Home / Blog / FreeSiteAudit Report: False Positives Explained

Site Audit

FreeSiteAudit Report: False Positives Explained

25 October 2026 · By John Carlsson

FreeSiteAudit's free scan of the aiwebpageseo.com home page listed 20 issues, and seven were false positives when checked against the live page. The charset declaration it called missing is in the first 1,024 bytes. The consent banner it called missing is loaded on every page, and Google Analytics, which it said was not installed, loads only after consent. The page has 23 headings, not 3, a visible last-updated date and dateModified in its schema, SVG images rather than only legacy formats, and is not built on Webflow. Its CSP wildcard warning was overstated.

What happened

On 25 October 2026 we ran the free public scan from FreeSiteAudit on the aiwebpageseo.com home page. It scored the site 92 out of 100, "Excellent", and listed 20 issues. We checked every issue against the live page from our own server. Seven were false positives, and an eighth overstated the problem. This post covers those, with the evidence for each.

The short version

"No charset declaration found": false. The page declares its character set in the first 1,024 bytes.
"Consent Banner Missing When Tracking Detected": false. The page loads its consent banner, and no tracking runs before consent.
"Analytics / Measurement Not Detected": false. The site uses Google Analytics 4, loaded only after consent. The report also contradicts itself: it says tracking was detected and no analytics was detected.
"Only 3 subheadings for 4817 words": false. The page has 23 headings.
"No date signals found": false. The page shows a last-updated date and its structured data carries dateModified.
"All 10 images use legacy formats": false. The images are PNG and SVG, and SVG is a modern vector format.
Platform detected as Webflow: false. The site is not built on Webflow.
"Wildcard (*) in script-src": overstated. There is no bare wildcard, only one scoped to Cloudflare's own subdomains.

False positive 1: "No charset declaration found"

What the report said. Under Technical Health, "HTML Validation Sample Issues: No charset declaration found", with the fix "Add <meta charset="utf-8"> within the first 1024 bytes of <head>".

What the page has. We fetched the page and checked its first 1,024 bytes. The <meta charset> declaration is there, exactly where the fix says it should be.

What the rule says. The HTML Standard requires the character encoding declaration to be serialised completely within the first 1,024 bytes of the document. Ours is.

Who complies. Our page complies. The scan reports a declaration missing that is present.

False positive 2: "Consent Banner Missing When Tracking Detected"

What the report said. "Tracking scripts detected but no consent banner or CMP found. 5 scripts loaded, no consent mechanism detected."

What the page has. The page loads /gdpr-consent.js, our consent banner. The page HTML contains no Google Analytics ID and no Google Tag Manager or gtag code at all: Google Analytics is only loaded by the consent script after a visitor clicks Accept. Counting scripts is not the same as detecting tracking. A page can load several first-party scripts without tracking anyone.

What the rule says. Under the UK's PECR rules on cookies and the EU ePrivacy rules, non-essential cookies such as analytics need consent before they are set. The requirement is that tracking waits for consent.

Who complies. Our page complies: the banner is there, and analytics waits for Accept.

False positive 3: "Analytics / Measurement Not Detected"

What the report said. "No analytics or measurement capability detected", marked high impact, with the advice to install GA4.

What the site has. The site already uses GA4. Because it loads only after consent, a scanner that never clicks Accept will not see it, which is the consent working as it should. The same report, two sections earlier, claimed tracking was detected and complained there was no consent banner. It cannot be true both that tracking was detected and that no analytics was detected.

False positive 4: "Only 3 subheadings for 4817 words"

What the report said. "Content is hard to scan: only 3 subheadings for 4817 words."

What the page has. 23 headings: 1 H1, 3 H2 and 19 H3. The scan appears to have counted only the H2 headings. The 19 H3 headings are the names of each audit on the page, each followed by a short description, which is exactly the scannable structure the advice asks for. WAVE from WebAIM counted the same 23 headings on the same day.

False positive 5: "No date signals found"

What the report said. "No datePublished/dateModified in schema, no <time> tag, and no visible date pattern detected on this article."

What the page has. A visible date in the footer, "Last updated: 12 October 2026", and dateModified in the page's JSON-LD. The page is also a home page, not an article, so publish dates are not expected in the first place.

False positive 6: "All 10 images use legacy formats"

What the report said. "No Modern Image Formats (WebP/AVIF). All 10 images use legacy formats."

What the page has. The 10 images are PNG and SVG files. SVG is a vector format that scales to any size without losing quality, and for logos and badges it is usually smaller than WebP or AVIF. Calling SVG a legacy format is wrong.

False positive 7: Platform detected as Webflow

What the report said. Its platform detection named the site as Webflow, with "medium" confidence, from "Webflow references".

What the page has. The site is not built on Webflow. The word "Webflow" appears on the home page only in our own list of website platforms our audits are tested on: WordPress, Wix, Shopify, Squarespace, Webflow and others. The detector read a mention in the text as the platform the site runs on. Fix advice tailored to the wrong platform will be wrong too.

Overstated: "Wildcard (*) in script-src"

What the report said. "Weak Content Security Policy. CSP has 1 weakness(es): Wildcard (*) in script-src."

What the page sends.

script-src 'self' https://cdnjs.cloudflare.com https://static.cloudflareinsights.com https://*.cloudflare.com https://www.googletagmanager.com

There is no bare *, which would allow scripts from anywhere. There is https://*.cloudflare.com, which allows only Cloudflare's own subdomains over HTTPS. That is a scoped wildcard, far narrower than the report's wording and its advice to remove "unsafe directives and wildcards" suggest. The policy has no 'unsafe-inline' or 'unsafe-eval' in script-src.

What the rule says. The W3C's Content Security Policy Level 3 allows host sources with a leading wildcard for subdomains, such as https://*.example.com. A bare * matches any host and is the weakness security graders warn about.

Who complies. Our policy uses a scoped subdomain wildcard, not a bare one.

How to check a report like this yourself

Fetch the page and look. A charset declaration, a date or a heading count takes seconds to confirm in the page source.
Look for contradictions. "Tracking detected" and "no analytics detected" in one report cannot both be right.
Remember consent. Scanners do not click Accept, so they will not see analytics that correctly waits for consent.
Check the platform it assumes. If a report names the wrong platform, treat its platform-specific advice with care.

Our Security Audit breaks a Content Security Policy down directive by directive and checks the headers your server actually sends.

The full reports

The FreeSiteAudit report and our live server checks are published in full and unedited. See the full reports.

Sources

Try it yourself: Security Audit · Combined Audit

Frequently asked questions

Is FreeSiteAudit accurate?

On our home page, seven of its 20 issues were false positives. It said the charset declaration, the consent banner, analytics and date signals were missing when all four are present, counted 3 subheadings on a page with 23 headings, called SVG images a legacy format, and identified the site as built on Webflow when it is not. It also overstated a scoped Cloudflare subdomain wildcard in the Content Security Policy as a general wildcard weakness.

Why can a site audit not see my Google Analytics?

If Google Analytics only loads after a visitor accepts cookies, a scanner that never clicks Accept will not see it in the page. That is the consent working correctly, because UK and EU rules require non-essential cookies such as analytics to wait for consent. A tool that reports no analytics installed on such a site is reading the consent behaviour as a missing install, so check your own analytics account before acting on it.

Is a wildcard in a Content Security Policy always unsafe?

No. A bare asterisk in script-src allows scripts from any website, and that is the real weakness. A scoped wildcard such as https://*.cloudflare.com only allows subdomains of one named domain over HTTPS, which is much narrower. It is still worth keeping wildcards as tight as possible, but a report that treats the two the same overstates the risk. Read the actual policy your server sends before deciding what to change.

Are SVG images a legacy format?

No. SVG is a vector image format supported by every modern browser. It scales to any size without losing sharpness, and for logos, icons and badges it is usually smaller than a WebP or AVIF version. WebP and AVIF are the modern choices for photographs and other detailed images. A report that counts SVG files as legacy images and tells you to convert them is giving advice that would make those images worse.

How do audit tools detect which platform a site uses?

Most look for traces in the page, such as script addresses, generator meta tags, cookie names or class names that a platform adds. Weaker detectors also match the platform's name anywhere in the text, so a page that merely mentions Webflow or WordPress can be misidentified. If a report names the wrong platform, its platform-specific fix instructions will be wrong too, so confirm the detection before following them. Checking the page source takes a minute.