duurzaamgefinancierd.nl

Volledige audit

Onderdeel van het WebYes-keurmerk: naast de vier pijlers keuren we ook SEO, structured data, content, links, privacy en AI-vindbaarheid. Deze extra categorieën tellen niet mee in de keurmerkscore.

Bevindingen (8)

• WaarschuwingVeiligheid

  No Content-Security-Policy header — XSS / clickjacking surface is wide open.

  Start with a strict-dynamic CSP using nonces: `Content-Security-Policy: script-src 'nonce-<...>' 'strict-dynamic'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'`. Roll out in `Content-Security-Policy-Report-Only` first to catch violations.

  Zo los je het op

  Voeg een Content-Security-Policy header toe die vastlegt welke bronnen scripts en stijlen mogen laden. Begin desnoods met een rapporterende policy (Content-Security-Policy-Report-Only) en scherp die daarna aan.

  Lees meer in de kennisbank: Security headers →

• WaarschuwingAI-vindbaarheid (GEO)

  robots.txt blocks 5 AI crawlers: GPTBot, ClaudeBot, Google-Extended, CCBot, Applebot-Extended.

  If you want ChatGPT / Claude / Perplexity citations, allow those bots: add `User-agent: GPTBot\nAllow: /` etc. to robots.txt. Note that Google's AI Overviews / AI Mode are unaffected — they use Googlebot and snippet eligibility, not these bots. Google-Extended is different: it only controls Gemini model training/grounding — blocking it does NOT remove you from AI Overviews (those are Search features served via Googlebot), so keeping that block is a legitimate policy choice. (If a block is intentional, suppress this rule.)

• InfoSnelheid

  2 image(s) ≥800px wide without srcset or <picture> for responsive delivery.

  Use `srcset` with multiple resolutions or wrap images in `<picture>` with WebP/AVIF sources. In Next.js, use `next/image` which handles this automatically. Without responsive images, mobile users download desktop-sized assets.

  Zo los je het op

  Lever afbeeldingen in een modern formaat (WebP of AVIF), geschaald naar het formaat waarop ze getoond worden. Een fotodienst of buildstap (zoals next/image) regelt dit automatisch.

  Lees meer in de kennisbank: Core Web Vitals →

• InfoVeiligheid

  Missing `Cross-Origin-Embedder-Policy`. Cross-origin isolation lets you use SharedArrayBuffer and high-resolution timers safely.

  Send `Cross-Origin-Opener-Policy: same-origin` and `Cross-Origin-Embedder-Policy: require-corp`. Note this requires every embedded resource to send `Cross-Origin-Resource-Policy`.

  Zo los je het op

  Voeg Cross-Origin-Opener-Policy: same-origin toe (en waar mogelijk Cross-Origin-Embedder-Policy). Dit isoleert je site van vensters die door andere origins zijn geopend.

  Lees meer in de kennisbank: Security headers →

• InfoTechniek

  Crawl stopped at the max-pages limit (6); 13 sitemap URLs were not visited but might still be reachable.

  Re-run with `--max-pages 2000` (or higher) before trusting orphan-from-sitemap counts.

• InfoTechniek

  No HTML sitemap link found on the homepage. Placing one in the footer is an industry best practice for UX and crawler/AI discovery.

  Add a link to a user-facing HTML sitemap (e.g. `/sitemap`, not `sitemap.xml`) inside the <footer>. An HTML sitemap acts as a structural overview for lost visitors and as a fallback discovery surface for search engines and AI crawlers.

• InfoJuridisch

  Site sets cookies on 8 page(s) but no cookie consent mechanism was detected.

  Implement a CMP (Cookiebot, OneTrust, Usercentrics, Complianz) or build a consent banner. GDPR and ePrivacy require prior consent for non-essential cookies in the EU.

• InfoKwaliteitsindruk

  Homepage has no `<link rel="icon">` — browsers will request /favicon.ico which may 404.

  Add a custom favicon that reflects your brand. A missing favicon causes extra 404 log noise and looks unprofessional in browser tabs and bookmarks.

Volledige audit uitgevoerd op 9 juli 2026.

Meer uit het keurmerkregister

Andere websites met een actief WebYes-keurmerk. Elk rapport is openbaar en op dezelfde vier pijlers gekeurd.