Website Audit Report — https://proton.me/
Prepared for: Website owner
Prepared by: KSD
Report date: 2026-10-26 15:05
Scope: 16 checks — availability, TLS, performance, security headers, SEO, accessibility, crawlability
Overall score: 95/100 (grade A) — 2 issue(s) found
1. Scorecard
| # | Check | Weight | Result |
|---|---|---|---|
| 1 | Site reachable and serving 2xx/3xx | 15 | PASS |
| 2 | HTTPS enabled | 10 | PASS |
| 3 | TLS certificate valid > 14 days | 8 | PASS |
| 4 | Mobile viewport declared | 10 | PASS |
| 5 | Page title length 8-60 chars | 8 | PASS |
| 6 | Meta description 40-160 chars | 7 | PASS |
| 7 | Exactly one H1 heading | 5 | PASS |
| 8 | Every image has alt text | 5 | PASS |
| 9 | Compression enabled (gzip/br) | 6 | PASS |
| 10 | Cache-Control policy set | 5 | PASS |
| 11 | Core security headers (4) | 5 | FAIL |
| 12 | HSTS header present | 4 | PASS |
| 13 | JSON-LD structured data | 4 | PASS |
| 14 | robots.txt served (200) | 5 | PASS |
| 15 | sitemap.xml served (200) | 5 | PASS |
| 16 | Time to first byte (informational, not scored) | 0 | INFO |
Score is the weighted pass ratio: 97 of 102 points = 95/100. Informational rows (weight 0) are reported but not scored, because network latency differs run to run.
2. Executive summary
2 of 15 scored checks failed. Fixing the items below recovers the majority of the lost score:
- Core security headers (4) (5 pts, LOW)
- Time to first byte (informational, not scored) (0 pts, LOW)
3. What is failing
Each item below is a real failure. The remediation steps for each one are in the paid report.
3.1 Core security headers (4) — LOW (weight 5, 5 points recoverable)
What we measured: the headers check reported a failing result for proton.me on 2026-10-26 15:05.
Why it matters: The core security headers are the cheap, one-line defences against clickjacking, MIME sniffing and referrer leaks.
Evidence: the detailed evidence string for this check was not retained in the public dataset, so it is not restated here rather than guessed.
3.2 Time to first byte (informational, not scored) — LOW (weight 0, 0 points recoverable)
What we measured: the ttfb check reported a failing result for proton.me on 2026-10-26 15:05.
Why it matters: Time to first byte is informational: it moves run to run and is never scored.
Evidence: the detailed evidence string for this check was not retained in the public dataset, so it is not restated here rather than guessed.
4. Method and limits
- Every check is a single HTTP fetch of the public page plus response header inspection. Nothing was crawled behind a login or written to.
- The score is a weighted pass ratio out of 102 points, normalised to 100. Checks with weight 0 are informational only.
- Timing-derived checks vary between runs and are never scored.
- This report is public and withholds the per-item fix steps; those are in the paid deliverable.
5. Next steps
- The HIGH and MEDIUM items above are the ones that cost score fastest.
- Re-run the audit after a change to confirm the score moved.
- Anything marked CRITICAL should ship this week.
_Report generated by KSD audit pipeline — 2026-10-26 15:05._
