Website Audit Report — https://example.com
Prepared for: Website owner
Prepared by: AUDIT_BRAND
Report date: 2026-10-26 06:02
Scope: 16 checks — availability, TLS, performance, security headers, SEO, accessibility, crawlability
Overall score: 51/100 (grade E) — 9 issue(s) found
1. Scorecard
| # | Check | Weight | Result | Evidence |
|---|---|---|---|---|
| 1 | Site reachable and serving 2xx/3xx | 15 | PASS | HTTP 200 in 111 ms, 400 bytes transferred |
| 2 | HTTPS enabled | 10 | PASS | Served over HTTPS |
| 3 | TLS certificate valid > 14 days | 8 | PASS | expires 2026-12-25 (60 days left) |
| 4 | Mobile viewport declared | 10 | FAIL | no <meta name="viewport"> — mobile renders at 980px then shrinks |
| 5 | Page title length 8-60 chars | 8 | PASS | "Example Domain" — 14 chars (target 15-35) |
| 6 | Meta description 40-160 chars | 7 | FAIL | missing — search results show no snippet |
| 7 | Exactly one H1 heading | 5 | FAIL | 0 H1 element(s) found |
| 8 | Every image has alt text | 5 | PASS | all images have alt |
| 9 | Compression enabled (gzip/br) | 6 | PASS | HTML Content-Encoding: gzip |
| 10 | Cache-Control policy set | 5 | FAIL | no Cache-Control header |
| 11 | Core security headers (4) | 5 | FAIL | present: none; missing: x-content-type-options, x-frame-options, referrer-policy, content-security-policy |
| 12 | HSTS header present | 4 | FAIL | no Strict-Transport-Security — first hop can be downgraded |
| 13 | JSON-LD structured data | 4 | FAIL | no application/ld+json — no rich results in Google |
| 14 | robots.txt served (200) | 5 | FAIL | unreachable — HTTPError: HTTP Error 404: Not Found |
| 15 | sitemap.xml served (200) | 5 | FAIL | unreachable — HTTPError: HTTP Error 404: Not Found |
| 16 | Time to first byte (informational, not scored) | 0 | INFO | 111 ms (target < 1500 ms) |
Score is the weighted pass ratio: 52 of 102 points = 51/100. Informational rows (weight 0) are reported but not scored, because network latency differs run to run.
2. Executive summary
9 of 15 scored checks failed. Fixing the three items below recovers the majority of the lost score:
- Mobile viewport declared (10 pts, CRITICAL)
- Meta description 40-160 chars (7 pts, HIGH)
- Cache-Control policy set (5 pts, MEDIUM)
3. What is failing
Each item below is a real failure with the evidence that produced it. The remediation steps for each one are in the paid report.
3.1 Mobile viewport declared — CRITICAL (weight 10, 10 points recoverable)
What we found: no <meta name="viewport"> — mobile renders at 980px then shrinks
Why it matters: Without a viewport declaration mobile browsers render the desktop layout at 980px and shrink it. Mobile traffic is typically 60-70% of visits for local businesses.
3.2 Meta description 40-160 chars — HIGH (weight 7, 7 points recoverable)
What we found: missing — search results show no snippet
Why it matters: The meta description is the grey snippet under the title. Google uses it about 70% of the time and it drives click-through, not ranking directly.
3.3 Cache-Control policy set — MEDIUM (weight 5, 5 points recoverable)
What we found: no Cache-Control header
Why it matters: Without Cache-Control the browser re-downloads assets on every visit and CDNs cannot serve repeat visitors from the edge. This is the cheapest speed win available.
3.4 Exactly one H1 heading — MEDIUM (weight 5, 5 points recoverable)
What we found: 0 H1 element(s) found
Why it matters: The H1 tells both users and crawlers what the page is about. Zero H1 leaves the topic ambiguous; several H1s split the signal and usually signal sloppy templating.
3.5 Core security headers (4) — MEDIUM (weight 5, 5 points recoverable)
What we found: present: none; missing: x-content-type-options, x-frame-options, referrer-policy, content-security-policy
Why it matters: Missing security headers leave clickjacking, MIME-sniffing and cross-site scripting attacks open. They are also checked by every buyer's security questionnaire.
3.6 robots.txt served (200) — MEDIUM (weight 5, 5 points recoverable)
What we found: unreachable — HTTPError: HTTP Error 404: Not Found
Why it matters: robots.txt is the first file every crawler fetches. A missing or blocking file can silently deindex the whole site; a 404 also means no sitemap discovery hint.
3.7 sitemap.xml served (200) — MEDIUM (weight 5, 5 points recoverable)
What we found: unreachable — HTTPError: HTTP Error 404: Not Found
Why it matters: A sitemap is how you hand Google the full URL list at once instead of waiting for crawls to discover pages. New and orphaned pages depend on it.
3.8 HSTS header present — MEDIUM (weight 4, 4 points recoverable)
What we found: no Strict-Transport-Security — first hop can be downgraded
Why it matters: Without HSTS the first request of every session can still be downgraded to plain HTTP by an on-path attacker, even though HTTPS is enabled.
3.9 JSON-LD structured data — MEDIUM (weight 4, 4 points recoverable)
What we found: no application/ld+json — no rich results in Google
Why it matters: JSON-LD structured data makes Google show rich results — star ratings, opening hours, FAQ dropdowns, breadcrumbs. Pages with it get measurably higher CTR at the same rank.
4. Method
Each site is fetched with a Chrome user agent and Accept-Encoding: gzip, deflate, following redirects, with a 2 MB body cap. Headers come from the live response; the certificate is read from a real TLS handshake; robots.txt and sitemap.xml are requested at the site root. Every check carries a weight; the score is the weighted pass ratio, rounded to an integer. Reports are reproducible: the same site audited twice yields the same score apart from the informational latency row.
5. Next steps
- Work top-down through section 3 — highest weight first, it is the cheapest score to recover.
- Re-run the audit after each batch of fixes; the score should move on the checks you touched.
- Anything marked CRITICAL should ship this week — those items are actively costing traffic or exposing the site.
_Report generated by AUDIT_BRAND audit pipeline — 2026-10-26 06:02._
