What your site is actually doing.

Audit of https://trynina.co/, run September 28, 2026. 14 issues were found. I want them fixed.

## Context
- Site: https://trynina.co/
- Mobile LCP (lab median): 158 ms
- Desktop LCP (lab median): 156 ms
- Page weight (median): 2.2 MB
- Tap targets under 44px: 33% (13 of 40)
- Evidence base: 6 mobile + 3 desktop loads

## Already working, do not change these
- Speed is good: The main content paints in about 0.2s in our test loads, inside Google's 2.5s "good" threshold. Real networks are slower, but the page itself is not heavy.
- Search basics are in place: Lighthouse scores SEO 100/100. The fundamentals Google looks for are present.
- Layout holds on phone and desktop: Nothing spilled past the edge at either 390px (phone) or 1366px (desktop), so the structure is responsive.

## Issues, most damaging first

### 1. [HIGH] 19 form fields have no label
Category: Accessibility (WCAG), Conversion, Tracking
Why it matters: Screen readers can't announce these fields, and a sighted user who clears the placeholder can't recover the prompt. Wrap each input in <label>…</label> or add aria-label.
Exact elements found: name="firstname" (input) placeholder="Jordan", name="lastname" (input) placeholder="Reyes", name="company" (input) placeholder="Acme Co.", name="website" (input) placeholder="company.com", name="email" (input) placeholder="you@company.com"

### 2. [HIGH] Add quotations so AI engines cite this page
Category: AI Search, SEO
Why it matters: Generative engines (ChatGPT, Perplexity, AI Overviews) lift sourced, attributed quotes almost verbatim, and quotations are the single strongest citation lever (studies measure roughly +41%). Add 1-2 attributed expert quotes or blockquotes to the pages below. (Found across a sample of 8 pages from your sitemap, a partial crawl rather than your full site.)

### 3. [HIGH] Some buttons have no accessible name
Category: Accessibility (WCAG), Tracking
Why it matters: A button with only an icon and no label is announced as "button" by screen readers, giving no idea what it does.

### 4. [MEDIUM] Tiny buttons are hard to tap on mobile
Affects: mobile only
Category: Accessibility (WCAG), Conversion
Why it matters: 13 of 40 tappable items on this page (33%) measure under 24 pixels on their shorter side, below the 24px floor WCAG 2.5.8 sets for accessibility and well under the platform minimums (Apple recommends 44pt, Android 48dp) for reliable tapping, and the same ones came up small on every test load. When visitors can't hit what they expect to, they get frustrated and many of them leave instead of trying again.
Exact elements found (8 of 13): a 1x1 "Skip to content", button 11x11 "Slide 1", button 11x11 "Slide 2", button 11x11 "Slide 3", button 11x11 "Slide 4", button 11x11 (no visible label), button 11x11 (no visible label), button 11x11 (no visible label)

### 5. [MEDIUM] JavaScript crashed while the page was loading
Category: Conversion, Tracking
Why it matters: 1 script error fired during page load. When a script crashes, buttons sometimes stop working, analytics stop firing, and the visitor has no warning. Worth opening the browser console to find which script failed.
Exact elements found: gtag is not defined
How we know: median across loads

### 6. [MEDIUM] Page is heavy and slow on mobile data
Category: Performance
Why it matters: Each visit downloads about 2.2 MB, roughly 1109 KB of images and 704 KB of JavaScript across 88 separate downloads. On a fast connection that's fine. On a phone with patchy mobile data, that's several seconds of blank screen before the page is readable.
How we know: median across loads

### 7. [MEDIUM] Meta Pixel sends only PageView on this page
Category: Tracking
Why it matters: On this page the Meta Pixel sends only PageView. That is expected on a homepage, but check that a conversion event (a standard one like Lead, Schedule or Purchase, or a custom event) fires when a visitor actually converts, or that a custom conversion is set up in Events Manager. This scan loads pages and never submits a form or books a call, so it cannot see events that fire on those actions. If nothing fires there, Meta can optimise your ads for page views only.

### 8. [MEDIUM] 5 potential dead-click targets
Category: Conversion, Accessibility (WCAG), Tracking
Why it matters: At phone and desktop width, in our test browser, these elements are styled with a pointer cursor, the page's own mark for something clickable. They are not a link or a button, have no button or link role, no tabindex and no click attribute, and nothing on or around them opens a menu. A click handler attached by a script is not visible to this check, so click one to confirm it does something. Examples: "pricing" (span.ns-pill), "how-to" (span.ns-pill), "reviews" (span.ns-pill).
Exact elements found: "pricing" (span.ns-pill), "how-to" (span.ns-pill), "reviews" (span.ns-pill), "vs" (span.ns-pill), "best" (span.ns-pill)

### 9. [MEDIUM] 2 inputs use the wrong type attribute
Category: Conversion
Why it matters: Mobile keyboards adapt to the input type (email shows @ key, tel shows numeric pad). Generic type="text" gets a generic keyboard and visitors mis-type. Switch to the correct type, or add a matching inputmode attribute if the native validation is too strict for what people type (bare domains in a URL field, for example).
Exact elements found: name="website" → use type="url", name="agwebsite" → use type="url"

### 10. [MEDIUM] Security headers are missing or weak
Category: Security
Why it matters: The server response is missing browser-hardening headers that protect visitors and are a standard security and agency checklist item. Missing or weak here: Content-Security-Policy (the main defense against injected and cross-site scripts); clickjacking protection (X-Frame-Options or a CSP frame-ancestors rule); a stronger HSTS policy (max-age at least 180 days plus includeSubDomains); X-Content-Type-Options: nosniff (stops MIME-type sniffing attacks). These are set at the server, CDN, or host level (most platforms expose them in settings or a config file) and do not change how the site looks or performs.

### 11. [MEDIUM] 14 interactive elements have no stable, accessible identity
Category: Accessibility (WCAG), Tracking
Why it matters: These elements are clicked like buttons but expose no accessible name, or are a plain div/span used as a control with no role. Assistive tech announces only a role (or nothing), and analytics and heatmaps have no human-readable label or stable selector to bind the click to, so the click is both inaccessible and untrackable, and any redesign silently breaks click aggregation. Give each one a real <button>/<a>, an aria-label, and a stable id or data-attribute.
Exact elements found: "pricing" (span.ns-pill) (div/span used as a button, no role), "how-to" (span.ns-pill) (div/span used as a button, no role), "reviews" (span.ns-pill) (div/span used as a button, no role), "vs" (span.ns-pill) (div/span used as a button, no role), "best" (span.ns-pill) (div/span used as a button, no role), (button.hpd-car-dot) (no accessible name), (button.hpd-car-dot) (no accessible name), (button.hpd-car-dot) (no accessible name)

### 12. [LOW] Images have no width or height set (layout is stable for now)
Category: Performance, SEO
Why it matters: 17 of 25 images don't declare width and height. Your layout currently stays stable (measured Cumulative Layout Shift is 0, which is fine), most likely because space is reserved another way (CSS), so this is not causing visible jumps today. It is still worth setting explicit dimensions or a CSS aspect-ratio so a slow connection or a future style change cannot reintroduce shift.
Exact elements found (6 of 17): Blog-Typing-Effect.gif "Nina blog writing demo", Nina-Line-Chart-Icon.png "Traffic growth icon", TryNina-SEMrush-screenshot.png "SEMrush dashboard", Nina-Bar-Graph-Icon.png "Measurable improvements ", TryNina-Google-Search-Console-screenshot-grey.png "Google Search Console gr", Nina-Multi-Channel-Icon.png "Multi-channel icon"

### 13. [LOW] Unused JavaScript is being downloaded
Category: Performance
Why it matters: Code that never runs on this page still costs download and parse time on every visit. Splitting or removing it speeds up load. Lighthouse measured: Est savings of 140 KiB.

### 14. [LOW] The page loads from a lot of third-party services
Why it matters: Around 28 separate outside domains load on this page (analytics, ads, chat widgets, fonts). Each one is a connection that can be slow, fail, or change behavior outside your control.
How we know: median across loads

## How to respond
Work through the issues in order. For each one give me the specific change that fixes it: real code or real copy, not advice. Keep changes minimal and match the existing style of the site.
Where several issues share one root cause, say so and fix it once rather than patching each symptom.
If an issue cannot be fixed without seeing more of the code, say exactly which file or selector you need instead of guessing.

{
  "generated_by": "Harvv",
  "report_url": "https://trynina.co/",
  "generated_at": "2026-09-28T16:02:50.816Z",
  "evidence_base": {
    "mobile_loads": 6,
    "desktop_loads": 3,
    "field_data": false,
    "lighthouse": true
  },
  "performance": {
    "mobile_lcp_ms": 158,
    "desktop_lcp_ms": 156,
    "mobile_ttfb_ms": 8,
    "mobile_fcp_ms": 74,
    "page_weight_kb": 2280
  },
  "finding_count": 14,
  "findings": [
    {
      "severity": "high",
      "title": "19 form fields have no label",
      "detail": "Screen readers can't announce these fields, and a sighted user who clears the placeholder can't recover the prompt. Wrap each input in <label>…</label> or add aria-label.",
      "device": "both",
      "tags": [
        "Accessibility (WCAG)",
        "Conversion",
        "Tracking"
      ],
      "topic": "form_labels",
      "confidence": "measured",
      "evidence": [
        "name=\"firstname\" (input) placeholder=\"Jordan\"",
        "name=\"lastname\" (input) placeholder=\"Reyes\"",
        "name=\"company\" (input) placeholder=\"Acme Co.\"",
        "name=\"website\" (input) placeholder=\"company.com\"",
        "name=\"email\" (input) placeholder=\"you@company.com\""
      ]
    },
    {
      "severity": "high",
      "title": "Add quotations so AI engines cite this page",
      "detail": "Generative engines (ChatGPT, Perplexity, AI Overviews) lift sourced, attributed quotes almost verbatim, and quotations are the single strongest citation lever (studies measure roughly +41%). Add 1-2 attributed expert quotes or blockquotes to the pages below. (Found across a sample of 8 pages from your sitemap, a partial crawl rather than your full site.)",
      "device": "both",
      "tags": [
        "AI Search",
        "SEO"
      ],
      "topic": "geo",
      "confidence": "measured",
      "evidence": []
    },
    {
      "severity": "high",
      "title": "Some buttons have no accessible name",
      "detail": "A button with only an icon and no label is announced as \"button\" by screen readers, giving no idea what it does.",
      "device": "both",
      "tags": [
        "Accessibility (WCAG)",
        "Tracking"
      ],
      "topic": "a11y_names",
      "confidence": "measured",
      "evidence": []
    },
    {
      "severity": "medium",
      "title": "Tiny buttons are hard to tap on mobile",
      "detail": "13 of 40 tappable items on this page (33%) measure under 24 pixels on their shorter side, below the 24px floor WCAG 2.5.8 sets for accessibility and well under the platform minimums (Apple recommends 44pt, Android 48dp) for reliable tapping, and the same ones came up small on every test load. When visitors can't hit what they expect to, they get frustrated and many of them leave instead of trying again.",
      "device": "mobile",
      "tags": [
        "Accessibility (WCAG)",
        "Conversion"
      ],
      "topic": "tap_targets",
      "confidence": "measured",
      "evidence": [
        "a 1x1 \"Skip to content\"",
        "button 11x11 \"Slide 1\"",
        "button 11x11 \"Slide 2\"",
        "button 11x11 \"Slide 3\"",
        "button 11x11 \"Slide 4\"",
        "button 11x11 (no visible label)",
        "button 11x11 (no visible label)",
        "button 11x11 (no visible label)"
      ]
    },
    {
      "severity": "medium",
      "title": "JavaScript crashed while the page was loading",
      "detail": "1 script error fired during page load. When a script crashes, buttons sometimes stop working, analytics stop firing, and the visitor has no warning. Worth opening the browser console to find which script failed.",
      "device": "both",
      "tags": [
        "Conversion",
        "Tracking"
      ],
      "topic": "js_errors",
      "confidence": "sampled",
      "evidence": [
        "gtag is not defined"
      ]
    },
    {
      "severity": "medium",
      "title": "Page is heavy and slow on mobile data",
      "detail": "Each visit downloads about 2.2 MB, roughly 1109 KB of images and 704 KB of JavaScript across 88 separate downloads. On a fast connection that's fine. On a phone with patchy mobile data, that's several seconds of blank screen before the page is readable.",
      "device": "both",
      "tags": [
        "Performance"
      ],
      "topic": "page_weight",
      "confidence": "sampled",
      "evidence": []
    },
    {
      "severity": "medium",
      "title": "Meta Pixel sends only PageView on this page",
      "detail": "On this page the Meta Pixel sends only PageView. That is expected on a homepage, but check that a conversion event (a standard one like Lead, Schedule or Purchase, or a custom event) fires when a visitor actually converts, or that a custom conversion is set up in Events Manager. This scan loads pages and never submits a form or books a call, so it cannot see events that fire on those actions. If nothing fires there, Meta can optimise your ads for page views only.",
      "device": "both",
      "tags": [
        "Tracking"
      ],
      "topic": "tracker_misconfig:Meta Pixel (Facebook)",
      "confidence": "measured",
      "evidence": []
    },
    {
      "severity": "medium",
      "title": "5 potential dead-click targets",
      "detail": "At phone and desktop width, in our test browser, these elements are styled with a pointer cursor, the page's own mark for something clickable. They are not a link or a button, have no button or link role, no tabindex and no click attribute, and nothing on or around them opens a menu. A click handler attached by a script is not visible to this check, so click one to confirm it does something. Examples: \"pricing\" (span.ns-pill), \"how-to\" (span.ns-pill), \"reviews\" (span.ns-pill).",
      "device": "both",
      "tags": [
        "Conversion",
        "Accessibility (WCAG)",
        "Tracking"
      ],
      "topic": "dead_clicks",
      "confidence": "measured",
      "evidence": [
        "\"pricing\" (span.ns-pill)",
        "\"how-to\" (span.ns-pill)",
        "\"reviews\" (span.ns-pill)",
        "\"vs\" (span.ns-pill)",
        "\"best\" (span.ns-pill)"
      ]
    },
    {
      "severity": "medium",
      "title": "2 inputs use the wrong type attribute",
      "detail": "Mobile keyboards adapt to the input type (email shows @ key, tel shows numeric pad). Generic type=\"text\" gets a generic keyboard and visitors mis-type. Switch to the correct type, or add a matching inputmode attribute if the native validation is too strict for what people type (bare domains in a URL field, for example).",
      "device": "both",
      "tags": [
        "Conversion"
      ],
      "topic": "form_input_type",
      "confidence": "measured",
      "evidence": [
        "name=\"website\" → use type=\"url\"",
        "name=\"agwebsite\" → use type=\"url\""
      ]
    },
    {
      "severity": "medium",
      "title": "Security headers are missing or weak",
      "detail": "The server response is missing browser-hardening headers that protect visitors and are a standard security and agency checklist item. Missing or weak here: Content-Security-Policy (the main defense against injected and cross-site scripts); clickjacking protection (X-Frame-Options or a CSP frame-ancestors rule); a stronger HSTS policy (max-age at least 180 days plus includeSubDomains); X-Content-Type-Options: nosniff (stops MIME-type sniffing attacks). These are set at the server, CDN, or host level (most platforms expose them in settings or a config file) and do not change how the site looks or performs.",
      "device": "both",
      "tags": [
        "Security"
      ],
      "topic": "security_headers",
      "confidence": "measured",
      "evidence": []
    },
    {
      "severity": "medium",
      "title": "14 interactive elements have no stable, accessible identity",
      "detail": "These elements are clicked like buttons but expose no accessible name, or are a plain div/span used as a control with no role. Assistive tech announces only a role (or nothing), and analytics and heatmaps have no human-readable label or stable selector to bind the click to, so the click is both inaccessible and untrackable, and any redesign silently breaks click aggregation. Give each one a real <button>/<a>, an aria-label, and a stable id or data-attribute.",
      "device": "both",
      "tags": [
        "Accessibility (WCAG)",
        "Tracking"
      ],
      "topic": "untrackable_elements",
      "confidence": "measured",
      "evidence": [
        "\"pricing\" (span.ns-pill) (div/span used as a button, no role)",
        "\"how-to\" (span.ns-pill) (div/span used as a button, no role)",
        "\"reviews\" (span.ns-pill) (div/span used as a button, no role)",
        "\"vs\" (span.ns-pill) (div/span used as a button, no role)",
        "\"best\" (span.ns-pill) (div/span used as a button, no role)",
        "(button.hpd-car-dot) (no accessible name)",
        "(button.hpd-car-dot) (no accessible name)",
        "(button.hpd-car-dot) (no accessible name)"
      ]
    },
    {
      "severity": "low",
      "title": "Images have no width or height set (layout is stable for now)",
      "detail": "17 of 25 images don't declare width and height. Your layout currently stays stable (measured Cumulative Layout Shift is 0, which is fine), most likely because space is reserved another way (CSS), so this is not causing visible jumps today. It is still worth setting explicit dimensions or a CSS aspect-ratio so a slow connection or a future style change cannot reintroduce shift.",
      "device": "both",
      "tags": [
        "Performance",
        "SEO"
      ],
      "topic": "image_dims",
      "confidence": "measured",
      "evidence": [
        "Blog-Typing-Effect.gif \"Nina blog writing demo\"",
        "Nina-Line-Chart-Icon.png \"Traffic growth icon\"",
        "TryNina-SEMrush-screenshot.png \"SEMrush dashboard\"",
        "Nina-Bar-Graph-Icon.png \"Measurable improvements \"",
        "TryNina-Google-Search-Console-screenshot-grey.png \"Google Search Console gr\"",
        "Nina-Multi-Channel-Icon.png \"Multi-channel icon\""
      ]
    },
    {
      "severity": "low",
      "title": "Unused JavaScript is being downloaded",
      "detail": "Code that never runs on this page still costs download and parse time on every visit. Splitting or removing it speeds up load. Lighthouse measured: Est savings of 140 KiB.",
      "device": "both",
      "tags": [
        "Performance"
      ],
      "topic": "unused_js",
      "confidence": "measured",
      "evidence": []
    },
    {
      "severity": "low",
      "title": "The page loads from a lot of third-party services",
      "detail": "Around 28 separate outside domains load on this page (analytics, ads, chat widgets, fonts). Each one is a connection that can be slow, fail, or change behavior outside your control.",
      "device": "both",
      "tags": [],
      "topic": "third_party",
      "confidence": "sampled",
      "evidence": []
    }
  ]
}