Section 1
01
Score Dashboard
| Area | Score | Bar | Key Finding |
|---|---|---|---|
| Business & Content | 60 | Good portfolio; no schema; Twitter meta bug | |
| UI / UX | 45 | Functional; no consent; language switcher hidden | |
| Accessibility | 30 | user-scalable=no fails WCAG 1.4.4; no hreflang | |
| Performance | 35 | HSTS excellent; no CDN; 1981 Expires; Pragma no-cache | |
| SEO | 40 | 164-URL sitemap; no hreflang, canonical, or schema | |
| Security | 50 | HSTS preload; but Concrete5 5.6 CVEs; no CSP | |
| Privacy / Legal | 20 | No cookie consent; no GDPR mechanism | |
| Code Quality | 25 | 12-year-old CMS; IE conditionals; HTML bugs; internals exposed | |
| CI / CD / Deployment | 20 | nginx/Plesk; no CDN; no CI/CD visible |
Section 2
02
Category Findings
A
Business & Content
60/100
Portfolio
15+ projects including Keturah Resort, The Ritz-Carlton Residences, Emirates Financial Towers, MAG 777, MAG D11. Broker portal, E-Services, and CSR sections present.
Bilingual
English and Arabic (/ar/ prefix). 164-URL sitemap covers both language versions.
Meta Issues
Meta description 205 chars — exceeds 160-char limit. Twitter description has unclosed HTML quote (`well>"`). No structured data for property listings.
Not Tested
Content accuracy, property data freshness, broker portal functionality, lead capture conversion.
B
UI / UX
45/100
CMS Theme
Custom theme by TenTwenty on Concrete5 5.6.x. Site loader animation on first visit via cookie.
Language Switcher
EN/AR switcher exists in `header__top` but parent has `style="display: none"` — may not be visible to users on desktop.
Cookie Consent
None detected. Site sets CONCRETE5 session cookie on first load without any consent prompt.
reCAPTCHA
Google reCAPTCHA loaded on all pages — present on forms. Good practice.
C
Accessibility (WCAG 2.2 AA first-pass)
30/100
HTML lang attribute (en-us)Partial — use lang="en" not "en-us"
user-scalable=no in viewportFail — WCAG 1.4.4 Level AA violation
hreflang alternate tagsFail — absent on bilingual site
Skip navigation linkNot Confirmed
ARIA landmarksNot Tested
Image alt textNot Tested
Colour contrast (WCAG 1.4.3)Not Tested
Keyboard navigationNot Tested
D
Performance
35/100
HTTPS enforcedPass — HTTP 301 to HTTPS
HSTS with preloadExcellent — max-age=581536000; preload
CDN deployedFail — nginx/Plesk origin only
Cache-Control / ExpiresFail — expires: 19 Nov 1981; pragma: no-cache
Core Web VitalsNot Tested
Image optimisationNot Tested
Lazy loadingNot Tested
E
SEO
40/100
robots.txt — blocks CMS pathsPass — comprehensive Disallow rules
Sitemap (164 URLs)Pass — full project and language coverage
Sitemap referenced in robots.txtFail — no Sitemap: directive
Canonical tagFail — absent on all pages
hreflang alternate tagsFail — absent; bilingual site
Structured data (JSON-LD)Fail — no schema detected
OG tagsPartial — present but no og:locale
Twitter cardPartial — malformed closing quote in description
Meta description lengthWarning — 205 chars; exceeds 160-char limit
Concrete5 generator metaFail — version 5.6.3.5b1 fully disclosed
F
Security
50/100
Concrete5 5.6.3.5b1 — End-of-Life CMS with Active CVEs
This release is approximately 12 years old. Multiple CVEs exist for this version range including SQL injection, stored XSS, path traversal, and remote code execution. This is an active exploitation risk on a live production server.
HTTPS enforcedPass
HSTS with preloadExcellent — max-age=581536000
X-Frame-Options: SAMEORIGINPass
X-Content-Type-Options: nosniffPass
X-XSS-Protection: 1; mode=blockWarning — deprecated; remove when CSP added
Content-Security-PolicyFail — absent
Referrer-PolicyFail — absent
Permissions-PolicyFail — absent
x-powered-by: PleskLinFail — platform disclosed
Session cookie Secure flagFail — CONCRETE5 cookie lacks Secure attribute
Session cookie SameSiteFail — no SameSite attribute
CMS version in generator metaFail — 5.6.3.5b1 fully disclosed
G
Privacy, Legal & Compliance
20/100
Cookie consent bannerFail — none detected
GDPR consent mechanismFail — not implemented
Google Consent Mode v2Fail — not implemented
Cookie set before consentFail — CONCRETE5 session cookie on first load
Privacy Policy pagePass — linked from footer
Terms pagePass — linked from footer
H
Code Quality
25/100
CMS version — Concrete5 5.6.3.5b1Critical — end-of-life circa 2015
IE conditional commentsFail — IE8/9 conditionals still in templates
CMS internals in JSFail — CCM_DISPATCHER_FILENAME, CCM_BASE_URL exposed
Twitter description HTMLFail — unclosed quote: content="...well>"
Meta description lengthWarning — 205 chars; truncated in SERPs
lang="en-us" attributeWarning — use lang="en"
Author meta tag discloses agencyNote — "TenTwenty | Webdesign..."
reCAPTCHA on formsPass
I
CI / CD / Deployment
20/100
HTTPSPass
CDNFail — nginx/Plesk origin only
Cache strategyFail — 1981 Expires; Pragma no-cache
Source repositoryNot Found publicly
CI/CD pipelineNot Testable
Staging environmentNot Tested
Section 3
03
Full Issue Register
CriticalP0 — Fix This Week2 issues
SEC-001
Concrete5 CMS 5.6.3.5b1 — end-of-life platform with active CVEs
CriticalP0Large
Evidence
Generator meta: "concrete5 - 5.6.3.5b1" — approximately 2014 release. Current version is Concrete CMS 9.x.
Impact
Multiple publicly-known CVEs: SQL injection (CVE series), stored XSS, path traversal, RCE. Active exploitation possible on live server.
Fix
Plan migration to Concrete CMS 9.x on staging environment. Audit theme compatibility. Deploy with rollback plan.
Owner / Effort
Developer / Management · Large (4–8 weeks)
Verify
Generator meta shows 9.x or is removed; no known CVEs for running version
PRIV-001
No cookie consent — CONCRETE5 session cookie set on first load
CriticalP0Medium
Evidence
No consent banner detected. `set-cookie: CONCRETE5=...; path=/; HttpOnly` on first response. No GDPR mechanism.
Impact
GDPR violation for EU visitors; UAE PDPL liability; invalidates any consent-based analytics data.
Fix
Implement CookieYes or OneTrust. Implement Google Consent Mode v2 with denied defaults for EU regions. Gate analytics behind consent.
Owner / Effort
Developer · Medium
HighP1 — Before Next Release9 issues
SEO-001
No hreflang tags on bilingual EN/AR site
HighP1Small
Evidence
Arabic at /ar/ prefix; no hreflang link tags in source
Fix
Add hreflang="en", hreflang="ar-ae", x-default in CMS page settings or theme header
Owner
Developer / SEO · Small
SEO-002
No canonical tag on any page
HighP1Small
Fix
Add `` to every page template pointing to preferred URL
Owner
Developer · Small
SEO-003
No structured data (JSON-LD) on any page
HighP1Medium
Fix
Add Organization schema to homepage. Add RealEstateListing schema to project detail pages.
Owner
Developer / SEO · Medium
SEO-004
Twitter description has malformed unclosed HTML quote
HighP1Quick Win
Evidence
content="...art of living well>" — trailing `>` inside attribute value
Fix
Fix closing quote in CMS Twitter meta field
SEC-002
No Content-Security-Policy header
HighP1Small
Fix
Add CSP in Content-Security-Policy-Report-Only mode via nginx. Review violations. Progressively enforce.
Owner
DevOps · Small
SEC-003
Session cookie missing Secure and SameSite flags
HighP1Small
Evidence
set-cookie: CONCRETE5=...; path=/; HttpOnly — missing Secure and SameSite
Fix
Add `Secure; SameSite=Lax` in Concrete5 session config or nginx Set-Cookie header transform
ACC-001
user-scalable=no — WCAG 1.4.4 Level AA failure
HighP1Quick Win
Fix
Remove `user-scalable=no` from viewport meta in theme header template
Owner
Developer · Quick Win
PERF-001
No CDN · 1981 Expires date · Pragma no-cache
HighP1Medium
Evidence
server: nginx; expires: Thu, 19 Nov 1981; pragma: no-cache — zero browser or CDN caching
Fix
Add Cloudflare CDN in front of nginx. Configure Cache-Control: public, max-age=3600 for HTML; 2592000 for assets.
SEC-004
x-powered-by: PleskLin discloses hosting platform
HighP1Quick Win
Fix
nginx config: `more_clear_headers 'X-Powered-By';` or Cloudflare Transform Rule to remove header
MediumP2 — Next Development Cycle7 issues
SEC-005
No Referrer-Policy header
MediumP2Quick Win
Fix
Add Referrer-Policy: strict-origin-when-cross-origin via nginx or Cloudflare
SEC-006
No Permissions-Policy header
MediumP2Quick Win
Fix
Add Permissions-Policy: camera=(), microphone=(), geolocation=()
SEO-005
robots.txt does not reference sitemap.xml
MediumP2Quick Win
Fix
Add: Sitemap: https://mag.global/sitemap.xml to robots.txt
COD-001
IE conditional comments still in templates
MediumP2Small
Fix
Remove <!--[if lte IE 8]> etc. — IE support is irrelevant for 2026
COD-002
CMS internal JS variables exposed in page source
MediumP2Small
Evidence
CCM_DISPATCHER_FILENAME, CCM_BASE_URL, CCM_SITE, CCM_TOOLS_PATH in every page source
Fix
Move to server-side config where possible; minimise exposed CMS variables
COD-003
Meta description exceeds 160 chars (205 chars)
MediumP2Quick Win
Fix
Trim to 150–160 chars in CMS meta settings
ACC-002
lang="en-us" — non-standard HTML language attribute
MediumP2Quick Win
Fix
Change to lang="en" in CMS page settings
LowP3 — Backlog4 issues
COD-004
X-XSS-Protection header is deprecated
LowP3Quick Win
Fix
Remove header once CSP is in place; deprecated in modern browsers
COD-005
Author meta tag discloses agency (TenTwenty)
LowP3Quick Win
Fix
Remove or update meta author tag in theme header
UX-001
Language switcher header hidden (display:none)
LowP3Quick Win
Fix
Remove `style="display: none"` from .header__top if EN/AR switcher should be visible
PERF-002
Language switch triggers full-page reload
LowP3Medium
Fix
Consider AJAX locale switching or persistent cookie to avoid full reload on language change
Section 4
04
Implementation Roadmap
| Phase | Focus | Issues | Effort | Timeline | Owner |
|---|---|---|---|---|---|
| Phase 1 | CMS Upgrade & Legal Migrate to Concrete CMS 9.x; add cookie consent | SEC-001, PRIV-001 | 4–8 weeks | Weeks 1–8 | Developer + Management |
| Phase 2 | SEO & Security Headers hreflang, canonical, schema, CSP, cookie fix | SEO-001–005, SEC-002–004 | 1–2 weeks | Weeks 3–4 (parallel) | Developer + DevOps + SEO |
| Phase 3 | Accessibility & Performance Remove user-scalable=no; add Cloudflare CDN | ACC-001–002, PERF-001, COD-001–003 | 1–2 weeks | Weeks 5–6 | Developer + DevOps |
| Phase 4 | Backlog & Monitoring Remaining headers, UX cleanup, uptime monitoring | SEC-005–006, COD-004–005, UX-001, PERF-002 | Ongoing | Weeks 7–10 | DevOps + Developer |
Section 5
05
Audit Tools & Commands
HTTP Redirect Chain
curl -sI http://www.mag.global/
301 redirect from HTTP to HTTPS
Security Headers
curl -sv https://mag.global/
Full response headers including HSTS, X-Frame, XCT
HTML Source
curl -sL https://mag.global/
CMS version, meta tags, cookies, JS variables
robots.txt
WebFetch /robots.txt
Crawl directives — CMS path protection
Sitemap
WebFetch /sitemap.xml
164-URL coverage across projects and languages
Page Content
WebFetch https://www.mag.global
Navigation, footer, cookie consent, contact
Section 6
06
Items Not Tested
The following were in scope but require browser testing, authenticated access, or specialist tooling.
- Lighthouse / PageSpeed Insights CWV
- LCP, CLS, INP measurements
- Mobile rendering across viewports
- Colour contrast ratios (WCAG 1.4.3)
- Keyboard navigation walkthrough
- Screen reader testing
- Arabic page full audit (/ar/)
- Project detail page audit
- Broker portal security
- E-Services portal security
- Lead capture form submission
- 404 and error pages
- SSL certificate expiry
- PHP version on server
- Concrete5 CVE active verification
- Image alt text audit
- Internal link structure depth
- Cookie banner blocking verification