Skip to content

Changes

https://costdown.org
Compared to previous audit · 37 minutes ago View previous audit

Sao Paulo, Brazil → Santa Clara, United States

These audits ran from different locations. Timing metrics (TTFB, DNS, TLS) may reflect network path differences rather than site changes.

3
New issues
11
Resolved
22
score changes
CategoryPreviousCurrentChange
CompositeB (86)B (89) +3.000
PerformanceA (96)A+ (97) +1.000
SecurityB (88)B (89) +1.000
AccessibilityC (79)A (90) +11.000
SEOA (95)A (95)—
InfrastructureB (83)B (88) +5.000
ComplianceD (63)D (63)—
ContentC (75)C (75)—
SustainabilityA+ (98)A+ (98)—
MetricPreviousCurrentChange
Performance 62007500 +1300
Accessibility 90009600 +600
Best Practices 1000010000—
SEO 91009100—
PWA 00—
Desktop Performance 98009000 -800
Desktop Accessibility 91009600 +500
Desktop Best Practices 1000010000—
Desktop SEO 92009200—
FCP 3.75 s2.72 s -1.03 s
LCP 7.06 s4.12 s -2.94 s
TBT 208 ms243 ms +35 ms
CLS 0.0000.079 +0.079
Desktop FCP 585 ms1.12 s +537 ms
Desktop LCP 1.04 s1.74 s +692 ms
Desktop TBT 0 ms14 ms +14 ms
Desktop CLS 0.0000.011 +0.011
TTFB †976 ms951 ms -25 ms
DNS †11 ms115 ms +103 ms
TLS †11 ms18 ms +7 ms
Connect †4 ms8 ms +4 ms
Total †1.15 s1.12 s -37 ms

† Timing metrics may vary by worker location and do not necessarily indicate site changes.

WARNING 1 render-blocking <script src> tag(s) without async/defer performance
WARNING https://costdown.org/: 798ms CPU time performance
WARNING Unattributable: 320ms CPU time performance
CRITICAL 'unsafe-eval' found in script source security
CRITICAL 'unsafe-inline' found in script source security
CRITICAL 3 control(s) without accessible label accessibility
WARNING https://costdown.org/: 857ms CPU time performance
WARNING IPv6 DNS records exist but server is not reachable infrastructure
WARNING security.txt: Missing required 'Contact' field security
WARNING Manifest contains invalid JSON accessibility
WARNING 1 control(s) rely on placeholder only accessibility
WARNING Unattributable: 353ms CPU time performance
WARNING security.txt: Missing required 'Expires' field (RFC 9116) security
WARNING https://costdown.org/_next/static/chunks/1255-fc6c...: 666ms CPU time performance
CRITICAL Both www and non-www versions serve content infrastructure
WARNING Registrar lock is NOT enabled infrastructure
WARNING No privacy policy link detected compliance
WARNING No Open Graph meta tags found content
WARNING Cross-Origin-Embedder-Policy header is missing security
WARNING Permissions-Policy header not set -- features default to allow-on-same-origin security
WARNING No SPF record found security
WARNING No Permissions-Policy header security
WARNING No accessibility statement detected compliance
WARNING GDPR Article 13 disclosure coverage: 0 / 8 categories compliance
WARNING Permissions-Policy header is missing security
WARNING Cross-Origin-Opener-Policy header is missing security
WARNING X-Powered-By header reveals technology stack security
WARNING Terms of Service not detected compliance
WARNING All 1 images use legacy formats (JPEG/PNG/GIF) content
WARNING No DMARC record found security
WARNING Skip navigation link is missing (WCAG 2.4.1) accessibility
WARNING Privacy Policy not detected compliance
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://c... → default-src 'self'; script-src 'self' 'nonce-ZpaIpGLbwZ3rV1BEG4uqMA==' https:...
link
</_next/static/media/62c97acc3aa63787-s.p.woff2>; rel=preload; as="font"; cro... → </_next/static/media/62c97acc3aa63787-s.p.woff2>; rel=preload; as="font"; cro...

13 headers unchanged

Technology stack unchanged

10 technologies unchanged

Looking ahead

+7 pts
B (89) Could reach A (96)
Compliance +16Infrastructure +12Security +11Content +8Accessibility +4Performance +3

Estimate — actual results may vary (21 issues to fix)

Website improvement report — Costdown

August 27, 2026 → August 27, 2026

B B 86 → 89 +3 pts

11

Resolved

3

New issues

18

Still remaining

Financial summary

Investment delivered

₫9,150,000 in development time

Investment remaining

₫9,150,000 to complete the remaining items

Ongoing risk

₫3,461/month in ongoing exposure

Figures are estimates based on local developer hourly rate, industry CPC, and regulatory fine ranges.

Performance by category

MetricBeforeAfterChange
Overall score86 (B)89 (B)+3
Performance96 (A)97 (A+)+1
Security88 (B)89 (B)+1
Accessibility79 (C)90 (A)+11
SEO95 (A)95 (A)0
Infrastructure83 (B)88 (B)+5
Compliance63 (D)63 (D)0
Content75 (C)75 (C)0
Sustainability98 (A+)98 (A+)0

Resolved (11)

  • https://costdown.org/: 857ms CPU time (Performance)

    → Page loads faster for users

  • IPv6 DNS records exist but server is not reachable (Infrastructure)

    → More reliable delivery

  • security.txt: Missing required 'Contact' field (Security)

    → Reduced attack surface for visitors

  • Manifest contains invalid JSON (Accessibility)

    → Improved usability for assistive technology users

  • 'unsafe-eval' found in script source (Security)

    → Reduced attack surface for visitors

  • 1 control(s) rely on placeholder only (Accessibility)

    → Improved usability for assistive technology users

  • Unattributable: 353ms CPU time (Performance)

    → Page loads faster for users

  • 'unsafe-inline' found in script source (Security)

    → Reduced attack surface for visitors

  • security.txt: Missing required 'Expires' field (RFC 9116) (Security)

    → Reduced attack surface for visitors

  • 3 control(s) without accessible label (Accessibility)

    → Improved usability for assistive technology users

  • https://costdown.org/_next/static/chunks/1255-fc6c...: 666ms CPU time (Performance)

    → Page loads faster for users

Recommended next steps (21)

  • Sprint 1

    Both www and non-www versions serve content (Infrastructure)

  • Sprint 2

    1 render-blocking <script src> tag(s) without async/defer (Performance)

  • Sprint 1

    https://costdown.org/: 798ms CPU time (Performance)

  • Sprint 1

    Unattributable: 320ms CPU time (Performance)

  • Sprint 1

    Registrar lock is NOT enabled (Infrastructure)

  • Sprint 2

    No privacy policy link detected (Compliance)

  • Sprint 1

    No Open Graph meta tags found (Content)

  • Sprint 2

    Cross-Origin-Embedder-Policy header is missing (Security)

  • Sprint 1

    Permissions-Policy header not set -- features default to allow-on-same-origin (Security)

  • Sprint 1

    No SPF record found (Security)

  • Sprint 1

    No Permissions-Policy header (Security)

  • Sprint 1

    No accessibility statement detected (Compliance)

  • Sprint 2

    GDPR Article 13 disclosure coverage: 0 / 8 categories (Compliance)

  • Sprint 1

    Permissions-Policy header is missing (Security)

  • Sprint 1

    Cross-Origin-Opener-Policy header is missing (Security)

…and 6 more recommended item(s)

Send Feedback