Full site audit following the analytics launch

The September pass in SC-21 was run blind — every page weighed the same because there was no way to know which ones anyone reached. Analytics changes what an audit can ask: the pages that get opened deserve the scrutiny, and a page nobody has ever landed on is worth a different conversation than a broken link.

Wait for enough data to be worth reading. An audit run on three days of traffic would be measuring the deploy.

Carry forward from SC-21

Two findings there were left open rather than fixed, and this pass should close them or record why not:

• ~~The Kremlin citation.~~ Closed 21 September 2026. Opened from a connection that can reach the host: http:// returns 200, https:// does not connect. The link works, the http:// is correct, and it must not be rewritten. See SC-21.
• Ticket pages carry no JSON-LD, while entry pages emit an Article block. Inconsistent rather than wrong.

Finding 3 there — no security headers beyond HSTS — is now partly answered: SC-27 put Referrer-Policy: no-referrer on /holocron. The site-wide case is still open, along with X-Content-Type-Options, X-Frame-Options, Permissions-Policy and CSP.

What analytics adds to the checklist

• Which pages are actually entered from search, and whether their titles and descriptions read like the thing someone clicked.
• Whether any page is being reached that should not be — the holocron shows as /(private), so a count above what you can account for yourself is worth knowing about.
• Real device and viewport spread, rather than an assumption about it.

A technical pass was run on 21 September

Not this audit. It covered indexability only, and used no traffic data, so none of the three things above that analytics is supposed to add were looked at. Recorded so it is not repeated rather than counted.

Came back clean: 47 sitemap URLs all returning 200, no midnight timestamps, no http:// entries; every page with its own title, description and single h1, no duplicates of either; canonical matching og:url everywhere; http to https, www to apex and trailing slashes all redirecting to one address; a real 404 on a missing page; 48 internal link targets with none broken; 24 KB of HTML per page on average.

Bot-blocking, not link rot: Facebook returns 400 to any plain request — including to its own page and NASA's — and Reuters, the New York Times, AP, The Hill and the Economist return 401 or 403 the same way. AP and analytics.google.com return 200 with a browser user agent.

Not a defect: the home page's canonical is https://scofti.com while the sitemap says https://scofti.com/. An empty path is /, so those are one address to a crawler.

Unexplained, recorded rather than claimed: HTML responses carry Access-Control-Allow-Origin: *. It appears to be a platform default and has no bearing on indexing, but whether it can be changed has not been checked.

So what is still outstanding here is what it always was: enough traffic to be worth reading, then the questions only traffic can answer.

Closed October 1

A last technical pass against production before closing, the same checks as September 21 at a bigger size.

Clean: 75 sitemap URLs, every one returning 200, with no midnight timestamps and no http:// entries. Every page has its own title and description, a single h1, and a canonical that matches its og:url. No title or description is duplicated. All 80 internal link targets resolve. http to https, www to apex and a trailing slash each redirect to one address, and a missing page returns a real 404.

Still open, unchanged from above: ticket pages carry no JSON-LD (all 44 of them), and the home page sends HSTS and nothing else. There is no X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy or CSP, and Access-Control-Allow-Origin: * is still there.

Not looked at: the three analytics questions this ticket was opened for. No traffic data was read in this pass, so it closes with them unanswered.