Scanned sites / sofiori.com / 2026-11-03-1617
sofiori.com scan from 2026-11-03 16:17:20 UTC DR 4
DR is Ahrefs Domain Rating (0-100, backlink strength), used under its Domain Rating License.
Scan 2026-11-03-1617
Scanned 2026-11-03 16:17:20 UTC, finished 2026-11-04 02:52:45 UTC. Found on page 3 of brave web search results
Site: https://sofiori.com/
Download SQLite databaseEvery page and asset from this scan, with the crawl events, in one file.
On November 3, 2026 the Site Spider crawled 4745 pages and 864 assets of sofiori.com, starting from https://sofiori.com/. It scored 91 out of 100, an excellent result. 9 of 33 checks found something to fix, led by redirects (4,203), heavy assets (6), title tags (34); 11 checks passed. Most of the points went to redirects (−4), heavy assets (−3.6), title tags (−0.6). 13 checks found something the score does not count, listed as noted. 4 checks were not run because the crawl fetched nothing for them. The list below shows each check's result, the fix plan, when present, explains what to do first, and the security review at the end of the page covers headers, transport, libraries and exposed files.
Security review: Medium3 medium and 3 low findings. See the security findings ↓
- Pages crawled
- 4745
- Assets fetched
- 864
- Status
- Completed
- Checks with issues
- 9 of 33
5,609 of 6,000 discovered URLs were fetched, 1 failed, 390 blocked by robots.txt, 12,977 left out by the 5,000-page and 1,000-asset budget. The job finished, but the crawl did not reach everything it found. HTML only: nothing here ran JavaScript. 7 link destinations on other sites were checked.
- Title tags34 issues34 of 171 pages have title issues. 371 noindex or canonicalized pages excluded.−0.6 points
- Meta descriptions28 issues28 of 171 pages have meta description issues. 371 noindex or canonicalized pages excluded.−0.4 points
- Headings13 issues13 of 171 pages have heading issues. 371 noindex or canonicalized pages excluded.−0.1 points
- Broken links1 issue1 internal link point at 1 broken URL.
- Links to other sites4 noted0 destinations answered with an error, 4 could not be determined (timeouts, rate limits or refusals), of 7 destinations checked.
- Redirects4,203 issues4204 redirecting URLs, 3 of them chained.−4 points
- Non-200 responses1 issue4205 URLs did not return a 2xx response. 4204 of them are pages, 1 with an error status; the rest are assets or redirects.
- Rate limitedOKThe site did not rate limit the crawler.
- IndexabilityOK0 of 542 indexable pages have indexability warnings.
- Image alt text153 issues153 of 39769 image references have no alt attribute. 133 use an empty alt (decorative), which is fine.
- Heavy assets6 issues6 assets larger than 500 KB among 864 fetched assets. 35 documents over that size are listed but not counted: downloads are not page weight.−3.6 points
- Orphan pagesOK0 pages have no internal links pointing at them.
- Sitemap coverage28 issues1 sitemap listing 449 URLs: 2 crawled pages missing, 26 listed URLs broken or redirecting, 0 reachable only via the sitemap. 254 listed URLs not crawled within the 5000-page budget.−0.3 points
- Internal link counts161 notedInternal link counts for 500 pages; 161 worth a look.
- Thin contentOK0 of 171 pages have fewer than 200 words. 371 noindex or canonicalized pages excluded.
- Duplicate contentOK0 groups of pages with identical HTML.
- URL format4,348 noted4348 of 4745 page URLs are harder to read, share or cache than they need to be.
- Canonicals371 noted371 of 542 pages have a canonical worth checking.
- Robots directives542 noted542 pages carry a robots directive; 0 carry none.
- Anchor text4,440 noted4440 destinations are linked without useful anchor text, or with nofollow.
- Title and heading structure27 noted27 of 171 pages could use the title, heading and snippet space better. 371 noindex or canonicalized pages excluded.
- Image weight and alt length447 noted397 images over 100 KB; 50 with alt text over 100 characters.
- Response anomalies2 noted2 URLs answered in a way worth looking at.
- HTML and head validationOKAll 542 pages keep their head tags in <head>, once each, under Googlebot's 2 MB.
- hreflangOKNo page declares hreflang.
- Structured data1 noted542 of 171 indexable pages carry structured data: Offer (542), Organization (542), WebSite (542), Florist (542), AggregateRating (542). 1 page with errors a rich result would fail on.
- Near duplicates4 noted4 pages in 2 groups read almost the same as another page (95% alike or more).
- Soft 404sOKNone of 542 pages answering 200 reads like an error page.
- AccessibilityNot checkedNot checked: the accessibility audit runs in the browser. Tick "Include JavaScript rendering checks" when you request a scan to run it.
- Link positionsOK0 of 171 linked pages are linked only from the template, never from another page's content.
- PaginationOKNo page declares rel=next or rel=prev pagination.
- Headers and cookies4 noted4 cookies set by the site, 4 missing a protective flag; 15 response headers recorded across 5609 URLs.
- Orphans in searchNot checkedNot checked: import a Search Console Pages export on the scan page to find pages Google shows that the site does not link to.
- Link ScoreOKLink Score (internal PageRank, 0-100) for 542 pages; 407 hold almost none (10 or less).
- JavaScript renderingNot checkedNot checked: this scan did not render pages. Tick "Include JavaScript rendering checks" when you request a scan to compare the served HTML with what a browser builds.
- PageSpeed InsightsNot checkedNot checked yet: PageSpeed Insights runs on the top pages once the crawl has finished.
- Spelling35 noted35 words an English dictionary does not know, on 153 pages. Product names and jargon will appear here too.
Where this scan sits among all scanned sites
2848 sites, median 80%, average 79%
sofiori.com scores 91%, higher than 88% of the 2848 scanned sites. See the full ranking.
Green 90% and up (Excellent), lime 75 to 89 (Good), amber 50 to 74 (Needs work), red below 50 (Poor).
Internal link map
Loading the link map...
Fix plan
Written by gpt-4o-mini from the scan findingsYour website is in excellent health with few issues. Prioritize fixing broken links, redirects, titles, meta descriptions, and headings to enhance SEO. These changes can boost user experience and site authority.
- 1
Fix Broken Links
Why: Improving broken links enhances user experience and SEO.
How: Update the internal link pointing to the broken URL or remove it.
Checks: broken-links
- 2
Reduce Redirects
Why: Minimizing redirects speeds up site performance and improves SEO.
How: Evaluate 4204 redirecting URLs and remove unnecessary ones. Ensure that the final destination is the main link.
Checks: redirects
- 3
Optimize Title Tags
Why: Correcting title issues improves click-through rates and SEO.
How: Shorten the title tags on 34 identified pages to under 60 characters.
Checks: titles
- 4
Enhance Meta Descriptions
Why: Optimizing meta descriptions can improve search visibility and click rates.
How: Revise 28 pages' meta descriptions to be concise and under 160 characters.
Checks: meta-descriptions
- 5
Correct Heading Structure
Why: Ensuring proper headings aids user navigation and SEO.
How: Fix the multiple H1 issues on 13 pages by using only one H1 per page.
Checks: headings
- 6
Optimize Heavy Assets
Why: Shrinking large assets improves load times and user experience.
How: Compress or resize the heavy images and documents listed.
Evidence: 480 KB of image, loaded by 3 pages, so every visitor to any of them downloads it.
3 pages affected
Depends on: If it is a download rather than part of the page, weight matters less; move it out of the page instead.
Checks: heavy-assets
Generated automatically; verify each change against your own site before relying on it.
Security review
Written by gpt-4o-mini from 16 checks over the crawlThe site sofiori.com lacks several important security headers and cookie protections that can expose user data and increase vulnerability to attacks. Recommendations include enabling HTTP Strict Transport Security, setting frame options, securing cookie flags, and hiding the server version to enhance security.
- 0 high
- 3 medium
- 3 low
- 0 info
- 1
Missing HTTP Strict Transport Security (HSTS)Medium
Why it matters: Lack of HSTS allows interception of the first request when users type the address without 'https://'.
Fix: Enable HSTS by adding 'Strict-Transport-Security: max-age=31536000; includeSubDomains; preload' to your HTTP response headers.
Evidence: HTTP Strict Transport Security
- 2
Missing X-Frame-OptionsMedium
Why it matters: Without this header, the site is vulnerable to clickjacking attacks where malicious sites can embed content in a deceptive manner.
Fix: Add 'X-Frame-Options: DENY' or use a Content Security Policy with 'frame-ancestors' directive to your HTTP response headers.
Evidence: Clickjacking protection
- 3
Missing HttpOnly and Secure flags for CookiesMedium
Why it matters: Cookies without these flags are vulnerable to being accessed by scripts and can be sent over unencrypted connections.
Fix: Set cookies with 'HttpOnly; Secure; SameSite=Strict' attributes to protect user sessions.
Evidence: Cookie flags
- 4
Missing X-Content-Type-Options (MIME sniffing protection)Low
Why it matters: Absence of this header allows browsers to incorrectly interpret the types of files, leading to potential script execution issues.
Fix: Add 'X-Content-Type-Options: nosniff' to your HTTP response headers.
Evidence: MIME sniffing protection
- 5
Missing Referrer-PolicyLow
Why it matters: Without a Referrer-Policy, sensitive URL information may be passed to third-party sites, compromising privacy.
Fix: Add 'Referrer-Policy: no-referrer' to your HTTP response headers for better privacy.
Evidence: Referrer policy
- 6
Exposed Server InformationLow
Why it matters: Revealing server version can help attackers identify vulnerabilities in your stack.
Fix: Remove 'X-Powered-By' and configure your web server to hide software version details.
Evidence: Software version disclosure
What the checks found
- FoundHTTP Strict Transport SecurityMedium
No HTML page sends strict-transport-security. Without it a visitor who types the address without https:// can be intercepted on the first request.
- https://sofiori.com/ → no strict-transport-security
- https://sofiori.com/shop/ → no strict-transport-security
- https://sofiori.com/shop/?orderby=date → no strict-transport-security
- https://sofiori.com/product/a-buquete-of-red-roses/ → no strict-transport-security
- https://sofiori.com/product/lilies-and-purple/ → no strict-transport-security
- https://sofiori.com/product/cloud-bloom/ → no strict-transport-security
- https://sofiori.com/product/velvet-kiss/ → no strict-transport-security
- https://sofiori.com/product/teddy-bear-8-inch/ → no strict-transport-security
- https://sofiori.com/product/arctic-dream/ → no strict-transport-security
- https://sofiori.com/product/royal-flame/ → no strict-transport-security
- https://sofiori.com/product/noir-blush/ → no strict-transport-security
- https://sofiori.com/product/joyful-arrangement/ → no strict-transport-security
- FoundClickjacking protectionMedium
No HTML page sends x-frame-options. Without X-Frame-Options (or a CSP frame-ancestors directive) the pages can be embedded in a frame on another site and overlaid with invisible controls.
- https://sofiori.com/ → no x-frame-options
- https://sofiori.com/shop/ → no x-frame-options
- https://sofiori.com/shop/?orderby=date → no x-frame-options
- https://sofiori.com/product/a-buquete-of-red-roses/ → no x-frame-options
- https://sofiori.com/product/lilies-and-purple/ → no x-frame-options
- https://sofiori.com/product/cloud-bloom/ → no x-frame-options
- https://sofiori.com/product/velvet-kiss/ → no x-frame-options
- https://sofiori.com/product/teddy-bear-8-inch/ → no x-frame-options
- https://sofiori.com/product/arctic-dream/ → no x-frame-options
- https://sofiori.com/product/royal-flame/ → no x-frame-options
- https://sofiori.com/product/noir-blush/ → no x-frame-options
- https://sofiori.com/product/joyful-arrangement/ → no x-frame-options
- FoundMIME sniffing protectionLow
No HTML page sends x-content-type-options. Without X-Content-Type-Options: nosniff a browser may run a file as a script because of its contents rather than its declared type.
- https://sofiori.com/ → no x-content-type-options
- https://sofiori.com/shop/ → no x-content-type-options
- https://sofiori.com/shop/?orderby=date → no x-content-type-options
- https://sofiori.com/product/a-buquete-of-red-roses/ → no x-content-type-options
- https://sofiori.com/product/lilies-and-purple/ → no x-content-type-options
- https://sofiori.com/product/cloud-bloom/ → no x-content-type-options
- https://sofiori.com/product/velvet-kiss/ → no x-content-type-options
- https://sofiori.com/product/teddy-bear-8-inch/ → no x-content-type-options
- https://sofiori.com/product/arctic-dream/ → no x-content-type-options
- https://sofiori.com/product/royal-flame/ → no x-content-type-options
- https://sofiori.com/product/noir-blush/ → no x-content-type-options
- https://sofiori.com/product/joyful-arrangement/ → no x-content-type-options
- FoundReferrer policyLow
No HTML page sends referrer-policy. Without a Referrer-Policy the full page address, including any query string, is sent to every site a visitor clicks through to.
- https://sofiori.com/ → no referrer-policy
- https://sofiori.com/shop/ → no referrer-policy
- https://sofiori.com/shop/?orderby=date → no referrer-policy
- https://sofiori.com/product/a-buquete-of-red-roses/ → no referrer-policy
- https://sofiori.com/product/lilies-and-purple/ → no referrer-policy
- https://sofiori.com/product/cloud-bloom/ → no referrer-policy
- https://sofiori.com/product/velvet-kiss/ → no referrer-policy
- https://sofiori.com/product/teddy-bear-8-inch/ → no referrer-policy
- https://sofiori.com/product/arctic-dream/ → no referrer-policy
- https://sofiori.com/product/royal-flame/ → no referrer-policy
- https://sofiori.com/product/noir-blush/ → no referrer-policy
- https://sofiori.com/product/joyful-arrangement/ → no referrer-policy
- FoundSoftware version disclosureLow
Responses reveal the exact server or framework version, which lets an attacker look up known vulnerabilities for it without guessing.
- server: cloudflare (5609 responses)
- x-powered-by: PHP/8.3.36 (4523 responses)
- FoundCookie flagsMedium
4 of 4 cookies are missing protective flags. Without HttpOnly a script can read the cookie; without Secure it travels over plain HTTP; without SameSite it is sent on cross-site requests.
- sso_landing (set by https://sofiori.com/) lacks HttpOnly, SameSite
- woocommerce_items_in_cart (set by https://sofiori.com/shop/?add-to-cart=37021) lacks HttpOnly, SameSite
- woocommerce_cart_hash (set by https://sofiori.com/shop/?add-to-cart=37021) lacks HttpOnly, SameSite
- wp_woocommerce_session_74cec5ecc65a0e60d9f9cf65d49a4a4b (set by https://sofiori.com/shop/?add-to-cart=37021) lacks SameSite
- NoteThird-party scripts
Scripts run from 8 other domains without Subresource Integrity, so a compromise of any of them changes what runs on this site. (Tag managers and analytics rarely support SRI; a Content-Security-Policy that names these hosts is the usual control.)
- www.googletagmanager.com (160 script tags)
- c0.wp.com (1184 script tags)
- stats.wp.com (80 script tags)
- js.hcaptcha.com (40 script tags)
- challenges.cloudflare.com (40 script tags)
- cdn-reach.hostinger.com (40 script tags)
- news.google.com (40 script tags)
- cdn.trustindex.io (1 script tag)
- NoteSensitive paths in robots.txt
robots.txt lists 2 paths that look private. robots.txt is public and does not restrict access, so it doubles as a map for anyone probing the site; those paths need real access control.
- Disallow: /wp-admin/
- Disallow: /wp-login.php
8 checks passed
- OKHTTPS
All 542 crawled pages were served over HTTPS.
- OKContent Security Policy
A Content-Security-Policy is set.
- OKPermissions policy
permissions-policy is set on all 542 HTML pages.
- OKMixed content
No HTTPS page loads a script, stylesheet, font or image over plain HTTP.
- OKForms over HTTPS
186 forms found, all on HTTPS pages posting to HTTPS addresses.
- OKVulnerable JavaScript libraries
1 library version recognised, none with known vulnerabilities.
- OKKeys and secrets in page code
No API keys, tokens or private keys were found in the sampled HTML and scripts.
- OKExposed files and listings
None of the crawled URLs is a configuration file, backup, dump, repository folder or directory listing.
A passive review of what the crawl recorded: response headers, page and script contents and the URLs it found. It does not probe the site, test TLS settings or look for files that were not linked. Generated automatically; verify each finding against your own site before acting on it.
Sites scoring near sofiori.com
Their neighbours in the SEO rank table, which orders every scanned site by health score.
- outlookoptometry.comDR 392/100 · rank 257 · 13 pages
- www.bellerivedental.caDR 591/100 · rank 299 · 144 pages
- www.brunilaw.comDR 091/100 · rank 299 · 11 pages
- www.pulsephysioyyc.comDR 191/100 · rank 299 · 63 pages
- www.allsmilesdentalgroup.caDR 091/100 · rank 299 · 32 pages
- www.fargoeyecare.comDR 391/100 · rank 299 · 226 pages
DR is Ahrefs Domain Rating (0-100, backlink strength), used under its Domain Rating License.
This report was produced by the DIY SEO Hub Site Spider crawling sofiori.com from its pages as published, the way a search engine does. It shows summary figures only.
Own sofiori.com?
- Claim this site to manage the listing, hide it from the public lists, or keep it.
- Want it gone instead? Ask through the support form or e-mail support@diyseohub.com, naming sofiori.com. Removal needs no account and no proof of purchase.