Scanned sites / moz.com / 2026-09-29-0856

moz.com scan from 9/29/2026, 8:56:26 AM

Scan 2026-09-29-0856

Scanned 9/29/2026, 8:56:26 AM, finished 9/29/2026, 11:45:17 AM. Found with 42backlinks.com tool directory

Site: https://moz.com/

Download SQLite databaseEvery page and asset from this scan, with the crawl events, in one file.

71/ 100Needs work

On September 29, 2026 the Site Spider crawled 4895 pages and 1065 assets of moz.com, starting from https://moz.com/. It scored 71 out of 100, a result that needs work. 14 of 16 checks found something to fix, led by heavy assets (132), meta descriptions (2,189), sitemap coverage (2,621); 1 check passed. Most of the points went to heavy assets (−6), meta descriptions (−4.9), sitemap coverage (−4.4). 1 check found something the score does not count, listed as noted. The list below shows each check's result, the fix plan, when present, explains what to do first, and the security review at the end of the page covers headers, transport, libraries and exposed files.

Security review: Medium4 medium, 1 low and 1 info findings. See the security findings ↓

Pages crawled
4895
Assets fetched
1065
Status
Completed
Checks with issues
14 of 16
CoverageJob finished, partial coverage

5,960 of 6,000 discovered URLs were fetched, 40 blocked by robots.txt, 57,001 left out by the 5,000-page and 1,000-asset budget. The job finished, but the crawl did not reach everything it found. HTML only: nothing here ran JavaScript. 300 link destinations on other sites were checked, 14000 left unchecked.

  • Title tags1,297 issues
    1297 of 2621 pages have title issues. 938 noindex or canonicalized pages excluded.
    −3.6 points
  • Meta descriptions2,189 issues
    2189 of 2621 pages have meta description issues. 938 noindex or canonicalized pages excluded.
    −4.9 points
  • Headings1,162 issues
    1162 of 2621 pages have heading issues. 938 noindex or canonicalized pages excluded.
    −2 points
  • Broken links624 issues
    21477 internal links point at 624 broken URLs.
    −3.5 points
  • Links to other sites29 issues
    29 destinations answered with an error, 101 could not be determined (timeouts, rate limits or refusals), 14000 were left unchecked by the per-scan cap, of 300 destinations checked.
    −0.3 points
  • Redirects715 issues
    726 redirecting URLs, 6 of them chained.
    −0.8 points
  • Non-200 responses625 issues
    1380 URLs did not return a 2xx response. 1336 of them are pages, 625 with an error status; the rest are assets or redirects.
    −1.8 points
  • Rate limitedOK
    The site did not rate limit the crawler.
  • Indexability248 issues
    248 of 2772 indexable pages have indexability warnings. 787 pages noindex by design.
    −0.7 points
  • Image alt text8,063 issues
    8063 of 56035 image references have no alt attribute. 2733 use an empty alt (decorative), which is fine.
    −0.9 points
  • Heavy assets132 issues
    132 assets larger than 500 KB among 1065 fetched assets.
    −6 points
  • Orphan pages37 issues
    37 pages have no internal links pointing at them.
  • Sitemap coverage2,621 issues
    2 sitemaps listing 0 URLs: 2621 crawled pages missing, 0 listed URLs broken or redirecting, 0 reachable only via the sitemap.
    −4.4 points
  • Internal link countsOK
    Internal link counts for 500 pages.
  • Thin content21 issues
    21 of 2621 pages have fewer than 200 words. 938 noindex or canonicalized pages excluded.
  • Duplicate content4 issues
    2 groups of pages with identical HTML.

Where this scan sits among all scanned sites

1356 sites, median 80%, average 79%

moz.com scores 71%, higher than 18% of the 1356 scanned sites. See the full ranking.

039780%: 0 sites1%: 0 sites2%: 0 sites3%: 0 sites4%: 0 sites5%: 0 sites6%: 0 sites7%: 0 sites8%: 0 sites9%: 0 sites10%: 0 sites11%: 0 sites12%: 0 sites13%: 0 sites14%: 0 sites15%: 0 sites16%: 0 sites17%: 0 sites18%: 0 sites19%: 0 sites20%: 0 sites21%: 1 site22%: 0 sites23%: 0 sites24%: 0 sites25%: 0 sites26%: 0 sites27%: 0 sites28%: 1 site29%: 0 sites30%: 0 sites31%: 0 sites32%: 0 sites33%: 0 sites34%: 0 sites35%: 1 site36%: 1 site37%: 1 site38%: 1 site39%: 0 sites40%: 1 site41%: 0 sites42%: 0 sites43%: 0 sites44%: 0 sites45%: 3 sites46%: 2 sites47%: 2 sites48%: 2 sites49%: 2 sites50%: 3 sites51%: 5 sites52%: 6 sites53%: 5 sites54%: 5 sites55%: 4 sites56%: 3 sites57%: 5 sites58%: 9 sites59%: 5 sites60%: 8 sites61%: 10 sites62%: 14 sites63%: 12 sites64%: 8 sites65%: 14 sites66%: 14 sites67%: 27 sites68%: 24 sites69%: 14 sites70%: 32 sites71%: 29 sites72%: 39 sites73%: 33 sites74%: 41 sites75%: 40 sites76%: 49 sites77%: 45 sites78%: 59 sites79%: 48 sites80%: 68 sites81%: 78 sites82%: 67 sites83%: 62 sites84%: 60 sites85%: 45 sites86%: 49 sites87%: 47 sites88%: 50 sites89%: 36 sites90%: 29 sites91%: 31 sites92%: 19 sites93%: 9 sites94%: 10 sites95%: 5 sites96%: 7 sites97%: 3 sites98%: 1 site99%: 2 sites100%: 50 sites71% here100%90%80%70%60%50%40%30%20%10%0%

Green 90% and up (Excellent), lime 75 to 89 (Good), amber 50 to 74 (Needs work), red below 50 (Poor).

Internal link map

Loading the link map...

Start page (centre)OKRedirectErrorOrphanLinked from most pagesOne inbound link or noneRings = clicks from the start page. Size = inbound links. Drag to pan, scroll to zoom, click a page to see only its links.

Fix plan

Written by gpt-4o-mini from the scan findings

Your website has several critical issues, including broken links and redirects. Prioritize addressing these for better SEO performance. Focus on fixing internal links and updating your sitemap.

  1. 1

    Fix Broken Links

    Why: Broken links degrade user experience and SEO rankings.

    How: Identify and update or remove the broken URLs within your internal links.

    Checks: broken-links

  2. 2

    Resolve Redirects

    Why: Excessive redirects can slow down page loading and confuse users.

    How: Review and streamline the redirect chains, replacing them with direct links where possible.

    Checks: redirects

  3. 3

    Update Sitemap Coverage

    Why: Many pages are missing from your sitemap, impacting discoverability.

    How: Add the 2621 missing URLs to your sitemap to improve indexing.

    Checks: sitemap-coverage

  4. 4

    Address Title Tags Issues

    Why: Unoptimized title tags weaken search engine visibility.

    How: Revise title tags for affected pages to ensure they are unique and descriptive.

    Checks: titles

  5. 5

    Fix Meta Descriptions

    Why: Issues with meta descriptions can reduce click-through rates from search results.

    How: Create unique meta descriptions for the 312 pages that are missing them.

    Checks: meta-descriptions

  6. 6

    Improve Heading Structure

    Why: Proper heading structure enhances content readability and comprehension.

    How: Ensure each page has a single H1 title and use appropriate H2s for subsections.

    Checks: headings

Generated automatically; verify each change against your own site before relying on it.

Security review

Written by gpt-4o-mini from 16 checks over the crawl

The security review for your website highlights several significant areas for improvement, including missing security headers, cookie settings, and outdated libraries. Addressing these issues will enhance protection against various attacks and improve overall security posture.

  • 0 high
  • 4 medium
  • 1 low
  • 1 info
  1. 1

    Cookies Missing Protective FlagsMedium

    Why it matters: 130 of 133 cookies are missing flags like Secure, HttpOnly, and SameSite, increasing the risk of cookie theft.

    Fix: Update cookies to include the flags: Secure; HttpOnly; SameSite=Lax or SameSite=Strict.

    Evidence: Cookie flags

  2. 2

    Mixed Content IssuesMedium

    Why it matters: 42 resources are loaded over HTTP on HTTPS pages, which can be blocked or tampered with.

    Fix: Update resource URLs from HTTP to HTTPS to ensure secure connections.

    Evidence: Mixed content

  3. 3

    Outdated JavaScript LibraryMedium

    Why it matters: jQuery version 1.9.1 has known vulnerabilities that could potentially be exploited.

    Fix: Upgrade jQuery to at least version 3.5.0 to mitigate vulnerabilities.

    Evidence: Vulnerable JavaScript libraries

  4. 4

    Leaked API KeyMedium

    Why it matters: A Google API key was found in source code, which can lead to unauthorized access if exploited.

    Fix: Restrict the API key usage in the Google Cloud console to specific referrers or services.

    Evidence: Keys and secrets in page code

  5. 5

    Missing X-Content-Type-Options HeaderLow

    Why it matters: 3463 of 3559 HTML pages lack the X-Content-Type-Options header, which helps prevent MIME sniffing vulnerabilities.

    Fix: Set the header X-Content-Type-Options: nosniff in your server configuration for all HTML responses.

    Evidence: MIME sniffing protection

  6. 6

    Missing Permissions-Policy HeaderInfo

    Why it matters: No HTML page has a Permissions-Policy header, which limits permissions for potentially harmful scripts.

    Fix: Set the header Permissions-Policy: (...) based on your needs for camera, microphone, and geolocation permissions.

    Evidence: Permissions policy

What the checks found

  • FoundMIME sniffing protectionLow

    3463 of 3559 HTML pages send x-content-type-options. Without X-Content-Type-Options: nosniff a browser may run a file as a script because of its contents rather than its declared type.

    • https://moz.com/login → no x-content-type-options
    • https://moz.com/mozcast → no x-content-type-options
    • https://moz.com/api/docs → no x-content-type-options
    • https://moz.com/api/dashboard/usage → no x-content-type-options
    • https://moz.com/freemium/keyword-explorer → no x-content-type-options
    • https://moz.com/freemium/competitive-research → no x-content-type-options
    • https://moz.com/freemium/local/check-listing → no x-content-type-options
    • https://moz.com/subscriptions → no x-content-type-options
    • https://moz.com/freemium/brand-authority-freemium-form → no x-content-type-options
    • https://moz.com/api/docs/welcome → no x-content-type-options
    • https://moz.com/api/dashboard → no x-content-type-options
    • https://moz.com/api/docs/guides/getting-started → no x-content-type-options
  • FoundPermissions policyInfo

    No HTML page sends permissions-policy. A Permissions-Policy header turns off browser features the site does not use (camera, microphone, geolocation), limiting what an injected script could do.

    • https://moz.com/ → no permissions-policy
    • https://moz.com/products/pro → no permissions-policy
    • https://moz.com/products/local → no permissions-policy
    • https://moz.com/products/stat → no permissions-policy
    • https://moz.com/products/api → no permissions-policy
    • https://moz.com/products → no permissions-policy
    • https://moz.com/moz-data → no permissions-policy
    • https://moz.com/explorer → no permissions-policy
    • https://moz.com/link-explorer → no permissions-policy
    • https://moz.com/competitive-research → no permissions-policy
    • https://moz.com/products/pro/seo-toolbar → no permissions-policy
    • https://moz.com/free-seo-tools → no permissions-policy
  • FoundCookie flagsMedium

    130 of 133 cookies are missing protective flags. Without HttpOnly a script can read the cookie; without Secure it travels over plain HTTP; without SameSite it is sent on cross-site requests.

    • 29 Sep 2026 12:06:20 GMT (set by https://moz.com/images/assets/features/moz-freemum-tool-card-bg_Check-SERP-Stab…) lacks Secure, HttpOnly, SameSite
    • 29 Sep 2026 12:06:21 GMT (set by https://moz.com/images/assets/features/moz-freemum-tool-card-bg_Competitive-Res…) lacks Secure, HttpOnly, SameSite
    • 29 Sep 2026 12:06:24 GMT (set by https://moz.com/images/assets/features/moz-freemum-tool-card-bg_MozBar.jpg?w=70…) lacks Secure, HttpOnly, SameSite
    • 29 Sep 2026 12:06:25 GMT (set by https://moz.com/images/assets/features/moz-freemum-tool-card-bg_Google-Algorith…) lacks Secure, HttpOnly, SameSite
    • 29 Sep 2026 12:07:37 GMT (set by https://moz.com/images/user/photo/Matt-Hollingshead-Profile-Pic.png?w=160&h=160…) lacks Secure, HttpOnly, SameSite
    • 29 Sep 2026 12:10:39 GMT (set by https://moz.com/images/cms/icons/[email protected]?w=152&h=152&auto=compress%2Cf…) lacks Secure, HttpOnly, SameSite
    • 29 Sep 2026 12:10:48 GMT (set by https://moz.com/images/assets/avatars/Jason_Nurmi.png?w=160&h=160&auto=compress…) lacks Secure, HttpOnly, SameSite
    • 29 Sep 2026 12:10:49 GMT (set by https://moz.com/images/assets/features/[email protected]?auto=…) lacks Secure, HttpOnly, SameSite
    • 29 Sep 2026 12:10:59 GMT (set by https://moz.com/images/assets/files/Help-Hub-tutorials-and-courses.png?w=1200&h…) lacks Secure, HttpOnly, SameSite
    • 29 Sep 2026 12:11:14 GMT (set by https://moz.com/images/blog/insets/MozCon-2026-Inset-Images/Miracle-Miracle-Ina…) lacks Secure, HttpOnly, SameSite
    • 29 Sep 2026 12:11:25 GMT (set by https://moz.com/images/user/photo/phil-nottingham-pic.jpg?w=160&h=160&auto=comp…) lacks Secure, HttpOnly, SameSite
    • 29 Sep 2026 12:11:30 GMT (set by https://moz.com/images/blog/banners/13-WBF-blog-banner-BGs/whiteboard-friday-BG…) lacks Secure, HttpOnly, SameSite
  • FoundMixed contentMedium

    42 resources on HTTPS pages are loaded over plain HTTP, 2 of them scripts or stylesheets that browsers block or that can be tampered with in transit.

    • https://moz.com/about/team/funnylookinhat loads image http://i.imgur.com/ctECATe.gif
    • https://moz.com/about/team/funnylookinhat loads image http://i.imgur.com/8knHvsl.gif
    • https://moz.com/blog/google-instant-fewer-changes-to-seo-than-the-ave… loads image http://blog.conductor.com/wp-content/uploads/2010/09/Research-visits-search-term-length-5…
    • https://moz.com/blog/how-to-build-a-facebook-group loads image http://www.searchenginejournal.com/wp-content/uploads/2015/10/facebook-traffic-380x239.png
    • https://moz.com/blog/how-to-build-a-facebook-group loads image http://www.searchenginejournal.com/wp-content/uploads/2015/10/Screen-Shot-2015-10-15-at-8…
    • https://moz.com/blog/how-to-build-a-facebook-group loads image http://www.searchenginejournal.com/wp-content/uploads/2015/10/IMG_1055-380x310.png
    • https://moz.com/blog/how-to-build-a-facebook-group loads image http://www.searchenginejournal.com/wp-content/uploads/2015/10/facebook-group-reach-760x27…
    • https://moz.com/blog/how-to-build-a-facebook-group loads image http://www.searchenginejournal.com/wp-content/uploads/2015/10/Screen-Shot-2015-10-15-at-9…
    • https://moz.com/blog/how-to-build-a-facebook-group loads image http://www.searchenginejournal.com/wp-content/uploads/2015/10/Screen-Shot-2015-10-16-at-9…
    • https://moz.com/blog/how-to-build-a-facebook-group loads image http://www.searchenginejournal.com/wp-content/uploads/2015/10/Screen-Shot-2015-10-15-at-8…
    • https://moz.com/blog/how-to-build-a-facebook-group loads image http://www.searchenginejournal.com/wp-content/uploads/2015/10/Screen-Shot-2015-10-16-at-9…
    • https://moz.com/blog/how-to-build-a-facebook-group loads image http://www.searchenginejournal.com/wp-content/uploads/2015/10/Screen-Shot-2015-10-16-at-1…
  • FoundVulnerable JavaScript librariesMedium

    1 library with published vulnerabilities: jQuery 1.9.1. Whether they are exploitable depends on how the site uses them, but each has a fixed release.

    • jQuery 1.9.1 in https://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js: CVE-2015-9251 (XSS via cross-domain AJAX), CVE-2019-11358 (prototype pollution), CVE-2020-11022, CVE-2020-11023 (XSS via HTML passed to DOM methods); fixed in 3.5.0
  • FoundKeys and secrets in page codeMedium

    1 credential-like value found in code served to every visitor: Google API key.

    • Google API key AIzaSy…gM (39 chars) in https://moz.com/_next/static/chunks/app/layout-dea6d359a06f19f0.js: browser keys are expected in pages, but must be restricted by HTTP referrer and API in the Google Cloud console
  • NoteSoftware version disclosure

    Responses name the framework in an X-Powered-By header but hide the version.

    • server: cloudflare (5960 responses)
    • x-powered-by: NodeBB (1514 responses)
  • NoteThird-party scripts

    Scripts run from 6 other domains without Subresource Integrity, so a compromise of any of them changes what runs on this site. (Tag managers and analytics rarely support SRI; a Content-Security-Policy that names these hosts is the usual control.)

    • cloud.wordlift.io (39 script tags)
    • cdn.ziffstatic.com (39 script tags)
    • moz-static.moz.com (156 script tags)
    • static.cloudflareinsights.com (39 script tags)
    • fast.wistia.com (12 script tags)
    • js.hsforms.net (8 script tags)
  • NoteSensitive paths in robots.txt

    robots.txt lists 1 path that look private. robots.txt is public and does not restrict access, so it doubles as a map for anyone probing the site; those paths need real access control.

    • Disallow: /admin-preview/*
7 checks passed
  • OKHTTPS

    All 3559 crawled pages were served over HTTPS.

  • OKHTTP Strict Transport Security

    strict-transport-security is set on all 3559 HTML pages.

  • OKContent Security Policy

    A Content-Security-Policy is set on 1215 of 3559 pages.

  • OKClickjacking protection

    x-frame-options is set on all 3559 HTML pages.

  • OKReferrer policy

    A referrer policy is set through a <meta name="referrer"> tag.

  • OKForms over HTTPS

    43 forms found, all on HTTPS pages posting to HTTPS addresses.

  • OKExposed files and listings

    None of the crawled URLs is a configuration file, backup, dump, repository folder or directory listing.

A passive review of what the crawl recorded: response headers, page and script contents and the URLs it found. It does not probe the site, test TLS settings or look for files that were not linked. Generated automatically; verify each finding against your own site before acting on it.

Sites scoring near moz.com

Their neighbours in the SEO rank table, which orders every scanned site by health score.

This report was produced by the DIY SEO Hub Site Spider crawling moz.com from its pages as published, the way a search engine does. It shows summary figures only.

Own moz.com?

moz.com scan 2026-09-29-0856 | DIY SEO Hub