Finding Summary
21 Issues Identified
Across 9 audit categories covering privacy compliance, security headers, SEO, performance, accessibility, and code quality.
Analytics Fire Before Consent — GDPR Risk
Google Tag Manager, GA4, and LinkedIn Insight Tag all load on every page visit without waiting for cookie consent. The cookie banner is cosmetic only — it does not prevent tracking. This is a direct GDPR violation requiring immediate remediation.
No CDN — All Traffic Hits Single Heroku Server
There is no content delivery network in front of the Heroku origin. UAE and GCC visitors experience higher latency, and there is no DDoS mitigation. Adding Cloudflare (free tier) resolves this immediately.
Area Scores
Performance by Category
Baseline indicators from automated HTTP checks and HTML source inspection only.
Business & Content
68
Strong listing platform; analytics meta bug
UI / UX
62
Clean design; cookie consent present
Accessibility
45
Partial ARIA; full audit needed
Performance
35
No CDN; no cache headers
SEO
58
Good schema; 302 redirect; entity bug
Security
45
X-Frame-Options present; missing HSTS, CSP
Privacy / Legal
30
Banner present but tracking fires before consent
Code Quality
50
Clean custom app; HTML entity encoding bug
CI / CD / Deployment
30
Heroku only; no CDN; no caching strategy
Priority 0
Critical Issues — Fix This Week
PRIV-001
GTM, GA4 and LinkedIn Insight fire before cookie consent
All three tracking scripts load unconditionally in <head> on every page visit. No Google Consent Mode v2 configuration detected. The cookie consent banner is cosmetic — it does not block any tracking.
→ Implement Google Consent Mode v2 with all categories denied by default. Gate LinkedIn Insight Tag inside a consent callback. Test: zero network requests to GA/GTM before user accepts.
PERF-001
No CDN — all traffic hits single Heroku origin dyno
`server: Heroku` header present; no Cloudflare, CloudFront, or edge cache headers. `cache-control: no-cache, private` on all responses — every request hits origin.
→ Add Cloudflare in front of Heroku origin (free tier sufficient). Configure cache rules: HTML 5 min, static assets 30 days. Reduces latency and adds DDoS protection.
Priority 1
High Priority Issues
SEO-001
Root redirect is 302 (temporary) not 301 (permanent)
https://www.cushwake.ae/ returns 302 to /en. Google does not pass link equity through 302 redirects — domain authority is not being accumulated correctly.
→ Change to 301 in the application router. One-line fix.
SEO-002
HTML entity double-encoding in social meta tags
og:title, meta:title and twitter:title contain `&amp;` instead of `&`. LinkedIn, X and WhatsApp previews display "Cushman & Wakefield" as raw text.
→ Fix template escaping in the view file — output the `&` character once, not double-encoded.
SEC-001
No HSTS header (Strict-Transport-Security)
Header absent from all responses — browsers cannot enforce HTTPS on repeat visits, leaving a protocol downgrade window.
→ Add `Strict-Transport-Security: max-age=31536000; includeSubDomains` via server config or Cloudflare.
SEC-002 / SEC-003
No Content-Security-Policy · No Permissions-Policy
Both headers absent. No XSS header-level mitigation; browser APIs (camera, mic, geolocation) unrestricted for scripts.
→ Deploy CSP in report-only mode first via Cloudflare. Add Permissions-Policy: camera=(), microphone=(), geolocation=()
SEC-004
Referrer-Policy too permissive
`no-referrer-when-downgrade` sends full page URLs including property search query strings to third parties on cross-origin navigation.
→ Change to `strict-origin-when-cross-origin`
PERF-002
No Cache-Control on any page response
`cache-control: no-cache, private` on all HTML responses. Every visit hits the origin — no browser or CDN caching benefits.
→ Configure cache headers: HTML pages 1–5 min, CSS/JS/images 30+ days. Addressed when Cloudflare is added.
ACC-001
Accessibility not fully verified — WCAG compliance unknown
Only partial ARIA navigation controls confirmed externally. Skip navigation, contrast ratios, keyboard flow, and form labels not verifiable without a full browser audit.
→ Commission WCAG 2.2 AA audit; remediate findings before next major release.
What's Working
Existing Strengths
HTTPS enforced
HTTP 301 redirect to HTTPS — all users reach a secure connection
X-Frame-Options: SAMEORIGIN
Clickjacking protection header present
X-Content-Type-Options: nosniff
MIME sniffing protection header present
Cookie consent banner
Custom banner with Essential, Non-Essential, and Marketing categories
Privacy Policy + Cookie Policy
Both pages exist and are linked from footer
hreflang (en-ae, ar-ae, x-default)
All three alternate language tags correctly configured
Organization + RealEstateAgent schema
Two structured data types deployed — eligible for rich results
Rich sitemap structure
25 child sitemaps covering all property types, cities, areas, and towers
Bilingual EN / AR
Full Arabic (/ar) and English (/en) versions with RTL support
lazysizes.js lazy loading
Lazy loading implemented for images — good performance practice
Alpine.js lightweight framework
Minimal JS footprint vs React/Vue for property filtering and UI
5 active social channels
LinkedIn, Facebook, Twitter, Instagram, YouTube all linked and active