How to Read a Website Audit Report Without Getting Overwhelmed

So you ran an audit. Now you're looking at a score of 78, a grade of C, and a list of findings with words like "CORS" and "Content-Security-Policy." Where do you even start?

Take a breath. This guide goes through the report piece by piece, and by the end you'll know what each part means and what to do first.

Start with the score, but don't obsess over it

The score (out of 100) and the grade (A to F) are a quick summary of everything the scan found, with serious problems counting for more. Think of it like a thermometer. It tells you something is up, but it isn't the diagnosis.

What matters most is the direction. A site that scored 52 last month and 78 today is moving the right way, and that's worth celebrating.

Every finding has four parts

Each item in the list tells you:

• Category, which is the area it belongs to, like headers, HTTPS or cookies.
• Severity, usually critical, warning or info. Critical first, then warnings, then info when you have time.
• Detail, which is what the scan noticed.
• Fix, which is what to do about it. This is the part to paste into your task list.

The security checks, in plain words

Security headers

When a browser loads your page, your server can send along some instructions about how to behave safely. These are called headers. The common ones:

• Content-Security-Policy says where scripts and images are allowed to come from. It's your best defence against someone slipping a malicious script into your page.
• Strict-Transport-Security tells the browser, "always use HTTPS with this site."
• X-Frame-Options stops other sites from putting yours inside a hidden frame to trick your visitors into clicking things.
• X-Content-Type-Options stops the browser from guessing what kind of file something is.
• Referrer-Policy and Permissions-Policy limit what information leaks out and which browser features your pages can use.

Missing headers are the most common finding, and usually a five-minute fix in your server or framework settings.

HTTPS and your certificate

This checks that your certificate is valid, that visitors on plain HTTP get sent to HTTPS, and that old, weak protocols are switched off. One tip: an expired certificate takes your site down with a scary browser warning. Put the renewal date in your calendar.

Exposed files and paths

The scan politely knocks on doors that should never be open, like .env, .git, database backups and admin pages. If one opens, treat it as urgent. Those files can contain passwords and keys. Remove the file, block the path, and then change any secret that was exposed. You can't know who already copied it.

CORS

CORS decides which other websites are allowed to call your API from a visitor's browser. If it's set to allow everyone, especially together with login cookies, a malicious site could act as your logged-in user. Only allow the specific websites that need access.

Cookie settings

Your login cookie should be marked Secure (HTTPS only), HttpOnly (JavaScript can't read it) and have a SameSite setting. If they're missing, it's easier to steal a session.

Mixed content

This happens when a secure page loads something over plain HTTP, like an image or a script. Anyone in the middle can tamper with it. The fix is to change those web addresses to HTTPS.

The speed, access and search scores

The audit also includes four Lighthouse scores:

• Performance: how quickly the page becomes usable. Huge images and heavy scripts are the usual culprits.
• Accessibility: things like readable colours, labelled buttons and image descriptions. It's the right thing to do, and it opens your site to more people.
• Best Practices: modern, safe ways of building a page.
• SEO: page titles, descriptions, and whether Google can understand and crawl your site.

These matter because slow, hard-to-use pages rank lower and convert fewer visitors.

The "AI-generated" signals

You may also see signals that the site looks auto-generated, such as leftover template text or very repetitive design patterns. Treat that as a hint, not an accusation. It's useful for spotting unfinished placeholders, and for quick due diligence when you're checking out someone else's site.

What to fix first

If you only have an hour, go in this order:

1. Anything critical, especially exposed files or a broken certificate.
2. Missing security headers. Quick and valuable.
3. CORS and cookie settings. Small changes that remove big risks.
4. Speed. Compress images and delay heavy scripts.
5. Accessibility and SEO polish.

Then run the audit again and watch the score climb.

Want a closer look?

The standard audit checks what any visitor can see. The Deep Audit crawls more pages and checks data exposure, and for domains you've verified, it runs live tests such as login throttling. We explain why that matters in AI can build your app in a day.

When you're ready, run a free audit or use it from code through the API. Every report is saved in your dashboard so you can compare results over time.