gallucios-de.com
12-year-old corporate / B2B site, served through Cloudflare, with email running through google.
Brand presence58Solid
Google Business Profile presence + rating
We couldn't find a Google Business Profile linked to this domain.
Yelp presence + rating + review count
We couldn't find a Yelp listing for this business. Local-business searches and recommendation engines lean on Yelp as a signal.
We couldn't find a Trustpilot listing. Many consumers check Trustpilot before buying — a missing listing reads as a missing reputation.
LinkedIn Company Page (presence + employee count + follower count)
We couldn't find a LinkedIn Company Page for this business. B2B prospects look for it before reaching out.
Apple Maps presence (Apple Business Connect)
We couldn't find an Apple Business Connect listing. Apple Maps visitors and Siri queries can't find you cleanly.
We couldn't find a Facebook Page linked from your site. Many consumers still check Facebook before booking or buying.
Instagram presence (link from site → IG profile)
We couldn't find an Instagram profile linked from your site. For local / consumer-facing brands, Instagram is the lead channel.
Your domain has been registered for years — long enough to clear fraud-detection signals.
Wayback Machine site age & last snapshot
Your site has been online for years — public archives have a long history of it.
6 additional standards didn't apply to this category
Email health59Solid
You have DMARC set up, but in monitor-only mode — it's not actually rejecting spoofed mail.
No SPF record is published, so nothing tells mail providers who's allowed to send as you.
No MTA-STS or TLS-RPT policy is published — incoming mail could be downgraded to plaintext.
DMARC aggregate reporting enabled (rua=)
No DMARC aggregate-reporting address is published — you wouldn't see spoofing attempts.
Mailto: direct contact link present
We couldn't find a tap-to-email link anywhere on your site.
Branded domain email address (vs free Gmail/Yahoo)
You send email from your own domain, not a free Gmail/Yahoo address.
Free-email exposure on contact page (gmail/yahoo/outlook visible)
Your published contact address is on your own domain, not a free inbox.
Email forwarding service detected (improvmx, forwardemail, etc.)
Mail to this domain is being forwarded — you have working email reachability.
Lead magnet / signup incentive detected (free download, ebook, etc.)
Your homepage offers a lead magnet — visitors who aren't ready to buy can still leave with something useful.
5 additional standards didn't apply to this category
SEO71Excellent
Schema.org structured data presence
Your homepage doesn't publish any Schema.org structured data. Search engines and AI tools fall back to guessing what your site is — and they guess wrong more often than not.
Schema.org type validity (parsed JSON-LD)
We didn't find any structured-data tags on your homepage.
No breadcrumb schema is published. Search engines can't show breadcrumb trails under your listings, and visitors lose the trail to important pages.
Title, meta description, OG, Twitter cards, canonical
Your homepage has the title, description, OG, Twitter, and canonical tags.
Your homepage has a clear H1 heading — search engines and screen readers know what the page is about.
hreflang for multi-language sites
Your hreflang tags are published — visitors get routed to the right language version.
Internal link depth (clicks from homepage to deepest content)
Important pages are reachable in just a click or two from your homepage.
3 additional standards didn't apply to this category
AI-readiness76Excellent
JSON-LD richness score for LLMs
We couldn't find any organization details in your page's structured data.
AI plugin manifest (.well-known/ai-plugin.json)
Your AI plugin manifest is published — AI assistants can integrate with your service.
Security77Excellent
Your site isn't sending any of the standard browser-protection headers.
There's no CAA record at your registrar saying which companies are allowed to issue certificates for you.
Your server doesn't staple OCSP. Visitors' browsers may have to contact the CA themselves, slowing first connects.
Neither OCSP stapling nor Must-Staple is in play. A revoked cert wouldn't be caught quickly.
Embedded SCT count (Certificate Transparency)
Your certificate carries only one embedded SCT — modern browsers want at least two. Reissue from a CA that includes them.
SSL certificate validity & expiration window
Your SSL certificate is valid and not close to expiring.
Sensitive path exposure (.git, .env, /admin, xmlrpc.php, wp-login.php)
None of the common admin or developer paths are publicly reachable.
Only modern TLS (1.2 and above) is offered — TLS 1.0 and 1.1 are turned off.
Modern cipher suite preference
The handshake negotiates a modern AEAD cipher (AES-GCM or ChaCha20-Poly1305).
Forward secrecy is guaranteed by the negotiated handshake — past traffic stays unreadable even if your key leaks.
Certificate key strength and signature algorithm
Your certificate uses strong modern math (ECDSA P-256+ or RSA-2048+ with SHA-256+).
Certificate chain completeness
Your server sends the full certificate chain — every device builds the path to a trusted root cleanly.
Certificate validity-period brevity
Your certificate uses a short validity window (≤ 90 days) — auto-renewal keeps revocation fast and frictionless.
Your certificate is issued by a tier-1 publicly trusted CA (Let's Encrypt, DigiCert, Google Trust, Sectigo, etc.).
Your TLS handshake completes quickly — under 300ms on a cold connection.
4 additional standards didn't apply to this category
Accessibility85Excellent
No skip-to-content link is published. Keyboard users have to tab through every nav item on every page before reaching the content.
Text on your homepage meets WCAG AA contrast minimums — readable by visitors with low vision.
Your accessibility statement page is published — visitors can find out what standards you commit to.
Every image on your homepage has alt text — screen readers can describe them.
Your heading levels are properly nested — H1, then H2s, then H3s — and screen readers can navigate the outline.
ARIA labels presence and validity
Interactive elements have proper ARIA labels — screen reader users get a clear description of each control.
1 additional standard didn't apply to this category
Performance90Excellent
Font loading strategy (FOUT/FOIT/swap)
Your fonts aren't using font-display: swap. Visitors see invisible text for a moment while the font downloads — Google penalises this.
Mobile PageSpeed score + Core Web Vitals (LCP, FCP, CLS)
Your homepage loads fast on mobile — the metrics Google uses for ranking are in the green.
Image optimization (WebP/AVIF)
Your images use modern formats (WebP / AVIF) — visitors download a fraction of the bytes.
Your server compresses pages with Brotli or gzip — visitors download a fraction of the raw size.
Lazy loading on below-fold images
Below-fold images use loading="lazy" — they download only when the visitor scrolls toward them.
5 additional standards didn't apply to this category
Privacy93Excellent
Your homepage loads a reasonable number of third-party services — clean privacy footprint.
3 additional standards didn't apply to this category
View formal standards verdicts → Composite-spec rollups for press, regulators, and compliance auditors.
10 additional standards planned, scorer not yet implemented.
Is email from this domain trustworthy?50Needs work
Stops scammers from emailing customers as you
You have DMARC set up, but in monitor-only mode — it's not actually rejecting spoofed mail.
Lists who's allowed to email as your business
No SPF record is published, so nothing tells mail providers who's allowed to send as you.
Keeps your email private in transit
No MTA-STS or TLS-RPT policy is published — incoming mail could be downgraded to plaintext.
You get reports when someone fakes your email
No DMARC aggregate-reporting address is published — you wouldn't see spoofing attempts.
A clickable email link on your site
We couldn't find a tap-to-email link anywhere on your site.
You email from your own domain, not Gmail
You send email from your own domain, not a free Gmail/Yahoo address.
Your email is being forwarded, not hosted
Mail to this domain is being forwarded — you have working email reachability.
4 additional standards didn't apply to this site
Does this look like a real business?59Solid
Your listing on Google Maps and search
We couldn't find a Google Business Profile linked to this domain.
We couldn't find a Yelp listing for this business. Local-business searches and recommendation engines lean on Yelp as a signal.
We couldn't find a Trustpilot listing. Many consumers check Trustpilot before buying — a missing listing reads as a missing reputation.
We couldn't find a LinkedIn Company Page for this business. B2B prospects look for it before reaching out.
We couldn't find an Apple Business Connect listing. Apple Maps visitors and Siri queries can't find you cleanly.
Whether anyone's written about you lately
No news mentions of this domain in the last 30 days.
How long your domain has existed
Your domain has been registered for years — long enough to clear fraud-detection signals.
How long your site has been online
Your site has been online for years — public archives have a long history of it.
A contact form people can actually find
A visible contact form is reachable from your homepage.
2 additional standards didn't apply to this site
Can people find this site?73Excellent
Hidden labels that explain your business to Google
Your homepage doesn't publish any Schema.org structured data. Search engines and AI tools fall back to guessing what your site is — and they guess wrong more often than not.
Whether your behind-the-scenes labels are valid
We didn't find any structured-data tags on your homepage.
A trail showing where visitors are on your site
No breadcrumb schema is published. Search engines can't show breadcrumb trails under your listings, and visitors lose the trail to important pages.
How well your site feeds AI the right facts
We couldn't find any organization details in your page's structured data.
How your site appears when shared or in search results
Your homepage has the title, description, OG, Twitter, and canonical tags.
A clear headline on every page
Your homepage has a clear H1 heading — search engines and screen readers know what the page is about.
Telling Google which language a visitor should see
Your hreflang tags are published — visitors get routed to the right language version.
How easy it is to reach your deepest pages
Important pages are reachable in just a click or two from your homepage.
Whether you're letting AI assistants read your site
You aren't blocking any AI crawlers in your robots.txt.
A direct line for AI assistants to your business
Your AI plugin manifest is published — AI assistants can integrate with your service.
3 additional standards didn't apply to this site
Is it safe to visit?77Excellent
Browser-level protections for visitors
Your site isn't sending any of the standard browser-protection headers.
Only your approved vendors can issue your padlock
There's no CAA record at your registrar saying which companies are allowed to issue certificates for you.
Visitors connect faster on the first click
Your server doesn't staple OCSP. Visitors' browsers may have to contact the CA themselves, slowing first connects.
Strict mode for your padlock check
Neither OCSP stapling nor Must-Staple is in play. A revoked cert wouldn't be caught quickly.
Your certificate is publicly logged
Your certificate carries only one embedded SCT — modern browsers want at least two. Reissue from a CA that includes them.
Your padlock isn't about to expire
Your SSL certificate is valid and not close to expiring.
Private files aren't open to the public
None of the common admin or developer paths are publicly reachable.
Old TLS versions are turned off
Only modern TLS (1.2 and above) is offered — TLS 1.0 and 1.1 are turned off.
The padlock uses strong, modern math
The handshake negotiates a modern AEAD cipher (AES-GCM or ChaCha20-Poly1305).
Old recordings stay locked even if a key leaks
Forward secrecy is guaranteed by the negotiated handshake — past traffic stays unreadable even if your key leaks.
Your padlock isn't using outdated keys
Your certificate uses strong modern math (ECDSA P-256+ or RSA-2048+ with SHA-256+).
Your padlock loads cleanly on every device
Your server sends the full certificate chain — every device builds the path to a trusted root cleanly.
Your padlock renews on a healthy schedule
Your certificate uses a short validity window (≤ 90 days) — auto-renewal keeps revocation fast and frictionless.
Your padlock comes from a reputable vendor
Your certificate is issued by a tier-1 publicly trusted CA (Let's Encrypt, DigiCert, Google Trust, Sectigo, etc.).
Your site finishes its handshake quickly
Your TLS handshake completes quickly — under 300ms on a cold connection.
4 additional standards didn't apply to this site
Can everyone use it?85Excellent
No skip-to-content link is published. Keyboard users have to tab through every nav item on every page before reaching the content.
Text on your homepage meets WCAG AA contrast minimums — readable by visitors with low vision.
You have an accessibility statement
Your accessibility statement page is published — visitors can find out what standards you commit to.
Your photos have written descriptions
Every image on your homepage has alt text — screen readers can describe them.
Your headings are in a sensible order
Your heading levels are properly nested — H1, then H2s, then H3s — and screen readers can navigate the outline.
Your buttons and forms are labeled for screen readers
Interactive elements have proper ARIA labels — screen reader users get a clear description of each control.
1 additional standard didn't apply to this site
Is it fast?90Excellent
Your text shows up while fonts load
Your fonts aren't using font-display: swap. Visitors see invisible text for a moment while the font downloads — Google penalises this.
How fast your site loads on a phone
Your homepage loads fast on mobile — the metrics Google uses for ranking are in the green.
Your photos are saved in modern formats
Your images use modern formats (WebP / AVIF) — visitors download a fraction of the bytes.
Your site uses a modern web connection
Your server speaks HTTP/2 — page loads multiplex over a single connection.
Pages get squeezed before they're sent
Your server compresses pages with Brotli or gzip — visitors download a fraction of the raw size.
Photos lower on the page wait their turn
Below-fold images use loading="lazy" — they download only when the visitor scrolls toward them.
5 additional standards didn't apply to this site
Does it respect visitor privacy?93Excellent
How many outside companies you let watch your visitors
Your homepage loads a reasonable number of third-party services — clean privacy footprint.
You have a terms of service page
Your terms of service page is reachable from the homepage.
3 additional standards didn't apply to this site