Subject siteclearsite-demo-meridian.vercel.app
Report reference39bb4890-8475-49ff-95c7-757f88c278a8
Scan dateJuly 26, 2026
Report versionFull
Scan moderead-only
Coveragecomplete
Pages scanned7
Engine versionv0.2.0
Industry profileMedical practice
Overall verdictPass
Scope of this report
This is a point-in-time automated technical scan of observable website behavior on the specific URLs scanned, as they existed at the scan date shown — not a legal compliance audit or attestation, and not an audit, certification, or compliance opinion of any kind. Results describe only the pages scanned at that time; they are not an assessment of the business or entity operating the site, and must not be represented as current after the scan date. A "pass" means no high-priority technical issues were found at the scan threshold on the pages crawled — it does not certify HIPAA, ADA, or any regulatory compliance, and does not cover items unobservable from outside (signed vendor agreements, server configuration, internal policies). Form analysis covers each form's declared submission target; forms that submit via JavaScript to endpoints not visible in the page markup are not assessed. Third-party/tracker detection matches a known-vendor catalog, so absence of a finding is not proof a site is free of trackers. This report is general information about observable technical facts and is not legal advice, does not create an attorney-client or other professional relationship, and is not a substitute for review by a qualified attorney. For your specific legal obligations, consult an attorney licensed in your jurisdiction. The exact URLs scanned are enumerated in the appendix at the end of this report.
What your site is costing you
Every observation from this scan, grouped by what it actually does to your business — the same five groups as your portal, ordered by severity. We describe how each one affects you; we never put a number on it, because that number would be a guess about your business rather than an observation about your site.
How exposed you are
4 observations
What does your site tell the outside world about how it is configured?
2 Medium2 Low
- No SPF record — anyone can send email as clearsite-demo-meridian.vercel.app
- No DMARC record — forged email from clearsite-demo-meridian.vercel.app is delivered unchecked
- No CAA record — any certificate authority can issue certs for clearsite-demo-meridian.vercel.app
and 1 more in this group
Details: the Security posture chapter in the findings below.
People who can't use your site
1 observation
Who arrives, hits something they cannot get past, and leaves?
1 Low
- Small tap targets on 7 page(s)
Details: the Accessibility chapter in the findings below.
Checked, nothing found: the tools and tags you're running · being found · what you're promising. A real result about the pages we crawled — not a guarantee.
Risk overview
| Area | Highest | Findings | Severity mix |
|---|
| Website Security |
Medium |
4 |
2 Medium, 2 Low |
| Accessibility (ADA) |
Low |
1 |
1 Low |
Findings
Findings are organised into the same six discipline chapters as your portal, then grouped by area and numbered area.item (3.2 = area 3, item 2). A sensitive tag marks a page whose URL, title, or form indicated health, identity, or payment context — the specific trigger is shown where recorded.
Security postureModerate risk
What your site tells the outside world about how it is configured — observed without touching it. 4 observations in this discipline.
1Email security3 findings
1.1No SPF record — anyone can send email as clearsite-demo-meridian.vercel.app
Medium
Website Security · Email security · observed · visitor exposure
Medical practices are frequent targets of impersonation attacks because patients, insurers, and referral partners trust messages that appear to come from a known provider. A forged email appearing to come from your domain could be used to trick patients into revealing login credentials or redirecting payments — and your practice may have no visibility into it when it happens.
Observed: no v=spf1 TXT record on clearsite-demo-meridian.vercel.app
Status: First seen in this scan
Recommended fix: Add a DNS TXT record for clearsite-demo-meridian.vercel.app in the form "v=spf1 -all" if this domain genuinely sends no email, or "v=spf1 include:<your mail provider> -all" if it does or will. Your DNS host or IT contact can make this change. If outgoing email actually runs through a different domain, verify that that domain has its own SPF record configured correctly.
1.2No DMARC record — forged email from clearsite-demo-meridian.vercel.app is delivered unchecked
Medium
Website Security · Email security · observed · visitor exposure
Patients and referral partners trust email that appears to come from your practice. Without a DMARC record, other mail servers have no instruction to reject or flag forged messages using your domain name, making it easier for someone to impersonate your practice in email. Major providers including Google, Yahoo, and Microsoft have increased scrutiny of domains without DMARC, and a spoofed message appearing to come from a medical practice could put patients at risk of fraud.
Observed: no v=DMARC1 TXT record at _dmarc.clearsite-demo-meridian.vercel.app
Status: First seen in this scan
Recommended fix: Publish a DMARC TXT record at _dmarc.clearsite-demo-meridian.vercel.app — start with a policy of "p=none" and include a reporting address so you can monitor results, then advance to "p=quarantine" once the reports show no legitimate mail is being caught. Your DNS host or web developer can make this change directly in your domain's DNS settings.
1.3No CAA record — any certificate authority can issue certs for clearsite-demo-meridian.vercel.app
Low
Website Security · Email security · observed · missing safeguard
CAA is a cheap guard against certificate mis-issuance — if an attacker tricks some CA into issuing a cert for your domain, CAA can block it. One DNS record.
Observed: no CAA record for clearsite-demo-meridian.vercel.app
Status: First seen in this scan
Recommended fix: Add a CAA record naming your certificate authority (e.g. "0 issue \"letsencrypt.org\"").
2Transport security1 finding
2.1OCSP stapling is not enabled
Low
Website Security · Transport security · observed · missing safeguard
OCSP stapling speeds up the connection and improves privacy by proving the certificate isn't revoked without the browser contacting the CA. It's a server toggle.
Observed: no stapled OCSP response during the handshake
Status: First seen in this scan
Recommended fix: Enable OCSP stapling in the web server / load balancer configuration.
AccessibilityLow risk
Whether people using a keyboard, a screen reader, or a phone can complete what your site is for. 1 observation in this discipline.Technical score 96/100 — ranks your own scans against each other, not a grade against other sites.
3Navigation & links1 finding
3.1Small tap targets on 7 page(s)
Low
Accessibility (ADA) · Navigation & links · observed · missing safeguard
Medical practices regularly serve patients with physical limitations, and hard-to-tap links on pages like /contact and /health-privacy may prevent those patients from reaching appointment or privacy information. HHS has issued a rule requiring WCAG 2.1 AA accessibility for provider websites; verify whether your practice receives Medicare or Medicaid funding and how many employees you have, as those factors determine which deadline — May 2027 or May 2028 — may apply to you.
Observed: / (10), /services (7), /contact (11), /about (7), /health-privacy (7)
Status: First seen in this scan
Screens for: WCAG 2.2 SC 2.5.8 Target Size (Minimum) — Level AA
ADA Title III suits over business websites number in the thousands each year (healthcare is a steady share of filings — UsableNet/EcomBack trackers). More directly for practices: HHS's Section 504 final rule requires WCAG 2.1 AA for the websites and apps of providers receiving federal financial assistance (Medicare/Medicaid); after a May 2026 interim final rule the compliance deadline is May 11, 2027 for recipients with 15 or more employees and May 10, 2028 for smaller ones.
Recommended fix: Have your web developer increase the CSS size or padding of the affected buttons and links on /, /services, /contact, /about, and /health-privacy so that each interactive element measures at least 24×24 CSS pixels, or add sufficient spacing around smaller elements to meet that minimum.
How deep we scanned
3,000+
known trackers screened
Beyond a cookie scan, we inspect every outbound channel — requests, form-field values, beacons, WebSockets, cookies and browser-storage writes — and match what we find against our live database of FDA, FTC, DOJ and state enforcement actions and court cases, updated continuously. The itemized breakdown of the 48 checks is in What we checked below.
Benchmarked against the standard tools
For each pillar, a detector for every defect class the recognized reference tools can find — verified check-by-check against the same rule catalog, on the same page.
| Pillar | Reference tool | Coverage | …and beyond |
|---|
| Accessibility a detector for every WCAG A/AA rule these engines run, proven on the same page |
axe-core |
65/65 |
each check mapped to its WCAG 2.2 success criterion (15 SCs, incl. Target Size — new in 2.2) |
| Google Lighthouse (Accessibility) |
57/57 |
the manual/unscored audits Lighthouse only links out for, we either check or skip with a documented reason |
| HTML CodeSniffer |
11/11 |
two error classes axe and Lighthouse leave to manual review — empty headings, fieldsets without a legend — we now detect |
| Security every HTTP-security and TLS check these graders run, plus the ones they don’t |
Mozilla Observatory |
9/9 |
21 checks Observatory does not run — TLS configuration, known-CVE libraries, SPF/DKIM/DMARC, DNSSEC/CAA |
| securityheaders.com |
6/6 |
we grade each header’s strength, not just its presence (weak CSP, short-max-age HSTS) |
| SSL Labs |
5/5 |
we grade the same TLS config offline (protocol, key exchange, cipher, certificate, HSTS) without a remote scan |
| retire.js + OSV.dev |
✓ |
we bundle both databases and detect their advisories by filename and by the runtime version a library exposes — recall a filename-only scan misses |
| Privacy every tracking behavior these inspectors report, proven against the same site |
Blacklight |
11/11 |
each tracker tied to the enforcement action it appeared in — context Blacklight does not carry |
| Disconnect |
5/5 |
we already bundle the list and detect by category — advertising, analytics, social, content, fingerprinting |
| WhoTracks.me |
5/5 |
we bundle it (5,089 domains) and use its owner data to name who each tracker belongs to |
| DuckDuckGo Tracker Radar |
11/11 |
its non-tracking categories (CDN, payment, SSO, badges) are correctly not flagged — precision, not blind spots |
| SEO a detector for every Lighthouse SEO audit and every Screaming Frog issue family |
Google Lighthouse (SEO) |
11/11 |
Google's open web-quality auditor |
| Screaming Frog SEO Spider |
16/16 |
the skipped tabs are deprecated or niche (meta keywords, rel-pagination, AMP), not gaps |
| Performance every Core Web Vital Google ranks on, from real-user field data |
Google CrUX (Core Web Vitals) |
3/3 |
plus lab load time, page weight, image weight and mobile readiness |
| Google Lighthouse (Performance) |
4/4 |
we run it via PageSpeed Insights and rate every lab metric; Total Blocking Time (its heaviest) now raises a finding |
| Claims & Trust the one pillar no scanner competes on — measured against the real enforcement record |
FTC / FDA / DOJ enforcement corpus |
✓ |
each finding matched to the enforcement action pattern it resembles |
Capability coverage means a detector exists for each defect class the reference tool can detect — verified check-by-check on the same page. It is not a claim of identical scoring, and for accessibility it is the machine-detectable subset of WCAG (~30–50% of the standard).
What we checked
The 105 checks of the standard we measure every site against, version 0.5, and what each did on this site across the 7 pages we read: 4 raised a finding, 74 checked and nothing found, 1 not measured on this scan, 26 not run on this scan.
● raised a finding ✓ checked and nothing found ◌ not measured on this scan ○ not run on this scan
Regulated-data privacy 20 checked and nothing found
✓ Advertising pixels on sensitive pages✓ Personal identifiers observed in transit✓ Session recording / heatmap tools✓ Customer-data-platform server-side fan-out✓ Device fingerprinting (by vendor and by technique)✓ Persistent identifiers in browser storage✓ Cross-network cookie syncing✓ CNAME-cloaked (first-party-disguised) trackers✓ Third-party WebSocket data streams✓ Third-party asset leakage on sensitive pages✓ Form submission destinations & encryption✓ Sensitive data in page addresses✓ Embedded chat / scheduling / form widgets✓ Tracking cookies vs consent timing✓ Consent enforcement (does Decline stop tags)✓ Global Privacy Control signal honored✓ Trackers that fire only on some devices✓ Site-platform vendor-agreement posture✓ Privacy policy present while collecting data✓ Separate consumer-health-data policy
Visitor privacy 14 checked and nothing found
✓ Third-party trackers & advertising pixels✓ Disguised trackers & hidden channels (CNAME cloaking, WebSocket streams)✓ Third parties we have no catalogued position on✓ Personal data observed leaving the browser✓ Session recording / heatmap tools✓ Device fingerprinting & persistent browser-storage identifiers✓ Cookie lifetime & third-party-set first-party cookies✓ Privacy policy present & consistent with observed behavior✓ Sale/share opt-out control actually present✓ Tracking cookies vs consent timing✓ Connections and pre-fetches made ahead of the visitor✓ High-value pages the site excluded from scanning✓ Tracking on the error/404 template✓ Where forms send what visitors type
Website security 3 raised a finding · 10 checked and nothing found
● TLS certificate, protocol version & cipher strength✓ HSTS / transport hardening✓ Content-Security-Policy✓ Security response headers✓ Cross-origin resource sharing (CORS)✓ Subresource integrity on third-party scripts✓ Secure / HttpOnly cookie flags✓ JavaScript libraries with published vulnerabilities✓ Scripts running site-wide that nothing identifies✓ Published security contact (security.txt)✓ Server software version disclosure● Email authentication (SPF / DKIM / DMARC)● DNS hardening (DNSSEC / CAA)
SEO & findability 14 checked and nothing found · 1 not measured on this scan
✓ Title & meta-description quality✓ Heading structure & H1✓ Canonical, robots & indexability✓ Sitemap presence & health✓ Structured data (schema.org)✓ Content depth, duplication & internal linking✓ Local business info (NAP)✓ Link health, anchor text & crawlability✓ URL structure & tracking parameters✓ International targeting (hreflang)✓ Page head & resource hygiene✓ AI crawler access (retrieval vs training)◌ AI retrieval: what robots.txt declares vs what a non-browser client received✓ Raw vs rendered HTML (JavaScript dependence)✓ Image markup (alt text, dimensions)
the non-browser probe did not run on this scan, so there is no receipt to compare against
Performance 7 checked and nothing found
✓ Core Web Vitals (field data)✓ Page & image weight✓ Render-blocking resources & font loading✓ Caching, protocol version & back/forward cache✓ Third-party request weight & DOM size✓ Mobile viewport & responsiveness✓ HTTPS redirect
Accessibility (ADA) 1 raised a finding · 8 checked and nothing found
✓ Image & SVG alternative text✓ Form field labels & grouping✓ Color contrast & colour-only cues✓ Landmarks, headings & skip links✓ ARIA, accessible names & focus order● Zoom, target size & text spacing✓ Media captions & autoplay✓ Data table headers✓ Accessibility statement
Trust & substantiation 1 checked and nothing found
✓ Unsubstantiated marketing claims
Disclosures & representations 3 not run on this scan
○ FDIC / SIPC representation accuracy○ Affiliate / endorsement disclosure○ Investment guarantee language
not included in this scan
Pharmacy & Rx claims 4 not run on this scan
○ Drug-claim & fair-balance patterns○ Compounded / controlled-substance patterns○ Pharmacy legitimacy seals○ Telehealth disclosures (crisis line, emergency, consent)
not included in this scan
Subscription & billing 2 not run on this scan
○ Auto-renewal & negative-option disclosure○ Cancellation path clarity
not included in this scan
Fair housing & tenancy 6 not run on this scan
○ Listing copy screened for preference wording (§3604(c))○ Housing-assistance / voucher exclusions in advertising○ Pet policy vs assistance-animal accommodation○ Housing ad targeting exposure (Special Ad Category)○ Screening criteria & FCRA adverse-action disclosure○ Application / admin fee disclosure
not included in this scan
Consented egress test 1 not run on this scan
○ Field values observed leaving on a consented, never-submitted form
runs only with your written consent, on a site you have verified you own
Content & build integrity 4 not run on this scan
○ Unfilled placeholders and blank merge fields○ Page addresses: duplicates, broken links, and addresses that contradict the page○ Copy errors: doubled words and misspellings○ Pages that appear unfinished
not included in this scan
Services you pay for 6 not run on this scan
○ Conversion pages carrying none of the site's services○ Services present on some pages and not others○ Services that did not load on the pages that asked for them○ Vendors reporting to more than one account○ Two services doing one job, and site-wide tools left on one or two pages○ What each service adds to your pages
not included in this scan
A check that found nothing is a check that found nothing: it is not proof the issue is absent, and it is never a pass mark. A check that did not run says so, with the reason. A read-only scan of observable behavior: we identified our crawler honestly and honored robots directives. Detection matches a known-vendor catalog (vendor terms as of June 2026). Engine v0.2.0.
This is a point-in-time automated technical scan of observable website behavior on the specific URLs scanned, as they existed at the scan date shown — not a legal compliance audit or attestation, and not an audit, certification, or compliance opinion of any kind. Results describe only the pages scanned at that time; they are not an assessment of the business or entity operating the site, and must not be represented as current after the scan date. A "pass" means no high-priority technical issues were found at the scan threshold on the pages crawled — it does not certify HIPAA, ADA, or any regulatory compliance, and does not cover items unobservable from outside (signed vendor agreements, server configuration, internal policies). Form analysis covers each form's declared submission target; forms that submit via JavaScript to endpoints not visible in the page markup are not assessed. Third-party/tracker detection matches a known-vendor catalog, so absence of a finding is not proof a site is free of trackers. This report is general information about observable technical facts and is not legal advice, does not create an attorney-client or other professional relationship, and is not a substitute for review by a qualified attorney. For your specific legal obligations, consult an attorney licensed in your jurisdiction.
Full report · Assessment completeness: complete · Reference: 39bb4890-8475-49ff-95c7-757f88c278a8 · Generated by ClearSite