e-bids.nl
Better than 77% (national)
Better than 73% (national)
Better than 18% (national)
Better than 82% (national)
Machine-readable verification: /api/verify/e-bids.nl
Certified on 9 July 2026 · 8 pages checked · 3 improvements found
Full certification report
Part of the WebYes certification: beyond the four pillars we also audit SEO, structured data, content, links, privacy and AI findability. These extra categories do not count towards the certification score.
Findings
- WarningSecurity
No Content-Security-Policy header — XSS / clickjacking surface is wide open.
Start with a strict-dynamic CSP using nonces: `Content-Security-Policy: script-src 'nonce-<...>' 'strict-dynamic'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'`. Roll out in `Content-Security-Policy-Report-Only` first to catch violations.
How to fix it
Add a Content-Security-Policy header that defines which sources may load scripts and styles. Start with a report-only policy if needed and tighten it from there.
- WarningTechnical
54 internal resource(s) across 8 page(s) are blocked from crawling by a robots.txt Disallow rule.
Search engines must fetch CSS, JS, and images to render and rank your pages. Remove the matching Disallow line(s) so Googlebot can load these resources. Blocked: https://e-bids.nl/_next/image?url=%2Fimages%2Fkennisbank%2Fauto-kopen-via-veiling.jpg&w=1920&q=75, https://e-bids.nl/_next/image?url=%2Fimages%2Fkennisbank%2Fautoveiling-voor-beginners.webp&w=1920&q=75, https://e-bids.nl/_next/image?url=%2Fimages%2Fkennisbank%2Fbekendste-veilinghuizen-nederland.jpg&w=1920&q=75, https://e-bids.nl/_next/image?url=%2Fimages%2Fkennisbank%2Fbva-veilingen-uitleg.webp&w=1920&q=75, https://e-bids.nl/_next/image?url=%2Fimages%2Fkennisbank%2Fcatawiki-veilingen-uitleg.jpg&w=1920&q=75
- WarningSpam signals
Term "redacteur" appears unusually often (9×, 7% of words).
Rewrite for natural language — repeated exact-match phrases can trigger spam classifiers.
- InfoSpeed
1 image(s) ≥800px wide without srcset or <picture> for responsive delivery.
Use `srcset` with multiple resolutions or wrap images in `<picture>` with WebP/AVIF sources. In Next.js, use `next/image` which handles this automatically. Without responsive images, mobile users download desktop-sized assets.
How to fix it
Serve images in a modern format (WebP or AVIF), scaled to the size at which they are displayed. An image service or build step (such as next/image) handles this automatically.
- InfoSecurity
Missing `Cross-Origin-Embedder-Policy`. Cross-origin isolation lets you use SharedArrayBuffer and high-resolution timers safely.
Send `Cross-Origin-Opener-Policy: same-origin` and `Cross-Origin-Embedder-Policy: require-corp`. Note this requires every embedded resource to send `Cross-Origin-Resource-Policy`.
How to fix it
Add Cross-Origin-Opener-Policy: same-origin (and where possible Cross-Origin-Embedder-Policy). This isolates your site from windows opened by other origins.
- InfoOn-page SEO
Heading level jumps from h1 to h3, skipping h2.
- InfoTechnical
Crawl stopped at the max-pages limit (6); 44 sitemap URLs were not visited but might still be reachable.
Re-run with `--max-pages 2000` (or higher) before trusting orphan-from-sitemap counts.
- InfoLegal
Site sets cookies on 8 page(s) but no cookie consent mechanism was detected.
Implement a CMP (Cookiebot, OneTrust, Usercentrics, Complianz) or build a consent banner. GDPR and ePrivacy require prior consent for non-essential cookies in the EU.
- InfoQuality impression
Homepage has no `<link rel="icon">` — browsers will request /favicon.ico which may 404.
Add a custom favicon that reflects your brand. A missing favicon causes extra 404 log noise and looks unprofessional in browser tabs and bookmarks.
More from the register
Other websites holding an active WebYes certification. Every report is public and audited on the same four pillars.