Revenue57/100
what the site earnsSample report
This is an example audit of a fictional storefront, shown in full so you can see exactly what arrives. Every score and finding below is illustrative. Run one on your own site.
Website audit
65
Audited 3 September 2026
northfield-outfitters.com
3 critical10 warnings27 passed
The shop works. The engines answering for your customers do not know it exists.
Risk64/100
what can hurt or sue youExperience73/100
what customers feelHow you compare
northfield-outfitters.com61
Typical site we audit68
Best site we audited94
You score 61 against a median of 68 across the 214 sites we have audited — below the middle of a field that is itself far from secure. Same checks, same scoring, every site — not an industry survey.
Fix these first
The 3 issues with the most at stake, worst first. Everything else in this report is detail behind them.
- Patch the WooCommerce Stripe Gateway advisory (CVE-2026-1147) — it is remotely reachable today.
- Add structured product data so answer engines can quote your catalogue.
- Write meta descriptions for the 12 product pages shipping without one.
- 1criticalVisibility3 of 4 answer engines cannot cite youAnswer engines quote structured, self-contained facts. Publish a specifications table per product and an About page that states what you sell, where you ship, and since when.
- 2criticalSecurityNo Content-Security-Policy headerStart with a report-only policy on the checkout path, review violations for a week, then enforce. This blocks the injection class that most commonly harvests card details.
- 3criticalSecurityWooCommerce Stripe Gateway 8.1.2 — CVE-2026-1147Update to 8.3.0 or later. This is the single finding in this report an attacker could act on today.
3 of 4 answer engines cannot cite you is where we would start. If you would rather it was fixed than documented, we will walk you through it.
Get this fixedWhat this means for your business
Northfield Outfitters is reachable, the payment path is intact, the page is legible and it clears accessibility at 86. The money mechanics and the front of house are sound, and this report says so first because it is true.
The exposure is upstream and behind. 3 of 4 answer engines cannot cite you, 12 product pages ship without meta descriptions, and the site is running a plugin with a published advisory from 4 March 2026 that is remotely reachable today.
Your store — WooCommerce
Everything else in this report is traffic. This section is the till — each item below acts on people who are already on your site with their card out.
Payment methods detected: Visa, Mastercard, PayPal, Apple Pay.
Design critique
First impressions
84/100We screenshotted your page on desktop and mobile and reviewed it the way a first-time visitor sees it. The score is how quickly a stranger understands what you offer.
“A stranger can tell what you sell, who it is for and what to do next inside one screen. The weakness is the differentiator: nothing says why yours rather than the shop next door.”
VisibilityRevenue
Can customers find you on Google and in AI answers (ChatGPT, Gemini)?
critical
3 of 4 answer engines cannot cite you
Asked for recommendations in your category, ChatGPT, Perplexity and Gemini named competitors and did not mention Northfield. Claude named you once, without the catalogue.
What it takes
Answer engines quote structured, self-contained facts. Publish a specifications table per product and an About page that states what you sell, where you ship, and since when.
high
12 product pages have no meta description
Google is generating snippets from body copy on 12 of 31 product pages, which measurably lowers click-through against pages that supply their own.
What it takes
Generate descriptions from the product summary field. Lead with the material and the use case, keep to 150 characters.
high
No llms.txt
There is no machine-readable summary of what the site is, so crawlers infer your business from navigation labels alone.
What it takes
Publish /llms.txt describing the catalogue, shipping regions and contact route.
medium
No Product structured data
No Product or Offer schema is present, so price and availability cannot appear in search results or be quoted by answer engines.
What it takes
Emit Product schema with price, availability and aggregateRating on every product template.
medium
Faceted URLs are not canonicalised
Colour and size filters produce 40+ crawlable variants of the same product, splitting ranking signal.
What it takes
Point every faceted variant at the base product URL with rel=canonical.
medium
Product copy renders client-side
Descriptions are injected after load, so retrievers that do not execute JavaScript see an empty product template.
What it takes
Server-render product descriptions into the initial HTML.
ConversionRevenue
How much of your traffic turns into enquiries or sales
high
Checkout requires an account
The buying path forces registration before payment. Forced account creation is one of the most consistently cited reasons for cart abandonment.
What it takes
Enable guest checkout and offer the account at the confirmation step, once the money has cleared.
medium
Shipping cost appears only at the final step
Delivery cost is not shown until after the address form, which is where unexpected-cost abandonment concentrates.
What it takes
Surface a shipping estimate on the cart page.
SecurityRisk
Exposure to breaches, data loss and downtime
critical
No Content-Security-Policy header
The site returns no CSP header on any of the 14 pages crawled, including /checkout.
What it takes
Start with a report-only policy on the checkout path, review violations for a week, then enforce. This blocks the injection class that most commonly harvests card details.
critical
WooCommerce Stripe Gateway 8.1.2 — CVE-2026-1147
An advisory published 4 March 2026 describes an unauthenticated order-manipulation path in versions below 8.3.0. Your installed version is reachable from the public storefront.
What it takes
Update to 8.3.0 or later. This is the single finding in this report an attacker could act on today.
high
HSTS not enforced
HTTPS is available and redirects correctly, but no Strict-Transport-Security header is sent, so the first request of each session is downgradeable.
What it takes
Send Strict-Transport-Security with a 31536000 max-age once you have confirmed every subdomain serves HTTPS.
medium
Server version disclosed in headers
Responses advertise the exact web server and PHP build, which narrows an attacker's search for a working exploit.
What it takes
Suppress the Server and X-Powered-By headers.
medium
Core is 2 minor versions behind
No advisory affects the running build, but the gap grows with each release and the next one may not be optional.
What it takes
Enable automatic minor-version updates.
1 further check passed.
ComplianceRisk
GDPR, cookies, and the European Accessibility Act (in force since June 2025)
This category is scored from a measurement rather than a list of checks, so there are no individual findings to show. The score above is the measurement.
Speed & page experienceExperience
Every extra second of load time costs conversions
A visitor arriving on this page waits 2.6 s before your main content is on screen. Every fraction of a second past that costs you visitors who never see what you sell, and Google measures the same delay when it decides where you rank.
| Metric | Measured | Score |
|---|---|---|
| Largest Contentful PaintHow long before your main content is actually on screen. Google's headline speed measure. | 2.6 s | 62 |
| First Contentful PaintHow long a visitor stares at a blank page before anything appears. | 1.4 s | 86 |
| Speed IndexHow quickly the page fills in visually, rather than in one late jump. | 3.9 s | 66 |
| Time to InteractiveWhen a visitor can click and have something happen. | 4.1 s | 58 |
| Total Blocking TimeHow long the page is frozen while scripts run — taps and clicks are ignored. | 340 ms | 62 |
| Cumulative Layout ShiftHow much the page jumps while loading, moving the button out from under a finger. | 0.04 | 97 |
| Google’s bands | PoorNeeds workGood |
Each row is scored on Google’s own 0–100 scale for that metric, and the bands are their published thresholds. The tick marks where this page falls; the middle column is what a visitor actually waits.
Usability & DesignExperience
Where visitors get confused, stuck, or leave
medium
Design observation
The hero states the category and carries one primary action, but nothing on it distinguishes you from a competitor selling the same equipment.
What it takes
Add one line naming the differentiator — range, expertise, guarantee — under the existing headline.
medium
Design observation
The cart icon sits within 8px of the menu toggle, below the comfortable tap-target threshold.
What it takes
Separate the targets and give each a 44px minimum hit area.
Answer engines
What AI says about you
31/100Asked to recommend suppliers in your category and region, 3 of 4 engines returned competitors. The one that mentioned you described the business incorrectly.
In its words: I don't have specific information about Northfield Outfitters. For outdoor equipment in that region you might consider a few better-documented retailers.
Recommended instead of you: Ridgeline Supply Co., Alpine & Co, Basecamp Traders.
- Publish a specifications table on every product page.
- State the business, its location and its founding year in server-rendered text.
- Add Product and Organization structured data.
Asked live via sample. Answer engines vary by user and change over time — this is a snapshot, not a ranking.
Platform
WordPress
Your site runs software with 1 confirmed vulnerability matching the exact installed version. One of them is confirmed to be exploited in the wild — listed by CISA as attacks seen against real sites, not as theoretical risk. Anything actionable we found is listed under Security.
- Core
- undetermined
- WooCommerce
- Not detected
- Confirmed CVEs
- 1(1 exploited)
- Unconfirmed
- 9(version not readable)
Unauthenticated order manipulationCVE-2026-1147CVSS 9.1actively exploited · ransomware
plugin woocommerce-gateway-stripe 8.1.2 · matches your installed version · fixed in 8.3.0
CISA lists this vulnerability in its Known Exploited Vulnerabilities catalogue — confirmed attacks against real sites, not a theoretical risk. It is also known to be used in ransomware campaigns. US federal agencies were required to remediate it by 1 April 2026.
9 further advisories exist for components whose version we could not read. We report those as a count and nothing more: scoring an advisory we cannot tie to your installed version would tell you how bad it is for someone else’s site. Establishing those versions turns the number into a definite yes or no.
Want these fixed rather than just documented?
This report shows what is wrong. Fixing it correctly — and confirming it is truly resolved — is where our team comes in.
Get these fixed30 minutes with the person who would do the work. No charge, no pitch.