

LowEasy fix2 affectedBP-005

Why it matters

Elements like <center>, <font> and <marquee> were removed from the standard. Browsers still tolerate them, but their behaviour is not guaranteed.

Evidence

Observed1× <center>, 1× <font>

ExpectedModern HTML with CSS for presentation

<center>: 1 occurrences
<font>: 1 occurrences

Impact

Minor impact on the robustness and correctness of the page.

How to fix

Replace deprecated presentational elements with CSS.

Was this finding incorrect?

No robots.txt was found at the domain root.

LowEasy fixSEO-007

Why it matters

robots.txt tells crawlers which parts of the site they may request and where the sitemap lives. A missing file is not fatal, but a blocking one is.

Evidence

Observedhttp://demo.example.com/robots.txt returned no response

ExpectedHTTP 200 with crawl directives

URL: http://demo.example.com/robots.txt
Status: no response

Impact

Minor impact on how well search engines can find and present this page.

How to fix

Publish a robots.txt at the domain root and reference your sitemap from it.

Technical details

Rule: SEO-007 — robots.txt
Category: seo
URL: http://demo.example.com/landing
Priority score: 2.7

User-agent: *
Allow: /

Sitemap: http://demo.example.com/sitemap.xml

Was this finding incorrect?

No Twitter/X card metadata was found.

LowEasy fixSEO-010

Why it matters

Twitter/X card tags control how links to the page render on X and in several other apps that reuse the format.

Evidence

ObservedNo <meta name="twitter:card">

Expectedtwitter:card, ideally "summary_large_image"

Fallback og:image: missing

Impact

Minor impact on how well search engines can find and present this page.

How to fix

Add <meta name="twitter:card" content="summary_large_image"> plus twitter:title and twitter:description.

Technical details

Rule: SEO-010 — Twitter/X card metadata
Category: seo
URL: http://demo.example.com/landing
Priority score: 2.7

<meta name="twitter:card" content="summary_large_image">

Was this finding incorrect?

No favicon is declared in the page HTML.

LowEasy fixSEO-015

Why it matters

A favicon is shown in browser tabs, bookmarks and some search result layouts. Its absence looks unfinished.

Evidence

ObservedNo <link rel="icon"> element

ExpectedA declared favicon

Checked: link[rel~="icon"], link[rel="apple-touch-icon"]

Impact

Minor impact on how well search engines can find and present this page.

How to fix

Add <link rel="icon" href="/favicon.ico"> (plus an SVG or 180×180 PNG for modern devices).

Technical details

Rule: SEO-015 — Favicon
Category: seo
URL: http://demo.example.com/landing
Priority score: 2.7

<link rel="icon" href="/favicon.ico" sizes="any">

Was this finding incorrect?

The X-Content-Type-Options header is missing.

LowEasy fixSEC-004

Why it matters

Without nosniff, browsers may guess a response's type and execute a file that was never meant to be a script.

Evidence

Observedabsent

Expectednosniff

Header: X-Content-Type-Options
Value: absent

Impact

Minor impact on the security posture of the site.

How to fix

Send X-Content-Type-Options: nosniff on all responses.

Technical details

Rule: SEC-004 — X-Content-Type-Options
Category: security
URL: http://demo.example.com/landing
Priority score: 2.7

X-Content-Type-Options: nosniff

Was this finding incorrect?

No Referrer-Policy is declared.

LowEasy fixSEC-005

Why it matters

Referrer-Policy controls how much of the current URL is sent to other sites. The default can leak private paths and query strings.

Evidence

Observedabsent

Expectedstrict-origin-when-cross-origin (or stricter)

Header: Referrer-Policy
Meta fallback: absent

Impact

Minor impact on the security posture of the site.

How to fix

Send Referrer-Policy: strict-origin-when-cross-origin.

Technical details

Rule: SEC-005 — Referrer-Policy
Category: security
URL: http://demo.example.com/landing
Priority score: 2.7

Referrer-Policy: strict-origin-when-cross-origin

Was this finding incorrect?

No Permissions-Policy is declared.

LowEasy fixSEC-006

Why it matters

Permissions-Policy lets you switch off browser features (camera, microphone, geolocation) that your site — and any embedded third party — should never use.

Evidence

Observedabsent

ExpectedAn explicit policy for sensitive browser features

Header: Permissions-Policy
Value: absent

Impact

Minor impact on the security posture of the site.

How to fix

Send Permissions-Policy disabling the features you do not need.

Technical details

Rule: SEC-006 — Permissions-Policy
Category: security
URL: http://demo.example.com/landing
Priority score: 2.7

Permissions-Policy: camera=(), microphone=(), geolocation=()

Was this finding incorrect?

1 external link open in a new tab without rel="noopener".

LowEasy fixSEC-012

Why it matters

A target="_blank" link gives the opened page a reference back to yours unless rel="noopener" is set. Older browsers allow that page to redirect yours.

Evidence

Observed1 links missing rel="noopener"

Expectedrel="noopener noreferrer"

Link 1: /page

Impact

Minor impact on the security posture of the site.

How to fix

Add rel="noopener noreferrer" to external links that open in a new tab.

Technical details

Rule: SEC-012 — Cross-origin link safety
Category: security
URL: http://demo.example.com/landing
Priority score: 2.7

<a href="https://example.com" target="_blank" rel="noopener noreferrer">Example</a>

Was this finding incorrect?

🔗 Links (0 broken)

Status	URL	Type
unverified	http://demo.example.com/broken	internal
unverified	https://external.example.com/page	external

External hosts often block automated requests. Those links are shown as “unverified” rather than broken.

🖼️ Image intelligence

Image	Size	Format	Dimensions	Alt text
hero.png	not measured	PNG	unknown	missing
photo.jpg	not measured	JPG	unknown	(decorative)

0 of 2 images were measured with a real request. Savings estimates are derived from those measured bytes only.

✅ Passed checks

PERF-006 The initial HTML references 6 resources.

🧩 Detected technology

nginx serverserver: nginx/1.18.0

🚫 Not applicable

PERF-IMG-001 No image sizes could be measured for this page.
PERF-IMG-002 No image sizes could be measured.
PERF-IMG-004 Too few images for lazy loading to matter.
PERF-002 No script sizes could be measured.
PERF-003 No stylesheet sizes could be measured.
PERF-004 No resource sizes could be measured.
PERF-005 Response time was not measured in this run.
PERF-CWV-001 Core Web Vitals need a PageSpeed Insights API key (PAGESPEED_API_KEY).
PERF-CWV-002 Core Web Vitals need a PageSpeed Insights API key (PAGESPEED_API_KEY).
PERF-CWV-003 Interaction data needs a PageSpeed Insights API key (PAGESPEED_API_KEY).
SEO-013 This page declares no hreflang annotations (only needed for multi-language sites).
A11Y-007 No viewport meta tag to evaluate (reported by SEO-004).
BP-003 The HTML document is too small for compression to matter.
BP-004 No static assets could be measured.
BP-007 No links were checked in this run.
BP-008 No links were checked in this run.
SEC-002 HSTS only applies to HTTPS pages (see SEC-001).
SEC-007 Mixed content only applies to HTTPS pages (see SEC-001).
SEC-010 This response sets no cookies.