Scanned sites / creativeplanning.com / 2026-10-03-0347

creativeplanning.com scan from 10/3/2026, 3:47:34 AM

Scan 2026-10-03-0347

Scanned 10/3/2026, 3:47:34 AM, finished 10/3/2026, 9:02:47 AM. Found on page 3 of brave web search results

Site: https://creativeplanning.com/

Download SQLite databaseEvery page and asset from this scan, with the crawl events, in one file.

78/ 100Good

On October 3, 2026 the Site Spider crawled 2008 pages and 1109 assets of creativeplanning.com, starting from https://creativeplanning.com/. It scored 78 out of 100, a good result. 13 of 16 checks found something to fix, led by heavy assets (14), sitemap coverage (1,364), meta descriptions (886); 2 checks passed. Most of the points went to heavy assets (−6), sitemap coverage (−5.2), meta descriptions (−4.5). 1 check found something the score does not count, listed as noted. The list below shows each check's result, the fix plan, when present, explains what to do first, and the security review at the end of the page covers headers, transport, libraries and exposed files.

Security review: Medium3 medium, 1 low and 1 info findings. See the security findings ↓

Pages crawled
2008
Assets fetched
1109
Status
Completed
Checks with issues
13 of 16
CoverageJob finished, partial coverage

3,117 of 3,117 discovered URLs were fetched, 44,868 left out by the 5,000-page and 1,000-asset budget. The job finished, but the crawl did not reach everything it found. HTML only: nothing here ran JavaScript. 300 link destinations on other sites were checked, 3778 left unchecked.

  • Title tags599 issues
    599 of 1364 pages have title issues. 204 noindex or canonicalized pages excluded.
    −3.8 points
  • Meta descriptions886 issues
    886 of 1364 pages have meta description issues. 204 noindex or canonicalized pages excluded.
    −4.5 points
  • Headings4 issues
    4 of 1364 pages have heading issues. 204 noindex or canonicalized pages excluded.
  • Broken links5 issues
    36 internal links point at 5 broken URLs.
    −0.1 points
  • Links to other sites11 issues
    11 destinations answered with an error, 112 could not be determined (timeouts, rate limits or refusals), 3778 were left unchecked by the per-scan cap, of 300 destinations checked.
    −0.3 points
  • Redirects479 issues
    436 redirecting URLs, 66 of them chained.
    −1.2 points
  • Non-200 responses5 issues
    441 URLs did not return a 2xx response. 440 of them are pages, 5 with an error status; the rest are assets or redirects.
  • Rate limitedOK
    The site did not rate limit the crawler.
  • Indexability86 issues
    86 of 1470 indexable pages have indexability warnings. 98 pages noindex by design.
    −0.5 points
  • Image alt text1,324 issues
    1324 of 22108 image references have no alt attribute. 7601 use an empty alt (decorative), which is fine.
    −0.4 points
  • Heavy assets14 issues
    14 assets larger than 500 KB among 1109 fetched assets. 12 documents over that size are listed but not counted: downloads are not page weight.
    −6 points
  • Orphan pages12 issues
    12 pages have no internal links pointing at them.
  • Sitemap coverage1,364 issues
    2 sitemaps listing 0 URLs: 1364 crawled pages missing, 0 listed URLs broken or redirecting, 0 reachable only via the sitemap.
    −5.2 points
  • Internal link countsOK
    Internal link counts for 500 pages.
  • Thin contentOK
    0 of 1364 pages have fewer than 200 words. 204 noindex or canonicalized pages excluded.
  • Duplicate content5 issues
    1 group of pages with identical HTML.

Where this scan sits among all scanned sites

1955 sites, median 80%, average 79%

creativeplanning.com scores 78%, higher than 39% of the 1955 scanned sites. See the full ranking.

0561120%: 0 sites1%: 0 sites2%: 0 sites3%: 0 sites4%: 0 sites5%: 0 sites6%: 0 sites7%: 0 sites8%: 0 sites9%: 0 sites10%: 0 sites11%: 0 sites12%: 0 sites13%: 0 sites14%: 0 sites15%: 0 sites16%: 0 sites17%: 0 sites18%: 0 sites19%: 0 sites20%: 0 sites21%: 1 site22%: 0 sites23%: 0 sites24%: 0 sites25%: 0 sites26%: 0 sites27%: 0 sites28%: 1 site29%: 0 sites30%: 0 sites31%: 0 sites32%: 0 sites33%: 0 sites34%: 0 sites35%: 2 sites36%: 1 site37%: 2 sites38%: 2 sites39%: 1 site40%: 2 sites41%: 2 sites42%: 0 sites43%: 1 site44%: 0 sites45%: 4 sites46%: 3 sites47%: 3 sites48%: 2 sites49%: 6 sites50%: 4 sites51%: 5 sites52%: 8 sites53%: 7 sites54%: 7 sites55%: 4 sites56%: 7 sites57%: 7 sites58%: 15 sites59%: 7 sites60%: 10 sites61%: 12 sites62%: 17 sites63%: 16 sites64%: 11 sites65%: 22 sites66%: 22 sites67%: 37 sites68%: 30 sites69%: 27 sites70%: 39 sites71%: 41 sites72%: 59 sites73%: 53 sites74%: 51 sites75%: 62 sites76%: 78 sites77%: 74 sites78%: 91 sites79%: 72 sites80%: 92 sites81%: 112 sites82%: 86 sites83%: 89 sites84%: 88 sites85%: 72 sites86%: 77 sites87%: 67 sites88%: 66 sites89%: 56 sites90%: 37 sites91%: 38 sites92%: 30 sites93%: 17 sites94%: 13 sites95%: 12 sites96%: 8 sites97%: 8 sites98%: 2 sites99%: 2 sites100%: 55 sites78% here100%90%80%70%60%50%40%30%20%10%0%

Green 90% and up (Excellent), lime 75 to 89 (Good), amber 50 to 74 (Needs work), red below 50 (Poor).

Internal link map

Loading the link map...

Start page (centre)OKRedirectErrorOrphanLinked from most pagesOne inbound link or noneRings = clicks from the start page. Size = inbound links. Drag to pan, scroll to zoom, click a page to see only its links.

Fix plan

Written by gpt-4o-mini from the scan findings

The site has some important issues to address, particularly with broken links and redirects. Prioritize addressing broken links and ensuring titles and meta descriptions are optimized for better SEO performance.

  1. 1

    Fix Broken Links

    Why: Improving your site's internal link structure will enhance user experience and SEO.

    How: Update or remove broken links identified in the crawl.

    Checks: broken-links

  2. 2

    Reduce Redirects

    Why: Minimizing redirects can improve page load speed and user experience.

    How: Evaluate and reduce the number of redirecting URLs, particularly focusing on chained redirects.

    Checks: redirects

  3. 3

    Optimize Title Tags

    Why: Improving title tags can enhance search visibility and click-through rates.

    How: Revise the title tags longer than 60 characters to make them concise and relevant.

    Checks: titles

  4. 4

    Fix Meta Description Issues

    Why: Well-crafted meta descriptions can increase click-through rates from search engine results.

    How: Write compelling meta descriptions for pages that have issues, especially those lacking them.

    Checks: meta-descriptions

  5. 5

    Address Indexability Warnings

    Why: Ensuring proper indexability helps improve visibility in search results.

    How: Review pages flagged with indexability warnings and adjust canonical links as necessary.

    Checks: indexability

  6. 6

    Update Sitemap Coverage

    Why: Including all relevant pages in the sitemap helps search engines index your content.

    How: Revise the sitemap to include all crawled pages and submit it to search engines.

    Checks: sitemap-coverage

Generated automatically; verify each change against your own site before relying on it.

Security review

Written by gpt-4o-mini from 16 checks over the crawl

The website has several security improvements needed, such as missing permissions policies, insecure cookie configurations, and outdated JavaScript libraries. Addressing these vulnerabilities is crucial to enhance protection against potential attacks.

  • 0 high
  • 3 medium
  • 1 low
  • 1 info
  1. 1

    Insecure Cookie FlagsMedium

    Why it matters: Cookies lack HttpOnly, Secure, and SameSite flags, leaving them vulnerable to access via malicious scripts.

    Fix: Update cookie settings to include `HttpOnly`, `Secure`, and `SameSite` attributes (e.g., `Set-Cookie: handl_landing_page=<value>; HttpOnly; Secure; SameSite=Strict`).

    Evidence: Cookie flags

  2. 2

    Outdated JavaScript LibrariesMedium

    Why it matters: Using jQuery versions 3.1.2 and 3.1.3 with known vulnerabilities could expose the site to attacks.

    Fix: Upgrade jQuery to at least version 3.5.0 to mitigate these vulnerabilities.

    Evidence: Vulnerable JavaScript libraries

  3. 3

    Leaked Google API KeyMedium

    Why it matters: A Google API key found in the code poses a risk of misuse if not properly restricted.

    Fix: Restrict the key's usage by setting appropriate referrer controls in the Google Cloud console.

    Evidence: Keys and secrets in page code

  4. 4

    Software Version DisclosureLow

    Why it matters: Server responses expose version information, aiding attackers in identifying vulnerabilities.

    Fix: Configure server to hide version information (e.g., remove `X-Powered-By` header and server information).

    Evidence: Software version disclosure

  5. 5

    Missing Permissions PolicyInfo

    Why it matters: 33 pages lack a permissions-policy header, increasing the risk of unauthorized access to sensitive browser features.

    Fix: Set a `Permissions-Policy` header to disable unused features (e.g., `Permissions-Policy: geolocation=(), microphone=(), camera=()`).

    Evidence: Permissions policy

What the checks found

  • FoundPermissions policyInfo

    33 of 1568 HTML pages send permissions-policy. A Permissions-Policy header turns off browser features the site does not use (camera, microphone, geolocation), limiting what an injected script could do.

    • https://creativeplanning.com/family-office/ → no permissions-policy
    • https://creativeplanning.com/family-office/ultra-affluent-wealth-management/ → no permissions-policy
    • https://creativeplanning.com/family-office/legacy-planning/ → no permissions-policy
    • https://creativeplanning.com/family-office/charitable-planning/ → no permissions-policy
    • https://creativeplanning.com/private-wealth-management/insurance/ → no permissions-policy
    • https://creativeplanning.com/family-office/wealth-transfer/ → no permissions-policy
    • https://creativeplanning.com/family-office/exit-planning/ → no permissions-policy
    • https://creativeplanning.com/business/valuation-services/ → no permissions-policy
    • https://creativeplanning.com/family-office/bill-pay/ → no permissions-policy
    • https://creativeplanning.com/family-office/family-governance/ → no permissions-policy
    • https://creativeplanning.com/family-office/social-impact/ → no permissions-policy
    • https://creativeplanning.com/family-office/philanthropy/ → no permissions-policy
  • FoundSoftware version disclosureLow

    Responses reveal the exact server or framework version, which lets an attacker look up known vulnerabilities for it without guessing.

    • server: nginx (3114 responses)
    • x-powered-by: WP Engine (29 responses)
    • server: awselb/2.0 (2 responses)
    • server: CloudFront (1 response)
  • FoundCookie flagsMedium

    9 of 9 cookies are missing protective flags. Without HttpOnly a script can read the cookie; without Secure it travels over plain HTTP; without SameSite it is sent on cross-site requests.

    • handl_landing_page (set by https://creativeplanning.com/?s=social+security) lacks HttpOnly
    • handl_ip (set by https://creativeplanning.com/?s=social+security) lacks HttpOnly
    • handl_url_base (set by https://creativeplanning.com/?s=social+security) lacks HttpOnly
    • handl_url (set by https://creativeplanning.com/?s=social+security) lacks HttpOnly
    • user_agent (set by https://creativeplanning.com/?s=social+security) lacks HttpOnly
    • handl_original_ref (set by https://creativeplanning.com/?s=roth+ira) lacks HttpOnly
    • handl_ref (set by https://creativeplanning.com/?s=roth+ira) lacks HttpOnly
    • organic_source (set by https://creativeplanning.com/?s=roth+ira) lacks HttpOnly
    • organic_source_str (set by https://creativeplanning.com/?s=roth+ira) lacks HttpOnly
  • FoundVulnerable JavaScript librariesMedium

    2 libraries with published vulnerabilities: jQuery 3.1.2, jQuery 3.1.3. Whether they are exploitable depends on how the site uses them, but each has a fixed release.

    • jQuery 3.1.2 in https://creativeplanning.com/wp-content/plugins/gravityforms/js/placeholders.jq…: CVE-2019-11358 (prototype pollution), CVE-2020-11022, CVE-2020-11023 (XSS via HTML passed to DOM methods); fixed in 3.5.0
    • jQuery 3.1.3 in https://creativeplanning.com/wp-content/plugins/gravityforms/js/placeholders.jq…: CVE-2019-11358 (prototype pollution), CVE-2020-11022, CVE-2020-11023 (XSS via HTML passed to DOM methods); fixed in 3.5.0
  • FoundKeys and secrets in page codeMedium

    1 credential-like value found in code served to every visitor: Google API key.

    • Google API key AIzaSy…UY (39 chars) in https://creativeplanning.com/family-office/: browser keys are expected in pages, but must be restricted by HTTP referrer and API in the Google Cloud console
  • NoteContent Security Policy

    A Content-Security-Policy is set, but it allows inline or eval scripts ('unsafe-inline' / 'unsafe-eval'), which removes most of its protection against injected scripts.

    • https://creativeplanning.com/family-office/ → default-src 'self' *.creativeplanning.com creativeplanning.com cp2026dev.wpenginepowered.com cp20221dev.wpengine.com *.doubleclick.net *.creativeplanning-testing.g43labs.net; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.mgln.ai mgln.ai *.tealiumiq.com tealiumiq.com *.tiqcdn.com tiqcdn.com
    • https://creativeplanning.com/family-office/ultra-affluent-wealth-management/ → default-src 'self' *.creativeplanning.com creativeplanning.com cp2026dev.wpenginepowered.com cp20221dev.wpengine.com *.doubleclick.net *.creativeplanning-testing.g43labs.net; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.mgln.ai mgln.ai *.tealiumiq.com tealiumiq.com *.tiqcdn.com tiqcdn.com
    • https://creativeplanning.com/family-office/legacy-planning/ → default-src 'self' *.creativeplanning.com creativeplanning.com cp2026dev.wpenginepowered.com cp20221dev.wpengine.com *.doubleclick.net *.creativeplanning-testing.g43labs.net; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.mgln.ai mgln.ai *.tealiumiq.com tealiumiq.com *.tiqcdn.com tiqcdn.com
    • https://creativeplanning.com/family-office/charitable-planning/ → default-src 'self' *.creativeplanning.com creativeplanning.com cp2026dev.wpenginepowered.com cp20221dev.wpengine.com *.doubleclick.net *.creativeplanning-testing.g43labs.net; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.mgln.ai mgln.ai *.tealiumiq.com tealiumiq.com *.tiqcdn.com tiqcdn.com
    • https://creativeplanning.com/private-wealth-management/insurance/ → default-src 'self' *.creativeplanning.com creativeplanning.com cp2026dev.wpenginepowered.com cp20221dev.wpengine.com *.doubleclick.net *.creativeplanning-testing.g43labs.net; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.mgln.ai mgln.ai *.tealiumiq.com tealiumiq.com *.tiqcdn.com tiqcdn.com
    • https://creativeplanning.com/family-office/wealth-transfer/ → default-src 'self' *.creativeplanning.com creativeplanning.com cp2026dev.wpenginepowered.com cp20221dev.wpengine.com *.doubleclick.net *.creativeplanning-testing.g43labs.net; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.mgln.ai mgln.ai *.tealiumiq.com tealiumiq.com *.tiqcdn.com tiqcdn.com
    • https://creativeplanning.com/family-office/exit-planning/ → default-src 'self' *.creativeplanning.com creativeplanning.com cp2026dev.wpenginepowered.com cp20221dev.wpengine.com *.doubleclick.net *.creativeplanning-testing.g43labs.net; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.mgln.ai mgln.ai *.tealiumiq.com tealiumiq.com *.tiqcdn.com tiqcdn.com
    • https://creativeplanning.com/business/valuation-services/ → default-src 'self' *.creativeplanning.com creativeplanning.com cp2026dev.wpenginepowered.com cp20221dev.wpengine.com *.doubleclick.net *.creativeplanning-testing.g43labs.net; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.mgln.ai mgln.ai *.tealiumiq.com tealiumiq.com *.tiqcdn.com tiqcdn.com
    • https://creativeplanning.com/family-office/bill-pay/ → default-src 'self' *.creativeplanning.com creativeplanning.com cp2026dev.wpenginepowered.com cp20221dev.wpengine.com *.doubleclick.net *.creativeplanning-testing.g43labs.net; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.mgln.ai mgln.ai *.tealiumiq.com tealiumiq.com *.tiqcdn.com tiqcdn.com
    • https://creativeplanning.com/family-office/family-governance/ → default-src 'self' *.creativeplanning.com creativeplanning.com cp2026dev.wpenginepowered.com cp20221dev.wpengine.com *.doubleclick.net *.creativeplanning-testing.g43labs.net; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.mgln.ai mgln.ai *.tealiumiq.com tealiumiq.com *.tiqcdn.com tiqcdn.com
    • https://creativeplanning.com/family-office/social-impact/ → default-src 'self' *.creativeplanning.com creativeplanning.com cp2026dev.wpenginepowered.com cp20221dev.wpengine.com *.doubleclick.net *.creativeplanning-testing.g43labs.net; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.mgln.ai mgln.ai *.tealiumiq.com tealiumiq.com *.tiqcdn.com tiqcdn.com
    • https://creativeplanning.com/family-office/philanthropy/ → default-src 'self' *.creativeplanning.com creativeplanning.com cp2026dev.wpenginepowered.com cp20221dev.wpengine.com *.doubleclick.net *.creativeplanning-testing.g43labs.net; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.mgln.ai mgln.ai *.tealiumiq.com tealiumiq.com *.tiqcdn.com tiqcdn.com
  • NoteThird-party scripts

    Scripts run from 3 other domains without Subresource Integrity, so a compromise of any of them changes what runs on this site. (Tag managers and analytics rarely support SRI; a Content-Security-Policy that names these hosts is the usual control.)

    • cdn.userway.org (38 script tags)
    • maps.googleapis.com (33 script tags)
    • assets.calendly.com (33 script tags)
  • NoteSensitive paths in robots.txt

    robots.txt lists 1 path that look private. robots.txt is public and does not restrict access, so it doubles as a map for anyone probing the site; those paths need real access control.

    • Disallow: /wp-admin/
8 checks passed
  • OKHTTPS

    All 1568 crawled pages were served over HTTPS.

  • OKHTTP Strict Transport Security

    strict-transport-security is set on all 1568 HTML pages.

  • OKClickjacking protection

    x-frame-options is set on all 1568 HTML pages.

  • OKMIME sniffing protection

    x-content-type-options is set on all 1568 HTML pages.

  • OKReferrer policy

    referrer-policy is set on all 1568 HTML pages.

  • OKMixed content

    No HTTPS page loads a script, stylesheet, font or image over plain HTTP.

  • OKForms over HTTPS

    270 forms found, all on HTTPS pages posting to HTTPS addresses.

  • OKExposed files and listings

    None of the crawled URLs is a configuration file, backup, dump, repository folder or directory listing.

A passive review of what the crawl recorded: response headers, page and script contents and the URLs it found. It does not probe the site, test TLS settings or look for files that were not linked. Generated automatically; verify each finding against your own site before acting on it.

Sites scoring near creativeplanning.com

Their neighbours in the SEO rank table, which orders every scanned site by health score.

This report was produced by the DIY SEO Hub Site Spider crawling creativeplanning.com from its pages as published, the way a search engine does. It shows summary figures only.

Own creativeplanning.com?

  • Claim this site to manage the listing, hide it from the public lists, or keep it.
  • Want it gone instead? Ask through the support form or e-mail support@diyseohub.com, naming creativeplanning.com. Removal needs no account and no proof of purchase.
creativeplanning.com scan 2026-10-03-0347 | DIY SEO Hub