Skip to content

Changes

https://localai.hex7.com
Compared to previous audit · 46 minutes ago View previous audit
8
New issues
12
Resolved
16
score changes
CategoryPreviousCurrentChange
CompositeB (84)B (86) +2.000
PerformanceA (92)A (92)—
SecurityB (83)A (90) +7.000
AccessibilityC (76)C (76)—
SEOA (93)A (93)—
InfrastructureB (87)A (90) +3.000
ComplianceD (68)D (68)—
ContentC (76)C (76)—
SustainabilityB (88)B (88)—
MetricPreviousCurrentChange
Performance 49005900 +1000
Accessibility 96009600—
Best Practices 1000010000—
SEO 91009100—
PWA 00—
Desktop Performance 99009700 -200
Desktop Accessibility 96009600—
Desktop Best Practices 1000010000—
Desktop SEO 91009100—
FCP 3.07 s3.00 s -64 ms
LCP 3.19 s3.02 s -170 ms
TBT 14.05 s7.73 s -6.32 s
CLS 0.0000.000—
Desktop FCP 348 ms557 ms +208 ms
Desktop LCP 348 ms616 ms +267 ms
Desktop TBT 40 ms46 ms +6 ms
Desktop CLS 0.0000.000—
TTFB †321 ms136 ms -185 ms
DNS †69 ms33 ms -36 ms
TLS †39 ms7 ms -32 ms
Connect †33 ms1 ms -32 ms
Total †375 ms137 ms -238 ms

† Timing metrics may vary by worker location and do not necessarily indicate site changes.

WARNING form-action directive is missing security
WARNING Total JS execution time is 13.3 s -- over the 3.5s budget performance
WARNING 1 render-blocking <script src> tag(s) without async/defer performance
WARNING 34 text node(s) render below 12 CSS pixels on mobile accessibility
WARNING frame-ancestors directive is missing security
WARNING https://localai.hex7.com/net.js: 12278ms CPU time performance
WARNING base-uri directive is missing security
WARNING Unattributable: 956ms CPU time performance
CRITICAL Content-Security-Policy header is missing security
CRITICAL HTTP version does not redirect to HTTPS infrastructure
CRITICAL HSTS header is missing security
WARNING Cross-Origin-Embedder-Policy header is missing security
WARNING https://localai.hex7.com/net.js: 20016ms CPU time performance
WARNING X-Frame-Options header is missing security
WARNING Unattributable: 1355ms CPU time performance
WARNING X-Content-Type-Options header is missing security
WARNING No Permissions-Policy header security
WARNING Referrer-Policy header is missing security
WARNING Permissions-Policy header is missing security
WARNING Cross-Origin-Opener-Policy header is missing security
CRITICAL Soft 404: server returns HTTP 200 for non-existent pages accessibility
WARNING Sitemap is empty -- 0 URLs listed seo
WARNING Registrar lock is NOT enabled infrastructure
WARNING 1 publicly-accessible JavaScript source map(s) security
WARNING No DMARC record found security
WARNING No <nav> landmark found accessibility
WARNING security.txt: Missing required 'Expires' field (RFC 9116) security
WARNING No SPF record found security
WARNING 1 heading(s) are over 120 characters -- likely a misformatted paragraph accessibility
WARNING Skip navigation link is missing (WCAG 2.4.1) accessibility
WARNING sitemap.xml is empty — no URLs found infrastructure
WARNING No accessibility statement detected compliance
WARNING Manifest contains invalid JSON accessibility
WARNING No canonical tag found seo
WARNING No Open Graph meta tags found content
WARNING https://localai.hex7.com/net.js: unminified — 13 KB could be saved performance
WARNING Terms of Service not detected compliance
WARNING Privacy Shield reference detected — note: framework invalidated compliance
WARNING security.txt: Missing required 'Contact' field security
WARNING sitemap.xml contains invalid XML infrastructure
WARNING GDPR Article 13 disclosure coverage: 2 / 8 categories compliance
+ content-security-policy default-src 'self'; font-src 'self'
+ strict-transport-security max-age=31536000; includeSubDomains
+ permissions-policy geolocation=(), camera=(), microphone=(), payment=(), usb=()
+ x-content-type-options nosniff
+ cross-origin-opener-policy same-origin
+ x-frame-options DENY
+ cross-origin-embedder-policy require-corp
+ referrer-policy strict-origin-when-cross-origin
+ cross-origin-resource-policy same-origin
via
1.1 2fea9bb55456bdcc8f2da3765c8fd6ea.cloudfront.net (CloudFront) → 1.1 ddad005ff10ada7b206d062a22b1ae38.cloudfront.net (CloudFront)
last-modified
Thu, 05 Nov 2026 23:17:11 GMT → Fri, 06 Nov 2026 00:00:17 GMT

6 headers unchanged

+ HSTS Security

6 technologies unchanged

Looking ahead

+10 pts
B (86) Could reach A (96)
Accessibility +18Compliance +13Infrastructure +10Security +10Performance +8SEO +7Content +4

Estimate — actual results may vary (29 issues to fix)

Website improvement report — Localai.hex7

November 5, 2026 → November 6, 2026

B B 84 → 86 +2 pts

12

Resolved

8

New issues

21

Still remaining

Financial summary

Investment delivered

€482 in development time

Investment remaining

€1,424 to complete the remaining items

Ongoing risk

€0/month in ongoing exposure

Figures are estimates based on local developer hourly rate, industry CPC, and regulatory fine ranges.

Performance by category

MetricBeforeAfterChange
Overall score84 (B)86 (B)+2
Performance92 (A)92 (A)0
Security83 (B)90 (A)+7
Accessibility76 (C)76 (C)0
SEO93 (A)93 (A)0
Infrastructure87 (B)90 (A)+3
Compliance68 (D)68 (D)0
Content76 (C)76 (C)0
Sustainability88 (B)88 (B)0

Resolved (12)

  • Cross-Origin-Embedder-Policy header is missing (Security)

    → Reduced attack surface for visitors

  • https://localai.hex7.com/net.js: 20016ms CPU time (Performance)

    → Page loads faster for users

  • X-Frame-Options header is missing (Security)

    → Reduced attack surface for visitors

  • Unattributable: 1355ms CPU time (Performance)

    → Page loads faster for users

  • X-Content-Type-Options header is missing (Security)

    → Reduced attack surface for visitors

  • Content-Security-Policy header is missing (Security)

    → Reduced attack surface for visitors

  • HTTP version does not redirect to HTTPS (Infrastructure)

    → More reliable delivery

  • HSTS header is missing (Security)

    → Reduced attack surface for visitors

  • No Permissions-Policy header (Security)

    → Reduced attack surface for visitors

  • Referrer-Policy header is missing (Security)

    → Reduced attack surface for visitors

  • Permissions-Policy header is missing (Security)

    → Reduced attack surface for visitors

  • Cross-Origin-Opener-Policy header is missing (Security)

    → Reduced attack surface for visitors

Recommended next steps (29)

  • Sprint 1

    Soft 404: server returns HTTP 200 for non-existent pages (Accessibility)

  • Sprint 1

    form-action directive is missing (Security)

  • Sprint 2

    Total JS execution time is 13.3 s -- over the 3.5s budget (Performance)

  • Sprint 2

    1 render-blocking <script src> tag(s) without async/defer (Performance)

  • Sprint 1

    34 text node(s) render below 12 CSS pixels on mobile (Accessibility)

  • Sprint 1

    frame-ancestors directive is missing (Security)

  • Sprint 1

    https://localai.hex7.com/net.js: 12278ms CPU time (Performance)

  • Sprint 1

    base-uri directive is missing (Security)

  • Sprint 1

    Unattributable: 956ms CPU time (Performance)

  • Sprint 1

    Sitemap is empty -- 0 URLs listed (SEO)

  • Sprint 1

    Registrar lock is NOT enabled (Infrastructure)

  • Sprint 1

    1 publicly-accessible JavaScript source map(s) (Security)

  • Sprint 2

    No DMARC record found (Security)

  • Sprint 1

    No <nav> landmark found (Accessibility)

  • Sprint 1

    security.txt: Missing required 'Expires' field (RFC 9116) (Security)

…and 14 more recommended item(s)

Send Feedback