A real example report
This is an actual EngineeringScore report from a real scan, with the same categories, findings, and roadmap format you'll get for your own site.
Example report: a snapshot from a real scan, shown for illustration. Which pages each finding is on is an example too.
Summary
Mark the three cookies Secure first: Security carries the largest deduction (-9), and these cookies can currently be sent over plain HTTP. The engineering health score is 77, calculated from a base of 100 with deductions for security (-9), accessibility (-5), runtime errors (-5), performance (-2), and SEO (-2). The most consequential findings are three cookies missing Secure, six console errors, and one serious accessibility issue involving a <blink> element.
Pages
Show the report for
- Not scanned /firefox/download/thanks/ The page answered 403 Forbidden.
- 1 page more: your plan's scan quota ran out first.
64 Security
-9 pts
Security
-9 ptsSecurity has issues and contributes -9 to the score. Three cookies (_ga_9Y966W6Q7W, _ga, and _ga_MQ7767QQQW) lack Secure, and the top fix is to mark them Secure so they are sent only over HTTPS; the same cookies also lack HttpOnly, and Permissions-Policy is missing.
JavaScript files scanned: 3 (0 with detected libraries)
What we verified (9)
HTTPS
Served over HTTPS
HSTS
HSTS enabled
Content-Security-Policy
CSP present
X-Content-Type-Options
X-Content-Type-Options present
Clickjacking protection
X-Frame-Options or frame-ancestors set
Referrer-Policy
Referrer-Policy present
Server software disclosure
No server version exposed
Mixed content
No mixed content
JavaScript libraries
No known-vulnerable library versions detected
90 Performance
-2 pts
Performance
-2 ptsPerformance has issues and contributes -2 to the score, with a reported navigation time of 2.6s. Investigate server response, render-blocking resources, and large assets to reduce load time.
What we verified (6)
Page weight
0.7 MB
Request count
36 requests
Image sizes
0 images over 300KB
Text compression
Text assets compressed
Static caching
Static assets carry cache-control
Render-blocking resources
4 render-blocking resources
87 SEO
-2 pts
SEO
-2 ptsSEO has issues and contributes -2 to the score because a canonical link is missing. Add a canonical link pointing to the preferred URL to reduce duplicate-content ambiguity.
What we verified (10)
Page title
Present: "Internet for people, not profit — Mozilla Global" (48 chars)
Title length
Title is 48 chars (ideal 10–65)
Meta description
Present (134 chars)
Description length
Description is 134 chars (ideal 50–160)
Single H1
Exactly one H1
Viewport
Viewport meta present
Indexable
Indexable
Lang attribute
Present (en)
Open Graph tags
Open Graph tags present
Favicon
Favicon present
67 Accessibility
-5 pts
Accessibility
-5 ptsAccessibility has issues and contributes -5 to the score because one <blink> element was detected with serious impact. Remove or replace the <blink> element with an accessible alternative.
Ensure <blink> elements are not used
1 of 8 pagesEnsure <blink> elements are not used (1 element)
Learn →What we verified (2)
Document language
Present (en)
Image alt text
All 12 images have alt text
50 Runtime Errors
-5 pts
Runtime Errors
-5 ptsRuntime Errors has issues and contributes -5 to the score, with 6 console errors. Resolve the CSP configuration warnings and the blocked connection to stats.g.doubleclick.net so browser behavior is clean and observable.
What we verified (2)
Uncaught JS errors
No uncaught errors
Failed requests
No failed requests
100 Best Practices
Partly checked
Best Practices
Partly checkedBest Practices has no failed checks, but the HTTP→HTTPS redirect could not be verified for this scan. Nothing here counts against the score, but that one check is unresolved rather than confirmed.
Couldn't be checked (1)
HTTP→HTTPS redirect
Could not determine whether HTTP requests redirect to HTTPS.
What we verified (3)
Doctype
Doctype present
Charset declaration
Charset present
Responsive viewport
Viewport present
Detected technologies
Analytics
Tag Manager
CDN & Hosting
Your improvement roadmap
A prioritized plan for where to focus next.
Do next 2
Mark cookies as Secure
Add the Secure attribute to all cookies so they are only ever sent over HTTPS.
Show details Hide details
Add the Secure attribute to the three identified cookies so they are sent only over HTTPS, addressing the security finding with a -9 deduction.
Why it matters
Cookies without the Secure attribute can be sent over an unencrypted connection, letting anyone on the same network intercept session tokens and impersonate the user.
How to fix
- 1. Add the Secure attribute to every cookie the app sets.
- 2. Confirm the site is fully served over HTTPS first.
Fix console errors
Investigate and resolve the JavaScript errors logged to the browser console.
Show details Hide details
Why it matters
Console errors often signal broken functionality (failed API calls, broken integrations) that users experience as things silently not working, even if the page still loads.
How to fix
- 1. Open devtools and reproduce the errors.
- 2. Trace each one to its source and fix the underlying bug or missing dependency.
- 3. Re-test after the fix to confirm the console is clean.
Later 4
Add a Permissions-Policy header
Set a Permissions-Policy header to restrict access to sensitive browser features (camera, mic, geolocation).
Show details Hide details
Why it matters
Without a Permissions-Policy, any script running on the page, including third-party scripts and ads, can request access to the camera, microphone, or location, widening the damage a compromised script can do.
How to fix
- 1. Decide which browser features the site actually needs.
- 2. Add a Permissions-Policy header disabling the rest (camera=(), microphone=(), geolocation=(), etc.).
- 3. Re-test any embedded widgets that rely on these features.
Mark cookies as HttpOnly
Add the HttpOnly attribute to cookies that do not need JavaScript access, reducing XSS exposure.
Show details Hide details
Why it matters
Cookies without HttpOnly are readable by any JavaScript on the page, so a single XSS bug is enough for an attacker to steal session cookies and take over accounts.
How to fix
- 1. Add the HttpOnly attribute to session and authentication cookies.
- 2. Only omit it for cookies a legitimate client-side script genuinely needs to read.
Add a canonical link
Add a <link rel="canonical"> tag pointing at the preferred URL to avoid duplicate-content issues.
Show details Hide details
Why it matters
Without a canonical tag, search engines can split ranking signals across near-duplicate URLs (with tracking params, trailing slashes, etc.), diluting the page's authority.
How to fix
- 1. Add <link rel="canonical" href="..."> pointing to the preferred URL.
- 2. Make sure the canonical URL matches the one you actually want indexed.
Speed up page load time
Investigate slow server response, render-blocking resources, and large assets to bring navigation time down.
Show details Hide details
Why it matters
Slow page loads are one of the strongest predictors of visitors leaving before the page even finishes loading, directly costing traffic and conversions.
How to fix
- 1. Profile server response time (TTFB) and fix slow backend queries or endpoints.
- 2. Eliminate render-blocking CSS/JS in the critical rendering path.
- 3. Reduce and defer large assets that delay the largest contentful paint.
Ready to see where you stand?
Scan your site and get your Engineering Score with a prioritized roadmap in under a minute, no signup required.