Lab part failed; field data shows a slow LCP. No change is claimed.
Canonical still points to http://. Sitemap check timed out.
New regression: an ad pixel fires before the visitor chooses.
Built only from the findings below. Every line names its evidence.
An advertising pixel request leaves before any choice. It did not in the previous run. Fix this first.
Evidence: Request log · Based on observed requests. Not legal advice and not a certificate.
Canonical points to the http:// version of the home page. Worth doing in the next round.
Evidence: HTML extract · Based on the fetched HTML and headers. It does not claim a ranking change.
No Content-Security-Policy. Worth doing in the next round.
Evidence: HTTP headers · Based on the fetched HTML and headers. It does not claim a ranking change.
Fixed mobile profile, three runs, median. Lab and field data are kept apart.
Check failed Two of three lab runs timed out after retries. There is no median, so no performance change is claimed.
URL-level CrUX data exists. Field data is shown even though the lab part failed.
| Metric | Scope | p75 | Previous | Status |
|---|---|---|---|---|
| LCP | This URL | 3,480 ms | 3,390 ms | Has data |
| CLS | This URL | 0.06 | 0.07 | Has data |
| INP | This URL | 260 ms | 240 ms | Has data |
| LCP | Whole origin | 3,310 ms | 3,300 ms | Has data |
| CLS | Whole origin | 0.05 | 0.05 | Has data |
| INP | Whole origin | 240 ms | 230 ms | Has data |
Structured checks on the start URL. Not a full SEO suite.
| Check | Status | Priority | Confidence |
|---|---|---|---|
| HTTP statusThe start URL answers 200 after one redirect from the www host. | Pass | — | High confidence |
| HTTPSHTTPS without mixed content. | Pass | — | High confidence |
| Security headersNo Content-Security-Policy. | Issue | Medium | High confidence |
| TitleUnique title. | Pass | — | High confidence |
| CanonicalCanonical points to the http:// version of the home page. | Issue | Medium | High confidence |
| SitemapThe sitemap request timed out. That does not mean the file is missing. | Check failed | — | High confidence |
| H1 & heading outlineOne H1. | Pass | — | High confidence |
Each state starts from a clean browser. No forms, checkout or login.
Technical observation only. This is not legal advice and not a compliance certificate. When the purpose of a cookie cannot be decided from the evidence, its “necessary” classification is marked as uncertain.
| Check | Status | Priority | Confidence |
|---|---|---|---|
| Three-state browser runAll three isolated states ran. | Pass | — | High confidence |
| Consent noticeA consent banner appears with accept and reject on the first layer. | Pass | — | High confidence |
| Reject as easy as acceptAccept and reject have the same weight. | Pass | — | High confidence |
| Trackers before a choiceAn advertising pixel request leaves before any choice. It did not in the previous run. | Issue | High | High confidence |
Stack-aware steps with owner, risk, rollback and how the next audit verifies it.
rel=canonical uses http:// on an HTTPS site.
Search engines may treat the http:// URL as the main one and split signals.
Web developer · WordPress Address and Site Address settings, SEO plugin
Low. Restore the previous addresses.
Next audit: marketing.canonical passes.
Compared with 6 Oct 2026, 12:15. A fix counts only when this run measures it.
| Check | Area | Previous | Now | Change |
|---|---|---|---|---|
| Trackers before a choice | Privacy | Pass | Issue | Regressed |
| Sitemap | Marketing & technical | Pass | Check failed | No comparable data |
| Lab runs | Performance | Pass | Check failed | No comparable data |
| Canonical | Marketing & technical | Issue | Issue | Unchanged |
| H1 & heading outline | Marketing & technical | Pass | Pass | Unchanged |
| HTTP status | Marketing & technical | Pass | Pass | Unchanged |
| HTTPS | Marketing & technical | Pass | Pass | Unchanged |
| Security headers | Marketing & technical | Issue | Issue | Unchanged |
| Title | Marketing & technical | Pass | Pass | Unchanged |
| CLS · CrUX origin | Performance | 0.05 | 0.05 | Unchanged |
| INP · CrUX origin | Performance | 230 ms | 240 ms | Unchanged |
| LCP · CrUX origin | Performance | 3,300 ms | 3,310 ms | Unchanged |
| CLS · CrUX url | Performance | 0.07 | 0.06 | Unchanged |
| INP · CrUX url | Performance | 240 ms | 260 ms | Unchanged |
| LCP · CrUX url | Performance | 3,390 ms | 3,480 ms | Unchanged |
| Consent notice | Privacy | Pass | Pass | Unchanged |
| Reject as easy as accept | Privacy | Pass | Pass | Unchanged |
| Three-state browser run | Privacy | Pass | Pass | Unchanged |
Stored per run with a hash and a retention date. Cookie snapshots are redacted.
| Evidence | Type | Hash | Retention | Redaction |
|---|---|---|---|---|
The start URL answers 200 after one redirect from the www host.mock://evidence/ev-run-harbor-2026-11-05-marketing.http_status | HTTP headers | sha256:demo:9e8a637f | 2026-12-10 | not applicable |
HTTPS without mixed content.mock://evidence/ev-run-harbor-2026-11-05-marketing.https | HTML extract | sha256:demo:79b904a1 | 2026-12-10 | not applicable |
No Content-Security-Policy.mock://evidence/ev-run-harbor-2026-11-05-marketing.security_headers | HTTP headers | sha256:demo:92eae273 | 2026-12-10 | not applicable |
Unique title.mock://evidence/ev-run-harbor-2026-11-05-marketing.title | HTML extract | sha256:demo:d444195e | 2026-12-10 | not applicable |
Canonical points to the http:// version of the home page.mock://evidence/ev-run-harbor-2026-11-05-marketing.canonical | HTML extract | sha256:demo:a8769f9a | 2026-12-10 | not applicable |
The sitemap request timed out. That does not mean the file is missing.mock://evidence/ev-run-harbor-2026-11-05-marketing.sitemap | Note | sha256:demo:736d3393 | 2026-12-10 | not applicable |
One H1.mock://evidence/ev-run-harbor-2026-11-05-marketing.h1 | HTML extract | sha256:demo:ec051ad3 | 2026-12-10 | not applicable |
All three isolated states ran.mock://evidence/ev-run-harbor-2026-11-05-privacy.three_state | HTML extract | sha256:demo:4bd18ef2 | 2026-12-10 | redacted |
A consent banner appears with accept and reject on the first layer.mock://evidence/ev-run-harbor-2026-11-05-privacy.consent_ui | HTML extract | sha256:demo:0d7f5809 | 2026-12-10 | redacted |
Accept and reject have the same weight.mock://evidence/ev-run-harbor-2026-11-05-privacy.reject_comparable | HTML extract | sha256:demo:3ebe26c0 | 2026-12-10 | redacted |
An advertising pixel request leaves before any choice. It did not in the previous run.mock://evidence/ev-run-harbor-2026-11-05-privacy.tracker_before_decision | Request log | sha256:demo:4b083dc1 | 2026-12-10 | redacted |
Lab request timed out.mock://evidence/ev-run-harbor-2026-11-05-perf.lab.collect | Note | sha256:demo:0a915dec | 2026-12-10 | not applicable |
CrUX url LCP: 3480mock://evidence/ev-run-harbor-2026-11-05-perf.field.url.lcp | CrUX JSON | sha256:demo:680b8181 | 2026-12-10 | not applicable |
CrUX url CLS: 0.06mock://evidence/ev-run-harbor-2026-11-05-perf.field.url.cls | CrUX JSON | sha256:demo:e575cdda | 2026-12-10 | not applicable |
CrUX url INP: 260mock://evidence/ev-run-harbor-2026-11-05-perf.field.url.inp | CrUX JSON | sha256:demo:243fc407 | 2026-12-10 | not applicable |
CrUX origin LCP: 3310mock://evidence/ev-run-harbor-2026-11-05-perf.field.origin.lcp | CrUX JSON | sha256:demo:31f8b360 | 2026-12-10 | not applicable |
CrUX origin CLS: 0.05mock://evidence/ev-run-harbor-2026-11-05-perf.field.origin.cls | CrUX JSON | sha256:demo:bcae1bb3 | 2026-12-10 | not applicable |
CrUX origin INP: 240mock://evidence/ev-run-harbor-2026-11-05-perf.field.origin.inp | CrUX JSON | sha256:demo:835f3bc2 | 2026-12-10 | not applicable |
before_decision: redacted list of cookies and requests.mock://evidence/ev-run-harbor-2026-11-05-privacy-before_decision | Cookie snapshot | sha256:demo:f1a522e9 | 2026-12-10 | redacted |
after_reject: redacted list of cookies and requests.mock://evidence/ev-run-harbor-2026-11-05-privacy-after_reject | Cookie snapshot | sha256:demo:25072499 | 2026-12-10 | redacted |
after_accept: redacted list of cookies and requests.mock://evidence/ev-run-harbor-2026-11-05-privacy-after_accept | Cookie snapshot | sha256:demo:a5244932 | 2026-12-10 | redacted |