www.mag.global · 28 August 2026 · vl-web-audit v2.1 · 36 checks across 6 categories
| # | Category | Check Item | Status | Finding / Evidence | Screenshot | Recommendation | Owner | Priority | Effort |
|---|---|---|---|---|---|---|---|---|---|
| A — SEO / On-Page | |||||||||
| 1 | SEO | hreflang tags EN/AR alternates + x-default | Fail | Bilingual EN/AR site; zero hreflang link tags in source | 📷Add Screenshot | Add hreflang="en", hreflang="ar-ae", x-default to all page templates | Developer/SEO | P1 | Small |
| 2 | SEO | Canonical tag Present on all pages | Fail | No <link rel="canonical"> detected on homepage or any page | 📷Add Screenshot | Add canonical to every page template in Concrete5 | Developer | P1 | Small |
| 3 | SEO | Structured data Organization + listing schema | Fail | No JSON-LD schema detected; no Organization or RealEstateListing markup | 📷Add Screenshot | Add Organization schema to homepage; RealEstateListing to project pages | Developer/SEO | P1 | Medium |
| 4 | SEO | Twitter description HTML No malformed attributes | Fail | content="...art of living well>" — unclosed quote in meta attribute | 📷Add Screenshot | Fix closing quote in CMS Twitter meta field | Developer | P1 | Quick Win |
| 5 | SEO | robots.txt CMS paths blocked | OK | Comprehensive Disallow rules for /concrete/, /config/, /models/ etc. | 📷Add Screenshot | Add Sitemap: directive | DevOps | P2 | Quick Win |
| 6 | SEO | Sitemap in robots.txt Sitemap: directive present | Fail | sitemap.xml exists at /sitemap.xml but no Sitemap: directive in robots.txt | 📷Add Screenshot | Add: Sitemap: https://mag.global/sitemap.xml | DevOps | P2 | Quick Win |
| 7 | SEO | Sitemap content All pages covered | OK | 164 URLs — projects, news, AR versions all covered | 📷Add Screenshot | Monitor in GSC | SEO | — | — |
| 8 | SEO | Meta description length Under 160 chars | Warning | 205 chars — will be truncated in Google SERPs | 📷Add Screenshot | Trim to 150–160 chars in CMS meta settings | SEO/Content | P2 | Quick Win |
| 9 | SEO | OG tags Present with og:locale | Warning | OG tags present but no og:locale tag | 📷Add Screenshot | Add og:locale="en_AE" to English pages | Developer/SEO | P2 | Quick Win |
| 10 | SEO | Twitter card type summary_large_image | OK | twitter:card="summary_large_image" present | 📷Add Screenshot | No action — fix description bug (row 4) | — | — | — |
| B — Security | |||||||||
| 11 | Security | CMS version Current, supported release | Fail | Concrete5 5.6.3.5b1 (~2014) — end-of-life with multiple known CVEs | 📷Add Screenshot | Migrate to Concrete CMS 9.x on staging; deploy post-testing | Developer | P0 | Large |
| 12 | Security | HTTPS enforced HTTP 301 to HTTPS | OK | HTTP returns 301 to HTTPS — enforced correctly | 📷Add Screenshot | No action needed | — | — | — |
| 13 | Security | HSTS with preload max-age, includeSubDomains, preload | OK | Strict-Transport-Security: max-age=581536000; includeSubDomains; preload — excellent | 📷Add Screenshot | No action — strongest possible configuration | — | — | — |
| 14 | Security | X-Frame-Options SAMEORIGIN | OK | x-frame-options: SAMEORIGIN — clickjacking protection active | 📷Add Screenshot | No action needed | — | — | — |
| 15 | Security | X-Content-Type-Options nosniff | OK | x-content-type-options: nosniff — MIME sniffing blocked | 📷Add Screenshot | No action needed | — | — | — |
| 16 | Security | Content-Security-Policy CSP header present | Fail | No CSP header — XSS unmitigated at header level | 📷Add Screenshot | Add CSP in report-only mode via nginx config; harden progressively | DevOps | P1 | Small |
| 17 | Security | Session cookie flags Secure + SameSite=Lax | Fail | CONCRETE5 cookie: HttpOnly only — missing Secure and SameSite flags | 📷Add Screenshot | Add Secure; SameSite=Lax in Concrete5 session configuration | Developer | P1 | Small |
| 18 | Security | x-powered-by header Platform not disclosed | Fail | x-powered-by: PleskLin — hosting platform disclosed | 📷Add Screenshot | Suppress via nginx: more_clear_headers 'X-Powered-By' | DevOps | P1 | Quick Win |
| 19 | Security | X-XSS-Protection Deprecated — remove | Warning | x-xss-protection: 1; mode=block — deprecated in modern browsers | 📷Add Screenshot | Remove once CSP is implemented | DevOps | P3 | Quick Win |
| C — Privacy / Legal | |||||||||
| 20 | Privacy | Cookie consent banner GDPR compliant | Fail | No consent banner detected. CONCRETE5 session cookie set on first load without consent. | 📷Add Screenshot | Implement CookieYes or OneTrust with Google Consent Mode v2 | Developer | P0 | Medium |
| 21 | Privacy | Google Consent Mode v2 Configured with EU defaults | Fail | Not implemented — no consent mode configuration detected | 📷Add Screenshot | Implement with all categories denied by default for EU regions | Developer | P0 | Medium |
| 22 | Privacy | Privacy Policy page Linked from footer | OK | Privacy policy linked at /privacy-policy/ from footer | 📷Add Screenshot | No action needed | — | — | — |
| 23 | Privacy | Terms page Linked from footer | OK | Terms linked at /terms/ from footer | 📷Add Screenshot | No action needed | — | — | — |
| D — Accessibility | |||||||||
| 24 | Access. | user-scalable=no WCAG 1.4.4 Level AA | Fail | Viewport meta: user-scalable=no — prevents pinch-to-zoom for low vision users | 📷Add Screenshot | Remove user-scalable=no from viewport meta tag | Developer | P1 | Quick Win |
| 25 | Access. | HTML lang attribute Standard lang="en" | Warning | lang="en-us" — non-standard; screen readers may misinterpret | 📷Add Screenshot | Change to lang="en" in CMS page settings | Developer | P2 | Quick Win |
| 26 | Access. | Skip navigation link WCAG 2.1 SC 2.4.1 | Missing | Not detected in source — not confirmed | 📷Add Screenshot | Add visually-hidden skip link as first focusable element in header | Developer | P1 | Small |
| 27 | Access. | Full WCAG 2.2 AA audit Colour contrast, keyboard, SR | Missing | No external accessibility audit performed — compliance unknown | 📷Add Screenshot | Commission WCAG 2.2 AA audit with axe DevTools and screen reader testing | Developer/Designer | P1 | Medium |
| E — Performance | |||||||||
| 28 | Perf. | HSTS with preload Strong HSTS config | OK | max-age=581536000; includeSubDomains; preload — excellent configuration | 📷Add Screenshot | No action needed — maintain preload registration | — | — | — |
| 29 | Perf. | CDN deployed Edge caching active | Fail | server: nginx — no CDN headers detected; all requests hit Plesk origin | 📷Add Screenshot | Add Cloudflare CDN in front of nginx origin | DevOps | P1 | Medium |
| 30 | Perf. | Cache-Control headers Modern max-age values | Fail | expires: Thu, 19 Nov 1981 08:52:00 GMT — 45-year-old expiry; pragma: no-cache | 📷Add Screenshot | Configure modern Cache-Control headers via nginx or Cloudflare | DevOps | P1 | Small |
| 31 | Perf. | reCAPTCHA on forms Spam protection active | OK | Google reCAPTCHA API loaded on all pages — form spam protection active | 📷Add Screenshot | No action needed | — | — | — |
| 32 | Perf. | Language switch performance No full-page reload | Fail | Language switch uses /tools/locale?_lcl=ar_AE — triggers full-page reload | 📷Add Screenshot | Consider persistent cookie or AJAX locale switching | Developer | P3 | Medium |
| F — Technology / CI/CD | |||||||||
| 33 | Tech | CMS platform version Supported, current release | Fail | Concrete5 5.6.3.5b1 — end-of-life (~2014); current is Concrete CMS 9.x | 📷Add Screenshot | Plan migration to Concrete CMS 9.x — begin immediately on staging | Developer | P0 | Large |
| 34 | Code | IE conditional comments Removed from templates | Fail | <!--[if lte IE 8]> and <!--[if IE 9]> conditionals still in page source | 📷Add Screenshot | Remove IE conditional comments from theme templates | Developer | P2 | Small |
| 35 | Code | CMS internals in JS Minimise exposed variables | Fail | CCM_DISPATCHER_FILENAME, CCM_BASE_URL, CCM_SITE, CCM_TOOLS_PATH in every page | 📷Add Screenshot | Move to server-side config where possible; minimise client-side exposure | Developer | P2 | Small |
| 36 | Tech | Staging environment Separate from production | Missing | No staging environment identified — required for safe CMS upgrade | 📷Add Screenshot | Set up staging server for CMS 9.x migration testing | DevOps | P2 | Medium |