Scanned sites / moz.com / 2026-09-26-0309

moz.com scan from 9/26/2026, 3:09:34 AM

Scan 2026-09-26-0309

Scanned 9/26/2026, 3:09:34 AM, finished 9/26/2026, 8:54:40 AM. Found with 42backlinks.com tool directory

Site: https://moz.com/

Download SQLite databaseEvery page and asset from this scan, with the crawl events, in one file.

87/ 100Good

On September 26, 2026 the Site Spider crawled 4961 pages and 1073 assets of moz.com, starting from https://moz.com/. It scored 87 out of 100, a good result. 11 of 14 checks found something to fix, led by image alt text (8351), title tags (500), meta descriptions (500); 3 checks passed. The list below shows each check's result, the fix plan, when present, explains what to do first, and the security review at the end of the page covers headers, transport, libraries and exposed files.

Security review: Medium4 medium, 1 low and 1 info findings. See the security findings ↓

Pages crawled
4961
Assets fetched
1073
Status
Completed
Checks with issues
11 of 14
  • Title tags500 issues
    1345 of 2648 pages have title issues. 869 noindex or canonicalized pages excluded.
  • Meta descriptions500 issues
    1869 of 2648 pages have meta description issues. 869 noindex or canonicalized pages excluded.
  • Headings500 issues
    1128 of 2648 pages have heading issues. 869 noindex or canonicalized pages excluded.
  • Broken links19 issues
    20575 internal links point at 632 broken URLs.
  • Redirects494 issues
    822 redirecting URLs, 6 of them chained.
  • Non-200 responsesOK
    1468 URLs did not return a 2xx response.
  • Rate limitedOK
    The site did not rate limit the crawler.
  • Indexability222 issues
    222 of 2812 indexable pages have indexability warnings. 705 pages noindex by design.
  • Image alt text8351 issues
    8351 of 55611 image references have no alt attribute. 2773 use an empty alt (decorative), which is fine.
  • Heavy assets117 issues
    100 assets larger than 500 KB among the 100 heaviest.
  • Orphan pages50 issues
    50 pages have no internal links pointing at them.
  • Sitemap coverage500 issues
    2 sitemaps listing 0 URLs: 2648 crawled pages missing, 0 listed URLs broken or redirecting, 0 reachable only via the sitemap.
  • Thin content21 issues
    21 of 2648 pages have fewer than 200 words. 869 noindex or canonicalized pages excluded.
  • Duplicate contentOK
    0 groups of pages with identical HTML.

Where this scan sits among all scanned sites

1279 sites, median 82%, average 80%

moz.com scores 87%, higher than 69% of the 1279 scanned sites. See the full ranking.

035690%: 0 sites1%: 0 sites2%: 0 sites3%: 0 sites4%: 0 sites5%: 0 sites6%: 0 sites7%: 0 sites8%: 0 sites9%: 0 sites10%: 0 sites11%: 0 sites12%: 0 sites13%: 0 sites14%: 0 sites15%: 0 sites16%: 0 sites17%: 0 sites18%: 0 sites19%: 0 sites20%: 0 sites21%: 1 site22%: 0 sites23%: 0 sites24%: 0 sites25%: 0 sites26%: 0 sites27%: 0 sites28%: 1 site29%: 0 sites30%: 0 sites31%: 0 sites32%: 0 sites33%: 0 sites34%: 0 sites35%: 1 site36%: 1 site37%: 0 sites38%: 0 sites39%: 0 sites40%: 0 sites41%: 0 sites42%: 0 sites43%: 0 sites44%: 0 sites45%: 3 sites46%: 2 sites47%: 1 site48%: 1 site49%: 0 sites50%: 3 sites51%: 4 sites52%: 4 sites53%: 4 sites54%: 4 sites55%: 2 sites56%: 2 sites57%: 3 sites58%: 8 sites59%: 4 sites60%: 7 sites61%: 9 sites62%: 12 sites63%: 5 sites64%: 9 sites65%: 10 sites66%: 10 sites67%: 16 sites68%: 29 sites69%: 14 sites70%: 26 sites71%: 25 sites72%: 29 sites73%: 28 sites74%: 33 sites75%: 30 sites76%: 41 sites77%: 42 sites78%: 40 sites79%: 38 sites80%: 52 sites81%: 59 sites82%: 56 sites83%: 53 sites84%: 61 sites85%: 54 sites86%: 49 sites87%: 55 sites88%: 60 sites89%: 47 sites90%: 69 sites91%: 42 sites92%: 27 sites93%: 20 sites94%: 19 sites95%: 11 sites96%: 11 sites97%: 4 sites98%: 3 sites99%: 2 sites100%: 23 sites87% here100%90%80%70%60%50%40%30%20%10%0%

Green 90% and up (Excellent), lime 75 to 89 (Good), amber 50 to 74 (Needs work), red below 50 (Poor).

Internal link map

Loading the link map...

Start page (centre)OKRedirectErrorOrphanLinked from most pagesOne inbound link or noneRings = clicks from the start page. Size = inbound links. Drag to pan, scroll to zoom, click a page to see only its links.

Fix plan

Written by gpt-4o-mini from the scan findings

Fixing the broken links and improving redirects will significantly enhance user experience. Additionally, addressing title and meta description issues will boost SEO performance. The sitemap requires updates for better coverage. Consider optimizing alt text for images.

  1. 1

    Fix Broken Links

    Why: 20575 internal links point to broken URLs, harming user experience.

    How: Identify broken URLs and either fix them or remove links pointing to them.

    Checks: broken-links

  2. 2

    Reduce Redirects

    Why: 822 URLs are redirecting, which can slow down page loading.

    How: Consolidate unnecessary redirects and fix chained redirects.

    Checks: redirects

  3. 3

    Resolve Non-200 Responses

    Why: 1468 URLs returned errors, leading to poor site performance.

    How: Update or remove URLs that do not respond with a 2xx status.

    Checks: status-codes

  4. 4

    Improve Title Tags

    Why: 1345 pages have title issues, affecting SEO and visibility.

    How: Rewrite titles to be unique and within 30-60 characters.

    Checks: titles

  5. 5

    Enhance Meta Descriptions

    Why: 1869 pages have meta description issues, hurting click-through rates.

    How: Create compelling meta descriptions for all pages, under 160 characters.

    Checks: meta-descriptions

  6. 6

    Update Sitemap Coverage

    Why: Sitemaps list 0 URLs of crawled pages, affecting search engine indexing.

    How: Ensure all crawled pages are included in the sitemap and resubmit to search engines.

    Checks: sitemap-coverage

Generated automatically; verify each change against your own site before relying on it.

Security review

Written by gpt-4o-mini from 16 checks over the crawl

The security review of moz.com highlights areas for improvement to enhance the website's protection against common web vulnerabilities. Key findings include missing security headers, improper cookie flags, and usage of outdated libraries. Addressing these issues will help safeguard user data and improve overall security posture.

  • 0 high
  • 4 medium
  • 1 low
  • 1 info
  1. 1

    Cookies Lacking Protective FlagsMedium

    Why it matters: Cookies that lack Secure, HttpOnly, and SameSite attributes are vulnerable to attacks like cross-site scripting.

    Fix: Set flags: 'Secure', 'HttpOnly', and 'SameSite=Strict' for all cookies.

    Evidence: Cookie flags

  2. 2

    Mixed Content on Secure PagesMedium

    Why it matters: Loading resources over HTTP on HTTPS pages can expose users to security risks, including potential content tampering.

    Fix: Change all HTTP resource URLs to HTTPS to ensure secure loading.

    Evidence: Mixed content

  3. 3

    Vulnerable jQuery Library DetectedMedium

    Why it matters: Using an outdated version of jQuery (1.9.1) may expose the site to known vulnerabilities.

    Fix: Upgrade jQuery to version 3.5.0 or later to mitigate known vulnerabilities.

    Evidence: Vulnerable JavaScript libraries

  4. 4

    Exposed Google API KeyMedium

    Why it matters: An exposed API key can lead to unauthorized access and misuse of services.

    Fix: Restrict the API key in the Google Cloud console based on HTTP referrer and context of use.

    Evidence: Keys and secrets in page code

  5. 5

    Missing X-Content-Type-Options HeaderLow

    Why it matters: Without this header, browsers may incorrectly interpret files based on contents, leading to potential XSS attacks.

    Fix: Implement 'X-Content-Type-Options: nosniff' in response headers for all HTML pages.

    Evidence: MIME sniffing protection

  6. 6

    No Permissions-Policy HeaderInfo

    Why it matters: Lacking this header can leave browser features open to misuse by potential injected scripts.

    Fix: Add a 'Permissions-Policy' header to HTML pages to limit unused features.

    Evidence: Permissions policy

What the checks found

  • FoundMIME sniffing protectionLow

    3420 of 3517 HTML pages send x-content-type-options. Without X-Content-Type-Options: nosniff a browser may run a file as a script because of its contents rather than its declared type.

    • https://moz.com/login → no x-content-type-options
    • https://moz.com/mozcast → no x-content-type-options
    • https://moz.com/api/docs → no x-content-type-options
    • https://moz.com/api/dashboard/usage → no x-content-type-options
    • https://moz.com/freemium/keyword-explorer → no x-content-type-options
    • https://moz.com/freemium/competitive-research → no x-content-type-options
    • https://moz.com/community/join → no x-content-type-options
    • https://moz.com/freemium/local/check-listing → no x-content-type-options
    • https://moz.com/subscriptions → no x-content-type-options
    • https://moz.com/freemium/brand-authority-freemium-form → no x-content-type-options
    • https://moz.com/api/docs/welcome → no x-content-type-options
    • https://moz.com/api/dashboard → no x-content-type-options
  • FoundPermissions policyInfo

    No HTML page sends permissions-policy. A Permissions-Policy header turns off browser features the site does not use (camera, microphone, geolocation), limiting what an injected script could do.

    • https://moz.com/ → no permissions-policy
    • https://moz.com/products/pro → no permissions-policy
    • https://moz.com/products/local → no permissions-policy
    • https://moz.com/products/stat → no permissions-policy
    • https://moz.com/products/api → no permissions-policy
    • https://moz.com/products → no permissions-policy
    • https://moz.com/moz-data → no permissions-policy
    • https://moz.com/explorer → no permissions-policy
    • https://moz.com/link-explorer → no permissions-policy
    • https://moz.com/competitive-research → no permissions-policy
    • https://moz.com/products/pro/seo-toolbar → no permissions-policy
    • https://moz.com/free-seo-tools → no permissions-policy
  • FoundCookie flagsMedium

    121 of 124 cookies are missing protective flags. Without HttpOnly a script can read the cookie; without Secure it travels over plain HTTP; without SameSite it is sent on cross-site requests.

    • 26 Sep 2026 08:48:27 GMT (set by https://moz.com/images/assets/features/[email protected]…) lacks Secure, HttpOnly, SameSite
    • 26 Sep 2026 04:00:28 GMT (set by https://moz.com/community/users/24685215) lacks Secure, HttpOnly, SameSite
    • 26 Sep 2026 04:06:25 GMT (set by https://moz.com/community/users/22184103) lacks Secure, HttpOnly, SameSite
    • SERVD_LOGGED_IN_STATUS (set by https://moz.com/generative-engine-optimization) lacks Secure
    • 26 Sep 2026 04:12:01 GMT (set by https://moz.com/generative-engine-optimization) lacks Secure, HttpOnly, SameSite
    • 26 Sep 2026 09:11:18 GMT (set by https://moz.com/images/blog/banners/Brand-Entity-SEO-Blog_Header.png?w=640&auto…) lacks Secure, HttpOnly, SameSite
    • 26 Sep 2026 09:11:57 GMT (set by https://moz.com/images/assets/CTAs/Illustrations/Brand-Authority.png?w=290&h=20…) lacks Secure, HttpOnly, SameSite
    • 26 Sep 2026 09:12:23 GMT (set by https://moz.com/mozcast/img/mozcast-social.png) lacks Secure, HttpOnly, SameSite
    • 26 Sep 2026 09:13:30 GMT (set by https://moz.com/about/49.281392)/-123.120398) lacks Secure, HttpOnly, SameSite
    • 26 Sep 2026 09:13:31 GMT (set by https://moz.com/about/15) lacks Secure, HttpOnly, SameSite
    • 26 Sep 2026 09:13:32 GMT (set by https://moz.com/about/0/640x480?access_token=pk.eyJ1IjoiamFrZW1veiIsImEiOiJjbDF…) lacks Secure, HttpOnly, SameSite
    • 26 Sep 2026 04:27:27 GMT (set by https://moz.com/community/q/user/tom-capper) lacks Secure, HttpOnly, SameSite
  • FoundMixed contentMedium

    47 resources on HTTPS pages are loaded over plain HTTP, 2 of them scripts or stylesheets that browsers block or that can be tampered with in transit.

    • https://moz.com/about/team/funnylookinhat loads image http://i.imgur.com/ctECATe.gif
    • https://moz.com/about/team/funnylookinhat loads image http://i.imgur.com/8knHvsl.gif
    • https://moz.com/blog/google-instant-fewer-changes-to-seo-than-the-ave… loads image http://blog.conductor.com/wp-content/uploads/2010/09/Research-visits-search-term-length-5…
    • https://moz.com/blog/how-to-build-a-facebook-group loads image http://www.searchenginejournal.com/wp-content/uploads/2015/10/facebook-traffic-380x239.png
    • https://moz.com/blog/how-to-build-a-facebook-group loads image http://www.searchenginejournal.com/wp-content/uploads/2015/10/Screen-Shot-2015-10-15-at-8…
    • https://moz.com/blog/how-to-build-a-facebook-group loads image http://www.searchenginejournal.com/wp-content/uploads/2015/10/IMG_1055-380x310.png
    • https://moz.com/blog/how-to-build-a-facebook-group loads image http://www.searchenginejournal.com/wp-content/uploads/2015/10/facebook-group-reach-760x27…
    • https://moz.com/blog/how-to-build-a-facebook-group loads image http://www.searchenginejournal.com/wp-content/uploads/2015/10/Screen-Shot-2015-10-15-at-9…
    • https://moz.com/blog/how-to-build-a-facebook-group loads image http://www.searchenginejournal.com/wp-content/uploads/2015/10/Screen-Shot-2015-10-16-at-9…
    • https://moz.com/blog/how-to-build-a-facebook-group loads image http://www.searchenginejournal.com/wp-content/uploads/2015/10/Screen-Shot-2015-10-15-at-8…
    • https://moz.com/blog/how-to-build-a-facebook-group loads image http://www.searchenginejournal.com/wp-content/uploads/2015/10/Screen-Shot-2015-10-16-at-9…
    • https://moz.com/blog/how-to-build-a-facebook-group loads image http://www.searchenginejournal.com/wp-content/uploads/2015/10/Screen-Shot-2015-10-16-at-1…
  • FoundVulnerable JavaScript librariesMedium

    1 library with published vulnerabilities: jQuery 1.9.1. Whether they are exploitable depends on how the site uses them, but each has a fixed release.

    • jQuery 1.9.1 in https://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js: CVE-2015-9251 (XSS via cross-domain AJAX), CVE-2019-11358 (prototype pollution), CVE-2020-11022, CVE-2020-11023 (XSS via HTML passed to DOM methods); fixed in 3.5.0
  • FoundKeys and secrets in page codeMedium

    1 credential-like value found in code served to every visitor: Google API key.

    • Google API key AIzaSy…gM (39 chars) in https://moz.com/_next/static/chunks/app/layout-dea6d359a06f19f0.js: browser keys are expected in pages, but must be restricted by HTTP referrer and API in the Google Cloud console
  • NoteSoftware version disclosure

    Responses name the framework in an X-Powered-By header but hide the version.

    • server: cloudflare (6034 responses)
    • x-powered-by: NodeBB (1553 responses)
  • NoteThird-party scripts

    Scripts run from 6 other domains without Subresource Integrity, so a compromise of any of them changes what runs on this site. (Tag managers and analytics rarely support SRI; a Content-Security-Policy that names these hosts is the usual control.)

    • cloud.wordlift.io (39 script tags)
    • cdn.ziffstatic.com (39 script tags)
    • moz-static.moz.com (156 script tags)
    • static.cloudflareinsights.com (39 script tags)
    • fast.wistia.com (12 script tags)
    • js.hsforms.net (8 script tags)
  • NoteSensitive paths in robots.txt

    robots.txt lists 1 path that look private. robots.txt is public and does not restrict access, so it doubles as a map for anyone probing the site; those paths need real access control.

    • Disallow: /admin-preview/*
7 checks passed
  • OKHTTPS

    All 3517 crawled pages were served over HTTPS.

  • OKHTTP Strict Transport Security

    strict-transport-security is set on all 3517 HTML pages.

  • OKContent Security Policy

    A Content-Security-Policy is set on 1197 of 3517 pages.

  • OKClickjacking protection

    x-frame-options is set on all 3517 HTML pages.

  • OKReferrer policy

    A referrer policy is set through a <meta name="referrer"> tag.

  • OKForms over HTTPS

    43 forms found, all on HTTPS pages posting to HTTPS addresses.

  • OKExposed files and listings

    None of the crawled URLs is a configuration file, backup, dump, repository folder or directory listing.

A passive review of what the crawl recorded: response headers, page and script contents and the URLs it found. It does not probe the site, test TLS settings or look for files that were not linked. Generated automatically; verify each finding against your own site before acting on it.

Sites scoring near moz.com

Their neighbours in the SEO rank table, which orders every scanned site by health score.

This report was produced by the DIY SEO Hub Site Spider crawling moz.com from its pages as published, the way a search engine does. It shows summary figures only.

Own moz.com?

moz.com scan 2026-09-26-0309 | DIY SEO Hub