WCAG Repair: Critical Examination of Negative Audit Findings

The 64-check security assessment reports named response-header controls rather than a single unexplained header score. Its documented inventory covers Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Resource-Policy and Cross-Origin-Opener-Policy. The reported security-audit outcome is 97/100, with 47 PASS, two WARN, 11 N/A and four INFO results. The overall score is contextual information, not a substitute for those individual checks.

A security-header audit should identify the tested HTTPS response, header name, actual value, applicable rule and whether the header is expected for that resource. CSP needs particular attention: the mere presence of a policy does not prove that directives are suitably restrictive. Likewise, COOP and CORP can be intentionally configured according to application architecture. My AIWebPageSEO Audit's itemised controls provide a more inspectable basis than WCAG Repair's incompatible module-level percentages.

My AIWebPageSEO Security Audit explicitly marks HTTP-to-HTTPS redirection PASS. The supplied server configuration also contains a port-80 redirect returning HTTP 301 to the HTTPS scheme, preserving the requested path. The audit result and configured behaviour point in the same direction: the tested site is intended to enforce encrypted transport.

For a redirecting HTTP endpoint, the client normally receives a 3xx response and a Location header identifying the HTTPS target. A status 200 for that same initial HTTP request means the requested resource was served rather than redirected. A proper report records the initial URL, status and Location, including any intermediate hops. WCAG Repair's unexplained failure can cause a site to be penalised for a transport control that my AIWebPageSEO Audit reports as passed.

My AIWebPageSEO Security Audit explicitly records Strict-Transport-Security as PASS. The supplied server configuration specifies a one-year max-age, includeSubDomains and preload in the HSTS value, with configuration intended to add the header to HTTPS responses. This is more specific evidence than a generic security grade.

HSTS is defined by RFC 6797 and is conveyed in HTTPS responses. Looking for the header on an unencrypted HTTP response is not an appropriate way to determine whether an HTTPS endpoint implements HSTS. The effective policy also depends on max-age and deployment details; a site-wide assertion should identify the host and response actually examined. An unsupported missing-HSTS verdict wrongly suggests browsers lack a transport protection.

My AIWebPageSEO Security Audit records HTTP-to-HTTPS redirection as PASS. Separately, the documented Redirect Chain Checker enumerates redirect hops, HTTP status codes and destination URLs, and detects excessive chains or loops. This matters because the existence of a redirect is normal: moving from HTTP to HTTPS, canonicalising a hostname or forwarding an old page does not itself imply suspicious behaviour.

Redirect-chain integrity and malicious-destination classification are related but distinct checks. A malicious-redirect determination requires the actual chain plus a stated detection criterion, such as a dangerous external destination, unexpected host transition or malicious reputation signal. My AIWebPageSEO Audit demonstrably documents redirect paths and passes its HTTPS-enforcement test; the available evidence does not identify a separately recorded malicious-destination PASS. That distinction prevents inventing a result while still holding WCAG Repair responsible for its opaque failure.

My AIWebPageSEO Security Audit includes a specific check for Cache-Control on private responses. It records that check as N/A when the relevant preconditions — cookies or private data — are absent. This is an intentional distinction between an inapplicable risk and a failed control, not an omission.

A public static page can legitimately use caching directives, whereas authenticated, personalised or sensitive responses require careful storage controls. 'no-cache' permits storage subject to revalidation; 'no-store' is a stronger instruction against storage. A security finding should explain which data is at risk and what directive is required. Scoring every absent or different cache header as a security failure conflates performance policy with confidentiality risk.

My AIWebPageSEO Audit has broader AI-readiness tooling, including assessment of machine-readable website information and separate structured-data capabilities. Those tools address discoverability and interoperability through multiple formats rather than assuming one legacy integration file is compulsory.

The ai-plugin.json convention arose in a particular plugin ecosystem. It is not a WCAG accessibility success criterion, HTTP security header or universal search indexing requirement. A meaningful AI-readiness assessment should distinguish optional ecosystem compatibility from machine-readable content, structured data, crawler accessibility and other capabilities. Treating the optional file as a blanket failure can reduce an AI-readiness score even when the site has no reason to publish it.

My AIWebPageSEO Audit documents structured-data analysis and tooling for JSON-LD, schema.org types and Google-oriented validation requirements. This allows a reviewer to examine markup syntax, recognised entity types, required properties, recommended properties and actionable errors. A structured-data assessment is meaningful when it names the precise node and property at issue.

Schema.org vocabulary validity, Google's feature-specific eligibility and an individual AI product's data-ingestion preferences are different questions. A validator should not collapse them into a single unqualified failure. For example, a syntactically valid JSON-LD block may be ineligible for a particular rich-result feature without being invalid structured data. A diagnostic report should explain which standard or feature is being applied and why the observed markup fails it.

My AIWebPageSEO Accessibility Audit is documented as using axe-core alongside supplementary checks, including keyboard behaviour, focus, reflow, text spacing, non-text contrast, flashing and navigation consistency. The separate independent axe-core report for the homepage records zero automated violations, 46 passed checks and one manual-review category affecting 21 gradient-related elements. These are specific method and result statements.

For each contested issue the scanner should provide the URL, selector or DOM excerpt, rule identifier, tested state, viewport and observed failure. That evidence distinguishes a genuine defect from a false positive, a different page state or a difference in rule coverage. The AIWebPageSEO's documented supplementary tests matter because automated axe-core results alone cannot establish every aspect of WCAG conformance. WCAG Repair's available report does not give enough detail to audit its complete issue total against the independent homepage result.

The independent axe-core report identifies 21 homepage elements for manual assessment because gradient backgrounds prevent a reliable automated foreground/background contrast calculation. It records those items separately from its zero confirmed automated violations. That distinction is technically important.

WCAG text contrast generally requires at least 4.5:1 for ordinary text or 3:1 for qualifying large text, subject to exceptions. A reliable result depends on rendered text colour, background colour at the text's location, font characteristics and state. Gradients, images and overlays can defeat simplistic colour sampling. A tool should mark such cases as inconclusive until a representative rendered contrast value is established; it should not silently convert uncertainty into a confirmed failure.

The saved WCAG Repair report distinguishes 201 accessibility issues from 1,394 colour-contrast occurrences flagged for manual review. The 1,394 occurrences are distributed across nine pages and are not 1,394 additional confirmed violations. Any summary that combines these figures into a single failure count would misstate the source.

A serious accessibility audit must maintain separate tallies for automated failures, potential issues needing human inspection, passed rules and not-applicable rules. It must also retain page and element identifiers so repeated instances are not confused with distinct accessibility criteria. Large counts are not inherently more thorough: they are useful only when their definitions and evidence are transparent.

My AIWebPageSEO Security Audit identifies 64 checks and classifies them as 47 PASS, two WARN, 11 N/A and four INFO. The counts reconcile to the stated total. Crucially, the N/A and INFO categories are visible rather than being disguised as failures. This gives the reader a defined basis for understanding why a control did or did not affect the security assessment.

A security audit is an engineering diagnostic, not simply a score. Every adverse result should identify its control, evidence, applicability, severity and remediation. Hiding three failures prevents an independent reviewer from distinguishing real vulnerabilities from optional hardening, policy preferences or scanner mistakes. A complete itemised inventory is therefore a functional advantage, not merely a more attractive presentation.