Audited {{DATE}} Scope: SEO · structured data · performance & Core Web Vitals · analytics · security · ad tech · links · accessibility · WP stack Environment: {{ENV_NOTE}}
🌿 Generated with Understory Trace — server-side sight for Claude in Chrome · Orchard Grove Media
Executive summary
What we checked, what we found, and where to start. Findings measured in a single browser session are lab data — pair with PageSpeed Insights / CrUX field data for real-user Core Web Vitals.
{{CRIT_N}}Critical
{{WARN_N}}Warnings
{{OPP_N}}Opportunities
Top concerns
{{TOP_1}}
{{TOP_2}}
{{TOP_3}}
Category
Grade
Headline
SEO & indexation
Needs work
{{...}}
Structured data
Good
{{...}}
Performance & CWV
At risk
{{...}}
Analytics & tracking
Needs work
{{...}}
Security
At risk
{{...}}
Ad tech
Needs work
{{...}}
Links & crawl
Good
{{...}}
Accessibility
Needs work
{{...}}
Architecture & stack
Needs work
{{...}}
1 · SEO & indexation Needs work
Titles, meta, canonicals, robots, sitemap, headings, and crawl efficiency across the page-type matrix.
Critical
Canonical points to the homepage on every page
What
Every template emits <link rel="canonical" href="https://site/"> instead of a self-referential URL — telling Google every page is a duplicate of the home page.
Evidence
Rendered <head> on the post & archive templates
Owner
SEO plugin — canonical setting
Fix
Enable self-referential canonicals; confirm per template.
Screenshot embedded as a data: URI so the PDF is self-contained.
Opportunity
Thin tag/param archives waste crawl budget
What
Faceted ?s= and paginated tag archives are crawlable and indexable.
Evidence
robots.txt + sitemap + SEO plugin taxonomy settings (/option)
Fix
noindex thin archives; block search-result URLs in robots.txt.
3 · Performance & Core Web Vitals At risk
Lab measurements (one device/run) plus the server-side cause behind each. Field data: run PageSpeed Insights for CrUX.
The search template's server response is dominated by a single WP_Query MySQL LIKE scan.
Evidence
Understory Trace capture — database.slowest (5.7s) tied to the 7.2s TTFB
Owner
Core search / DB
Fix
Add a search index — SearchWP, Relevanssi, or ElasticPress.
Warning
Layout shift from injected ad slots
What
Ad slots don't reserve height, causing CLS as ads load.
Evidence
In-browser layout-shift observer + screenshot
Fix
Reserve min-height per ad slot; lazy-load below-fold ads.
5 · Security At risk
Response headers, info leakage, config posture, and known plugin CVEs.
Critical
10 plugins carry known CVEs (5 High)
What
AdRotate (CVSS 8.8), Advanced Ads, Forminator, Ad Inserter Pro, Easy Social Share — installed versions are known-vulnerable.
Evidence
GET /vulnerabilities (WPVulnerability.com)
Fix
Update the affected plugins; AdRotate is many versions behind.
Warning
Missing HSTS and Content-Security-Policy headers
What
The document response omits Strict-Transport-Security and Content-Security-Policy.
Evidence
Response headers (network panel); WP-sent vs edge confirmed via the plugin
Fix
Add HSTS at the edge; introduce a report-only CSP, then enforce.
Methodology & scope
How this audit was produced and what to keep in mind.
Vantages: the rendered page (DOM, network, response headers), live in-browser measurement (Core Web Vitals — lab), and the Understory Trace plugin for server-side cause, attribution, plugin settings, and CVEs.
Page matrix: {{PAGES_AUDITED}}.
Lab vs field: Core Web Vitals here are a single-session lab measurement. Real-user (field) data comes from CrUX / PageSpeed Insights and may differ — validate before acting on CWV.
Links: broken-link checking sampled {{LINK_SAMPLE}} links, not a full crawl.
Staging caveats: {{STAGING_NOTE}} (e.g. object cache / OPcache may be enabled on production).
Generated with 🌿 Understory Trace by Orchard Grove Media. Findings are a point-in-time snapshot; re-run after changes to confirm.
