# Sample site audit report — fictional excerpt

## Scope
Site: example.invalid (fictional; no live scan).
Pages represented: home, services and contact.
Mode: desktop response checks; selected illustrative rules only.
No performance benchmark, security certification or client outcome is implied.

## Selected findings
| Area | Expected | Observed in example | Result |
| --- | --- | --- | --- |
| Security | A Content-Security-Policy header | Header absent | Needs attention |
| SEO | One descriptive H1 per page | Contact page has no H1 | Needs attention |
| SEO | Canonical URL for the page | All three point to themselves | Passed rule |
| Links | Internal destinations respond successfully | Services links to a removed route | Needs attention |
| Accessibility | Meaningful images have text alternatives | One content image has no alternative text | Needs review |
| Performance | Content images declare dimensions | Dimensions absent on hero image | Needs attention |

## Fix first: shared security configuration
Observation: the sample responses omit a Content-Security-Policy header.
Action: inventory the required script, image, font and connection origins; configure a policy compatible with the framework and third-party services.
Verification: check the deployed response header, exercise interactive flows and inspect browser violations. Merely adding a header does not establish that the policy prevents inline script execution.

## Fix next: page-specific content and navigation
Give the contact page a descriptive primary heading. Replace or remove the broken services link. Add an appropriate alternative description to the meaningful image; decorative images should use an empty alternative. Declare image dimensions and check the layout at narrow and wide viewports.
Verification: repeat the same checks, use the actual page destinations and review keyboard operation. Automated alternative-text detection cannot decide whether the description is useful.

## Handover record
Owner: assign one owner per fix.
Evidence: attach the original response, affected route and follow-up result to the private work item.
Remaining work: authentication, business workflows, interactive accessibility, load testing and specialist security assessment are outside this excerpt.

A real report reflects a particular run, configuration and point in time. The release decision needs additional evidence for areas an automated response check cannot exercise.