SEO Audit
84
Overall score

https://smhairtransplant.org/metform-form/new-form-1772189041/

Audit #961 · started 2 months ago · 24.34 s · triggered by site_audit
✓ 51 pass ! 11 warn ✗ 2 fail · 100 total checks
View full history Download PDF
meta
98
headings
67
schema
100
technical
100
sitemap
100
ssl security
89
page speed
—
links
40
images
—
content
53
mobile
100
hreflang
—
geo
—
spam security
88
domain security
84
⚠️
13 issues need attention
Open the for prioritised, copy-paste-ready fixes with location and AI-personalised suggestions.

Fix progress

0 of 13 issues fixed · Est. time left: 11h 25m
0%
Severity: | Showing / 13 | PDF CSV
High spam security Warning priority 74/100 −60 pts Hard · ~120m

No injected/obfuscated code

Potential hacked/injected-code signals: large inline base64 blob.

Generic best practice

Potential hacked-site/injected-code signals found. Scan source for obfuscated scripts and hidden iframes, check for unexpected admin users and recently modified files, restore from a clean backup, update CMS/plugins, then request a review in Search Console.

Code fix
Before:
<script>eval(atob("...base64..."))</script>
After:
<!-- remove injected script; patch the vulnerability that allowed it -->
AI suggestion (context-aware)
Generating personalised suggestion…
High headings Fail priority 73/100 −100 pts Easy · ~15m

H1 tag present

No <h1> found.

Location in HTML
Line 54 · html > body.wp-singular 
    53  }
>   54  .site-content .ast-container{max-width:100%;padding:0px;}</style><meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover" /></head><body class="wp-singular metform-form-template metform-form-template-element…
    55  id="metform-wrap-3090"
Generic best practice

Every page needs exactly one <h1> tag — the primary heading. It tells both users and search engines what the page is about, and is the strongest on-page ranking signal.

Code fix
Before:
<body>
  <div>Page content with no H1</div>
</body>
After:
<body>
  <h1>Your Main Page Heading</h1>
  <!-- rest of content -->
</body>
AI suggestion (context-aware)
Generating personalised suggestion…
High content Fail priority 68/100 −80 pts Hard · ~120m

Sufficient word count

Only 22 words — thin content.

Generic best practice

Expand the content. 300+ words is the minimum for a substantive page; 1000+ for competitive informational queries. Cover the topic thoroughly.

AI suggestion (context-aware)
Generating personalised suggestion…
Medium content Warning priority 62/100 −50 pts Medium · ~45m

E-E-A-T: Expertise

Moderate:

Generic best practice

Show expertise: author bio with credentials, citations to reputable sources, in-depth coverage of the topic, technical accuracy.

AI suggestion (context-aware)
Generating personalised suggestion…
Medium content Warning priority 62/100 −50 pts Medium · ~45m

E-E-A-T: Trustworthiness

Moderate:

Generic best practice

Add trust signals: clear contact info, privacy policy, terms of service, customer reviews, security badges, real photos of team/location.

AI suggestion (context-aware)
Generating personalised suggestion…
Medium meta Warning priority 59/100 −30 pts Trivial · ~5m

Meta description length

Description is 923 characters — likely truncated.

Location in HTML
Line 1 · html > head > meta:nth-of-type(2) 
>    1  <!DOCTYPE html><html dir="ltr" lang="en-US" prefix="og: https://ogp.me/ns#"><head><script data-no-optimize="1">var litespeed_docref=sessionStorage.getItem("litespeed_docref");litespeed_docref&&(Object.defineProperty(document,"referrer",{get…
     2  <style id="wp-img-auto-sizes-contain-inline-css">img:is([sizes=auto i],[sizes^="auto," i]){contain-intrinsic-size:3000px 1500px}
Generic best practice

Meta description is outside the 120-160 character range. Too short = thin content; too long = truncated by Google.

Code fix
Before:
<meta name="description" content="923 chars">
After:
<meta name="description" content="Rewritten description, 120-160 chars, with the primary keyword and a value proposition.">
AI suggestion (context-aware)
Generating personalised suggestion…
Medium content Warning priority 58/100 −50 pts Hard · ~120m

E-E-A-T: Experience

Moderate:

Generic best practice

Demonstrate first-hand experience: original photos, personal anecdotes, before/after results, screenshots from the actual product/service.

AI suggestion (context-aware)
Generating personalised suggestion…
Medium content Warning priority 58/100 −50 pts Hard · ~120m

E-E-A-T: Authoritativeness

Moderate:

Generic best practice

Build authoritativeness: links from respected sites in your niche, mentions in industry publications, About page detailing your expertise.

AI suggestion (context-aware)
Generating personalised suggestion…
Medium ssl security Warning priority 54/100 −40 pts Easy · ~15m

HSTS header present

Missing strict-transport-security header.

Generic best practice

Add Strict-Transport-Security header so browsers refuse HTTP for your domain after the first visit. Bumps SSL Labs grade to A+.

Code fix
Strict-Transport-Security: max-age=31536000; includeSubDomains
AI suggestion (context-aware)
Generating personalised suggestion…
Medium links Warning priority 50/100 −60 pts Medium · ~45m

Healthy internal link count

No internal links on this page.

Generic best practice

Add internal links to related pages on your site. Internal links spread link equity and help users discover related content.

AI suggestion (context-aware)
Generating personalised suggestion…
Medium domain security Warning priority 44/100 −67 pts Easy · ~15m

Security headers configured

Most security headers are missing: strict-transport-security, x-content-type-options, x-frame-options, referrer-policy.

Generic best practice

Add the recommended HTTP security headers at the server/CDN level to harden the site.

Code fix
Before:
# missing headers
After:
# nginx
add_header X-Frame-Options "SAMEORIGIN";
add_header X-Content-Type-Options "nosniff";
add_header Referrer-Policy "strict-origin-when-cross-origin";
add_header Permissions-Policy "geolocation=(), microphone=()";
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
AI suggestion (context-aware)
Generating personalised suggestion…
Low domain security Warning priority 43/100 −30 pts Easy · ~15m

DMARC record present

DMARC present but policy is p=none (monitor only).

Generic best practice

Publish a DMARC record to tell receivers what to do with mail that fails SPF/DKIM, and where to send reports. Start at p=none to monitor, then tighten to quarantine/reject.

Code fix
Before:
# no _dmarc TXT record
After:
_dmarc.example.com.  IN  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"
AI suggestion (context-aware)
Generating personalised suggestion…
Low ssl security Warning priority 39/100 −40 pts Trivial · ~5m

X-Content-Type-Options

Missing x-content-type-options header.

Generic best practice

Add X-Content-Type-Options: nosniff so browsers honour the Content-Type and don't MIME-sniff for malicious files.

Code fix
X-Content-Type-Options: nosniff
AI suggestion (context-aware)
Generating personalised suggestion…
Pass Title tag present
title_present
Title tag found.
Actual: Contact Form - Dr Shalini Malhotra
Pass Title length
title_length
Title length 34 chars — within recommended range.
Actual: 34 chars
Pass Title pixel width
title_pixel_width
Title is ~267px wide — fits within the SERP display limit.
Actual: ~267px
Pass Title is descriptive
title_unique_words
6 words — descriptive enough.
Pass Meta description present
meta_description_present
Meta description present.
Actual: ${ parent.decodeEntities(`Full Name`) } * { parent.activateValidation({"message"...
Warning Meta description length
meta_description_length
Description is 923 characters — likely truncated.
Fix: Trim to 120–160 characters.
Actual: 923 chars
Expected: 120–160 chars
Pass OpenGraph title present
og_title_present
Og title present present.
Actual: Contact Form - Dr Shalini Malhotra
Pass OpenGraph description present
og_description_present
Og description present present.
Actual: ${ parent.decodeEntities(`Full Name`) } * { parent.activateValidation({"message"...
Pass OpenGraph image present
og_image_present
Og image present present.
Actual: https://smhairtransplant.org/wp-content/uploads/2025/09/cropped-SM_logo-1.png
Pass Twitter card present
twitter_card_present
Twitter card present present.
Actual: summary_large_image
Pass Viewport meta tag present
meta_viewport_present
Viewport meta tag present.
Actual: width=device-width, initial-scale=1.0, viewport-fit=cover
Pass Charset meta tag present
meta_charset_present
Charset declared.
Fail H1 tag present
h1_present
No <h1> found.
Fix: Every page should have one descriptive H1.
Actual: 0 H1
Skipped Single H1 tag
h1_count
No H1 to evaluate.
Skipped H1 has reasonable length
h1_length
No H1 to evaluate.
Pass Sufficient H2 tags
h2_count
2 H2 tags — good content structure.
Actual: 2
Pass Heading hierarchy
heading_hierarchy
Heading levels descend logically.
Actual: 0 skips
Pass JSON-LD structured data present
schema_json_ld_present
1 JSON-LD blocks present.
Actual: 1 scripts
Pass JSON-LD is valid JSON
schema_valid_json
All JSON-LD blocks parse cleanly.
Pass Recommended schema types used
schema_recommended_types
Recommended schema types found.
Actual: Organization, WebSite, BreadcrumbList
Pass No deprecated schema types
schema_no_deprecated
No deprecated schema types.
Pass No restricted schema types
schema_no_restricted
No restricted schema types.
Pass Schema has required properties
schema_required_properties
Recognised schema types include their required properties.
Info Microdata or RDFa present
schema_microdata_present
No microdata. JSON-LD is preferred — this is informational only.
Actual: 0
Pass Canonical URL present
canonical_present
Canonical link found.
Actual: https://smhairtransplant.org/metform-form/new-form-1772189041/
Pass Canonical self-references
canonical_self_referencing
Canonical points to this page.
Actual: https://smhairtransplant.org/metform-form/new-form-1772189041/
Pass Page is indexable
robots_meta_indexable
No noindex directive (meta robots or X-Robots-Tag).
Actual: max-image-preview:large
Pass Minimal redirect chain
redirect_chain_minimal
URL resolves directly with no redirects.
Actual: 0 hops
Pass HTML lang attribute
lang_attribute_present
<html lang="en-US"> declared.
Actual: en-US
Pass HTML5 doctype
doctype_html5
HTML5 doctype declared.
Pass Favicon present
favicon_present
Favicon declared.
Pass HTTP status 2xx
http_status_ok
Server returned 200.
Actual: 200
Pass Response time acceptable
response_time_ok
Fetched in 146 ms.
Actual: 146 ms
Pass robots.txt accessible
robots_txt_found
robots.txt found.
Pass robots.txt does not block
robots_txt_no_block
robots.txt does not block this page.
Pass sitemap.xml accessible
sitemap_xml_found
Sitemap found at https://smhairtransplant.org/sitemap.xml (41 URLs).
Actual: https://smhairtransplant.org/sitemap.xml
Pass Sitemap lists URLs
sitemap_url_count
Sitemap lists 41 URLs.
Actual: 41 URLs
Pass Page is listed in sitemap
sitemap_contains_url
This page is listed in the sitemap.
Pass Sitemap referenced
sitemap_referenced
Sitemap referenced from robots.txt.
Pass Page served over HTTPS
ssl_https
Served over HTTPS.
Actual: https
Pass TLS handshake succeeds
ssl_valid
TLS handshake succeeded.
Actual: smhairtransplant.org
Pass HTTP redirects to HTTPS
http_redirects_to_https
HTTP requests redirect to HTTPS.
Warning HSTS header present
hsts_header_present
Missing strict-transport-security header.
Fix: Add strict-transport-security for hardened security posture.
Actual: missing
Pass CSP header present
csp_header_present
content-security-policy header present.
Actual: upgrade-insecure-requests
Warning X-Content-Type-Options
x_content_type_options
Missing x-content-type-options header.
Fix: Add x-content-type-options for hardened security posture.
Actual: missing
Pass No mixed content
no_mixed_content
All subresources load over HTTPS.
Info PageSpeed performance score
pagespeed_score
No PageSpeed API key configured — heuristic-only score.
Actual: heuristic
Info Largest Contentful Paint
lcp_within_threshold
Estimated from initial fetch (146 ms). Configure GOOGLE_PAGESPEED_API_KEY for real metrics.
Actual: 0.15s
Info First Contentful Paint
fcp_within_threshold
Estimated from initial fetch (146 ms). Configure GOOGLE_PAGESPEED_API_KEY for real metrics.
Actual: 0.15s
Info Time To First Byte
ttfb_within_threshold
Estimated from initial fetch (146 ms). Configure GOOGLE_PAGESPEED_API_KEY for real metrics.
Actual: 0.15s
Info Cumulative Layout Shift
cls_within_threshold
CLS not measurable without PageSpeed API.
Actual: unknown
Info Interaction to Next Paint
inp_within_threshold
INP not measurable without PageSpeed API.
Actual: unknown
Info Largest Contentful Paint (field)
crux_lcp_field
Real-world field data requires the PageSpeed API.
Actual: unknown
Info Cumulative Layout Shift (field)
crux_cls_field
Real-world field data requires the PageSpeed API.
Actual: unknown
Info Few render-blocking resources
render_blocking_resources
Render-blocking analysis requires the PageSpeed API.
Actual: unknown
Info Compression enabled
gzip_or_brotli
No gzip/brotli content-encoding header (heuristic — configure GOOGLE_PAGESPEED_API_KEY for a scored result).
Actual: none
Warning Healthy internal link count
internal_link_count
No internal links on this page.
Fix: Link to related pages on your site to spread link equity.
Actual: 0
Skipped No broken internal links
no_broken_internal_links
No internal links to test.
Skipped No broken external links
no_broken_external_links
No external links to test.
Info External links safe
external_links_safe
No external links on this page.
Actual: 0
Skipped Descriptive anchor text
descriptive_anchor_text
No links to evaluate.
Info Images have alt text
images_alt_present
No <img> tags on page.
Actual: 0
Skipped Below-fold images lazy
images_lazy_loaded
No images to evaluate.
Skipped Modern image formats
images_modern_formats
No images to evaluate.
Skipped Images have dimensions
images_have_dimensions
No images to evaluate.
Fail Sufficient word count
word_count
Only 22 words — thin content.
Fix: Target 300+ words; ideal 1000+.
Actual: 22 words
Expected: ≥ 300
Pass Content present without JavaScript
js_rendered_content
Content is present in the server-rendered HTML.
Skipped Readable prose
readability
Insufficient text to score.
Warning E-E-A-T: Experience
eeat_experience
Moderate:
Fix: Strengthen Experience signals on this page.
Actual: 5/10
Expected: ≥ 7
Warning E-E-A-T: Expertise
eeat_expertise
Moderate:
Fix: Strengthen Expertise signals on this page.
Actual: 5/10
Expected: ≥ 7
Warning E-E-A-T: Authoritativeness
eeat_authority
Moderate:
Fix: Strengthen Authoritativeness signals on this page.
Actual: 5/10
Expected: ≥ 7
Warning E-E-A-T: Trustworthiness
eeat_trust
Moderate:
Fix: Strengthen Trustworthiness signals on this page.
Actual: 5/10
Expected: ≥ 7
Info Target keyword alignment
keyword_alignment
No target keyword supplied — skipped. Provide one when starting an audit to score on-page keyword alignment.
Actual: not set
Pass Viewport set for mobile
mobile_viewport
Responsive viewport configured.
Actual: width=device-width, initial-scale=1.0, viewport-fit=cover
Pass Tap targets reasonable
mobile_tap_targets
No obvious tap-target sizing problems.
Info Legible font sizes
mobile_font_size
No inline body font-size — relying on stylesheet defaults.
Actual: unknown
Pass No Flash/legacy plugins
mobile_no_flash
No legacy plugin elements.
Info hreflang tags present (if i18n)
hreflang_present
No hreflang tags. OK for monolingual sites.
Actual: 0
Skipped hreflang codes valid
hreflang_valid_codes
No hreflang to evaluate.
Skipped hreflang self-reference
hreflang_self_ref
No hreflang to evaluate.
Skipped hreflang x-default present
hreflang_x_default
No hreflang to evaluate.
Skipped Content provides clear answers
geo_clear_answers
Content too short to evaluate.
Skipped High factual density
geo_factual_density
Content too short to evaluate.
Skipped Structured for AI extraction
geo_structured_for_ai
Content too short to evaluate.
Skipped Cites authoritative sources
geo_authoritative_sources
Content too short to evaluate.
Pass No hidden text or links
spam_no_hidden_content
No obvious hidden text or link spam.
Pass No sneaky redirects
spam_no_sneaky_redirects
No sneaky meta or JavaScript redirects.
Pass Clean outbound links
spam_clean_outbound_links
No spammy outbound links among 0 external links.
Actual: 0 spam / 0 external
Pass No cloaking
spam_no_cloaking
Googlebot and visitors are served comparable content (0% difference).
Actual: 0% difference
Warning No injected/obfuscated code
spam_no_malware_signals
Potential hacked/injected-code signals: large inline base64 blob.
Fix: Investigate for a site compromise. Scan the source, check for unexpected admin users, and review recently modified files.
Actual: large inline base64 blob
Expected: none
Info Google Safe Browsing
safe_browsing_clean
Not checked — set GOOGLE_SAFE_BROWSING_API_KEY to flag malware/phishing.
Actual: not configured
Warning Security headers configured
security_headers_posture
Most security headers are missing: strict-transport-security, x-content-type-options, x-frame-options, referrer-policy.
Fix: Configure security headers at the server/CDN level for a stronger posture.
Actual: 2/6 present
Expected: 6/6
Pass SPF record present
email_spf
SPF record found.
Actual: v=spf1 include:_spf.mail.hostinger.com ~all
Warning DMARC record present
email_dmarc
DMARC present but policy is p=none (monitor only).
Fix: Once reports look clean, move to p=quarantine or p=reject to actually block spoofed mail.
Actual: p=none
Expected: p=quarantine/reject
Pass MX records present
email_mx
2 MX record(s) configured.
Actual: mx2.hostinger.com, mx1.hostinger.com
Info DKIM configured
email_dkim
No DKIM key found for common selectors. DKIM uses a private selector that cannot be fully enumerated externally — verify with your mail provider.
Actual: unknown
Info DNS resolves / hosting
dns_hosting_info
IP 193.203.185.192; NS: ns2.dns-parking.com, ns1.dns-parking.com
Actual: 193.203.185.192
Pass Domain registration
domain_registration
Registrar: NameCheap, Inc.; registered 327 day(s) ago; expires in 37 day(s).
Actual: NameCheap, Inc.
Pass Not on spam blacklists
domain_not_blacklisted
Not listed on the checked spam blacklists (2 zones).
Actual: clean
Info Clean web reputation
web_reputation
Deep reputation scoring not run (set VIRUSTOTAL_API_KEY). Safe Browsing & blacklist checks cover the basics.
Actual: not configured