I Audited My Own Website. The Tests Passed Anyway.

Last week I published a page offering a findability audit. Somewhere between writing the copy and pushing it live, it occurred to me that I had never run the thing on my own site.

So I did. It took an afternoon and it found four problems. Here is what turned up, because the findings are more useful to you than any claim I could make about the service.

The one that bothered me most

My site sets security headers. Content Security Policy, X-Frame-Options, the usual set. They live in a file called _headers, which Cloudflare reads and applies.

I also have a test that checks those headers are configured. It passes. It has always passed.

Then I measured the actual responses coming back from the live site:

Page	Security headers served
Home	0
Contact	0
Workflow audit	0
Local visibility audit	6

One page out of forty was protected. The rest were serving nothing.

The cause is a detail in how Cloudflare works. A _headers file applies to static files. My site renders most pages on demand instead, which means the header file never touches them. The one protected page was the one I had happened to mark as static, and I had only done that by copying an older page.

The test passed the whole time because it was reading the configuration file, not the response. It confirmed the rule was written down. It never confirmed the rule was being applied.

That distinction cost me nothing this time. It is the same distinction that lets a business believe its enquiry form works because the form exists.

The one every site seems to have

Typing http://lumomatics.com.au into a browser returned the site over plain HTTP. No redirect to the secure version. It had been that way since launch.

That is a single toggle in Cloudflare. It took about four seconds to fix once I knew. Knowing is the whole job.

The one that made my sitemap look busy

A sitemap tells search engines which pages you consider worth indexing. Mine listed 139 addresses.

Sixty-five of them were blog tag archives. I have forty posts and sixty-five tags, so most of those archives held one or two items. Thin pages, competing with the posts they linked to, taking up almost half of everything I was putting forward.

They are still on the site and still linked. They are simply no longer presented as pages worth indexing. The sitemap is now 74 addresses, all of which I would defend.

The one that was hiding in plain sight

My site said I was based on the Mornington Peninsula. My listings on the government AI directory, Localsearch and Yellow Pages all said Red Hill. The Yellow Pages address literally contains red-hill-vic.

The Peninsula is where I work. Red Hill is where I am. Those are different claims, and I had been publishing the wrong one in the field that is supposed to hold a locality.

Worse, the site disagreed with itself. One page had said “Based in Red Hill” for months while the footer said something else. I had never noticed, because I do not read my own footer.

Search engines match businesses across sources by comparing these details. When the details disagree, the matching gets weaker. It is not dramatic. It is just quietly worse, forever, until someone checks.

What I actually changed

Always Use HTTPS, on. Security headers moved into code so every page gets them, with a test that now compares the two sources against each other rather than trusting one. Tag archives out of the sitemap. Locality corrected, postcode included, in one place that everything else reads from.

There is a fifth finding I am not writing up yet. I think I understand it, I have made the change, and I will not publish the explanation until I have confirmed the change worked. Publishing a diagnosis before verifying the cure is how confident nonsense gets into circulation.

What I am not claiming

None of this has produced a result yet. The fixes are days old. There is no traffic graph, no ranking movement, no enquiry bump, and anyone showing you one this soon after a technical change is showing you noise.

What I have is findings. Findings are the product. Whether they turn into outcomes depends on what happens over the next few months, and I would rather tell you that than dress up an afternoon’s work as a transformation.

I will also say plainly that none of these were catastrophic. My site was not down. Enquiries were arriving. If you had asked me the day before whether my site was fine, I would have said yes, and I would have been mostly right.

Three things you can check on your own site this afternoon

None of these need a developer.

Type your address starting with http://, not https://. If the padlock never appears, you have the same problem I had.

Search your business name in Google Maps. If you find two listings, or one showing a suburb you have never worked from, your reviews and your ranking are being split between them.

Send yourself an enquiry through your own contact form. Not a test in the builder. A real submission, from your phone, on mobile data. Then wait and see whether it arrives.

That last one catches more businesses than the other two combined. A contact form that stopped delivering is completely invisible from the inside, because the person who would notice the silence is the person receiving nothing.

If you find something and want a second pair of eyes on the rest, book a call and we will look at it together. If you find nothing, that is a good afternoon’s work and you owe me nothing.