paulmartindds.com
15-year-old saaS / Product site, served through Cloudflare, with email running through custom-or-self-hosted.
Email health21Needs work
You have DMARC set up, but in monitor-only mode — it's not actually rejecting spoofed mail.
No SPF record is published, so nothing tells mail providers who's allowed to send as you.
DMARC aggregate reporting enabled (rua=)
No DMARC aggregate-reporting address is published — you wouldn't see spoofing attempts.
Mailto: direct contact link present
We couldn't find a tap-to-email link anywhere on your site.
Branded domain email address (vs free Gmail/Yahoo)
You send email from your own domain, not a free Gmail/Yahoo address.
5 additional standards didn't apply to this category
Privacy48Needs work
No privacy policy page found. Required by GDPR, CCPA, and most app store listings.
Terms of service page presence
No terms of service page found. Without one, you have no contractual basis for the relationship with your visitors.
Your homepage loads a moderate number of third-party trackers. Worth auditing what each one is for.
3 additional standards didn't apply to this category
Accessibility62Fair
Some images on your homepage are missing alt text. Screen reader users hear silence where they should hear a description.
No skip-to-content link is published. Keyboard users have to tab through every nav item on every page before reaching the content.
axe-core / WAVE accessibility scan
Your homepage passes automated accessibility checks — no obvious blockers for screen readers or keyboard users.
ARIA labels presence and validity
Interactive elements have proper ARIA labels — screen reader users get a clear description of each control.
Your heading levels are properly nested — H1, then H2s, then H3s — and screen readers can navigate the outline.
Text on your homepage meets WCAG AA contrast minimums — readable by visitors with low vision.
1 additional standard didn't apply to this category
Security67Fair
Your site isn't sending any of the standard browser-protection headers.
SSL certificate validity & expiration window
Your SSL certificate is valid and not close to expiring.
Sensitive path exposure (.git, .env, /admin, xmlrpc.php, wp-login.php)
None of the common admin or developer paths are publicly reachable.
18 additional standards didn't apply to this category
Performance81Strong
Your server still serves over the older HTTP/2 protocol — not the newer, faster HTTP/3.
Lazy loading on below-fold images
Images below the fold aren't lazy-loaded — visitors download them up front even if they never scroll that far.
Mobile PageSpeed score + Core Web Vitals (LCP, FCP, CLS)
Your homepage is mid-pack on mobile. Reasonable but Google's ranking signal rewards faster sites.
Image optimization (WebP/AVIF)
Your images are served as JPEG or PNG when modern formats (WebP, AVIF) would cut their size by 30–60% with no visible loss.
Your homepage loads fast on desktop — Google's ranking signal is in the green.
Your server compresses pages with Brotli or gzip — visitors download a fraction of the raw size.
Font loading strategy (FOUT/FOIT/swap)
Your fonts swap in cleanly — text is readable in the system font while custom fonts download.
4 additional standards didn't apply to this category
SEO81Strong
Schema.org type validity (parsed JSON-LD)
We didn't find any structured-data tags on your homepage.
Schema.org structured data presence
Your homepage doesn't publish any Schema.org structured data. Search engines and AI tools fall back to guessing what your site is — and they guess wrong more often than not.
Title, meta description, OG, Twitter cards, canonical
Your homepage has the title, description, OG, Twitter, and canonical tags.
Your homepage has a clear H1 heading — search engines and screen readers know what the page is about.
Internal link depth (clicks from homepage to deepest content)
Important pages are reachable in just a click or two from your homepage.
4 additional standards didn't apply to this category
View formal standards verdicts → Composite-spec rollups for press, regulators, and compliance auditors.
17 additional standards planned, scorer not yet implemented.
Does it respect visitor privacy?40Needs work
You have a privacy policy page
No privacy policy page found. Required by GDPR, CCPA, and most app store listings.
You have a terms of service page
No terms of service page found. Without one, you have no contractual basis for the relationship with your visitors.
How many outside companies you let watch your visitors
Your homepage loads a moderate number of third-party trackers. Worth auditing what each one is for.
3 additional standards didn't apply to this site
Is email from this domain trustworthy?48Needs work
Stops scammers from emailing customers as you
You have DMARC set up, but in monitor-only mode — it's not actually rejecting spoofed mail.
Lists who's allowed to email as your business
No SPF record is published, so nothing tells mail providers who's allowed to send as you.
You get reports when someone fakes your email
No DMARC aggregate-reporting address is published — you wouldn't see spoofing attempts.
A clickable email link on your site
We couldn't find a tap-to-email link anywhere on your site.
You email from your own domain, not Gmail
You send email from your own domain, not a free Gmail/Yahoo address.
A contact form people can actually find
A visible contact form is reachable from your homepage.
5 additional standards didn't apply to this site
Is it safe to visit?67Fair
Browser-level protections for visitors
Your site isn't sending any of the standard browser-protection headers.
Your padlock isn't about to expire
Your SSL certificate is valid and not close to expiring.
Private files aren't open to the public
None of the common admin or developer paths are publicly reachable.
18 additional standards didn't apply to this site
Can everyone use it?67Fair
Your photos have written descriptions
Some images on your homepage are missing alt text. Screen reader users hear silence where they should hear a description.
No skip-to-content link is published. Keyboard users have to tab through every nav item on every page before reaching the content.
Your site works for visitors with disabilities
Your homepage passes automated accessibility checks — no obvious blockers for screen readers or keyboard users.
Your buttons and forms are labeled for screen readers
Interactive elements have proper ARIA labels — screen reader users get a clear description of each control.
Your headings are in a sensible order
Your heading levels are properly nested — H1, then H2s, then H3s — and screen readers can navigate the outline.
Text on your homepage meets WCAG AA contrast minimums — readable by visitors with low vision.
1 additional standard didn't apply to this site
Is it fast?80Strong
Your site uses the newest connection style
Your server still serves over the older HTTP/2 protocol — not the newer, faster HTTP/3.
Photos lower on the page wait their turn
Images below the fold aren't lazy-loaded — visitors download them up front even if they never scroll that far.
How fast your site loads on a phone
Your homepage is mid-pack on mobile. Reasonable but Google's ranking signal rewards faster sites.
Your photos are saved in modern formats
Your images are served as JPEG or PNG when modern formats (WebP, AVIF) would cut their size by 30–60% with no visible loss.
How fast your site loads on a laptop
Your homepage loads fast on desktop — Google's ranking signal is in the green.
Your site uses a modern web connection
Your server speaks HTTP/2 — page loads multiplex over a single connection.
Pages get squeezed before they're sent
Your server compresses pages with Brotli or gzip — visitors download a fraction of the raw size.
Your text shows up while fonts load
Your fonts swap in cleanly — text is readable in the system font while custom fonts download.
4 additional standards didn't apply to this site
Can people find this site?82Strong
Whether your behind-the-scenes labels are valid
We didn't find any structured-data tags on your homepage.
Hidden labels that explain your business to Google
Your homepage doesn't publish any Schema.org structured data. Search engines and AI tools fall back to guessing what your site is — and they guess wrong more often than not.
How your site appears when shared or in search results
Your homepage has the title, description, OG, Twitter, and canonical tags.
A clear headline on every page
Your homepage has a clear H1 heading — search engines and screen readers know what the page is about.
How easy it is to reach your deepest pages
Important pages are reachable in just a click or two from your homepage.
4 additional standards didn't apply to this site
Does this look like a real business?——
Site signals
Context we detected about this site — presence, reputation, and the tools it runs. These are informational and don't affect the score, up or down.