Audit Result

Found 45 characters. Length is optimal.

Found 137 characters. Good snippet length.

Canonical found: https://cliqs.me/

Favicon found and reachable: /cliqs-logo.png?v=20260623 (HTTP 200).

Viewport configured: width=device-width, initial-scale=1.0

Language declared as "en".

Exactly one H1 found: "Create a link in bio page that sells, teaches, books and grows.".

Valid heading flow across 42 headings.

All 15 images include alt text.

Page is served over HTTPS.

2 HTTPS hardening issues detected.

• • HSTS is missing includeSubDomains.
• • Could not probe the HTTP version of this page.
• • Strict-Transport-Security: max-age=63072000

Fix: Set Strict-Transport-Security with a long max-age, add includeSubDomains, and redirect all HTTP requests to HTTPS.

Missing: x-frame-options.

Fix: Add the missing security headers at your reverse proxy or application layer.

2 CSP hardening issues detected.

• • script-src/default-src permits 'unsafe-inline'.
• • script-src/default-src permits 'unsafe-eval'.
• • Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://js.stripe.com; style-src 'self' 'unsafe-inline' data: https://fonts.googleapis.com; img-src 'self' data: blob: https:; media-src 'self' blob: https:; font-src 'self' data: https://fonts.gstatic.com; connect-src 'self' https: wss:; worker-src 'self' blob:; child-src 'self' blob:; frame-src 'self' https://js.stripe.com https://hooks.stripe.com https://*.zoom.us https://*.zoom.com https://www.youtube.com https://www.youtube-nocookie.com https://open.spotify.com; frame-ancestors 'self' https://*.zoom.us https://*.zoom.com; object-src 'none'; base-uri 'self'; form-action 'self' https://*.stripe.com

Fix: Tighten Content-Security-Policy by removing unsafe directives and adding object-src, base-uri, and frame-ancestors restrictions.

No first-party cookies were set during the initial page load.

Server response headers do not expose version tokens.

Domain does not appear to be behind Cloudflare.

Loaded in 0.57s (perceived).

6 scripts and 3 styles may block rendering.

• • script: https://us-assets.i.posthog.com/static/tracing-headers.js?v=1.398.0
• • script: https://us-assets.i.posthog.com/array/phc_yhrBhLForDpWT4J3c5zXBBJh2BfWwyYuAna6e35tXZTi/config.js
• • script: https://us-assets.i.posthog.com/static/posthog-recorder.js?v=1.398.0
• • script: https://us-assets.i.posthog.com/static/surveys.js?v=1.398.0
• • script: https://us-assets.i.posthog.com/static/dead-clicks-autocapture.js?v=1.398.0
• • script: https://us-assets.i.posthog.com/static/web-vitals.js?v=1.398.0
• • style: https://fonts.googleapis.com/css2?family=Plus+Jakarta+Sans:wght@400;500;600;700&display=swap
• • style: https://cliqs.me/assets/index-CLNSKDBl.css
• • style: https://cliqs.me/assets/app-BeP1182W.css

Fix: Defer non-critical scripts and inline critical CSS to improve first paint speed.

Text-like assets appear compressed.

Found robots.txt (200).

Found sitemap (200) at https://cliqs.me/sitemap-index.xml.

Robots meta found: index,follow

All 0 controls are labeled.

Missing landmarks: header.

Fix: Use semantic regions (<header>, <nav>, <main>, <footer>) for navigation and assistive tech.

12 interactive elements appear smaller than 48px.

• • a.hidden.sm:inline (Pricing) - 54x24px
• • a.hidden.sm:inline (Login) - 43x24px
• • button.inline-flex.h-10 (Switch public pages to light mode) - 40x40px
• • a.group.relative (Get Started) - 138x40px
• • button.text-gray-600.hover:text-purple-600 (Manage Cookie Preferences) - 216x24px
• • a.text-white/70.hover:text-white - 18x24px
• • a.text-white/70.hover:text-white - 20x24px
• • a.text-white/70.hover:text-white - 18x24px
• • a.text-white/70.hover:text-white - 20x24px
• • button.px-4.py-2 (Decline All) - 99x36px
• • button.px-4.py-2 (Accept All) - 98x36px
• • button.text-gray-400.hover:text-gray-600 (Close) - 28x36px

Fix: Increase target size to at least 48x48 CSS pixels for touch interactions.

Core Open Graph tags are present.

og:image is present and absolute.

twitter:card set to summary_large_image.

JSON-LD schema detected.

Manifest or Apple touch icon is missing.

Fix: Link your web app manifest and apple-touch-icon for improved install/share experiences.

1 social preview quality issues detected.

• • ISSUE: Failed to fetch preview image: network error.
• • GUIDELINE: Optimal og:title length: 40-60 characters (acceptable: 10-70).
• • GUIDELINE: Optimal og:description length: 110-160 characters (acceptable: 50-200).
• • GUIDELINE: Optimal preview image size: 1200x630 pixels.
• • GUIDELINE: Optimal preview image aspect ratio: 1.91:1.
• • GUIDELINE: Optimal preview image file size: under 5 MB.
• • GUIDELINE: Recommended twitter:card: summary_large_image.

Fix: Use absolute OG/Twitter URLs, keep metadata lengths in recommended ranges, and provide a preview image near 1200x630 under 5MB.

Checked 30 links. No broken internal links found.

No broken external links found in checked URLs.

All 45 links use non-empty href values.

Largest Contentful Paint: 0.74s.

Cumulative Layout Shift: 0.001.

Total Blocking Time estimate: 28ms.

8 asset requests failed.

• • https://www.googletagmanager.com/gtag/js?id=G-R90YCVQYWV (csp)
• • https://us-assets.i.posthog.com/static/tracing-headers.js?v=1.398.0 (csp)
• • https://us-assets.i.posthog.com/array/phc_yhrBhLForDpWT4J3c5zXBBJh2BfWwyYuAna6e35tXZTi/config.js (csp)
• • https://us-assets.i.posthog.com/static/posthog-recorder.js?v=1.398.0 (csp)
• • https://us-assets.i.posthog.com/static/surveys.js?v=1.398.0 (csp)
• • https://us-assets.i.posthog.com/static/dead-clicks-autocapture.js?v=1.398.0 (csp)
• • https://us-assets.i.posthog.com/static/web-vitals.js?v=1.398.0 (csp)
• • https://analytics.ahrefs.com/analytics.js (csp)

Fix: Fix missing files, update asset URLs, and ensure static assets return HTTP 200.

16 JavaScript runtime issues detected.

• • Request failed: https://www.googletagmanager.com/gtag/js?id=G-R90YCVQYWV (csp, type: script)
• • Request failed: https://us-assets.i.posthog.com/static/tracing-headers.js?v=1.398.0 (csp, type: script)
• • Request failed: https://us-assets.i.posthog.com/array/phc_yhrBhLForDpWT4J3c5zXBBJh2BfWwyYuAna6e35tXZTi/config.js (csp, type: script)
• • Request failed: https://us-assets.i.posthog.com/static/posthog-recorder.js?v=1.398.0 (csp, type: script)
• • Request failed: https://us-assets.i.posthog.com/static/surveys.js?v=1.398.0 (csp, type: script)
• • Request failed: https://us-assets.i.posthog.com/static/dead-clicks-autocapture.js?v=1.398.0 (csp, type: script)
• • Request failed: https://us-assets.i.posthog.com/static/web-vitals.js?v=1.398.0 (csp, type: script)
• • Request failed: https://analytics.ahrefs.com/analytics.js (csp, type: script)
• • Loading the script 'https://www.googletagmanager.com/gtag/js?id=G-R90YCVQYWV' violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://js.stripe.com". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback. The action has been blocked. [https://cliqs.me/:1]
• • Loading the script 'https://us-assets.i.posthog.com/static/tracing-headers.js?v=1.398.0' violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://js.stripe.com". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback. The action has been blocked. [https://cliqs.me/assets/index-CWZWFb5Y.js:1078]
• • Loading the script 'https://us-assets.i.posthog.com/array/phc_yhrBhLForDpWT4J3c5zXBBJh2BfWwyYuAna6e35tXZTi/config.js' violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://js.stripe.com". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback. The action has been blocked. [https://cliqs.me/assets/index-CWZWFb5Y.js:1078]
• • Loading the script 'https://us-assets.i.posthog.com/static/posthog-recorder.js?v=1.398.0' violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://js.stripe.com". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback. The action has been blocked. [https://cliqs.me/assets/index-CWZWFb5Y.js:1078]
• • Loading the script 'https://us-assets.i.posthog.com/static/surveys.js?v=1.398.0' violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://js.stripe.com". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback. The action has been blocked. [https://cliqs.me/assets/index-CWZWFb5Y.js:1078]
• • Loading the script 'https://us-assets.i.posthog.com/static/dead-clicks-autocapture.js?v=1.398.0' violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://js.stripe.com". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback. The action has been blocked. [https://cliqs.me/assets/index-CWZWFb5Y.js:1078]
• • Loading the script 'https://us-assets.i.posthog.com/static/web-vitals.js?v=1.398.0' violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://js.stripe.com". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback. The action has been blocked. [https://cliqs.me/assets/index-CWZWFb5Y.js:1078]
• • Loading the script 'https://analytics.ahrefs.com/analytics.js' violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://js.stripe.com". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback. The action has been blocked. [https://cliqs.me/:118]

Fix: Fix JS files returning 404/failed requests and resolve the listed runtime exceptions.