Audit Result

Found 29 characters. Keep title between 30 and 60 characters.

Fix: Add a unique <title> tag describing the main page intent in 30-60 characters.

Found 73 characters. Good snippet length.

Canonical found: https://www.hsbc.com.cn/

Favicon found and reachable: /etc.clientlibs/dpws/clientlibs-public/clientlib-site/resources/favicons/favicon-32x32.png (HTTP 200).

Viewport configured: width=device-width, initial-scale=1.0

Language declared as "zh-cn".

Found 2 H1 tags.

Fix: Use a single, descriptive <h1> that states the primary purpose of the page.

Valid heading flow across 104 headings.

6 of 11 images are missing alt text.

Fix: Add meaningful alt attributes to all informative images for accessibility and image SEO.

Page is served over HTTPS.

1 HTTPS hardening issues detected.

• • Could not probe the HTTP version of this page.
• • Strict-Transport-Security: max-age=31536000; includeSubDomains

Fix: Set Strict-Transport-Security with a long max-age, add includeSubDomains, and redirect all HTTP requests to HTTPS.

Missing: referrer-policy.

Fix: Add the missing security headers at your reverse proxy or application layer.

4 CSP hardening issues detected.

• • script-src/default-src permits 'unsafe-inline'.
• • script-src/default-src permits 'unsafe-eval'.
• • object-src should be 'none' unless legacy plugins are required.
• • CSP is missing a base-uri restriction.
• • Content-Security-Policy: default-src 'self' *.hsbc.com.hk *.mastercard.com.au *.demdex.net *.lpsnmedia.net *.liveperson.net; script-src 'self' 'unsafe-eval' 'unsafe-inline' *.tiqcdn.com *.tealiumiq.com *.liveperson.net *.googletagmanager.com *.hsbc.co.uk *.hsbc.com.hk *.doubleclick.net *.googleadservices.com *.lpsnmedia.net *.optimizely.com *.facebook.net *.google.com *.gstatic.com *.appdynamics.com *.googleapis.com *.awswaf.com *.analytics.yahoo.com vjs.zencdn.net players.brightcove.net *.ads-twitter.com *.hsbc.ae vdata.amap.com webapi.amap.com restapi.amap.com *.omtrdc.net *.hsbc.com.cn *.utag *.recaptcha.net *.amap.com *.brightcove.net *.gstatic.cn; img-src 'self' blob: *.hsbc.com.hk *.eum-appdynamics.com *.google.com.hk *.google.com *.google.co.in *.doubleclick.net *.googleapis.com *.facebook.com data: *.gstatic.com *; connect-src 'self' *.tiqcdn.com *.tealiumiq.com *.hsbc.com.hk *.eum-appdynamics.com *.optimizely.com wss://*.liveperson.net *.cloud.hsbc *.googleapis.com *.awswaf.com *.analytics.yahoo.com players.brightcove.net edge.api.brightcove.com *.hsbc.ae *.omtrdc.net *.demdex.net *.hsbc.co.om *.brightcovecdn.com vdata.amap.com *.hsbc.com.cn *.boltdns.net *.brightcove.com http://127.0.0.1:5000 manifest.prod.boltdns.net *.akamaihd.net brightcove.hs.llnwd.net *.amap.com; frame-src 'self' blob: *.lpsnmedia.net *.optimizely.com *.liveperson.net *.google.com *.doubleclick.net *.analytics.yahoo.com players.brightcove.net *.recaptcha.net; frame-ancestors 'self'; font-src 'self' data: *.hsbc.com.hk *.gstatic.com; worker-src 'self' blob:; child-src 'self'; media-src 'self' blob: *.boltdns.net *.media.brightcove.com *.llnw.net *.llnwd.net *.akafms.net *.akamaihd.net *.cf.brightcove.com *.brightcovecdn.com *.brightcove.com; style-src 'self' 'unsafe-inline' *.hsbc.com.hk *.googleapis.com players.brightcove.net; object-src 'self' blob:; manifest-src 'self'; upgrade-insecure-requests ; report-uri https://csp.prod2.ap.dynp.cloud1.vv1865.com;

Fix: Tighten Content-Security-Policy by removing unsafe directives and adding object-src, base-uri, and frame-ancestors restrictions.

No first-party cookies were set during the initial page load.

Server response headers do not expose version tokens.

Domain does not appear to be behind Cloudflare.

Loaded in 2.64s (perceived).

Fix: Reduce payload size, cache static assets, and remove non-critical JS from initial load.

2 scripts and 1 styles may block rendering.

• • script: https://www.hsbc.com.cn/utag/hsbc/cn-rbwm/prod/utag.sync.js
• • script: https://www.hsbc.com.cn/etc.clientlibs/hsbc/global/clientlibs/appd.min.28729b81913621076cb1004898cb22c7.js
• • style: https://www.hsbc.com.cn/etc.clientlibs/dpws/clientlibs-public/clientlib-china.min.98112837095cdb1d581b9cc265834692.css

Fix: Defer non-critical scripts and inline critical CSS to improve first paint speed.

6 text resources look uncompressed.

• • https://www.hsbc.com.cn/ (text/html; charset=utf-8)
• • https://akamai.tiqcdn.com/location/location.js (application/x-javascript)
• • https://www.hsbc.com.cn/configuration/modals/you-are-leaving-hsbc.modal/ (text/html; charset=utf-8)
• • https://www.hsbc.com.cn/auth-status-hint?_=1779843586903 (application/json)
• • https://www.hsbc.com.cn/configuration/modals/you-are-leaving-hsbc-international.modal/ (text/html; charset=utf-8)
• • https://col.eum-appdynamics.com/eumcollector/beacons/browser/v1/AD-AAB-AAD-DCB/adrum (text/html)

Fix: Enable Brotli or Gzip compression for HTML, CSS, JS, and JSON responses.

Found robots.txt (200).

Found sitemap (200) at https://www.hsbc.com.cn/sitemaps.xml.

No robots meta tag defined.

Fix: Add <meta name="robots" content="index,follow"> (or the intended directive) in <head>.

All 0 controls are labeled.

Header, nav, main, and footer landmarks are present.

25 interactive elements appear smaller than 48px.

• • button.close-cookie-banner (close cookie banner) - 24x39px
• • a (个人银行) - 69x15px
• • a (卓越小微企业服务) - 117x15px
• • a (商业理财) - 69x15px
• • a (私人银行) - 69x15px
• • a (村镇银行) - 68x15px
• • a.selected-item (选择语言 简体) - 65x36px
• • a.selected-item.login-button (登录) - 76x37px
• • button.close-notification-banner (关闭通知) - 24x26px
• • a.A-LNKC16R-RW-ALL (多面财富管理) - 122x20px
• • a.A-LNKC16R-RW-ALL (维系全球联接) - 122x20px
• • a.A-LNKC16R-RW-ALL (卓然银行服务) - 122x20px
• • a.A-LNKC16R-RW-ALL (卓越理财・尊尚) - 138x20px
• • a.A-LNKC16R-RW-ALL (结构性存款产品（银行自有产品）) - 266x20px
• • a.A-LNKC16R-RW-ALL (代客境外理财计划 – 海外基金型（银行自有产品）) - 295x39px
• • a.A-LNKC16R-RW-ALL (内地证券投资基金（代销）) - 218x20px
• • a.A-LNKC16R-RW-ALL (查看更多) - 90x20px
• • a.A-LNKC16R-RW-ALL (留学前 - 出国准备) - 153x20px
• • a.A-LNKC16R-RW-ALL (留学中 - 海外守护) - 153x20px
• • a.A-LNKC16R-RW-ALL (留学后 - 未来规划) - 153x20px
• • a.A-LNKC16R-RW-ALL (查看更多) - 90x20px
• • a.A-LNKC16R-RW-ALL (手机银行) - 90x20px
• • a.A-LNKC16R-RW-ALL (微信服务号) - 106x20px
• • a.A-LNKC16R-RW-ALL (个人网上银行) - 122x20px
• • a.A-LNKC16R-RW-ALL (汇丰直播间) - 106x20px

Fix: Increase target size to at least 48x48 CSS pixels for touch interactions.

Core Open Graph tags are present.

og:image exists but is not an absolute URL.

Fix: Use an absolute URL in <meta property="og:image">.

twitter:card set to summary.

No JSON-LD schema scripts found.

Fix: Add JSON-LD structured data matching your page type (Organization, Article, Product, etc.).

Manifest and Apple touch icon are configured.

2 social preview quality issues detected.

• • ISSUE: Use an absolute URL for og:image or twitter:image.
• • ISSUE: twitter:card should be summary_large_image for richer previews.
• • GUIDELINE: Optimal og:title length: 40-60 characters (acceptable: 10-70).
• • GUIDELINE: Optimal og:description length: 110-160 characters (acceptable: 50-200).
• • GUIDELINE: Optimal preview image size: 1200x630 pixels.
• • GUIDELINE: Optimal preview image aspect ratio: 1.91:1.
• • GUIDELINE: Optimal preview image file size: under 5 MB.
• • GUIDELINE: Recommended twitter:card: summary_large_image.

Fix: Use absolute OG/Twitter URLs, keep metadata lengths in recommended ranges, and provide a preview image near 1200x630 under 5MB.

Checked 80 links. No broken internal links found.

2 external links returned errors or timed out.

• • https://www.services.online-banking.hsbc.com.cn/gpib/channel/?idv_cmd=idv.Logoff&nextPage=saasextention/ICSaaSExtRedirectionController/ADVANCE_LOGOUT_LANDING_PAGE (HTTP 500)
• • https://hsbc.com.cn/investment-platform/ui/fhc/startPws?targetFunction=home&sourceType=pws (HTTP 400)

Fix: Replace dead external URLs or point to working alternatives.

6 links are empty, invalid, or placeholder-only.

• • href="#" text="选择语言 简体"
• • href="(empty)" text="登录"
• • href="#"
• • href="#"
• • href="(empty)" text="登录 已展开 已折叠"
• • href="#" text="返回顶部"

Fix: Replace empty/#/javascript href values with real destinations or use buttons for non-navigation actions.

Largest Contentful Paint: 2.89s.

Fix: Improve LCP by optimizing above-the-fold media, reducing server latency, and inlining critical CSS.

Cumulative Layout Shift: 0.035.

Total Blocking Time estimate: 291ms.

Fix: Reduce heavy JavaScript work, split long tasks, and defer non-critical scripts.

1 asset requests failed.

• • https://cdn.hsbc.com.cn/utag/hsbc/cn-rbwm/prod/utag.455.js?utv=ut4.46.202211221328 (net::ERR_NAME_NOT_RESOLVED)

Fix: Fix missing files, update asset URLs, and ensure static assets return HTTP 200.

2 JavaScript runtime issues detected.

• • Request failed: https://cdn.hsbc.com.cn/utag/hsbc/cn-rbwm/prod/utag.455.js?utv=ut4.46.202211221328 (net::ERR_NAME_NOT_RESOLVED, type: script)
• • Failed to load resource: net::ERR_NAME_NOT_RESOLVED [https://cdn.hsbc.com.cn/utag/hsbc/cn-rbwm/prod/utag.455.js?utv=ut4.46.202211221328:1]

Fix: Fix JS files returning 404/failed requests and resolve the listed runtime exceptions.