Skip to content

Changes

https://localai.hex7.com
Compared to previous audit · 46 minutes ago View previous audit
8
New issues
12
Resolved
16
score changes
CategoryPreviousCurrentChange
CompositeB (84)B (86) +2.000
PerformanceA (92)A (92)—
SecurityB (83)A (90) +7.000
AccessibilityC (76)C (76)—
SEOA (93)A (93)—
InfrastructureB (87)A (90) +3.000
ComplianceD (68)D (68)—
ContentC (76)C (76)—
SustainabilityB (88)B (88)—
MetricPreviousCurrentChange
Performance 49005900 +1000
Accessibility 96009600—
Best Practices 1000010000—
SEO 91009100—
PWA 00—
Desktop Performance 99009700 -200
Desktop Accessibility 96009600—
Desktop Best Practices 1000010000—
Desktop SEO 91009100—
FCP 3.07 s3.00 s -64 ms
LCP 3.19 s3.02 s -170 ms
TBT 14.05 s7.73 s -6.32 s
CLS 0.0000.000—
Desktop FCP 348 ms557 ms +208 ms
Desktop LCP 348 ms616 ms +267 ms
Desktop TBT 40 ms46 ms +6 ms
Desktop CLS 0.0000.000—
TTFB †321 ms136 ms -185 ms
DNS †69 ms33 ms -36 ms
TLS †39 ms7 ms -32 ms
Connect †33 ms1 ms -32 ms
Total †375 ms137 ms -238 ms

† Timing metrics may vary by worker location and do not necessarily indicate site changes.

WARNING 1 render-blocking <script src> tag(s) without async/defer performance
WARNING form-action directive is missing security
WARNING 34 text node(s) render below 12 CSS pixels on mobile accessibility
WARNING Total JS execution time is 13.3 s -- over the 3.5s budget performance
WARNING base-uri directive is missing security
WARNING https://localai.hex7.com/net.js: 12278ms CPU time performance
WARNING frame-ancestors directive is missing security
WARNING Unattributable: 956ms CPU time performance
CRITICAL HTTP version does not redirect to HTTPS infrastructure
CRITICAL HSTS header is missing security
CRITICAL Content-Security-Policy header is missing security
WARNING Cross-Origin-Opener-Policy header is missing security
WARNING X-Frame-Options header is missing security
WARNING Referrer-Policy header is missing security
WARNING Unattributable: 1355ms CPU time performance
WARNING No Permissions-Policy header security
WARNING Cross-Origin-Embedder-Policy header is missing security
WARNING https://localai.hex7.com/net.js: 20016ms CPU time performance
WARNING X-Content-Type-Options header is missing security
WARNING Permissions-Policy header is missing security
CRITICAL Soft 404: server returns HTTP 200 for non-existent pages accessibility
WARNING Skip navigation link is missing (WCAG 2.4.1) accessibility
WARNING sitemap.xml contains invalid XML infrastructure
WARNING GDPR Article 13 disclosure coverage: 2 / 8 categories compliance
WARNING No Open Graph meta tags found content
WARNING No SPF record found security
WARNING No accessibility statement detected compliance
WARNING Privacy Shield reference detected — note: framework invalidated compliance
WARNING Sitemap is empty -- 0 URLs listed seo
WARNING security.txt: Missing required 'Expires' field (RFC 9116) security
WARNING Manifest contains invalid JSON accessibility
WARNING https://localai.hex7.com/net.js: unminified — 13 KB could be saved performance
WARNING 1 publicly-accessible JavaScript source map(s) security
WARNING No DMARC record found security
WARNING security.txt: Missing required 'Contact' field security
WARNING 1 heading(s) are over 120 characters -- likely a misformatted paragraph accessibility
WARNING No canonical tag found seo
WARNING sitemap.xml is empty — no URLs found infrastructure
WARNING Registrar lock is NOT enabled infrastructure
WARNING Terms of Service not detected compliance
WARNING No <nav> landmark found accessibility
+ cross-origin-embedder-policy require-corp
+ strict-transport-security max-age=31536000; includeSubDomains
+ referrer-policy strict-origin-when-cross-origin
+ x-frame-options DENY
+ cross-origin-opener-policy same-origin
+ x-content-type-options nosniff
+ permissions-policy geolocation=(), camera=(), microphone=(), payment=(), usb=()
+ content-security-policy default-src 'self'; font-src 'self'
+ cross-origin-resource-policy same-origin
last-modified
Thu, 05 Nov 2026 23:17:11 GMT → Fri, 06 Nov 2026 00:00:17 GMT
via
1.1 2fea9bb55456bdcc8f2da3765c8fd6ea.cloudfront.net (CloudFront) → 1.1 ddad005ff10ada7b206d062a22b1ae38.cloudfront.net (CloudFront)

6 headers unchanged

+ HSTS Security

6 technologies unchanged

Looking ahead

+10 pts
B (86) Could reach A (96)
Accessibility +18Compliance +13Infrastructure +10Security +10Performance +8SEO +7Content +4

Estimate — actual results may vary (29 issues to fix)

Website improvement report — Localai.hex7

November 5, 2026 → November 6, 2026

B B 84 → 86 +2 pts

12

Resolved

8

New issues

21

Still remaining

Financial summary

Investment delivered

€482 in development time

Investment remaining

€1,424 to complete the remaining items

Ongoing risk

€0/month in ongoing exposure

Figures are estimates based on local developer hourly rate, industry CPC, and regulatory fine ranges.

Performance by category

MetricBeforeAfterChange
Overall score84 (B)86 (B)+2
Performance92 (A)92 (A)0
Security83 (B)90 (A)+7
Accessibility76 (C)76 (C)0
SEO93 (A)93 (A)0
Infrastructure87 (B)90 (A)+3
Compliance68 (D)68 (D)0
Content76 (C)76 (C)0
Sustainability88 (B)88 (B)0

Resolved (12)

  • Cross-Origin-Opener-Policy header is missing (Security)

    → Reduced attack surface for visitors

  • X-Frame-Options header is missing (Security)

    → Reduced attack surface for visitors

  • Referrer-Policy header is missing (Security)

    → Reduced attack surface for visitors

  • Unattributable: 1355ms CPU time (Performance)

    → Page loads faster for users

  • No Permissions-Policy header (Security)

    → Reduced attack surface for visitors

  • HTTP version does not redirect to HTTPS (Infrastructure)

    → More reliable delivery

  • HSTS header is missing (Security)

    → Reduced attack surface for visitors

  • Content-Security-Policy header is missing (Security)

    → Reduced attack surface for visitors

  • Cross-Origin-Embedder-Policy header is missing (Security)

    → Reduced attack surface for visitors

  • https://localai.hex7.com/net.js: 20016ms CPU time (Performance)

    → Page loads faster for users

  • X-Content-Type-Options header is missing (Security)

    → Reduced attack surface for visitors

  • Permissions-Policy header is missing (Security)

    → Reduced attack surface for visitors

Recommended next steps (29)

  • Sprint 1

    Soft 404: server returns HTTP 200 for non-existent pages (Accessibility)

  • Sprint 2

    1 render-blocking <script src> tag(s) without async/defer (Performance)

  • Sprint 1

    form-action directive is missing (Security)

  • Sprint 1

    34 text node(s) render below 12 CSS pixels on mobile (Accessibility)

  • Sprint 2

    Total JS execution time is 13.3 s -- over the 3.5s budget (Performance)

  • Sprint 1

    base-uri directive is missing (Security)

  • Sprint 1

    https://localai.hex7.com/net.js: 12278ms CPU time (Performance)

  • Sprint 1

    frame-ancestors directive is missing (Security)

  • Sprint 1

    Unattributable: 956ms CPU time (Performance)

  • Sprint 1

    Skip navigation link is missing (WCAG 2.4.1) (Accessibility)

  • Sprint 1

    sitemap.xml contains invalid XML (Infrastructure)

  • Sprint 2

    GDPR Article 13 disclosure coverage: 2 / 8 categories (Compliance)

  • Sprint 1

    No Open Graph meta tags found (Content)

  • Sprint 1

    No SPF record found (Security)

  • Sprint 1

    No accessibility statement detected (Compliance)

…and 14 more recommended item(s)

Send Feedback