www.cushwake.ae · 28 August 2026 · vl-web-audit v2.1 · 36 checks across 6 categories
| # | Category | Check Item | Status | Finding / Evidence | Screenshot | Recommendation | Owner | Priority | Effort |
|---|---|---|---|---|---|---|---|---|---|
| A — SEO / On-Page | |||||||||
| 1 | SEO | Meta description Present and descriptive | OK | "Discover commercial real estate in UAE…" — 93 chars via Yoast | 📷Add Screenshot | No action needed | — | — | — |
| 2 | SEO | Root redirect type Must be 301 not 302 | Fail | https://www.cushwake.ae/ → /en returns 302 (temporary) — link equity not passed | 📷Add Screenshot | Change to 301 in application router | Developer | P1 | Quick Win |
| 3 | SEO | OG title entity encoding No double-encoded entities | Fail | og:title contains "&" — renders as raw text "&" on social platforms | 📷Add Screenshot | Fix template escaping in view file | Developer | P1 | Quick Win |
| 4 | SEO | Twitter card title encoding No double-encoded entities | Fail | twitter:title same double-encoding bug as OG title | 📷Add Screenshot | Fix with OG title template — same root cause | Developer | P1 | Quick Win |
| 5 | SEO | hreflang tags en-ae, ar-ae, x-default | OK | All three hreflang tags present and correctly configured | 📷Add Screenshot | No action needed | — | — | — |
| 6 | SEO | robots.txt Present, sitemap referenced | OK | Present; allows all; references sitemap.xml | 📷Add Screenshot | Add Disallow for /admin/ and /api/ | DevOps | P3 | Quick Win |
| 7 | SEO | Sitemap structure Index with child sitemaps | OK | 25 child sitemaps covering all property types, cities, areas, towers | 📷Add Screenshot | Monitor coverage in GSC; consolidate if crawl budget limited | SEO | P3 | — |
| 8 | SEO | Structured data Organization + RealEstateAgent | OK | Both schemas deployed with address, contact, sameAs social links | 📷Add Screenshot | Add RealEstateListing schema to property detail pages | Developer/SEO | P2 | Medium |
| 9 | SEO | Keywords meta tag Low SEO value | Warning | Present: "Commercial Real Estate UAE, Commercial Property UAE" — minimal value | 📷Add Screenshot | Remove — focus on content quality | SEO | P2 | Quick Win |
| 10 | SEO | Canonical tag Points to /en | OK | Canonical: https://www.cushwake.ae/en — correct for English page | 📷Add Screenshot | No action needed | — | — | — |
| B — Security | |||||||||
| 11 | Security | HTTPS enforced HTTP 301 to HTTPS | OK | HTTP returns 301 to HTTPS — enforced | 📷Add Screenshot | No action needed | — | — | — |
| 12 | Security | X-Frame-Options SAMEORIGIN present | OK | x-frame-options: SAMEORIGIN — clickjacking protection active | 📷Add Screenshot | No action needed | — | — | — |
| 13 | Security | X-Content-Type-Options nosniff present | OK | x-content-type-options: nosniff — MIME sniffing blocked | 📷Add Screenshot | No action needed | — | — | — |
| 14 | Security | HSTS header Strict-Transport-Security | Fail | Header absent — browsers cannot enforce HTTPS on repeat visits | 📷Add Screenshot | Add Strict-Transport-Security: max-age=31536000; includeSubDomains | DevOps | P1 | Quick Win |
| 15 | Security | Content-Security-Policy CSP header present | Fail | No CSP header — XSS injection not mitigated at header level | 📷Add Screenshot | Deploy in report-only mode first; progressively enforce | DevOps | P1 | Small |
| 16 | Security | Permissions-Policy Restricts browser APIs | Fail | Header absent — camera, mic, geolocation unrestricted | 📷Add Screenshot | Permissions-Policy: camera=(), microphone=(), geolocation=() | DevOps | P1 | Quick Win |
| 17 | Security | Referrer-Policy strict-origin-when-cross-origin | Warning | no-referrer-when-downgrade — full URLs with query strings sent to third parties | 📷Add Screenshot | Change to strict-origin-when-cross-origin | DevOps | P1 | Quick Win |
| 18 | Security | Server header Platform not disclosed | Warning | server: Heroku — hosting platform disclosed | 📷Add Screenshot | Suppress via Cloudflare Transform Rule | DevOps | P2 | Quick Win |
| 19 | Security | robots.txt admin paths /admin, /api blocked | Fail | No Disallow rules for sensitive paths | 📷Add Screenshot | Add Disallow: /admin/ and /api/ to robots.txt | DevOps | P3 | Quick Win |
| C — Privacy / Legal | |||||||||
| 20 | Privacy | Analytics pre-consent firing GTM, GA4, LinkedIn gated | Fail | GTM-PFM7JDRD, G-Z69JWE7CRD, LinkedIn 8880001 all load in <head> unconditionally — GDPR violation | 📷Add Screenshot | Implement Google Consent Mode v2; gate all tracking behind consent | Developer | P0 | Medium |
| 21 | Privacy | Cookie consent banner Three categories, controls | OK | Custom banner with Essential, Non-Essential, Marketing + Accept All/Reject All/Save | 📷Add Screenshot | Make it functional — connect to tracking gates (PRIV-001) | — | — | — |
| 22 | Privacy | Privacy Policy page Exists and footer-linked | OK | Linked in footer navigation | 📷Add Screenshot | No action needed | — | — | — |
| 23 | Privacy | Cookie Policy page Exists and footer-linked | OK | Linked in footer navigation | 📷Add Screenshot | No action needed | — | — | — |
| 24 | Privacy | Google Consent Mode v2 Configured with EU defaults | Fail | Not implemented — no consent mode dataLayer configuration found in page source | 📷Add Screenshot | Implement with all categories denied by default for EU regions | Developer | P0 | Medium |
| D — Accessibility | |||||||||
| 25 | Access. | HTML lang attribute Correct language declared | OK | lang="en" on English root; /ar path uses lang="ar" dir="rtl" | 📷Add Screenshot | No action needed | — | — | — |
| 26 | Access. | Skip navigation link WCAG 2.1 SC 2.4.1 Level A | Warning | Referenced in content but not visually confirmed — requires browser audit | 📷Add Screenshot | Verify skip link exists and is first focusable element | Developer | P1 | Small |
| 27 | Access. | ARIA landmarks main, nav, header, footer | Warning | Partial ARIA controls referenced (Open/Close Navigation) — full landmark audit needed | 📷Add Screenshot | Run axe or WAVE to verify landmark coverage | Developer | P1 | Small |
| 28 | Access. | Full WCAG 2.2 AA audit Colour contrast, keyboard, SR | Missing | No external audit performed — compliance status unknown for colour contrast, keyboard nav, screen readers | 📷Add Screenshot | Commission full WCAG 2.2 AA audit with specialist tooling | Developer/Designer | P1 | Medium |
| E — Performance | |||||||||
| 29 | Perf. | CDN deployed Edge caching active | Fail | server: Heroku — no CDN; all requests hit origin dyno; high GCC latency | 📷Add Screenshot | Add Cloudflare free tier as reverse proxy in front of Heroku | DevOps | P0 | Medium |
| 30 | Perf. | Cache-Control headers Appropriate max-age set | Fail | cache-control: no-cache, private on all responses — zero caching | 📷Add Screenshot | Configure Cloudflare cache rules: HTML 5 min, assets 30 days | DevOps | P1 | Small |
| 31 | Perf. | Image lazy loading lazysizes.js implemented | OK | lazysizes.min.js loaded async — lazy loading active | 📷Add Screenshot | Add SRI hash to script tag | Developer | P3 | Quick Win |
| 32 | Perf. | Alpine.js CDN dependency Self-hosted preferred | Warning | cdn.jsdelivr.net/npm/alpinejs@3.12.0 — external DNS; no SRI hash | 📷Add Screenshot | Self-host Alpine.js and Intersect plugin; add integrity attribute | Developer | P2 | Small |
| F — Technology / CI/CD | |||||||||
| 33 | Tech | Platform Custom app, not WordPress | OK | Laravel-pattern custom application — clean architecture; no WP plugin bloat | 📷Add Screenshot | No action needed | — | — | — |
| 34 | Tech | HTML entity encoding No double-encoded entities | Fail | &amp; double-encoded in og:title, meta:title, twitter:title view templates | 📷Add Screenshot | Fix template escaping — output raw & character once | Developer | P1 | Quick Win |
| 35 | Tech | Source code version control Git repository found | Missing | No public repository found — version control status unknown | 📷Add Screenshot | Confirm private Git repo exists; ensure deployment workflow is documented | DevOps | P2 | Small |
| 36 | Tech | Staging environment Separate from production | Missing | No staging environment identified externally | 📷Add Screenshot | Confirm staging Heroku dyno exists for pre-production testing | DevOps | P2 | Small |