What your site is actually doing.

Audit of https://ifadvisory.org/, run September 1, 2026. 8 issues were found. I want them fixed.

## Context
- Site: https://ifadvisory.org/
- Mobile LCP (lab median): 724 ms
- Desktop LCP (lab median): 690 ms
- Page weight (median): 0.5 MB
- Tap targets under 44px: 36% (26 of 72)
- Evidence base: 4 mobile + 2 desktop loads

## Already working, do not change these
- Speed is good: The main content paints in about 0.7s in our test loads, inside Google's 2.5s "good" threshold. Real networks are slower, but the page itself is not heavy.
- Light page weight: The page is about 0.5 MB across 77 requests. That keeps it quick on mobile data and cheap to load repeatedly.
- No JavaScript errors on load: Nothing threw a script error across the test loads, so buttons and tracking are not silently breaking mid-session.
- Layout holds on phone and desktop: Nothing spilled past the edge at either 390px (phone) or 1366px (desktop), so the structure is responsive.

## Issues, most damaging first

### 1. [HIGH] Add statistics / fact density for AI citations
Category: AI Search, SEO
Why it matters: AI answers prefer concrete numbers over vague claims; pages with a statistic every ~150-200 words are cited markedly more (~+32%). These pages are statistic-thin. Back claims with figures (%, counts, $, multipliers). (Found across a sample of 8 pages from your sitemap, a partial crawl rather than your full site.)

### 2. [MEDIUM] Tiny buttons are hard to tap on mobile
Affects: mobile only
Category: Accessibility (WCAG), Conversion
Why it matters: 26 of 72 tappable items on this page (36%) measure under 24 pixels on their shorter side, below the 24px floor WCAG 2.5.8 sets for accessibility and well under the platform minimums (Apple recommends 44pt, Android 48dp) for reliable tapping, and the same ones came up small on every test load. When visitors can't hit what they expect to, they get frustrated and many of them leave instead of trying again.
Exact elements found: a 271x21 "ORGANISATIONS WE'VE WORKED W", a 184x18 "Read about our approach →", a 18x18 "Instagram", a 18x18 "LinkedIn", a 18x18 "YouTube", a 18x18 "WhatsApp channel", a 136x18 "Shari'ah Consultancy", a 122x18 "Dispute Resolution"

### 3. [LOW] Images have no width or height set (layout is stable for now)
Category: Performance, SEO
Why it matters: 76 of 76 images don't declare width and height. Your layout currently stays stable (measured Cumulative Layout Shift is 0, which is fine), most likely because space is reserved another way (CSS), so this is not causing visible jumps today. It is still worth setting explicit dimensions or a CSS aspect-ratio so a slow connection or a future style change cannot reintroduce shift.
Exact elements found: ifa-logo-colour.svg "IFA — Islamic Finance Ad", wahed.svg "Wahed", pfida.webp "Pfida", wayhome.webp "Wayhome", your-home.webp "Your Home", client-blue.svg "Bayuti"

### 4. [LOW] No email capture or newsletter detected
Category: Conversion
Why it matters: No email input field was found in the page, and no email-marketing tag (Klaviyo, Mailchimp, Substack, ConvertKit, Beehiiv, MailerLite, ActiveCampaign, Omnisend, Brevo, Drip or Buttondown) was detected. A form that loads after JavaScript runs, or one behind a popup or a separate page, will not be visible to this check. If capturing visitors is relevant to this site, an email signup builds an owned audience you keep regardless of ad costs. Not every site needs one.

### 5. [LOW] No third-party analytics tag detected
Category: Tracking
Why it matters: No Google Analytics, GA4, or other third-party analytics tag was found in the page. If you rely only on platform or server-side analytics that is fine; but if not, a third-party tag is the baseline way to see how many visitors arrive, where they come from, and what converts. First-party or server-side analytics are not detectable from the outside, so this may already be handled.

### 6. [LOW] 1 potential dead-click target
Category: Conversion, Accessibility (WCAG), Tracking
Why it matters: Elements styled like buttons but with no anchor, no <button> wrapper, no role="button", and no click attribute. Real visitors tap these expecting something to happen, then leave. Examples on this page: "Cohort 2 · Applications open October 202" (div.EduPromo-module__Otrzdq__pill).
Exact elements found: "Cohort 2 · Applications open October 2026" (div.EduPromo-module__Otrzdq__pill)

### 7. [LOW] No llms.txt file
Category: SEO
Why it matters: No /llms.txt. Optional: some AI tools read this file (Anthropic, Vercel, Stripe, Cloudflare and Hugging Face publish one, and AI coding assistants use it to find docs), so adding one is a cheap courtesy to them. Google has said in writing that Google Search and its AI features do not use llms.txt, so do not expect a search-ranking or AI Overviews benefit from it.

### 8. [LOW] Security headers are missing or weak
Category: Security
Why it matters: The server response is missing browser-hardening headers that protect visitors and are a standard security and agency checklist item. Missing or weak here: Content-Security-Policy (the main defense against injected and cross-site scripts). These are set at the server, CDN, or host level (most platforms expose them in settings or a config file) and do not change how the site looks or performs.

## How to respond
Work through the issues in order. For each one give me the specific change that fixes it: real code or real copy, not advice. Keep changes minimal and match the existing style of the site.
Where several issues share one root cause, say so and fix it once rather than patching each symptom.
If an issue cannot be fixed without seeing more of the code, say exactly which file or selector you need instead of guessing.

{
  "generated_by": "Harvv",
  "report_url": "https://ifadvisory.org/",
  "generated_at": "2026-09-01T03:43:12.892Z",
  "evidence_base": {
    "mobile_loads": 4,
    "desktop_loads": 2,
    "field_data": false,
    "lighthouse": false
  },
  "performance": {
    "mobile_lcp_ms": 724,
    "desktop_lcp_ms": 690,
    "mobile_ttfb_ms": 47,
    "mobile_fcp_ms": 724,
    "page_weight_kb": 518
  },
  "finding_count": 8,
  "findings": [
    {
      "severity": "high",
      "title": "Add statistics / fact density for AI citations",
      "detail": "AI answers prefer concrete numbers over vague claims; pages with a statistic every ~150-200 words are cited markedly more (~+32%). These pages are statistic-thin. Back claims with figures (%, counts, $, multipliers). (Found across a sample of 8 pages from your sitemap, a partial crawl rather than your full site.)",
      "device": "both",
      "tags": [
        "AI Search",
        "SEO"
      ],
      "topic": "geo",
      "confidence": "measured",
      "evidence": []
    },
    {
      "severity": "medium",
      "title": "Tiny buttons are hard to tap on mobile",
      "detail": "26 of 72 tappable items on this page (36%) measure under 24 pixels on their shorter side, below the 24px floor WCAG 2.5.8 sets for accessibility and well under the platform minimums (Apple recommends 44pt, Android 48dp) for reliable tapping, and the same ones came up small on every test load. When visitors can't hit what they expect to, they get frustrated and many of them leave instead of trying again.",
      "device": "mobile",
      "tags": [
        "Accessibility (WCAG)",
        "Conversion"
      ],
      "topic": "tap_targets",
      "confidence": "measured",
      "evidence": [
        "a 271x21 \"ORGANISATIONS WE'VE WORKED W\"",
        "a 184x18 \"Read about our approach →\"",
        "a 18x18 \"Instagram\"",
        "a 18x18 \"LinkedIn\"",
        "a 18x18 \"YouTube\"",
        "a 18x18 \"WhatsApp channel\"",
        "a 136x18 \"Shari'ah Consultancy\"",
        "a 122x18 \"Dispute Resolution\""
      ]
    },
    {
      "severity": "low",
      "title": "Images have no width or height set (layout is stable for now)",
      "detail": "76 of 76 images don't declare width and height. Your layout currently stays stable (measured Cumulative Layout Shift is 0, which is fine), most likely because space is reserved another way (CSS), so this is not causing visible jumps today. It is still worth setting explicit dimensions or a CSS aspect-ratio so a slow connection or a future style change cannot reintroduce shift.",
      "device": "both",
      "tags": [
        "Performance",
        "SEO"
      ],
      "topic": "image_dims",
      "confidence": "measured",
      "evidence": [
        "ifa-logo-colour.svg \"IFA — Islamic Finance Ad\"",
        "wahed.svg \"Wahed\"",
        "pfida.webp \"Pfida\"",
        "wayhome.webp \"Wayhome\"",
        "your-home.webp \"Your Home\"",
        "client-blue.svg \"Bayuti\""
      ]
    },
    {
      "severity": "low",
      "title": "No email capture or newsletter detected",
      "detail": "No email input field was found in the page, and no email-marketing tag (Klaviyo, Mailchimp, Substack, ConvertKit, Beehiiv, MailerLite, ActiveCampaign, Omnisend, Brevo, Drip or Buttondown) was detected. A form that loads after JavaScript runs, or one behind a popup or a separate page, will not be visible to this check. If capturing visitors is relevant to this site, an email signup builds an owned audience you keep regardless of ad costs. Not every site needs one.",
      "device": "both",
      "tags": [
        "Conversion"
      ],
      "topic": "no_email_capture",
      "confidence": "measured",
      "evidence": []
    },
    {
      "severity": "low",
      "title": "No third-party analytics tag detected",
      "detail": "No Google Analytics, GA4, or other third-party analytics tag was found in the page. If you rely only on platform or server-side analytics that is fine; but if not, a third-party tag is the baseline way to see how many visitors arrive, where they come from, and what converts. First-party or server-side analytics are not detectable from the outside, so this may already be handled.",
      "device": "both",
      "tags": [
        "Tracking"
      ],
      "topic": "no_analytics",
      "confidence": "measured",
      "evidence": []
    },
    {
      "severity": "low",
      "title": "1 potential dead-click target",
      "detail": "Elements styled like buttons but with no anchor, no <button> wrapper, no role=\"button\", and no click attribute. Real visitors tap these expecting something to happen, then leave. Examples on this page: \"Cohort 2 · Applications open October 202\" (div.EduPromo-module__Otrzdq__pill).",
      "device": "both",
      "tags": [
        "Conversion",
        "Accessibility (WCAG)",
        "Tracking"
      ],
      "topic": "dead_clicks",
      "confidence": "measured",
      "evidence": [
        "\"Cohort 2 · Applications open October 2026\" (div.EduPromo-module__Otrzdq__pill)"
      ]
    },
    {
      "severity": "low",
      "title": "No llms.txt file",
      "detail": "No /llms.txt. Optional: some AI tools read this file (Anthropic, Vercel, Stripe, Cloudflare and Hugging Face publish one, and AI coding assistants use it to find docs), so adding one is a cheap courtesy to them. Google has said in writing that Google Search and its AI features do not use llms.txt, so do not expect a search-ranking or AI Overviews benefit from it.",
      "device": "both",
      "tags": [
        "SEO"
      ],
      "topic": "missing_llms_txt",
      "confidence": "measured",
      "evidence": []
    },
    {
      "severity": "low",
      "title": "Security headers are missing or weak",
      "detail": "The server response is missing browser-hardening headers that protect visitors and are a standard security and agency checklist item. Missing or weak here: Content-Security-Policy (the main defense against injected and cross-site scripts). These are set at the server, CDN, or host level (most platforms expose them in settings or a config file) and do not change how the site looks or performs.",
      "device": "both",
      "tags": [
        "Security"
      ],
      "topic": "security_headers",
      "confidence": "measured",
      "evidence": []
    }
  ]
}