Scanned sites / wordpress.org / 2026-10-20-1229
wordpress.org scan from 2026-10-20 12:29:36 UTC DR 97
DR is Ahrefs Domain Rating (0-100, backlink strength), used under its Domain Rating License.
Scan 2026-10-20-1229
Scanned 2026-10-20 12:29:36 UTC, finished 2026-10-20 13:31:02 UTC. Found with 42backlinks.com tool directory
Site: https://wordpress.org/
Download SQLite databaseEvery page and asset from this scan, with the crawl events, in one file.
On October 20, 2026 the Site Spider crawled 3188 pages and 2209 assets of wordpress.org, starting from https://wordpress.org/. It scored 81 out of 100, a good result. 12 of 33 checks found something to fix, led by heavy assets (50), meta descriptions (1,725), sitemap coverage (2,229); 4 checks passed. Most of the points went to heavy assets (−6), meta descriptions (−4.5), sitemap coverage (−4.3). 17 checks found something the score does not count, listed as noted. 4 checks were not run because the crawl fetched nothing for them. The list below shows each check's result, the fix plan, when present, explains what to do first, and the security review at the end of the page covers headers, transport, libraries and exposed files.
Security review: Medium3 medium and 3 low findings. See the security findings ↓
- Pages crawled
- 3188
- Assets fetched
- 2209
- Status
- Completed
- Checks with issues
- 12 of 33
5,397 of 6,000 discovered URLs were fetched, 4 blocked by robots.txt, 41,237 left out by the 5,000-page and 1,000-asset budget. The job finished, but the crawl did not reach everything it found. HTML only: nothing here ran JavaScript. 300 link destinations on other sites were checked, 29113 left unchecked.
- Title tags652 issues652 of 2268 pages have title issues. 813 noindex or canonicalized pages excluded.−2.1 points
- Meta descriptions1,725 issues1725 of 2268 pages have meta description issues. 813 noindex or canonicalized pages excluded.−4.5 points
- Headings72 issues72 of 2268 pages have heading issues. 813 noindex or canonicalized pages excluded.−0.1 points
- Broken links4 issues301 internal links point at 4 broken URLs.
- Links to other sites1 issue1 destination answered with an error, 20 could not be determined (timeouts, rate limits or refusals), 29113 were left unchecked by the per-scan cap, of 300 destinations checked.
- Redirects103 issues103 redirecting URLs, 0 of them chained.−0.1 points
- Non-200 responses4 issues107 URLs did not return a 2xx response. 107 of them are pages, 4 with an error status; the rest are assets or redirects.
- Rate limitedOKThe site did not rate limit the crawler.
- Indexability456 issues456 of 2755 indexable pages have indexability warnings. 326 pages noindex by design.−1.5 points
- Image alt text99 issues99 of 15962 image references have no alt attribute. 8939 use an empty alt (decorative), which is fine.
- Heavy assets50 issues50 assets larger than 500 KB among 2209 fetched assets. 13 documents over that size are listed but not counted: downloads are not page weight.−6 points
- Orphan pagesOK0 pages have no internal links pointing at them.
- Sitemap coverage2,229 issues12 sitemaps listing 218 URLs: 2229 crawled pages missing, 0 listed URLs broken or redirecting, 0 reachable only via the sitemap. 191 listed URLs not crawled within the 5000-page budget.−4.3 points
- Internal link counts81 notedInternal link counts for 500 pages; 81 worth a look.
- Thin content10 issues10 of 2268 pages have fewer than 200 words. 813 noindex or canonicalized pages excluded.
- Duplicate contentOK0 groups of pages with identical HTML.
- URL format373 noted373 of 3188 page URLs are harder to read, share or cache than they need to be.
- Canonicals678 noted678 of 3081 pages have a canonical worth checking.
- Robots directives3,081 noted3081 pages carry a robots directive; 0 carry none.
- Anchor text1,185 noted1185 destinations are linked without useful anchor text, or with nofollow.
- Title and heading structure598 noted598 of 2268 pages could use the title, heading and snippet space better. 813 noindex or canonicalized pages excluded.
- Image weight and alt length952 noted94 images over 100 KB; 858 with alt text over 100 characters.
- Response anomalies22 noted22 URLs answered in a way worth looking at.
- HTML and head validation2,954 noted2954 of 3081 pages have HTML problems: 2954 with head tags outside <head>, 0 over 2 MB.
- hreflang68,785 noted577 of 599 pages with hreflang have problems: 68785 findings.
- Structured data20 noted267 of 2268 indexable pages carry structured data: Organization (170), SoftwareApplication (169), Product (169), Offer (169), AggregateRating (149). 20 pages with errors a rich result would fail on.
- Near duplicates24 noted24 pages in 8 groups read almost the same as another page (95% alike or more).
- Soft 404s3 noted3 pages answer 200 but say they are not there.
- AccessibilityNot checkedNot checked: the accessibility audit runs in the browser. Tick "Include JavaScript rendering checks" when you request a scan to run it.
- Link positions100 noted100 of 2268 linked pages are linked only from the template, never from another page's content.
- Pagination714 noted1107 pages in pagination sequences; 714 with problems.
- Headers and cookies3 noted3 cookies set by the site, 3 missing a protective flag; 13 response headers recorded across 5397 URLs.
- Orphans in searchNot checkedNot checked: import a Search Console Pages export on the scan page to find pages Google shows that the site does not link to.
- Link ScoreOKLink Score (internal PageRank, 0-100) for 3081 pages; 2956 hold almost none (10 or less).
- JavaScript renderingNot checkedNot checked: this scan did not render pages. Tick "Include JavaScript rendering checks" when you request a scan to compare the served HTML with what a browser builds.
- PageSpeed InsightsNot checkedNot checked yet: PageSpeed Insights runs on the top pages once the crawl has finished.
- Spelling5,011 noted5011 words an English dictionary does not know, on 1697 pages. Product names and jargon will appear here too.
Where this scan sits among all scanned sites
2296 sites, median 79%, average 78%
wordpress.org scores 81%, higher than 55% of the 2296 scanned sites. See the full ranking.
Green 90% and up (Excellent), lime 75 to 89 (Good), amber 50 to 74 (Needs work), red below 50 (Poor).
Internal link map
Loading the link map...
Fix plan
Written by gpt-4o-mini from the scan findingsThe site has a good health score but needs to address some critical issues for better SEO performance. Focus on fixing broken links and redirects first to improve user experience and accessibility.
- 1
Fix Broken Links
Why: Broken links harm user experience and SEO rankings.
How: Identify the pages with broken links and update them to point to correct URLs or remove the links if necessary.
Checks: broken-links
- 2
Address Redirects
Why: Excessive redirects can slow down page load times and dilute page authority.
How: Review redirecting URLs for relevance and consolidate when possible to improve site performance.
Checks: redirects
- 3
Resolve Non-200 Responses
Why: Non-200 responses lead to poor indexing and crawlability.
How: Fix or remove pages that are returning non-200 responses to ensure search engines can successfully index your site.
Checks: status-codes
- 4
Improve Title Tags
Why: Missing or short title tags can affect visibility in search results.
How: Rewrite title tags to be unique and descriptive, adhering to best practices for length and format.
Checks: titles
- 5
Enhance Meta Descriptions
Why: Meta descriptions are crucial for click-through rates in search engines.
How: Create unique and compelling meta descriptions for all pages that need them.
Evidence: 1033 pages have no meta description at all.
1,033 pages affected
Checks: meta-descriptions
- 6
Update Headings Structure
Why: Proper headings are important for SEO and accessibility.
How: Ensure each page has one H1 tag and use H2 tags for subheadings to improve content structure.
Checks: headings
Generated automatically; verify each change against your own site before relying on it.
Security review
Written by gpt-4o-mini from 16 checks over the crawlThe website has several security vulnerabilities including missing critical security headers like Content Security Policy and Clickjacking protection. Cookie flags are not set properly and mixed content issues are present. These findings could expose users to various security risks, including data theft and content injection.
- 0 high
- 3 medium
- 3 low
- 0 info
- 1
Missing Content Security PolicyMedium
Why it matters: Absence of a Content-Security-Policy header allows unrestricted loading of scripts and resources, increasing risk of attacks.
Fix: Implement a CSP header: `Content-Security-Policy: default-src 'self';`.
Evidence: Content Security Policy
- 2
Missing Clickjacking ProtectionMedium
Why it matters: 2812 pages lack X-Frame-Options, making them susceptible to clickjacking attacks.
Fix: Add X-Frame-Options header: `X-Frame-Options: DENY` or use CSP: `Content-Security-Policy: frame-ancestors 'none';`.
Evidence: Clickjacking protection
- 3
Lack of Secure Cookie FlagsMedium
Why it matters: Cookies lack Secure, HttpOnly, and SameSite attributes, exposing them to interception and cross-site request vulnerabilities.
Fix: Set cookie attributes to: `Set-Cookie: old-theme=value; Secure; HttpOnly; SameSite=Strict`.
Evidence: Cookie flags
- 4
Missing MIME Sniffing ProtectionLow
Why it matters: The absence of X-Content-Type-Options can lead browsers to misinterpret files, risking execution of malicious content.
Fix: Implement X-Content-Type-Options header: `X-Content-Type-Options: nosniff`.
Evidence: MIME sniffing protection
- 5
Lack of Referrer PolicyLow
Why it matters: Without a Referrer Policy, sensitive URLs may be exposed to third-party sites when users navigate away.
Fix: Set a Referrer Policy header: `Referrer-Policy: no-referrer`.
Evidence: Referrer policy
- 6
Mixed Content IssuesLow
Why it matters: Loading resources over HTTP on HTTPS pages can lead to man-in-the-middle attacks and degraded security.
Fix: Update resource URLs to use HTTPS where applicable.
Evidence: Mixed content
What the checks found
- FoundContent Security PolicyMedium
None of the 3081 HTML pages send a Content-Security-Policy header or meta tag, so the browser has no restriction on where scripts, styles and frames may load from.
- https://wordpress.org/ → no content-security-policy
- https://wordpress.org/showcase/ → no content-security-policy
- https://wordpress.org/plugins/ → no content-security-policy
- https://wordpress.org/themes/ → no content-security-policy
- https://wordpress.org/hosting/ → no content-security-policy
- https://wordpress.org/news/ → no content-security-policy
- https://wordpress.org/documentation/ → no content-security-policy
- https://wordpress.org/education/ → no content-security-policy
- https://wordpress.org/support/forums/ → no content-security-policy
- https://wordpress.org/blocks/ → no content-security-policy
- https://wordpress.org/patterns/ → no content-security-policy
- https://wordpress.org/photos/ → no content-security-policy
- FoundClickjacking protectionMedium
2812 of 3081 HTML pages send x-frame-options. Without X-Frame-Options (or a CSP frame-ancestors directive) the pages can be embedded in a frame on another site and overlaid with invisible controls.
- https://wordpress.org/themes/ → no x-frame-options
- https://wordpress.org/themes/getting-started/ → no x-frame-options
- https://wordpress.org/themes/commercial/ → no x-frame-options
- https://wordpress.org/themes/browse/favorites/ → no x-frame-options
- https://wordpress.org/themes/browse/new/ → no x-frame-options
- https://wordpress.org/themes/browse/community/ → no x-frame-options
- https://wordpress.org/themes/browse/commercial/ → no x-frame-options
- https://wordpress.org/themes/tags/full-site-editing/ → no x-frame-options
- https://wordpress.org/themes/twentytwentyfive/ → no x-frame-options
- https://wordpress.org/themes/hello-elementor/ → no x-frame-options
- https://wordpress.org/themes/astra/ → no x-frame-options
- https://wordpress.org/themes/twentytwentyfour/ → no x-frame-options
- FoundMIME sniffing protectionLow
No HTML page sends x-content-type-options. Without X-Content-Type-Options: nosniff a browser may run a file as a script because of its contents rather than its declared type.
- https://wordpress.org/ → no x-content-type-options
- https://wordpress.org/showcase/ → no x-content-type-options
- https://wordpress.org/plugins/ → no x-content-type-options
- https://wordpress.org/themes/ → no x-content-type-options
- https://wordpress.org/hosting/ → no x-content-type-options
- https://wordpress.org/news/ → no x-content-type-options
- https://wordpress.org/documentation/ → no x-content-type-options
- https://wordpress.org/education/ → no x-content-type-options
- https://wordpress.org/support/forums/ → no x-content-type-options
- https://wordpress.org/blocks/ → no x-content-type-options
- https://wordpress.org/patterns/ → no x-content-type-options
- https://wordpress.org/photos/ → no x-content-type-options
- FoundReferrer policyLow
No HTML page sends referrer-policy. Without a Referrer-Policy the full page address, including any query string, is sent to every site a visitor clicks through to.
- https://wordpress.org/ → no referrer-policy
- https://wordpress.org/showcase/ → no referrer-policy
- https://wordpress.org/plugins/ → no referrer-policy
- https://wordpress.org/themes/ → no referrer-policy
- https://wordpress.org/hosting/ → no referrer-policy
- https://wordpress.org/news/ → no referrer-policy
- https://wordpress.org/documentation/ → no referrer-policy
- https://wordpress.org/education/ → no referrer-policy
- https://wordpress.org/support/forums/ → no referrer-policy
- https://wordpress.org/blocks/ → no referrer-policy
- https://wordpress.org/patterns/ → no referrer-policy
- https://wordpress.org/photos/ → no referrer-policy
- FoundPermissions policyInfo
No HTML page sends permissions-policy. A Permissions-Policy header turns off browser features the site does not use (camera, microphone, geolocation), limiting what an injected script could do.
- https://wordpress.org/ → no permissions-policy
- https://wordpress.org/showcase/ → no permissions-policy
- https://wordpress.org/plugins/ → no permissions-policy
- https://wordpress.org/themes/ → no permissions-policy
- https://wordpress.org/hosting/ → no permissions-policy
- https://wordpress.org/news/ → no permissions-policy
- https://wordpress.org/documentation/ → no permissions-policy
- https://wordpress.org/education/ → no permissions-policy
- https://wordpress.org/support/forums/ → no permissions-policy
- https://wordpress.org/blocks/ → no permissions-policy
- https://wordpress.org/patterns/ → no permissions-policy
- https://wordpress.org/photos/ → no permissions-policy
- FoundCookie flagsMedium
3 of 3 cookies are missing protective flags. Without HttpOnly a script can read the cookie; without Secure it travels over plain HTTP; without SameSite it is sent on cross-site requests.
- old-theme (set by https://wordpress.org/support/forums/) lacks Secure, HttpOnly, SameSite
- PHPSESSID (set by https://wordpress.org/news/podcast-player/17684/episode-86-my-first-wordpress-e…) lacks Secure, HttpOnly, SameSite
- random-photo (set by https://wordpress.org/photos/random/) lacks Secure, HttpOnly, SameSite
- FoundMixed contentLow
8 resources on HTTPS pages are loaded over plain HTTP.
- https://wordpress.org/news/2022/06/the-month-in-wordpress-may-2022/ loads image http://img.youtube.com/vi/oe452WcY7fA/0.jpg
- https://wordpress.org/news/2013/04/wordpress-10th-anniversary-tees/ loads image http://wordpress.org/news/files/2013/04/wp10logo.jpg
- https://wordpress.org/documentation/article/video-shortcode/ loads media http://video-source.mp4/?_=3
- https://wordpress.org/documentation/article/video-shortcode/ loads media http://source.mp4/?_=4
- https://wordpress.org/documentation/article/video-shortcode/ loads media http://source.webm/?_=4
- https://wordpress.org/documentation/article/video-shortcode/ loads media http://source.ogv/?_=4
- https://wordpress.org/news/2014/09/benny/ loads image http://wordpress.org/news/files/2014/09/media.jpg
- https://wordpress.org/news/2013/12/parker/ loads image http://wpdotorg.files.wordpress.com/2013/12/overview.jpg
- NoteThird-party scripts
Scripts run from 2 other domains without Subresource Integrity, so a compromise of any of them changes what runs on this site. (Tag managers and analytics rarely support SRI; a Content-Security-Policy that names these hosts is the usual control.)
- stats.wp.com (39 script tags)
- s.w.org (5 script tags)
- NoteSensitive paths in robots.txt
robots.txt lists 1 path that look private. robots.txt is public and does not restrict access, so it doubles as a map for anyone probing the site; those paths need real access control.
- Disallow: /wp-admin/
7 checks passed
- OKHTTPS
All 3081 crawled pages were served over HTTPS.
- OKHTTP Strict Transport Security
strict-transport-security is set on all 3081 HTML pages.
- OKSoftware version disclosure
The Server header names a product without a version, and there is no X-Powered-By header.
- OKForms over HTTPS
90 forms found, all on HTTPS pages posting to HTTPS addresses.
- OKVulnerable JavaScript libraries
1 library version recognised, none with known vulnerabilities.
- OKKeys and secrets in page code
No API keys, tokens or private keys were found in the sampled HTML and scripts.
- OKExposed files and listings
None of the crawled URLs is a configuration file, backup, dump, repository folder or directory listing.
A passive review of what the crawl recorded: response headers, page and script contents and the URLs it found. It does not probe the site, test TLS settings or look for files that were not linked. Generated automatically; verify each finding against your own site before acting on it.
Sites scoring near wordpress.org
Their neighbours in the SEO rank table, which orders every scanned site by health score.
- supaslides.appDR 1682/100 · rank 801 · 198 pages
- www.scase.caDR 481/100 · rank 917 · 66 pages
- www.brunilaw.comDR 081/100 · rank 917 · 12 pages
- www.immigration-nation.caDR 2981/100 · rank 917 · 1,948 pages
- www.physiomira.comDR 581/100 · rank 917 · 37 pages
- www.4thstreetdental.comDR 281/100 · rank 917 · 69 pages
DR is Ahrefs Domain Rating (0-100, backlink strength), used under its Domain Rating License.
This report was produced by the DIY SEO Hub Site Spider crawling wordpress.org from its pages as published, the way a search engine does. It shows summary figures only.
Own wordpress.org?
- Claim this site to manage the listing, hide it from the public lists, or keep it.
- Want it gone instead? Ask through the support form or e-mail support@diyseohub.com, naming wordpress.org. Removal needs no account and no proof of purchase.