Audit results
Target: https://discoverable.ie
94
Overall
82 passed
16 warnings
19 failed
19 skipped
83
Security
100
GDPR
98
Tech
44
AEO/GEO
77
WCAG
76
Content
Security
83
Cookie Security Flags OWASP A05 Cookies missing security flags — session: missing Secure, SameSite.
Why this mattersEvery cookie should carry Secure (HTTPS-only transmission), HttpOnly (no JavaScript access — defends against XSS theft), and SameSite=Lax or Strict (defends against cross-site request forgery). Session cookies without these flags are an OWASP A05 misconfiguration that turns a small XSS or CSRF into a full account-takeover.
How to fix
Set every cookie with Secure (HTTPS-only), HttpOnly (no JS access), and SameSite=Lax (or Strict). Session cookies in particular must have all three.
HSTS Preload OWASP A02 HSTS header does not include preload directive.
Why this mattersPreloading puts your domain on a list compiled into Chrome, Firefox, and Safari, so HTTPS is enforced even on the very first visit from a fresh device.
How to fix
Add 'preload' to your HSTS header and submit to https://hstspreload.org/.
CSP Quality OWASP A05 CSP script-src allows 'unsafe-inline' or 'unsafe-eval'.
Why this matters'unsafe-inline' and 'unsafe-eval' in a CSP essentially disable the XSS protection it was meant to provide. Modern alternatives — nonces or hashes — give you the same flexibility without the safety hole.
How to fix
Remove 'unsafe-inline' / 'unsafe-eval' and switch to nonces or hashes.
15 more findings in this category — the top 3 fails/warnings are shown above.
Upgrade to see all →
GDPR
100
Privacy Policy Linked Link to a privacy page found in homepage HTML.
Why this mattersGDPR Article 13 requires that visitors are told what personal data you collect, why, and what their rights are. A linked privacy policy is the minimum mechanism. Without one, you're collecting data without consent or notice.
Cookie Consent Signal No CMP detected, and no analytics / advertising / tracking scripts were detected either — no consent is required under GDPR + ePrivacy when nothing non-essential is set. (HTML signal only: runtime cookie behaviour needs a real-browser audit. See gdpr.consent_layer_verified.)
Why this mattersNon-essential cookies (analytics, advertising, tracking pixels) need explicit, prior, freely-given consent under GDPR + the ePrivacy Directive. A consent management platform handles this consistently across pages.
Cookie Policy Present Link to a cookie page found in homepage HTML.
Why this mattersVisitors have a right to know exactly what cookies your site sets — by name, purpose, duration, and third-party sharing. A cookie policy page is where you publish that, separate from the broader privacy policy.
8 more findings in this category — the top 3 fails/warnings are shown above.
Upgrade to see all →
Technical SEO
98
Title Tag Length Title is 62 chars — will likely truncate in SERPs
Why this mattersGoogle typically displays the first 50-60 characters of the title in SERPs. Too short = wasted real estate; too long = SERP truncation (your CTA gets cut off mid-sentence). 50-60 is the sweet spot for primary keyword + brand.
How to fix
• Trim title to 50-60 chars. Keep primary keyword near the start to survive truncation.
Schema.org JSON-LD 2 JSON-LD block(s) parsed successfully.
Why this mattersSchema.org JSON-LD lets search engines understand your page as structured entities — an Organization with a name and address, an Article with a headline and date — not just a wall of text. The foundation of rich results.
robots.txt Present /robots.txt returned 200.
Why this mattersrobots.txt is the standard mechanism for telling crawlers what they can and can't fetch. Without it, crawlers fall back to crawling everything they can find.
27 more findings in this category — the top 3 fails/warnings are shown above.
Upgrade to see all →
AEO / GEO
44
Schema Markup (JSON-LD) No FAQPage schema · No Organization/LocalBusiness schema on homepage
Why this mattersJSON-LD schema.org markup is how AI engines understand entities + facts on the page without inferring from prose. Organization tells them who you are; FAQPage gets you quoted in answers; Service/Offer is how price + scope shows up in agentic-commerce flows. AI engines silently drop blocks that fail to parse, so syntactic validity matters.
How to fix
• Add FAQPage JSON-LD to your FAQ + service pages — primary signal for AI-quoted answers.
• Add Organization (or LocalBusiness) schema to the homepage so engines can identify your business entity.
Article / BlogPosting Schema No Article / BlogPosting schema
Why this mattersArticle (or BlogPosting / NewsArticle) schema with author, datePublished, and headline establishes content provenance. AI engines increasingly weight E-E-A-T signals (Experience, Expertise, Authoritativeness, Trustworthiness) — schema-declared authorship is the cleanest version of that signal.
How to fix
• Add Article JSON-LD on content pages with author, datePublished, and headline — establishes E-E-A-T signals for AI source selection.
Direct Answer in Opening Opening 100 words don't appear to contain a direct definition or answer
Why this mattersAI engines extract the first clear answer they find. If your opening paragraph is throat-clearing ('In today's modern world…') instead of a direct definition, the engine often jumps to a competitor's page that does answer the question up-front.
How to fix
• Rewrite the opening paragraph to lead with a 2-3 sentence direct answer to the page's primary question or topic, then expand below. AI engines extract the first clear answer they find — burying it reduces extraction chance.
30 more findings in this category — the top 3 fails/warnings are shown above.
Upgrade to see all →
Accessibility
77
Interactive Element Semantics (WCAG 4.1.2 A) 8 <div>/<span> with onclick (no role / tabindex)
Why this matters<div onclick=…> looks the same to a sighted user but is invisible to keyboard + screen-reader navigation. Use <button> for buttons, <a href> for links. WCAG 4.1.2 Level A: name + role + value must be programmatically determinable for every interactive element.
How to fix
• Use <button> for buttons and <a href="…"> for navigation. <div onclick=…> isn't keyboard-accessible by default. If you must use a non-semantic element, add role=button + tabindex=0 + keydown handler.
Skip Navigation Link (WCAG 2.4.1 A) No skip navigation link detected
Why this mattersOn every page, keyboard users currently tab through every nav link before reaching the main content. A skip-link as the first focusable element bypasses that. WCAG 2.4.1 Level A: provide a mechanism to bypass blocks of repeated content.
How to fix
• Add `<a href="#main" class="skip-link">Skip to main content</a>` as the first focusable element. Lets keyboard + screen-reader users bypass long nav menus on every page.
ARIA Landmark Regions (WCAG 1.3.6 AAA) Missing landmark(s): main
Why this mattersLandmarks (<main>, <nav>, <header>, <footer>) let screen-reader users jump between page regions with one keystroke. Without them, the page is one undifferentiated wall of content. WCAG 1.3.6 is Level AAA but the practical impact is on every screen-reader visit.
How to fix
• Use HTML5 semantic elements <main>, <nav>, <header>, <footer> (they map to implicit ARIA landmarks). Screen-reader users navigate by these regions — without them, the page is one undifferentiated wall.
15 more findings in this category — the top 3 fails/warnings are shown above.
Upgrade to see all →
Content Quality
76
Framework term in prominent placement (H1 / lede / H2) Framework term appears in first 100 words only.
Why this mattersSearch engines and AI answer engines weight terms in prominent positions — H1, first paragraph, section headers — far more than the same term buried deep in body copy. A framework term below the fold barely counts.
How to fix
Repeat the framework name across at least two of: H1, first 100 words, an H2. Once above the fold + once in a section header is the pattern buyers scan for.
H1 contains a jurisdiction / framework term H1 does not name a framework: "Know Where Your Website Stands on Compliance".
Why this mattersThe H1 is the single strongest ranking + reader-attention signal on the page. A framework-specific H1 ("WCAG 2.2 audits for EU sites") outperforms generic ones ("Accessibility solutions") on every commercial query.
How to fix
Rework the H1 to include the framework you serve (e.g. "WCAG 2.2 accessibility audits for EU sites" rather than "Accessibility solutions"). Framework specificity is what buyers filter on.
Outbound citation to legislation / standards authority No outbound links to legislation / standards / accessibility authorities.
Why this mattersLinking to the primary source (eur-lex, w3.org, ada.gov, iso.org) signals that your framing is grounded in the actual instruments rather than marketing paraphrase. Sites that never cite authorities read as opinion, not expertise.
How to fix
Cite the primary source at least once. Linking to eur-lex.europa.eu, w3.org, ada.gov, iso.org (etc.) signals that your framing is grounded in the actual instruments, not marketing paraphrase.
11 more findings in this category — the top 3 fails/warnings are shown above.
Upgrade to see all →
Like what you see? Audit more sites.
The single-URL scan stays free. Subscribe to manage multiple client sites, track scan history, send branded reports, and generate white-label PDFs for clients.
Starter
€19/mo ex-VAT
- 5 client sites · 25 scans / mo
- Client portal (read-only share)
- Premium PDF + scan history
- 20 client sites · 50 scans / mo
- AEO/GEO + agentic commerce audits
- Client portal (read-only share)
- 50 client sites · 150 scans / mo
- White-label PDF + bulk scheduling
- 10 concurrent scans