https://indiehackers.com

Page title length is not optimal

Your page title is either too short to be descriptive, or too long and gets cut off in Google search results with "...". Both reduce click-through rates.

H1 heading is missing or duplicated

Every page should have exactly one main heading (H1) that tells Google what the page is about. Missing or multiple H1s confuse search engines and lower your rankings.

Images are missing dimensions

Images without dimensions can cause layout shifts while the page loads. That hurts Core Web Vitals and makes the page feel unstable.

Images with empty or missing alt text

Some images have no meaningful alt text. Screen readers read these as "image" with no context, hurting accessibility and image search visibility.

No structured data (JSON-LD) found

No Schema.org JSON-LD blocks were found on this page. Structured data helps Google understand your content and display rich results. It also improves AI search visibility.

sitemap.xml exists but contains no URLs

Your sitemap.xml is empty. Search engines and AI crawlers use sitemaps to discover pages — an empty sitemap provides no benefit.

HSTS header missing

Your site allows browsers to connect over HTTP even though you have HTTPS. Attackers can intercept the first request and downgrade visitors to unencrypted HTTP. HSTS prevents this.

X-Frame-Options header missing

Your site can be embedded in an invisible iframe on another website. Attackers use this technique (called "clickjacking") to trick your users into clicking things without realising it.

X-Content-Type-Options header missing

Browsers can "sniff" your files and treat them as a different file type than intended. This can allow attackers to upload files that get executed as scripts. This header prevents that.

Referrer-Policy header missing

When visitors click a link to leave your site, their browser sends your full URL (including any private query parameters) to the destination site. A referrer policy controls what gets shared.

Content Security Policy missing

There's no policy controlling what scripts and resources your page can load. Without this, an attacker who injects any code into your page can do anything — steal cookies, redirect users, exfiltrate data.

API key found in page HTML

A secret API key is visible in your page's HTML source code. Anyone can view-source your page and steal it — this is actively exploited by bots that scrape the web looking for this.

Missing Permissions-Policy header

Without a Permissions-Policy header, any script on your page can access the camera, microphone, geolocation, and other sensitive browser features. This is a defence-in-depth security header that limits exposure if you get XSS.

DMARC policy is set to none (monitoring only)

Your DMARC record only monitors, it does not protect. Emails that fail DMARC (including spoofed phishing from your domain) are still delivered to inboxes.

No CAA DNS record

Without a CAA record, any certificate authority in the world can issue an SSL certificate for your domain. A CAA record restricts which CAs are allowed.

Cookie set without Secure flag

Without the Secure flag, cookies (including session tokens) can be sent over HTTP connections, making them visible to network attackers.

Cookie set without HttpOnly flag

Without HttpOnly, JavaScript on the page (including injected scripts from XSS attacks) can read your cookies, including session tokens.

Cookie set without SameSite attribute

Without SameSite, cookies may be sent with cross-site requests, enabling CSRF attacks. Modern browsers default to Lax, but explicit is better.

Third-party tracking scripts detected

Your site loads scripts from third-party tracking services. Each tracker adds latency, can access cookies/localStorage, and represents a privacy surface. More trackers = slower page + more GDPR liability.

No cookie consent mechanism detected

Your site loads tracking scripts (Google Analytics, Meta Pixel, etc.) but no cookie consent banner was found. GDPR and similar laws require informed consent before tracking EU visitors — fines can reach €20M.

No web app manifest found

Your site has no web app manifest. Without it, users who add your site to their home screen on Android get a generic browser icon and no app-like experience. It also helps Chrome show the "Add to Home Screen" prompt.

No structured data (Schema.org)

AI assistants and search engines use structured data to understand what your product is. Without it, they have less reliable context.

No llms.txt file

An llms.txt file can help AI systems understand which product pages and context to prefer.

No content date signal found

Perplexity and Google AI Overview weight fresh content significantly higher. Without a date signal, your page may be treated as potentially outdated — reducing how often AI systems cite it in answers.

First paragraph too short for AI citation

AI systems like ChatGPT, Claude, and Perplexity extract the beginning of your page as citation passages. A short or absent opening paragraph means they have little useful content to cite, reducing how often your page appears in AI answers.

No semantic HTML landmarks found

AI agents and screen readers navigate pages using semantic HTML landmarks. Without them, your content structure is invisible to machines.

Form inputs missing labels

Some form fields have no label. Screen reader users cannot tell what the field is for. Placeholder text is not a substitute — it disappears when you start typing.

No skip navigation link

Keyboard and screen reader users have to tab through every navigation item on every page to reach the main content. A "skip to content" link at the top of the page lets them jump directly to the main area.