Google Analytics 4 high 82% evidence score
Sources: html
- html
g-white
Website Report
birthdaywebsite.app Website Report
Final URL: https://birthdaywebsite.app/
Scanned at 10/17/2026, 5:51:20 PM UTC · HTTP status 200
Themerella Score
80 / 100
Strong. A solid public-site baseline. Close the priority fixes to protect the score.
Export & more
Tech detected
4
SEO issues
0
Performance issues
1
Accessibility issues
2
Security issues
6
Redirects
0
Channels
8
Coverage: This saved score reflects the public signals captured by this scan. Optional rendered-DOM, axe-core, and Lighthouse evidence is documented under “How this scan was produced.”
Top fixes
What to fix first
0/9 fixed
-
Add Strict-Transport-Security after confirming the full site works over HTTPS.
Security · high ·security.missing_hsts_header· View fix guide -
Add a CSP header at the CDN or server layer and test third-party scripts.
Security · high ·security.missing_csp_header· View fix guide -
Add X-Frame-Options: SAMEORIGIN or use frame-ancestors in CSP.
Security · medium ·security.missing_x_frame_options_header· View fix guide -
Add X-Content-Type-Options: nosniff.
Security · medium ·security.missing_x_content_type_options_header -
Associate every input with a visible label or accessible aria-label.
Accessibility · medium ·accessibility.form_labels_missing -
Accessibility · medium ·
accessibility.buttons_missing_accessible_names -
Check server response time, CDN caching, redirects, and backend bottlenecks.
Performance · medium ·performance.slow_initial_html_response· View fix guide -
Add Referrer-Policy: strict-origin-when-cross-origin.
Security · low ·security.missing_referrer_policy_header· View fix guide -
Restrict browser features that the site does not use.
Security · low ·security.missing_permissions_policy_header
Score breakdown
Seo
20/20
Security
1/15
Performance
18/20
Tech Clarity
15/15
Accessibility
16/20
Maintainability
10/10
Technology Stack
Detected technologies with evidence
Analytics
CSS / UI
Tailwind CSS low 40% evidence score
Sources: html
- html
class="bg-fd-secondary/50 p-3 empty:hidden
Frontend Framework
Next.js high 99% evidence score
Sources: html · resources · headers
- html
/_next/static - resources
/_next/static - headers
next-router
Hosting / CDN
Cloudflare high 91% evidence score
Sources: headers · resources
- headers
cf-ray - resources
cloudflareinsights.com
External context
Domain intelligence via SiteJSON
Optional external enrichment — popularity, traffic, and DNS signals that complement the first-party scan. Fetched on demand from an external provider; it is not part of the live scan.
WordPress / CMS Details
No strong WordPress signal
No strong WordPress signal was found in the public HTML/resources.
WordPress sites can hide public CMS traces behind caching, headless frontends, or bundled assets.
Redirect Chain
No redirect chain
Final URL: https://birthdaywebsite.app/
That usually means the input URL resolved directly without HTTP hop cleanup.
SEO / GEO
- Title
- Birthday Website Maker – Create a Birthday Surprise Website
- Description
- Birthday Website Maker helps you create a personalized birthday website with photos, music, and a heartfelt letter. Preview free, then unlock and share with one link.
- Canonical
- https://birthdaywebsite.app/
- Robots meta
- None
- H1
- Birthday Website Maker
- Structured data
- Organization, WebSite, WebPage, SoftwareApplication, FAQPage
- Robots.txt
- OK (200)
- Sitemap
- OK (200)
Performance Signals
- Initial fetch
- 5129ms
- HTML size
- 345KB
- Resources
- 102 total · 28 scripts · 3 CSS · 29 images
- Lazy images
- 38
This MVP uses fast static performance signals. Enable Lighthouse CLI to add lab performance, SEO, accessibility, and best-practices scores.
On-demand performance intelligence is disabled for this runtime. When enabled with a Google API key, it loads separately from the main scan.
Accessibility
- Images
- 54 total · 0 missing alt
- Forms
- 16 inputs · 11 labels
- Buttons
- 36 total · 4 may lack names
- Headings
- 72 heading tags
- Viewport
- Present
This is a fast static accessibility scan. Enable Playwright + axe-core for automated rendered-page audits.
Security Headers
- HSTS
- Missing
- Content-Security-Policy
- Missing
- X-Frame-Options
- Missing
- X-Content-Type-Options
- Missing
- Referrer-Policy
- Missing
- Permissions-Policy
- Missing
- Cookies
- 0 set-cookie header(s), 0 flag issue(s)
- TLS certificate
- TLSv1.3 · CN=WE1, O=Google Trust Services · expires Jan 15 08:33:03 2027 GMT (89 day(s))
- TLS SANs
- birthdaywebsite.app, www.birthdaywebsite.app, *.www.birthdaywebsite.app
Missing headers usually mean CDN, reverse-proxy, or framework config still needs a hardening pass.
All Issues
Detailed issue list
Showing all 9 issues
Missing HSTS headerSecurity · high
HSTS was not found in the response headers.
Fix: Add Strict-Transport-Security after confirming the full site works over HTTPS.
Missing Content-Security-Policy headerSecurity · high
Content-Security-Policy was not found in the response headers.
Fix: Add a CSP header at the CDN or server layer and test third-party scripts.
Missing X-Frame-Options headerSecurity · medium
X-Frame-Options was not found in the response headers.
Fix: Add X-Frame-Options: SAMEORIGIN or use frame-ancestors in CSP.
Missing X-Content-Type-Options headerSecurity · medium
X-Content-Type-Options was not found in the response headers.
Fix: Add X-Content-Type-Options: nosniff.
Missing Referrer-Policy headerSecurity · low
Referrer-Policy was not found in the response headers.
Fix: Add Referrer-Policy: strict-origin-when-cross-origin.
Missing Permissions-Policy headerSecurity · low
Permissions-Policy was not found in the response headers.
Fix: Restrict browser features that the site does not use.
Form labels may be missingAccessibility · medium
16 text-like inputs and 11 labels were found.
Fix: Associate every input with a visible label or accessible aria-label.
Buttons may lack accessible namesAccessibility · medium
4 button(s) appear to have no text or aria-label.
Fix: Add visible button text or aria-label for icon-only buttons.
Slow initial HTML responsePerformance · medium
The initial fetch took about 5129ms.
Fix: Check server response time, CDN caching, redirects, and backend bottlenecks.
How this scan was producedCoverage, optional runtime layers, cache, and detection evidence
Scan coverage
What this report used
- Static fetch
- Used · HTML, headers, metadata, robots.txt, and sitemap.xml
- Rendered DOM
- Disabled · Set ENABLE_PLAYWRIGHT=1 to enable rendered DOM scanning.
- axe-core
- Disabled · Set ENABLE_AXE=1 to enable axe-core accessibility audits.
- Lighthouse
- Disabled · Set ENABLE_LIGHTHOUSE=1 to enable Lighthouse CLI audits.
This was a fast static scan of the public HTML, headers, robots.txt, and sitemap. Deeper rendered-DOM, lab (Lighthouse), and axe-core checks are optional and off for this report — so any empty section below reflects that boundary, not a clean bill of health.
Runtime capability
Optional layers and cache
- Deep scan mode
- static-only · optional layers disabled
- Playwright
- Disabled
- axe-core
- Disabled
- Lighthouse
- Disabled
- Repeat scan cache
- Enabled · 10 min TTL · exact input URL
Detection Method
Multi-signal scan, not logo guessing.
Themerella uses a self-owned static scanner that combines HTML, resources, headers, metadata, CSS-class hints, robots.txt, and sitemap.xml. Enable Playwright to add rendered DOM, runtime globals, dynamic network responses, axe, and Lighthouse.
- HTML
- 345KB · 29 external scripts · 1 JSON-LD blocks
- Resource URLs
- 102 total · 28 scripts · 3 CSS · 29 images
- Headers
- 16 headers · 3 identity hints · 0 security headers
- CSS classes
- 962 class attributes · Tailwind-like 2774 · Elementor 0
- Playwright
- Not used for this scan
- axe-core
- Not used for this scan
- Lighthouse
- Not used for this scan
Detection cautions
No major signal-quality warning was generated by this scan.