This is a point-in-time automated technical scan of observable website behavior on the specific URLs scanned, as they existed at the scan date shown — not a legal compliance audit or attestation, and not an audit, certification, or compliance opinion of any kind. Results describe only the pages scanned at that time; they are not an assessment of the business or entity operating the site, and must not be represented as current after the scan date. A "pass" means no high-priority technical issues were found at the scan threshold on the pages crawled — it does not certify HIPAA, ADA, or any regulatory compliance, and does not cover items unobservable from outside (signed vendor agreements, server configuration, internal policies). Form analysis covers each form's declared submission target; forms that submit via JavaScript to endpoints not visible in the page markup are not assessed. Third-party/tracker detection matches a known-vendor catalog, so absence of a finding is not proof a site is free of trackers. This report is general information about observable technical facts and is not legal advice, does not create an attorney-client or other professional relationship, and is not a substitute for review by a qualified attorney. For your specific legal obligations, consult an attorney licensed in your jurisdiction. The exact URLs scanned are enumerated in the appendix at the end of this report.
1
Executive Summary
PASSNo high-priority technical issues found in this scan
This assessment identified 4 issues, none critical, that improve the site's standing once resolved. The most significant exposure is concentrated in website security.
Why this verdict: The verdict is Moderate, driven by 2 medium-severity findings.
0
Critical
0
High
2
Medium
2
Low
4
Total
SEO
100/100
Performance · measured
100/100
UX
100/100
Technical scores: 100 less a fixed deduction per issue found — they rank your own scans against each other, not your site against anyone else's. Performance is the exception: measured by Google Lighthouse plus real-world Core Web Vitals. Compliance, privacy and security risk are reported as a verdict, never a number.
Core Web Vitals · measured · mobile
Lab LCP 1.2 s · CLS 0 · TBT 0 ms · FCP 0.9 s
How to read this report
Severity ranks how much attention an item warrants: Critical rests on an observed fact on a sensitive page; High is a strong exposure; Medium/Low are lower-priority. Observed vs. verify: we report what we saw leave the browser as fact; anything we cannot see from outside (a signed agreement, a server config) we mark to verify, never assert. "Sensitive context" means a page whose URL, title, or form indicates health, identity, or payment data.
What to do, in order
3 changes, in the order we would make them — 2 of the 4 items are covered by just 1 of them, because one change can settle several at once.
Ordered by severity, then by how many items one change settles. Cost
are deliberately NOT part of that order — cheapest-first would sell you the
easy work rather than the work that matters.
2
The evidence
What your site is costing you
Every observation from this scan, grouped by what it actually does to your business — the same five groups as your portal, ordered by severity. We describe how each one affects you; we never put a number on it, because that number would be a guess about your business rather than an observation about your site.
How exposed you are
4 observations
What does your site tell the outside world about how it is configured?
2 Medium2 Low
No SPF record — anyone can send email as clearsite-demo-ledger.vercel.app
No DMARC record — forged email from clearsite-demo-ledger.vercel.app is delivered unchecked
No CAA record — any certificate authority can issue certs for clearsite-demo-ledger.vercel.app
and 1 more in this group
Details: the Security posture chapter in the findings below.
Checked, nothing found: the tools and tags you're running · people who can't use your site · being found · what you're promising. A real result about the pages we crawled — not a guarantee.
Risk overview
Area
Highest
Findings
Severity mix
Website Security
Medium
4
2 Medium, 2 Low
Findings
Findings are organised into the same six discipline chapters as your portal, then grouped by area and numbered area.item (3.2 = area 3, item 2). A sensitive tag marks a page whose URL, title, or form indicated health, identity, or payment context — the specific trigger is shown where recorded.
Security postureModerate risk
What your site tells the outside world about how it is configured — observed without touching it. 4 observations in this discipline.
1Email security3 findings
1.1
No SPF record — anyone can send email as clearsite-demo-ledger.vercel.app
Medium
Website Security · Email security · 85%
Law firm clients and opposing parties are frequent targets of impersonation fraud. An attacker could send a message appearing to come from your domain — requesting a wire transfer, credentials, or sensitive documents — and receiving mail servers would have no technical signal to flag it as suspicious. Even if this domain is not your primary email domain, verify whether it is associated with any client-facing communications.
Observed: no v=spf1 TXT record on clearsite-demo-ledger.vercel.app
Recommended fix: Add a DNS TXT record to clearsite-demo-ledger.vercel.app in the form "v=spf1 -all" if this domain never sends email, or "v=spf1 include:<your mail provider> -all" if it does. This change is made in your DNS host's control panel and typically takes effect within a few hours. If email for this domain is managed elsewhere, verify that the sending domain has its own SPF record configured correctly.
1.2
No DMARC record — forged email from clearsite-demo-ledger.vercel.app is delivered unchecked
Medium
Website Security · Email security · 85%
Without a DMARC record, there is no published instruction telling other mail servers what to do if someone forges an email that appears to come from your domain. For a law firm, even the appearance that your domain is being used to send fraudulent email — such as fake billing instructions or client impersonation attempts — can damage client trust and raise questions about your handling of sensitive communications. Verify whether this domain is intended to send email now or in the future, as that affects urgency.
Observed: no v=DMARC1 TXT record at _dmarc.clearsite-demo-ledger.vercel.app
Recommended fix: Publish a DMARC TXT record at _dmarc.clearsite-demo-ledger.vercel.app. Start with a policy of "p=none" and include a reporting address so you can monitor for any spoofing activity, then move to "p=quarantine" or "p=reject" once the reports show no legitimate mail is being affected.
1.3
No CAA record — any certificate authority can issue certs for clearsite-demo-ledger.vercel.app
Low
Website Security · Email security · 72%
CAA is a cheap guard against certificate mis-issuance — if an attacker tricks some CA into issuing a cert for your domain, CAA can block it. One DNS record.
Observed: no CAA record for clearsite-demo-ledger.vercel.app
Recommended fix: Add a CAA record naming your certificate authority (e.g. "0 issue \"letsencrypt.org\"").
2Transport security1 finding
2.1
OCSP stapling is not enabled
Low
Website Security · Transport security · 70%
OCSP stapling speeds up the connection and improves privacy by proving the certificate isn't revoked without the browser contacting the CA. It's a server toggle.
Observed: no stapled OCSP response during the handshake
Recommended fix: Enable OCSP stapling in the web server / load balancer configuration.
4
Methodology & depth
How deep we scanned
48
checks run
3,000+
known trackers screened
6
analysis lenses
Full
page capture
Beyond a cookie scan, we inspect every outbound channel — requests, form-field values, beacons, WebSockets, cookies and browser-storage writes — and match what we find against our live database of FDA, FTC, DOJ and state enforcement actions and court cases, updated continuously. The itemized breakdown of the 48 checks is in What we checked below.
Benchmarked against the standard tools
For each pillar, a detector for every defect class the recognized reference tools can find — verified check-by-check against the same rule catalog, on the same page.
Pillar
Reference tool
Coverage
…and beyond
Accessibility
a detector for every WCAG A/AA rule these engines run, proven on the same page
axe-core
65/65
each check mapped to its WCAG 2.2 success criterion (15 SCs, incl. Target Size — new in 2.2)
Google Lighthouse (Accessibility)
57/57
the manual/unscored audits Lighthouse only links out for, we either check or skip with a documented reason
HTML CodeSniffer
11/11
two error classes axe and Lighthouse leave to manual review — empty headings, fieldsets without a legend — we now detect
Security
every HTTP-security and TLS check these graders run, plus the ones they don’t
Mozilla Observatory
9/9
21 checks Observatory does not run — TLS configuration, known-CVE libraries, SPF/DKIM/DMARC, DNSSEC/CAA
securityheaders.com
6/6
we grade each header’s strength, not just its presence (weak CSP, short-max-age HSTS)
SSL Labs
5/5
we grade the same TLS config offline (protocol, key exchange, cipher, certificate, HSTS) without a remote scan
retire.js + OSV.dev
✓
we bundle both databases and detect their advisories by filename and by the runtime version a library exposes — recall a filename-only scan misses
Privacy
every tracking behavior these inspectors report, proven against the same site
Blacklight
11/11
each tracker tied to the enforcement action it appeared in — context Blacklight does not carry
Disconnect
5/5
we already bundle the list and detect by category — advertising, analytics, social, content, fingerprinting
WhoTracks.me
5/5
we bundle it (5,089 domains) and use its owner data to name who each tracker belongs to
DuckDuckGo Tracker Radar
11/11
its non-tracking categories (CDN, payment, SSO, badges) are correctly not flagged — precision, not blind spots
SEO
a detector for every Lighthouse SEO audit and every Screaming Frog issue family
Google Lighthouse (SEO)
11/11
Google's open web-quality auditor
Screaming Frog SEO Spider
16/16
the skipped tabs are deprecated or niche (meta keywords, rel-pagination, AMP), not gaps
Performance
every Core Web Vital Google ranks on, from real-user field data
Google CrUX (Core Web Vitals)
3/3
plus lab load time, page weight, image weight and mobile readiness
Google Lighthouse (Performance)
4/4
we run it via PageSpeed Insights and rate every lab metric; Total Blocking Time (its heaviest) now raises a finding
Claims & Trust
the one pillar no scanner competes on — measured against the real enforcement record
FTC / FDA / DOJ enforcement corpus
✓
each finding matched to the enforcement action pattern it resembles
Capability coverage means a detector exists for each defect class the reference tool can detect — verified check-by-check on the same page. It is not a claim of identical scoring, and for accessibility it is the machine-detectable subset of WCAG (~30–50% of the standard).
What we checked
48 checks ran across 7 pages; 46 found no issue, 2 raised a finding:
Regulated-data privacy 18 checked clean
✓ Advertising pixels on sensitive pages✓ Personal identifiers observed in transit✓ Session recording / heatmap tools✓ Customer-data-platform server-side fan-out✓ Device fingerprinting (by vendor and by technique)✓ Persistent identifiers in browser storage✓ Cross-network cookie syncing✓ CNAME-cloaked (first-party-disguised) trackers✓ Third-party WebSocket data streams✓ Third-party asset leakage on sensitive pages✓ Form submission destinations & encryption✓ Sensitive data in page addresses✓ Embedded chat / scheduling / form widgets✓ Tracking cookies vs consent timing✓ Consent enforcement (does Decline stop tags)✓ Site-platform vendor-agreement posture✓ Privacy policy present while collecting data✓ Separate consumer-health-data policy
Website security 2 flagged · 7 checked clean
✓ TLS certificate validity & version✓ HSTS / transport hardening✓ Content-Security-Policy✓ Security response headers✓ Subresource integrity on third-party scripts✓ Secure / HttpOnly cookie flags✓ Server software version disclosure● Email authentication (SPF / DKIM / DMARC)● DNS hardening (DNSSEC / CAA)
SEO & findability 8 checked clean
✓ Title & meta-description quality✓ Heading structure & H1✓ Canonical, robots & indexability✓ Sitemap presence✓ Structured data (schema.org)✓ Content depth & internal linking✓ Local business info (NAP)✓ Broken internal links
Performance 4 checked clean
✓ Core Web Vitals (field data)✓ Page & image weight✓ Mobile viewport & responsiveness✓ HTTPS redirect
Accessibility (ADA) 8 checked clean
✓ Image alt text✓ Form field labels✓ Color contrast✓ Landmarks, headings & skip links✓ ARIA & focus order✓ Media captions & autoplay✓ Data table headers✓ Accessibility statement
Trust & substantiation 1 checked clean
✓ Unsubstantiated marketing claims
A read-only scan of observable behavior: we identified our crawler honestly and honored robots directives. Detection matches a known-vendor catalog (vendor terms as of June 2026), so absence of a finding is not proof a site is free of a given issue. Engine v0.2.0.
A
Appendices
Appendix — URLs Scanned
These results bind to exactly the 7 URLs below, as they existed on July 26, 2026 (engine v0.2.0). Pages not listed were not examined.
A per-finding record of what was observed, on which pages, over which channels — captured July 26, 2026 by engine v0.2.0 on a read-only scan. Each item can be re-observed independently (see Verify this yourself). Raw request/identifier values are in the evidence CSV export. This documents our capture process and is not a legal conclusion.
MediumNo SPF record — anyone can send email as clearsite-demo-ledger.vercel.appemail-no-spf
Observed: no v=spf1 TXT record on clearsite-demo-ledger.vercel.app
Where:site-wide (a server/DNS setting, not a per-page fact)
MediumNo DMARC record — forged email from clearsite-demo-ledger.vercel.app is delivered uncheckedemail-no-dmarc
Observed: no v=DMARC1 TXT record at _dmarc.clearsite-demo-ledger.vercel.app
Where:site-wide (a server/DNS setting, not a per-page fact)
LowNo CAA record — any certificate authority can issue certs for clearsite-demo-ledger.vercel.appdns-no-caa
Observed: no CAA record for clearsite-demo-ledger.vercel.app
Where:site-wide (a server/DNS setting, not a per-page fact)
LowOCSP stapling is not enabledtls-no-ocsp
Observed: no stapled OCSP response during the handshake
Where:site-wide (a server/DNS setting, not a per-page fact)
Recommended next steps
We can remediate the 4 items identified above. To receive a prioritized remediation plan with timeline, contact ClearSite or reply to this report.
This is a point-in-time automated technical scan of observable website behavior on the specific URLs scanned, as they existed at the scan date shown — not a legal compliance audit or attestation, and not an audit, certification, or compliance opinion of any kind. Results describe only the pages scanned at that time; they are not an assessment of the business or entity operating the site, and must not be represented as current after the scan date. A "pass" means no high-priority technical issues were found at the scan threshold on the pages crawled — it does not certify HIPAA, ADA, or any regulatory compliance, and does not cover items unobservable from outside (signed vendor agreements, server configuration, internal policies). Form analysis covers each form's declared submission target; forms that submit via JavaScript to endpoints not visible in the page markup are not assessed. Third-party/tracker detection matches a known-vendor catalog, so absence of a finding is not proof a site is free of trackers. This report is general information about observable technical facts and is not legal advice, does not create an attorney-client or other professional relationship, and is not a substitute for review by a qualified attorney. For your specific legal obligations, consult an attorney licensed in your jurisdiction.
Full report · Assessment completeness: complete · Reference: 1100bed6-3f7d-4ea7-b1a6-5277349c9952 · Generated by ClearSite