Finding Summary
24 Issues Identified
Across 9 audit categories covering security, SEO, accessibility, performance, privacy, and code quality.
Immediate Action Required
The WordPress REST API publicly exposes staff usernames and IDs without authentication. This creates a direct brute-force attack surface. Fix this week via a single PHP filter or security plugin.
All HTTP Security Headers Missing
HSTS, CSP, X-Frame-Options, and X-Content-Type-Options are absent. These can all be added in minutes via Cloudflare Transform Rules — no code deployment needed.
Area Scores
Performance by Category
Scores are baseline indicators from automated checks. Not a substitute for full Lighthouse testing or legal review.
Business & Content
65
Good portfolio; title errors, stale OG
UI / UX
60
Clean design; missing skip-nav
Accessibility
35
No skip links, no ARIA, missing alt text
Performance
45
CDN active; dual jQuery, no cache headers
SEO
55
Yoast Premium; title duplication, OG mismatch
Security
30
HTTPS enforced; REST API leak, no headers
Privacy / Legal
60
CookieYes + consent mode v2; privacy policy unconfirmed
Code Quality
35
WP 7.1 current; XHTML doctype, dual jQuery
CI / CD / Deployment
20
Cloudflare CDN; no source repo, no pipeline
Priority 0
Critical Issues — Fix This Week
SEC-001
WordPress REST API exposes user accounts
/wp-json/wp/v2/users returns 3 staff records: usernames, IDs, and profile URLs — no authentication required.
→ Add PHP filter to restrict REST API user endpoint to authenticated requests, or use a security plugin. 30-minute fix.
SEC-002
No HTTP security headers on any response
HSTS, X-Frame-Options, X-Content-Type-Options, Content-Security-Policy, Referrer-Policy, and Permissions-Policy all absent from response headers.
→ Add all headers via Cloudflare Transform Rules — no code deployment or server access needed. 1-hour fix.
Priority 1
High Priority Issues
SEO-001
Arabic page title duplicates company name
"جبل عمر جبل عمر - يُجسد الأصالة والحداثة" — "Jabal Omar" repeated twice, wasting title real estate.
→ Update Yoast title template to single instance: "جبل عمر - يُجسد الأصالة والحداثة"
SEO-002
English page title has typo and duplication
"Jaba Omar Jabal Omar - Envisioning Growth Enhancing Heritage" — typo "Jaba Omar" plus two brand names.
→ Fix to "Jabal Omar — Envisioning Growth, Enhancing Heritage"
SEO-003
OG tags target hotel keywords, not company brand
OG title: "فنادق بالقرب من مكة: دليلك لإقامة مريحة" (Hotels near Mecca guide). Twitter title also hotel-focused. When shared on LinkedIn/WhatsApp the company appears as a hotel search result, not a major developer.
→ Replace OG title/description with accurate company identity and mission statement
ACC-001
No skip navigation link (WCAG Level A failure)
No skip link detected on Arabic or English pages. Keyboard and screen reader users must tab through full navigation on every page load.
→ Add visually-hidden "Skip to main content" link as first focusable element in header.php
ACC-002 / ACC-003
No ARIA landmarks · Images missing alt text
No <main>, <nav>, or <footer> landmarks detected. Placeholder images and award images lack descriptive alt attributes. Both are WCAG Level A violations.
→ Add semantic HTML5 landmarks to theme templates; add descriptive alt text to all meaningful images
PERF-001
Two jQuery versions loaded simultaneously
Theme enqueues jQuery 1.8.3 alongside WordPress core jQuery 3.7.1 — approximately 85 KB of unnecessary JavaScript on every page load.
→ Deregister theme jQuery using wp_deregister_script('jquery') before enqueue; rely on WP core version
PRIV-001
Privacy policy page not confirmed
Footer links "Terms & Conditions" but no standalone Privacy Policy page was found. Required under Saudi PDPL and GDPR for international visitors.
→ Create dedicated Privacy Policy page; link from all page footers on both language versions
What's Working
Existing Strengths
These items require no immediate action and represent a solid foundation to build on.
HTTPS enforced
HTTP → HTTPS 301 redirect working; users always reach a secure connection
Cloudflare CDN
Global edge network provides DDoS protection and performance distribution
CookieYes + Consent Mode v2
Google Consent Mode v2 correctly configured with EU region denial defaults — strong GDPR posture
hreflang tags (AR + EN)
Correct alternate link tags for both language versions; avoids duplicate content penalties
Yoast SEO Premium
Sitemap index with 3 child sitemaps; robots.txt configured; Google Search Console verified
Structured data
Organization, WebSite, WebPage, and BreadcrumbList schemas deployed via Yoast
XML-RPC protected
Returns HTTP 405 on HEAD requests — partially protected against automated attacks
WordPress 7.1 (current)
Running the current major version reduces known vulnerability exposure
Mobile apps (3 stores)
iOS App Store, Google Play, and Huawei AppGallery — broad platform coverage
Bilingual RTL support
Arabic (RTL) and English versions with correct lang and dir attributes; separate RTL stylesheet
Twitter card configured
summary_large_image card type in place; @jabal_omar_sa handle referenced
Five social channels active
YouTube, LinkedIn, X, Facebook, Instagram — comprehensive social media presence