SEO Report: cbot.se
Generated April 29, 2026 · 26 findings · 10.0s
Institutional websites prioritize accessibility, security, and proper indexing — citizens and stakeholders need easy access to relevant information.
Score Breakdown
Average General score: 50
Score Projection
Estimated improvement based on the findings in this report
Ready to improve your SEO?
Start a free trial and see how your score can improve.
Module Breakdown
All Findings (22)
Critical (3)
- highheaders
Missing strict-transport-security
HSTS header is missing. The site may be vulnerable to downgrade attacks.
Add Strict-Transport-Security header with max-age of at least 31536000
- highcookies
Module failed
The operation was aborted due to timeout
Try scanning again
- highindexing checker
Canonical points to different domain
Canonical: https://www.storavillamassan.se/ points to storavillamassan.se
Ensure the canonical URL points to the same domain unless cross-domain canonicalization is intended
Medium (7)
- mediumdns
Missing SPF record
No SPF TXT record found. Email spoofing is possible.
Add a TXT record with v=spf1 policy
- mediumdns
Missing DMARC record
No DMARC policy found at _dmarc subdomain.
Add a DMARC TXT record to prevent email spoofing
- mediumdns
No DKIM record found
None of the common DKIM selectors returned a valid key. Email authentication may be incomplete.
Configure DKIM signing with your email provider and publish the public key in DNS
- mediumheaders
Missing content-security-policy
CSP header is missing. The site may be vulnerable to XSS attacks.
Add a Content-Security-Policy header to restrict resource loading
- mediumheaders
Missing x-content-type-options
X-Content-Type-Options is missing. MIME-sniffing attacks are possible.
Add X-Content-Type-Options: nosniff header
- mediumheaders
Missing x-frame-options
X-Frame-Options is missing. The site may be vulnerable to clickjacking.
Add X-Frame-Options: DENY or SAMEORIGIN header
- mediumsitemap
Sitemap contains foreign URLs
1 URLs belong to other domains
Only include URLs from your own domain in the sitemap
Low (12)
- lowheaders
Missing referrer-policy
Referrer-Policy is not set. Full URLs may leak to third parties.
Add Referrer-Policy: strict-origin-when-cross-origin
- lowheaders
Missing permissions-policy
Permissions-Policy is missing.
Add Permissions-Policy to restrict browser feature access
- lowheaders
Missing Cache-Control header
No Cache-Control header — browser caching is undefined
Add Cache-Control with appropriate max-age for static and dynamic resources
- lowheaders
Content-Type missing charset
Content-Type header does not specify charset
Add charset=utf-8 to Content-Type header
- lowsitemap
No lastmod dates
Sitemap URLs don't include lastmod timestamps
Add <lastmod> to help search engines prioritize crawling
- lowtechnology
Many inline scripts
16 inline <script> blocks found
Move inline scripts to external files for caching and CSP compliance
- lowtechnology
Many third-party domains
21 external domains — may impact performance and privacy
Reduce third-party dependencies or self-host critical resources
- lowrate limits
No rate limiting detected
No explicit rate-limit headers or 429 responses detected. Cloudflare WAF provides platform-level protection.
Implement rate limiting (e.g., 429 Too Many Requests) to protect against brute-force attacks
- lownews mentions
No press or news presence
No press pages found on the site and no external news mentions detected
Create a /news or /press page with company updates — this builds authority and earns links
- lowsocial checker
No social profile links
No links to social media profiles found on the homepage
Add links to your social media profiles for better brand visibility and authority signals
- lowbrand checker
No web app manifest
No manifest.json linked — PWA features unavailable
Add a web app manifest for installability and brand customization
- lowpage experience
Popup elements detected
Found 2 popup/overlay element(s) — likely consent banners
Ensure popups don't cover main content excessively, especially on mobile
AI Fix Prompt
Copy this prompt into ChatGPT or Claude to get step-by-step fix instructions
Fix all SEO issues found in the audit of cbot.se.
Prioritize high-severity issues first, then medium. For each fix, make the actual code change — don't just describe what to do.
```json
{
"domain": "cbot.se",
"scores": {
"overall": 80,
"performance": 0,
"seo": 91,
"accessibility": 100,
"bestPractices": 97,
"security": 52
},
"findings": [
{
"module": "dns",
"severity": "medium",
"title": "Missing SPF record",
"description": "No SPF TXT record found. Email spoofing is possible.",
"recommendation": "Add a TXT record with v=spf1 policy"
},
{
"module": "dns",
"severity": "medium",
"title": "Missing DMARC record",
"description": "No DMARC policy found at _dmarc subdomain.",
"recommendation": "Add a DMARC TXT record to prevent email spoofing"
},
{
"module": "dns",
"severity": "medium",
"title": "No DKIM record found",
"description": "None of the common DKIM selectors returned a valid key. Email authentication may be incomplete.",
"recommendation": "Configure DKIM signing with your email provider and publish the public key in DNS"
},
{
"module": "headers",
"severity": "high",
"title": "Missing strict-transport-security",
"description": "HSTS header is missing. The site may be vulnerable to downgrade attacks.",
"recommendation": "Add Strict-Transport-Security header with max-age of at least 31536000"
},
{
"module": "headers",
"severity": "medium",
"title": "Missing content-security-policy",
"description": "CSP header is missing. The site may be vulnerable to XSS attacks.",
"recommendation": "Add a Content-Security-Policy header to restrict resource loading"
},
{
"module": "headers",
"severity": "medium",
"title": "Missing x-content-type-options",
"description": "X-Content-Type-Options is missing. MIME-sniffing attacks are possible.",
"recommendation": "Add X-Content-Type-Options: nosniff header"
},
{
"module": "headers",
"severity": "medium",
"title": "Missing x-frame-options",
"description": "X-Frame-Options is missing. The site may be vulnerable to clickjacking.",
"recommendation": "Add X-Frame-Options: DENY or SAMEORIGIN header"
},
{
"module": "cookies",
"severity": "high",
"title": "Module failed",
"description": "The operation was aborted due to timeout",
"recommendation": "Try scanning again"
},
{
"module": "sitemap",
"severity": "medium",
"title": "Sitemap contains foreign URLs",
"description": "1 URLs belong to other domains",
"recommendation": "Only include URLs from your own domain in the sitemap"
},
{
"module": "indexing-checker",
"severity": "high",
"title": "Canonical points to different domain",
"description": "Canonical: https://www.storavillamassan.se/ points to storavillamassan.se",
"recommendation": "Ensure the canonical URL points to the same domain unless cross-domain canonicalization is intended"
}
]
}
```Recommendations for your industry
- 1Ensure WCAG 2.1 AA compliance
- 2Implement all recommended security headers
- 3Ensure sitemap covers all important pages
- 4Optimize page load time to under 2 seconds
- 5Ensure responsive design on all pages
SEO Checklist for General
Tips for Mixed websites
- →Define clear landing pages for each segment
- →Use different meta strategies per page group
- →Segment sitemap by content type
Local SEO Context
Sweden has high internet penetration and favors Swedish domains in local searches.