Scanned sites / www.kcphysiotherapy.com / 2026-09-20-1742
www.kcphysiotherapy.com scan from 9/20/2026, 5:42:47 PM
Scan 2026-09-20-1742
Scanned 9/20/2026, 5:42:47 PM, finished 9/20/2026, 5:53:49 PM. Found with openstreetmap overpass
Site: https://www.kcphysiotherapy.com/
Download SQLite databaseEvery page and asset from this scan, with the crawl events, in one file.
On September 20, 2026 the Site Spider crawled 87 pages and 596 assets of www.kcphysiotherapy.com, starting from https://www.kcphysiotherapy.com/. It scored 71 out of 100, a result that needs work. 8 of 14 checks found something to fix, led by meta descriptions (87), headings (53), indexability (40); 6 checks passed. The list below shows each check's result, the fix plan, when present, explains what to do first, and the security review at the end of the page covers headers, transport, libraries and exposed files.
Security review: Medium3 medium, 3 low and 2 info findings. See the security findings ↓
- Pages crawled
- 87
- Assets fetched
- 596
- Status
- Completed
- Checks with issues
- 8 of 14
- Title tags21 issues21 of 87 pages have title issues.
- Meta descriptions87 issues87 of 87 pages have meta description issues.
- Headings53 issues53 of 87 pages have heading issues.
- Broken linksOK0 internal links point at 0 broken URLs.
- RedirectsOK1 redirecting URL, 0 of them chained.
- Non-200 responsesOK1 URL did not return a 2xx response.
- Rate limitedOKThe site did not rate limit the crawler.
- Indexability40 issues40 of 87 indexable pages have indexability warnings.
- Image alt textOK0 of 619 image references have no alt attribute. 421 use an empty alt (decorative), which is fine.
- Heavy assets30 issues31 assets larger than 500 KB among the 100 heaviest.
- Orphan pages12 issues12 pages have no internal links pointing at them.
- Sitemap coverage22 issues5 sitemaps listing 77 URLs: 10 crawled pages missing, 0 listed URLs broken or redirecting, 12 reachable only via the sitemap.
- Thin content20 issues20 of 87 pages have fewer than 200 words.
- Duplicate contentOK0 groups of pages with identical HTML.
Where this scan sits among all scanned sites
1125 sites, median 82%, average 80%
www.kcphysiotherapy.com scores 71%, higher than 15% of the 1125 scanned sites. See the full ranking.
Green 90% and up (Excellent), lime 75 to 89 (Good), amber 50 to 74 (Needs work), red below 50 (Poor).
Internal link map
Loading the link map...
Fix plan
Written by gpt-4o-mini from the scan findingsYour site has several SEO issues requiring attention, particularly with titles, meta descriptions, and indexability. Addressing these will improve your site's visibility and health score.
- 1
Fix Redirect Issue
Why: Redirects can confuse search engines and impact user experience.
How: Update the sitemap to reflect the new URL directly without redirection.
Checks: redirects
- 2
Add Title Tags
Why: 21 pages have title issues that can negatively impact rankings.
How: Create unique titles under 60 characters for each page.
Checks: titles
- 3
Implement Meta Descriptions
Why: All pages lack meta descriptions, affecting click-through rates.
How: Write unique meta descriptions for each page, aiming for 150-160 characters.
Checks: meta-descriptions
- 4
Add Missing Headings
Why: 53 pages are missing H1 tags, which are essential for SEO.
How: Add a relevant H1 tag to each page that conveys the main topic.
Checks: headings
- 5
Resolve Indexability Warnings
Why: 40 pages have indexability warnings that may limit their discoverability.
How: Add canonical tags to pages where applicable to clarify indexing.
Checks: indexability
- 6
Address Thin Content
Why: 20 pages with fewer than 200 words can be considered low-quality.
How: Enhance these pages with more relevant content to improve value.
Checks: thin-content
Generated automatically; verify each change against your own site before relying on it.
Security review
Written by gpt-4o-mini from 16 checks over the crawlThe site has several security headers missing, which can leave it vulnerable to various attacks. High-priority issues include a lack of HTTP Strict Transport Security and Content Security Policy, both crucial for protecting against common threats. Additionally, Clickjacking protection is not implemented, and there are other headers absent that mitigate risks related to MIME sniffing and privacy.
- 0 high
- 3 medium
- 3 low
- 2 info
- 1
Missing HTTP Strict Transport Security (HSTS)Medium
Why it matters: Without HSTS, users may be exposed to man-in-the-middle attacks if they access the site via HTTP.
Fix: Add the header 'Strict-Transport-Security: max-age=31536000; includeSubDomains; preload'.
Evidence: HTTP Strict Transport Security
- 2
Missing Content Security Policy (CSP)Medium
Why it matters: Absence of CSP allows loading content from any source, increasing the risk of XSS attacks.
Fix: Implement a CSP header like 'Content-Security-Policy: default-src 'self';'.
Evidence: Content Security Policy
- 3
Missing X-Frame-Options (Clickjacking Protection)Medium
Why it matters: Not using X-Frame-Options makes the site vulnerable to clickjacking attacks.
Fix: Add the header 'X-Frame-Options: DENY' or use 'Content-Security-Policy: frame-ancestors 'none''.
Evidence: Clickjacking protection
- 4
Missing X-Content-Type-Options (MIME Sniffing Protection)Low
Why it matters: Without this header, browsers may execute unintended content types, increasing risk.
Fix: Include the header 'X-Content-Type-Options: nosniff'.
Evidence: MIME sniffing protection
- 5
Missing Referrer-PolicyLow
Why it matters: Absence of a referrer policy exposes full URLs to third-party sites, risking user privacy.
Fix: Add the header 'Referrer-Policy: no-referrer-when-downgrade'.
Evidence: Referrer policy
- 6
Server Version DisclosureLow
Why it matters: Revealing server versions can aid attackers in targeting known vulnerabilities.
Fix: Consider configuring the web server to hide version details or set 'Server: nginx' and 'Server: Apache' to a generic value.
Evidence: Software version disclosure
- 7
Missing Permissions-PolicyInfo
Why it matters: Without a permissions policy, injected scripts could misuse sensitive browser features.
Fix: Specify the header 'Permissions-Policy: geolocation=(), microphone=(), camera=()'.
Evidence: Permissions policy
- 8
Potentially Sensitive Paths in robots.txtInfo
Why it matters: The presence of /wp-admin/ in robots.txt may lead attackers to target these paths.
Fix: Ensure sensitive areas have proper authentication, not just a robots.txt exclusion.
Evidence: Sensitive paths in robots.txt
What the checks found
- FoundHTTP Strict Transport SecurityMedium
No HTML page sends strict-transport-security. Without it a visitor who types the address without https:// can be intercepted on the first request.
- https://www.kcphysiotherapy.com/ → no strict-transport-security
- https://www.kcphysiotherapy.com/our-services/ → no strict-transport-security
- https://www.kcphysiotherapy.com/free-webinars/ → no strict-transport-security
- https://www.kcphysiotherapy.com/therapist-list/ → no strict-transport-security
- https://www.kcphysiotherapy.com/category/physiotherapy/ → no strict-transport-security
- https://www.kcphysiotherapy.com/category/massage-therapy/ → no strict-transport-security
- https://www.kcphysiotherapy.com/category/athletictherapy/ → no strict-transport-security
- https://www.kcphysiotherapy.com/join-our-team/ → no strict-transport-security
- https://www.kcphysiotherapy.com/faq/ → no strict-transport-security
- https://www.kcphysiotherapy.com/photo-gallery/ → no strict-transport-security
- https://www.kcphysiotherapy.com/category/physiotherapy-blog/ → no strict-transport-security
- https://www.kcphysiotherapy.com/auto-draft/ → no strict-transport-security
- FoundContent Security PolicyMedium
None of the 87 HTML pages send a Content-Security-Policy header or meta tag, so the browser has no restriction on where scripts, styles and frames may load from.
- https://www.kcphysiotherapy.com/ → no content-security-policy
- https://www.kcphysiotherapy.com/our-services/ → no content-security-policy
- https://www.kcphysiotherapy.com/free-webinars/ → no content-security-policy
- https://www.kcphysiotherapy.com/therapist-list/ → no content-security-policy
- https://www.kcphysiotherapy.com/category/physiotherapy/ → no content-security-policy
- https://www.kcphysiotherapy.com/category/massage-therapy/ → no content-security-policy
- https://www.kcphysiotherapy.com/category/athletictherapy/ → no content-security-policy
- https://www.kcphysiotherapy.com/join-our-team/ → no content-security-policy
- https://www.kcphysiotherapy.com/faq/ → no content-security-policy
- https://www.kcphysiotherapy.com/photo-gallery/ → no content-security-policy
- https://www.kcphysiotherapy.com/category/physiotherapy-blog/ → no content-security-policy
- https://www.kcphysiotherapy.com/auto-draft/ → no content-security-policy
- FoundClickjacking protectionMedium
No HTML page sends x-frame-options. Without X-Frame-Options (or a CSP frame-ancestors directive) the pages can be embedded in a frame on another site and overlaid with invisible controls.
- https://www.kcphysiotherapy.com/ → no x-frame-options
- https://www.kcphysiotherapy.com/our-services/ → no x-frame-options
- https://www.kcphysiotherapy.com/free-webinars/ → no x-frame-options
- https://www.kcphysiotherapy.com/therapist-list/ → no x-frame-options
- https://www.kcphysiotherapy.com/category/physiotherapy/ → no x-frame-options
- https://www.kcphysiotherapy.com/category/massage-therapy/ → no x-frame-options
- https://www.kcphysiotherapy.com/category/athletictherapy/ → no x-frame-options
- https://www.kcphysiotherapy.com/join-our-team/ → no x-frame-options
- https://www.kcphysiotherapy.com/faq/ → no x-frame-options
- https://www.kcphysiotherapy.com/photo-gallery/ → no x-frame-options
- https://www.kcphysiotherapy.com/category/physiotherapy-blog/ → no x-frame-options
- https://www.kcphysiotherapy.com/auto-draft/ → no x-frame-options
- FoundMIME sniffing protectionLow
No HTML page sends x-content-type-options. Without X-Content-Type-Options: nosniff a browser may run a file as a script because of its contents rather than its declared type.
- https://www.kcphysiotherapy.com/ → no x-content-type-options
- https://www.kcphysiotherapy.com/our-services/ → no x-content-type-options
- https://www.kcphysiotherapy.com/free-webinars/ → no x-content-type-options
- https://www.kcphysiotherapy.com/therapist-list/ → no x-content-type-options
- https://www.kcphysiotherapy.com/category/physiotherapy/ → no x-content-type-options
- https://www.kcphysiotherapy.com/category/massage-therapy/ → no x-content-type-options
- https://www.kcphysiotherapy.com/category/athletictherapy/ → no x-content-type-options
- https://www.kcphysiotherapy.com/join-our-team/ → no x-content-type-options
- https://www.kcphysiotherapy.com/faq/ → no x-content-type-options
- https://www.kcphysiotherapy.com/photo-gallery/ → no x-content-type-options
- https://www.kcphysiotherapy.com/category/physiotherapy-blog/ → no x-content-type-options
- https://www.kcphysiotherapy.com/auto-draft/ → no x-content-type-options
- FoundReferrer policyLow
No HTML page sends referrer-policy. Without a Referrer-Policy the full page address, including any query string, is sent to every site a visitor clicks through to.
- https://www.kcphysiotherapy.com/ → no referrer-policy
- https://www.kcphysiotherapy.com/our-services/ → no referrer-policy
- https://www.kcphysiotherapy.com/free-webinars/ → no referrer-policy
- https://www.kcphysiotherapy.com/therapist-list/ → no referrer-policy
- https://www.kcphysiotherapy.com/category/physiotherapy/ → no referrer-policy
- https://www.kcphysiotherapy.com/category/massage-therapy/ → no referrer-policy
- https://www.kcphysiotherapy.com/category/athletictherapy/ → no referrer-policy
- https://www.kcphysiotherapy.com/join-our-team/ → no referrer-policy
- https://www.kcphysiotherapy.com/faq/ → no referrer-policy
- https://www.kcphysiotherapy.com/photo-gallery/ → no referrer-policy
- https://www.kcphysiotherapy.com/category/physiotherapy-blog/ → no referrer-policy
- https://www.kcphysiotherapy.com/auto-draft/ → no referrer-policy
- FoundPermissions policyInfo
No HTML page sends permissions-policy. A Permissions-Policy header turns off browser features the site does not use (camera, microphone, geolocation), limiting what an injected script could do.
- https://www.kcphysiotherapy.com/ → no permissions-policy
- https://www.kcphysiotherapy.com/our-services/ → no permissions-policy
- https://www.kcphysiotherapy.com/free-webinars/ → no permissions-policy
- https://www.kcphysiotherapy.com/therapist-list/ → no permissions-policy
- https://www.kcphysiotherapy.com/category/physiotherapy/ → no permissions-policy
- https://www.kcphysiotherapy.com/category/massage-therapy/ → no permissions-policy
- https://www.kcphysiotherapy.com/category/athletictherapy/ → no permissions-policy
- https://www.kcphysiotherapy.com/join-our-team/ → no permissions-policy
- https://www.kcphysiotherapy.com/faq/ → no permissions-policy
- https://www.kcphysiotherapy.com/photo-gallery/ → no permissions-policy
- https://www.kcphysiotherapy.com/category/physiotherapy-blog/ → no permissions-policy
- https://www.kcphysiotherapy.com/auto-draft/ → no permissions-policy
- FoundSoftware version disclosureLow
Responses reveal the exact server or framework version, which lets an attacker look up known vulnerabilities for it without guessing.
- server: Apache (582 responses)
- server: nginx/1.29.8 (101 responses)
- NoteSensitive paths in robots.txt
robots.txt lists 1 path that look private. robots.txt is public and does not restrict access, so it doubles as a map for anyone probing the site; those paths need real access control.
- Disallow: /wp-admin/
7 checks passed, 1 not applicable
- OKHTTPS
All 87 crawled pages were served over HTTPS.
- OKMixed content
No HTTPS page loads a script, stylesheet, font or image over plain HTTP.
- OKForms over HTTPS
61 forms found, all on HTTPS pages posting to HTTPS addresses.
- OKVulnerable JavaScript libraries
2 library versions recognised, none with known vulnerabilities.
- OKKeys and secrets in page code
No API keys, tokens or private keys were found in the sampled HTML and scripts.
- OKExposed files and listings
None of the crawled URLs is a configuration file, backup, dump, repository folder or directory listing.
- OKThird-party scripts
The sampled pages load no scripts from other domains.
- Not applicableCookie flags
The crawl set no cookies, so there are no cookie flags to check.
A passive review of what the crawl recorded: response headers, page and script contents and the URLs it found. It does not probe the site, test TLS settings or look for files that were not linked. Generated automatically; verify each finding against your own site before acting on it.
Sites scoring near www.kcphysiotherapy.com
Their neighbours in the SEO rank table, which orders every scanned site by health score.
- daviesdrury.com72/100 · rank 906 · 53 pages
- sjm.lat72/100 · rank 906 · 6 pages
- www.ostationcafe.ca71/100 · rank 931 · 2 pages
- bigdranch.com71/100 · rank 931 · 7 pages
- floridarevenue.com71/100 · rank 931 · 969 pages
- greenleafdental.ca71/100 · rank 931 · 47 pages
This report was produced by the DIY SEO Hub Site Spider crawling www.kcphysiotherapy.com from its pages as published, the way a search engine does. It shows summary figures only.
Own www.kcphysiotherapy.com?
- Claim this site to manage the listing, hide it from the public lists, or keep it.
- Want it gone instead? Ask through the support form or e-mail support@diyseohub.com, naming www.kcphysiotherapy.com. Removal needs no account and no proof of purchase.