Prototype. Sample sites use fixture data on .example domains. Quick scans are a single read of a home page, not a full audit.

Fix cards

A small, reviewed set of stack-aware cards. Each says who fixes it, where, the risk, how to roll back, and how the next audit proves it worked.

High priorityWordPress 6.8High confidencenorthwind-dental.example →

Trackers before a choice

Request log before a choice shows stats.mockstat.example.

Why it matters

Measurement should wait for consent when its purpose is not strictly necessary.

Owner · where

Web developer · Consent plugin script blocking, or the theme header

Steps

  1. Mark the MockStat script as analytics in the consent plugin.
  2. Load it only after the accept event.
  3. Re-run the three-state check.

Risk · rollback

Low. Analytics counts drop for visitors who reject. Restore the previous script include.

Verified when

Next audit: no tracker in the before-choice request log; tracker present after accept.

High priorityWordPress 6.8High confidencenorthwind-dental.example →

Security headers

CSP and X-Content-Type-Options missing since last run.

Why it matters

These headers limit the damage of injected scripts and content sniffing.

Owner · where

Hosting owner · Server or CDN response header rules

Steps

  1. Restore X-Content-Type-Options: nosniff.
  2. Restore the previous Content-Security-Policy.
  3. Check the site in a private window for blocked assets.

Risk · rollback

Medium. A strict CSP can block a forgotten third-party script. Remove the CSP header and keep nosniff.

Verified when

Next audit: marketing.security_headers passes.

Medium priorityWordPress theme-dependentMedium confidencenorthbeam-staffing.example →

H1 & heading outline

Home page has no H1; the main statement is an H3.

Why it matters

The H1 tells search engines and screen readers what the page is about. The current main sentence already says it; it only has the wrong level.

Owner · where

Web developer or theme owner · Home page template or page builder block for the hero text

Steps

  1. Change the hero sentence block from H3 to H1.
  2. Keep exactly one H1 on the page.
  3. Move the section headings to H2 so the outline reads in order.

Risk · rollback

Low. Font size may change with the heading level; check the hero layout. Set the block back to H3.

Verified when

Next audit: marketing.h1 passes with exactly one H1 on the home page.

Medium priorityWordPress any SEO pluginMedium confidencenorthbeam-staffing.example →

Meta description

No meta description found on the home page.

Why it matters

Without it, the search result snippet is chosen automatically and may not describe the offer.

Owner · where

Marketing owner · SEO plugin settings for the home page, per language

Steps

  1. Write a 120–155 character description for the English home page.
  2. Write a separate one for /hu/.
  3. Publish and clear the page cache.

Risk · rollback

None for users. Clear the field.

Verified when

Next audit: marketing.meta_description passes on both language versions.

Medium priorityWordPress 7.xMedium confidenceclearpath-compliance.example →

Reject as easy as accept

Cookie notice offers “I accept” only; no reject or settings control seen.

Why it matters

Visitors should be able to refuse as easily as they accept. An accept-only notice also makes it hard to show that measurement waits for a choice.

Owner · where

Site owner with the web developer · Cookie notice plugin or theme footer script

Steps

  1. Add a reject (necessary only) button with the same size and prominence as accept.
  2. Add a settings link in the footer that reopens the choice.
  3. Make sure measurement scripts load only after accept.

Risk · rollback

Low. Traffic statistics will drop by the share of visitors who reject. Restore the previous notice configuration.

Verified when

Next audit: privacy.reject_comparable passes and the three-state run shows no measurement request before a choice.

Medium priorityWordPress 6.8High confidencenorthwind-dental.example →

LCP (lab)

LCP median 3080 ms; the LCP element is the hero image.

Why it matters

The first screen is what visitors wait for.

Owner · where

Web developer · Hero block image settings

Steps

  1. Serve the hero in WebP or AVIF at the displayed size.
  2. Add fetchpriority=high and exclude it from lazy loading.

Risk · rollback

Low. Restore the original image.

Verified when

Next audit: LCP median below 2500 ms outside the noise band.

Medium priorityWooCommerce 9.4High confidenceharbor-goods.example →

Canonical

rel=canonical uses http:// on an HTTPS site.

Why it matters

Search engines may treat the http:// URL as the main one and split signals.

Owner · where

Web developer · WordPress Address and Site Address settings, SEO plugin

Steps

  1. Set both addresses in Settings → General to https://.
  2. Regenerate the SEO plugin canonical cache.

Risk · rollback

Low. Restore the previous addresses.

Verified when

Next audit: marketing.canonical passes.