Audit report
Example domain (mobile)
https://example.org/
done10 Oct 2026, 18:13
Share report evidence
Exports contain report findings. Share only information you intend to make public.
Summary
Pass · pass mark 70
19 passed, 6 warnings, 7 failed across 1 page in 1 s.
- Security
- 44
- Search & sharing
- 71
- Performance
- 100
- Accessibility
- 100
- Links
- 100
- Device
- Mobile
- Pages to crawl
- 1
- Pass mark
- 70
- Accessibility checks
- Included
- Run at
- 10 Oct 2026, 18:13
- Public history
- Listed
Fix these first
The findings that cost the most points, worst first. Each one says what we expected and what we found.
HTTP redirects to HTTPSfail
Old links and typed addresses arrive over plain HTTP; they should be upgraded, not served.
Found: Served over HTTP (200)Expected: http:// redirects to https://
Strict-Transport-Securityfail
Tells browsers to refuse plain HTTP for this site, which closes the downgrade window.
Found: MissingExpected: max-age of 180 days or more
Content-Security-Policyfail
Limits where scripts may load from, the strongest single defence against cross-site scripting.
Found: MissingExpected: An enforced policy
Clickjacking protectionfail
X-Frame-Options or frame-ancestors keeps other sites from framing yours under a fake button.
Found: MissingExpected: X-Frame-Options or frame-ancestors
X-Content-Type-Optionsfail
Stops browsers guessing a file type, so an upload cannot be executed as a script.
Found: MissingExpected: nosniff
Next steps
Want these fixed?
These recommendations follow from this report. Each links to the service, and the button opens the contact form with your audit already attached.
7 of 11 security checks need work
Close the security gaps
OWASP security assessment
Missing headers are only what is visible from outside. An OWASP-based assessment tests what an attacker would actually try, from authentication to injection, and ends in a prioritised fix list.
- HTTP redirects to HTTPS
- Strict-Transport-Security
- Content-Security-Policy
6 of 10 search and sharing checks need work
Fix what search engines read first
Website development
Titles, descriptions, canonicals and sharing tags belong in your templates, not in a plugin. We retrofit or rebuild them so every new page ships correct by default.
- Meta description
- One H1 heading
- robots.txt
All findings
Site-wide
Checked once, on https://example.org/.
| Result | Check | Expected | Found |
|---|---|---|---|
| pass | Served over HTTPS | HTTPS | HTTPS |
| fail | HTTP redirects to HTTPSOld links and typed addresses arrive over plain HTTP; they should be upgraded, not served. | http:// redirects to https:// | Served over HTTP (200) |
| fail | Strict-Transport-SecurityTells browsers to refuse plain HTTP for this site, which closes the downgrade window. | max-age of 180 days or more | Missing |
| fail | Content-Security-PolicyLimits where scripts may load from, the strongest single defence against cross-site scripting. | An enforced policy | Missing |
| fail | X-Content-Type-OptionsStops browsers guessing a file type, so an upload cannot be executed as a script. | nosniff | Missing |
| fail | Clickjacking protectionX-Frame-Options or frame-ancestors keeps other sites from framing yours under a fake button. | X-Frame-Options or frame-ancestors | Missing |
| warn | Referrer-PolicyControls how much of your URLs, including query strings, leaks to every third party you link to. | A policy | Missing |
| warn | Permissions-PolicySwitches off camera, microphone and location for embedded content that has no business asking. | A policy | Missing |
| pass | Cookie flags | Secure and HttpOnly | No cookies set |
| pass | Version banners | No version numbers | None exposed |
| warn | robots.txtThe first file a crawler asks for; without it, crawl rules and the sitemap location are guesswork. | /robots.txt returns 200 | 404 |
| warn | XML sitemapLists the pages you want indexed, so new and deep pages are found without waiting for links. | /sitemap.xml returns 200 | 404 |
| pass | Broken internal links | No 4xx/5xx | No internal links to sample |
Per page
Example Domainhttps://example.org/HTTP 200 · 21 ms · 2 failed · 2 warnings
| Result | Check | Expected | Found |
|---|---|---|---|
| pass | Page responds with 200 | 200 OK | 200 |
| pass | Title tag | 10–60 characters | "Example Domain" (14 characters) |
| fail | Meta descriptionOften used as the snippet under the result; 50 to 160 characters is what search engines show. | 50–160 characters | Missing |
| fail | One H1 headingA single top-level heading tells crawlers and screen readers what the page is about. | Exactly one | None |
| warn | Canonical URLNames the preferred address when the same page is reachable through several URLs. | A canonical link | Missing |
| warn | Open Graph tagsDecide the title and image when the page is shared on LinkedIn, Slack or messengers. | og:title and og:image | Neither |
| pass | Indexable | Indexable | Indexable |
| pass | Mobile viewport | width=device-width | width=device-width,initial-scale=1 |
| pass | Server response time | Under 800 ms | 21 ms |
| pass | HTML weight | Under 200 KB | 1 KB |
| pass | Compression | gzip, Brotli or zstd | br |
| pass | External scripts | 15 or fewer | 1 |
| pass | Image dimensions | width and height on every image | All 0 sized |
| pass | No mixed content | No http:// resources | None |
| pass | Page language | lang on <html> | en |
| pass | Image text alternatives | alt on every image | All 0 have alt |
| pass | Form labels | A label for every field | No form fields |
| pass | Link and button names | Text or aria-label on each | All named |
| pass | Heading order | No skipped levels | No headings |