Website Audit Scores Directory

Every audit starts at 100 and loses points for its findings by severity: 5 for a critical finding, 2 for a high one, 0.8 for a medium one and 0.2 for a low one. Informational notes take no points away.

Every audit counts findings the same way, whether it is a quick audit anyone can run without an account, an audit run from an account or an audit through the NexusBro API. It counts each distinct finding message once and charges 1 more point for any finding that turns up more times than half the number of pages it fetched; on a one page audit that is every finding, so a medium finding there costs 1.8 points.

Deductions stop at 35 points. Healthy basics then add points back, never more than 15. Every audit adds 3 for an XML sitemap, 2 for a robots.txt file, 2 when the address of the first page uses HTTPS, 2 for structured data on that page, and 5 when pages load in under 300 ms on average or 3 when they load in under 500 ms.

Four ceilings apply last: any finding at all caps the score at 99, more than 50 findings cap it at 90 and more than 200 cap it at 80, counting every occurrence except informational notes, and any critical finding caps it at 85. The result is rounded to a whole number. A site the crawler cannot reach gets no score at all.

The letter grade comes from one ladder:

Grade	Score	Sites in the sample below
A+	90 to 100	12
A	80 to 89	19
B	66 to 79	25
C	51 to 65	0
D	31 to 50	0
F	0 to 30	0

What audits of 56 real websites found

These are the latest NexusBro audits of 56 third party websites, completed between 10 July 2026 and 9 October 2026. Each site counts once, from its most recent audit in which at least one page answered. NexusBro's own sites and test domains are left out, and no site is named. The audits read 213 pages in total: 4 per site at the median and 16 at most. 46 ran as quick audits without an account and 10 from an account.

Scores ran from 67 to 99, with a median of 81. Of the 56, 12 scored 90 or more, 32 scored from 70 to 89 and 12 scored below 70. No site in the sample scored under 67: since deductions stop at 35 points, a site the crawler can read never scores below 65.

Finding types flagged by the crawler, out of 56 third party websites
Finding	Layer	Sites	Share	What the audit suggests
At least one security header missing (HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy or Permissions-Policy)	Security	52 of 56	93%	Add the headers where the site is served: headers() in next.config.js on Next.js, a _headers file on Netlify or Cloudflare Pages, or the web server config elsewhere.
No behavior analytics script found (Clarity, Hotjar or PostHog)	Conversion	43 of 56	77%	Add a heatmap and session recording tool such as Microsoft Clarity.
No email signup form on the home page	Conversion	40 of 56	71%	Add an email signup form to build an audience and collect leads.
No robots.txt rule that keeps AI training crawlers out	Security	36 of 56	64%	Add Disallow rules for GPTBot, CCBot, anthropic-ai and other AI training crawlers to robots.txt.
No JSON-LD structured data	SEO	35 of 56	63%	Add schema.org markup in JSON-LD so search engines can show rich results.
No traffic analytics script found (GA4, Vercel Analytics, Plausible or Umami)	Conversion	34 of 56	61%	Install GA4, Plausible or Umami in the template every page shares, such as the root layout on Next.js, or Vercel Analytics on a site hosted by Vercel.
Images without width and height, a layout shift risk	Performance	33 of 56	59%	Give every image a width and a height so the page does not jump while it loads.
No call to action inside the content body	Conversion	33 of 56	59%	Add an inline call to action after the second section or after about 500 words.
Title under 30 characters	SEO	32 of 56	57%	Aim for 50 to 60 characters.
No skip link for keyboard users	Accessibility	32 of 56	57%	Add a skip to content link for keyboard users.
No call to action in the top 30% of the page	Conversion	29 of 56	52%	Add a call to action link or button in the hero section or a sticky header.
Meta description under 120 characters	SEO	28 of 56	50%	Aim for 150 to 160 characters.
No og:image for link previews	SEO	27 of 56	48%	Add an Open Graph image of 1200 by 630 pixels for link previews.
No link to a next step anywhere on the page (contact, booking, quote, shop, signup or pricing)	Conversion	27 of 56	48%	Add a clear next step above the fold, inside the content and at the bottom, linking to where visitors contact you, book, buy or sign up.
No call to action near the bottom of the home page	Conversion	25 of 56	45%	Add a call to action after the main content, before related pages.
No canonical tag	SEO	24 of 56	43%	Add a canonical link tag so every duplicate points to one URL.
Heading levels skipped, for example an H1 followed by an H3	Accessibility	23 of 56	41%	Keep heading levels in order without skipping one.
No sticky call to action bar on the home page for phone visitors	Conversion	23 of 56	41%	Add a call to action bar fixed to the bottom of the screen on phones.
A page with fewer than 300 words of text	Content	22 of 56	39%	Expand the page with unique content, such as an FAQ or a how it works section.
A page with no H1	SEO	19 of 56	34%	Add exactly one descriptive H1.
Render blocking scripts in the head	Performance	19 of 56	34%	Add defer or async to scripts the first paint does not need.
New tab links without rel=noopener	Security	18 of 56	32%	Add rel="noopener noreferrer" to every target="_blank" link.
A page with no meta description	SEO	17 of 56	30%	Add a meta description of 150 to 160 characters.
No og:title for link previews	SEO	16 of 56	29%	Add an Open Graph title for social sharing.
Form fields without a label	Accessibility	15 of 56	27%	Add a label element or an aria-label to each field for screen readers.
No favicon	SEO	14 of 56	25%	Add a favicon.
HTTP resources loaded on an HTTPS page	Security	14 of 56	25%	Load every resource over HTTPS.
Open Graph tags incomplete (og:description, og:url or og:type missing)	SEO	13 of 56	23%	Complete the Open Graph tags for rich link previews.
Images without alt text	Accessibility	12 of 56	21%	Add descriptive alt text to every image.
More than one H1 on a page	SEO	11 of 56	20%	Use exactly one H1 per page.
Canonical tag pointing to another domain	SEO	10 of 56	18%	Check that the cross domain canonical is intended: it tells search engines the other domain holds the original page.
More than 10 scripts beyond the framework's own on a page	Performance	9 of 56	16%	Defer scripts the first paint does not need and remove unused libraries. Framework chunks are not counted.
Words repeated unusually often in the body text	SEO	9 of 56	16%	Cut repeated keywords so the text reads naturally. The crawler flags a word density above 2%.
A page with text but no internal links	SEO	8 of 56	14%	Add internal links so crawlers can reach more of the site.
No Sitemap line in robots.txt	SEO	8 of 56	14%	Add a Sitemap line with the sitemap address to robots.txt.
Links with generic text, or empty links without an aria-label	Accessibility	8 of 56	14%	Use link text that says where the link goes, and add an aria-label to icon only links.
No Twitter card tags	SEO	7 of 56	13%	Add a twitter:card meta tag for link previews on X.
A page whose HTML is larger than 500 KB	Performance	7 of 56	13%	Reduce page size: compress the HTML and defer scripts.
Inline scripts with possible errors	Code	6 of 56	11%	Review inline scripts for syntax problems and undefined references.
Analytics script placed in the body instead of the head	Conversion	6 of 56	11%	Place analytics scripts in the head or the root layout so they load first.
A page with a noindex directive	SEO	5 of 56	9%	Remove noindex if the page should appear in search, after checking it is not there on purpose.
Title over 75 characters	SEO	4 of 56	7%	Shorten the title so search results do not cut it off: aim for 50 to 60 characters.
Images with an empty or invalid src	Performance	4 of 56	7%	Fix broken image sources or remove unused img tags.
No lang attribute on the html element	Accessibility	3 of 56	5%	Add a lang attribute to the html element, for example lang="en".
Viewport that blocks pinch zoom	Accessibility	3 of 56	5%	Remove user-scalable=no and maximum-scale=1 so people can pinch to zoom.
A page with no title tag	SEO	2 of 56	4%	Add a unique title tag of 50 to 60 characters.
Tap targets that may be too small on phones	Accessibility	2 of 56	4%	Give every interactive element a touch area of at least 44 by 44 pixels.
A page taking more than 3 seconds to load	Performance	2 of 56	4%	Bring the load time under 3 seconds.
Elements with a positive tabindex, which breaks the tab order	Accessibility	2 of 56	4%	Use tabindex="0" or tabindex="-1" instead of positive values.
Buttons with no visible text or aria-label	Accessibility	2 of 56	4%	Add an aria-label to icon only or empty buttons.
TODO or FIXME left in the page HTML	Content	1 of 56	2%	Remove development comments from production pages.
Title and meta description identical	SEO	1 of 56	2%	Write a title of 50 to 60 characters and a description of 120 to 160 that expands on it.
Lorem ipsum placeholder text	Content	1 of 56	2%	Replace placeholder text with real content.
JavaScript error text in the page HTML	Code	1 of 56	2%	Fix the runtime JavaScript errors.
Links with generic anchor text such as click here or read more	SEO	1 of 56	2%	Use anchor text that describes the destination page.
An API key pattern in the page HTML (Stripe, Google, AWS, GitHub or Slack)	Security	1 of 56	2%	Remove secret keys from the HTML the browser receives.

A site counts once per finding when the crawler flagged it on at least one page. The thresholds are the crawler’s own: a title under 30 characters, a meta description under 120 characters, and fewer than 300 words of text.

A Core Web Vitals line that names both images without width and height and render blocking scripts counts for both. The table leaves out lines that describe a site instead of flagging a problem: a summary of what robots.txt allows and blocks, added whenever a site has a robots.txt file (42 sites), which the score still counts as a low finding, and 3 informational notes that take no points away: a meta description longer than 200 characters (10 sites), a page that builds its content with JavaScript (9 sites) and a page that shows only a few words before its scripts run (1 site).

What the score covers

The score counts every finding the crawler records, whatever its layer: SEO, speed, accessibility, security, content, code, and conversion basics such as calls to action and analytics, all read from the HTML each page returns, its response headers and the site's robots.txt and sitemap. The SEO layer alone runs 64 checks on every site, listed check by check on the website audit page.

Website score questions

What is a good website audit score?

On the NexusBro ladder 90 or more is an A+, 80 to 89 an A, 66 to 79 a B, 51 to 65 a C, 31 to 50 a D; anything below 31 is an F. In the 56 real audits on this page, the median score was 81 and 12 sites reached an A+.

Why did my site lose points with no critical issues?

Small findings add up. Each high finding costs 2 points, each medium one 0.8 and each low one 0.2, so 30 different medium findings cost 24 points on their own. The audit counts each distinct finding message once but adds 1 point for a finding that turns up more times than half the number of pages it fetched, so on a one page audit a medium finding costs 1.8. Deductions stop at 35 points, any finding at all caps the score at 99, and more than 50 findings cap it at 90 even when every finding is minor.

Does a high score mean my site will rank on Google?

No. The score measures what the crawler can verify in a page’s HTML and response headers: tags, structure, speed signals, accessibility and security basics. Rankings also depend on how well a page answers the search and on links from other sites, which the audit does not measure.

How is the SEO score different from the overall score?

The overall score covers every layer of the audit and starts from 100 with deductions. The SEO score comes only from the SEO checks: each check carries points, the score is the share of points earned, and one critical SEO check caps it at 70, three cap it at 40.

Which findings did the audits flag most often?

In order: missing security headers (52 of 56 sites), no behavior analytics script (43), no email signup form on the home page (40), no robots.txt rule against AI training crawlers (36) and no JSON-LD structured data (35). The table above lists every finding type the audits flagged and what the audit suggests for each; the lines under it name the notes it leaves out.

Explore the NexusBro audit library: Website audits · Compare sites · Industry benchmarks · Audit checklists · Stack reports