azelty.fr
Corporate / B2B site based in France, served through cloudflare, with email running through microsoft.
Email health38Needs work
You have DMARC set up, but in monitor-only mode — it's not actually rejecting spoofed mail.
Branded domain email address (vs free Gmail/Yahoo)
Your published contact email is on a free service, not your own domain.
Mailto: direct contact link present
We couldn't find a tap-to-email link anywhere on your site.
No SPF record is published, so nothing tells mail providers who's allowed to send as you.
6 additional standards didn't apply to this category
Privacy64Fair
No privacy policy page found. Required by GDPR, CCPA, and most app store listings.
Terms of service page presence
No terms of service page found. Without one, you have no contractual basis for the relationship with your visitors.
Your homepage loads a high number of third-party trackers. Each one slows the page, leaks data, and increases your compliance surface.
Cookie banner presence + CMP detection
A consent management platform is in place — visitors are asked before non-essential cookies fire.
Cookie scan — actual cookies set on first load
Your homepage sets only essential cookies before consent. Non-essential cookies fire after opt-in.
1 additional standard didn't apply to this category
Performance79Strong
Lazy loading on below-fold images
Images below the fold aren't lazy-loaded — visitors download them up front even if they never scroll that far.
Image optimization (WebP/AVIF)
Your images are served as JPEG or PNG when modern formats (WebP, AVIF) would cut their size by 30–60% with no visible loss.
Your server compresses pages with Brotli or gzip — visitors download a fraction of the raw size.
Font loading strategy (FOUT/FOIT/swap)
Your fonts swap in cleanly — text is readable in the system font while custom fonts download.
6 additional standards didn't apply to this category
Accessibility84Strong
No skip-to-content link is published. Keyboard users have to tab through every nav item on every page before reaching the content.
axe-core / WAVE accessibility scan
Automated accessibility scans flagged issues on your homepage — alt text, contrast, ARIA labels, or heading structure problems that block real users.
Your heading levels skip — for example, an H1 followed by an H3 with no H2 in between. Screen reader users lose the outline of the page.
ARIA labels presence and validity
Interactive elements have proper ARIA labels — screen reader users get a clear description of each control.
Every image on your homepage has alt text — screen readers can describe them.
Text on your homepage meets WCAG AA contrast minimums — readable by visitors with low vision.
1 additional standard didn't apply to this category
Security93Excellent
Your server doesn't staple OCSP. Visitors' browsers may have to contact the CA themselves, slowing first connects.
Neither OCSP stapling nor Must-Staple is in play. A revoked cert wouldn't be caught quickly.
Embedded SCT count (Certificate Transparency)
Your certificate carries only one embedded SCT — modern browsers want at least two. Reissue from a CA that includes them.
Your TLS handshake is on the slower side. A CDN with anycast edges and session resumption usually cuts this in half.
SSL certificate validity & expiration window
Your SSL certificate is valid and not close to expiring.
Sensitive path exposure (.git, .env, /admin, xmlrpc.php, wp-login.php)
None of the common admin or developer paths are publicly reachable.
Modern cipher suite preference
The handshake negotiates a modern AEAD cipher (AES-GCM or ChaCha20-Poly1305).
Forward secrecy is guaranteed by the negotiated handshake — past traffic stays unreadable even if your key leaks.
Certificate key strength and signature algorithm
Your certificate uses strong modern math (ECDSA P-256+ or RSA-2048+ with SHA-256+).
Certificate chain completeness
Your server sends the full certificate chain — every device builds the path to a trusted root cleanly.
Certificate validity-period brevity
Your certificate uses a short validity window (≤ 90 days) — auto-renewal keeps revocation fast and frictionless.
Your certificate is issued by a tier-1 publicly trusted CA (Let's Encrypt, DigiCert, Google Trust, Sectigo, etc.).
8 additional standards didn't apply to this category
SEO96Excellent
Schema.org structured data presence
Your homepage publishes Schema.org structured data — search engines and AI tools can read what your site is directly.
Title, meta description, OG, Twitter cards, canonical
Your homepage has the title, description, OG, Twitter, and canonical tags.
Your homepage has a clear H1 heading — search engines and screen readers know what the page is about.
Schema.org type validity (parsed JSON-LD)
Your structured-data tags parse cleanly against Schema.org.
Your pages publish breadcrumb schema — search results show the path back to important sections.
Internal link depth (clicks from homepage to deepest content)
Important pages are reachable in just a click or two from your homepage.
4 additional standards didn't apply to this category
View formal standards verdicts → Composite-spec rollups for press, regulators, and compliance auditors.
10 additional standards planned, scorer not yet implemented.
Is email from this domain trustworthy?52Needs work
Stops scammers from emailing customers as you
You have DMARC set up, but in monitor-only mode — it's not actually rejecting spoofed mail.
You email from your own domain, not Gmail
Your published contact email is on a free service, not your own domain.
A clickable email link on your site
We couldn't find a tap-to-email link anywhere on your site.
Lists who's allowed to email as your business
No SPF record is published, so nothing tells mail providers who's allowed to send as you.
A contact form people can actually find
A visible contact form is reachable from your homepage.
6 additional standards didn't apply to this site
Does it respect visitor privacy?60Fair
You have a privacy policy page
No privacy policy page found. Required by GDPR, CCPA, and most app store listings.
You have a terms of service page
No terms of service page found. Without one, you have no contractual basis for the relationship with your visitors.
How many outside companies you let watch your visitors
Your homepage loads a high number of third-party trackers. Each one slows the page, leaks data, and increases your compliance surface.
Cookie consent banner for European visitors
A consent management platform is in place — visitors are asked before non-essential cookies fire.
What your site actually drops on visitors' phones
Your homepage sets only essential cookies before consent. Non-essential cookies fire after opt-in.
1 additional standard didn't apply to this site
Can everyone use it?73Strong
No skip-to-content link is published. Keyboard users have to tab through every nav item on every page before reaching the content.
Your site works for visitors with disabilities
Automated accessibility scans flagged issues on your homepage — alt text, contrast, ARIA labels, or heading structure problems that block real users.
Your headings are in a sensible order
Your heading levels skip — for example, an H1 followed by an H3 with no H2 in between. Screen reader users lose the outline of the page.
Your buttons and forms are labeled for screen readers
Interactive elements have proper ARIA labels — screen reader users get a clear description of each control.
Your photos have written descriptions
Every image on your homepage has alt text — screen readers can describe them.
Text on your homepage meets WCAG AA contrast minimums — readable by visitors with low vision.
1 additional standard didn't apply to this site
Is it fast?75Strong
Photos lower on the page wait their turn
Images below the fold aren't lazy-loaded — visitors download them up front even if they never scroll that far.
Your photos are saved in modern formats
Your images are served as JPEG or PNG when modern formats (WebP, AVIF) would cut their size by 30–60% with no visible loss.
Your site uses a modern web connection
Your server speaks HTTP/2 — page loads multiplex over a single connection.
Pages get squeezed before they're sent
Your server compresses pages with Brotli or gzip — visitors download a fraction of the raw size.
Your text shows up while fonts load
Your fonts swap in cleanly — text is readable in the system font while custom fonts download.
6 additional standards didn't apply to this site
Is it safe to visit?82Strong
Visitors connect faster on the first click
Your server doesn't staple OCSP. Visitors' browsers may have to contact the CA themselves, slowing first connects.
Strict mode for your padlock check
Neither OCSP stapling nor Must-Staple is in play. A revoked cert wouldn't be caught quickly.
Your certificate is publicly logged
Your certificate carries only one embedded SCT — modern browsers want at least two. Reissue from a CA that includes them.
Your site finishes its handshake quickly
Your TLS handshake is on the slower side. A CDN with anycast edges and session resumption usually cuts this in half.
Your padlock isn't about to expire
Your SSL certificate is valid and not close to expiring.
Private files aren't open to the public
None of the common admin or developer paths are publicly reachable.
The padlock uses strong, modern math
The handshake negotiates a modern AEAD cipher (AES-GCM or ChaCha20-Poly1305).
Old recordings stay locked even if a key leaks
Forward secrecy is guaranteed by the negotiated handshake — past traffic stays unreadable even if your key leaks.
Your padlock isn't using outdated keys
Your certificate uses strong modern math (ECDSA P-256+ or RSA-2048+ with SHA-256+).
Your padlock loads cleanly on every device
Your server sends the full certificate chain — every device builds the path to a trusted root cleanly.
Your padlock renews on a healthy schedule
Your certificate uses a short validity window (≤ 90 days) — auto-renewal keeps revocation fast and frictionless.
Your padlock comes from a reputable vendor
Your certificate is issued by a tier-1 publicly trusted CA (Let's Encrypt, DigiCert, Google Trust, Sectigo, etc.).
8 additional standards didn't apply to this site
Can people find this site?97Excellent
Hidden labels that explain your business to Google
Your homepage publishes Schema.org structured data — search engines and AI tools can read what your site is directly.
How your site appears when shared or in search results
Your homepage has the title, description, OG, Twitter, and canonical tags.
A clear headline on every page
Your homepage has a clear H1 heading — search engines and screen readers know what the page is about.
Whether your behind-the-scenes labels are valid
Your structured-data tags parse cleanly against Schema.org.
A trail showing where visitors are on your site
Your pages publish breadcrumb schema — search results show the path back to important sections.
How easy it is to reach your deepest pages
Important pages are reachable in just a click or two from your homepage.
4 additional standards didn't apply to this site
Does this look like a real business?——
Site signals
Context we detected about this site — presence, reputation, and the tools it runs. These are informational and don't affect the score, up or down.