What your site is actually doing.

Audit of https://contractive.app, run August 30, 2026. 11 issues were found. I want them fixed.

## Context
- Site: https://contractive.app
- Mobile LCP (lab median): 230 ms
- Desktop LCP (lab median): 184 ms
- Page weight (median): 0.1 MB
- Tap targets under 44px: 64% (16 of 25)
- Evidence base: 4 mobile + 2 desktop loads

## Already working, do not change these
- Speed is good: The main content paints in about 0.2s in our test loads, inside Google's 2.5s "good" threshold. Real networks are slower, but the page itself is not heavy.
- Light page weight: The page is about 0.1 MB across 42 requests. That keeps it quick on mobile data and cheap to load repeatedly.
- No JavaScript errors on load: Nothing threw a script error across the test loads, so buttons and tracking are not silently breaking mid-session.
- Search basics are in place: Lighthouse scores SEO 100/100. The fundamentals Google looks for are present.
- Layout holds on phone and desktop: Nothing spilled past the edge at either 390px (phone) or 1366px (desktop), so the structure is responsive.

## Issues, most damaging first

### 1. [HIGH] Tiny buttons are hard to tap on mobile
Affects: mobile only
Category: Accessibility (WCAG), Conversion
Why it matters: 16 of 25 tappable items on this page (64%) measure under 24 pixels on their shorter side, below the 24px floor WCAG 2.5.8 sets for accessibility and well under the platform minimums (Apple recommends 44pt, Android 48dp) for reliable tapping, and the same ones came up small on every test load. When visitors can't hit what they expect to, they get frustrated and many of them leave instead of trying again.
Exact elements found: a 308x20 "hello@contractive.app", a 38x18 "About", a 57x18 "Products", a 51x18 "Contact", a 91x18 "Local Analysis", a 78x18 "Risk Review", a 113x18 "Clause Extraction", a 99x18 "Private Legal AI"

### 2. [HIGH] A floating widget is covering a clickable element
Category: Conversion, Accessibility (WCAG)
Why it matters: A clickable element is sitting underneath a fixed overlay (nav.container over a "Products"), so a visitor who tries to tap it hits the widget on top instead. The element is there and looks fine in a preview, it just can't be reached. Move the floating widget to a clear corner, lower its z-index, or add spacing so it never overlaps your links and buttons.
Exact elements found: a "Products" under nav.container

### 3. [HIGH] Add quotations so AI engines cite this page
Category: AI Search, SEO
Why it matters: Generative engines (ChatGPT, Perplexity, AI Overviews) lift sourced, attributed quotes almost verbatim, and quotations are the single strongest citation lever (studies measure roughly +41%). Add 1-2 attributed expert quotes or blockquotes to the pages below. (Found across a sample of 8 pages from your sitemap, a partial crawl rather than your full site.)

### 4. [HIGH] Broken internal links
Category: SEO, Conversion
Why it matters: 1 internal link target returned an error (404/410/5xx) or did not respond. Broken links waste crawl budget, frustrate visitors, and leak ranking signal. (Found across a sample of 8 pages from your sitemap, a partial crawl rather than your full site.)
Exact examples found: https://www.contractive.app/cdn-cgi/l/email-protection (404)

### 5. [MEDIUM] 1 form field has no label
Category: Accessibility (WCAG), Conversion, Tracking
Why it matters: Screen readers can't announce these fields, and a sighted user who clears the placeholder can't recover the prompt. Wrap each input in <label>…</label> or add aria-label.
Exact elements found: name="website" (input)

### 6. [MEDIUM] 1 input uses the wrong type attribute
Category: Conversion
Why it matters: Mobile keyboards adapt to the input type (email shows @ key, tel shows numeric pad). Generic type="text" gets a generic keyboard and visitors mis-type. Switch to the correct type, or add a matching inputmode attribute if the native validation is too strict for what people type (bare domains in a URL field, for example).
Exact elements found: name="website" → use type="url"

### 7. [MEDIUM] Security headers are missing or weak
Category: Security
Why it matters: The server response is missing browser-hardening headers that protect visitors and are a standard security and agency checklist item. Missing or weak here: Content-Security-Policy (the main defense against injected and cross-site scripts); clickjacking protection (X-Frame-Options or a CSP frame-ancestors rule); a stronger HSTS policy (max-age at least 180 days plus includeSubDomains); X-Content-Type-Options: nosniff (stops MIME-type sniffing attacks). These are set at the server, CDN, or host level (most platforms expose them in settings or a config file) and do not change how the site looks or performs.

### 8. [LOW] Images have no width or height set (layout is stable for now)
Category: Performance, SEO
Why it matters: 6 of 7 images don't declare width and height. Your layout currently stays stable (measured Cumulative Layout Shift is 0, which is fine), most likely because space is reserved another way (CSS), so this is not causing visible jumps today. It is still worth setting explicit dimensions or a CSS aspect-ratio so a slow connection or a future style change cannot reintroduce shift.
Exact elements found: workflow1.png "Workflow step 1 UI scree", workflow2.png "Workflow step 2 UI scree", workflow3.png "Workflow step 3 UI scree", workflow4.png "Workflow step 4 UI scree", core-banner.png "Contractive Core local c", agents-banner.png "Contractive Agents workf"

### 9. [LOW] Unused JavaScript is being downloaded
Category: Performance
Why it matters: Code that never runs on this page still costs download and parse time on every visit. Splitting or removing it speeds up load. Lighthouse measured: Est savings of 139 KiB.

### 10. [LOW] No advertising pixel detected
Category: Tracking
Why it matters: Analytics is present but no Meta/Google/TikTok ad pixel was found. If you run paid ads, conversion tracking should be installed before the next campaign so the platforms can optimize toward buyers, not clicks.

### 11. [LOW] No llms.txt file
Category: SEO
Why it matters: No /llms.txt. Optional: some AI tools read this file (Anthropic, Vercel, Stripe, Cloudflare and Hugging Face publish one, and AI coding assistants use it to find docs), so adding one is a cheap courtesy to them. Google has said in writing that Google Search and its AI features do not use llms.txt, so do not expect a search-ranking or AI Overviews benefit from it.

## How to respond
Work through the issues in order. For each one give me the specific change that fixes it: real code or real copy, not advice. Keep changes minimal and match the existing style of the site.
Where several issues share one root cause, say so and fix it once rather than patching each symptom.
If an issue cannot be fixed without seeing more of the code, say exactly which file or selector you need instead of guessing.

{
  "generated_by": "Harvv",
  "report_url": "https://contractive.app",
  "generated_at": "2026-08-30T03:41:29.830Z",
  "evidence_base": {
    "mobile_loads": 4,
    "desktop_loads": 2,
    "field_data": false,
    "lighthouse": true
  },
  "performance": {
    "mobile_lcp_ms": 230,
    "desktop_lcp_ms": 184,
    "mobile_ttfb_ms": 110,
    "mobile_fcp_ms": 230,
    "page_weight_kb": 59
  },
  "finding_count": 11,
  "findings": [
    {
      "severity": "high",
      "title": "Tiny buttons are hard to tap on mobile",
      "detail": "16 of 25 tappable items on this page (64%) measure under 24 pixels on their shorter side, below the 24px floor WCAG 2.5.8 sets for accessibility and well under the platform minimums (Apple recommends 44pt, Android 48dp) for reliable tapping, and the same ones came up small on every test load. When visitors can't hit what they expect to, they get frustrated and many of them leave instead of trying again.",
      "device": "mobile",
      "tags": [
        "Accessibility (WCAG)",
        "Conversion"
      ],
      "topic": "tap_targets",
      "confidence": "measured",
      "evidence": [
        "a 308x20 \"hello@contractive.app\"",
        "a 38x18 \"About\"",
        "a 57x18 \"Products\"",
        "a 51x18 \"Contact\"",
        "a 91x18 \"Local Analysis\"",
        "a 78x18 \"Risk Review\"",
        "a 113x18 \"Clause Extraction\"",
        "a 99x18 \"Private Legal AI\""
      ]
    },
    {
      "severity": "high",
      "title": "A floating widget is covering a clickable element",
      "detail": "A clickable element is sitting underneath a fixed overlay (nav.container over a \"Products\"), so a visitor who tries to tap it hits the widget on top instead. The element is there and looks fine in a preview, it just can't be reached. Move the floating widget to a clear corner, lower its z-index, or add spacing so it never overlaps your links and buttons.",
      "device": "both",
      "tags": [
        "Conversion",
        "Accessibility (WCAG)"
      ],
      "topic": "obscured_control",
      "confidence": "measured",
      "evidence": [
        "a \"Products\" under nav.container"
      ]
    },
    {
      "severity": "high",
      "title": "Add quotations so AI engines cite this page",
      "detail": "Generative engines (ChatGPT, Perplexity, AI Overviews) lift sourced, attributed quotes almost verbatim, and quotations are the single strongest citation lever (studies measure roughly +41%). Add 1-2 attributed expert quotes or blockquotes to the pages below. (Found across a sample of 8 pages from your sitemap, a partial crawl rather than your full site.)",
      "device": "both",
      "tags": [
        "AI Search",
        "SEO"
      ],
      "topic": "geo",
      "confidence": "measured",
      "evidence": []
    },
    {
      "severity": "high",
      "title": "Broken internal links",
      "detail": "1 internal link target returned an error (404/410/5xx) or did not respond. Broken links waste crawl budget, frustrate visitors, and leak ranking signal. (Found across a sample of 8 pages from your sitemap, a partial crawl rather than your full site.)",
      "device": "both",
      "tags": [
        "SEO",
        "Conversion"
      ],
      "topic": "broken_internal_links",
      "confidence": "measured",
      "evidence": [
        "https://www.contractive.app/cdn-cgi/l/email-protection (404)"
      ]
    },
    {
      "severity": "medium",
      "title": "1 form field has no label",
      "detail": "Screen readers can't announce these fields, and a sighted user who clears the placeholder can't recover the prompt. Wrap each input in <label>…</label> or add aria-label.",
      "device": "both",
      "tags": [
        "Accessibility (WCAG)",
        "Conversion",
        "Tracking"
      ],
      "topic": "form_labels",
      "confidence": "measured",
      "evidence": [
        "name=\"website\" (input)"
      ]
    },
    {
      "severity": "medium",
      "title": "1 input uses the wrong type attribute",
      "detail": "Mobile keyboards adapt to the input type (email shows @ key, tel shows numeric pad). Generic type=\"text\" gets a generic keyboard and visitors mis-type. Switch to the correct type, or add a matching inputmode attribute if the native validation is too strict for what people type (bare domains in a URL field, for example).",
      "device": "both",
      "tags": [
        "Conversion"
      ],
      "topic": "form_input_type",
      "confidence": "measured",
      "evidence": [
        "name=\"website\" → use type=\"url\""
      ]
    },
    {
      "severity": "medium",
      "title": "Security headers are missing or weak",
      "detail": "The server response is missing browser-hardening headers that protect visitors and are a standard security and agency checklist item. Missing or weak here: Content-Security-Policy (the main defense against injected and cross-site scripts); clickjacking protection (X-Frame-Options or a CSP frame-ancestors rule); a stronger HSTS policy (max-age at least 180 days plus includeSubDomains); X-Content-Type-Options: nosniff (stops MIME-type sniffing attacks). These are set at the server, CDN, or host level (most platforms expose them in settings or a config file) and do not change how the site looks or performs.",
      "device": "both",
      "tags": [
        "Security"
      ],
      "topic": "security_headers",
      "confidence": "measured",
      "evidence": []
    },
    {
      "severity": "low",
      "title": "Images have no width or height set (layout is stable for now)",
      "detail": "6 of 7 images don't declare width and height. Your layout currently stays stable (measured Cumulative Layout Shift is 0, which is fine), most likely because space is reserved another way (CSS), so this is not causing visible jumps today. It is still worth setting explicit dimensions or a CSS aspect-ratio so a slow connection or a future style change cannot reintroduce shift.",
      "device": "both",
      "tags": [
        "Performance",
        "SEO"
      ],
      "topic": "image_dims",
      "confidence": "measured",
      "evidence": [
        "workflow1.png \"Workflow step 1 UI scree\"",
        "workflow2.png \"Workflow step 2 UI scree\"",
        "workflow3.png \"Workflow step 3 UI scree\"",
        "workflow4.png \"Workflow step 4 UI scree\"",
        "core-banner.png \"Contractive Core local c\"",
        "agents-banner.png \"Contractive Agents workf\""
      ]
    },
    {
      "severity": "low",
      "title": "Unused JavaScript is being downloaded",
      "detail": "Code that never runs on this page still costs download and parse time on every visit. Splitting or removing it speeds up load. Lighthouse measured: Est savings of 139 KiB.",
      "device": "both",
      "tags": [
        "Performance"
      ],
      "topic": "unused_js",
      "confidence": "measured",
      "evidence": []
    },
    {
      "severity": "low",
      "title": "No advertising pixel detected",
      "detail": "Analytics is present but no Meta/Google/TikTok ad pixel was found. If you run paid ads, conversion tracking should be installed before the next campaign so the platforms can optimize toward buyers, not clicks.",
      "device": "both",
      "tags": [
        "Tracking"
      ],
      "topic": "no_ad_pixel",
      "confidence": "measured",
      "evidence": []
    },
    {
      "severity": "low",
      "title": "No llms.txt file",
      "detail": "No /llms.txt. Optional: some AI tools read this file (Anthropic, Vercel, Stripe, Cloudflare and Hugging Face publish one, and AI coding assistants use it to find docs), so adding one is a cheap courtesy to them. Google has said in writing that Google Search and its AI features do not use llms.txt, so do not expect a search-ranking or AI Overviews benefit from it.",
      "device": "both",
      "tags": [
        "SEO"
      ],
      "topic": "missing_llms_txt",
      "confidence": "measured",
      "evidence": []
    }
  ]
}