Sample report

northwind.example

Full audit · scan #1042 · 128 pages crawled · 4 August 2026 · depth 4

How this is scored Scan my domain

The report, section by section

68D

Overall audit score

+6 vs previous scan · confidence 86%

4Critical

9High

21Medium

13Manual

Category breakdown

Security48 / 100

Headers, TLS, cookies, exposure surface · weight 22%

Performance61 / 100

Core Web Vitals readiness, payload, caching · weight 16%

SEO76 / 100

Indexability, metadata, structure, links · weight 14%

Accessibility55 / 100

WCAG signals, semantics, contrast · weight 12%

UX quality68 / 100

Clarity, states, navigation, trust · weight 10%

Technical66 / 100

Status codes, rendering, assets, canonicals · weight 10%

Compliance47 / 100

GDPR, policies, consent, transparency · weight 8%

Mobile readiness79 / 100

Viewport, tap targets, responsive integrity · weight 5%

Browser compat86 / 100

Engine coverage, fallbacks, legacy risk · weight 3%

Findings

Priority findings

Sorted by weighted priority score across all crawled pages.

CriticalAuto-detectedSEC-CSP-001

No Content-Security-Policy header

The origin serves no CSP, so any injected script executes with full privileges.

Why it matters. CSP is the last line of defence against cross-site scripting and third-party script compromise. Without it, a single injected tag can exfiltrate session data or payment inputs.

GET / HTTP/2 200 - response headers: server, x-powered-by, set-cookie, cache-control (no CSP)

OWASP ASVS 14.4.3MDN CSPCIS 2.1

Priority98

EffortM

Impacthigh

Confidence99%

Affected4 page group(s)

HighAuto-detectedSEC-HSTS-002

HSTS missing on the apex domain

HTTPS is enforced by redirect only - the first request stays downgradeable.

Why it matters. Without HSTS the initial plaintext request can be intercepted and stripped before the redirect happens, exposing session cookies on hostile networks.

curl -I https://northwind.example → no strict-transport-security header

OWASP ASVS 9.1.1RFC 6797

Priority88

EffortS

Impacthigh

Confidence98%

Affected1 page group(s)

HighAuto-detectedSEC-COOK-004

Session cookie missing SameSite and HttpOnly

`nw_session` is readable from JavaScript and sent on cross-site requests.

Why it matters. A readable session cookie turns any XSS into full account takeover, and a missing SameSite widens CSRF exposure on legacy engines.

Set-Cookie observed on POST /account/login (302)

OWASP ASVS 3.4.1OWASP ASVS 3.4.3

Priority84

EffortS

Impacthigh

Confidence96%

Affected1 page group(s)

HighAuto-detectedPERF-IMG-021

Hero image is unoptimised and blocks LCP

A 1.8 MB PNG is the largest contentful element on 22 pages.

Why it matters. The LCP element defines perceived load speed and is a ranking input. A single oversized hero routinely costs 1.5–2.5 s on mid-tier mobile.

LCP element: img.hero-main - 1842 KB PNG

Core Web VitalsLighthouse: uses-optimized-images

Priority81

EffortM

Impacthigh

Confidence94%

Affected3 page group(s)

HighAuto-detectedSEO-LINK-036

14 internal links resolve to 404

Broken links waste crawl budget and break user journeys.

Why it matters. Repeated 404s from global navigation dilute internal link equity and signal low maintenance quality.

404: /support/returns, /guides/setup-2023, /careers/senior-dev …

Google Search Essentials

Priority69

EffortM

Impactmedium

Confidence99%

Affected2 page group(s)

HighAuto-detectedA11Y-CONTRAST-041

Secondary body text fails WCAG AA contrast

3.1:1 measured against the required 4.5:1 for normal text.

Why it matters. Low-contrast supporting text is unreadable for users with reduced vision and in bright outdoor conditions - a common accessibility complaint trigger.

Computed color #8A94A6 vs background #FFFFFF

WCAG 2.2 AA 1.4.3

Priority74

EffortS

Impacthigh

Confidence95%

Affected3 page group(s)

CriticalAuto-detectedCOMP-COOKIE-051

Analytics and ad cookies set before consent

Three third-party cookies are written on first load with no prior opt-in.

Why it matters. Under GDPR and the ePrivacy directive non-essential cookies require prior informed consent. Pre-consent placement is the single most enforced violation in the EU.

3 non-essential cookies present before any banner interaction

GDPR Art. 6ePrivacy 5(3)

Priority95

EffortM

Impacthigh

Confidence91%

Affected1 page group(s)

Crawl

Page inventory extract

12 of 128 crawled URLs shown in the sample.

URL	Type	Status	Indexable	Score	Issues
/	homepage	Pass	Yes	64	2C · 3H · 5M
/pricing	pricing	Pass	Yes	71	1C · 2H · 4M
/account/login	login	Pass	No	48	3C · 2H · 1M
/category/tools	category	Pass	Yes	69	0C · 2H · 6M
/blog	blog index	Pass	Yes	83	0C · 0H · 3M
/blog/legacy-guide	blog post	Pass	Yes	52	0C · 3H · 4M
/legal/privacy	legal	Pass	Yes	88	0C · 0H · 1M
/support/returns	help	Fail	No	22	1C · 1H · 0M
/contact	contact	Pass	Yes	79	0C · 1H · 2M
/checkout	product	Pass	No	57	2C · 2H · 3M
/about	about	Pass	Yes	91	0C · 0H · 1M
/old-offer	landing	Warning	No	60	0C · 1H · 1M

This is the free tier output.

Paid plans add a larger crawl budget, scheduled monitoring with regression alerts, PDF export, scan comparison, a saved readiness sign-off and, on Agency, branded client reports.

Audit my domain See plans