A real audit of an online store
Audited September 18, 2026. 120 pages analyzed, overall score 52/100. Only the names were changed.
These PDFs are samples of the audit report, not of the full delivery.
A full order includes three PDFs: the audit report, the page-by-page analysis and the methodology note.
The report's verdict
The storefront works without a single defect and ranks very well in search, but the site lags behind on compliance, accessibility, and security hardening, which exposes it more than a merchant of its size should be.
These passages are copied from the report, word for word.
This is the report of an online shop. The ecommerce website audit guide covers what the audit checks on top for a site that sells.
What weighs most on the score
- Trackers before consent: Google Tag Manager loads as soon as the page opens, before the visitor makes any choice. The reject option is not on the first screen of the banner: the visitor must open “Personnaliser” (customize) to find it.
- No accessibility statement: PRAVEL SAS has 10 to 19 employees and sells online to consumers, so the European Accessibility Act applies. No statement is published, neither on the 120 pages nor in the terms of sale.
- Vulnerable library: the main script bundles axios 1.7.7, which has 30 known vulnerabilities, 15 of them rated high or critical.
- Data outside the EU and dependency: Google Tag Manager receives the visitor's IP address before any consent. The site is hosted by Amazon Web Services, a U.S. company, which also manages the domain name and the DNS servers.
- Untranslated language versions: 51 of the 57 pages analyzed in the English, Spanish, and Italian versions serve the French text.
What needs fixing
- Compliance at 15/100: two clicks to reject cookies, an incomplete legal notice (3 fields missing), no consumer mediator, no accessibility statement, and customer reviews published with no information on how they are verified.
- Accessibility at 28/100: zoom blocked on all 120 pages, unnamed buttons and links on more than 100 pages, and search and menus that do not work with a keyboard.
- Security at 45/100: no browser protection headers, TLS 1.0 accepted, and one JavaScript library (axios 1.7.7) with 15 known high or critical vulnerabilities.
- English, Spanish, and Italian versions served in French under a foreign-language label.
- Mobile speed on a constrained network: 25 to 62 seconds to display the main content of listing pages and most product pages.
What already works
- No functional defects on the 120 pages: zero script errors, zero missing resources, zero broken internal links out of 22,919 links followed.
- SEO at 98/100: tags in place on all 120 pages, a declared sitemap, no redirect chains, and content served by the server.
- User experience at 97/100: a clear first screen, visible commitments, a correct 404 error page, and no horizontal overflow at the measured widths.
- Real-user experience on mobile in the green: main content displayed in 1.6 s at the 75th percentile, with a response time of 144 ms.
The score for each pillar
| Pillar | Score | Weight in the overall score |
|---|---|---|
| Security & encryption | 45/100 | 18% |
| Performance | 39/100 | 12% |
| SEO & search visibility | 98/100 | 10% |
| Accessibility | 28/100 | 13% |
| Compliance & privacy | 15/100 | 16% |
| Domain & network | 64/100 | 6% |
| Independence & resilience | 47/100 | 8% |
| Content & trust | 77/100 | 5% |
| User experience & reliability | 97/100 | 12% |
Pillar by pillar
Each pillar in the report opens with a summary written for a non-technical reader. Here it is for all nine, copied from the report, with the guides that explain the findings.
Security & encryption: 45/100
In brief: encryption works and no serious misconfiguration was found, but the site is not hardened. None of the headers that protect the browser are sent, the server still accepts TLS 1.0, and the main script bundles a library with 15 known high or critical vulnerabilities. These are settings and one dependency update: a few days of work, to schedule now.
Guides that explain these findings:
Performance: 39/100
In brief: real visitors do not experience slowness: on their phones, the main content appears in 1.6 seconds. But on a phone with a constrained network, the site becomes very slow: over 26 seconds on the home page, and up to 62 seconds on some product pages. Image weight is the main cause: the home page transfers 21.6 MB, including four carousel images of 2.1 to 3.7 MB each. The fix is about how images are delivered, not a redesign.
SEO & search visibility: 98/100
In brief: this is the site's strongest point. The content comes straight from the server, every page carries a title, a description, and a canonical URL, and none of the 22,919 internal links followed is broken. Three caveats: a quarter of the descriptions exceed the length Google displays, the site-wide rating is declared as a product rating on 47 listing pages, and the language versions are declared in a contradictory way.
Accessibility: 28/100
In brief: this is one of the two lowest pillars. The most serious defect is easy to fix: zoom is blocked on every page, which prevents visually impaired visitors from enlarging text on their phones. Add to that buttons and links with no name a screen reader can announce, a search that does not open with the keyboard, and no skip link. Almost all of these defects come from the shared header: about ten fixes in the template address most of them.
Guides that explain these findings:
Compliance & privacy: 15/100
In brief: this is the lowest pillar in the report, and the most urgent. The cookie banner hides the reject option on its second screen, the legal notice is only an incomplete set of terms of sale, no consumer mediator is named, and no accessibility statement is published. The foundation is sound, though: after a rejection, no advertising tracker loads, and the terms of sale cover the right of withdrawal and the legal guarantee. The fixes are documentation work and quick to make.
Guides that explain these findings:
Domain & network: 64/100
In brief: the foundations hold. The domain runs until August 2027, it is locked against transfer, and email is authenticated. Three settings are missing: DNS response signing, the list of authorities allowed to issue a certificate, and IPv6. The email anti-spoofing policy quarantines rather than rejects.
Guides that explain these findings:
Independence & resilience: 47/100
In brief: the site relies on a single provider for its three vital layers. Amazon hosts the site, registers the domain name, and answers DNS queries: if Amazon fails or suspends the account, the site goes offline with no fallback. The servers are in Ireland, but Amazon is a U.S. company. Before any consent, Google receives the visitor's IP address through the tag manager. This is a business trade-off more than a technical defect.
Guides that explain these findings:
Content & trust: 77/100
In brief: the content is rich and precise where it counts: detailed product pages, brand pages that name the models and their specifications, and buying guides on the blog. Three caveats: the introductions of the main categories line up generic phrases, the descriptions shown in Google promise a “free return” the terms of sale do not guarantee, and the English, Spanish, and Italian versions are not translated.
Guides that explain these findings:
User experience & reliability: 97/100
In brief: together with SEO, this is the site's strongest point. No script errors, no missing resources, no broken internal links, a real 404 page, and a first screen that clearly says what is sold and on what terms. The caveats are minor: the language selector leads to pages still in French, and a pre-production resource from a payment partner loads in production.
Read the report (opens in a new tab)