Audit Result

Found 32 characters. Length is optimal.

Missing meta description.

Fix: Add <meta name="description" content="..."> in <head> with a clear page summary.

Canonical link not found.

Fix: Add <link rel="canonical" href="https://example.com/page"> to avoid duplicate URL ambiguity.

No favicon link found in <head>.

Fix: Add <link rel="icon" href="/favicon.ico"> to ensure browser tab and bookmark visibility.

Viewport configured: width=device-width,initial-scale=1

Language declared as "en-US".

Exactly one H1 found: "Sorry, you have been blocked".

Valid heading flow across 4 headings.

All 0 images include alt text.

Page is served over HTTPS.

1 HTTPS hardening issues detected.

• • Could not probe the HTTP version of this page.
• • Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Fix: Set Strict-Transport-Security with a long max-age, add includeSubDomains, and redirect all HTTP requests to HTTPS.

Missing: x-frame-options.

Fix: Add the missing security headers at your reverse proxy or application layer.

4 CSP hardening issues detected.

• • script-src/default-src permits 'unsafe-inline'.
• • script-src/default-src permits 'unsafe-eval'.
• • CSP is missing a base-uri restriction.
• • CSP is missing frame-ancestors protection.
• • Content-Security-Policy: default-src ws: 'self' data: blob: 'unsafe-inline' 'unsafe-eval' *.adnxs.org *.adsrvr.org *.adyen.com *.akamaihd.net *.akamaized.net *.amazonaws.com *.americanexpress.com *.android.com *.appboycdn.com *.arcot.com *.aturahotels.com *.auth0.com *.azureedge.net *.bing.com *.bookmebob.com *.bootstrapcdn.com *.braintree-api.com *.braintreegateway.com *.braze.com *.browser-update.org *.cardinalcommerce.com *.cardinaltrusted.com *.cdn-apple.com *.cendynhub.com *.clarity.ms *.cloudflare.com *.cloudflareaccess.com *.cloudflareinsights.com *.cloudfront.net *.cookiebot.com *.criteo.com *.criteo.net *.d-edgeconnect.media *.datatrans.com *.demdex.net *.doubleclick.net *.duosecurity.com *.elev.io *.event-restaurants-venues.com *.eventcinemas.com.au *.everestjs.net *.everesttech.net *.evt.com *.evtstays.com *.facebook.com *.fontawesome.com *.fortawesome.com *.gleam.io *.gleamjs.io *.google-analytics.com *.google.co.nz *.google.com *.google.com.au *.googleadservices.com *.googleapis.com *.googlesyndication.com *.googletagmanager.com *.gstatic.com *.hoteltotto.com *.hotjar.com *.hotjar.io *.independentcollection.com.au *.instagram.com *.ivvy.com *.ivvy.com.au *.ixopay.com *.jquery.com *.jsdelivr.net *.kaptcha.com *.mapbox.com *.mews-demo.com *.mews.com *.mews.li *.mintdesign.co.nz *.mycardsecure.com *.myma.ai *.ovalhotel.com.au *.paymentgateway.cloud *.paypal.com *.paypalobjects.com *.pingdom.net *.planpay.com *.priorityguestrewards.com *.qtathome.com *.qthotels.com *.quantcount.com *.quantserve.com *.resdiary.com *.rokt.com *.rsa3dsauth.co.uk *.rydges.com *.sentry-cdn.com *.sentry.io *.sevenrooms.com *.sg-form.com *.sharepointonline.com *.shift72.com *.smartcheckmobile.com *.sojern.com *.squarespace.com *.stripe.com *.surveymonkey.com *.tacdn.com *.tamgrt.com *.thehotelsnetwork.com *.tiktok.com *.tiktokw.us *.typekit.net *.typography.com *.vimeo.com *.vimeocdn.com *.weatherwidget.io *.windcave.com *.wistia.com *.wp.com *.wpo365.com *.yoast.com *.youtube.com ads.yahoo.com adx.dable.io akamaized.net americanexpress.com android.com appboy-images.com azureedge.net bam.nr-data.net beacon-v2.helpscout.net bing.com bookmebob.com bootstrapcdn.com braintree-api.com braintreegateway.com braze-images.com braze.com browser-update.org cardinalcommerce.com cdn.braze.eu cendynhub.com cloudflare.hcaptcha.com cloudfront.net cm.mgid.com connect.facebook.net contextual.media.net criteo-sync.teads.tv criteo.com criteo.net cw.addthis.com d-edgeconnect.media datatrans.com demdex.net duosecurity.com eb2.3lift.com elev.io eventcinemas.com.au everestjs.net everesttech.net fontawesome.com gleam.io gleamjs.io google.com googletagmanager.com hotjar.com hotjar.io i.ytimg.com instagram.com ipapi.co ivvy.com ivvy.com.au ixopay.com jquery.com js-agent.newrelic.com js.appboycdn.com js.sentry-cdn.com kaptcha.com mews-demo.com mews.com mews.li mintdesign.co.nz mycardsecure.com myma.ai paymentgateway.cloud paypal.com pixel.advertising.com pixel.tapad.com planpay.com r.casalemedia.com r.turn.com resdiary.com rsa3dsauth.co.uk rtb-csync.smartadserver.com rydges.com s-cs.send.microad.jp s.ad.smaato.net s.adroll.com secure.adnxs.com sentry-cdn.com sharepointonline.com shift72.com simage2.pubmatic.com smartcheckmobile.com sojern.com sp.analytics.yahoo.com stripe.com sync-criteo.ads.yieldmo.com sync-t1.taboola.com sync.e-planning.net tacdn.com tags.bluekai.com tamgrt.com tiktok.com typekit.net ups.analytics.yahoo.com us-u.openx.net via.placeholder.com vimeo.com visitor-fra01.omnitagjs.com visitor.omnitagjs.com weatherwidget.io wistia.com wp.com wpo365.com www.aexp-static.com www.googletagservices.com yoast.com; frame-src * blob:; object-src 'none'; img-src 'self' https: data: blob:; upgrade-insecure-requests; report-uri https://evtgroup.report-uri.com/r/t/csp/enforce

Fix: Tighten Content-Security-Policy by removing unsafe directives and adding object-src, base-uri, and frame-ancestors restrictions.

No first-party cookies were set during the initial page load.

Server response headers do not expose version tokens.

Domain appears to be behind Cloudflare.

• • server: cloudflare
• • cf-ray: a3be05ff4bbd96d5-IAD

Loaded in 0.08s (perceived).

0 scripts and 1 styles may block rendering.

• • style: https://staging.rydges.com/cdn-cgi/styles/cf.errors.css

Fix: Defer non-critical scripts and inline critical CSS to improve first paint speed.

Text-like assets appear compressed.

robots.txt missing or inaccessible (403).

Fix: Create a robots.txt file at https://staging.rydges.com/robots.txt and allow intended crawlers.

Sitemap missing or inaccessible at https://staging.rydges.com/sitemap.xml (403).

Fix: Publish a sitemap.xml and reference it in robots.txt with: Sitemap: https://staging.rydges.com/sitemap.xml

Robots meta found: noindex, nofollow

All 0 controls are labeled.

Missing landmarks: header, nav, main, footer.

Fix: Use semantic regions (<header>, <nav>, <main>, <footer>) for navigation and assistive tech.

1 interactive elements appear smaller than 48px.

• • button#cf-footer-ip-reveal.cf-footer-ip-reveal-btn (Click to reveal) - 83x20px

Fix: Increase target size to at least 48x48 CSS pixels for touch interactions.

Missing og:title or og:description.

Fix: Add og:title and og:description tags to control social preview text.

og:image is missing.

Fix: Add <meta property="og:image" content="https://..."> with a high-quality share image.

twitter:card is missing.

Fix: Add <meta name="twitter:card" content="summary_large_image"> for better previews on X.

No JSON-LD schema scripts found.

Fix: Add JSON-LD structured data matching your page type (Organization, Article, Product, etc.).

Manifest or Apple touch icon is missing.

Fix: Link your web app manifest and apple-touch-icon for improved install/share experiences.

5 social preview quality issues detected.

• • ISSUE: og:url should be an absolute URL.
• • ISSUE: og:title should typically be between 10 and 70 characters.
• • ISSUE: og:description should typically be between 50 and 200 characters.
• • ISSUE: Use an absolute URL for og:image or twitter:image.
• • ISSUE: twitter:card is missing.
• • GUIDELINE: Optimal og:title length: 40-60 characters (acceptable: 10-70).
• • GUIDELINE: Optimal og:description length: 110-160 characters (acceptable: 50-200).
• • GUIDELINE: Optimal preview image size: 1200x630 pixels.
• • GUIDELINE: Optimal preview image aspect ratio: 1.91:1.
• • GUIDELINE: Optimal preview image file size: under 5 MB.
• • GUIDELINE: Recommended twitter:card: summary_large_image.

Fix: Use absolute OG/Twitter URLs, keep metadata lengths in recommended ranges, and provide a preview image near 1200x630 under 5MB.

Checked 1 links. No broken internal links found.

No broken external links found in checked URLs.

All 1 links use non-empty href values.

Largest Contentful Paint: 0.08s.

Cumulative Layout Shift: 0.000.

Total Blocking Time estimate: 0ms.

No failed CSS/JS/image/font/media requests detected.

1 JavaScript runtime issues detected.

• • Failed to load resource: the server responded with a status of 403 () [https://staging.rydges.com/accommodation/sydney-nsw/world-square-sydney-cbd/meetings-events/:1]

Fix: Fix JS files returning 404/failed requests and resolve the listed runtime exceptions.