Sample Website Audit Report

This is an anonymized educational sample. Findings are based on illustrative technical checks — not a real customer.

Educational sample — anonymous-example.irRequest assessment

About this report

This page is an educational sample. Scores and findings come from anonymized technical checks. No ranking, revenue, or outcome guarantees are implied.

Sample domain: anonymous-example.ir (fictional)
No fake score, ranking, speed, or outcome metric is shown
Confirmed findings are separated from hypotheses that need verification
No real customer data is displayed

Executive Summary

Evidence status

Confirmed / hypothesis

Confirmed

Hypothesis to verify

Total findings

Critical

High

Medium

Top 3 urgent issues

Content-Security-Policy header is missing — Critical
HSTS header is missing — High
High LCP: over 4 seconds — High

Recommended next step: Fix critical and high issues first, then start a free assessment for your own site.

Security headers

Content-Security-PolicyMissing

Strict-Transport-SecurityMissing

X-Content-Type-OptionsPresent

Referrer-PolicyPresent

Permissions-PolicyMissing

SEO status

Page titlePresent

Meta descriptionPresent

Canonical URLMissing

Open GraphMissing

Findings by severity

Critical (1)

NO_CSP_HEADERCriticalSecurityConfirmedPriority: P0

Content-Security-Policy header is missing

The site does not send a CSP header, which increases XSS risk.

Evidence: Response header scan: no Content-Security-Policy value on the HTTPS homepage response.

Business impact: High security risk for injected content and third-party scripts.

Suggested owner: Developer | Difficulty: Medium

Recommended fix: Implement Content-Security-Policy with appropriate directives. Start report-only, then enforce.

High (4)

NO_HSTSHighSecurityConfirmedPriority: P1

HSTS header is missing

HTTP Strict-Transport-Security is not configured.

Evidence: Strict-Transport-Security is absent on the sample domain response.

Business impact: Users may be exposed to HTTP downgrade on some networks.

Suggested owner: Hosting / infra | Difficulty: Easy

Recommended fix: Add HSTS with an appropriate max-age (at least one year) and includeSubDomains if needed.

CWV_LCP_POOR_PROXYHighPerformanceHypothesis to verifyPriority: P1

High LCP: over 4 seconds

Largest Contentful Paint exceeds 4 seconds on the sample run.

Evidence: Lab measurement on anonymous-example.ir: LCP ≈ 4.2s on simulated 4G.

Business impact: Poor UX and negative signal for SEO and conversion.

Suggested owner: Developer | Difficulty: Medium

Recommended fix: Compress above-the-fold images, preload the LCP element, lazy-load non-critical images.

HIGH_CLSHighPerformanceHypothesis to verifyPriority: P1

High CLS: layout shift during load

Cumulative Layout Shift exceeds the recommended threshold.

Evidence: CLS ≈ 0.18 in the sample run; banner and web fonts without reserved space caused shifts.

Business impact: Mis-clicks and reduced trust on mobile.

Suggested owner: Developer | Difficulty: Medium

Recommended fix: Set width/height on media, tune font-display, reserve space for dynamic content.

NO_CANONICALHighSEOConfirmedPriority: P1

Canonical URL is missing

Pages lack a canonical link element.

Evidence: Sample homepage HTML has no link[rel=canonical].

Business impact: Risk of duplicate indexing and wasted crawl budget.

Suggested owner: SEO specialist | Difficulty: Easy

Recommended fix: Add a single canonical URL per indexable page in the document head.

Medium (6)

NO_OG_TAGSMediumSEOConfirmedPriority: P1

Open Graph tags are missing

Social sharing previews are incomplete.

Evidence: og:title and og:image are absent on the sample homepage head.

Business impact: Lower click-through on social shares.

Suggested owner: SEO specialist | Difficulty: Easy

Recommended fix: Add og:title, og:description, og:image, and og:url on key pages.

THIN_META_DESCRIPTIONMediumContentConfirmedPriority: P1

Thin or duplicate meta descriptions

Several important pages share identical or low-information meta descriptions.

Evidence: Three mapped sample URLs share a meta description under 50 characters.

Business impact: Weak SERP snippets and lower organic CTR.

Suggested owner: Content manager | Difficulty: Easy

Recommended fix: Write unique 120–160 character descriptions aligned to each page intent.

THIRD_PARTY_FONTSMediumPerformanceConfirmedPriority: P1

Fonts loaded from third-party CDN

Google Fonts dependency may slow or block rendering on some networks.

Evidence: Request to fonts.googleapis.com observed in the sample homepage waterfall.

Business impact: FOIT/FOUT and delayed text rendering.

Suggested owner: Developer | Difficulty: Medium

Recommended fix: Self-host fonts or define a reliable fallback stack.

IMG_MISSING_ALTMediumAccessibilityConfirmedPriority: P1

7 images missing alt text

Meaningful images lack alt text for screen reader users.

Evidence: Sample DOM scan: 7 img tags without non-empty alt on key pages.

Business impact: WCAG gap and incomplete experience for low-vision users.

Suggested owner: Content manager | Difficulty: Easy

Recommended fix: Descriptive alt on content images; alt="" on decorative images.

MIXED_CONTENTMediumSecurityConfirmedPriority: P1

Mixed content (HTTP on HTTPS)

Some assets still load over HTTP on HTTPS pages.

Evidence: Two image requests using http:// detected on the sample page.

Business impact: Browser warnings and blocked assets in strict mode.

Suggested owner: Developer | Difficulty: Easy

Recommended fix: Upgrade all asset URLs to HTTPS.

MOBILE_TAP_TARGETMediumUX / MobileConfirmedPriority: P1

Small tap targets on mobile

Some buttons and links are smaller than 44×44px.

Evidence: Five interactive elements under 44px height at 390px mobile viewport.

Business impact: Touch error rate and mobile frustration.

Suggested owner: Developer | Difficulty: Easy

Recommended fix: Increase padding and min-height/min-width on touch controls.

Low (2)

NO_STRUCTURED_DATALowSEOConfirmedPriority: P1

Structured data (Schema.org) is missing

No JSON-LD for Organization/WebSite on the homepage.

Evidence: No script[type=application/ld+json] found in sample HTML.

Business impact: Missed rich result eligibility.

Suggested owner: SEO specialist | Difficulty: Easy

Recommended fix: Add WebSite and Organization JSON-LD with valid name and URL.

STATIC_ASSETS_NO_LONG_CACHELowPerformanceConfirmedPriority: P1

Short cache TTL on static assets

CSS/JS served with short cache headers.

Evidence: cache-control: max-age=3600 on three versioned sample static files.

Business impact: Extra network cost on repeat visits.

Suggested owner: Hosting / infra | Difficulty: Easy

Recommended fix: Set long max-age (≥1 year) and immutable on hashed static files.

Findings by category

Security (3)

NO_CSP_HEADERCriticalSecurityConfirmedPriority: P0

Content-Security-Policy header is missing

The site does not send a CSP header, which increases XSS risk.

Evidence: Response header scan: no Content-Security-Policy value on the HTTPS homepage response.

Business impact: High security risk for injected content and third-party scripts.

Suggested owner: Developer | Difficulty: Medium

Recommended fix: Implement Content-Security-Policy with appropriate directives. Start report-only, then enforce.

NO_HSTSHighSecurityConfirmedPriority: P1

HSTS header is missing

HTTP Strict-Transport-Security is not configured.

Evidence: Strict-Transport-Security is absent on the sample domain response.

Business impact: Users may be exposed to HTTP downgrade on some networks.

Suggested owner: Hosting / infra | Difficulty: Easy

Recommended fix: Add HSTS with an appropriate max-age (at least one year) and includeSubDomains if needed.

MIXED_CONTENTMediumSecurityConfirmedPriority: P1

Mixed content (HTTP on HTTPS)

Some assets still load over HTTP on HTTPS pages.

Evidence: Two image requests using http:// detected on the sample page.

Business impact: Browser warnings and blocked assets in strict mode.

Suggested owner: Developer | Difficulty: Easy

Recommended fix: Upgrade all asset URLs to HTTPS.

Performance (4)

CWV_LCP_POOR_PROXYHighPerformanceHypothesis to verifyPriority: P1

High LCP: over 4 seconds

Largest Contentful Paint exceeds 4 seconds on the sample run.

Evidence: Lab measurement on anonymous-example.ir: LCP ≈ 4.2s on simulated 4G.

Business impact: Poor UX and negative signal for SEO and conversion.

Suggested owner: Developer | Difficulty: Medium

Recommended fix: Compress above-the-fold images, preload the LCP element, lazy-load non-critical images.

HIGH_CLSHighPerformanceHypothesis to verifyPriority: P1

High CLS: layout shift during load

Cumulative Layout Shift exceeds the recommended threshold.

Evidence: CLS ≈ 0.18 in the sample run; banner and web fonts without reserved space caused shifts.

Business impact: Mis-clicks and reduced trust on mobile.

Suggested owner: Developer | Difficulty: Medium

Recommended fix: Set width/height on media, tune font-display, reserve space for dynamic content.

THIRD_PARTY_FONTSMediumPerformanceConfirmedPriority: P1

Fonts loaded from third-party CDN

Google Fonts dependency may slow or block rendering on some networks.

Evidence: Request to fonts.googleapis.com observed in the sample homepage waterfall.

Business impact: FOIT/FOUT and delayed text rendering.

Suggested owner: Developer | Difficulty: Medium

Recommended fix: Self-host fonts or define a reliable fallback stack.

STATIC_ASSETS_NO_LONG_CACHELowPerformanceConfirmedPriority: P1

Short cache TTL on static assets

CSS/JS served with short cache headers.

Evidence: cache-control: max-age=3600 on three versioned sample static files.

Business impact: Extra network cost on repeat visits.

Suggested owner: Hosting / infra | Difficulty: Easy

Recommended fix: Set long max-age (≥1 year) and immutable on hashed static files.

SEO (3)

NO_CANONICALHighSEOConfirmedPriority: P1

Canonical URL is missing

Pages lack a canonical link element.

Evidence: Sample homepage HTML has no link[rel=canonical].

Business impact: Risk of duplicate indexing and wasted crawl budget.

Suggested owner: SEO specialist | Difficulty: Easy

Recommended fix: Add a single canonical URL per indexable page in the document head.

NO_OG_TAGSMediumSEOConfirmedPriority: P1

Open Graph tags are missing

Social sharing previews are incomplete.

Evidence: og:title and og:image are absent on the sample homepage head.

Business impact: Lower click-through on social shares.

Suggested owner: SEO specialist | Difficulty: Easy

Recommended fix: Add og:title, og:description, og:image, and og:url on key pages.

NO_STRUCTURED_DATALowSEOConfirmedPriority: P1

Structured data (Schema.org) is missing

No JSON-LD for Organization/WebSite on the homepage.

Evidence: No script[type=application/ld+json] found in sample HTML.

Business impact: Missed rich result eligibility.

Suggested owner: SEO specialist | Difficulty: Easy

Recommended fix: Add WebSite and Organization JSON-LD with valid name and URL.

UX / Mobile (1)

MOBILE_TAP_TARGETMediumUX / MobileConfirmedPriority: P1

Small tap targets on mobile

Some buttons and links are smaller than 44×44px.

Evidence: Five interactive elements under 44px height at 390px mobile viewport.

Business impact: Touch error rate and mobile frustration.

Suggested owner: Developer | Difficulty: Easy

Recommended fix: Increase padding and min-height/min-width on touch controls.

Accessibility (1)

IMG_MISSING_ALTMediumAccessibilityConfirmedPriority: P1

7 images missing alt text

Meaningful images lack alt text for screen reader users.

Evidence: Sample DOM scan: 7 img tags without non-empty alt on key pages.

Business impact: WCAG gap and incomplete experience for low-vision users.

Suggested owner: Content manager | Difficulty: Easy

Recommended fix: Descriptive alt on content images; alt="" on decorative images.

Content (1)

THIN_META_DESCRIPTIONMediumContentConfirmedPriority: P1

Thin or duplicate meta descriptions

Several important pages share identical or low-information meta descriptions.

Evidence: Three mapped sample URLs share a meta description under 50 characters.

Business impact: Weak SERP snippets and lower organic CTR.

Suggested owner: Content manager | Difficulty: Easy

Recommended fix: Write unique 120–160 character descriptions aligned to each page intent.

30-day action plan

Days 1-7

Fix P0/P1 security, canonical, and mobile defects, then re-check evidence.

Days 8-20

Validate performance hypotheses with real lab/field data and implement LCP/CLS fixes.

Days 21-30

Prepare before/after evidence, owners, and monthly monitoring.

Get a report for your site

The initial assessment is free. Enter your URL and see a prioritized fix path.

Request assessment Request my site report Request assessment Submit request Request professional review