What your site is actually doing.

Audit of https://nowkickback.com/, run September 2, 2026. 16 issues were found. I want them fixed.

## Context
- Site: https://nowkickback.com/
- Mobile LCP (lab median): 326 ms
- Desktop LCP (lab median): 454 ms
- Page weight (median): 1.3 MB
- Tap targets under 44px: 0% (0 of 33)
- Evidence base: 4 mobile + 2 desktop loads

## Already working, do not change these
- Speed is good: The main content paints in about 0.3s in our test loads, inside Google's 2.5s "good" threshold. Real networks are slower, but the page itself is not heavy.
- Light page weight: The page is about 1.3 MB across 132 requests. That keeps it quick on mobile data and cheap to load repeatedly.
- No JavaScript errors on load: Nothing threw a script error across the test loads, so buttons and tracking are not silently breaking mid-session.
- Search basics are in place: Lighthouse scores SEO 100/100. The fundamentals Google looks for are present.
- Layout holds on phone and desktop: Nothing spilled past the edge at either 390px (phone) or 1366px (desktop), so the structure is responsive.

## Issues, most damaging first

### 1. [HIGH] Add quotations so AI engines cite this page
Category: AI Search, SEO
Why it matters: Generative engines (ChatGPT, Perplexity, AI Overviews) lift sourced, attributed quotes almost verbatim, and quotations are the single strongest citation lever (studies measure roughly +41%). Add 1-2 attributed expert quotes or blockquotes to the pages below. (Found across a sample of 1 pages from your sitemap, a partial crawl rather than your full site.)

### 2. [HIGH] Some text is low-contrast and hard to read
Category: Accessibility (WCAG)
Why it matters: Text that does not stand out enough from its background is hard to read for many visitors, and fails accessibility guidelines Google checks.

### 3. [MEDIUM] No XML sitemap found
Why it matters: No sitemap.xml at the standard location and none listed in robots.txt. A sitemap tells search engines every page you want indexed; without it they rely on link discovery and may miss pages.

### 4. [MEDIUM] Security headers are missing or weak
Category: Security
Why it matters: The server response is missing browser-hardening headers that protect visitors and are a standard security and agency checklist item. Missing or weak here: Content-Security-Policy (the main defense against injected and cross-site scripts); clickjacking protection (X-Frame-Options or a CSP frame-ancestors rule); HSTS (Strict-Transport-Security, which forces HTTPS on return visits); X-Content-Type-Options: nosniff (stops MIME-type sniffing attacks). These are set at the server, CDN, or host level (most platforms expose them in settings or a config file) and do not change how the site looks or performs.

### 5. [LOW] Unused JavaScript is being downloaded
Category: Performance
Why it matters: Code that never runs on this page still costs download and parse time on every visit. Splitting or removing it speeds up load. Lighthouse measured: Est savings of 493 KiB.

### 6. [LOW] Unused CSS is being downloaded
Category: Performance
Why it matters: Style rules that this page never uses still block rendering while they download. Trimming them frees the paint path. Lighthouse measured: Est savings of 40 KiB.

### 7. [LOW] No email capture or newsletter detected
Category: Conversion
Why it matters: No email input field was found in the page, and no email-marketing tag (Klaviyo, Mailchimp, Substack, ConvertKit, Beehiiv, MailerLite, ActiveCampaign, Omnisend, Brevo, Drip or Buttondown) was detected. A form that loads after JavaScript runs, or one behind a popup or a separate page, will not be visible to this check. If capturing visitors is relevant to this site, an email signup builds an owned audience you keep regardless of ad costs. Not every site needs one.

### 8. [LOW] No visible contact details (email or phone)
Category: Conversion
Why it matters: This page exposes no email address, no phone link, no contact form and no link to a contact page. For higher-value or trust-sensitive purchases, a clear way to reach a human reduces hesitation. A contact route that only appears after JavaScript runs, or that lives on a page not checked here, will not be visible to this check. Add an email or phone link in the header or footer.

### 9. [LOW] No advertising pixel detected
Category: Tracking
Why it matters: Analytics is present but no Meta/Google/TikTok ad pixel was found. If you run paid ads, conversion tracking should be installed before the next campaign so the platforms can optimize toward buyers, not clicks.

### 10. [LOW] No canonical tag, so duplicate URLs split the page's ranking
Why it matters: When the same content is reachable at multiple URLs (think tracking parameters or session IDs), Google can split your ranking signal across them. A single canonical tag tells Google which version counts.

### 11. [LOW] Links to this page will look bare when shared
Why it matters: The page is missing its Open Graph image, so when someone shares it on Facebook, LinkedIn, iMessage, or Slack the preview has no image. A flat grey link gets far fewer clicks than one with an image and headline.

### 12. [LOW] No structured data for rich search results
Why it matters: The page has no schema.org markup. Adding the right type (Product, Article, Organization, FAQ) lets Google show rich results like star ratings and prices, which lift click-through for free.

### 13. [LOW] 2 potential dead-click targets
Category: Conversion, Accessibility (WCAG), Tracking
Why it matters: Elements styled like buttons but with no anchor, no <button> wrapper, no role="button", and no click attribute. Real visitors tap these expecting something to happen, then leave. Examples on this page: "DRAFTED IN YOUR VOICE" (div.kb-deck-tag), "DRAFTED IN YOUR VOICE" (div.kb-deck-tag).
Exact elements found: "DRAFTED IN YOUR VOICE" (div.kb-deck-tag), "DRAFTED IN YOUR VOICE" (div.kb-deck-tag)

### 14. [LOW] No llms.txt file
Category: SEO
Why it matters: No /llms.txt. Optional: some AI tools read this file (Anthropic, Vercel, Stripe, Cloudflare and Hugging Face publish one, and AI coding assistants use it to find docs), so adding one is a cheap courtesy to them. Google has said in writing that Google Search and its AI features do not use llms.txt, so do not expect a search-ranking or AI Overviews benefit from it.

### 15. [LOW] 3 interactive elements have no stable, accessible identity
Category: Accessibility (WCAG), Tracking
Why it matters: These elements are clicked like buttons but expose no accessible name, or are a plain div/span used as a control with no role. Assistive tech announces only a role (or nothing), and analytics and heatmaps have no human-readable label or stable selector to bind the click to, so the click is both inaccessible and untrackable, and any redesign silently breaks click aggregation. Give each one a real <button>/<a>, an aria-label, and a stable id or data-attribute.
Exact elements found: (span.kb-h1-chat-pill) (no accessible name), "DRAFTED IN YOUR VOICE" (div.kb-deck-tag) (div/span used as a button, no role), "DRAFTED IN YOUR VOICE" (div.kb-deck-tag) (div/span used as a button, no role)

### 16. [LOW] Some text is too small to read on phones
Affects: mobile only
Category: Accessibility (WCAG), Conversion
Why it matters: 43 chunks of text come in under 12 pixels on this page. Most visitors don't zoom, they just skim past anything that small. Bumping the smallest body text to 14 pixels makes the page read without effort.
How we know: median across loads

## How to respond
Work through the issues in order. For each one give me the specific change that fixes it: real code or real copy, not advice. Keep changes minimal and match the existing style of the site.
Where several issues share one root cause, say so and fix it once rather than patching each symptom.
If an issue cannot be fixed without seeing more of the code, say exactly which file or selector you need instead of guessing.

{
  "generated_by": "Harvv",
  "report_url": "https://nowkickback.com/",
  "generated_at": "2026-09-02T03:41:30.082Z",
  "evidence_base": {
    "mobile_loads": 4,
    "desktop_loads": 2,
    "field_data": false,
    "lighthouse": true
  },
  "performance": {
    "mobile_lcp_ms": 326,
    "desktop_lcp_ms": 454,
    "mobile_ttfb_ms": 41,
    "mobile_fcp_ms": 326,
    "page_weight_kb": 1358
  },
  "finding_count": 16,
  "findings": [
    {
      "severity": "high",
      "title": "Add quotations so AI engines cite this page",
      "detail": "Generative engines (ChatGPT, Perplexity, AI Overviews) lift sourced, attributed quotes almost verbatim, and quotations are the single strongest citation lever (studies measure roughly +41%). Add 1-2 attributed expert quotes or blockquotes to the pages below. (Found across a sample of 1 pages from your sitemap, a partial crawl rather than your full site.)",
      "device": "both",
      "tags": [
        "AI Search",
        "SEO"
      ],
      "topic": "geo",
      "confidence": "measured",
      "evidence": []
    },
    {
      "severity": "high",
      "title": "Some text is low-contrast and hard to read",
      "detail": "Text that does not stand out enough from its background is hard to read for many visitors, and fails accessibility guidelines Google checks.",
      "device": "both",
      "tags": [
        "Accessibility (WCAG)"
      ],
      "topic": "contrast",
      "confidence": "measured",
      "evidence": []
    },
    {
      "severity": "medium",
      "title": "No XML sitemap found",
      "detail": "No sitemap.xml at the standard location and none listed in robots.txt. A sitemap tells search engines every page you want indexed; without it they rely on link discovery and may miss pages.",
      "device": "both",
      "tags": [],
      "topic": "missing_sitemap",
      "confidence": "measured",
      "evidence": []
    },
    {
      "severity": "medium",
      "title": "Security headers are missing or weak",
      "detail": "The server response is missing browser-hardening headers that protect visitors and are a standard security and agency checklist item. Missing or weak here: Content-Security-Policy (the main defense against injected and cross-site scripts); clickjacking protection (X-Frame-Options or a CSP frame-ancestors rule); HSTS (Strict-Transport-Security, which forces HTTPS on return visits); X-Content-Type-Options: nosniff (stops MIME-type sniffing attacks). These are set at the server, CDN, or host level (most platforms expose them in settings or a config file) and do not change how the site looks or performs.",
      "device": "both",
      "tags": [
        "Security"
      ],
      "topic": "security_headers",
      "confidence": "measured",
      "evidence": []
    },
    {
      "severity": "low",
      "title": "Unused JavaScript is being downloaded",
      "detail": "Code that never runs on this page still costs download and parse time on every visit. Splitting or removing it speeds up load. Lighthouse measured: Est savings of 493 KiB.",
      "device": "both",
      "tags": [
        "Performance"
      ],
      "topic": "unused_js",
      "confidence": "measured",
      "evidence": []
    },
    {
      "severity": "low",
      "title": "Unused CSS is being downloaded",
      "detail": "Style rules that this page never uses still block rendering while they download. Trimming them frees the paint path. Lighthouse measured: Est savings of 40 KiB.",
      "device": "both",
      "tags": [
        "Performance"
      ],
      "topic": "unused_css",
      "confidence": "measured",
      "evidence": []
    },
    {
      "severity": "low",
      "title": "No email capture or newsletter detected",
      "detail": "No email input field was found in the page, and no email-marketing tag (Klaviyo, Mailchimp, Substack, ConvertKit, Beehiiv, MailerLite, ActiveCampaign, Omnisend, Brevo, Drip or Buttondown) was detected. A form that loads after JavaScript runs, or one behind a popup or a separate page, will not be visible to this check. If capturing visitors is relevant to this site, an email signup builds an owned audience you keep regardless of ad costs. Not every site needs one.",
      "device": "both",
      "tags": [
        "Conversion"
      ],
      "topic": "no_email_capture",
      "confidence": "measured",
      "evidence": []
    },
    {
      "severity": "low",
      "title": "No visible contact details (email or phone)",
      "detail": "This page exposes no email address, no phone link, no contact form and no link to a contact page. For higher-value or trust-sensitive purchases, a clear way to reach a human reduces hesitation. A contact route that only appears after JavaScript runs, or that lives on a page not checked here, will not be visible to this check. Add an email or phone link in the header or footer.",
      "device": "both",
      "tags": [
        "Conversion"
      ],
      "topic": "no_contact",
      "confidence": "measured",
      "evidence": []
    },
    {
      "severity": "low",
      "title": "No advertising pixel detected",
      "detail": "Analytics is present but no Meta/Google/TikTok ad pixel was found. If you run paid ads, conversion tracking should be installed before the next campaign so the platforms can optimize toward buyers, not clicks.",
      "device": "both",
      "tags": [
        "Tracking"
      ],
      "topic": "no_ad_pixel",
      "confidence": "measured",
      "evidence": []
    },
    {
      "severity": "low",
      "title": "No canonical tag, so duplicate URLs split the page's ranking",
      "detail": "When the same content is reachable at multiple URLs (think tracking parameters or session IDs), Google can split your ranking signal across them. A single canonical tag tells Google which version counts.",
      "device": "both",
      "tags": [],
      "topic": "canonical",
      "confidence": "measured",
      "evidence": []
    },
    {
      "severity": "low",
      "title": "Links to this page will look bare when shared",
      "detail": "The page is missing its Open Graph image, so when someone shares it on Facebook, LinkedIn, iMessage, or Slack the preview has no image. A flat grey link gets far fewer clicks than one with an image and headline.",
      "device": "both",
      "tags": [],
      "topic": "og_tags",
      "confidence": "measured",
      "evidence": []
    },
    {
      "severity": "low",
      "title": "No structured data for rich search results",
      "detail": "The page has no schema.org markup. Adding the right type (Product, Article, Organization, FAQ) lets Google show rich results like star ratings and prices, which lift click-through for free.",
      "device": "both",
      "tags": [],
      "topic": "schema",
      "confidence": "measured",
      "evidence": []
    },
    {
      "severity": "low",
      "title": "2 potential dead-click targets",
      "detail": "Elements styled like buttons but with no anchor, no <button> wrapper, no role=\"button\", and no click attribute. Real visitors tap these expecting something to happen, then leave. Examples on this page: \"DRAFTED IN YOUR VOICE\" (div.kb-deck-tag), \"DRAFTED IN YOUR VOICE\" (div.kb-deck-tag).",
      "device": "both",
      "tags": [
        "Conversion",
        "Accessibility (WCAG)",
        "Tracking"
      ],
      "topic": "dead_clicks",
      "confidence": "measured",
      "evidence": [
        "\"DRAFTED IN YOUR VOICE\" (div.kb-deck-tag)",
        "\"DRAFTED IN YOUR VOICE\" (div.kb-deck-tag)"
      ]
    },
    {
      "severity": "low",
      "title": "No llms.txt file",
      "detail": "No /llms.txt. Optional: some AI tools read this file (Anthropic, Vercel, Stripe, Cloudflare and Hugging Face publish one, and AI coding assistants use it to find docs), so adding one is a cheap courtesy to them. Google has said in writing that Google Search and its AI features do not use llms.txt, so do not expect a search-ranking or AI Overviews benefit from it.",
      "device": "both",
      "tags": [
        "SEO"
      ],
      "topic": "missing_llms_txt",
      "confidence": "measured",
      "evidence": []
    },
    {
      "severity": "low",
      "title": "3 interactive elements have no stable, accessible identity",
      "detail": "These elements are clicked like buttons but expose no accessible name, or are a plain div/span used as a control with no role. Assistive tech announces only a role (or nothing), and analytics and heatmaps have no human-readable label or stable selector to bind the click to, so the click is both inaccessible and untrackable, and any redesign silently breaks click aggregation. Give each one a real <button>/<a>, an aria-label, and a stable id or data-attribute.",
      "device": "both",
      "tags": [
        "Accessibility (WCAG)",
        "Tracking"
      ],
      "topic": "untrackable_elements",
      "confidence": "measured",
      "evidence": [
        "(span.kb-h1-chat-pill) (no accessible name)",
        "\"DRAFTED IN YOUR VOICE\" (div.kb-deck-tag) (div/span used as a button, no role)",
        "\"DRAFTED IN YOUR VOICE\" (div.kb-deck-tag) (div/span used as a button, no role)"
      ]
    },
    {
      "severity": "low",
      "title": "Some text is too small to read on phones",
      "detail": "43 chunks of text come in under 12 pixels on this page. Most visitors don't zoom, they just skim past anything that small. Bumping the smallest body text to 14 pixels makes the page read without effort.",
      "device": "mobile",
      "tags": [
        "Accessibility (WCAG)",
        "Conversion"
      ],
      "topic": "tiny_text",
      "confidence": "sampled",
      "evidence": []
    }
  ]
}