duurzaamgefinancierd.nl
Visit duurzaamgefinancierd.nl ↗
Better than 77% (national)
Better than 73% (national)
Better than 18% (national)
Better than 82% (national)
Machine-readable verification: /api/verify/duurzaamgefinancierd.nl
Certified on 9 July 2026 · 8 pages checked · 3 improvements found
Full certification report
Part of the WebYes certification: beyond the four pillars we also audit SEO, structured data, content, links, privacy and AI findability. These extra categories do not count towards the certification score.
Findings
- WarningSecurity
No Content-Security-Policy header — XSS / clickjacking surface is wide open.
Start with a strict-dynamic CSP using nonces: `Content-Security-Policy: script-src 'nonce-<...>' 'strict-dynamic'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'`. Roll out in `Content-Security-Policy-Report-Only` first to catch violations.
How to fix it
Add a Content-Security-Policy header that defines which sources may load scripts and styles. Start with a report-only policy if needed and tighten it from there.
- WarningAI findability (GEO)
robots.txt blocks 5 AI crawlers: GPTBot, ClaudeBot, Google-Extended, CCBot, Applebot-Extended.
If you want ChatGPT / Claude / Perplexity citations, allow those bots: add `User-agent: GPTBot\nAllow: /` etc. to robots.txt. Note that Google's AI Overviews / AI Mode are unaffected — they use Googlebot and snippet eligibility, not these bots. Google-Extended is different: it only controls Gemini model training/grounding — blocking it does NOT remove you from AI Overviews (those are Search features served via Googlebot), so keeping that block is a legitimate policy choice. (If a block is intentional, suppress this rule.)
- InfoSpeed
2 image(s) ≥800px wide without srcset or <picture> for responsive delivery.
Use `srcset` with multiple resolutions or wrap images in `<picture>` with WebP/AVIF sources. In Next.js, use `next/image` which handles this automatically. Without responsive images, mobile users download desktop-sized assets.
How to fix it
Serve images in a modern format (WebP or AVIF), scaled to the size at which they are displayed. An image service or build step (such as next/image) handles this automatically.
- InfoSecurity
Missing `Cross-Origin-Embedder-Policy`. Cross-origin isolation lets you use SharedArrayBuffer and high-resolution timers safely.
Send `Cross-Origin-Opener-Policy: same-origin` and `Cross-Origin-Embedder-Policy: require-corp`. Note this requires every embedded resource to send `Cross-Origin-Resource-Policy`.
How to fix it
Add Cross-Origin-Opener-Policy: same-origin (and where possible Cross-Origin-Embedder-Policy). This isolates your site from windows opened by other origins.
- InfoTechnical
Crawl stopped at the max-pages limit (6); 13 sitemap URLs were not visited but might still be reachable.
Re-run with `--max-pages 2000` (or higher) before trusting orphan-from-sitemap counts.
- InfoTechnical
No HTML sitemap link found on the homepage. Placing one in the footer is an industry best practice for UX and crawler/AI discovery.
Add a link to a user-facing HTML sitemap (e.g. `/sitemap`, not `sitemap.xml`) inside the <footer>. An HTML sitemap acts as a structural overview for lost visitors and as a fallback discovery surface for search engines and AI crawlers.
- InfoLegal
Site sets cookies on 8 page(s) but no cookie consent mechanism was detected.
Implement a CMP (Cookiebot, OneTrust, Usercentrics, Complianz) or build a consent banner. GDPR and ePrivacy require prior consent for non-essential cookies in the EU.
- InfoQuality impression
Homepage has no `<link rel="icon">` — browsers will request /favicon.ico which may 404.
Add a custom favicon that reflects your brand. A missing favicon causes extra 404 log noise and looks unprofessional in browser tabs and bookmarks.
More from the register
Other websites holding an active WebYes certification. Every report is public and audited on the same four pillars.