e-bids.nl

Full audit

Part of the WebYes certification: beyond the four pillars we also audit SEO, structured data, content, links, privacy and AI findability. These extra categories do not count towards the certification score.

Findings (9)

• WarningSecurity

  No Content-Security-Policy header — XSS / clickjacking surface is wide open.

  Start with a strict-dynamic CSP using nonces: `Content-Security-Policy: script-src 'nonce-<...>' 'strict-dynamic'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'`. Roll out in `Content-Security-Policy-Report-Only` first to catch violations.

  How to fix it

  Add a Content-Security-Policy header that defines which sources may load scripts and styles. Start with a report-only policy if needed and tighten it from there.

  Read more in the knowledge base: Security headers →

• WarningTechnical

  54 internal resource(s) across 8 page(s) are blocked from crawling by a robots.txt Disallow rule.

  Search engines must fetch CSS, JS, and images to render and rank your pages. Remove the matching Disallow line(s) so Googlebot can load these resources. Blocked: https://e-bids.nl/_next/image?url=%2Fimages%2Fkennisbank%2Fauto-kopen-via-veiling.jpg&w=1920&q=75, https://e-bids.nl/_next/image?url=%2Fimages%2Fkennisbank%2Fautoveiling-voor-beginners.webp&w=1920&q=75, https://e-bids.nl/_next/image?url=%2Fimages%2Fkennisbank%2Fbekendste-veilinghuizen-nederland.jpg&w=1920&q=75, https://e-bids.nl/_next/image?url=%2Fimages%2Fkennisbank%2Fbva-veilingen-uitleg.webp&w=1920&q=75, https://e-bids.nl/_next/image?url=%2Fimages%2Fkennisbank%2Fcatawiki-veilingen-uitleg.jpg&w=1920&q=75

• WarningSpam signals

  Term "redacteur" appears unusually often (9×, 7% of words).

  Rewrite for natural language — repeated exact-match phrases can trigger spam classifiers.

• InfoSpeed

  1 image(s) ≥800px wide without srcset or <picture> for responsive delivery.

  Use `srcset` with multiple resolutions or wrap images in `<picture>` with WebP/AVIF sources. In Next.js, use `next/image` which handles this automatically. Without responsive images, mobile users download desktop-sized assets.

  How to fix it

  Serve images in a modern format (WebP or AVIF), scaled to the size at which they are displayed. An image service or build step (such as next/image) handles this automatically.

  Read more in the knowledge base: Core Web Vitals →

• InfoSecurity

  Missing `Cross-Origin-Embedder-Policy`. Cross-origin isolation lets you use SharedArrayBuffer and high-resolution timers safely.

  Send `Cross-Origin-Opener-Policy: same-origin` and `Cross-Origin-Embedder-Policy: require-corp`. Note this requires every embedded resource to send `Cross-Origin-Resource-Policy`.

  How to fix it

  Add Cross-Origin-Opener-Policy: same-origin (and where possible Cross-Origin-Embedder-Policy). This isolates your site from windows opened by other origins.

  Read more in the knowledge base: Security headers →

• InfoOn-page SEO

  Heading level jumps from h1 to h3, skipping h2.

• InfoTechnical

  Crawl stopped at the max-pages limit (6); 44 sitemap URLs were not visited but might still be reachable.

  Re-run with `--max-pages 2000` (or higher) before trusting orphan-from-sitemap counts.

• InfoLegal

  Site sets cookies on 8 page(s) but no cookie consent mechanism was detected.

  Implement a CMP (Cookiebot, OneTrust, Usercentrics, Complianz) or build a consent banner. GDPR and ePrivacy require prior consent for non-essential cookies in the EU.

• InfoQuality impression

  Homepage has no `<link rel="icon">` — browsers will request /favicon.ico which may 404.

  Add a custom favicon that reflects your brand. A missing favicon causes extra 404 log noise and looks unprofessional in browser tabs and bookmarks.

Full audit performed on 9 July 2026.

More from the register

Other websites holding an active WebYes certification. Every report is public and audited on the same four pillars.