squirrelscan - The website QA tool for your coding agent

How to fix

Your site declares the same thing on page after page without an @id, so nothing says they are one thing. A search engine reading 60 pages sees 60 separate organizations, and none of them accumulates the authority of the others. Give the entity one absolute @id, something like https://yoursite.com/#organization, declare it in full once per page, and reference it by { "@id": "…" } everywhere else. The fragment is arbitrary; what matters is that it is absolute and identical on every page. See https://docs.squirrelscan.com/guides/entity-map/fixing.

How to fix

A page whose script or stylesheet returns 404 or 500 still answers 200 with its title and meta, but renders unstyled or its interactive parts never run. The usual cause is a deploy: cached HTML still points at hashed bundles the new release deleted. Redeploy the missing file, or update the reference so pages point at the bundle that exists. Keep old hashed assets for as long as cached HTML may reference them. Third-party failures are reported as warnings: check the provider's status, or remove the reference if the service is gone.

How to fix

For controls with visible labels, the accessible name should contain the visible text. Voice control users say what they see - if the accessible name doesn't include the visible label, voice commands won't work. Example: A button showing 'Search' should not have aria-label='Find products'.

How to fix

Third-party cookies are being phased out by browsers. Review resources from external domains that may set cookies for tracking. Consider using first-party analytics solutions, server-side tracking, or privacy-focused alternatives. Ensure compliance with GDPR/CCPA by providing cookie consent and disclosing third-party services in your privacy policy.

How to fix

Source maps help debug minified code but can expose source code if publicly accessible. For production: 1) Either remove source maps entirely, 2) Restrict access via server config, or 3) Use 'hidden' source maps uploaded only to error tracking services. Exposed source maps can reveal business logic and security implementations to attackers.

How to fix

Cookie consent is required under GDPR and ePrivacy regulations for EU users. Implement a consent banner that: allows users to accept/reject non-essential cookies, doesn't pre-check optional cookies, stores consent preferences, and blocks tracking cookies until consent. Use tools like CookieYes, OneTrust, or Cookiebot.

How to fix

Under GDPR Art. 28, processors must disclose the sub-processors they engage and offer a Data Processing Agreement (DPA). Publish a /subprocessors page listing each third party that handles customer personal data (purpose, location), keep it current, and link a DPA from your legal/trust pages. B2B SaaS and fintech buyers expect this during security review.

How to fix

Video poster images improve perceived performance and user experience. For HTML5 video, use the poster attribute. For embedded videos, thumbnailUrl in VideoObject schema. Thumbnails should be high quality, relevant to content, and properly sized (recommend 1280x720 or higher).

How to fix

If the site has an associated codebase, publish an AGENTS.md at the repository root covering setup, testing, and conventions a coding agent needs to be productive. This is a recommendation only — it never affects your score.

How to fix

Every page needs a unique, descriptive title tag between 30-75 characters. Titles appear in browser tabs, search results, and social shares. Write titles that accurately describe the page content while including your primary keyword near the beginning. If your title is too short, add more descriptive context. If too long, prioritize the most important information first and trim secondary details. Avoid keyword stuffing or duplicate titles across pages.

How to fix

Meta descriptions should be 120-160 characters and provide a compelling summary of the page. While not a direct ranking factor, good descriptions improve click-through rates from search results. Write unique descriptions for each page that accurately preview the content. Include a call-to-action when appropriate. If missing, search engines will auto-generate snippets which may not represent your page optimally.

How to fix

The robots meta tag and the X-Robots-Tag response header control how search engines index and follow links on a page. Common directives include noindex, nofollow, noarchive, and nosnippet. If your page has noindex, it won't appear in search results. Review whether this is intentional; the report names the source, and a header set by a CDN, proxy or server config does not appear in the page source. For pages that should be indexed, remove the noindex directive or change it to "index, follow". Be careful with nofollow as it prevents link equity from flowing to linked pages.

How to fix

CSP prevents XSS attacks by restricting which resources can load. Start with a report-only policy to identify issues. Key directives: default-src 'self', script-src (avoid 'unsafe-inline'), img-src, style-src, frame-ancestors. Use nonces or hashes instead of 'unsafe-inline' for scripts. Test thoroughly as strict CSP can break functionality.

How to fix

Cross-origin scripts and stylesheets can be tampered with in transit or at the source (a compromised CDN or third-party host), and the browser has no way to detect it without help. Add an integrity attribute with a sha256/sha384/sha512 hash of the expected file, plus crossorigin="anonymous": <script src="..." integrity="sha384-..." crossorigin="anonymous"></script>. Most CDNs (jsDelivr, cdnjs, unpkg) publish the hash alongside the URL. This only works for pinned/versioned assets — scripts that update themselves server-side (analytics, payment SDKs, CAPTCHAs) intentionally don't support it: list such a host in the exempt_hosts option rather than pinning a hash that will go stale.

How to fix

Publish a security.txt at /.well-known/security.txt with at least a Contact and an Expires field, served as plain text. Keep Expires in the future (renew it yearly). Sign the file with PGP if you can, and do not serve an HTML page at that path.

How to fix

Broken external links hurt user experience and credibility. Regularly audit external links using automated tools. Remove or replace broken links with working alternatives. Consider using archived versions (archive.org) if the original content is gone. For important resources, consider hosting your own copies of critical documentation or linking to more stable sources.

How to fix

Orphan pages have no internal links and are hard for search engines to discover. They may not get indexed or rank well. Add internal links from relevant pages. Include in navigation or sidebar. Add to sitemap. Create contextual links from related content. If intentionally orphaned (e.g., landing pages), ensure they're accessible via sitemap.

How to fix

A link to #id jumps to the element with that id. When the element is renamed or removed, the link still loads and the reader lands at the top of the page instead of the section. Update the link to the id that exists now, or add the id to the target element. Skip links need a target too: give <main> or the content container the id the skip link points at.

How to fix

These pages look well-linked but receive no editorial support: every link pointing at them is repeated on every page of the site, so it carries no signal about what the page is about or how important it is. Add links from the body copy of related articles, hub pages, or category descriptions using descriptive anchor text. Sitewide navigation links help discovery, but contextual links are what pass topical relevance and internal link equity.

How to fix

Pages with only a single internal link have weak internal linking support and may struggle to rank. Search engines use internal links to understand page importance and distribute link equity. Add contextual links from related content, include in navigation or sidebar, or link from category/hub pages to strengthen internal link profiles.

How to fix

Each family points at a different break in the publishing pipeline. Lorem ipsum and theme boilerplate mean a page was published before its copy was written: replace the text, and add the affected fields to whatever check gates publishing. Unrendered template syntax means the templating engine never ran over that string, usually because the value was interpolated into an already-escaped fragment or the template was served as static HTML: render it server-side, or delete the stale copy. A visible undefined, NaN, null or [object Object] means the value was missing and the code concatenated it into the copy anyway: guard the field at the point of render rather than in CSS. TODO and FIXME markers mean a draft shipped: finish or remove the note, since search engines and readers see it exactly as written.

How to fix

Keyword stuffing is repeating words unnaturally to manipulate rankings. Search engines penalize this practice. Write naturally for users first. Use keywords where they fit naturally. Aim for 1-2% keyword density at most. Use synonyms and related terms instead of repeating the exact same phrase. Focus on providing value, not gaming algorithms.

How to fix

A page states its date more than once - the visible byline, schema.org datePublished/dateModified, a year in the URL or title, the sitemap lastmod, the Last-Modified header - and readers and crawlers do not all read the same one. When they disagree, at least one is wrong, and presence checks cannot tell you which: they pass as soon as any single signal exists. Drive every date on the page from ONE content timestamp. If the visible byline disagrees with the schema, fix whichever renders from the wrong field (a common cause is the template printing a build-time or hardcoded value while the schema prints the CMS field). If the schema carries dates the reader never sees, render the date in the article header - Google asks for a visible date on dated content, and a date only crawlers can see is not one. Check the schema date is attached to the node describing the page (Article/BlogPosting/WebPage): a datePublished on a sitewide SoftwareApplication or Organization node is that entity's own date and says nothing about this page.

How to fix

Pages with thin content (under 300 words) often struggle to rank well and are actively deindexed by Google since the June 2025 core update. Add more valuable, relevant content to thin pages—aim for at least 500 words for standard pages and 1000+ for in-depth articles. If a page can't be fleshed out, voluntarily noindex it or consolidate it into a more comprehensive resource. Trimming thin pages from your index is better than leaving low-value content for Google to penalize.

How to fix

VideoObject schema enables video rich results and carousels. Required: name, description, thumbnailUrl, uploadDate. Recommended: duration (ISO 8601), contentUrl, embedUrl. For video courses, use Course with hasCourseInstance. Ensure thumbnailUrl is high quality (min 160x90, max 1920x1080).

How to fix

These pages break your own site's pattern: most pages of the same type emit this schema @type and these do not. That is almost always a template or CMS gap rather than a deliberate choice - a product without its Product markup, an article without its Article markup - and it costs those pages the rich results their siblings are eligible for. Find where the working pages get their JSON-LD and make sure the listed pages run through the same path. If a page genuinely should not carry the markup (a discontinued product stub, a landing page filed under the same type), leave it: the point is that it is currently the exception.

How to fix

Add loading='lazy' to images below the fold to defer loading until needed. This reduces initial page load time and saves bandwidth. Exception: Don't lazy-load LCP image or above-the-fold content. Use loading='eager' for critical images.

How to fix

Serve images at the size they are displayed. A thumbnail shown at 64x64 needs at most a 128x128 file for high-density screens; a file much heavier than that wastes bandwidth and slows the page. Generate a thumbnail-sized variant and reference it, or list 1x and 2x candidates in srcset so the browser picks the smallest sharp one. Image CDNs can resize on the fly.

How to fix

Specifying width and height attributes prevents Cumulative Layout Shift (CLS) by reserving space before images load. Add width and height attributes to img tags matching the image's intrinsic dimensions. Use CSS for responsive sizing if needed. For responsive images, the aspect ratio from width/height prevents layout shifts even when CSS overrides the actual size.

How to fix

Large JavaScript files block the main thread and delay interactivity. Code-split bundles into smaller chunks, tree-shake unused exports, lazy-load non-critical scripts, and defer or async load third-party scripts. Use dynamic imports for route-based splitting.

How to fix

Time to First Byte (TTFB) measures how quickly your server responds. Slow TTFB indicates server/backend issues. Thresholds (Core Web Vitals): - Good: < 600ms - Needs improvement: 600-1000ms - Poor: > 1000ms Fixes for slow TTFB: - Enable server caching (Redis, Varnish, CDN) - Optimize database queries - Use CDN for static assets - Upgrade server resources - Reduce server-side processing - Enable HTTP/2 or HTTP/3 - Use edge computing (Cloudflare Workers, Vercel Edge)

How to fix

CLS measures visual stability - how much content shifts during load. Prevent layout shifts by: 1) Always set width and height attributes on images and iframes. 2) Reserve space for ads and embeds with CSS min-height. 3) Use CSS aspect-ratio for responsive media. 4) Avoid inserting content above existing content. 5) Use transform animations instead of properties that trigger layout.

How to fix

Large DOMs slow page rendering, increase memory usage, and harm mobile performance. Google recommends keeping total nodes under 1500. Fixes for large DOMs: - Use virtualization for long lists (e.g., react-window) - Lazy-load off-screen content - Reduce unnecessary wrapper elements - Use CSS instead of DOM for visual effects - Paginate large content sections

How to fix

Set Cache-Control with an appropriate max-age on every response (short for HTML, long + immutable for hashed static assets), expose an ETag or Last-Modified for cheap revalidation, and enable gzip/Brotli for text responses. Consistent caching across the whole site cuts repeat-visit load times and origin/CDN cost.

How to fix

Critical request chains are sequences of dependent network requests that must complete before the page can render. Reduce chain depth by: 1) Inlining critical CSS instead of linking external files. 2) Adding async or defer to non-critical scripts. 3) Avoiding CSS @import — use <link> tags instead. 4) Using <link rel='preload'> for critical resources. 5) Reducing the number of render-blocking resources in <head>.

How to fix

Don't use loading='lazy' on images that appear above the fold (visible without scrolling). Lazy loading these images delays LCP because the browser waits for layout before fetching. For hero images and LCP candidates: 1) Remove loading='lazy'. 2) Add fetchpriority='high'. 3) Consider preloading with <link rel='preload' as='image'>. Only use lazy loading for below-fold images.

How to fix

Give every field that collects a person's own data the matching WHATWG autofill token, e.g. autocomplete='given-name', 'email', 'tel', 'address-line1', 'postal-code', 'cc-number'. Browsers and password managers fill those fields in one tap, which is the difference between a completed checkout and an abandoned one, and WCAG 2.1 success criterion 1.3.5 (Identify Input Purpose) requires it. Tokens may be prefixed with section-*, shipping/billing and home/work/mobile, e.g. autocomplete='shipping address-line1'. A token the browser does not recognise is ignored outright, so a typo like 'firstname' is worse than nothing: use 'given-name'. Avoid autocomplete='off' on personal data; it does not stop autofill in modern browsers, it only stops the accurate kind.

How to fix

All video content needs captions for deaf/hard-of-hearing users (WCAG 1.2.2). Add <track kind='captions' src='captions.vtt' srclang='en'> to video elements. For embedded videos (YouTube, Vimeo), enable captions in the embed settings. Also provide a text transcript for complex content. Auto-generated captions should be reviewed for accuracy.

How to fix

Headings should follow a logical hierarchy without skipping levels. Screen reader users navigate by headings, so skipping from H1 to H3 is confusing. Correct order: H1 -> H2 -> H3 (not H1 -> H3). You can have multiple headings at the same level, and you can go back up (H3 -> H2 is fine). Think of headings as an outline - they should make sense when read alone.

How to fix

Links with the same visible text should go to the same URL. When identical link text leads to different destinations, it confuses screen reader users who navigate by listing links. Make link text unique or more descriptive to differentiate destinations.

How to fix

Image alt text should not start with 'image of', 'photo of', 'picture of', etc. Screen readers already announce that it's an image. Alt text should describe the content or function, not state the obvious. Also avoid duplicating adjacent text in the alt.

How to fix

Link text should describe the destination, not generic phrases like 'click here'. Screen reader users often navigate by links, hearing them out of context. Good: 'View our pricing plans'. Bad: 'Click here'. For icon-only links, add aria-label: <a href='/search' aria-label='Search'><svg>...</svg></a>. Empty links are especially problematic - add text or aria-label. A link hidden by the hidden attribute, aria-hidden, a closed dialog or an inline style='display:none' is out of the accessibility tree and is not reported, but it needs text before it is shown. A <style> rule squirrel can decide counts too. An empty link carrying a no-js class (itself or an ancestor other than <html>) on a page with an external stylesheet or @import is reported as unconfirmed, because the theme may hide it when JavaScript runs. One a style may hide but squirrel cannot settle (a pseudo-class, a media query, a page that also loads an external stylesheet) is reported as unconfirmed. External stylesheets are not read, so a link hidden only by one is still reported.

How to fix

Each <th> element should be associated with at least one <td> data cell in the same row or column. Orphaned header cells without data cells usually indicate the table is being misused for layout purposes. If the table is for layout, add role='presentation'. Otherwise, ensure every header has corresponding data cells.

How to fix

When a page has multiple data tables, each should have a unique accessible name to help users distinguish between them. Use <caption>, aria-label, or aria-labelledby with unique text for each table.

How to fix

The web app manifest (usually site.webmanifest) sets the name, icons, splash colours and start page used when someone adds the site to their home screen. Serve it as application/manifest+json, give it a name, a start_url and a display mode, and declare 192x192 and 512x512 PNG icons. Add a maskable icon so Android can crop it to the launcher shape without clipping. Keep the manifest's theme_color equal to the theme-color meta on your pages. A site that links no manifest gets advice only, and that does not affect the score.

How to fix

Your site uses more than one URL convention: some paths follow one form and a minority follow another. Mixed conventions are how duplicate-content and canonical bugs start, because /My_Page, /my-page and /my-page/ are three different URLs to a crawler even when they serve the same thing. Pick the dominant form already used by most of your site, migrate the minority onto it, and 301-redirect the old paths so links and rankings follow. If a section deliberately differs (a dated archive, a deeper product tree), that is fine: the point is that a handful of pages should not be the exception.

How to fix

Add VideoObject schema to pages with video content for rich results. Required: name, description, thumbnailUrl, uploadDate. Recommended: duration, contentUrl, embedUrl. Schema enables video carousels and previews in search results. Test with Google's Rich Results Test.

How to fix

Videos need captions for deaf/hard-of-hearing users and transcripts for SEO. Use <track> elements for captions. Provide text transcripts on the page. Auto-generated captions should be reviewed for accuracy. Captions also help when audio can't be played. Required by WCAG 2.1 Level A.

How to fix

A mismatch between what a page IS (as an AI or search engine reads it) and what its structured data declares confuses rich-result eligibility and AI answers. Either fix the JSON-LD @type to describe the page truthfully, or restructure the page content so its primary purpose is unambiguous.

How to fix

Strip or externalize inline <script>/<style> blocks, avoid deeply nested wrapper divs and long utility-class strings on content-bearing elements, and serve lean server-rendered markup rather than a client framework's verbose hydration output — especially on content pages. Consider Markdown content negotiation, which sidesteps the ratio problem by removing HTML markup from the response entirely.

How to fix

Resources matching EasyPrivacy are blocked by privacy-focused browsers and extensions (uBlock Origin, Brave, Firefox strict mode). Analytics, session replay, and tracking pixels on these domains will silently fail for those visitors, skewing your data. Consider first-party or privacy-respecting analytics so measurement survives tracker blocking.