What a report actually looks like

What to fix first

These three numbers count problems found anywhere in this report. The band above counts something else: how many of a fixed list of checks ran, and how many of those came back clean. One check that came back not clean can raise more than one problem here, and several sections below sit outside that fixed list entirely, so the two totals are not meant to match.

• 6 critical
• 6 flagged
• 16 issues

1. Critical:button-nameThis is a failure reported by axe, an automated accessibility checker that tests the rendered page against the WCAG guidelines. Each one means some people using the page with a screen reader, a keyboard alone, or low vision hit a specific obstacle here, and the impact word is axe's own grading: critical usually means someone cannot complete the task at all, minor means friction. Automated checks catch only part of what is actually wrong with a page for real users, so treat these as the floor rather than the ceiling. They are worth fixing first because the exact failing elements are listed, which makes most of them a targeted edit rather than a redesign.
2. Critical:labelThis is a failure reported by axe, an automated accessibility checker that tests the rendered page against the WCAG guidelines. Each one means some people using the page with a screen reader, a keyboard alone, or low vision hit a specific obstacle here, and the impact word is axe's own grading: critical usually means someone cannot complete the task at all, minor means friction. Automated checks catch only part of what is actually wrong with a page for real users, so treat these as the floor rather than the ceiling. They are worth fixing first because the exact failing elements are listed, which makes most of them a targeted edit rather than a redesign.
3. Critical:Content-Security-PolicyA Content Security Policy is a short instruction your server attaches to the page, listing which places the browser may load scripts, styles and embedded frames from. Without it, if anything ever injects a script into your page (through a comment field, a URL parameter, or a third-party widget whose vendor gets compromised), the browser runs it without question. A policy is the difference between one such mistake being contained and it being able to read everything on the page. You can deploy it in report-only mode first, so there is no risk of breaking the site while you learn what it needs.
4. Critical:Strict-Transport-SecurityStrict-Transport-Security is a one-line instruction telling browsers to only ever reach this site over an encrypted connection, and to remember that for a set period. Without it, the very first request a visitor makes, typing your domain or following an old http link, goes out unencrypted before your redirect can take effect, and that first request is exactly the one someone on the same network can intercept. Redirects alone cannot close that gap, and this header can.
5. Critical:Stripe publishable keyA string shaped like a credential, an API key, an access token or a password, was found inside a JavaScript file this page serves. Every visitor downloads that file, so if it really is a live key then it is not secret from anyone who opens developer tools, whatever else is guarding it. Some matches are false alarms (publishable keys, test fixtures, values that are meant to be visible), which is why the redacted excerpt stays inside this report and is never copied out to any other tool. Check whether this one is live, because if it is, the only fix that holds is replacing the key rather than deleting the line.
6. Critical:Analytics write keyA string shaped like a credential, an API key, an access token or a password, was found inside a JavaScript file this page serves. Every visitor downloads that file, so if it really is a live key then it is not secret from anyone who opens developer tools, whatever else is guarding it. Some matches are false alarms (publishable keys, test fixtures, values that are meant to be visible), which is why the redacted excerpt stays inside this report and is never copied out to any other tool. Check whether this one is live, because if it is, the only fix that holds is replacing the key rather than deleting the line.
7. Flag:color-contrastThis is a failure reported by axe, an automated accessibility checker that tests the rendered page against the WCAG guidelines. Each one means some people using the page with a screen reader, a keyboard alone, or low vision hit a specific obstacle here, and the impact word is axe's own grading: critical usually means someone cannot complete the task at all, minor means friction. Automated checks catch only part of what is actually wrong with a page for real users, so treat these as the floor rather than the ceiling. They are worth fixing first because the exact failing elements are listed, which makes most of them a targeted edit rather than a redesign.
8. Flag:Privacy policy linkThe scan read every link on this page looking for one that leads to a privacy policy, the document telling visitors what you collect about them and what you do with it, and found none. Visitors who want to check have no way to, and app stores, ad platforms and payment providers routinely refuse or suspend accounts whose site cannot show one. This check saw only the page it was given, so if the policy already exists elsewhere, the fix is likely one footer link.
9. Flag:Clickjacking protection (X-Frame-Options or frame-ancestors)Nothing here tells browsers whether other websites are allowed to load your page inside a frame, which is a window embedded in their page. That permits clickjacking, where someone lays your real page invisibly over their own buttons so a visitor believes they are clicking one thing and actually clicks yours. It matters most where there is a logged-in action worth hijacking and much less on a static brochure page, but the fix is a single header either way, so there is little reason to leave it open.
10. Flag:X-Content-Type-Options: nosniffThis is a one-line instruction telling the browser to trust the file type your server declares rather than guessing from the contents. Without it, a browser can decide that something you serve as plain text or as a user upload is really JavaScript or HTML and run it, which is how a harmless-looking upload becomes executable code. The value is fixed, there is nothing site-specific to decide, and it has essentially no chance of breaking anything, which makes it one of the cheapest items in this whole report.
11. Flag:Referrer-Policy sends the full URL to every origin (unsafe-url)Referrer-Policy controls how much of your page's address the browser reveals to other sites, and yours is set to a value that hands over the whole thing, path and query string included, to every destination. If any of your URLs carry a password reset token, a search term, a customer id or an order reference, that value is being passed to third parties, including every analytics and advertising script on the page. This is graded above a merely missing policy because the header is present and actively choosing the leaky behaviour, and changing one word fixes it.
12. Flag:Cookie Secure attributeA cookie is a small piece of data your site asks the browser to keep and send back on each visit, often the token that keeps someone signed in. At least one of yours is set without the Secure attribute, which means the browser is willing to transmit it over an unencrypted connection, where anyone on the same network path can read it. The affected cookie names are listed in the evidence, and this is a single option added wherever each one is set.

16 further finding(s), in the sections below