SEO Report: cis.es
Generated April 30, 2026 · 31 findings · 6.2s
Institutional websites prioritize accessibility, security, and proper indexing — citizens and stakeholders need easy access to relevant information.
Score Breakdown
Average Government score: 56
Score Projection
Estimated improvement based on the findings in this report
Ready to improve your SEO?
Start a free trial and see how your score can improve.
Module Breakdown
All Findings (28)
Critical (2)
- highaccessibility
6 buttons without accessible name
Buttons with no text, aria-label, or title are invisible to screen readers
Add visible text or aria-label to all buttons
- highpage experience
Intrusive interstitials detected
Found 17 potential popup/overlay elements
Reduce intrusive interstitials — they hurt mobile experience and can trigger Google penalties
Medium (9)
- mediumcookies
3 cookies missing Secure flag
Cookies without Secure flag can be sent over unencrypted HTTP connections
Add the Secure attribute to all cookies to prevent transmission over HTTP
- mediumdns
Missing DMARC record
No DMARC policy found at _dmarc subdomain.
Add a DMARC TXT record to prevent email spoofing
- mediumdns
No DKIM record found
None of the common DKIM selectors returned a valid key. Email authentication may be incomplete.
Configure DKIM signing with your email provider and publish the public key in DNS
- mediumssl
SSL certificate expiring within 30 days
Certificate expires in 22 days
Plan to renew the SSL certificate soon
- mediumtechnology
Render-blocking scripts
11 scripts load synchronously without async/defer
Add async or defer to non-critical scripts to improve page load speed
- mediumcontent
External links without noopener
11 external links with target="_blank" lack rel="noopener"
Add rel="noopener noreferrer" to all target="_blank" links
- mediumaccessibility
No skip navigation link
No skip-to-content link at the top of the page
Add a visually hidden skip link as the first focusable element
- mediumrate limits
No rate limiting detected
10 rapid requests all succeeded without any rate-limit headers or 429 responses. The site may be vulnerable to abuse.
Implement rate limiting (e.g., 429 Too Many Requests) to protect against brute-force attacks
- mediumbrand checker
No Organization schema
No Organization JSON-LD found
Add Organization structured data with name, logo, and contact information
Low (17)
- lowcookies
3 cookies missing SameSite attribute
Missing SameSite defaults to Lax in modern browsers but should be explicit
Set SameSite=Strict or SameSite=Lax on all cookies
- lowdns
No IPv6 (AAAA) records
The domain has no AAAA records for IPv6 connectivity
Add AAAA DNS records for IPv6 support
- lowheaders
Missing referrer-policy
Referrer-Policy is not set. Full URLs may leak to third parties.
Add Referrer-Policy: strict-origin-when-cross-origin
- lowheaders
Missing permissions-policy
Permissions-Policy is missing.
Add Permissions-Policy to restrict browser feature access
- lowheaders
Server header exposes software
Server: Apache
Remove or obfuscate the Server header to reduce information leakage
- lowmeta
Title too long
Title is 79 characters (recommended: 50-60)
Shorten the title to 50-60 characters
- lowmeta
Meta description too long
Description is 183 characters (recommended: 120-160)
Shorten the meta description to 120-160 characters
- lowstructured data
Missing Organization schema
No Organization or LocalBusiness structured data found
Add Organization schema with name, logo, and contact info
- lowsitemap
No lastmod dates
Sitemap URLs don't include lastmod timestamps
Add <lastmod> to help search engines prioritize crawling
- lowtechnology
Many inline scripts
46 inline <script> blocks found
Move inline scripts to external files for caching and CSP compliance
- lowcontent
Empty anchor links
4 links point to "#" or "javascript:void(0)"
Use proper URLs or button elements instead of empty anchors
- lowcontent
Lazy images without dimensions
1 lazy-loaded images lack width/height — causes layout shift
Add width and height attributes to lazy-loaded images
- lowrate limits
No WAF detected
No Web Application Firewall (Cloudflare, AWS, Akamai, Vercel, Sucuri, Fastly) was detected in response headers.
Consider using a WAF to protect against common web attacks (XSS, SQL injection, DDoS)
- lowrate limits
No bot protection detected
No CAPTCHA, challenge page, or bot detection was triggered during rapid requests.
Consider implementing bot protection (e.g., Cloudflare Turnstile, hCaptcha) for sensitive endpoints
- lownews mentions
No press or news presence
No press pages found on the site and no external news mentions detected
Create a /news or /press page with company updates — this builds authority and earns links
- lowbrand checker
No web app manifest
No manifest.json linked — PWA features unavailable
Add a web app manifest for installability and brand customization
- lowpage experience
No resource hints
No preload or preconnect hints found
Add preload for critical resources and preconnect for important third-party origins
AI Fix Prompt
Copy this prompt into ChatGPT or Claude to get step-by-step fix instructions
Fix all SEO issues found in the audit of cis.es.
Prioritize high-severity issues first, then medium. For each fix, make the actual code change — don't just describe what to do.
```json
{
"domain": "cis.es",
"scores": {
"overall": 85,
"performance": 0,
"seo": 91,
"accessibility": 77,
"bestPractices": 93,
"security": 79
},
"findings": [
{
"module": "cookies",
"severity": "medium",
"title": "3 cookies missing Secure flag",
"description": "Cookies without Secure flag can be sent over unencrypted HTTP connections",
"recommendation": "Add the Secure attribute to all cookies to prevent transmission over HTTP"
},
{
"module": "dns",
"severity": "medium",
"title": "Missing DMARC record",
"description": "No DMARC policy found at _dmarc subdomain.",
"recommendation": "Add a DMARC TXT record to prevent email spoofing"
},
{
"module": "dns",
"severity": "medium",
"title": "No DKIM record found",
"description": "None of the common DKIM selectors returned a valid key. Email authentication may be incomplete.",
"recommendation": "Configure DKIM signing with your email provider and publish the public key in DNS"
},
{
"module": "ssl",
"severity": "medium",
"title": "SSL certificate expiring within 30 days",
"description": "Certificate expires in 22 days",
"recommendation": "Plan to renew the SSL certificate soon"
},
{
"module": "technology",
"severity": "medium",
"title": "Render-blocking scripts",
"description": "11 scripts load synchronously without async/defer",
"recommendation": "Add async or defer to non-critical scripts to improve page load speed"
},
{
"module": "content",
"severity": "medium",
"title": "External links without noopener",
"description": "11 external links with target=\"_blank\" lack rel=\"noopener\"",
"recommendation": "Add rel=\"noopener noreferrer\" to all target=\"_blank\" links"
},
{
"module": "accessibility",
"severity": "medium",
"title": "No skip navigation link",
"description": "No skip-to-content link at the top of the page",
"recommendation": "Add a visually hidden skip link as the first focusable element"
},
{
"module": "accessibility",
"severity": "high",
"title": "6 buttons without accessible name",
"description": "Buttons with no text, aria-label, or title are invisible to screen readers",
"recommendation": "Add visible text or aria-label to all buttons"
},
{
"module": "rate-limits",
"severity": "medium",
"title": "No rate limiting detected",
"description": "10 rapid requests all succeeded without any rate-limit headers or 429 responses. The site may be vulnerable to abuse.",
"recommendation": "Implement rate limiting (e.g., 429 Too Many Requests) to protect against brute-force attacks"
},
{
"module": "brand-checker",
"severity": "medium",
"title": "No Organization schema",
"description": "No Organization JSON-LD found",
"recommendation": "Add Organization structured data with name, logo, and contact information"
},
{
"module": "page-experience",
"severity": "high",
"title": "Intrusive interstitials detected",
"description": "Found 17 potential popup/overlay elements",
"recommendation": "Reduce intrusive interstitials — they hurt mobile experience and can trigger Google penalties"
}
]
}
```Recommendations for your industry
- 1Ensure WCAG 2.1 AA compliance
- 2Implement all recommended security headers
- 3Ensure sitemap covers all important pages
- 4Optimize page load time to under 2 seconds
- 5Ensure responsive design on all pages
SEO Checklist for Government
Tips for B2G websites
- →Ensure full accessibility (WCAG 2.1 AAA)
- →Prioritize information architecture and navigation
- →Implement multilingual content with hreflang
Local SEO Context
Spain has growing e-commerce and mobile search dominates.