High-leverage changes that don't need a project plan. Effort figures are indicative. Copy any card as ticket text with one click.
Prioritised by severity, impact, effort, confidence and simple dependency order. Owner suggestions are heuristic; adjust to your team. Effort figures are indicative.
plus 6 further items, prioritised in the findings table
Showing all findings across every owner. Pick a tab above to retell the same audit through one role's lens.
Search, filter, sort and expand findings. Results update without leaving this report.
21 findings shown after filtering and sorting.
| Owner | ||||||||
|---|---|---|---|---|---|---|---|---|
| Critical | No analytics tracking detected Specialist | Tracking and data | Data Team | 9/10 | 3h | |||
| High | Missing Organisation structured data DIY | SEO health | Web/CMS | 7/10 | 3h | |||
| High | No high-intent call-to-action for this type of site Specialist | Conversion readiness | Marketing Ops | 7/10 | 4h | |||
| High | No pricing information or honest expectation-setting found Specialist | Conversion readiness | Marketing Ops | 7/10 | 4h | |||
| Medium | Images are not served in modern formats DIY | Performance and Core Web Vitals | Web/CMS | 5/10 | 4h | |||
| Medium | Page measurably overflows a phone viewport DIY | Performance and Core Web Vitals | Web/CMS | 5/10 | 2h | |||
| Medium | Pages are missing canonical tags DIY | SEO health | Web/CMS | 5/10 | 4h | |||
| Medium | Internal linking is sparse DIY | SEO health | Marketing Ops | 5/10 | 4h | |||
| Medium | No content date metadata found anywhere on the site DIY | AI discovery readiness | Web/CMS | 5/10 | 2h | |||
| Medium | Missing Content-Security-Policy header Specialist | Trust and security | IT/Security | 5/10 | 2h | |||
| Medium | Missing X-Frame-Options protection Specialist | Trust and security | IT/Security | 5/10 | 2h | |||
| Medium | No terms of service or legal page found Specialist | Trust and security | IT/Security | 5/10 | 4h | |||
| Low | Title tags are suboptimal length DIY | SEO health | Web/CMS | 3/10 | 1h | |||
| Low | Meta descriptions are suboptimal length DIY | SEO health | Web/CMS | 3/10 | 1h | |||
| Low | Missing X-Content-Type-Options header Specialist | Trust and security | IT/Security | 3/10 | 2h | |||
| Low | Missing Referrer-Policy header Specialist | Trust and security | IT/Security | 3/10 | 2h | |||
| Low | Missing Permissions-Policy header Specialist | Trust and security | IT/Security | 3/10 | 2h | |||
| Low | No visible company identity information DIY | Trust and security | Marketing Ops | 3/10 | 1h | |||
| Low | No skip-navigation link found DIY | Accessibility | Web/CMS | 3/10 | 2h | |||
| Info | Possible content-coverage gaps against homepage offerings (hypothesis only) | AI discovery readiness | Marketing Ops | Non-scored | Not estimated | |||
| Info | No lead capture mechanism found | Conversion readiness | Marketing Ops | Non-scored | Not estimated |
Higher is better. The shaded shape is this site; the dashed line is the portfolio median for brochure websites SpotCheck has audited.
Strongest category: Accessibility at 96/100. Lowest category: Trust and security at 58/100. A reliable compatible benchmark is not available for this chart.
| Category | This site |
|---|---|
| Performance and Core Web Vitals | 88/100 |
| SEO health | 67/100 |
| AI discovery readiness | 92/100 |
| Conversion readiness | 70/100 |
| Trust and security | 58/100 |
| Accessibility | 96/100 |
| Tracking and data | 75/100 |
Benchmark values appear only for compatible cohorts with enough retained audits to be reliable.
Categories down, severities across. Cell intensity scales with finding count.
| Critical | High | Medium | Low | Info | Total | |
|---|---|---|---|---|---|---|
| Performance and Core Web Vitals | 0 | 0 | 2 | 0 | 0 | 2 |
| SEO health | 0 | 1 | 2 | 2 | 0 | 5 |
| AI discovery readiness | 0 | 0 | 1 | 0 | 1 | 2 |
| Conversion readiness | 0 | 2 | 0 | 0 | 1 | 3 |
| Trust and security | 0 | 0 | 3 | 4 | 0 | 7 |
| Accessibility | 0 | 0 | 0 | 1 | 0 | 1 |
| Tracking and data | 1 | 0 | 0 | 0 | 0 | 1 |
Each category is scored out of 100 and contributes to the overall grade by its weight. The rationale explains what moved each score.
| Category | Grade | Score | Weight | Confidence | Why |
|---|---|---|---|---|---|
| Performance and Core Web Vitals | B | 88 | 16% | Medium | Public field Core Web Vitals were unavailable; no points were lost for missing CrUX coverage. Lighthouse lab diagnostics were unavailable; no lab deduction was applied. Images are not served in modern formats. Page measurably overflows a phone viewport. |
| SEO health | C | 67 | 18% | Medium | Title tags are suboptimal length. Meta descriptions are suboptimal length. Pages are missing canonical tags. Internal linking is sparse. Missing Organisation structured data. |
| AI discovery readiness | A | 92 | 14% | Medium | No crawler-specific policy from crawler-purpose-matrix-v1-2026-07-12 was declared. This is informational and does not affect the score. No llms.txt proposal file was detected. The file is optional and experimental, and Google documents no Search visibility or ranking effect; no score or recommendation is affected. The answer-first paragraph check was skipped: fewer than 10 paragraphs were available to sample. No content date metadata found anywhere on the site. No citation-style source links (<cite> elements or citation-worded links) were observed in the sampled pages. This is a factual observation, not a quality score. |
| Conversion readiness | C | 70 | 18% | High | No high-intent call-to-action for this type of site. No pricing information or honest expectation-setting found. |
| Trust and security | D | 58 | 14% | Medium | Missing Content-Security-Policy header. Missing X-Frame-Options protection. Missing X-Content-Type-Options header. Missing Referrer-Policy header. Missing Permissions-Policy header. No terms of service or legal page found. No visible company identity information. |
| Accessibility | A | 96 | 12% | Medium | No skip-navigation link found. Axe-core rendered accessibility evidence was unavailable; no points were lost for missing automation coverage. Rendered keyboard, reflow and target-size smoke evidence was unavailable; no points were lost for missing smoke-test coverage. |
| Tracking and data | C | 75 | 8% | High | No analytics tracking detected. |
Each dot is a finding. Top-left means quick wins and top-right means strategic projects. Use the chart or the finding controls below to jump to a finding.
12 plotted findings look like quick wins. Highest plotted impact: No analytics tracking detected, 9/10 impact and about 3 hours.
| Finding | Severity | Impact | Effort | Owner |
|---|---|---|---|---|
| Images are not served in modern formats | medium | 5/10 | 4 hours | Web/CMS |
| Page measurably overflows a phone viewport | medium | 5/10 | 2 hours | Web/CMS |
| Title tags are suboptimal length | low | 3/10 | 1 hours | Web/CMS |
| Meta descriptions are suboptimal length | low | 3/10 | 1 hours | Web/CMS |
| Pages are missing canonical tags | medium | 5/10 | 4 hours | Web/CMS |
| Internal linking is sparse | medium | 5/10 | 4 hours | Marketing Ops |
| Missing Organisation structured data | high | 7/10 | 3 hours | Web/CMS |
| No content date metadata found anywhere on the site | medium | 5/10 | 2 hours | Web/CMS |
| No high-intent call-to-action for this type of site | high | 7/10 | 4 hours | Marketing Ops |
| No pricing information or honest expectation-setting found | high | 7/10 | 4 hours | Marketing Ops |
| Missing Content-Security-Policy header | medium | 5/10 | 2 hours | IT/Security |
| Missing X-Frame-Options protection | medium | 5/10 | 2 hours | IT/Security |
| Missing X-Content-Type-Options header | low | 3/10 | 2 hours | IT/Security |
| Missing Referrer-Policy header | low | 3/10 | 2 hours | IT/Security |
| Missing Permissions-Policy header | low | 3/10 | 2 hours | IT/Security |
| No terms of service or legal page found | medium | 5/10 | 4 hours | IT/Security |
| No visible company identity information | low | 3/10 | 1 hours | Marketing Ops |
| No skip-navigation link found | low | 3/10 | 2 hours | Web/CMS |
| No analytics tracking detected | critical | 9/10 | 3 hours | Data Team |
high confidence · deterministic · website-site-classifier-v2
CrUX field evidence records public, real-user p75 Core Web Vitals. Lighthouse lab evidence is a controlled diagnostic run. Lab Total Blocking Time is not a Core Web Vital and is not field INP. Deterministic scoring may use this evidence; this display does not apply any additional score or grade adjustment.
Synthetic fixture. No screenshot or model review is required.
Coverage, evidence and the deterministic rule trail. Closed by default so the results stay in front.
Wholly synthetic golden fixture. Wholly synthetic fixture. No customer or anonymised production data is used.
Public evidence limits. SpotCheck cannot know traffic volume, organic or keyword positions, backlink authority, market share, conversion performance or all-assistant share of voice from this audit. No third-party analytics or search account connection is required. Policy spotcheck-public-claims-v2.
Each deterministic rule records its outcome and the evidence it used. Checks that could not run are omitted here rather than shown as errors; they never count as a pass and never lower the score. The coverage summary above accounts for those gaps.
spotcheck-methodology-v2deterministic-rule-registry-v2website-scorer-v16-rendered-instrumentationwebsite-score-evidence-v1deterministic-evidence-ledger-v22181a4ec2bd835caf4c70a0189af961cd56ebe372ad26073c72f9f656cd05a8aInspect a bounded sample of visible FAQ question-and-answer pairs without judging factual accuracy.
website.check.conversion.faq-context.v1website.check.conversion.faq-context.v1, non-scored contextCompare visible calls to action with the deterministic vocabulary for the classified site type.
website.check.conversion.primary-cta.v1website.check.conversion.primary-cta.v1, available evidence requiredCount visible fields in conversion-relevant forms across the bounded page sample.
website.check.conversion.form-length.v1website.check.conversion.form-length.v1, available evidence requiredClassify observed form purpose and inspect required-state, autocomplete and error-association cues without submitting the form.
website.check.conversion.form-validation-cues.v1website.check.conversion.form-validation-cues.v1, available evidence requiredInspect declared form actions for HTTPS and disclosed third-party destinations without sending data.
website.check.conversion.form-destination-security.v1website.check.conversion.form-destination-security.v1, available evidence requiredInspect homepage and discovered pricing content for numbers or deterministic expectation-setting language.
website.check.conversion.pricing-expectation.v1website.check.conversion.pricing-expectation.v1, available evidence requiredInspect the bounded rendered-preferred page sample for forms, newsletters or gated resources.
website.check.conversion.lead-capture-presence.v1website.check.conversion.lead-capture-presence.v1, non-scored contextCompare downloadable-resource signals with observed email/newsletter capture.
website.check.conversion.lead-magnet-gating.v1website.check.conversion.lead-magnet-gating.v1, non-scored contextRecord whether effective robots rules prevent the audit crawler from crawling beyond the submitted page.
website.check.seo.spotcheckbot-policy.v1website.check.seo.spotcheckbot-policy.v1, non-scored contextCheck the conventional robots.txt location.
website.check.seo.robots-presence.v1website.check.seo.robots-presence.v1, available evidence requiredCount discovered pages skipped because the audit crawler was disallowed.
website.check.seo.robots-partial-coverage.v1website.check.seo.robots-partial-coverage.v1, non-scored contextCheck conventional and robots-declared sitemap evidence and validate the XML root.
website.check.seo.sitemap.v1website.check.seo.sitemap.v1, available evidence requiredInspect homepage meta robots and X-Robots-Tag evidence.
website.check.seo.homepage-noindex.v1website.check.seo.homepage-noindex.v1, available evidence requiredInspect non-homepage, non-utility pages for noindex directives.
website.check.seo.content-noindex.v1website.check.seo.content-noindex.v1, available evidence requiredMeasure canonical-tag coverage across parseable deep pages.
website.check.seo.canonical-coverage.v1website.check.seo.canonical-coverage.v1, available evidence requiredCompare each observed canonical path with its page path.
website.check.seo.canonical-target.v1website.check.seo.canonical-target.v1, available evidence requiredCompare sampled sitemap URLs with status, redirect, robots and noindex evidence.
website.check.seo.sitemap-url-state.v1website.check.seo.sitemap-url-state.v1, available evidence requiredCount analysed pages with an empty or absent title.
website.check.seo.title-presence.v1website.check.seo.title-presence.v1, available evidence requiredMeasure title length on analysed pages.
website.check.seo.title-length.v1website.check.seo.title-length.v1, available evidence requiredGroup normalised title text across analysed pages.
website.check.seo.title-duplicates.v1website.check.seo.title-duplicates.v1, available evidence requiredCount analysed pages without a meta description.
website.check.seo.meta-presence.v1website.check.seo.meta-presence.v1, available evidence requiredMeasure meta-description length on analysed pages.
website.check.seo.meta-length.v1website.check.seo.meta-length.v1, available evidence requiredGroup normalised meta-description text across analysed pages.
website.check.seo.meta-duplicates.v1website.check.seo.meta-duplicates.v1, available evidence requiredCount analysed pages without an H1.
website.check.seo.h1-presence.v1website.check.seo.h1-presence.v1, available evidence requiredCount analysed pages with more than one H1.
website.check.seo.h1-multiple.v1website.check.seo.h1-multiple.v1, available evidence requiredMeasure site-wide alt-text coverage across observed images.
website.check.seo.alt-coverage.v1website.check.seo.alt-coverage.v1, available evidence requiredCompare static and rendered title availability.
website.check.seo.static-tag-availability.v1website.check.seo.static-tag-availability.v1, non-scored contextCompare static and rendered title, meta, headings, content, canonical, robots, links and structured data.
website.check.seo.static-rendered-reconciliation.v1website.check.seo.static-rendered-reconciliation.v1, available evidence requiredCompare static and rendered navigation evidence and reject all-page artefacts.
website.check.seo.link-graph-reliability.v1website.check.seo.link-graph-reliability.v1, non-scored contextMeasure average inbound internal links in the bounded graph.
website.check.seo.inbound-density.v1website.check.seo.inbound-density.v1, available evidence requiredCount graph nodes with no inbound internal links.
website.check.seo.orphan-pages.v1website.check.seo.orphan-pages.v1, available evidence requiredMeasure the maximum link distance from the homepage.
website.check.seo.click-depth.v1website.check.seo.click-depth.v1, available evidence requiredCount discovered pages not reachable from the homepage through internal links.
website.check.seo.unreachable-pages.v1website.check.seo.unreachable-pages.v1, available evidence requiredInspect parsed JSON-LD for Organization or applicable LocalBusiness types.
website.check.seo.organisation-schema.v1website.check.seo.organisation-schema.v1, available evidence requiredCount malformed non-FAQ JSON-LD blocks.
website.check.seo.malformed-jsonld.v1website.check.seo.malformed-jsonld.v1, available evidence requiredCount malformed FAQPage blocks separately from score-bearing structured data.
website.check.seo.faq-jsonld-neutrality.v1website.check.seo.faq-jsonld-neutrality.v1, non-scored contextNormalise JSON-LD arrays, nested objects and @graph entities, then validate required high-value properties.
website.check.seo.structured-data-graph-validity.v1website.check.seo.structured-data-graph-validity.v1, available evidence requiredCompare high-value schema facts with visible page content where deterministic comparison is possible.
website.check.seo.structured-data-visible-consistency.v1website.check.seo.structured-data-visible-consistency.v1, available evidence requiredCount distinct third-party script origins in the rendered homepage.
website.check.performance.third-party-origin-count.v1website.check.performance.third-party-origin-count.v1, available evidence requiredInspect rendered homepage head scripts for synchronous third-party loading.
website.check.performance.render-blocking-third-party.v1website.check.performance.render-blocking-third-party.v1, available evidence requiredMeasure modern-format alternatives on the first offending analysed page.
website.check.performance.modern-image-format.v1website.check.performance.modern-image-format.v1, available evidence requiredInspect homepage image count and lazy-loading attributes.
website.check.performance.lazy-loading.v1website.check.performance.lazy-loading.v1, available evidence requiredInspect every analysed page for a viewport meta tag.
website.check.performance.viewport-presence.v1website.check.performance.viewport-presence.v1, available evidence requiredInspect every observed viewport value for width=device-width.
website.check.performance.viewport-device-width.v1website.check.performance.viewport-device-width.v1, available evidence requiredInspect viewport values for user-scalable=no or maximum-scale=1.
website.check.performance.zoom-enabled.v1website.check.performance.zoom-enabled.v1, available evidence requiredMeasure document scroll width against a rendered 390px phone viewport with Playwright.
website.check.performance.horizontal-scroll.v1website.check.performance.horizontal-scroll.v1, available evidence requiredCompare blocked crawler user agents with the versioned owner-source capability registry.
website.check.ai.discovery-crawler-policy.v1website.check.ai.discovery-crawler-policy.v1, available evidence requiredRecord training, user-triggered, general or unknown crawler policies separately.
website.check.ai.neutral-crawler-policy.v1website.check.ai.neutral-crawler-policy.v1, non-scored contextRecord fetch status and representation for the experimental llms.txt proposal.
website.check.ai.llms-txt.v1website.check.ai.llms-txt.v1, non-scored contextCount missing H1 pages not already owned by the SEO deduction.
website.check.ai.content-h1.v1website.check.ai.content-h1.v1, available evidence requiredCount heading-level skips not already owned by another scored check.
website.check.ai.heading-nesting.v1website.check.ai.heading-nesting.v1, available evidence requiredInspect published, modified, time-element and Last-Modified evidence at the audit timestamp.
website.check.ai.date-metadata-freshness.v1website.check.ai.date-metadata-freshness.v1, available evidence requiredCluster sampled deep pages by page role and a normalised main-text token signature after boilerplate removal.
website.check.ai.template-duplicates.v1website.check.ai.template-duplicates.v1, available evidence requiredMeasure main-text word count, after boilerplate removal, for pages that share a repeated template.
website.check.ai.thin-template-content.v1website.check.ai.thin-template-content.v1, available evidence requiredInspect sampled pages for <cite> elements and citation-worded links to external references.
website.check.ai.content-sources.v1website.check.ai.content-sources.v1, non-scored contextCompare homepage-stated offerings with sampled non-homepage page text and titles.
website.check.ai.content-coverage-hypothesis.v1website.check.ai.content-coverage-hypothesis.v1, non-scored contextCompare the submitted scheme with observed HTTPS reachability.
website.check.trust.https.v1website.check.trust.https.v1, available evidence requiredInspect the homepage Strict-Transport-Security response header on HTTPS sites.
website.check.trust.hsts.v1website.check.trust.hsts.v1, available evidence requiredInspect the homepage Content-Security-Policy response header.
website.check.trust.csp.v1website.check.trust.csp.v1, available evidence requiredInspect X-Frame-Options and CSP frame-ancestors evidence.
website.check.trust.frame-protection.v1website.check.trust.frame-protection.v1, available evidence requiredInspect the homepage X-Content-Type-Options response header.
website.check.trust.content-type-protection.v1website.check.trust.content-type-protection.v1, available evidence requiredInspect the homepage Referrer-Policy response header.
website.check.trust.referrer-policy.v1website.check.trust.referrer-policy.v1, available evidence requiredInspect the homepage Permissions-Policy response header.
website.check.trust.permissions-policy.v1website.check.trust.permissions-policy.v1, available evidence requiredInspect Server and X-Powered-By headers for version-number exposure without retaining their values.
website.check.trust.server-fingerprint.v1website.check.trust.server-fingerprint.v1, available evidence requiredInspect same-site paths and homepage anchors for a privacy policy.
website.check.trust.privacy-policy.v1website.check.trust.privacy-policy.v1, available evidence requiredInspect same-site paths and homepage anchors for terms or legal content.
website.check.trust.terms-page.v1website.check.trust.terms-page.v1, available evidence requiredCompare bounded technical observations from isolated browser contexts before choice, after reject and after accept.
website.check.trust.cookie-consent.v1website.check.trust.cookie-consent.v1, available evidence requiredInspect analysed page text and homepage context for deterministic company-identity signals.
website.check.trust.company-identity.v1website.check.trust.company-identity.v1, available evidence requiredApply the deterministic CMS confidence rule to homepage evidence.
website.check.trust.cms-detection.v1website.check.trust.cms-detection.v1, non-scored contextMeasure alt-text coverage and coordinate with the SEO owner check.
website.check.accessibility.alt-coverage.v1website.check.accessibility.alt-coverage.v1, available evidence requiredCount pages with fewer than two semantic or ARIA landmarks.
website.check.accessibility.landmarks.v1website.check.accessibility.landmarks.v1, available evidence requiredInspect analysed pages for a skip-to-content link.
website.check.accessibility.skip-link.v1website.check.accessibility.skip-link.v1, available evidence requiredCount analysed pages without a non-empty html lang attribute.
website.check.accessibility.language.v1website.check.accessibility.language.v1, available evidence requiredCount analysed pages that skip heading levels.
website.check.accessibility.heading-hierarchy.v1website.check.accessibility.heading-hierarchy.v1, available evidence requiredInspect the public technology scan for recognised measurement platforms.
website.check.tracking.analytics.v1website.check.tracking.analytics.v1, available evidence requiredCount general-purpose analytics platforms and suppress the signal when a migration marker is observed.
website.check.tracking.overlapping-platforms.v1website.check.tracking.overlapping-platforms.v1, non-scored contextThese records identify the bounded source used by each completed check. They contain labels and non-identifying page roles, not raw customer payloads. Sources that could not be collected are omitted.
An honest read on how complete this run was. A skipped or unavailable check reduces what could be assessed, not the score. Common causes include a page not loading, crawling being blocked, or public performance data being unavailable.
SpotCheck® also runs a free HubSpot portal audit covering security, data quality, automation, and whether you're getting full value from your licence tier.
Audit a HubSpot portal