SEO Report: momondo.no
Generated 30 April 2026 · 32 findings · 4.7s
Service businesses need to dominate local search results with correct NAP data, reviews, and local signals to attract nearby customers.
Score Breakdown
Average Local Business score: 54
Score Projection
Estimated improvement based on the findings in this report
Ready to improve your SEO?
Start a free trial and see how your score can improve.
Module Breakdown
All Findings (28)
Critical (1)
- highaccessibility
2 buttons without accessible name
Buttons with no text, aria-label, or title are invisible to screen readers
Add visible text or aria-label to all buttons
Medium (8)
- mediumcookies
5 cookies missing Secure flag
Cookies without Secure flag can be sent over unencrypted HTTP connections
Add the Secure attribute to all cookies to prevent transmission over HTTP
- mediumdns
No DKIM record found
None of the common DKIM selectors returned a valid key. Email authentication may be incomplete.
Configure DKIM signing with your email provider and publish the public key in DNS
- mediumheaders
Missing x-frame-options
X-Frame-Options is missing. The site may be vulnerable to clickjacking.
Add X-Frame-Options: DENY or SAMEORIGIN header
- mediumcontent
Very low text-to-HTML ratio
Text/HTML ratio is 1% (recommended: >5%)
Increase meaningful text content relative to HTML markup
- mediummobile
Fixed-width elements may cause horizontal scroll
1 elements have fixed widths > 400px
Use max-width: 100% or responsive units instead of fixed pixel widths
- mediumrate limits
No rate limiting detected
10 rapid requests all succeeded without any rate-limit headers or 429 responses. The site may be vulnerable to abuse.
Implement rate limiting (e.g., 429 Too Many Requests) to protect against brute-force attacks
- mediumlayout scan
Inconsistent headings
Desktop has 1 H1 tags, mobile has 0
Ensure the same heading structure is served to both mobile and desktop users
- mediumlog analyzer
Server version exposed
Server header reveals version: KAYAK/1.0
Remove version numbers from the Server header to reduce attack surface
Low (19)
- lowcookies
2 cookies missing HttpOnly flag
Cookies without HttpOnly can be accessed by JavaScript, increasing XSS risk
Add HttpOnly to session and authentication cookies
- lowcookies
6 cookies missing SameSite attribute
Missing SameSite defaults to Lax in modern browsers but should be explicit
Set SameSite=Strict or SameSite=Lax on all cookies
- lowcookies
1 cookie with expiry > 1 year
Long cookie lifetimes may violate privacy regulations
Reduce cookie lifetimes to the minimum necessary period
- lowheaders
Missing permissions-policy
Permissions-Policy is missing.
Add Permissions-Policy to restrict browser feature access
- lowheaders
HSTS max-age too short
HSTS max-age is 10886400s (recommended: 31536000)
Set max-age to at least 31536000 (1 year)
- lowmeta
Missing og:url
Open Graph URL is not set
Add og:url meta tag matching the canonical URL
- lowstructured data
Missing WebSite schema
No WebSite structured data found
Add WebSite schema with SearchAction for sitelinks search box
- lowstructured data
Organization missing logo
Organization schema has no logo
Add a logo URL to the Organization schema
- lowrobots
wp-admin blocked without ajax exception
WordPress admin is blocked but admin-ajax.php is not allowed
Add Allow: /wp-admin/admin-ajax.php if using WordPress
- lowtechnology
Many external CSS files
77 external stylesheets loaded
Consider bundling CSS files to reduce HTTP requests
- lowtechnology
Many third-party domains
37 external domains — may impact performance and privacy
Reduce third-party dependencies or self-host critical resources
- lowcontent
Heading level skipped
H5 follows H3 (skipped H4)
Maintain sequential heading hierarchy without skipping levels
- lowrate limits
No WAF detected
No Web Application Firewall (Cloudflare, AWS, Akamai, Vercel, Sucuri, Fastly) was detected in response headers.
Consider using a WAF to protect against common web attacks (XSS, SQL injection, DDoS)
- lowrate limits
No bot protection detected
No CAPTCHA, challenge page, or bot detection was triggered during rapid requests.
Consider implementing bot protection (e.g., Cloudflare Turnstile, hCaptcha) for sensitive endpoints
- lowsocial checker
No social profile links
No links to social media profiles found on the homepage
Add links to your social media profiles for better brand visibility and authority signals
- lowbrand checker
No WebSite schema
No WebSite JSON-LD found
Add WebSite structured data for sitelinks search box in Google
- lowbrand checker
No web app manifest
No manifest.json linked — PWA features unavailable
Add a web app manifest for installability and brand customization
- lowpage experience
Popup elements detected
Found 2 popup/overlay element(s) — likely consent banners
Ensure popups don't cover main content excessively, especially on mobile
- lowpage experience
No lazy loading on images
84 images without lazy loading
Add loading="lazy" to below-the-fold images for faster initial page load
AI Fix Prompt
Copy this prompt into ChatGPT or Claude to get step-by-step fix instructions
Fix all SEO issues found in the audit of momondo.no.
Prioritize high-severity issues first, then medium. For each fix, make the actual code change — don't just describe what to do.
```json
{
"domain": "momondo.no",
"scores": {
"overall": 88,
"performance": 0,
"seo": 94,
"accessibility": 85,
"bestPractices": 91,
"security": 82
},
"findings": [
{
"module": "cookies",
"severity": "medium",
"title": "5 cookies missing Secure flag",
"description": "Cookies without Secure flag can be sent over unencrypted HTTP connections",
"recommendation": "Add the Secure attribute to all cookies to prevent transmission over HTTP"
},
{
"module": "dns",
"severity": "medium",
"title": "No DKIM record found",
"description": "None of the common DKIM selectors returned a valid key. Email authentication may be incomplete.",
"recommendation": "Configure DKIM signing with your email provider and publish the public key in DNS"
},
{
"module": "headers",
"severity": "medium",
"title": "Missing x-frame-options",
"description": "X-Frame-Options is missing. The site may be vulnerable to clickjacking.",
"recommendation": "Add X-Frame-Options: DENY or SAMEORIGIN header"
},
{
"module": "content",
"severity": "medium",
"title": "Very low text-to-HTML ratio",
"description": "Text/HTML ratio is 1% (recommended: >5%)",
"recommendation": "Increase meaningful text content relative to HTML markup"
},
{
"module": "mobile",
"severity": "medium",
"title": "Fixed-width elements may cause horizontal scroll",
"description": "1 elements have fixed widths > 400px",
"recommendation": "Use max-width: 100% or responsive units instead of fixed pixel widths"
},
{
"module": "accessibility",
"severity": "high",
"title": "2 buttons without accessible name",
"description": "Buttons with no text, aria-label, or title are invisible to screen readers",
"recommendation": "Add visible text or aria-label to all buttons"
},
{
"module": "rate-limits",
"severity": "medium",
"title": "No rate limiting detected",
"description": "10 rapid requests all succeeded without any rate-limit headers or 429 responses. The site may be vulnerable to abuse.",
"recommendation": "Implement rate limiting (e.g., 429 Too Many Requests) to protect against brute-force attacks"
},
{
"module": "layout-scan",
"severity": "medium",
"title": "Inconsistent headings",
"description": "Desktop has 1 H1 tags, mobile has 0",
"recommendation": "Ensure the same heading structure is served to both mobile and desktop users"
},
{
"module": "log-analyzer",
"severity": "medium",
"title": "Server version exposed",
"description": "Server header reveals version: KAYAK/1.0",
"recommendation": "Remove version numbers from the Server header to reduce attack surface"
}
]
}
```Recommendations for your industry
- 1Optimize Google Business profile
- 2Add Service/LocalBusiness schema
- 3Integrate customer reviews with Review schema
- 4Ensure consistent NAP data across all pages
- 5Create profiles in local business directories
SEO Checklist for Local Business
Tips for Mixed websites
- →Define clear landing pages for each segment
- →Use different meta strategies per page group
- →Segment sitemap by content type
Local SEO Context
Norway has Scandinavia's highest digital purchasing power per capita.