cramberts.com

Standards-mode <!doctype html> present.

<html> declares a language.

Character encoding declared.

Responsive viewport meta present.

Page has a non-empty <title>.

Meta description present.

Canonical link present.

Icon link(s) declared.

No theme-color — mobile browser UI will not match your brand.

No color-scheme — form controls and scrollbars will not adapt to dark mode.

Open Graph tags present.

Feed auto-discovery link present.

Feed content quality cannot be assessed from a page scan.

No popover attributes — only applies if the page has popovers/menus.

robots.txt is served.

An XML sitemap is present or referenced.

Sitemap index in use.

No image/video sitemap extensions detected.

URL path is clean and readable.

http:// redirects to https with a 3xx status.

Could not probe a nonexistent path.

Indexing is not being blocked by robots meta / X-Robots-Tag.

Exactly one <h1> heading.

85 internal links found.

JSON-LD structured data present.

No breadcrumb structured data or navigation found.

IndexNow integration cannot be detected from a page scan.

Page is served over HTTPS.

No Strict-Transport-Security header — browsers will not enforce HTTPS.

Content-Security-Policy header present.

No /.well-known/security.txt — researchers have no disclosure contact.

No X-Content-Type-Options: nosniff — browsers may MIME-sniff responses.

No frame-ancestors or X-Frame-Options — the page can be framed for clickjacking.

No Referrer-Policy — full URLs may leak to third parties.

No Permissions-Policy — powerful browser features are not locked down.

0/13 cross-origin scripts use SRI — add integrity hashes to the rest.

No cookies set on the document response.

CAA records are not collected by the scanner — check your DNS provider.

DNSSEC status is not collected by the scanner.

No /.well-known/ resources found.

No change-password redirect — recommended if the site has accounts.

Not present — only relevant for OIDC identity providers.

Not present — recommended if the site exposes public APIs.

Not present — only relevant for federated identity.

Not present — only needed for iOS Universal Links.

Not present — only needed for Android App Links.

Not present — only relevant for Fediverse servers.

Not present — optional prefetch-proxy control file.

Lab load completed in 1669ms (a proxy). Confirm LCP/INP/CLS with field data.

13/15 raster images use modern formats (WebP/AVIF).

loading="lazy" is used.

Resource hints (preload/preconnect/…) present.

Cache-Control set on the document (public, max-age=0).

Not set — optional; helps cache/prefetch URLs that differ only by tracking params.

Document is compressed (br).

No inline font-display/preload — ensure web fonts use font-display: swap to avoid invisible text.

2 render-blocking stylesheet(s) in <head>.

27/31 external scripts use defer/async/module — add defer to the rest.

HTTP/3 advertised via Alt-Svc.

Speculation Rules present for instant navigations.

Resource hints are in use.

No View Transitions detected — optional polish for navigations.

BFCache eligibility needs runtime testing.

No content-visibility detected — optional offscreen-render optimisation.

No CSS containment detected — optional.

Not detected — optional.

No scrollbar-gutter — optional; prevents layout shift when scrollbars toggle.

A privacy policy link/reference is present.

No consent manager detected (and no document cookies) — required if you set non-essential cookies.

GPC handling is server-side and cannot be confirmed from a scan.

7 third-party script origins — a large external surface; trim where possible.

Tracking-based analytics (Google Analytics) detected — consider a cookieless alternative.

Data-minimisation practices need a manual review of forms and backend.

Could not probe a missing path.

Maintenance behaviour can only be observed during downtime.

No service worker detected — optional offline/PWA support.

No <link rel="manifest"> — add a web app manifest for installability.

Monitoring is operational and cannot be detected from the page.