www.eon.de
Built with Cloudflare, Cloudflare Bot Management, Cloudflare Turnstile, Cloudflare Waf, Html5 and 1 more
Performance
TTFB
42ms
DOM Ready
178ms
Load Complete
342ms
Requests
5
Total Size
428KB
Domains
2
Errors
0
Technologies
Other
SEO recommendations
SEO health score
This URL serves a Cloudflare bot-challenge interstitial ('Just a moment...') carrying a noindex,nofollow robots meta tag, so none of the actual eon.de MeinEON portal page's SEO signals (title, meta, content, structured data) are exposed to crawlers; the URL is effectively invisible to search engines and every meta/content check fails against this HTML.
- Improve page titlesVery High
The only title is the generic challenge string 'Just a moment...' with no reference to eon.de, MeinEON or the customer portal, so this URL carries zero keyword relevance.
→ Serve the real portal page (title like 'MeinEON – Ihr E.ON Kundenportal') to crawlers instead of the challenge, e.g. by whitelisting Googlebot in Cloudflare's bot/WAF rules.
92%impact
- Improve internal linkingVery High
The challenge page contains no internal links at all – no navigation, footer or contextual links to any other eon.de section.
→ Ensure the real page exposes the main navigation with descriptive anchors to related sections (Tarife, Hilfe, Kontakt) and that Googlebot can crawl them without having to pass the challenge.
88%impact
- Add structured data to your websiteVery High
No JSON-LD or schema.org markup of any kind is present anywhere in the returned HTML.
→ Add JSON-LD (e.g. WebSite/Organization on the real start page, plus Service markup for portal features) to the actual https://www.eon.de/de/meineon/start.html document.
85%impact
- Optimize your sitemapVery High
No XML sitemap link, robots.txt reference or sitemap metadata is present anywhere in the returned HTML.
→ Verify https://www.eon.de/robots.txt references an XML sitemap and that /de/meineon/start.html is listed in it (or is deliberately excluded with a clear policy).
80%impact
- Review similar contentHigh
The page is maximally thin – it contains only the challenge text 'Just a moment...' and no unique informational content, making it a near-duplicate of every other Cloudflare challenge response on the web.
→ Make sure crawlers receive the full portal page rather than the interstitial, so the URL indexes unique content instead of a generic challenge page.
78%impact
- Trailing slashes may cause duplicate contentHigh
No canonical tag is present, so there is nothing on this page asserting the preferred URL variant (slash vs no-slash, www vs non-www, .html form).
→ Add a self-referencing canonical tag to the real page (https://www.eon.de/de/meineon/start.html) and ensure the .html variant is the single indexed version.
72%impact
- Content to-do listMedium
There is no semantic content structure – no h1/h2 headings, no body text and no portal copy beyond the challenge prompt, so content depth and coverage are missing from this HTML.
→ Plan the real page's information architecture (h1 on the portal name, sections for self-service, bill/reading entry and FAQ anchors) once the actual document is retrievable.
65%impact
- Improve meta descriptionsMedium
No meta description tag exists anywhere in the returned HTML, so no CTR-relevant summary would appear in the SERPs for this URL.
→ Add a ~150-160 character meta description to the real start.html, e.g. 'MeinEON: Verwalten Sie online Ihren E.ON Vertrag, melden Sie Ihren Zählerstand und sehen Sie Ihre Rechnungen bequem im Kundenportal.'
55%impact
- Avoid internal redirectsHigh
The HTML shows no redirect chain, but this URL is being intercepted by a Cloudflare challenge (typically served with a 403-class status), whose final response for crawlers is unknown from the HTML alone.
→ Check server logs / curl -I to confirm Googlebot receives a 200 for https://www.eon.de/de/meineon/start.html with no redirect chain to a canonical portal URL.
50%impact
- Improve page speedHigh
The challenge page itself is lightweight (inline CSS/JS only), but it gates the real page, so no Core Web Vitals or real asset weights are observable from this HTML.
→ Measure the real start page with Lighthouse/PageSpeed Insights once the challenge is bypassed, and confirm Googlebot is not forced through a slow JavaScript challenge.
45%impact
- Add OpenGraph tagsLow
No og: or twitter: meta tags are present, so links to this page shared on social platforms would render without a proper title, image or description.
→ Add og:title, og:description, og:image and twitter:card tags to the real page so portal links preview correctly when shared.
25%impact
AI-generated SEO assessment · impact = estimated priority for this page
Specification compliance (22 shortcomings)
Specification compliance score
21/28 required and 9/30 recommended practices implemented. 22 shortcomings to address.
21/28
Required
9/30
Recommended
22
Shortcomings
62%
Overall
- The HTML doctypeRequired
Standards-mode <!doctype html> present.
100%Implemented
- The lang attribute on <html>Required
<html> declares a language.
100%Implemented
- <meta charset>Required
Character encoding declared.
100%Implemented
- <meta viewport>Required
Responsive viewport meta present.
100%Implemented
- The <title> elementRequired
Page has a non-empty <title>.
100%Implemented
- <meta name="description">Recommended
No meta description — search engines may show a poor snippet.
0%Not implemented
- Canonical URL (rel="canonical")Recommended
No rel="canonical" — risks duplicate-content dilution.
0%Not implemented
- Favicons and app iconsRecommended
No favicon/app-icon links found.
0%Not implemented
- <meta name="theme-color">Recommended
No theme-color — mobile browser UI will not match your brand.
0%Not implemented
- <meta name="color-scheme">Recommended
color-scheme declared.
100%Implemented
- Open Graph protocolRecommended
No Open Graph tags — shared links will render without rich previews.
0%Not implemented
- Feed discovery with rel="alternate"Recommended
No feed discovery link found — only relevant if the site publishes a feed.
—Needs review
- Feed content hygieneRecommended
Feed content quality cannot be assessed from a page scan.
—Needs review
- Popover APIRecommended
No popover attributes — only applies if the page has popovers/menus.
—Needs review
- robots.txtRecommended
No robots.txt found at the site root.
0%Not implemented
- XML sitemapsRecommended
No sitemap.xml found and none referenced in robots.txt.
0%Not implemented
- Sitemap index filesRecommended
No sitemap index — only needed once you exceed 50k URLs / 50MB.
—Needs review
- Image and video sitemap extensionsOptional
No image/video sitemap extensions detected.
—Needs review
- URL structureRecommended
URL path is clean and readable.
100%Implemented
- Redirects (301/302/308)Required
http:// redirects to https with a 3xx status.
100%Implemented
- Soft 404sAvoid
Nonexistent path returned 403; ensure missing pages return 404.
50%Partial
- Meta robots and X-Robots-TagRequired
This page is set to noindex — search engines will not index it. Remove it unless intentional.
0%Not implemented
- Heading hierarchyRequired
Exactly one <h1> heading.
100%Implemented
- Internal linkingRecommended
Few internal links found — add contextual links between related pages.
40%Partial
- Structured data (JSON-LD)Recommended
No JSON-LD — add schema.org structured data for rich results.
0%Not implemented
- BreadcrumbsRecommended
No breadcrumb structured data or navigation found.
0%Not implemented
- IndexNowOptional
IndexNow integration cannot be detected from a page scan.
—Needs review
- Colour contrastRequired
Colour contrast requires rendering analysis — review with an automated contrast checker.
—Needs review
- Image alt textRequired
All 1 images declare alt text.
100%Implemented
- Form labelsRequired
No form fields requiring labels.
100%Implemented
- Keyboard navigationRequired
Keyboard operability needs interactive testing.
—Needs review
- Visible focus indicatorsRequired
Focus-indicator visibility needs rendering review.
—Needs review
- Skip linksRecommended
No skip link — keyboard users must tab through the nav on every page.
0%Not implemented
- Semantic HTML and landmarksRequired
No semantic landmark elements — the page is built from generic <div>s.
0%Not implemented
- ARIA — first rule of ARIARecommended
No obvious ARIA misuse, but full review needs assistive-tech testing.
—Needs review
- Descriptive link textRequired
Link-text quality needs manual review.
—Needs review
- Empty links and buttonsAvoid
No empty links or buttons detected.
100%Implemented
- Accessible form errorsRequired
Form-error accessibility needs interactive testing.
—Needs review
- Document and parts languageRequired
Document language is declared.
100%Implemented
- Reduced motionRequired
prefers-reduced-motion handling detected.
100%Implemented
- Accessibility overlaysAvoid
No accessibility-overlay widget detected.
100%Implemented
- Captions and transcriptsRequired
No audio/video requiring captions.
100%Implemented
- Accessible data tablesRequired
No data tables on the page.
100%Implemented
- Touch target sizeRequired
Touch-target sizing needs rendering measurement.
—Needs review
- Hidden until foundRecommended
Not used — only relevant for collapsible/accordion content.
—Needs review
- Native interactive elementsRecommended
Could not confirm use of native interactive elements.
—Needs review
- CSS state and relational selectorsRecommended
CSS selector strategy needs source review.
—Needs review
- HTTPS and TLSRequired
Page is served over HTTPS.
100%Implemented
- HSTS (Strict-Transport-Security)Required
No Strict-Transport-Security header — browsers will not enforce HTTPS.
0%Not implemented
- Content Security Policy (CSP)Recommended
Content-Security-Policy header present.
100%Implemented
- /.well-known/security.txtRecommended
security.txt is published.
100%Implemented
- X-Content-Type-Options: nosniffRequired
nosniff header present.
100%Implemented
- Clickjacking protectionRequired
Framing is restricted (frame-ancestors / X-Frame-Options).
100%Implemented
- Referrer-PolicyRecommended
Referrer-Policy header present.
100%Implemented
- Permissions-PolicyRecommended
Permissions-Policy header present.
100%Implemented
- Subresource Integrity (SRI)Recommended
0/1 cross-origin scripts use SRI — add integrity hashes to the rest.
1%Partial
- Cookie attributes — Secure, HttpOnly, SameSiteRequired
No cookies set on the document response.
100%Implemented
- DNS CAA recordsRecommended
CAA records are not collected by the scanner — check your DNS provider.
—Needs review
- DNSSECOptional
DNSSEC status is not collected by the scanner.
—Needs review
- Agent readinessRecommended
No agent-readiness signals (no llms.txt, no structured data).
0%Not implemented
- /llms.txtRecommended
No /llms.txt — agents have no curated map of your key content.
0%Not implemented
- /llms-full.txtOptional
No /llms-full.txt — optional full-content variant.
—Needs review
- Per-page Markdown source endpointsRecommended
No Markdown source endpoint detected — recommended for content/doc sites.
—Needs review
- robots.txt for AI crawlersRecommended
robots.txt has no explicit AI-crawler rules — state your stance on GPTBot/ClaudeBot/etc.
0%Not implemented
- Content Signals in robots.txtOptional
No Content-Signal directives — optional usage-preference signalling.
—Needs review
- Web Bot Auth — verifiable bot identityOptional
Web Bot Auth support cannot be detected from a scan.
—Needs review
- Stable URLsRequired
URL has no obvious session/volatile parameters.
100%Implemented
- Structured data for agentsRecommended
No structured data — agents must scrape prose instead of reading typed facts.
0%Not implemented
- Machine-readable formatsRecommended
No machine-readable alternates detected — recommended for listings/data pages.
—Needs review
- HTTP Link headers for discoveryRecommended
No HTTP Link header — recommended to surface related resources to agents.
—Needs review
- MCP and tool discoveryOptional
No MCP/tool discovery endpoint — optional.
—Needs review
- A2A agent cardsOptional
No A2A agent card — optional.
—Needs review
- Agent Skills discoveryRecommended
Agent Skills discovery cannot be detected automatically.
—Needs review
- DNS for AI Discovery (DNS-AID)Optional
DNS-AID records are not collected by the scanner.
—Needs review
- NLWeb — conversational interface discoveryOptional
NLWeb support cannot be detected automatically.
—Needs review
- WebMCP — browser-native tools for agentsOptional
WebMCP support cannot be detected automatically.
—Needs review
- Schemamap — discoverable JSON-LD endpointsOptional
Schemamap support cannot be detected automatically.
—Needs review
- Core Web Vitals (LCP, INP, CLS)Required
Lab load completed in 342ms (a proxy). Confirm LCP/INP/CLS with field data.
85%Partial
- Image optimisationRequired
None of 1 raster images use WebP/AVIF — convert from PNG/JPEG.
0%Not implemented
- Lazy loading images, iframes, and videoRecommended
Too few images to need lazy-loading.
100%Implemented
- Preload, prefetch, preconnectRecommended
No resource hints — preconnect to critical origins and preload the LCP asset.
0%Not implemented
- Cache-Control headersRequired
No Cache-Control header on the document — set explicit caching for HTML and assets.
0%Not implemented
- No-Vary-Search response headerRecommended
Not set — optional; helps cache/prefetch URLs that differ only by tracking params.
—Needs review
- Compression (gzip, brotli, zstd)Required
Document is compressed (br).
100%Implemented
- Web font loadingRecommended
No inline font-display/preload — ensure web fonts use font-display: swap to avoid invisible text.
—Needs review
- Critical CSS and render-blocking resourcesRecommended
0 render-blocking stylesheet(s) in <head>.
100%Implemented
- Script loading — defer, async, moduleRecommended
1/2 external scripts use defer/async/module — add defer to the rest.
50%Partial
- HTTP/2 and HTTP/3Recommended
Protocol version not captured — verify HTTP/2/3 is enabled at your edge/CDN.
—Needs review
- Speculation RulesRecommended
No Speculation Rules — optionally prerender/prefetch likely next pages.
—Needs review
- Resource hints overviewRecommended
No resource hints found on the page.
0%Not implemented
- View TransitionsRecommended
No View Transitions detected — optional polish for navigations.
—Needs review
- Back/forward cache (BFCache)Recommended
BFCache eligibility needs runtime testing.
—Needs review
- Visibility-aware renderingRecommended
No content-visibility detected — optional offscreen-render optimisation.
—Needs review
- CSS containmentOptional
No CSS containment detected — optional.
—Needs review
- Scroll-driven animationsOptional
Not detected — optional.
—Needs review
- Scrollbar gutterRecommended
No scrollbar-gutter — optional; prevents layout shift when scrollbars toggle.
—Needs review
- Privacy policyRequired
A privacy policy link/reference is present.
100%Implemented
- Cookie consentRequired
No consent manager detected (and no document cookies) — required if you set non-essential cookies.
—Needs review
- Global Privacy Control (GPC)Recommended
GPC handling is server-side and cannot be confirmed from a scan.
—Needs review
- Third-party scripts and privacyRecommended
1 third-party script origin(s) — audit each for data collection.
70%Partial
- Privacy-respecting analyticsRecommended
No analytics detected, or an unrecognised provider.
—Needs review
- Data minimisationRecommended
Data-minimisation practices need a manual review of forms and backend.
—Needs review
- Custom error pages (404, 500)Required
Missing path returned 403 — ensure it is a 404 with a custom page.
50%Partial
- Maintenance pages and 503Recommended
Maintenance behaviour can only be observed during downtime.
—Needs review
- Offline support and service workersOptional
No service worker detected — optional offline/PWA support.
—Needs review
- Web app manifestRecommended
No <link rel="manifest"> — add a web app manifest for installability.
0%Not implemented
- Monitoring and uptimeRecommended
Monitoring is operational and cannot be detected from the page.
—Needs review
Deterministic audit against the website specification checklist. “Needs review” items can't be confirmed from a headless scan and are excluded from the score.
DNS & Infrastructure
IP Addresses
172.64.150.53104.18.37.2032a06:98c1:3101::6812:25cbIPv62606:4700:4400::ac40:9635IPv6Nameservers
Mail Servers (MX)
eon-de.mail.protection.outlook.comAI Analysis Notes
- ·DNS hosted on Cloudflare (troy.ns.cloudflare.com, elly.ns.cloudflare.com)
- ·Email via Microsoft 365 (eon-de.mail.protection.outlook.com)
- ·All A records point to Cloudflare IPs (AS13335), likely proxied, so origin server is hidden behind Cloudflare
- ·Site verification tokens present for Google (google-site-verification) and Microsoft (microsoft-site-verification style tokens)
- ·D-TRUST and QuoVadis TXT records indicate certificate authority (CAA) verification via those CAs
- ·DocuSign verification TXT record present; no SPF or DMARC records found
Email & Deliverability
Email health score
Microsoft 365eon.de is a Microsoft 365 customer with a generally strong posture: SPF hard fail (-all), DMARC p=quarantine with full reporting, two DKIM selectors, and MTA-STS are all published. The main risks are the oversized SPF record (mechanism-heavy, likely to exceed the 10-DNS-lookup limit and cause permanent errors) and the sp=none DMARC subdomain policy; fixing those and moving to p=reject would make spoofing effectively unprofitable.
Mail configuration
- Mail servers (MX)
eon-de.mail.protection.outlook.com1 MX record — the domain can receive mail.
- SPF
v=spf1 include:spf.protection.outlook.com include:spf.mailjet.com include:spf-sap.eon.com a:surveymonkey.com include:spfa.eon.de include:_spf.salesforce.com ip4:192.109.216.0/24 ip4:160.44.230.240/29 ip4:148.105.8.0/21 ip4:198.2.128.0/18 ip4:205.201.128.0/20 ip4:136.146.128.64/28 ip4:162.247.216.0/22 ip4:178.21.131.158 ip4:178.249.98.17 ip4:182.50.78.64/28 ip4:212.18.21.68/31 ip4:216.74.162.12/30 ip4:46.249.197.144/30 ip4:46.30.5.108/30 ip4:5.61.115.0/25 ip4:50.31.33.37 ip4:193.26.32.0/19 ip4:94.100.245.16/28 -allSPF present with a hard fail (-all) — strong protection against spoofing.
- DMARC policy
v=DMARC1; p=quarantine; rua=mailto:dmarc_rua@emaildefense.proofpoint.com,mailto:bfb9adeaa3e4218@rep.dmarcanalyzer.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com,mailto:bfb9adeaa3e4218@for.dmarcanalyzer.com; sp=none; fo=1DMARC policy is p=quarantine — failing mail is sent to spam. Consider p=reject.
- DKIM
selector1._domainkey, selector2._domainkeyDKIM signing keys found (selectors: selector1, selector2).
- MTA-STS
presentMTA-STS is published — enforces TLS for inbound mail.
- SMTP server
Microsoft Exchange / 365Primary mail server responded (Microsoft Exchange / 365).
Recommended improvements
- Trim SPF to stay within the 10-DNS-lookup limitVery High
The SPF record already contains 6 lookup mechanisms (5 includes plus a:surveymonkey.com), and the nested includes (spf.protection.outlook.com, _spf.salesforce.com, spf.mailjet.com) add more, so the total can exceed the 10-DNS-lookup cap and trigger a permerror that turns the -all hard fail into rejected legitimate mail.
→ Consolidate eon.de's SPF to at most 10 total lookups — keep include:spf.protection.outlook.com and include:spf.mailjet.com, replace a:surveymonkey.com and the static ip4 ranges with sender-side includes where possible — then verify the lookup count (e.g. dig +short TXT eon.de and count nested lookups).
90%impact
- Enforce DMARC on subdomains with sp=rejectHigh
The DMARC record sets sp=none, so mail from any subdomain of eon.de gets no enforcement and spoofed subdomain messages land in inboxes.
→ Change the sp=none tag in the DMARC TXT record to sp=reject once the rua/ruf reports confirm no legitimate subdomain senders.
70%impact
- Escalate DMARC policy to p=rejectHigh
p=quarantine only diverts failed mail to spam, whereas p=reject instructs receivers to drop spoofed mail outright — the strongest anti-phishing stance now that reporting (rua/ruf/fo=1 to Proofpoint) is already in place.
→ After reviewing the Proofpoint DMARC Analyzer reports, update the DMARC TXT record to v=DMARC1; p=reject; sp=reject; rua=mailto:dmarc_rua@emaildefense.proofpoint.com,mailto:bfb9adeaa3e4218@rep.dmarcanalyzer.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com,mailto:bfb9adeaa3e4218@for.dmarcanalyzer.com; fo=1.
60%impact
- Verify DKIM alignment across all sending platformsMedium
DKIM selectors (selector1, selector2) are published, but mail sent via Mailjet and Salesforce signs with their own DKIM domains, so those streams depend on SPF (and DMARC alignment) rather than DKIM.
→ Confirm the selector1/selector2 keys are 2048-bit and actively used by Microsoft 365 outbound mail, and configure Mailjet and Salesforce campaigns to sign with d=eon.de (or ensure their SPF/include coverage stays within the lookup limit).
45%impact
- Shrink the broad SPF ip4 rangesMedium
The record authorizes very large blocks such as ip4:198.2.128.0/18, ip4:193.26.32.0/19 and ip4:205.201.128.0/20, which dilute the -all hard fail and allow any host inside those ranges to send as eon.de.
→ Replace each broad /18-/21 ip4 range with the exact sender IPs actually used (e.g. ip4:198.2.128.10 for the surveymonkey relay) or have the vendor publish its own SPF include, then keep -all.
40%impact
- Publish TLS-RPT for inbound TLS failure reportingLow
MTA-STS is published but no TLS-RPT record exists, so you get no reports when a peer cannot fetch the policy and mail arrives in plaintext despite the enforcement policy.
→ Add a TXT record at _smtp._tls.eon.de: v=TLSRPTv1; rua=mailto:dmarc_rua@emaildefense.proofpoint.com.
15%impact
- Add BIMI to display a verified brand logoLow
With SPF/DMARC/DKIM already passing, BIMI can display the E.ON logo next to authenticated mail, improving recognition and engagement.
→ Publish default._bimi.eon.de TXT v=BIMI1; l=https://www.eon.de/logo.svg with an SVG logo and a Verified Mark Certificate, once DMARC reaches p=reject.
10%impact
Auto-rated from DNS & SMTP records · improvements suggested by AI
Loaded Resources (5 requests · sorted by load time)
| Resource | Size | Time | Status |
|---|---|---|---|
Cchallenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/f/av0/rch/7ri | — | 66ms | 200 |
Ewww.eon.de/favicon.ico | 5.9KB | 62ms | — |
Ewww.eon.de/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a43a48b93b | 232.8KB | 21ms | 200 |
Ewww.eon.de/cdn-cgi/challenge-platform/h/b/fo/3382436115:1790841621:DOBwhQ2wXupQY | 104.4KB | 20ms | 200 |
Cchallenges.cloudflare.com/turnstile/v0/b/d76008a69eab/api.js?onload=zaERg6&rende | 84.7KB | 16ms | 200 |
Scan History (1 scans)
Page load time
TTFB
| Date | TTFB | DOM | Load | Requests | Size | Errors | Scripts |
|---|---|---|---|---|---|---|---|
| Oct 1, 09:01 AM UTC | 42ms | 178ms | 342ms | 5 | 428KB | 0 | 10AI |
Embed a badge
Pick what to show — your detected tech stack, the social-trend valuation, or both.
Brand · detected technologies.
<a href="https://madewith.tech/s/www.eon.de"><img src="https://madewith.tech/s/www.eon.de/badge.svg" alt="www.eon.de on MadeWithTech" /></a>[](https://madewith.tech/s/www.eon.de)https://madewith.tech/s/www.eon.de