Skip to main content
GeneralMixed

SEO Report: sp.se

Generated 30 April 2026 · 35 findings · 5.3s

81
report.overallScore
80
seo
73
security
0
performance
92
accessibility
90
Best Practices

Institutional websites prioritize accessibility, security, and proper indexing — citizens and stakeholders need easy access to relevant information.

Score Breakdown

Average General score: 50

seo
80(+35 vs avg)
security
73(+15 vs avg)
performance
0(-44 vs avg)
accessibility
92(+40 vs avg)
Best Practices
90(+34 vs avg)

Score Projection

Estimated improvement based on the findings in this report

Current score: 81Projected score: 86
Current score
Free (+3)
Starter (+1)
Pro (+1)

Ready to improve your SEO?

Start a free trial and see how your score can improve.

Module Breakdown

headers
010 findings
sitemap
502 findings
robots
653 findings
rate limits
753 findings
news mentions
751 finding
page experience
751 finding
indexing checker
751 finding
structured data
784 findings
social checker
802 findings
brand checker
802 findings
uptime checker
851 finding
dns
902 findings
accessibility
921 finding
mobile
951 finding
log analyzer
951 finding
cookies
100
ssl
100
meta
100
technology
100
content
100
layout scan
100
crawl budget
100

All Findings (33)

Critical (5)

  • highheaders

    HTTP 403 error

    Server returned HTTP 403

    Fix the server error to return a 200 status

  • highsitemap

    Invalid sitemap format

    Sitemap does not appear to be valid XML

    Ensure sitemap.xml is properly formatted XML

  • highsitemap

    Empty sitemap

    Sitemap contains no URLs

    Add URLs to the sitemap

  • highpage experience

    Intrusive interstitials detected

    Found 6 potential popup/overlay elements

    Reduce intrusive interstitials — they hurt mobile experience and can trigger Google penalties

  • highindexing checker

    Canonical points to different domain

    Canonical: https://www.ri.se/sv points to ri.se

    Ensure the canonical URL points to the same domain unless cross-domain canonicalization is intended

Medium (12)

  • mediumheaders

    Missing content-security-policy

    CSP header is missing. The site may be vulnerable to XSS attacks.

    Add a Content-Security-Policy header to restrict resource loading

  • mediumheaders

    Missing x-content-type-options

    X-Content-Type-Options is missing. MIME-sniffing attacks are possible.

    Add X-Content-Type-Options: nosniff header

  • mediumheaders

    Missing x-frame-options

    X-Frame-Options is missing. The site may be vulnerable to clickjacking.

    Add X-Frame-Options: DENY or SAMEORIGIN header

  • mediumheaders

    CORS allows all origins

    Access-Control-Allow-Origin: * allows any website to make requests

    Restrict CORS to specific trusted origins if the page handles sensitive data

  • mediumstructured data

    Missing @type in schema

    A structured data object has no @type

    Add a @type property (e.g. Organization, WebSite)

  • mediumrobots

    No User-agent directive

    robots.txt has no User-agent directive

    Add User-agent: * to apply rules to all crawlers

  • mediumrobots

    No sitemap in robots.txt

    robots.txt does not reference a sitemap

    Add Sitemap: https://yourdomain.com/sitemap.xml to robots.txt

  • mediumaccessibility

    Auto-playing media detected

    2 video/audio elements auto-play

    Avoid auto-playing media or ensure it has controls and is muted by default

  • mediumrate limits

    No rate limiting detected

    10 rapid requests all succeeded without any rate-limit headers or 429 responses. The site may be vulnerable to abuse.

    Implement rate limiting (e.g., 429 Too Many Requests) to protect against brute-force attacks

  • mediumsocial checker

    og:image not accessible

    OG image returned HTTP 403

    Ensure og:image URL is publicly accessible

  • mediumuptime checker

    Soft 404 detected

    Non-existent URLs return HTTP 200 instead of 404

    Return proper 404 status codes for non-existent pages to avoid indexing junk URLs

  • mediumbrand checker

    No Organization schema

    No Organization JSON-LD found

    Add Organization structured data with name, logo, and contact information

Low (16)

  • lowdns

    DMARC policy is 'none'

    DMARC is set but policy is 'none' (monitoring only).

    Consider upgrading DMARC policy to 'quarantine' or 'reject'

  • lowdns

    Only one MX record (no redundancy)

    A single MX record means no failover if the mail server goes down.

    Add a secondary MX record for email redundancy

  • lowheaders

    Missing referrer-policy

    Referrer-Policy is not set. Full URLs may leak to third parties.

    Add Referrer-Policy: strict-origin-when-cross-origin

  • lowheaders

    Missing permissions-policy

    Permissions-Policy is missing.

    Add Permissions-Policy to restrict browser feature access

  • lowheaders

    HSTS max-age too short

    HSTS max-age is 14515200s (recommended: 31536000)

    Set max-age to at least 31536000 (1 year)

  • lowheaders

    Missing Cache-Control header

    No Cache-Control header — browser caching is undefined

    Add Cache-Control with appropriate max-age for static and dynamic resources

  • lowheaders

    Content-Type missing charset

    Content-Type header does not specify charset

    Add charset=utf-8 to Content-Type header

  • lowstructured data

    Missing Organization schema

    No Organization or LocalBusiness structured data found

    Add Organization schema with name, logo, and contact info

  • lowstructured data

    Missing WebSite schema

    No WebSite structured data found

    Add WebSite schema with SearchAction for sitelinks search box

  • lowmobile

    Unresponsive images

    6 images lack srcset or responsive sizing

    Use srcset and sizes attributes for responsive images

  • lowrate limits

    No WAF detected

    No Web Application Firewall (Cloudflare, AWS, Akamai, Vercel, Sucuri, Fastly) was detected in response headers.

    Consider using a WAF to protect against common web attacks (XSS, SQL injection, DDoS)

  • lowrate limits

    No bot protection detected

    No CAPTCHA, challenge page, or bot detection was triggered during rapid requests.

    Consider implementing bot protection (e.g., Cloudflare Turnstile, hCaptcha) for sensitive endpoints

  • lownews mentions

    No press or news presence

    No press pages found on the site and no external news mentions detected

    Create a /news or /press page with company updates — this builds authority and earns links

  • lowsocial checker

    No social profile links

    No links to social media profiles found on the homepage

    Add links to your social media profiles for better brand visibility and authority signals

  • lowbrand checker

    No WebSite schema

    No WebSite JSON-LD found

    Add WebSite structured data for sitelinks search box in Google

  • lowlog analyzer

    Soft 404 response

    Non-existent pages return HTTP 200 instead of 404

    Return proper 404 status codes for non-existent pages

AI Fix Prompt

Copy this prompt into ChatGPT or Claude to get step-by-step fix instructions

Fix all SEO issues found in the audit of sp.se.

Prioritize high-severity issues first, then medium. For each fix, make the actual code change — don't just describe what to do.

```json
{
  "domain": "sp.se",
  "scores": {
    "overall": 81,
    "performance": 0,
    "seo": 80,
    "accessibility": 92,
    "bestPractices": 90,
    "security": 73
  },
  "findings": [
    {
      "module": "headers",
      "severity": "medium",
      "title": "Missing content-security-policy",
      "description": "CSP header is missing. The site may be vulnerable to XSS attacks.",
      "recommendation": "Add a Content-Security-Policy header to restrict resource loading"
    },
    {
      "module": "headers",
      "severity": "medium",
      "title": "Missing x-content-type-options",
      "description": "X-Content-Type-Options is missing. MIME-sniffing attacks are possible.",
      "recommendation": "Add X-Content-Type-Options: nosniff header"
    },
    {
      "module": "headers",
      "severity": "medium",
      "title": "Missing x-frame-options",
      "description": "X-Frame-Options is missing. The site may be vulnerable to clickjacking.",
      "recommendation": "Add X-Frame-Options: DENY or SAMEORIGIN header"
    },
    {
      "module": "headers",
      "severity": "medium",
      "title": "CORS allows all origins",
      "description": "Access-Control-Allow-Origin: * allows any website to make requests",
      "recommendation": "Restrict CORS to specific trusted origins if the page handles sensitive data"
    },
    {
      "module": "headers",
      "severity": "high",
      "title": "HTTP 403 error",
      "description": "Server returned HTTP 403",
      "recommendation": "Fix the server error to return a 200 status"
    },
    {
      "module": "structured-data",
      "severity": "medium",
      "title": "Missing @type in schema",
      "description": "A structured data object has no @type",
      "recommendation": "Add a @type property (e.g. Organization, WebSite)"
    },
    {
      "module": "robots",
      "severity": "medium",
      "title": "No User-agent directive",
      "description": "robots.txt has no User-agent directive",
      "recommendation": "Add User-agent: * to apply rules to all crawlers"
    },
    {
      "module": "robots",
      "severity": "medium",
      "title": "No sitemap in robots.txt",
      "description": "robots.txt does not reference a sitemap",
      "recommendation": "Add Sitemap: https://yourdomain.com/sitemap.xml to robots.txt"
    },
    {
      "module": "sitemap",
      "severity": "high",
      "title": "Invalid sitemap format",
      "description": "Sitemap does not appear to be valid XML",
      "recommendation": "Ensure sitemap.xml is properly formatted XML"
    },
    {
      "module": "sitemap",
      "severity": "high",
      "title": "Empty sitemap",
      "description": "Sitemap contains no URLs",
      "recommendation": "Add URLs to the sitemap"
    },
    {
      "module": "accessibility",
      "severity": "medium",
      "title": "Auto-playing media detected",
      "description": "2 video/audio elements auto-play",
      "recommendation": "Avoid auto-playing media or ensure it has controls and is muted by default"
    },
    {
      "module": "rate-limits",
      "severity": "medium",
      "title": "No rate limiting detected",
      "description": "10 rapid requests all succeeded without any rate-limit headers or 429 responses. The site may be vulnerable to abuse.",
      "recommendation": "Implement rate limiting (e.g., 429 Too Many Requests) to protect against brute-force attacks"
    },
    {
      "module": "social-checker",
      "severity": "medium",
      "title": "og:image not accessible",
      "description": "OG image returned HTTP 403",
      "recommendation": "Ensure og:image URL is publicly accessible"
    },
    {
      "module": "uptime-checker",
      "severity": "medium",
      "title": "Soft 404 detected",
      "description": "Non-existent URLs return HTTP 200 instead of 404",
      "recommendation": "Return proper 404 status codes for non-existent pages to avoid indexing junk URLs"
    },
    {
      "module": "brand-checker",
      "severity": "medium",
      "title": "No Organization schema",
      "description": "No Organization JSON-LD found",
      "recommendation": "Add Organization structured data with name, logo, and contact information"
    },
    {
      "module": "page-experience",
      "severity": "high",
      "title": "Intrusive interstitials detected",
      "description": "Found 6 potential popup/overlay elements",
      "recommendation": "Reduce intrusive interstitials — they hurt mobile experience and can trigger Google penalties"
    },
    {
      "module": "indexing-checker",
      "severity": "high",
      "title": "Canonical points to different domain",
      "description": "Canonical: https://www.ri.se/sv points to ri.se",
      "recommendation": "Ensure the canonical URL points to the same domain unless cross-domain canonicalization is intended"
    }
  ]
}
```

Recommendations for your industry

  • 1Ensure WCAG 2.1 AA compliance
  • 2Implement all recommended security headers
  • 3Ensure sitemap covers all important pages
  • 4Optimize page load time to under 2 seconds
  • 5Ensure responsive design on all pages

SEO Checklist for General

Tips for Mixed websites

  • →Define clear landing pages for each segment
  • →Use different meta strategies per page group
  • →Segment sitemap by content type

Local SEO Context

Sweden has high internet penetration and favors Swedish domains in local searches.

Start your free trial

Use Ctrl+P / Cmd+P to save as PDF