hexaspace.store

Last checked 1d ago · 8 issues found

87Overall

100Speed

96SEO

88Security

63AI readiness

Speed all good

!
Social share tags
Missing: og:image, og:url
Fix: 🔒 Unlock with Pro
!
www and non-www go to one address
www.hexaspace.store loads without redirecting to hexaspace.store, so the site exists at two addresses.
Fix: 🔒 Unlock with Pro
i
Inner pages
Fewer than 2 inner pages could be read from the homepage links and sitemap, so only the homepage was graded.
✓
Homepage returns 200
HTTP 200
✓
Title tag
"Hexaspace | Shop Building Materials & Home Improvement Online" (61 chars)
✓
Meta description
122 characters
✓
One H1 heading
1 H1 tag(s) found.
✓
Canonical URL
https://hexaspace.store
✓
Page can be indexed
No noindex directive.
✓
Language declared
lang="en"
✓
Mobile viewport
Viewport meta tag present.
✓
Image alt text
0 of 17 images have no alt attribute.
✓
Short redirect chain
http://hexaspace.store/ takes 1 redirect(s): 301 → https://hexaspace.store/
✓
Enough content on the page
1021 words of visible text.
✓
Character encoding
Charset declared in the HTML.
✓
Favicon
Favicon found.
✓
X (Twitter) card tags
twitter:card = summary_large_image, no image
✓
Missing pages return 404
A made-up URL returns 404.
✓
robots.txt
Found at /robots.txt.
✓
XML sitemap
Found at https://hexaspace.store/sitemap.xml
✓
No broken internal links
Checked 15 internal links from the homepage.
✓
Accessibility
100/100 on Google Lighthouse
✓
Best practices
96/100 on Google Lighthouse

✕
SPF record (email spoofing)
No SPF record on hexaspace.store, so any server can send email that claims to come from your domain.
Fix: 🔒 Unlock with Pro
✓
Served over HTTPS
The homepage loads over HTTPS.
✓
HTTP redirects to HTTPS
http:// returns 301 to HTTPS.
✓
HSTS header
strict-transport-security: max-age=31536000; includeSubDomains; preload
✓
Content Security Policy
content-security-policy: default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; img-src 'self' data:
✓
Clickjacking protection
X-Frame-Options: DENY
✓
X-Content-Type-Options
x-content-type-options: nosniff
✓
Referrer-Policy
referrer-policy: strict-origin-when-cross-origin
✓
Permissions-Policy
permissions-policy: camera=(), microphone=(), geolocation=(), payment=(self)
✓
No mixed content
All resources load over HTTPS.
✓
Server software not exposed
No software versions in response headers.
✓
Cookies set securely
The homepage sets no cookies.
✓
DMARC policy (email spoofing)
Policy is p=quarantine: v=DMARC1; p=quarantine; adkim=r; aspf=r; rua=mailto:dmarc_rua@onsecureserver.net;

✕
AI crawlers not blocked by firewall
Blocked: GPTBot (429)
Fix: 🔒 Unlock with Pro
!
llms.txt file
No /llms.txt file.
Fix: 🔒 Unlock with Pro
!
Structured data (schema.org)
JSON-LD types: Organization. The main entity is missing: logo, sameAs or description.
Fix: 🔒 Unlock with Pro
!
Answers real questions
No question-style headings or FAQ schema on the 1 page(s) read. AI answers are built from pages that state a question and answer it directly.
Fix: 🔒 Unlock with Pro
!
Content shows when it was updated
No lastmod dates in the sitemap and no dateModified on the homepage, so crawlers can't tell how current the content is.
Fix: 🔒 Unlock with Pro
i
NIST, MITRE and CISA citations resolve
No NIST, MITRE or CISA links found on the homepage and 0 linked content pages and posts. Only scored on sites that cite them.
✓
AI crawlers allowed in robots.txt
GPTBot, ClaudeBot, PerplexityBot and others are not blocked.
✓
Content readable without JavaScript
1021 words in the raw HTML. Most AI crawlers don't run JavaScript.
✓
Content split into headed sections
18 H2/H3 headings in the raw HTML. Answer engines lift passages section by section, using the heading to know what each one is about.
✓
Clear page summary
AI answers often reuse your title and meta description to describe you.