tcpcustomoutdoor.com — Website Report

Add a Content-Security-Policy header to prevent XSS and injection attacks.

# Nginx:
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';" always;

# Apache (.htaccess):
Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';"

# Next.js (next.config.js headers):
{ key: 'Content-Security-Policy', value: "default-src 'self'; script-src 'self' 'unsafe-inline'" }

6 scripts without async or defer attributes. These block page rendering. Add defer or async to non-critical scripts.

Set X-Content-Type-Options: nosniff to prevent MIME-type sniffing.

# Nginx:
add_header X-Content-Type-Options "nosniff" always;

# Next.js (next.config.js headers):
{ key: 'X-Content-Type-Options', value: 'nosniff' }

Set X-Frame-Options to prevent clickjacking attacks.

# Nginx:
add_header X-Frame-Options "SAMEORIGIN" always;

# Next.js (next.config.js headers):
{ key: 'X-Frame-Options', value: 'SAMEORIGIN' }

Add a Referrer-Policy header to control information leakage.

# Nginx:
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

# Next.js (next.config.js headers):
{ key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' }

Add a Permissions-Policy header to control browser feature access.

# Nginx:
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

# Next.js (next.config.js headers):
{ key: 'Permissions-Policy', value: 'camera=(), microphone=(), geolocation=()' }

Found 2 H1 headings. Best practice is to have exactly one H1 per page for clear content hierarchy.

Heading hierarchy jumps from H2 to H4. Don't skip heading levels — this confuses screen readers and assistive technology.

Links with text like "click here" or "read more" don't make sense out of context. Use descriptive link text that explains the destination.

Some text appears to use light colors that may not have sufficient contrast against the background. WCAG requires a minimum 4.5:1 contrast ratio.

Server responded in 1.9s. Aim for under 200ms TTFB. Consider caching, CDN, or server-side optimizations.

Your HTML is 776KB. Large HTML documents take longer to parse. Consider lazy loading content or splitting into multiple pages.

13 images don't use loading="lazy". Add lazy loading to below-the-fold images to improve initial page load.

ChatGPT cannot crawl your site — you won't appear in their AI answers.

Claude cannot crawl your site — you won't appear in their AI answers.

Claude cannot crawl your site — you won't appear in their AI answers.

Gemini/AI Overview cannot crawl your site — you won't appear in their AI answers.

Alexa AI cannot crawl your site — you won't appear in their AI answers.

Add a <main> element to identify the primary content area. Screen reader users use this to skip navigation.

<!-- Wrap your primary content in a <main> element -->
<main id="main-content">
  <h1>Page Title</h1>
  <p>Your primary content here...</p>
</main>

Add a 'Skip to main content' link at the top of the page so keyboard users can bypass repetitive navigation.

<!-- Add as the first element inside <body> -->
<a href="#main-content" class="sr-only focus:not-sr-only focus:absolute focus:top-2 focus:left-2 focus:z-50 focus:px-4 focus:py-2 focus:bg-blue-600 focus:text-white focus:rounded">
  Skip to main content
</a>

<!-- Add id to your main content area -->
<main id="main-content">
  ...
</main>

Found 18 elements with large inline styles. Move these to external CSS for better caching and maintainability.