Your position
7th percentile of 15 sites audited. The average site scores 67, the median 66.
Website audit report
1 critical and 6 high-severity issues found across 61 checks.
Scanned 2026-08-17T02:48:28+00:00 · 4 host IPs · cert expires in 71 days
This report is not offered to search engines. It is reachable by link only. If you own example.net you can publish or delete it.
Measured against every site SEOking has audited: a corpus that grows with each scan and cannot be reconstructed after the fact.
7th percentile of 15 sites audited. The average site scores 67, the median 66.
HTTP redirects to HTTPS
80% of the sites we have audited get this right and yours does not. Of everything on this report, it is the fault that most sets you apart from your competition, which makes it the first thing worth fixing.
Our own measure of whether your domain is trusted by the systems that decide if mail reaches an inbox. No other website audit reports this. It is built from BounceZero's deliverability platform.
Solid foundations, with a few gaps worth closing.
We have measured deliverability across 209,176 domains. Yours is not among them, which simply means no one has needed to verify an address at it. The score above is from live measurements of your own DNS.
For context, 2.2% of the domains we have measured accept mail to any address, which makes their bounce behaviour unpredictable.
Oldest on the left. Every re-run is kept.
The 27 faults on this report come from 8 underlying causes. Fixing a cause fixes everything under it, so this is ordered by score returned per unit of work, not by severity alone.
The 5 quickest steps here take you from 61 to about 76. That is 15 points for changes measured in minutes and hours, not weeks.
One block of structured data in your site template carries all of these. It is what map and 'near me' results are assembled from.
Fixes 7 findings: Business marked up as a local business · Postal address is machine-readable · Opening hours are published · Phone number in structured data · Review rating marked up · Geo coordinates published · Map or directions link present
All set in the same place — your web server or CDN. Half of them are single lines.
Fixes 6 findings: HTTP redirects to HTTPS · HSTS header · Content Security Policy header · MIME sniffing protection header · Clickjacking protection header · Referrer policy header
These are all records in your DNS. One editing session fixes every one of them, and it is the change most likely to stop your mail being filtered.
Fixes 4 findings: DMARC reports are collected · MTA-STS policy published · TLS reporting enabled · BIMI logo published
These decide whether your pages can appear at all. Nothing else on this report matters until they are right.
Fixes 2 findings: XML sitemap published · Homepage canonical is correct
Most local searches happen on a phone. A number that cannot be tapped loses the call at the exact moment someone decided to ring.
Fixes 3 findings: Phone number is tap-to-call · Contact route is obvious · Social profiles linked
A subdomain pointing at a service that released it can be claimed by anyone, who then publishes on your domain. Deleting the record costs nothing and closes it immediately.
Fixes 1 finding: No lookalike domain can send mail as your brand
Your title and description are the advert Google runs for you, free, every time someone searches.
Fixes 3 findings: Homepage meta description is present · Structured data present · Social preview configured
Resilience and reputation work — lower urgency, but cheap while you are already in these systems.
Fixes 1 finding: CAA record restricts certificate issuance
Ranked by severity, then by how much score each returns.
No LocalBusiness structured data anywhere on the site. Google builds map and 'near me' results from this markup — without it you are relying entirely on your Google Business Profile and third-party directories to be found locally.
How to fix: Add LocalBusiness JSON-LD with name, address, phone, opening hours and geo coordinates.
Reference: schema.org/LocalBusiness
No tel: link anywhere. The majority of local searches happen on a phone, and a number that cannot be tapped loses calls at exactly the moment someone decided to ring you.
How to fix: Link your number as <a href="tel:+44...">, in the header of every page.
No address found in structured data. Google cannot confirm where you are, which is the single most important local ranking input.
How to fix: Add a PostalAddress block inside your LocalBusiness markup.
We generated and checked 57 plausible misspellings and variants of your domain. 11 of the 13 registered variants has mail servers configured, so it is technically able to send email that reads as yours to anyone skimming a sender address. Many such domains are entirely unrelated businesses that happen to have a similar name — this is a risk to be aware of and to defend against, not evidence that anyone is doing anything.
exaample.net [mail configured] examlpe.net [mail configured] exammple.net [mail configured] examp1e.net [mail configured] exampke.net [mail configured] example.co [mail configured] example.com [mail configured] example.org [mail configured]
How to fix: Publish DMARC at enforcement so mail claiming to be your domain is rejected outright — that is the defence that works regardless of who owns a lookalike. Then register the closest unregistered variants; they cost a few pounds a year and are the cheapest brand protection available.
No opening hours in structured data. Google shows 'Open now' and 'Closes soon' directly in results — without this markup you never qualify for it, and customers can't tell whether to travel to you.
How to fix: Add openingHoursSpecification covering every day of the week.
Whether the connection, certificate and headers hold up.
http:// does not redirect to https://, so the insecure version of every page stays reachable and can be indexed as duplicate content.
Add a permanent 301 redirect from http:// to https://.
Missing. Tells browsers to only ever connect over HTTPS.
Send Strict-Transport-Security: max-age=31536000; includeSubDomains
Missing. Limits where scripts may load from, which is the main defence against injected code and card skimmers.
Add a Content-Security-Policy header, starting in report-only mode.
Missing. Stops browsers guessing file types.
Send X-Content-Type-Options: nosniff
Missing. Stops your site being framed inside someone else's.
Send X-Frame-Options: SAMEORIGIN, or use CSP frame-ancestors.
Missing. Controls how much of your URL is leaked to other sites.
Send Referrer-Policy: strict-origin-when-cross-origin
Secure connection working.
All resources load securely.
Certificate valid for another 71 days (expires 2026-10-27).
Negotiated TLSv1.3.
Whether your mail reaches inboxes or spam folders.
No rua= address, so DMARC failures are generated and then discarded. You have no visibility into who is sending as you.
v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s
Add rua=mailto:dmarc@yourdomain to start collecting reports.
No MTA-STS policy, so mail to you can be delivered unencrypted if an attacker strips TLS.
Publish an MTA-STS policy and the _mta-sts TXT record.
No TLS-RPT record, so delivery-encryption failures go unreported.
Publish a _smtp._tls TXT record with a reporting address.
No BIMI record. With DMARC at enforcement you could display your logo next to your messages in Gmail and Apple Mail.
Once DMARC is at quarantine or reject, publish a BIMI record with an SVG logo.
DKIM keys published on selector(s): google, default, selector1, selector2, k1, k2, s1, s2, mail, dkim, mandrill, zoho, protonmail.
1 mail server(s) configured.
Ends in -all (hard fail) — the strictest setting.
The record forces about 0 DNS lookups. Comfortably within the limit of 10.
One SPF record, as required.
DMARC policy is p=reject.
How fast real visitors experience the site.
Not available: PageSpeed API returned 429. This usually means the site does not yet have enough Chrome traffic for Google to report field data. Lab measurements below still apply.
Served with gzip compression.
Median response across 1 page(s) was 32 ms.
Homepage HTML is 0 KB.
0 external script file(s) on the homepage.
Pages may be cached by browsers and CDNs.
The tags, files and signals search engines read first.
No XML sitemap. Google has to discover your pages by following links, which means deeper pages may never be crawled.
0 URLs · not referenced in robots.txt
Publish sitemap.xml and reference it from robots.txt.
No meta description, so Google writes the snippet for you from whatever text it finds.
Write 120-160 characters that give someone a reason to click.
No canonical tag, so duplicate URLs of the same page can compete.
Set a self-referencing canonical on every page.
No structured data. Google is reading your page as plain text and cannot qualify you for any rich result.
Add JSON-LD for Organization and your primary content type.
No Open Graph tags, so links shared on social or WhatsApp show no image, title or description.
Add og:title, og:description and og:image.
Homepage is open to indexing.
Mobile viewport is declared.
Title is 14 characters.
No robots.txt file. Not fatal, but it is where you point search engines at your sitemap.
Language attribute present.
Whether pages are unique, linked and crawlable.
Not measured — too few pages were reachable to analyse how the site links to itself.
All 1 crawled pages returned successfully.
No multi-step redirects found.
What Google needs to place you in map results.
No LocalBusiness structured data anywhere on the site. Google builds map and 'near me' results from this markup — without it you are relying entirely on your Google Business Profile and third-party directories to be found locally.
Add LocalBusiness JSON-LD with name, address, phone, opening hours and geo coordinates.
No tel: link anywhere. The majority of local searches happen on a phone, and a number that cannot be tapped loses calls at exactly the moment someone decided to ring you.
Link your number as <a href="tel:+44...">, in the header of every page.
No address found in structured data. Google cannot confirm where you are, which is the single most important local ranking input.
Add a PostalAddress block inside your LocalBusiness markup.
No opening hours in structured data. Google shows 'Open now' and 'Closes soon' directly in results — without this markup you never qualify for it, and customers can't tell whether to travel to you.
Add openingHoursSpecification covering every day of the week.
We found no phone link, email link or contact page in the crawl. Every visit that would have become an enquiry is being lost.
Put a phone number and a contact link in the header and footer of every page.
Phone number is not in your structured data, so it may not appear beside your listing in search results.
Add "telephone" to your LocalBusiness markup.
No review markup. Genuine customer reviews marked up correctly can show star ratings in search results, which materially lifts clicks.
Mark up genuine reviews with AggregateRating. Only mark up reviews that are real and visible on the same page — fabricated ratings breach both Google's policies and UK consumer law.
No geo coordinates, so Google places you by address lookup alone.
Add a GeoCoordinates block with latitude and longitude.
No map or directions link found. It reduces friction for anyone deciding whether you are convenient to reach.
Embed a map or link to your Google Business Profile on the contact page.
No social profiles linked. These are entity signals Google uses to confirm you are a real, established business.
Link your profiles, and add them to sameAs in your Organization markup.
DNS, hosting and delivery configuration.
We generated and checked 57 plausible misspellings and variants of your domain. 11 of the 13 registered variants has mail servers configured, so it is technically able to send email that reads as yours to anyone skimming a sender address. Many such domains are entirely unrelated businesses that happen to have a similar name — this is a risk to be aware of and to defend against, not evidence that anyone is doing anything.
exaample.net [mail configured] examlpe.net [mail configured] exammple.net [mail configured] examp1e.net [mail configured] exampke.net [mail configured] example.co [mail configured] example.com [mail configured] example.org [mail configured]
Publish DMARC at enforcement so mail claiming to be your domain is rejected outright — that is the defence that works regardless of who owns a lookalike. Then register the closest unregistered variants; they cost a few pounds a year and are the cheapest brand protection available.
No CAA record, so any certificate authority may issue certificates for your domain.
Publish a CAA record naming the certificate authority you use.
Not checked: the blocklists declined queries from this resolver, so reputation could not be confirmed either way. This is excluded from your score rather than guessed at.
2 nameserver(s) configured.
Checked 1 subdomain(s); none point at a cloud service that has released them.
Certificate transparency lists 1 hostname(s) for this domain and none of the development-style hosts are both live and open to indexing.
Your certificate covers only your own domain.
DNSSEC is signing this zone.
No version numbers advertised in response headers.
1 hostname(s) appear in this domain's public certificate history, issued by Sectigo Limited, DigiCert Inc.
Served from AS13335 (CLOUDFLARENET - Cloudflare, Inc.), announced in 104.20.16.0/20 — a block of 4,096 addresses.
The site loaded in a real browser, the way a visitor and a crawler get it.
Not measured: the browser could not load this site (TimeoutError). Everything else in this report is unaffected — these checks are excluded from your score rather than guessed at.
| Final URL | https://example.net/ |
|---|---|
| Host IPs | 104.20.21.8, 172.66.175.59, 2606:4700:10::6814:1508, 2606:4700:10::ac42:af3b |
| Pages crawled | 1 of 1 attempted |
| Sitemap URLs | 0 |
| Nameservers | betty.ns.cloudflare.com, hugh.ns.cloudflare.com |
| Mail servers | |
| DKIM selectors | google, default, selector1, selector2, k1, k2, s1, s2, mail, dkim, mandrill, zoho, protonmail |
| TLS | TLSv1.3 · TLS_AES_256_GCM_SHA384 · issued by SSL Corporation |
| Detected stack | custom / Cloudflare / Cloudflare |
| Browser render | Not run: the browser could not load this site (TimeoutError) |
BounceZero Ltd does this work: technical remediation, local SEO and email deliverability. Tell us what you want fixed and we'll reply with what it takes. No call required, no obligation.
We re-audit on a schedule and email you only when a check that was passing starts failing. That is usually a recent change to the site or its DNS, and it is findable while still fresh. No digest, no newsletter.
Monitoring means repeatedly fetching your site and emailing about it, so we ask you to prove you own example.net first.