Download this report as a PDFNo email, no signup. It is this page, printed.
Most audit companies show you a designed mock-up of a report. This is the actual output of the engine this site sells, pointed at this site. Nothing below was written by hand — the scores, the findings and the recommendations are read straight out of the run.
Run against the pre-deployment build, not the live domain. getlightening.com currently serves a placeholder, so auditing it would describe the placeholder. This run went through a local server that applies the same response headers, compression and routing the host will.
What that server cannot fake is HTTPS, DNS or real-user field data. Those checks are listed below as conditions of the run rather than quietly dropped — a check that could not run is never reported as a defect, which is the rule the whole engine is built on.
A dash means the check could not run, not that it passed.
1 critical, 0 warning, 3 informational. Including the ones that are not flattering, because a sample report that only shows a site passing is an advertisement, not a sample.
No LocalBusiness structured data on the site
Add LocalBusiness (or Store/Restaurant) JSON-LD with name, address, phone and hours — this is how Google links the site to your Maps listing.
No public status page / uptime-monitoring signal detected
Set up uptime monitoring (UptimeRobot, Pingdom, BetterUptime) with alerting.
No Google Search Console verification meta tag found
Verify the site in Google Search Console to monitor indexing and search performance.
4 minor grammar/spelling issue(s) found
Light proofreading recommended.
The four findings that stand, in priority order, with what to change. This is the page to forward — it repeats nothing from the rest of the report and needs no context to act on.
Do: add a LocalBusiness JSON-LD block
(or Store / Restaurant as fits) carrying name,
address, phone and opening hours. This is what lets Google tie the site
to the Maps listing. One <script type="application/ld+json">
in <head>; validate with Google’s Rich Results Test.
Do: verify the property in Search Console, by DNS
TXT record or by the google-site-verification
meta tag. Without it there is no view of what the site ranks for or
which pages are excluded from the index.
Do: point an external monitor at the homepage with alerting — UptimeRobot, Pingdom or BetterUptime. Five minutes of setup; the alternative is learning about downtime from a customer.
Do: a proofreading pass. Each instance is listed with its page in the findings above.
Twenty further findings were raised by the engine and taken out by hand, with the reason recorded against each. They are above under “What a person overruled” and are not developer work.
This is the part a scanner cannot do. Every one of these is a real rule, correctly triggered, that does not apply to this site — and the reason is written down. It is what “every finding checked by hand” actually means.
No customer reviews or testimonials found on the page
True, and it stays true until there are real ones.
No web-analytics platform detected (GA4/Plausible/Matomo/etc.)
Deliberate. This site runs no analytics at all — that is the product promise, not an oversight.
No JS error monitoring detected (Sentry/Bugsnag/Rollbar)
Would mean shipping a third-party script. Not worth it for four lines of inline JavaScript.
High server latency (2073.6 ms)
Same.
42 of 65 touch targets (65%) are smaller than 44x44px
Measured against 44px, which is Apple's guidance rather than the WCAG 2.5.8 floor of 24px. Every target on this site clears 24; the stricter number is worth knowing and is not a failure.
No cookie consent banner / CMP detected
Correct as-is. A consent banner is required when you set cookies. This site sets none, so a banner would be theatre.
CSP allows 'unsafe-inline'
A real trade-off, made knowingly and written into _headers. Those inline scripts are why. Tightening it means moving them to files.
No tag manager (GTM) detected
Follows from the above. Nothing to manage.
No conversion tracking detected
Same. Enquiries arrive by email and are counted by hand.
No custom event tracking detected
Same trade. Rejected.
No A/B testing tool detected
Same trade. Rejected.
Many inline style attributes (133)
Real, and the cheapest thing on this list to fix. Layout choices that belong in the stylesheet were written inline while the page was moving fast.
No loading indicators found
Nothing on the page loads asynchronously.
Slow under load (avg 2174.3 ms)
Same.
No embedded Google Map
This is not a walk-in business.
X-XSS-Protection header not set
Retired by every current browser and actively harmful in old ones. Not setting it is correct; the engine's rule is out of date here.
5 inline scripts found
Ours, and small. They set the stored theme before first paint, wire the toggle, and keep the footer year current. The alternative is external files, which costs a request and a round trip on a site whose whole claim is that it makes one.
Email addresses exposed in HTML (1 found)
Intended. It is a contact address on a contact page.
No review/rating structured data
Refused on purpose. There are no reviews yet, and inventing them is the one thing this business cannot do.
No breadcrumbs detected
Measured on the homepage, which is the top level and has nothing above it to breadcrumb. Everything below it does: all 17 guides and the guide index ship a visible Home › Guides › title trail and BreadcrumbList structured data. This note previously read “a five-page site has no hierarchy”, which was true when it was written and stopped being true the day the guides shipped.
Conditions of this run, not defects. Each needs the live domain or the real host, and each says which.
Website is not using HTTPS
This report was run against the pre-deployment build over HTTP.
No SPF record found
Needs the live domain to resolve.
No DMARC record found
Needs the live domain to resolve.
og:image does not load as a valid image
It points at getlightening.com/og.png, which today serves the host's “Coming Soon” placeholder. Real, and it clears on deploy.
Response time is slow (2.07s)
Single-threaded local server, not the CDN.
No caching headers found
Set by the host at the edge.
No valid XML sitemap found
The sitemap lists getlightening.com URLs; this run audited localhost, so they correctly did not match.
No DKIM record found on common selectors
Needs the live domain to resolve.
DNSSEC not enabled
A registrar setting on the live domain.
No ETag or Last-Modified headers
Set by the host at the edge.
No CDN detected for static resources
The host IS the CDN.