This is a same-day re-audit of workflowloom.com after the morning baseline (99/100) and its remediation cycle. The full collector pipeline was re-run from scratch — fresh crawl, fresh Lighthouse lab runs, fresh header/DNS/TLS captures — and every fix was re-verified by the same probes that found the original issues. The site now scores 100/100 with zero rubric deductions in any dimension.
Seven of the nine baseline findings are confirmed closed by independent re-measurement: the open /images/ listing (now 403), the CSP block on Microsoft Clarity's beacon (console errors gone), mobile performance (Lighthouse 77 → 96, LCP 6.5 s → 2.8 s), DMARC enforcement (p=quarantine live), all over-length titles and descriptions, and the /sitemap.xml alias (now a 301). The two that remain are advisory: a manual consent-gating check (WL2-001) and a deliberately-recorded schema address decision (WL2-003). Nothing outstanding affects the score.
| Metric | Baseline (this morning) | Now |
|---|---|---|
| Overall score (rubric v1.0) | 99 | 100 |
| Security Hygiene | 85 (open /images/ listing) | 100 |
| Lighthouse mobile performance | 77 | 96 |
| Mobile LCP (lab, slow-4G sim) | 6.5 s | 2.8 s |
| Lighthouse best-practices | 73 (CSP console errors + cookies) | 77 (cookies only — WL2-001) |
| DMARC | p=none | p=quarantine |
| Directory-listing probe | 1 open | 0 open |
| Titles > 580 px / descriptions > 160 ch | 1 / 4 | 0 / 0 |
| /sitemap.xml | 404 | 301 → /sitemap-index.xml |
| External render-blocking stylesheets | 4 | 0 (inlined, ~17 KB) |
| ID | Baseline finding | Status | Re-verification evidence (this run) |
|---|---|---|---|
| WL-001 | Open directory listing /images/ | Closed | Collector probe: 0 open listings; /images/ → 403 |
| WL-002 | CSP blocked Clarity beacon | Closed | Live CSP carries https://*.clarity.ms; errors-in-console no longer a failing audit |
| WL-003 | Mobile lab LCP 6.5 s | Closed | Fresh Lighthouse: perf 96, LCP 2.8 s, CLS 0; crawl shows zero external stylesheets |
| WL-004 | Consent gating unverified | Open | Carried forward as WL2-001 — manual browser check still pending |
| WL-005 | DMARC p=none | Closed | DNS capture: v=DMARC1; p=quarantine; rua=mailto:[email protected] |
| WL-006 | 4 long meta descriptions | Closed | Crawl export: zero descriptions over 160 ch (max 160) |
| WL-007 | 1 long title | Closed | Crawl export: zero titles over 580 px |
| WL-008 | /sitemap.xml 404 | Closed | Collector: /sitemap.xml → 301 → /sitemap-index.xml |
| WL-009 | Country-only schema address | Deferred | Deliberate, recorded decision (site commit ae08aa7); carried as WL2-003 |
| ID | Severity | Item | Next step |
|---|---|---|---|
| WL2-001 | Low · likely | Third-party cookies (Clarity → Bing MUID sync) still flagged in a no-consent lab run; sole driver of best-practices 77. Termly gating unverified. | 5-minute incognito check per runbooks.md — now meaningful since Clarity actually fires. If the Bing sync is unwanted, enable Clarity's cookieless mode. |
| WL2-002 | Low · lab-only | Mobile lab LCP 2.8 s sits marginally above the 2.5 s "good" line. No field data exists to confirm real-user impact. | Optional polish (edge-caching HTML, hero simplification). Monitor; act only if CrUX field data ever disagrees. |
| WL2-003 | Low · decision | Organization schema address stays country-level — deliberate privacy call, forfeits local-pack signals. | None unless positioning changes; city/state-only remains the middle path. |
Coverage. Crawl-based, not sampled: fresh Screaming Frog crawl of the full site (20 URLs — 12 HTML pages plus assets; the baseline's 26 included stylesheets that are now inlined). Same 12 HTML pages as the baseline, each re-fetched and re-inspected in raw HTML: /, /about/, /how-it-works/, /services/, /blog/ + 3 posts, /transportation/, /case-studies/, /privacy/, /contact/.
Limitations (unchanged from baseline): no CrUX field data (site below traffic threshold — performance findings are lab-only); Lighthouse ran on the homepage only; security section is hygiene-only, not a vulnerability scan; consent-flow behavior not lab-verifiable (WL2-001); no GSC/analytics/keyword/competitor inputs. Both same-day Lighthouse runs used identical settings, so the before/after deltas are like-for-like.