Scanned sites / moz.com / 2026-10-02-1146

moz.com scan from 10/2/2026, 11:46:25 AM

Scan 2026-10-02-1146

Scanned 10/2/2026, 11:46:25 AM, finished 10/3/2026, 6:07:55 AM. Found with 42backlinks.com tool directory

Site: https://moz.com/

Download SQLite databaseEvery page and asset from this scan, with the crawl events, in one file.

71/ 100Needs work

On October 2, 2026 the Site Spider crawled 4895 pages and 1066 assets of moz.com, starting from https://moz.com/. It scored 71 out of 100, a result that needs work. 14 of 16 checks found something to fix, led by heavy assets (129), meta descriptions (2,189), sitemap coverage (2,623); 1 check passed. Most of the points went to heavy assets (−6), meta descriptions (−4.9), sitemap coverage (−4.4). 1 check found something the score does not count, listed as noted. The list below shows each check's result, the fix plan, when present, explains what to do first, and the security review at the end of the page covers headers, transport, libraries and exposed files.

Security review: Medium4 medium, 1 low and 1 info findings. See the security findings ↓

Pages crawled
4895
Assets fetched
1066
Status
Completed
Checks with issues
14 of 16
CoverageJob finished, partial coverage

5,961 of 6,000 discovered URLs were fetched, 39 blocked by robots.txt, 57,155 left out by the 5,000-page and 1,000-asset budget. The job finished, but the crawl did not reach everything it found. HTML only: nothing here ran JavaScript. 300 link destinations on other sites were checked, 14036 left unchecked.

  • Title tags1,298 issues
    1298 of 2623 pages have title issues. 935 noindex or canonicalized pages excluded.
    −3.6 points
  • Meta descriptions2,189 issues
    2189 of 2623 pages have meta description issues. 935 noindex or canonicalized pages excluded.
    −4.9 points
  • Headings1,169 issues
    1169 of 2623 pages have heading issues. 935 noindex or canonicalized pages excluded.
    −2 points
  • Broken links625 issues
    21386 internal links point at 625 broken URLs.
    −3.5 points
  • Links to other sites31 issues
    31 destinations answered with an error, 101 could not be determined (timeouts, rate limits or refusals), 14036 were left unchecked by the per-scan cap, of 300 destinations checked.
    −0.3 points
  • Redirects715 issues
    725 redirecting URLs, 6 of them chained.
    −0.8 points
  • Non-200 responses626 issues
    1394 URLs did not return a 2xx response. 1337 of them are pages, 626 with an error status; the rest are assets or redirects.
    −1.8 points
  • Rate limitedOK
    The site did not rate limit the crawler.
  • Indexability248 issues
    248 of 2824 indexable pages have indexability warnings. 734 pages noindex by design.
    −0.7 points
  • Image alt text8,112 issues
    8112 of 56030 image references have no alt attribute. 2759 use an empty alt (decorative), which is fine.
    −0.9 points
  • Heavy assets129 issues
    129 assets larger than 500 KB among 1066 fetched assets.
    −6 points
  • Orphan pages40 issues
    40 pages have no internal links pointing at them.
  • Sitemap coverage2,623 issues
    2 sitemaps listing 0 URLs: 2623 crawled pages missing, 0 listed URLs broken or redirecting, 0 reachable only via the sitemap.
    −4.4 points
  • Internal link countsOK
    Internal link counts for 500 pages.
  • Thin content22 issues
    22 of 2623 pages have fewer than 200 words. 935 noindex or canonicalized pages excluded.
  • Duplicate content4 issues
    2 groups of pages with identical HTML.

Where this scan sits among all scanned sites

1912 sites, median 80%, average 79%

moz.com scores 71%, higher than 18% of the 1912 scanned sites. See the full ranking.

0561110%: 0 sites1%: 0 sites2%: 0 sites3%: 0 sites4%: 0 sites5%: 0 sites6%: 0 sites7%: 0 sites8%: 0 sites9%: 0 sites10%: 0 sites11%: 0 sites12%: 0 sites13%: 0 sites14%: 0 sites15%: 0 sites16%: 0 sites17%: 0 sites18%: 0 sites19%: 0 sites20%: 0 sites21%: 1 site22%: 0 sites23%: 0 sites24%: 0 sites25%: 0 sites26%: 0 sites27%: 0 sites28%: 1 site29%: 0 sites30%: 0 sites31%: 0 sites32%: 0 sites33%: 0 sites34%: 0 sites35%: 2 sites36%: 1 site37%: 2 sites38%: 2 sites39%: 1 site40%: 2 sites41%: 2 sites42%: 0 sites43%: 1 site44%: 0 sites45%: 4 sites46%: 2 sites47%: 3 sites48%: 2 sites49%: 7 sites50%: 4 sites51%: 5 sites52%: 8 sites53%: 6 sites54%: 7 sites55%: 4 sites56%: 7 sites57%: 6 sites58%: 15 sites59%: 7 sites60%: 10 sites61%: 12 sites62%: 17 sites63%: 16 sites64%: 11 sites65%: 22 sites66%: 22 sites67%: 37 sites68%: 30 sites69%: 26 sites70%: 39 sites71%: 40 sites72%: 57 sites73%: 52 sites74%: 49 sites75%: 61 sites76%: 76 sites77%: 73 sites78%: 88 sites79%: 70 sites80%: 90 sites81%: 111 sites82%: 86 sites83%: 88 sites84%: 87 sites85%: 67 sites86%: 75 sites87%: 63 sites88%: 64 sites89%: 54 sites90%: 36 sites91%: 36 sites92%: 29 sites93%: 16 sites94%: 13 sites95%: 13 sites96%: 7 sites97%: 8 sites98%: 2 sites99%: 2 sites100%: 55 sites71% here100%90%80%70%60%50%40%30%20%10%0%

Green 90% and up (Excellent), lime 75 to 89 (Good), amber 50 to 74 (Needs work), red below 50 (Poor).

Internal link map

Loading the link map...

Start page (centre)OKRedirectErrorOrphanLinked from most pagesOne inbound link or noneRings = clicks from the start page. Size = inbound links. Drag to pan, scroll to zoom, click a page to see only its links.

Fix plan

Written by gpt-4o-mini from the scan findings

The crawl revealed multiple SEO issues, including numerous broken links and missing meta descriptions. Addressing these will enhance site performance and user experience.

  1. 1

    Fix Broken Links

    Why: 21386 internal links are broken, affecting user experience and SEO.

    How: Audit broken links and update or remove them appropriately.

    Checks: broken-links

  2. 2

    Create a Sitemap

    Why: 2623 pages are not in the sitemap, hindering indexation.

    How: Generate a comprehensive sitemap that includes all indexable pages.

    Checks: sitemap-coverage

  3. 3

    Optimize Meta Descriptions

    Why: 2189 pages have meta description issues, impacting click-through rates.

    How: Write unique, concise meta descriptions for affected pages.

    Checks: meta-descriptions

  4. 4

    Address Redirects

    Why: 725 URLs are redirecting, which may slow down site loading times.

    How: Evaluate and streamline redirects, particularly the chained ones.

    Checks: redirects

  5. 5

    Improve Image Alt Text

    Why: 8112 images lack alt attributes, affecting accessibility and SEO.

    How: Add descriptive alt text to images to enhance their context.

    Checks: images-alt

  6. 6

    Reduce Heavy Assets

    Why: 129 assets exceed 500 KB, affecting loading performance.

    How: Optimize images or consider using lighter alternatives.

    Checks: heavy-assets

Generated automatically; verify each change against your own site before relying on it.

Security review

Written by gpt-4o-mini from 16 checks over the crawl

The website has several security issues that could expose user data and increase vulnerability to attacks. Key concerns include missing headers for security policies, improper cookie handling, mixed content issues, and the use of outdated libraries. Addressing these should be prioritized to enhance site security.

  • 0 high
  • 4 medium
  • 1 low
  • 1 info
  1. 1

    Insecure Cookie FlagsMedium

    Why it matters: Without Secure, HttpOnly, and SameSite flags, cookies may be vulnerable to interception and cross-site attacks.

    Fix: Set cookies with Secure, HttpOnly, and SameSite attributes for all cookies.

    Evidence: Cookie flags

  2. 2

    Mixed Content on HTTPS PagesMedium

    Why it matters: HTTP resources can be blocked or tampered with, compromising security.

    Fix: Update URLs to use HTTPS for all resources or host them securely.

    Evidence: Mixed content

  3. 3

    Vulnerable JavaScript Library DetectedMedium

    Why it matters: The use of outdated jQuery could expose the site to known vulnerabilities.

    Fix: Upgrade jQuery to version 3.5.0 or later to mitigate risks.

    Evidence: Vulnerable JavaScript libraries

  4. 4

    Exposed Google API KeyMedium

    Why it matters: Public exposure of this key may allow unauthorized use, leading to data leakage or charges.

    Fix: Limit the API key usage by restricting permissions in the Google Cloud console.

    Evidence: Keys and secrets in page code

  5. 5

    Missing X-Content-Type-Options HeaderLow

    Why it matters: Without this header, browsers may interpret files incorrectly, increasing the risk of XSS attacks.

    Fix: Set the X-Content-Type-Options header to 'nosniff' in your server configuration.

    Evidence: MIME sniffing protection

  6. 6

    No Permissions-Policy HeaderInfo

    Why it matters: Lack of this header means unused features remain accessible, increasing attack vectors.

    Fix: Add a Permissions-Policy header to control browser features (e.g., 'camera=()', 'geolocation=()').

    Evidence: Permissions policy

What the checks found

  • FoundMIME sniffing protectionLow

    3458 of 3558 HTML pages send x-content-type-options. Without X-Content-Type-Options: nosniff a browser may run a file as a script because of its contents rather than its declared type.

    • https://moz.com/login → no x-content-type-options
    • https://moz.com/mozcast → no x-content-type-options
    • https://moz.com/api/docs → no x-content-type-options
    • https://moz.com/api/dashboard/usage → no x-content-type-options
    • https://moz.com/freemium/keyword-explorer → no x-content-type-options
    • https://moz.com/freemium/competitive-research → no x-content-type-options
    • https://moz.com/freemium/local/check-listing → no x-content-type-options
    • https://moz.com/subscriptions → no x-content-type-options
    • https://moz.com/freemium/brand-authority-freemium-form → no x-content-type-options
    • https://moz.com/api/docs/welcome → no x-content-type-options
    • https://moz.com/api/dashboard → no x-content-type-options
    • https://moz.com/api/docs/guides/getting-started → no x-content-type-options
  • FoundPermissions policyInfo

    No HTML page sends permissions-policy. A Permissions-Policy header turns off browser features the site does not use (camera, microphone, geolocation), limiting what an injected script could do.

    • https://moz.com/ → no permissions-policy
    • https://moz.com/products/pro → no permissions-policy
    • https://moz.com/products/local → no permissions-policy
    • https://moz.com/products/stat → no permissions-policy
    • https://moz.com/products/api → no permissions-policy
    • https://moz.com/products → no permissions-policy
    • https://moz.com/moz-data → no permissions-policy
    • https://moz.com/explorer → no permissions-policy
    • https://moz.com/link-explorer → no permissions-policy
    • https://moz.com/competitive-research → no permissions-policy
    • https://moz.com/products/pro/seo-toolbar → no permissions-policy
    • https://moz.com/free-seo-tools → no permissions-policy
  • FoundCookie flagsMedium

    147 of 150 cookies are missing protective flags. Without HttpOnly a script can read the cookie; without Secure it travels over plain HTTP; without SameSite it is sent on cross-site requests.

    • 03 Oct 2026 03:09:12 GMT (set by https://moz.com/images/assets/features/moz-tools_stat.png?w=1024&auto=compress%…) lacks Secure, HttpOnly, SameSite
    • 03 Oct 2026 03:29:44 GMT (set by https://moz.com/images/cms/moz-stairs-homepage-banner-v2.jpg?w=800&h=418&q=82&a…) lacks Secure, HttpOnly, SameSite
    • 03 Oct 2026 03:58:52 GMT (set by https://moz.com/images/products/landing-pages/Tom-Capper-Circle.png?w=160&h=160…) lacks Secure, HttpOnly, SameSite
    • 03 Oct 2026 03:58:55 GMT (set by https://moz.com/images/assets/features/LI-Screenshots-InboundLinks_01.png?w=102…) lacks Secure, HttpOnly, SameSite
    • 03 Oct 2026 03:58:59 GMT (set by https://moz.com/images/assets/features/LI-Screenshots-LinkIntersect_03.png?w=10…) lacks Secure, HttpOnly, SameSite
    • 03 Oct 2026 03:59:00 GMT (set by https://moz.com/images/assets/features/LI-Screenshots-Top-Pages_04.png?w=1024&a…) lacks Secure, HttpOnly, SameSite
    • 03 Oct 2026 03:59:04 GMT (set by https://moz.com/images/cms/mozcon/speakers/cyrus-shepard.jpg?w=160&h=160&auto=c…) lacks Secure, HttpOnly, SameSite
    • 03 Oct 2026 04:00:23 GMT (set by https://moz.com/images/assets/avatars/about-will-critchlow-medium-e161109180555…) lacks Secure, HttpOnly, SameSite
    • 03 Oct 2026 04:00:39 GMT (set by https://moz.com/images/cms/assets/backgrounds/lg_curve.png?w=2000&auto=compress…) lacks Secure, HttpOnly, SameSite
    • 03 Oct 2026 04:10:07 GMT (set by https://moz.com/images/assets/features/mozbar_easily-assess-any-site_v5.avif?w=…) lacks Secure, HttpOnly, SameSite
    • 03 Oct 2026 04:10:08 GMT (set by https://moz.com/images/assets/features/mozbar_compare-key-metrics_v5.avif?auto=…) lacks Secure, HttpOnly, SameSite
    • 03 Oct 2026 04:10:10 GMT (set by https://moz.com/images/assets/features/mozbar_review-schema-markup_v5.avif?w=64…) lacks Secure, HttpOnly, SameSite
  • FoundMixed contentMedium

    42 resources on HTTPS pages are loaded over plain HTTP, 2 of them scripts or stylesheets that browsers block or that can be tampered with in transit.

    • https://moz.com/about/team/funnylookinhat loads image http://i.imgur.com/ctECATe.gif
    • https://moz.com/about/team/funnylookinhat loads image http://i.imgur.com/8knHvsl.gif
    • https://moz.com/blog/google-instant-fewer-changes-to-seo-than-the-ave… loads image http://blog.conductor.com/wp-content/uploads/2010/09/Research-visits-search-term-length-5…
    • https://moz.com/blog/how-to-build-a-facebook-group loads image http://www.searchenginejournal.com/wp-content/uploads/2015/10/facebook-traffic-380x239.png
    • https://moz.com/blog/how-to-build-a-facebook-group loads image http://www.searchenginejournal.com/wp-content/uploads/2015/10/Screen-Shot-2015-10-15-at-8…
    • https://moz.com/blog/how-to-build-a-facebook-group loads image http://www.searchenginejournal.com/wp-content/uploads/2015/10/IMG_1055-380x310.png
    • https://moz.com/blog/how-to-build-a-facebook-group loads image http://www.searchenginejournal.com/wp-content/uploads/2015/10/facebook-group-reach-760x27…
    • https://moz.com/blog/how-to-build-a-facebook-group loads image http://www.searchenginejournal.com/wp-content/uploads/2015/10/Screen-Shot-2015-10-15-at-9…
    • https://moz.com/blog/how-to-build-a-facebook-group loads image http://www.searchenginejournal.com/wp-content/uploads/2015/10/Screen-Shot-2015-10-16-at-9…
    • https://moz.com/blog/how-to-build-a-facebook-group loads image http://www.searchenginejournal.com/wp-content/uploads/2015/10/Screen-Shot-2015-10-15-at-8…
    • https://moz.com/blog/how-to-build-a-facebook-group loads image http://www.searchenginejournal.com/wp-content/uploads/2015/10/Screen-Shot-2015-10-16-at-9…
    • https://moz.com/blog/how-to-build-a-facebook-group loads image http://www.searchenginejournal.com/wp-content/uploads/2015/10/Screen-Shot-2015-10-16-at-1…
  • FoundVulnerable JavaScript librariesMedium

    1 library with published vulnerabilities: jQuery 1.9.1. Whether they are exploitable depends on how the site uses them, but each has a fixed release.

    • jQuery 1.9.1 in https://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js: CVE-2015-9251 (XSS via cross-domain AJAX), CVE-2019-11358 (prototype pollution), CVE-2020-11022, CVE-2020-11023 (XSS via HTML passed to DOM methods); fixed in 3.5.0
  • FoundKeys and secrets in page codeMedium

    1 credential-like value found in code served to every visitor: Google API key.

    • Google API key AIzaSy…gM (39 chars) in https://moz.com/_next/static/chunks/4023-d7c73e8fc3d9158e.js: browser keys are expected in pages, but must be restricted by HTTP referrer and API in the Google Cloud console
  • NoteSoftware version disclosure

    Responses name the framework in an X-Powered-By header but hide the version.

    • server: cloudflare (5961 responses)
    • x-powered-by: NodeBB (1506 responses)
  • NoteThird-party scripts

    Scripts run from 6 other domains without Subresource Integrity, so a compromise of any of them changes what runs on this site. (Tag managers and analytics rarely support SRI; a Content-Security-Policy that names these hosts is the usual control.)

    • cloud.wordlift.io (39 script tags)
    • cdn.ziffstatic.com (39 script tags)
    • moz-static.moz.com (156 script tags)
    • static.cloudflareinsights.com (39 script tags)
    • fast.wistia.com (12 script tags)
    • js.hsforms.net (8 script tags)
  • NoteSensitive paths in robots.txt

    robots.txt lists 1 path that look private. robots.txt is public and does not restrict access, so it doubles as a map for anyone probing the site; those paths need real access control.

    • Disallow: /admin-preview/*
7 checks passed
  • OKHTTPS

    All 3558 crawled pages were served over HTTPS.

  • OKHTTP Strict Transport Security

    strict-transport-security is set on all 3558 HTML pages.

  • OKContent Security Policy

    A Content-Security-Policy is set on 1212 of 3558 pages.

  • OKClickjacking protection

    x-frame-options is set on all 3558 HTML pages.

  • OKReferrer policy

    A referrer policy is set through a <meta name="referrer"> tag.

  • OKForms over HTTPS

    43 forms found, all on HTTPS pages posting to HTTPS addresses.

  • OKExposed files and listings

    None of the crawled URLs is a configuration file, backup, dump, repository folder or directory listing.

A passive review of what the crawl recorded: response headers, page and script contents and the URLs it found. It does not probe the site, test TLS settings or look for files that were not linked. Generated automatically; verify each finding against your own site before acting on it.

Sites scoring near moz.com

Their neighbours in the SEO rank table, which orders every scanned site by health score.

This report was produced by the DIY SEO Hub Site Spider crawling moz.com from its pages as published, the way a search engine does. It shows summary figures only.

Own moz.com?

moz.com scan 2026-10-02-1146 | DIY SEO Hub