Website Audit Report — https://gohugo.io/
Prepared for: Website owner
Prepared by: KSD
Report date: 2026-10-26 15:05
Scope: 16 checks — availability, TLS, performance, security headers, SEO, accessibility, crawlability
Overall score: 65/100 (grade D) — 7 issue(s) found
1. Scorecard
| # | Check | Weight | Result |
|---|---|---|---|
| 1 | Site reachable and serving 2xx/3xx | 15 | PASS |
| 2 | HTTPS enabled | 10 | PASS |
| 3 | TLS certificate valid > 14 days | 8 | PASS |
| 4 | Mobile viewport declared | 10 | FAIL |
| 5 | Page title length 8-60 chars | 8 | PASS |
| 6 | Meta description 40-160 chars | 7 | FAIL |
| 7 | Exactly one H1 heading | 5 | PASS |
| 8 | Every image has alt text | 5 | FAIL |
| 9 | Compression enabled (gzip/br) | 6 | PASS |
| 10 | Cache-Control policy set | 5 | PASS |
| 11 | Core security headers (4) | 5 | FAIL |
| 12 | HSTS header present | 4 | PASS |
| 13 | JSON-LD structured data | 4 | FAIL |
| 14 | robots.txt served (200) | 5 | FAIL |
| 15 | sitemap.xml served (200) | 5 | PASS |
| 16 | Time to first byte (informational, not scored) | 0 | INFO |
Score is the weighted pass ratio: 66 of 102 points = 65/100. Informational rows (weight 0) are reported but not scored, because network latency differs run to run.
2. Executive summary
7 of 15 scored checks failed. Fixing the items below recovers the majority of the lost score:
- Mobile viewport declared (10 pts, HIGH)
- Meta description 40-160 chars (7 pts, MEDIUM)
- Every image has alt text (5 pts, LOW)
- Core security headers (4) (5 pts, LOW)
- robots.txt served (200) (5 pts, LOW)
- JSON-LD structured data (4 pts, LOW)
- Time to first byte (informational, not scored) (0 pts, LOW)
3. What is failing
Each item below is a real failure. The remediation steps for each one are in the paid report.
3.1 Mobile viewport declared — HIGH (weight 10, 10 points recoverable)
What we measured: the viewport check reported a failing result for gohugo.io on 2026-10-26 15:05.
Why it matters: Without a viewport declaration mobile browsers render at desktop width and shrink the page, which loses mobile readers.
Evidence: the detailed evidence string for this check was not retained in the public dataset, so it is not restated here rather than guessed.
3.2 Meta description 40-160 chars — MEDIUM (weight 7, 7 points recoverable)
What we measured: the description check reported a failing result for gohugo.io on 2026-10-26 15:05.
Why it matters: The meta description is the snippet under the title; a missing one lets the search engine pick arbitrary text.
Evidence: the detailed evidence string for this check was not retained in the public dataset, so it is not restated here rather than guessed.
3.3 Every image has alt text — LOW (weight 5, 5 points recoverable)
What we measured: the img_alt check reported a failing result for gohugo.io on 2026-10-26 15:05.
Why it matters: Missing alt text loses image search traffic and makes the page unusable with a screen reader.
Evidence: the detailed evidence string for this check was not retained in the public dataset, so it is not restated here rather than guessed.
3.4 Core security headers (4) — LOW (weight 5, 5 points recoverable)
What we measured: the headers check reported a failing result for gohugo.io on 2026-10-26 15:05.
Why it matters: The core security headers are the cheap, one-line defences against clickjacking, MIME sniffing and referrer leaks.
Evidence: the detailed evidence string for this check was not retained in the public dataset, so it is not restated here rather than guessed.
3.5 JSON-LD structured data — LOW (weight 4, 4 points recoverable)
What we measured: the jsonld check reported a failing result for gohugo.io on 2026-10-26 15:05.
Why it matters: Structured data is what lets a result show ratings, breadcrumbs or step lists instead of a bare link.
Evidence: the detailed evidence string for this check was not retained in the public dataset, so it is not restated here rather than guessed.
3.6 robots.txt served (200) — LOW (weight 5, 5 points recoverable)
What we measured: the robots check reported a failing result for gohugo.io on 2026-10-26 15:05.
Why it matters: A missing robots.txt leaves crawler behaviour undefined and is the usual cause of a page not being indexed.
Evidence: the detailed evidence string for this check was not retained in the public dataset, so it is not restated here rather than guessed.
3.7 Time to first byte (informational, not scored) — LOW (weight 0, 0 points recoverable)
What we measured: the ttfb check reported a failing result for gohugo.io on 2026-10-26 15:05.
Why it matters: Time to first byte is informational: it moves run to run and is never scored.
Evidence: the detailed evidence string for this check was not retained in the public dataset, so it is not restated here rather than guessed.
4. Method and limits
- Every check is a single HTTP fetch of the public page plus response header inspection. Nothing was crawled behind a login or written to.
- The score is a weighted pass ratio out of 102 points, normalised to 100. Checks with weight 0 are informational only.
- Timing-derived checks vary between runs and are never scored.
- This report is public and withholds the per-item fix steps; those are in the paid deliverable.
5. Next steps
- The HIGH and MEDIUM items above are the ones that cost score fastest.
- Re-run the audit after a change to confirm the score moved.
- Anything marked CRITICAL should ship this week.
_Report generated by KSD audit pipeline — 2026-10-26 15:05._
