zoom.us
Corporate / B2B site, served through Cloudflare, with email running through custom-or-self-hosted.
Accessibility30Needs work
Some images on your homepage are missing alt text. Screen reader users hear silence where they should hear a description.
Text on your homepage doesn't meet WCAG AA contrast minimums against its background. Visitors with low vision can't read parts of the page.
No accessibility statement page found. Required in the EU under the Accessibility Act, and increasingly under US state law.
axe-core / WAVE accessibility scan
Automated accessibility scans flagged issues on your homepage — alt text, contrast, ARIA labels, or heading structure problems that block real users.
ARIA labels presence and validity
Interactive elements have proper ARIA labels — screen reader users get a clear description of each control.
Your heading levels are properly nested — H1, then H2s, then H3s — and screen readers can navigate the outline.
1 additional standard didn't apply to this category
SEO66Fair
Schema.org structured data presence
Your homepage doesn't publish any Schema.org structured data. Search engines and AI tools fall back to guessing what your site is — and they guess wrong more often than not.
Your homepage doesn't have a visible H1 heading. Without it, search engines and screen readers have no anchor for what the page is about.
No breadcrumb schema is published. Search engines can't show breadcrumb trails under your listings, and visitors lose the trail to important pages.
Title, meta description, OG, Twitter cards, canonical
Your homepage has the title, description, OG, Twitter, and canonical tags.
hreflang for multi-language sites
Your hreflang tags are published — visitors get routed to the right language version.
Internal link depth (clicks from homepage to deepest content)
Important pages are reachable in just a click or two from your homepage.
4 additional standards didn't apply to this category
Privacy67Fair
No privacy policy page found. Required by GDPR, CCPA, and most app store listings.
Terms of service page presence
No terms of service page found. Without one, you have no contractual basis for the relationship with your visitors.
CCPA "Do Not Sell or Share My Personal Information" link
No CCPA "Do Not Sell or Share My Personal Information" link found. If you have California visitors and sell or share data, this is required.
Your homepage loads a moderate number of third-party trackers. Worth auditing what each one is for.
Cookie banner presence + CMP detection
A consent management platform is in place — visitors are asked before non-essential cookies fire.
Cookie scan — actual cookies set on first load
Your homepage sets only essential cookies before consent. Non-essential cookies fire after opt-in.
Security69Fair
Sensitive path exposure (.git, .env, /admin, xmlrpc.php, wp-login.php)
Some common admin or developer paths are reachable from the public internet.
Only modern TLS (1.2 and above) is offered — TLS 1.0 and 1.1 are turned off.
17 additional standards didn't apply to this category
Performance78Strong
Lazy loading on below-fold images
Images below the fold aren't lazy-loaded — visitors download them up front even if they never scroll that far.
Mobile PageSpeed score + Core Web Vitals (LCP, FCP, CLS)
Your homepage is slow on mobile. The data Google uses to rank pages says real visitors wait too long for it to feel ready.
Image optimization (WebP/AVIF)
Your images are served as JPEG or PNG when modern formats (WebP, AVIF) would cut their size by 30–60% with no visible loss.
Your server compresses pages with Brotli or gzip — visitors download a fraction of the raw size.
Font loading strategy (FOUT/FOIT/swap)
Your fonts swap in cleanly — text is readable in the system font while custom fonts download.
Largest unused JavaScript bundle
Your JavaScript bundles are sized reasonably for what each page actually does.
4 additional standards didn't apply to this category
Email health94Excellent
Mailto: direct contact link present
We couldn't find a tap-to-email link anywhere on your site.
DMARC is enforcing — spoofed mail from your domain gets quarantined or rejected.
SPF is set and lists your sending services as approved senders.
BIMI is published — your verified logo appears next to your messages in supporting inboxes.
Branded domain email address (vs free Gmail/Yahoo)
You send email from your own domain, not a free Gmail/Yahoo address.
DMARC aggregate reporting enabled (rua=)
You're set up to receive daily DMARC reports of spoofing attempts.
SPF lookup count (10-limit deliverability check)
Your SPF record uses fewer than 10 DNS lookups — under the spec limit.
3 additional standards didn't apply to this category
View formal standards verdicts → Composite-spec rollups for press, regulators, and compliance auditors.
Can everyone use it?48Needs work
Your photos have written descriptions
Some images on your homepage are missing alt text. Screen reader users hear silence where they should hear a description.
Text on your homepage doesn't meet WCAG AA contrast minimums against its background. Visitors with low vision can't read parts of the page.
You have an accessibility statement
No accessibility statement page found. Required in the EU under the Accessibility Act, and increasingly under US state law.
Your site works for visitors with disabilities
Automated accessibility scans flagged issues on your homepage — alt text, contrast, ARIA labels, or heading structure problems that block real users.
Your buttons and forms are labeled for screen readers
Interactive elements have proper ARIA labels — screen reader users get a clear description of each control.
Your headings are in a sensible order
Your heading levels are properly nested — H1, then H2s, then H3s — and screen readers can navigate the outline.
1 additional standard didn't apply to this site
Does it respect visitor privacy?58Fair
You have a privacy policy page
No privacy policy page found. Required by GDPR, CCPA, and most app store listings.
You have a terms of service page
No terms of service page found. Without one, you have no contractual basis for the relationship with your visitors.
California privacy opt-out link
No CCPA "Do Not Sell or Share My Personal Information" link found. If you have California visitors and sell or share data, this is required.
How many outside companies you let watch your visitors
Your homepage loads a moderate number of third-party trackers. Worth auditing what each one is for.
Cookie consent banner for European visitors
A consent management platform is in place — visitors are asked before non-essential cookies fire.
What your site actually drops on visitors' phones
Your homepage sets only essential cookies before consent. Non-essential cookies fire after opt-in.
Can people find this site?65Fair
Hidden labels that explain your business to Google
Your homepage doesn't publish any Schema.org structured data. Search engines and AI tools fall back to guessing what your site is — and they guess wrong more often than not.
A clear headline on every page
Your homepage doesn't have a visible H1 heading. Without it, search engines and screen readers have no anchor for what the page is about.
A trail showing where visitors are on your site
No breadcrumb schema is published. Search engines can't show breadcrumb trails under your listings, and visitors lose the trail to important pages.
How your site appears when shared or in search results
Your homepage has the title, description, OG, Twitter, and canonical tags.
Telling Google which language a visitor should see
Your hreflang tags are published — visitors get routed to the right language version.
How easy it is to reach your deepest pages
Important pages are reachable in just a click or two from your homepage.
4 additional standards didn't apply to this site
Is it safe to visit?69Fair
Your domain isn't on a spam blocklist
listed=true, response_code=0, answers=127.255.255.254
Private files aren't open to the public
Some common admin or developer paths are reachable from the public internet.
Old TLS versions are turned off
Only modern TLS (1.2 and above) is offered — TLS 1.0 and 1.1 are turned off.
17 additional standards didn't apply to this site
Is it fast?83Strong
Photos lower on the page wait their turn
Images below the fold aren't lazy-loaded — visitors download them up front even if they never scroll that far.
How fast your site loads on a phone
Your homepage is slow on mobile. The data Google uses to rank pages says real visitors wait too long for it to feel ready.
Your photos are saved in modern formats
Your images are served as JPEG or PNG when modern formats (WebP, AVIF) would cut their size by 30–60% with no visible loss.
Pages get squeezed before they're sent
Your server compresses pages with Brotli or gzip — visitors download a fraction of the raw size.
Your site uses a modern web connection
Your server speaks HTTP/2 — page loads multiplex over a single connection.
Your text shows up while fonts load
Your fonts swap in cleanly — text is readable in the system font while custom fonts download.
You're not shipping code visitors don't use
Your JavaScript bundles are sized reasonably for what each page actually does.
4 additional standards didn't apply to this site
Is email from this domain trustworthy?83Strong
A contact form people can actually find
We couldn't find a visible contact form on your homepage.
A clickable email link on your site
We couldn't find a tap-to-email link anywhere on your site.
Stops scammers from emailing customers as you
DMARC is enforcing — spoofed mail from your domain gets quarantined or rejected.
Lists who's allowed to email as your business
SPF is set and lists your sending services as approved senders.
Shows your logo next to your emails
BIMI is published — your verified logo appears next to your messages in supporting inboxes.
You email from your own domain, not Gmail
You send email from your own domain, not a free Gmail/Yahoo address.
You get reports when someone fakes your email
You're set up to receive daily DMARC reports of spoofing attempts.
Your email setup is under a hidden limit
Your SPF record uses fewer than 10 DNS lookups — under the spec limit.
3 additional standards didn't apply to this site
Does this look like a real business?——
Site signals
Context we detected about this site — presence, reputation, and the tools it runs. These are informational and don't affect the score, up or down.