V3 Spreadsheet Checklist · Internal Use

Cushman & Wakefield Core — Audit Checklist V3

www.cushwake.ae · 28 August 2026 · vl-web-audit v2.1 · 36 checks across 6 categories

Fail
Warning
OK
Missing
#CategoryCheck ItemStatusFinding / EvidenceScreenshotRecommendationOwnerPriorityEffort
A — SEO / On-Page
1SEOMeta description
Present and descriptive
OK"Discover commercial real estate in UAE…" — 93 chars via Yoast
📷Add Screenshot
No action needed
2SEORoot redirect type
Must be 301 not 302
Failhttps://www.cushwake.ae/ → /en returns 302 (temporary) — link equity not passed
📷Add Screenshot
Change to 301 in application routerDeveloperP1Quick Win
3SEOOG title entity encoding
No double-encoded entities
Failog:title contains "&" — renders as raw text "&" on social platforms
📷Add Screenshot
Fix template escaping in view fileDeveloperP1Quick Win
4SEOTwitter card title encoding
No double-encoded entities
Failtwitter:title same double-encoding bug as OG title
📷Add Screenshot
Fix with OG title template — same root causeDeveloperP1Quick Win
5SEOhreflang tags
en-ae, ar-ae, x-default
OKAll three hreflang tags present and correctly configured
📷Add Screenshot
No action needed
6SEOrobots.txt
Present, sitemap referenced
OKPresent; allows all; references sitemap.xml
📷Add Screenshot
Add Disallow for /admin/ and /api/DevOpsP3Quick Win
7SEOSitemap structure
Index with child sitemaps
OK25 child sitemaps covering all property types, cities, areas, towers
📷Add Screenshot
Monitor coverage in GSC; consolidate if crawl budget limitedSEOP3
8SEOStructured data
Organization + RealEstateAgent
OKBoth schemas deployed with address, contact, sameAs social links
📷Add Screenshot
Add RealEstateListing schema to property detail pagesDeveloper/SEOP2Medium
9SEOKeywords meta tag
Low SEO value
WarningPresent: "Commercial Real Estate UAE, Commercial Property UAE" — minimal value
📷Add Screenshot
Remove — focus on content qualitySEOP2Quick Win
10SEOCanonical tag
Points to /en
OKCanonical: https://www.cushwake.ae/en — correct for English page
📷Add Screenshot
No action needed
B — Security
11SecurityHTTPS enforced
HTTP 301 to HTTPS
OKHTTP returns 301 to HTTPS — enforced
📷Add Screenshot
No action needed
12SecurityX-Frame-Options
SAMEORIGIN present
OKx-frame-options: SAMEORIGIN — clickjacking protection active
📷Add Screenshot
No action needed
13SecurityX-Content-Type-Options
nosniff present
OKx-content-type-options: nosniff — MIME sniffing blocked
📷Add Screenshot
No action needed
14SecurityHSTS header
Strict-Transport-Security
FailHeader absent — browsers cannot enforce HTTPS on repeat visits
📷Add Screenshot
Add Strict-Transport-Security: max-age=31536000; includeSubDomainsDevOpsP1Quick Win
15SecurityContent-Security-Policy
CSP header present
FailNo CSP header — XSS injection not mitigated at header level
📷Add Screenshot
Deploy in report-only mode first; progressively enforceDevOpsP1Small
16SecurityPermissions-Policy
Restricts browser APIs
FailHeader absent — camera, mic, geolocation unrestricted
📷Add Screenshot
Permissions-Policy: camera=(), microphone=(), geolocation=()DevOpsP1Quick Win
17SecurityReferrer-Policy
strict-origin-when-cross-origin
Warningno-referrer-when-downgrade — full URLs with query strings sent to third parties
📷Add Screenshot
Change to strict-origin-when-cross-originDevOpsP1Quick Win
18SecurityServer header
Platform not disclosed
Warningserver: Heroku — hosting platform disclosed
📷Add Screenshot
Suppress via Cloudflare Transform RuleDevOpsP2Quick Win
19Securityrobots.txt admin paths
/admin, /api blocked
FailNo Disallow rules for sensitive paths
📷Add Screenshot
Add Disallow: /admin/ and /api/ to robots.txtDevOpsP3Quick Win
C — Privacy / Legal
20PrivacyAnalytics pre-consent firing
GTM, GA4, LinkedIn gated
FailGTM-PFM7JDRD, G-Z69JWE7CRD, LinkedIn 8880001 all load in <head> unconditionally — GDPR violation
📷Add Screenshot
Implement Google Consent Mode v2; gate all tracking behind consentDeveloperP0Medium
21PrivacyCookie consent banner
Three categories, controls
OKCustom banner with Essential, Non-Essential, Marketing + Accept All/Reject All/Save
📷Add Screenshot
Make it functional — connect to tracking gates (PRIV-001)
22PrivacyPrivacy Policy page
Exists and footer-linked
OKLinked in footer navigation
📷Add Screenshot
No action needed
23PrivacyCookie Policy page
Exists and footer-linked
OKLinked in footer navigation
📷Add Screenshot
No action needed
24PrivacyGoogle Consent Mode v2
Configured with EU defaults
FailNot implemented — no consent mode dataLayer configuration found in page source
📷Add Screenshot
Implement with all categories denied by default for EU regionsDeveloperP0Medium
D — Accessibility
25Access.HTML lang attribute
Correct language declared
OKlang="en" on English root; /ar path uses lang="ar" dir="rtl"
📷Add Screenshot
No action needed
26Access.Skip navigation link
WCAG 2.1 SC 2.4.1 Level A
WarningReferenced in content but not visually confirmed — requires browser audit
📷Add Screenshot
Verify skip link exists and is first focusable elementDeveloperP1Small
27Access.ARIA landmarks
main, nav, header, footer
WarningPartial ARIA controls referenced (Open/Close Navigation) — full landmark audit needed
📷Add Screenshot
Run axe or WAVE to verify landmark coverageDeveloperP1Small
28Access.Full WCAG 2.2 AA audit
Colour contrast, keyboard, SR
MissingNo external audit performed — compliance status unknown for colour contrast, keyboard nav, screen readers
📷Add Screenshot
Commission full WCAG 2.2 AA audit with specialist toolingDeveloper/DesignerP1Medium
E — Performance
29Perf.CDN deployed
Edge caching active
Failserver: Heroku — no CDN; all requests hit origin dyno; high GCC latency
📷Add Screenshot
Add Cloudflare free tier as reverse proxy in front of HerokuDevOpsP0Medium
30Perf.Cache-Control headers
Appropriate max-age set
Failcache-control: no-cache, private on all responses — zero caching
📷Add Screenshot
Configure Cloudflare cache rules: HTML 5 min, assets 30 daysDevOpsP1Small
31Perf.Image lazy loading
lazysizes.js implemented
OKlazysizes.min.js loaded async — lazy loading active
📷Add Screenshot
Add SRI hash to script tagDeveloperP3Quick Win
32Perf.Alpine.js CDN dependency
Self-hosted preferred
Warningcdn.jsdelivr.net/npm/alpinejs@3.12.0 — external DNS; no SRI hash
📷Add Screenshot
Self-host Alpine.js and Intersect plugin; add integrity attributeDeveloperP2Small
F — Technology / CI/CD
33TechPlatform
Custom app, not WordPress
OKLaravel-pattern custom application — clean architecture; no WP plugin bloat
📷Add Screenshot
No action needed
34TechHTML entity encoding
No double-encoded entities
Fail&amp;amp; double-encoded in og:title, meta:title, twitter:title view templates
📷Add Screenshot
Fix template escaping — output raw & character onceDeveloperP1Quick Win
35TechSource code version control
Git repository found
MissingNo public repository found — version control status unknown
📷Add Screenshot
Confirm private Git repo exists; ensure deployment workflow is documentedDevOpsP2Small
36TechStaging environment
Separate from production
MissingNo staging environment identified externally
📷Add Screenshot
Confirm staging Heroku dyno exists for pre-production testingDevOpsP2Small