Content Security Policy is missing
The page does not send a Content-Security-Policy response header.
Remediation: Deploy a restrictive Content-Security-Policy and test it in report-only mode first.
See what a completed OmniCheck report looks like. The site and findings below are fictional sample data.
| Issue | Pages affected |
|---|---|
Images must have alternate text |
84 |
Buttons must have discernible text |
19 |
Elements must meet minimum color contrast |
12 |
Automated checks catch roughly 30–40% of WCAG success criteria. This surfaces real issues to fix, but it isn't a compliance certificate — full conformance still needs manual review.
| Top optimization opportunity | Pages |
|---|---|
|
Reduce unused JavaScript
Est. savings 2.1 s
|
19 |
|
Serve images in next-gen formats
Est. savings 1.5 s
|
54 |
|
Eliminate render-blocking resources
Est. savings 860 ms
|
21 |
| Status | Broken link |
|---|---|
| 404 | https://acme-shop.example/sale/summer |
| 503 | https://acme-shop.example/account/orders |
| Placeholder | https://acme-shop.example/# |
| Signal | Result | Detail |
|---|---|---|
AI crawler access |
△ Improve | 11/14 major AI crawlers allowed |
Structured data (schema.org) |
△ Improve | No JSON-LD structured data found |
Meta description |
✓ Pass | Present |
Open Graph tags |
△ Improve | Missing |
Page title |
✓ Pass | Present |
Visible content |
✓ Pass | ~18,420 chars of text in raw HTML |
Single, clear <h1> |
△ Improve | 2 <h1> elements |
Semantic landmarks |
✓ Pass | <main>/<article> present |
Heading structure |
✓ Pass | 18 headings |
Sitemap |
✓ Pass | Discoverable |
llms.txt |
△ Improve | Not present (optional, emerging) |
EntityMap (GEO) |
△ Improve | 0/3 |
Time to First Byte |
△ Improve | Slow — server responded in 1180ms |
The page does not send a Content-Security-Policy response header.
Remediation: Deploy a restrictive Content-Security-Policy and test it in report-only mode first.
Incomplete coverage: unavailable, not checked, and not applicable checks do not lower the score or count as passes.
External automated assessment only. This is not a penetration test or a guarantee of security.
Run all five checks and get one prioritized report for your website.