Site audit, September 2026

A pass over the whole site before building on it — technical, accessibility and link health, checked against production rather than the build.

Clean

• 29 URLs in the sitemap, 29 unique titles, 29 unique descriptions. No duplicates, none missing, no page borrowing another's.
• Every page has exactly one <h1>.
• Canonical equals og:url everywhere, enforced on every build by check:meta, and every page now carries its own share card.
• Host and protocol resolve to one place. http:// → https://, www. → apex, a trailing slash redirects to the clean path. No page is reachable at two addresses.
• 404s return 404, not a soft 200.
• lang="en" and a viewport tag are present.
• Contrast passes for body text, the accent blue and the finished green — all above 4.5:1 on white.
• Form inputs have real labels; the jukebox iframe has a title.
• Page weight is small: 15 KB for the home page, 50 KB for the board.

Findings

1. Low-contrast text in nine places — FIXED

text-neutral-400 is 2.52:1 on white, which fails WCAG AA for normal text. It is not decoration — it carries ticket IDs, column counts, entry dates, the city on the home page, and the "Empty." messages on the board. neutral-500 is 4.74:1 and passes.

Raised to neutral-500 everywhere it carried text. No text-neutral-400 is left in the app. The one place the old value survives is a decorative ▸ marker, which is aria-hidden and reads as nothing.

2. The Kremlin citation is http://, and unreachable from here

The world-leaders piece links http://en.kremlin.ru/... — the only non-HTTPS link in any published page.

en.kremlin.ru does not respond at all from this machine, over either protocol, including the site root. That looks like network-level blocking rather than a dead page, so the link has not been shown to be broken and must not be treated as broken. Equally, the http:// cannot simply be rewritten to https:// on the assumption it works — that would be publishing a URL nobody has opened. It needs checking from a connection that can reach the host.

3. No security headers beyond HSTS

Production sends Strict-Transport-Security and nothing else — no Referrer-Policy, X-Content-Type-Options, X-Frame-Options, Permissions-Policy or CSP. Nothing is broken by their absence, and a Referrer-Policy is the one with a real argument behind it here: without it, following an outbound link tells that site which page it was on. That sits oddly beside a privacy page.

4. Ticket pages carry no JSON-LD

Entry pages emit an Article block with the dates in machine-readable form. Ticket pages emit none, despite being indexed and served in search results. Inconsistent rather than wrong.

Not findings, recorded so they are not re-investigated

• AP, the Economist and CNBC return 403 to a plain request. That is bot-blocking, not link rot — CNBC returns 200 with a browser user agent, and the other two are paywalled. The links are fine.
• The largest JS chunk is 229 KB. That is the React and Next runtime, not anything this site added.

Finding 2 answered, 21 September 2026

The Kremlin citation was checked from a connection that can reach the host, which is what this finding asked for.

http://en.kremlin.ru/events/president/news/80754 returns 200, repeatedly. The same URL over https:// fails to connect at all. So the http:// in the world-leaders piece is correct rather than an oversight, the link is not broken, and rewriting it to https:// would break a link that currently works.

Left exactly as it is. Recorded here so nobody rewrites it on sight.