Site audit: motohorek.life
Measured from the outside on 2026-10-23. 15 findings: 1 fail, 14 warn. This pass read 6 pages of the 493 pages the sitemap lists, spread across the site and named below. The pages it did not open, and everything behind a login, are in the deeper audit. Nothing here needed access to the server.
The short version. performance 45/100 with a 7.7 s largest paint, 1 finding a scanner can act on (author names via api), 14 things worth tidying.
The pages we read
| Page | Title | H1 | Description | Canonical | Alt text |
|---|---|---|---|---|---|
| / | 87 ch | 0 | 217 ch | self | 100% |
| /2019/08/13-unique-animals-in-amazon-jungle-to-see-without-tour/ | 57 ch | 1 | 126 ch | self | 100% |
| /2020/05/porvenir-tierra-del-fuego/ | 41 ch | 1 | 118 ch | self | 100% |
| /2021/07/teberdinsky-zapovednik/ | 38 ch | 1 | 124 ch | self | 100% |
| /2023/07/starlink/ | 53 ch | 1 | 129 ch | self | 100% |
| /sotrudnichestvo/ | 14 ch | 1 | 127 ch | self | 100% |
Every check below ran on every page in this table, and each finding names the worst page it found it on.
Speed, measured by Lighthouse
Lighthouse 13.5.0, mobile, run on a real browser
Measured from a server in Helsinki, Finland, using a simulated mid-range phone on a mobile connection. Where that server sits is part of the score: visitors closer to it see faster times than visitors further away, so a site with customers on the other side of the world can score lower here than it feels in practice. Every audit is measured from the same place, which is what lets you compare one report against another. One run also moves by a few points on its own, so treat a change as real only when it repeats.
| Biggest single wins | Time | Bytes |
|---|---|---|
| Reduce unused JavaScript | 1600 ms | |
| Avoid multiple page redirects | 1001 ms | |
| Initial server response time was short | 78 ms |
Lighthouse's own estimates for this page. They describe where the time goes, not what a rebuild costs.
Everything we checked
43 checks across 7 layers. A FAIL is something a scanner can use; a WARN is a door that is common but does not need to be open.
Discovery and AI readiness
| Check | Result | What it found |
|---|---|---|
| XML sitemap | OK | found at /sitemap_index.xml 5 entries |
| Pages read | INFO | read 6 of the 493 pages the sitemap lists / /2019/08/13-unique-animals-in-amazon-jungle-to-see-without-tour/ /2020/05/porvenir-tierra-del-fuego/ /2021/07/teberdinsky-zapove |
| Sitemap named in robots.txt | OK | 1 Sitemap line(s) |
| llms.txt for AI agents | INFO | not published; assistants scrape pages instead |
| Favicon | OK | declared on all 6 pages read |
| Web app manifest | INFO | absent, only matters for installable apps |
| RSS feed | OK | available at /feed/ |
Crawlability and indexation
| Check | Result | What it found |
|---|---|---|
| Search engines allowed | OK | no site-wide block |
| Indexable | OK | no index block on any of the 6 pages read |
| Canonical tags | OK | self-referencing and absolute on all 6 pages read |
| HTTP redirects to HTTPS | OK | yes https://motohorek.life/ |
| www and bare domain agree | OK | both end at motohorek.life |
| Missing pages return 404 | OK | real 404 |
On-page basics
| Check | Result | What it found |
|---|---|---|
| Page titles | WARN | 1 of 6 pages are missing a title or run past 65 characters; the longest is 87 on / Camino Distinto Travel Blog - Жизнь в путешествии: 14 лет в дороге, 57 |
| Meta descriptions | WARN | 1 of 6 pages are missing a description or sit outside 80 to 200 characters / 217 |
| One H1 per page | WARN | 1 of 6 pages do not: 0 on / |
| Social preview tags | WARN | 1 of 6 pages lack an og:title or an og:image |
| Structured data | OK | JSON-LD on every page read |
| Image alt text | OK | every page with images describes at least 80% of them |
| Page language declared | OK | ru-RU |
| Mobile viewport | OK | declared on every page read |
Security headers
| Check | Result | What it found |
|---|---|---|
| HSTS | WARN | max-age=86400 |
| Content Security Policy | WARN | absent |
| MIME sniffing blocked | OK | nosniff |
| Clickjacking protection | WARN | neither header nor frame-ancestors |
| Referrer policy | WARN | absent |
| Permissions policy | INFO | absent |
| Cross-origin opener policy | INFO | absent |
| Server banner | OK | cloudflare |
Email and DNS
| Check | Result | What it found |
|---|---|---|
| Receives email at the domain | OK | 3 MX record(s) 10 mx.zoho.com. | 20 mx2.zoho.com. | 50 mx3.zoho.com. |
| SPF | OK | one record, ends in -all "v=spf1 include:zoho.com -all" |
| DMARC | OK | policy p=reject "v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s; rua=mailto:pauldmendes5+motohorekcloudflare@gmail.c |
| DKIM | WARN | key on zmail, 1024-bit (2048 is the current minimum) |
| Branded email | INFO | no email address found on the home page |
WordPress housekeeping
| Check | Result | What it found |
|---|---|---|
| WordPress version | WARN | 6.9.10 in use, 7.1.3 is current |
| readme.html | WARN | reachable and names the version |
| Author names via API | FAIL | 3 usernames readable without login |
| XML-RPC | WARN | reachable, a common password-guessing surface |
| Login page | WARN | public at /wp-login.php |
| Uploads listing | OK | not listable |
| /wp-content/debug.log reachable | OK | not reachable |
| /.env reachable | OK | not reachable |
Server runtime
| Check | Result | What it found |
|---|---|---|
| PHP runtime | WARN | PHP is in the request path, because this is a WordPress site, and the version is not disclosed from outside, so it cannot be checked from here. During the current PHP2Shell emergency that is not a pass: ask the host which branch and version the pool runs, and whether it is on 8.2.35, 8.3.36, 8.4.27 or 8.5.12. |
What you can fix yourself, without us
- Email authentication needs work: the DKIM key is 1024 bits, and 2048 is the minimum.
- Give each page one H1 that says what the page is about.
- Write a meta description of 120 to 160 characters; it is the sentence search results show.
- Add the missing security headers (HSTS, CSP, Referrer-Policy, framing protection). They are free and they close the cheap attacks.
- Publish an llms.txt: a short markdown map of your best pages, so AI assistants quote you accurately.
- Close the author enumeration on the API. It hands a scanner valid usernames to try.
- Turn XML-RPC off unless an app needs it; it is what automated login attempts use.
These are free, and you are welcome to do them with a developer you already trust. If that is enough, this audit has done its job.
Where we could help
- Email: a mailbox on your own domain, aliases for hello, sales and billing, and SPF, DKIM and DMARC set up and tested.
- Security hardening: the headers, the login path, and the WordPress exposure this audit found, closed.
- On-page basics: titles, descriptions, headings and alt text, written per page rather than templated.
- A migration: the site as static files on Cloudflare's edge, with WordPress kept as the editor or replaced entirely.
Want the deeper report? With read-only access we can see plugin versions, database size, backups and what you actually pay each month, which is the half that decides whether a migration is worth it.
This pass read one page. The whole site crawl is free: every page, every internal link, and an inventory you can hand to a developer.
What this audit cannot see
It ran without server access, so it cannot see plugin versions, the database, backups, logs, or your invoices. Three measurements a Worker cannot make are also absent rather than guessed: TLS certificate details, the HTTP protocol version, and whether the origin compresses. So is the PHP version under your site, unless the server volunteers it in a response header, which none of the twenty-two sites we sampled did. That layer is worth naming because two remote code execution flaws in PHP itself are being exploited in the wild as of 21 October 2026, and no scanner outside your server can see whether you are patched. They are in the deeper report.