Read-only report · shared from Own site
Prototype. Sample sites use fixture data on .example domains. Quick scans are a single read of a home page, not a full audit.

northwind-dental.exampleCompletedSample data

Audited 9 Nov 2026, 09:12Profile mobile-lab-v1WordPress 6.8
Full audit, sample data. Sample data: a fictional .example site with fixture numbers shaped like real audit output.

Summary

Performance

4issues4 no data / failed

LCP improved and is verified by the median. TBT got worse. The score twitch is noise.

Marketing & technical

2issues

Meta description fix is verified. Security headers regressed after a host change.

Privacy

2issues1 no data / failed

A measurement request still leaves before the visitor chooses.

Plain-language summary

Built only from the findings below. Every line names its evidence.

  1. HighMarketing & technicalHigh confidence

    Content-Security-Policy and X-Content-Type-Options are missing. Both were present in the previous run. Fix this first.

    Evidence: HTTP headers · Based on the fetched HTML and headers. It does not claim a ranking change.

  2. HighPerformanceHigh confidence

    Hero image LCP is above the 2.5 s threshold but clearly lower than last month. Fix this first.

    Evidence: Lab JSON · Based on lab runs. It does not claim real visitors see the same.

  3. HighPrivacyHigh confidence

    A MockStat request leaves before any choice is made. Fix this first.

    Evidence: Request log · Based on observed requests. Not legal advice and not a certificate.

  4. MediumPerformanceHigh confidence

    Layout shift sits at the same level, inside the noise band, above 0.10. Worth doing in the next round.

    Evidence: Lab JSON · Based on lab runs. It does not claim real visitors see the same.

  5. MediumPerformanceHigh confidence

    Total Blocking Time rose on the three-run median. Worth doing in the next round.

    Evidence: Lab JSON · Based on lab runs. It does not claim real visitors see the same.

Performance · lab

Fixed mobile profile, three runs, median. Lab and field data are kept apart.

MetricRun 1Run 2Run 3MedianPreviousStatusChange
LCPLargest Contentful Paint3,080 ms2,960 ms3,140 ms3,080 ms4,120 msIssueImproved
CLSCumulative Layout Shift0.120.110.130.120.11IssueUnchanged
TBTTotal Blocking Time410 ms380 ms440 ms410 ms290 msIssueRegressed
FCPFirst Contentful Paint1,820 ms1,760 ms1,900 ms1,820 ms1,880 msPassUnchanged
Speed IndexSpeed Index3,900 ms3,700 ms4,100 ms3,900 ms4,200 msIssueUnchanged
Score0–100, never used alone6366646461Unchanged
The lab score moved from 61 to 64. The noise band is ±5 points, so this is neither an improvement nor a regression. The report compares metric medians and closed rule states instead.

Performance · field (CrUX)

No URL-level CrUX data, so the report falls back to the origin. INP has no data at either level.

MetricScopep75PreviousStatus
LCPThis URLNo dataNo dataNo data
CLSThis URLNo dataNo dataNo data
INPThis URLNo dataNo dataNo data
LCPWhole origin2,910 ms3,260 msHas data
CLSWhole origin0.090.10Has data
INPWhole originNo dataNo dataNo data

Marketing & technical checks

Structured checks on the start URL. Not a full SEO suite.

CheckStatusPriorityConfidence
HTTP statusThe start URL answers 200.Pass—High confidence
HTTPSThe page loads over HTTPS without mixed content.Pass—High confidence
Security headersContent-Security-Policy and X-Content-Type-Options are missing. Both were present in the previous run.IssueHighHigh confidence
TitleUnique title: “Northwind Dental – family dentistry”.Pass—High confidence
Meta descriptionMeta description is 148 characters. It was 42 in the previous run.Pass—High confidence
CanonicalCanonical points to the HTTPS start URL.Pass—High confidence
Robots & noindexNo noindex. robots.txt allows the home page.Pass—High confidence
SitemapSitemap index found and listed in robots.txt.Pass—High confidence
H1 & heading outlineOne H1: “Gentle dentistry for the whole family”.Pass—High confidence
Open GraphOpen Graph title is set; og:image is missing.IssueLowHigh confidence
Analytics tagsOne MockStat tag is in the HTML. The audit does not check that the account measures correctly.Pass—Medium confidence

Privacy · three isolated browser states

Each state starts from a clean browser. No forms, checkout or login.

Before a choice

Banner
Shown
Trackers
stats.mockstat.example
Cookies
session (necessary), mockstat_id (purpose unclear)
Note
A measurement request leaves before any choice.

After reject

Banner
Not shown
Trackers
None
Cookies
session (necessary), consent=rejected
Note
No tracker after reject.

After accept

Banner
Not shown
Trackers
stats.mockstat.example
Cookies
session (necessary), consent=accepted, mockstat_id
Note
Measurement loads as expected after accept.

Privacy observations

Technical observation only. This is not legal advice and not a compliance certificate. When the purpose of a cookie cannot be decided from the evidence, its “necessary” classification is marked as uncertain.

CheckStatusPriorityConfidence
Three-state browser runAll three isolated states ran: before a choice, after reject, after accept.Pass—High confidence
Consent noticeA consent banner appears on first visit.Pass—High confidence
Reject as easy as acceptReject sits in a second layer; accept is one click. The two paths are not equally easy.IssueMediumHigh confidence
Trackers before a choiceA MockStat request leaves before any choice is made.IssueHighHigh confidence
Reopen cookie settingsCookie settings can be reopened from the footer. The link was missing last time.Pass—High confidence
“Necessary” classificationmockstat_id is not classed as necessary: its purpose cannot be decided from the evidence.No data—Low confidence
Forms, checkout, loginForm submission, checkout and login are out of scope.Not tested—High confidence

Fix cards

Stack-aware steps with owner, risk, rollback and how the next audit verifies it.

High priorityWordPress 6.8High confidence

Trackers before a choice

Request log before a choice shows stats.mockstat.example.

Why it matters

Measurement should wait for consent when its purpose is not strictly necessary.

Owner · where

Web developer · Consent plugin script blocking, or the theme header

Steps

  1. Mark the MockStat script as analytics in the consent plugin.
  2. Load it only after the accept event.
  3. Re-run the three-state check.

Risk · rollback

Low. Analytics counts drop for visitors who reject. Restore the previous script include.

Verified when

Next audit: no tracker in the before-choice request log; tracker present after accept.

High priorityWordPress 6.8High confidence

Security headers

CSP and X-Content-Type-Options missing since last run.

Why it matters

These headers limit the damage of injected scripts and content sniffing.

Owner · where

Hosting owner · Server or CDN response header rules

Steps

  1. Restore X-Content-Type-Options: nosniff.
  2. Restore the previous Content-Security-Policy.
  3. Check the site in a private window for blocked assets.

Risk · rollback

Medium. A strict CSP can block a forgotten third-party script. Remove the CSP header and keep nosniff.

Verified when

Next audit: marketing.security_headers passes.

Medium priorityWordPress 6.8High confidence

LCP (lab)

LCP median 3080 ms; the LCP element is the hero image.

Why it matters

The first screen is what visitors wait for.

Owner · where

Web developer · Hero block image settings

Steps

  1. Serve the hero in WebP or AVIF at the displayed size.
  2. Add fetchpriority=high and exclude it from lazy loading.

Risk · rollback

Low. Restore the original image.

Verified when

Next audit: LCP median below 2500 ms outside the noise band.

Changes since the previous audit

Compared with 12 Oct 2026, 10:05. A fix counts only when this run measures it.

CheckAreaPreviousNowChange
Security headersMarketing & technicalPassIssueRegressed
TBT (lab)Performance290 ms410 msRegressed
Meta descriptionMarketing & technicalIssuePassImproved
LCP · CrUX originPerformance3,260 ms2,910 msImproved
LCP (lab)Performance4,120 ms3,080 msImproved
Reopen cookie settingsPrivacyIssuePassImproved
Analytics tagsMarketing & technicalPassPassUnchanged
CanonicalMarketing & technicalPassPassUnchanged
H1 & heading outlineMarketing & technicalPassPassUnchanged
HTTP statusMarketing & technicalPassPassUnchanged
HTTPSMarketing & technicalPassPassUnchanged
Open GraphMarketing & technicalIssueIssueUnchanged
Robots & noindexMarketing & technicalPassPassUnchanged
SitemapMarketing & technicalPassPassUnchanged
TitleMarketing & technicalPassPassUnchanged
CLS · CrUX originPerformance0.100.09Unchanged
CLS (lab)Performance0.110.12Unchanged
FCP (lab)Performance1,880 ms1,820 msUnchanged
Lab score (0–100)Performance6164Unchanged
Speed Index (lab)Performance4,200 ms3,900 msUnchanged
Consent noticePrivacyPassPassUnchanged
Reject as easy as acceptPrivacyIssueIssueUnchanged
Three-state browser runPrivacyPassPassUnchanged
Trackers before a choicePrivacyIssueIssueUnchanged

Evidence

Stored per run with a hash and a retention date. Cookie snapshots are redacted.

EvidenceTypeHashRetentionRedaction
The start URL answers 200.mock://evidence/ev-run-northwind-2026-11-09-marketing.http_statusHTTP headerssha256:demo:6d23f1a82026-12-10not applicable
The page loads over HTTPS without mixed content.mock://evidence/ev-run-northwind-2026-11-09-marketing.httpsHTML extractsha256:demo:dc40886a2026-12-10not applicable
Content-Security-Policy and X-Content-Type-Options are missing. Both were present in the previous run.mock://evidence/ev-run-northwind-2026-11-09-marketing.security_headersHTTP headerssha256:demo:6b3cea862026-12-10not applicable
Unique title: “Northwind Dental – family dentistry”.mock://evidence/ev-run-northwind-2026-11-09-marketing.titleHTML extractsha256:demo:60d37c612026-12-10not applicable
Meta description is 148 characters. It was 42 in the previous run.mock://evidence/ev-run-northwind-2026-11-09-marketing.meta_descriptionHTML extractsha256:demo:749f4ed12026-12-10not applicable
Canonical points to the HTTPS start URL.mock://evidence/ev-run-northwind-2026-11-09-marketing.canonicalHTML extractsha256:demo:2d5f27cd2026-12-10not applicable
No noindex. robots.txt allows the home page.mock://evidence/ev-run-northwind-2026-11-09-marketing.robotsHTML extractsha256:demo:1e0087ac2026-12-10not applicable
Sitemap index found and listed in robots.txt.mock://evidence/ev-run-northwind-2026-11-09-marketing.sitemapHTML extractsha256:demo:4cb1b8802026-12-10not applicable
One H1: “Gentle dentistry for the whole family”.mock://evidence/ev-run-northwind-2026-11-09-marketing.h1HTML extractsha256:demo:9fb8efca2026-12-10not applicable
Open Graph title is set; og:image is missing.mock://evidence/ev-run-northwind-2026-11-09-marketing.ogHTML extractsha256:demo:39b193732026-12-10not applicable
One MockStat tag is in the HTML. The audit does not check that the account measures correctly.mock://evidence/ev-run-northwind-2026-11-09-marketing.analytics_tagsHTML extractsha256:demo:a4eff61d2026-12-10not applicable
All three isolated states ran: before a choice, after reject, after accept.mock://evidence/ev-run-northwind-2026-11-09-privacy.three_stateHTML extractsha256:demo:3d77c89d2026-12-10redacted
A consent banner appears on first visit.mock://evidence/ev-run-northwind-2026-11-09-privacy.consent_uiHTML extractsha256:demo:1e5cddec2026-12-10redacted
Reject sits in a second layer; accept is one click. The two paths are not equally easy.mock://evidence/ev-run-northwind-2026-11-09-privacy.reject_comparableHTML extractsha256:demo:dd45f4132026-12-10redacted
A MockStat request leaves before any choice is made.mock://evidence/ev-run-northwind-2026-11-09-privacy.tracker_before_decisionRequest logsha256:demo:539a1dfa2026-12-10redacted
Cookie settings can be reopened from the footer. The link was missing last time.mock://evidence/ev-run-northwind-2026-11-09-privacy.settings_reopenHTML extractsha256:demo:37284eb42026-12-10redacted
mockstat_id is not classed as necessary: its purpose cannot be decided from the evidence.mock://evidence/ev-run-northwind-2026-11-09-privacy.necessary_classificationHTML extractsha256:demo:0f39e0612026-12-10redacted
LCP, three lab runs: 3080, 2960, 3140mock://evidence/ev-run-northwind-2026-11-09-perf.lab.lcpLab JSONsha256:demo:ea1e282c2026-12-10not applicable
CLS, three lab runs: 0.12, 0.11, 0.13mock://evidence/ev-run-northwind-2026-11-09-perf.lab.clsLab JSONsha256:demo:0e278edf2026-12-10not applicable
TBT, three lab runs: 410, 380, 440mock://evidence/ev-run-northwind-2026-11-09-perf.lab.tbtLab JSONsha256:demo:325fa0d12026-12-10not applicable
FCP, three lab runs: 1820, 1760, 1900mock://evidence/ev-run-northwind-2026-11-09-perf.lab.fcpLab JSONsha256:demo:35ee42fe2026-12-10not applicable
SPEED_INDEX, three lab runs: 3900, 3700, 4100mock://evidence/ev-run-northwind-2026-11-09-perf.lab.speed_indexLab JSONsha256:demo:3f93e8e72026-12-10not applicable
Lab scores: 63, 66, 64mock://evidence/ev-run-northwind-2026-11-09-perf.lab.scoreLab JSONsha256:demo:55ab0d112026-12-10not applicable
CrUX url LCP: empty response.mock://evidence/ev-run-northwind-2026-11-09-perf.field.url.lcpCrUX JSONsha256:demo:f38dc74c2026-12-10not applicable
CrUX url CLS: empty response.mock://evidence/ev-run-northwind-2026-11-09-perf.field.url.clsCrUX JSONsha256:demo:1798c0ff2026-12-10not applicable
CrUX url INP: empty response.mock://evidence/ev-run-northwind-2026-11-09-perf.field.url.inpCrUX JSONsha256:demo:e074982e2026-12-10not applicable
CrUX origin LCP: 2910mock://evidence/ev-run-northwind-2026-11-09-perf.field.origin.lcpCrUX JSONsha256:demo:741cb3af2026-12-10not applicable
CrUX origin CLS: 0.09mock://evidence/ev-run-northwind-2026-11-09-perf.field.origin.clsCrUX JSONsha256:demo:b22b73742026-12-10not applicable
CrUX origin INP: empty response.mock://evidence/ev-run-northwind-2026-11-09-perf.field.origin.inpCrUX JSONsha256:demo:428f4e3d2026-12-10not applicable
before_decision: redacted list of cookies and requests.mock://evidence/ev-run-northwind-2026-11-09-privacy-before_decisionCookie snapshotsha256:demo:c5ca37022026-12-10redacted
after_reject: redacted list of cookies and requests.mock://evidence/ev-run-northwind-2026-11-09-privacy-after_rejectCookie snapshotsha256:demo:1787746c2026-12-10redacted
after_accept: redacted list of cookies and requests.mock://evidence/ev-run-northwind-2026-11-09-privacy-after_acceptCookie snapshotsha256:demo:4d342dd32026-12-10redacted