webyes.nl
Better than 45% (national)
Better than 55% (national)
Better than 18% (national)
Better than 77% (national)
Machine-readable verification: /api/verify/webyes.nl
Certified on 8 August 2026 · 17 pages checked · 5 improvements found
Score over time
Every audit and re-audit counts: this is the average score per scan day.
Scan timeline
Pillar scores across recent scans. Methodology changes (different engine version) are noted on the point.
8 August 2026 · Full audit
Engine unknown
88Speed 77Security 76Mobile 100Accessibility 998 July 2026 · Full audit
94Speed 100Security 79Mobile 100Accessibility 97
Full certification report
Part of the WebYes certification: beyond the four pillars we also audit SEO, structured data, content, links, privacy and AI findability. These extra categories do not count towards the certification score.
Pages examined
Sample of 15 pages (not every URL on the site).
- https://webyes.nl/
- https://webyes.nl/kennisbank/core-web-vitals
- https://webyes.nl/werkwijze
- https://webyes.nl/kennisbank/website-snelheid-testen
- https://webyes.nl/kennisbank/ssl-certificaat
- https://webyes.nl/kennisbank/mobielvriendelijke-website
- https://webyes.nl/kennisbank/security-headers
- https://webyes.nl/kennisbank/digitale-toegankelijkheid
- https://webyes.nl/kennisbank/wcag
- https://webyes.nl/contact
- https://webyes.nl/register
- https://webyes.nl/kennisbank
- https://webyes.nl/blog
- https://webyes.nl/about
- https://webyes.nl/prijzen
Diff vs previous audit
8 July 2026 → 8 August 2026
Resolved (1)
- No `Cross-Origin-Resource-Policy` header. Without it, side-channel attacks via Spectre-style speculative execution stay viable.https://webyes.nl/
New (1)
- 3 render-blocking <link rel="stylesheet"> in <head> (target: ≤2).https://webyes.nl/
Findings
- ErrorAccessibilityAutomatically checked
Page has 2 <main> elements without distinct aria-labels.
When using multiple <main> landmarks, give each a unique aria-label: <main aria-label="Primary content">.
How to fix it
The page has more than one <main> element (or role="main"). Keep exactly one; multiple main content areas confuse screen readers.
- WarningSpeed
3 render-blocking <link rel="stylesheet"> in <head> (target: ≤2).
Inline critical CSS, lazy-load the rest with the `<link rel="preload" as="style" onload="this.rel='stylesheet'">` pattern, or split chunks per route. Each blocking stylesheet adds round-trips to LCP.
How to fix it
Reduce render-blocking CSS: inline the critical above-the-fold styles and load the rest asynchronously. Also remove CSS that is no longer used anywhere.
- WarningSecurity
Sensitive path reachable: /admin/ (HTTP 200, 18269 bytes).
Block the path at the reverse proxy (deny .git/.env/etc.), remove the file from the deploy artifact, and rotate any secrets that may have been exposed.
How to fix it
A sensitive path is publicly reachable (such as a .env file, .git folder or admin panel). Block the path at the server level or take the file offline, and rotate any leaked keys.
- WarningSecurity
No Content-Security-Policy header — XSS / clickjacking surface is wide open.
Start with a strict-dynamic CSP using nonces: `Content-Security-Policy: script-src 'nonce-<...>' 'strict-dynamic'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'`. Roll out in `Content-Security-Policy-Report-Only` first to catch violations.
How to fix it
Add a Content-Security-Policy header that defines which sources may load scripts and styles. Start with a report-only policy if needed and tighten it from there.
- WarningStructured data
Schema "Product" is missing required property: image (affects 1 page).
Fix the JSON-LD generator that emits this Product block — one fix eliminates 1 occurrence(s). JSON-LD path: <root>. Affected URLs: https://webyes.nl/prijzen.
- WarningContent
Page has only 56 words (min 100).
Thin pages risk being classified as low-value. Expand with original, useful content — lead each H2 with a self-contained 40-75 word answer, and add a visible FAQ/Q&A section covering common questions (no FAQPage schema needed; visible Q&A is what ranks and what AI Overviews cite). Or noindex if it's a utility page.
- WarningSpam signals
Term "juli" appears unusually often (19×, 8% of words).
Rewrite for natural language — repeated exact-match phrases can trigger spam classifiers.
- InfoSecurity
Missing `Cross-Origin-Opener-Policy` + `Cross-Origin-Embedder-Policy`. Cross-origin isolation lets you use SharedArrayBuffer and high-resolution timers safely.
Send `Cross-Origin-Opener-Policy: same-origin` and `Cross-Origin-Embedder-Policy: require-corp`. Note this requires every embedded resource to send `Cross-Origin-Resource-Policy`.
How to fix it
Add Cross-Origin-Opener-Policy: same-origin (and where possible Cross-Origin-Embedder-Policy). This isolates your site from windows opened by other origins.
- InfoOn-page SEO
Title is slightly over the recommended length (61 chars, max 60).
Borderline — Google usually still renders this in full. Trim only if the most important keywords sit past the visible cutoff.
- InfoOn-page SEO
Heading level jumps from h1 to h3, skipping h2.
- InfoOn-page SEO
Page declares noindex; it will not be indexed.
Remove noindex if this page should appear in search results.
- InfoStructured data
Page has no JSON-LD structured data in the initial HTML.
Server-render JSON-LD in the HTML response. If this is currently injected after hydration (for example with next/script afterInteractive), static crawlers and AI bots may not see it.
- InfoContent
Text-to-HTML ratio is 0.7% (target ≥ 2%).
Very low ratios usually mean the hydration payload, inline RSC blob or a vendor script is bigger than the rendered prose. Inspect the largest scripts and externalise or split them.
- InfoTechnical
1 crawled page(s) are not listed in any sitemap.
Add these URLs to your sitemap or noindex them. Example: https://webyes.nl/prijzen
- InfoTechnical
Crawl stopped at the max-pages limit (15); 18 sitemap URLs were not visited but might still be reachable.
Re-run with `--max-pages 2000` (or higher) before trusting orphan-from-sitemap counts.
- InfoTechnical
No HTML sitemap link found on the homepage. Placing one in the footer is an industry best practice for UX and crawler/AI discovery.
Add a link to a user-facing HTML sitemap (e.g. `/sitemap`, not `sitemap.xml`) inside the <footer>. An HTML sitemap acts as a structural overview for lost visitors and as a fallback discovery surface for search engines and AI crawlers.
- InfoQuality impression
Homepage has no `<link rel="icon">` — browsers will request /favicon.ico which may 404.
Add a custom favicon that reflects your brand. A missing favicon causes extra 404 log noise and looks unprofessional in browser tabs and bookmarks.
More from the register
Other websites holding an active WebYes certification. Every report is public and audited on the same four pillars.