EngineeringScoreA real example report
This is an actual EngineeringScore report from a real scan, with the same categories, findings, and roadmap format you'll get for your own site.
Example report: a snapshot from a real scan, shown for illustration.
Summary
Set up a staging environment first because its absence is the largest listed score deduction (-10) and changes currently lack a pre-production verification environment. The engineering health score is 61, calculated from a base of 100 with deductions for staging (-10), security (-9), monitoring (-6), accessibility (-5), runtime errors (-5), performance (-2), and SEO (-2). The most consequential findings are no staging environment, three cookies missing Secure, no monitoring, six console errors, and one serious accessibility issue involving a <blink> element.
Security
-9 pts
Security
-9 ptsSecurity has issues and contributes -9 to the score. Three cookies (_ga_9Y966W6Q7W, _ga, and _ga_MQ7767QQQW) lack Secure, and the top fix is to mark them Secure so they are sent only over HTTPS; the same cookies also lack HttpOnly, and Permissions-Policy is missing.
What we verified (8)
HTTPS
Served over HTTPS
HSTS
HSTS enabled
Content-Security-Policy
CSP present
X-Content-Type-Options
X-Content-Type-Options present
Clickjacking protection
X-Frame-Options or frame-ancestors set
Referrer-Policy
Referrer-Policy present
Server version exposure
No server version exposed
Mixed content
No mixed content
Performance
-2 pts
Performance
-2 ptsPerformance has issues and contributes -2 to the score, with a reported navigation time of 2.6s. Investigate server response, render-blocking resources, and large assets to reduce load time.
What we verified (6)
Page weight
0.7 MB
Request count
36 requests
Image sizes
0 images over 300KB
Text compression
Text assets compressed
Static caching
Static assets carry cache-control
Render-blocking resources
4 render-blocking resources
SEO
-2 pts
SEO
-2 ptsSEO has issues and contributes -2 to the score because a canonical link is missing. Add a canonical link pointing to the preferred URL to reduce duplicate-content ambiguity.
What we verified (10)
Page title
Present: "Internet for people, not profit — Mozilla Global" (48 chars)
Title length
Title is 48 chars (ideal 10–65)
Meta description
Present (134 chars)
Description length
Description is 134 chars (ideal 50–160)
Single H1
Exactly one H1
Viewport
Viewport meta present
Indexable
Indexable
Lang attribute
Present (en)
Open Graph tags
Open Graph tags present
Favicon
Favicon present
Accessibility
-5 pts
Accessibility
-5 ptsAccessibility has issues and contributes -5 to the score because one <blink> element was detected with serious impact. Remove or replace the <blink> element with an accessible alternative.
What we verified (2)
Document language
Present (en)
Image alt text
All 12 images have alt text
Runtime Errors
-5 pts
Runtime Errors
-5 ptsRuntime Errors has issues and contributes -5 to the score, with 6 console errors. Resolve the CSP configuration warnings and the blocked connection to stats.g.doubleclick.net so browser behavior is clean and observable.
What we verified (2)
Uncaught JS errors
No uncaught errors
Failed requests
No failed requests
Best Practices
Partly checked
Best Practices
Partly checkedBest Practices has no failed checks, but the HTTP→HTTPS redirect could not be verified for this scan. Nothing here counts against the score, but that one check is unresolved rather than confirmed.
Couldn't be checked (1)
HTTP→HTTPS redirect
Could not determine whether HTTP requests redirect to HTTPS.
What we verified (3)
Doctype
Doctype present
Charset declaration
Charset present
Responsive viewport
Viewport present
Detected technologies
Analytics
Tag Manager
CDN & Hosting
Your improvement roadmap
A prioritized plan for where to focus next.
Do next 4
Mark cookies as Secure
Add the Secure attribute to all cookies so they are only ever sent over HTTPS.
Show details Hide details
Add the Secure attribute to the three identified cookies so they are sent only over HTTPS, addressing the security finding with a -9 deduction.
Why it matters
Cookies without the Secure attribute can be sent over an unencrypted connection, letting anyone on the same network intercept session tokens and impersonate the user.
How to fix
- 1. Add the Secure attribute to every cookie the app sets.
- 2. Confirm the site is fully served over HTTPS first.
Add uptime monitoring & alerting
Set up monitoring that alerts you when the site is down or erroring.
Show details Hide details
Implement uptime and error monitoring with alerting so the team can detect site downtime or errors, addressing the -6 monitoring deduction.
Why it matters
Without uptime monitoring, outages and errors are usually discovered by customers complaining rather than by the team, which extends downtime and erodes trust.
How to fix
- 1. Set up an uptime/monitoring service (e.g. UptimeRobot, Pingdom, Better Uptime) against key URLs.
- 2. Configure alerts (email/SMS/Slack) for downtime and error spikes.
Fix console errors
Investigate and resolve the JavaScript errors logged to the browser console.
Show details Hide details
Why it matters
Console errors often signal broken functionality (failed API calls, broken integrations) that users experience as things silently not working, even if the page still loads.
How to fix
- 1. Open devtools and reproduce the errors.
- 2. Trace each one to its source and fix the underlying bug or missing dependency.
- 3. Re-test after the fix to confirm the console is clean.
Set up a staging environment
Add a staging/test environment so changes can be verified before they reach production.
Show details Hide details
Set up a staging environment so changes can be validated before production, addressing the largest listed deduction (-10).
Why it matters
Without a staging environment, every change is tested for the first time in production, turning routine deploys into high-risk events that can take the live site down.
How to fix
- 1. Stand up a staging environment that mirrors production configuration.
- 2. Route all deploys through staging before promoting to production.
- 3. Add a lightweight checklist or smoke test to run on staging.
Later 4
Add a Permissions-Policy header
Set a Permissions-Policy header to restrict access to sensitive browser features (camera, mic, geolocation).
Show details Hide details
Why it matters
Without a Permissions-Policy, any script running on the page, including third-party scripts and ads, can request access to the camera, microphone, or location, widening the damage a compromised script can do.
How to fix
- 1. Decide which browser features the site actually needs.
- 2. Add a Permissions-Policy header disabling the rest (camera=(), microphone=(), geolocation=(), etc.).
- 3. Re-test any embedded widgets that rely on these features.
Mark cookies as HttpOnly
Add the HttpOnly attribute to cookies that do not need JavaScript access, reducing XSS exposure.
Show details Hide details
Why it matters
Cookies without HttpOnly are readable by any JavaScript on the page, so a single XSS bug is enough for an attacker to steal session cookies and take over accounts.
How to fix
- 1. Add the HttpOnly attribute to session and authentication cookies.
- 2. Only omit it for cookies a legitimate client-side script genuinely needs to read.
Add a canonical link
Add a <link rel="canonical"> tag pointing at the preferred URL to avoid duplicate-content issues.
Show details Hide details
Why it matters
Without a canonical tag, search engines can split ranking signals across near-duplicate URLs (with tracking params, trailing slashes, etc.), diluting the page's authority.
How to fix
- 1. Add <link rel="canonical" href="..."> pointing to the preferred URL.
- 2. Make sure the canonical URL matches the one you actually want indexed.
Speed up page load time
Investigate slow server response, render-blocking resources, and large assets to bring navigation time down.
Show details Hide details
Why it matters
Slow page loads are one of the strongest predictors of visitors leaving before the page even finishes loading, directly costing traffic and conversions.
How to fix
- 1. Profile server response time (TTFB) and fix slow backend queries or endpoints.
- 2. Eliminate render-blocking CSS/JS in the critical rendering path.
- 3. Reduce and defer large assets that delay the largest contentful paint.
Ready to see where you stand?
Scan your site and get your Engineering Score with a prioritized roadmap in under a minute, no signup required.