Website Audit Report — https://danluu.com
Prepared for: Website owner
Prepared by: AUDIT_BRAND
Report date: 2026-10-26 06:12
Scope: 16 checks — availability, TLS, performance, security headers, SEO, accessibility, crawlability
Overall score: 58/100 (grade E) — 7 issue(s) found
1. Scorecard
| # | Check | Weight | Result | Evidence |
|---|---|---|---|---|
| 1 | Site reachable and serving 2xx/3xx | 15 | PASS | HTTP 200 in 139 ms, 6704 bytes transferred |
| 2 | HTTPS enabled | 10 | PASS | Served over HTTPS |
| 3 | TLS certificate valid > 14 days | 8 | PASS | expires 2026-12-26 (61 days left) |
| 4 | Mobile viewport declared | 10 | FAIL | no <meta name="viewport"> — mobile renders at 980px then shrinks |
| 5 | Page title length 8-60 chars | 8 | FAIL | no <title> element |
| 6 | Meta description 40-160 chars | 7 | FAIL | missing — search results show no snippet |
| 7 | Exactly one H1 heading | 5 | FAIL | 0 H1 element(s) found |
| 8 | Every image has alt text | 5 | PASS | all images have alt |
| 9 | Compression enabled (gzip/br) | 6 | PASS | HTML Content-Encoding: gzip |
| 10 | Cache-Control policy set | 5 | PASS | Cache-Control: max-age=1200 |
| 11 | Core security headers (4) | 5 | FAIL | present: none; missing: x-content-type-options, x-frame-options, referrer-policy, content-security-policy |
| 12 | HSTS header present | 4 | FAIL | no Strict-Transport-Security — first hop can be downgraded |
| 13 | JSON-LD structured data | 4 | FAIL | no application/ld+json — no rich results in Google |
| 14 | robots.txt served (200) | 5 | PASS | HTTP 200, 70 bytes |
| 15 | sitemap.xml served (200) | 5 | PASS | HTTP 200, 2407 bytes |
| 16 | Time to first byte (informational, not scored) | 0 | INFO | 139 ms (target < 1500 ms) |
Score is the weighted pass ratio: 59 of 102 points = 58/100. Informational rows (weight 0) are reported but not scored, because network latency differs run to run.
2. Executive summary
7 of 15 scored checks failed. Fixing the three items below recovers the majority of the lost score:
- Mobile viewport declared (10 pts, CRITICAL)
- Page title length 8-60 chars (8 pts, HIGH)
- Meta description 40-160 chars (7 pts, HIGH)
3. What is failing
Each item below is a real failure with the evidence that produced it. The remediation steps for each one are in the paid report.
3.1 Mobile viewport declared — CRITICAL (weight 10, 10 points recoverable)
What we found: no <meta name="viewport"> — mobile renders at 980px then shrinks
Why it matters: Without a viewport declaration mobile browsers render the desktop layout at 980px and shrink it. Mobile traffic is typically 60-70% of visits for local businesses.
3.2 Page title length 8-60 chars — HIGH (weight 8, 8 points recoverable)
What we found: no <title> element
Why it matters: The title is the clickable blue line in Google results and the browser tab label. Too short wastes ranking keywords, too long gets truncated at ~60 characters.
3.3 Meta description 40-160 chars — HIGH (weight 7, 7 points recoverable)
What we found: missing — search results show no snippet
Why it matters: The meta description is the grey snippet under the title. Google uses it about 70% of the time and it drives click-through, not ranking directly.
3.4 Exactly one H1 heading — MEDIUM (weight 5, 5 points recoverable)
What we found: 0 H1 element(s) found
Why it matters: The H1 tells both users and crawlers what the page is about. Zero H1 leaves the topic ambiguous; several H1s split the signal and usually signal sloppy templating.
3.5 Core security headers (4) — MEDIUM (weight 5, 5 points recoverable)
What we found: present: none; missing: x-content-type-options, x-frame-options, referrer-policy, content-security-policy
Why it matters: Missing security headers leave clickjacking, MIME-sniffing and cross-site scripting attacks open. They are also checked by every buyer's security questionnaire.
3.6 HSTS header present — MEDIUM (weight 4, 4 points recoverable)
What we found: no Strict-Transport-Security — first hop can be downgraded
Why it matters: Without HSTS the first request of every session can still be downgraded to plain HTTP by an on-path attacker, even though HTTPS is enabled.
3.7 JSON-LD structured data — MEDIUM (weight 4, 4 points recoverable)
What we found: no application/ld+json — no rich results in Google
Why it matters: JSON-LD structured data makes Google show rich results — star ratings, opening hours, FAQ dropdowns, breadcrumbs. Pages with it get measurably higher CTR at the same rank.
4. Method
Each site is fetched with a Chrome user agent and Accept-Encoding: gzip, deflate, following redirects, with a 2 MB body cap. Headers come from the live response; the certificate is read from a real TLS handshake; robots.txt and sitemap.xml are requested at the site root. Every check carries a weight; the score is the weighted pass ratio, rounded to an integer. Reports are reproducible: the same site audited twice yields the same score apart from the informational latency row.
5. Next steps
- Work top-down through section 3 — highest weight first, it is the cheapest score to recover.
- Re-run the audit after each batch of fixes; the score should move on the checks you touched.
- Anything marked CRITICAL should ship this week — those items are actively costing traffic or exposing the site.
_Report generated by AUDIT_BRAND audit pipeline — 2026-10-26 06:12._
