- Home
- Mistakes
68,769 sites57 checks
The most common website mistakes
The mistakes we find most often on websites worldwide: SEO, security headers, email authentication, DNS — measured on 68,769 sites, 2026.
12%
Sites with ≤ 5 issues
8,408 / 68,769
41%
DMARC enforced
36,804 / 90,186
53%
HSTS
35,610 / 67,673
65%
Canonical link
44,483 / 68,315
91%No DNSSECDNS answers are not signed, so they can be spoofed on the way.DNS87%No CAA recordAny certificate authority may issue certificates for the domain.DNS70%No Content-Security-PolicyA CSP limits where scripts can come from and reduces the impact of XSS.Security64%No IPv6The site has no AAAA record and is reachable only over IPv4.DNS54%No X-Content-Type-OptionsBrowsers may guess content types, which enables some injection tricks.Security51%No structured dataWithout Schema.org markup the page can't get rich results.SEO50%No Open Graph tagsShared links show no image or a random one.Content50%No clickjacking protectionNeither X-Frame-Options nor CSP frame-ancestors is set, so the site can be framed by others.Security47%No HSTS headerWithout Strict-Transport-Security, the first request can be downgraded to HTTP.Security36%No DMARC recordWithout DMARC, receivers don't know what to do with spoofed mail and you get no reports.Email35%No canonical linkDuplicate URLs (parameters, trailing slashes) compete with each other.SEO34%No H1 headingThe main heading tells users and search engines what the page is about.SEO32%No XML sitemapSearch engines discover new pages more slowly.SEO28%No robots.txtCrawlers get a 404 and you can't point them to the sitemap.SEO26%Cookies without the Secure flagCookies set on HTTPS without Secure can leak over plain HTTP.Security24%No SPF recordAnyone can send email pretending to be your domain, and your own mail is more likely to land in spam.Email23%DMARC set to p=noneMonitoring only: spoofed email is still delivered.Email19%Missing meta descriptionSearch engines will build the snippet themselves from random page text.SEO19%X-Powered-By headerThe header reveals the framework or language version.Security17%Meta description too longLong descriptions are truncated in results.SEO16%No faviconTabs, bookmarks and search results show a generic icon.Content14%No lang attributeScreen readers and translators can't tell the page language.SEO14%HTTP does not redirect to HTTPSBoth versions are reachable, so visitors and search engines may land on the insecure copy.Security13%Title too shortA very short title wastes space in search results.SEO13%Images without alt textScreen readers and image search get no description.Content12%Several H1 headingsMultiple H1s blur the main topic of the page.SEO11%Server version in headersExact software versions help attackers pick known exploits.Security10%Title too longTitles over ~70 characters are cut off in search results.SEO9.9%No mobile viewportPhones render the page as a zoomed-out desktop page.SEO9%Outdated jQueryjQuery below 3.5 has known XSS vulnerabilities.Security8.6%Several title tagsSearch engines pick one at random.SEO7.8%hreflang without x-defaultVisitors from other countries have no fallback version.SEO7.5%Meta description too shortA short description gives searchers little reason to click.SEO7%Only legacy Universal AnalyticsUniversal Analytics stopped collecting data in 2023.Content6.5%Very large DOMOver 3,000 elements make the page slow to style and update.Performance6.2%HTML not compressedUncompressed HTML is 3–5 times larger on the wire.Performance4.8%HTML over 1 MBLarge HTML slows down the first render, especially on mobile.Performance4.8%Missing titleThe title is the headline of your search result.SEO4.1%More than 40 external scriptsEach script competes for bandwidth and the main thread.Performance2.7%Invalid TLS certificateThe certificate does not validate (expired, wrong host or broken chain) — browsers show a full-page warning.Security2%Invalid lines in robots.txtUnknown directives are ignored, so rules may not work as intended.SEO1.6%No HTTPSThe homepage loads over plain HTTP: browsers mark it «Not secure» and traffic can be read or altered.Security1.6%Homepage set to noindexThe homepage is excluded from search results.SEO1.2%Redirect chain before the homepageEvery hop adds latency and loses some link signals.Performance1.2%Mixed contentAn HTTPS page loads scripts, images or frames over HTTP; browsers block or flag them.Security1.1%Certificate expires within 14 daysIf renewal fails, the site will start showing security warnings.Security1.1%Canonical points to another domainSearch engines may index the other domain instead of yours.SEO0.9%Multiple SPF recordsTwo SPF records make SPF invalid (permerror).Email0.8%Broken JSON-LDInvalid JSON is ignored by search engines.SEO0.4%Invalid lang attributeThe language code is not a valid BCP 47 tag.SEO0.2%Only one nameserverIf that server fails, the whole domain disappears.DNS<0.1%SPF over 10 DNS lookupsSPF evaluation stops after 10 lookups, so some legitimate mail fails.Email<0.1%polyfill.io scriptThe polyfill.io domain was taken over and served malicious code in 2024.Security<0.1%SPF allows everyone (+all)+all authorizes every server on the internet to send as your domain.Email<0.1%More than 25 third-party domainsEach extra domain adds DNS, TLS and privacy cost.Performance0%Outdated TLS versionThe server negotiates TLS 1.0/1.1, which browsers no longer accept.Security0%robots.txt blocks everythingDisallow: / for all bots keeps the site out of search engines.SEO
Our crawler: 68,769 sites · Global · updated Oct 23, 2026 · Methodology
Markets
Markets compared
The same checks on popular sites in seven markets.
| Metric | Global | United Kingdom | Netherlands | Italy | Spain | Japan | Latin America |
|---|---|---|---|---|---|---|---|
| Sites with ≤ 5 issues | 12% | 11% | 19% | 5.4% | 7.6% | 1.8% | 7.3% |
| Title 31–70 characters | 56% | 61% | 60% | 58% | 62% | 28% | 53% |
| Meta description | 81% | 81% | 81% | 80% | 81% | 85% | 73% |
| Canonical link | 65% | 74% | 69% | 71% | 72% | 50% | 66% |
| Exactly one H1 | 54% | 60% | 58% | 50% | 58% | 58% | 44% |
| HSTS | 53% | 54% | 54% | 40% | 50% | 33% | 44% |
| DMARC record | 64% | 40% | 45% | 68% | 67% | 61% | 67% |
| Mixed content | 1.2% | 1.5% | 0.7% | 2.3% | 1.8% | 2.3% | 2.7% |
Found mistakes on your site?
We can fix them in one sprint. Reply within one business day.