mgsoftware.nl
Better than 68% (national)
Better than 50% (national)
Better than 18% (national)
Better than 41% (national)
Machine-readable verification: /api/verify/mgsoftware.nl
Certified on 5 August 2026 · 8 pages checked · 7 improvements found
Score over time
Every audit and re-audit counts: this is the average score per scan day.
Scan timeline
Pillar scores across recent scans. Methodology changes (different engine version) are noted on the point.
5 August 2026 · Quick scan
Engine unknown
73Speed 98Security 72Mobile 100Accessibility 235 August 2026 · Quick scan
Engine unknown
73Speed 98Security 72Mobile 100Accessibility 238 July 2026 · Full audit
82Speed 87Security 72Mobile 100Accessibility 708 July 2026 · Full audit
77Speed 86Security 52Mobile 100Accessibility 708 July 2026 · Full audit
77Speed 86Security 52Mobile 100Accessibility 708 July 2026 · Full audit
77Speed 86Security 52Mobile 100Accessibility 708 July 2026 · Quick scan
77Speed 86Security 52Mobile 100Accessibility 707 July 2026 · Quick scan
77Speed 86Security 52Mobile 100Accessibility 70
Full certification report
Part of the WebYes certification: beyond the four pillars we also audit SEO, structured data, content, links, privacy and AI findability. These extra categories do not count towards the certification score.
Diff vs previous audit
8 July 2026 → 8 July 2026
Resolved (2)
- Cookie `Next-Locale` is set on an HTTPS page without the Secure flag.https://www.mgsoftware.nl/
- Likely LCP image is missing `fetchpriority="high"`.https://www.mgsoftware.nl/features
Findings
- WarningSpeed
HTML document is 799 KB (budget: 488.28125 KB).
Large HTML payloads delay First Contentful Paint on slow connections. Server-render only above-the-fold content and lazy-load the rest, or paginate long listing pages. In Next.js, use streaming with `loading.tsx` to flush the shell early.
How to fix it
Your HTML document is considerably larger than needed. The usual culprits are inline CSS or JSON data in the page; move those to separate files or load them only when needed.
- WarningAccessibilityAutomatically checked
Page has no skip-navigation link for keyboard users.
Add a visually hidden link as the first focusable element: <a href="#main-content" class="skip-link">Skip to content</a>.
How to fix it
Add a 'skip link' as the first link on the page that jumps to the main content (<a href="#main-content">Skip to content</a>). Keyboard users then do not have to tab through the entire menu.
- WarningSecurity
Weak CSP: no `report-uri` or `report-to`.
Drop `unsafe-eval`, replace wildcard hosts with explicit origins, and configure a reporting endpoint so you can see violations as you tighten the policy.
How to fix it
Your Content-Security-Policy contains broad rules such as 'unsafe-inline' or a wildcard. Replace them with explicit sources and use nonces or hashes for inline scripts.
- WarningSecurity
CSP allows `'unsafe-inline'` without a nonce or hash — this effectively disables script-src protection against XSS.
Generate a per-response nonce in your server-rendered pages and emit `script-src 'nonce-<nonce>' 'strict-dynamic'`. Inline `<script nonce='...'>` tags then load while attacker-injected ones don't.
How to fix it
Give inline scripts a nonce or hash in your CSP instead of allowing them via 'unsafe-inline'. Most frameworks (including Next.js) can generate per-request nonces.
- WarningLegal
No link to a privacy policy was found on any crawled page.
Add a privacy policy page and link to it from the footer of every page. Required by GDPR, CCPA, and Google AdSense. Most browsers and AI agents check for this.
- WarningSpam signals
Term "2024" appears unusually often (20×, 4% of words).
Rewrite for natural language — repeated exact-match phrases can trigger spam classifiers.
- InfoSpeed
4 image(s) ≥800px wide without srcset or <picture> for responsive delivery.
Use `srcset` with multiple resolutions or wrap images in `<picture>` with WebP/AVIF sources. In Next.js, use `next/image` which handles this automatically. Without responsive images, mobile users download desktop-sized assets.
How to fix it
Serve images in a modern format (WebP or AVIF), scaled to the size at which they are displayed. An image service or build step (such as next/image) handles this automatically.
- InfoSecurity
No `/.well-known/security.txt` published.
Publish a `security.txt` (RFC 9116) at `/.well-known/security.txt`. Even a one-line `Contact: mailto:[email protected]` plus an `Expires:` date is enough; it gives white-hat researchers somewhere to send reports instead of giving up.
How to fix it
Publish a security.txt at /.well-known/security.txt with a contact address for security reports. Researchers then know where to report a vulnerability.
- InfoSecurity
Missing `Cross-Origin-Embedder-Policy`. Cross-origin isolation lets you use SharedArrayBuffer and high-resolution timers safely.
Send `Cross-Origin-Opener-Policy: same-origin` and `Cross-Origin-Embedder-Policy: require-corp`. Note this requires every embedded resource to send `Cross-Origin-Resource-Policy`.
How to fix it
Add Cross-Origin-Opener-Policy: same-origin (and where possible Cross-Origin-Embedder-Policy). This isolates your site from windows opened by other origins.
- InfoOn-page SEO
Meta description is slightly over the recommended length (165 chars, max 160).
- InfoContent
Text-to-HTML ratio is 0.8% (target ≥ 2%).
Very low ratios usually mean the hydration payload, inline RSC blob or a vendor script is bigger than the rendered prose. Inspect the largest scripts and externalise or split them.
- InfoTechnical
No HTML sitemap link found on the homepage. Placing one in the footer is an industry best practice for UX and crawler/AI discovery.
Add a link to a user-facing HTML sitemap (e.g. `/sitemap`, not `sitemap.xml`) inside the <footer>. An HTML sitemap acts as a structural overview for lost visitors and as a fallback discovery surface for search engines and AI crawlers.
- InfoQuality impression
Homepage has no `<link rel="icon">` — browsers will request /favicon.ico which may 404.
Add a custom favicon that reflects your brand. A missing favicon causes extra 404 log noise and looks unprofessional in browser tabs and bookmarks.
More from the register
Other websites holding an active WebYes certification. Every report is public and audited on the same four pillars.