A well built site that
nothing is pointing at.
Twenty-eight pages, crawled end to end. The engineering checks out: canonicals are correct and absolute on every page, all 190 images carry alt text, mobile has no horizontal scroll, and every AI crawler we tested was served the page. What is missing is weight on the pages that sell, and any way to measure what happens next.
Cordaata has done the hard part. The crawl matches the sitemap exactly, canonicals are right on all 28 pages, all 190 images have alt text, structured data is real rather than decorative, and the AI crawler policy is explicit rather than left to defaults. The problems are all on the demand side. The 11 blog posts average 1288 words while the 13 pages that actually sell average 480, so the domain's ranking strength sits on educational content instead of on the product pages. 12 title tags run past what Google shows, and 11 of those put the brand in the position that gets cut. Three posts have a single internal link pointing at them. A dead script on the homepage throws a JavaScript error on every load. And because there is no Search Console or Analytics access, none of what the site currently earns can be measured, which makes the first fix an access request rather than a code change.
01Every page, graded
Each of the 28 crawled pages was scored against the same gate, worth 14 points across 12 families. They are: title present and inside the length limit; meta description present and inside its band; exactly one non-empty H1; one absolute rel=canonical pointing at the page itself; no noindex and no nosnippet; the three Open Graph properties scored one by one; a lang attribute; a viewport meta; alt text on every image; no em or en dashes in visible copy or alt text; JSON-LD that parses; at least one internal link. 15 pages fail at least one point, 4 carry a warning only, 9 are clean. Failures cluster almost entirely in the blog, which is also where the strongest content lives.
What each failing page failed on
| Page | Title chars | Desc chars | Dashes | Words |
|---|---|---|---|---|
| /blog-posts/capacity-planning-blog.html | 75 | 127 | 2 | 923 |
| /blog-posts/cfo-dashboard-blog.html | 73 | 127 | 783 | |
| /blog-posts/cognitive-bias-security-priorities.html | 83 | 186 | 1679 | |
| /blog-posts/control-efficacy.html | 78 | 145 | 4 | 1665 |
| /blog-posts/managing-risk-in-vucah-landscapes-blog.html | 67 | 141 | 774 | |
| /blog-posts/metrics-governance-blog.html | 79 | 156 | 1186 | |
| /blog-posts/msp-security-questions.html | 70 | 152 | 1226 | |
| /blog-posts/partnering-with-business-blog.html | 73 | 157 | 14 | 1662 |
| /blog-posts/patching-everything-strategy.html | 82 | 186 | 1211 | |
| /blog-posts/risk-tiers-blog.html | 78 | 139 | 2139 | |
| /blog-posts/risk-to-plan-blog.html | 79 | 125 | 9 | 921 |
| /blog.html | 48 | 128 | 2 | 468 |
| /legal/dpa.html | 35 | 129 | 4 | 4026 |
| /legal/service-level-agreement.html | 34 | 152 | 9 | 1562 |
| /partners.html | 62 | 145 | 373 |
02Twelve titles run past what Google shows
Sixty characters is roughly what Google shows before it truncates, though the real cut is by pixel width rather than a fixed count. Twelve titles run past it. On 11 of them the brand sits last, so the brand is what gets dropped; on the twelfth, the Partners page, the brand leads and the descriptive tail is lost instead.
| Chars | Title as written |
|---|---|
| 83 | Cognitive Bias in Cybersecurity: Six Biases Setting Your Security Budget | Cordaata |
| 82 | Vulnerability Prioritization: Why Patching Everything Is Not a Strategy | Cordaata |
| 79 | Security Metrics & Governance: A Blueprint for Modern Security Teams | Cordaata |
| 79 | Plan Disruption Probability: Linking Cyber Risk to Business Strategy | Cordaata |
| 78 | Tiered Risk Analysis: Better Business Decisions with Risk Modelling | Cordaata |
| 78 | Security Control Efficacy: Why Controls Fail and How to Measure TMP | Cordaata |
| 75 | Proactive Security Capacity Planning: Moving Beyond Firefighting | Cordaata |
| 73 | The Strategic CISO: From Gatekeeper to Business Growth Enabler | Cordaata |
| 73 | Cyber Risk in Financial Terms: A CFO Dashboard Guide for CISOs | Cordaata |
| 70 | MSP vs Managed Security: Six Questions to Ask Your Provider | Cordaata |
| 67 | CISO Risk Management in Volatile, Uncertain Environments | Cordaata |
| 62 | Partner with Cordaata | Cyber Risk Management for Your Clients |
| Cordaata from the posts that do not need it, and keep the brand only where
the title is short enough to carry it.03The funnel is upside down
Ranking weight follows content depth, and on this domain the depth is all in the wrong place. Bars below show average word count by page group.
All three bars share one scale, with the longest group average, 2404 words, at full width.
The six thinnest commercial pages
| Page | Words |
|---|---|
| /demo.html | 136 |
| /contact.html | 157 |
| / | 370 |
| /partners.html | 373 |
| /regulatory-compliance.html | 408 |
| /ciso.html | 428 |
Contact and Demo are supposed to be short, and both carry working HubSpot forms, so leave them alone. That leaves 5 pages competing for category terms on under 450 words each: the homepage, Partners, Regulatory Compliance, CISO and Board Reporting.
04Nothing routes traffic to the deep content
Every page in the header and footer collects 28 internal links automatically. The blog posts collect whatever the blog index gives them, which for three of them is one link and nothing else.
| Post | Inbound internal links |
|---|---|
| /blog-posts/capacity-planning-blog.html | 1 |
| /blog-posts/managing-risk-in-vucah-landscapes-blog.html | 1 |
| /blog-posts/risk-tiers-blog.html | 1 |
| /blog-posts/cognitive-bias-security-priorities.html | 2 |
| /blog-posts/msp-security-questions.html | 2 |
| /blog-posts/patching-everything-strategy.html | 3 |
05Structured data, and the type that is missing
What is here is correct. Articles carry a named author with credentials, a published date and a modified date. The FAQ page carries real FAQPage markup. The gap is that nothing on the site tells a search engine this is software.
Zero pages carry SoftwareApplication or Product markup.
Zero carry BreadcrumbList. Both are standard for a SaaS product in 2026 and both
feed the rich results and AI answer panels that competitors in this category already occupy.
06Speed is solved. Visibility is not.
Measured through the PageSpeed Insights API on mobile, median of three runs, never headless Lighthouse.
07What we checked and what came back clean
A short ledger of every technical check run against the live site, so nothing in this report rests on a claim you cannot trace back to a test.
| Check | Result |
|---|---|
| Crawl against sitemap | 28 crawled, 28 declared, no orphans and no omissions |
| Canonical tags | 28 of 28 self-referencing and absolute |
| Image alt text | 190 images, 0 missing alt |
| Mobile horizontal scroll | None at 390px. scrollWidth equals clientWidth |
| Clipped or unreachable content | None, tested with menus open on mobile |
| Security headers | HSTS, nosniff, referrer policy and clickjacking protection present. Content-Security-Policy absent |
| AI crawler access | 7 crawlers fetched, all served 200, 0 blocked, plus 2 training-control tokens permitted by its wildcard rule |
| llms.txt | Present, 65 lines, structured summary rather than a link dump |
| robots.txt on the apex | 302 to www. Served correctly on www, but the apex copy is a redirect |
| 404 handling | Unknown URLs resolve to /404.html with HTTP 200, a soft 404 |
| Index coverage | Not verifiable without Search Console. See finding 01 |
08Long dashes in visible copy
44 em and en dashes across 7 pages. In a category where buyers are professionally suspicious of generated text, this is the cheapest credibility fix on the list.
| Page | Count |
|---|---|
| /blog-posts/partnering-with-business-blog.html | 14 |
| /legal/service-level-agreement.html | 9 |
| /blog-posts/risk-to-plan-blog.html | 9 |
| /legal/dpa.html | 4 |
| /blog-posts/control-efficacy.html | 4 |
| /blog.html | 2 |
| /blog-posts/capacity-planning-blog.html | 2 |
09Findings
Ten findings, ordered by what they cost to leave alone rather than by how hard they are to fix. Each carries a severity and one of the four categories used across this report.
No Search Console and no Analytics, so half the questions cannot be answered at all
This audit is a cold outside read. Without Search Console we cannot see which of the 28 pages Google actually holds, what queries the site already surfaces for, or whether anything is excluded. Without Analytics we cannot see what the traffic does once it lands. Every impression, click, CTR, ranking and conversion figure is therefore absent from this report by design, not by oversight. Read-only access to both closes that gap in minutes and converts the whole second half of this document from inference into measurement.
site:cordaata.com index probe was attempted twice, against DuckDuckGo's HTML endpoint and against Bing in a real Chromium browser. Both returned an empty result container rather than a zero-result page, which means the check could not be shown capable of returning a positive at all. A check that cannot be proven able to find something is not evidence that nothing is there, so index coverage is reported here as unknown and not as zero.A JavaScript error on the homepage kills its only inline script
Chrome throws TypeError: Cannot read properties of null (reading 'addEventListener') on first paint of the homepage. The cause is an email-capture widget that was removed from the markup while its code stayed behind: the script still calls document.getElementById("emailInput") and "submitBtn", and neither element exists any more. Because the failure happens inside the DOMContentLoaded handler, the handler aborts at that line and nothing after it runs. Of the 14 pages probed for the script, the homepage is the only one that still carries it, so this is a single-page defect rather than a site-wide one.
/, 0 on /demo.html. The element probe covered the homepage plus the 13 other non-blog, non-legal pages, the set the script could plausibly have been copied to, and returned emailInput: false, submitBtn: false on every one.The pages that sell are a third the weight of the pages that explain
The 11 blog posts average 1288 words. The 13 commercial pages, the ones that have to rank for the terms a buyer types, average 480. Four of them sit under 400. That inverts the intended funnel: the strongest ranking assets on the domain are educational posts that do not name the product, while the pages named after the category are the thinnest on the site. The fix is not more blogging, it is depth on the commercial pages that already exist.
12 of 28 title tags run past what Google shows
Twelve titles exceed the 60-character mark, the longest at 83. Google truncates by rendered pixel width rather than a hard character count, so 60 is a working guide and not a cliff, but everything past it is at risk. 11 of the 12 end in | Cordaata, which puts the brand in the first position to be dropped. The one exception is the Partners page, which leads with the brand and loses the tail instead. The titles themselves are well written; they are simply too long.
seo-compliance-check.py, which flags the same 12.Three blog posts have exactly one internal link pointing at them
Navigation pages each collect 28 internal links because they sit in the header and footer. The deep content does not: the three least-linked posts receive a single link each, from the blog index. A post with one inbound link is discovered late, crawled rarely, and passes almost no authority to the commercial pages it should be feeding. The posts are good; nothing routes traffic through them.
Ten meta descriptions sit outside the length Google will show
Every one of the 28 pages carries a meta description, and none is missing or empty. But 10 of them fall outside the 130 to 160 character working range this audit uses: 2 at 186 and 1 at 162 characters over the top of it and 7 under the bottom. Google does not publish a character limit, and it renders snippets by pixel width rather than by count, so treat that range as a guide in the same way as the 60 characters in finding 04. Descriptions do not rank. They are what a searcher reads before deciding whether to click, and Google substitutes its own sentence from the page when it judges the supplied one unhelpful.
No SoftwareApplication schema and no breadcrumbs anywhere on the site
Structured data is present and correct as far as it goes: Organization and WebSite on the homepage, Article with a named author on all 11 posts, a real FAQPage on the FAQ. What is missing is the type that matches what Cordaata actually sells. Across all 28 pages there is zero SoftwareApplication or Product markup and zero BreadcrumbList. Both are schema types Google documents for rich results, and both give an answer engine a cleaner object to quote than a generic WebPage.
44 em and en dashes across 7 pages
Long dashes in visible copy are a well known surface tell of machine-drafted text, and this is a category whose buyers audit wording for a living. They sit across 4 blog posts, the blog index and the 2 legal documents, with over half of them in two files. This is a find-and-replace, not a rewrite.
The site is fast, and nobody is on it yet
Lab performance is 95 out of 100 on mobile with LCP 2870ms, TBT 14ms, CLS 0.000 and FCP 1056ms, taken as the median of three PageSpeed Insights runs. Field data does not exist: Chrome has not recorded enough real visits to this origin to publish a CrUX record at all. That absence is itself the headline. Performance is not what is holding this site back, and there is no speed work worth funding here.
The AI crawler setup is deliberate, and most sites this size have none of it
7 AI crawlers were fetched against the live origin using their real user agents. All 7 were served HTTP 200 and none is blocked. Robots.txt names 8 AI agents one by one, GPTBot, ClaudeBot, PerplexityBot, GoogleOther, Amazonbot, Meta-ExternalAgent, YouBot and cohere-ai. The 3 fetched agents it does not name, OAI-SearchBot, ChatGPT-User and Bytespider, are covered by the site-wide allow rule rather than blocked. The remaining 2 entries checked, Google-Extended and Applebot-Extended, are training-control tokens rather than crawlers; robots.txt does not name either, so both are permitted by the same site-wide allow rule. An llms.txt exists, is 65 lines, and carries a structured summary rather than a link dump. This was set up on purpose, and it is the one area where the site is already doing more than it strictly needs to.
10Who owns what
Established from evidence rather than assumption. The site is a static build served from Amazon
S3 behind CloudFront, not a CMS: /wp-json/ returns a redirect rather than a WordPress
API, the server header reads AmazonS3, and pages are delivered as .html
files with an ETag and a one-year CDN cache. Forms post to HubSpot, portal
148797963, EU region. Everything in this report is therefore a change Cordaata's own
team makes in their own repository and redeploys. There is no platform vendor to wait on and no
template that blocks any of it.
11The plan, cheapest first
Ten steps, ordered by cost rather than by importance, so the work that needs a decision comes after the work that does not.
- Grant read-only Search Console and Analytics accessCosts nothing and takes two minutes. Until it exists, no one can say what the site already earns, which pages Google holds, or whether any change made afterwards worked.
- Delete the dead homepage scriptOne block of JavaScript referencing two elements that no longer exist. Removing it clears the only console error on the site.
- Rewrite 12 title tags to fit 60 charactersFront-load the term, drop the trailing brand where it does not fit. One afternoon, 12 files, no design change.
- Bring 10 meta descriptions inside the 130 to 160 character band3 are over the ceiling and 7 are short of it. Copy work only, no code.
- Cross-link posts to commercial pages, both directionsTwo or three links per page. This is the single highest return action in this document relative to effort.
- Take the 5 thin category pages past 900 wordsthe homepage, Partners, Regulatory Compliance, CISO and Board Reporting. Same argument, more of it, with the framework names spelled out.
- Add SoftwareApplication and BreadcrumbList markupHomepage and every product page. Pure markup work, no copy involved.
- Replace the 44 long dashesFind and replace across 7 files.
- Return a real 404 statusUnknown URLs currently render the 404 page with an HTTP 200, which tells Google the page exists. A CloudFront error-response rule fixes it.
- Then, and only then, decide on a content and keyword programWith measurement in place from step one, that decision gets made on data instead of on this audit.
Ten items. The first five cost nothing but an afternoon.
Steps one through five are housekeeping that any developer on the team can finish in a day, and they unlock the measurement that makes everything after them arguable rather than assumed. Steps six through ten are where the actual program starts, and what that program should be depends entirely on what Search Console shows once it is connected.
Scope and timing are a conversation, not a line item in a PDF. If you want to walk through any finding here, or you want the measurement piece set up before deciding anything else, get in touch.