rizzaengineering.com
Corporate / B2B site, served through cloudflare.
SEO62Fair
Schema.org type validity (parsed JSON-LD)
We didn't find any structured-data tags on your homepage.
Internal link depth (clicks from homepage to deepest content)
Important pages are reachable in just a click or two from your homepage.
8 additional standards didn't apply to this category
Performance71Strong
Your server still serves over the older HTTP/2 protocol — not the newer, faster HTTP/3.
Font loading strategy (FOUT/FOIT/swap)
Your fonts aren't using font-display: swap. Visitors see invisible text for a moment while the font downloads — Google penalises this.
Mobile PageSpeed score + Core Web Vitals (LCP, FCP, CLS)
Your homepage is mid-pack on mobile. Reasonable but Google's ranking signal rewards faster sites.
Your homepage is acceptable on desktop but not fast — there's headroom to improve.
Image optimization (WebP/AVIF)
Your images use modern formats (WebP / AVIF) — visitors download a fraction of the bytes.
Lazy loading on below-fold images
Below-fold images use loading="lazy" — they download only when the visitor scrolls toward them.
6 additional standards didn't apply to this category
Security81Strong
Your server doesn't staple OCSP. Visitors' browsers may have to contact the CA themselves, slowing first connects.
Neither OCSP stapling nor Must-Staple is in play. A revoked cert wouldn't be caught quickly.
Your TLS handshake takes over a second on a cold connection. Move behind a CDN with TLS session resumption and 0-RTT.
Certificate key strength and signature algorithm
Your certificate uses outdated key strength or a SHA-1 signature. Reissue with a modern ACME-class cert.
Embedded SCT count (Certificate Transparency)
Your certificate carries only one embedded SCT — modern browsers want at least two. Reissue from a CA that includes them.
Forward secrecy is guaranteed by the negotiated handshake — past traffic stays unreadable even if your key leaks.
Certificate chain completeness
Your server sends the full certificate chain — every device builds the path to a trusted root cleanly.
Certificate validity-period brevity
Your certificate uses a short validity window (≤ 90 days) — auto-renewal keeps revocation fast and frictionless.
Your certificate is issued by a tier-1 publicly trusted CA (Let's Encrypt, DigiCert, Google Trust, Sectigo, etc.).
12 additional standards didn't apply to this category
Accessibility92Excellent
Text on your homepage meets WCAG AA contrast minimums — readable by visitors with low vision.
axe-core / WAVE accessibility scan
Your homepage passes automated accessibility checks — no obvious blockers for screen readers or keyboard users.
Every image on your homepage has alt text — screen readers can describe them.
Your heading levels are properly nested — H1, then H2s, then H3s — and screen readers can navigate the outline.
ARIA labels presence and validity
Interactive elements have proper ARIA labels — screen reader users get a clear description of each control.
2 additional standards didn't apply to this category
Email health100Excellent
Mailto: direct contact link present
Your site exposes a mailto: link visitors can tap to start a message.
9 additional standards didn't apply to this category
View formal standards verdicts → Composite-spec rollups for press, regulators, and compliance auditors.
10 additional standards planned, scorer not yet implemented.
Can people find this site?65Fair
Whether your behind-the-scenes labels are valid
We didn't find any structured-data tags on your homepage.
How easy it is to reach your deepest pages
Important pages are reachable in just a click or two from your homepage.
8 additional standards didn't apply to this site
Is it fast?67Fair
Your site uses the newest connection style
Your server still serves over the older HTTP/2 protocol — not the newer, faster HTTP/3.
Your text shows up while fonts load
Your fonts aren't using font-display: swap. Visitors see invisible text for a moment while the font downloads — Google penalises this.
How fast your site loads on a phone
Your homepage is mid-pack on mobile. Reasonable but Google's ranking signal rewards faster sites.
How fast your site loads on a laptop
Your homepage is acceptable on desktop but not fast — there's headroom to improve.
Your photos are saved in modern formats
Your images use modern formats (WebP / AVIF) — visitors download a fraction of the bytes.
Photos lower on the page wait their turn
Below-fold images use loading="lazy" — they download only when the visitor scrolls toward them.
6 additional standards didn't apply to this site
Is it safe to visit?68Fair
Visitors connect faster on the first click
Your server doesn't staple OCSP. Visitors' browsers may have to contact the CA themselves, slowing first connects.
Strict mode for your padlock check
Neither OCSP stapling nor Must-Staple is in play. A revoked cert wouldn't be caught quickly.
Your site finishes its handshake quickly
Your TLS handshake takes over a second on a cold connection. Move behind a CDN with TLS session resumption and 0-RTT.
Your padlock isn't using outdated keys
Your certificate uses outdated key strength or a SHA-1 signature. Reissue with a modern ACME-class cert.
Your certificate is publicly logged
Your certificate carries only one embedded SCT — modern browsers want at least two. Reissue from a CA that includes them.
Old recordings stay locked even if a key leaks
Forward secrecy is guaranteed by the negotiated handshake — past traffic stays unreadable even if your key leaks.
Your padlock loads cleanly on every device
Your server sends the full certificate chain — every device builds the path to a trusted root cleanly.
Your padlock renews on a healthy schedule
Your certificate uses a short validity window (≤ 90 days) — auto-renewal keeps revocation fast and frictionless.
Your padlock comes from a reputable vendor
Your certificate is issued by a tier-1 publicly trusted CA (Let's Encrypt, DigiCert, Google Trust, Sectigo, etc.).
12 additional standards didn't apply to this site
Can everyone use it?94Excellent
Text on your homepage meets WCAG AA contrast minimums — readable by visitors with low vision.
Your site works for visitors with disabilities
Your homepage passes automated accessibility checks — no obvious blockers for screen readers or keyboard users.
Your photos have written descriptions
Every image on your homepage has alt text — screen readers can describe them.
Your headings are in a sensible order
Your heading levels are properly nested — H1, then H2s, then H3s — and screen readers can navigate the outline.
Your buttons and forms are labeled for screen readers
Interactive elements have proper ARIA labels — screen reader users get a clear description of each control.
2 additional standards didn't apply to this site
Does this look like a real business?——
Does it respect visitor privacy?——
6 additional standards didn't apply to this site
Is email from this domain trustworthy?100Excellent
A contact form people can actually find
A visible contact form is reachable from your homepage.
A clickable email link on your site
Your site exposes a mailto: link visitors can tap to start a message.
9 additional standards didn't apply to this site
Site signals
Context we detected about this site — presence, reputation, and the tools it runs. These are informational and don't affect the score, up or down.