Example Report

The site uses a consent tool called CookieYes, deployed through Google Tag Manager rather than added directly to the page. That’s a normal setup, but it means a quick scan of the page’s raw code won’t find it on its own, since the tool loads in after the fact.

Worth noting as a general point: when a page manages its tools this way, “not visible in a basic scan” isn’t the same as “not there.” This one was confirmed directly, in the tool’s own dashboard and on the live site.

The “Do Not Sell or Share My Personal Information” link in the footer works correctly for visitors. It previously pointed nowhere a search engine could read; it’s since been rebuilt as a real button rather than a dead link, closing that gap.

This was the main reason the search visibility score wasn’t higher. See the note under Search Engines below.

No third-party cookies are set when the page first loads. Cookies are only set after the consent tool records a visitor’s choice.

The homepage includes a structured data block, a summary written for search engines rather than people, that lists a real business name, address, phone number, email, and a link to an actual LinkedIn profile. Every field is filled in with real information rather than placeholder text.

The footer link described above has been fixed, bringing the score to a clean 100.

HTTPS is enforced across the site, and the browser is told to remember that. A few extensions of that protection aren’t configured yet:

• The instruction that extends HTTPS enforcement to subdomains and pre-registers the site with browsers isn’t set.
• There’s no policy yet telling the browser which sources are allowed to run scripts on the page, or blocking browser plugins outright.
• A newer isolation setting, and a stricter script-loading mode, aren’t in place.
• Whether the site blocks being loaded inside another site’s frame couldn’t be confirmed automatically this pass; it’s worth a quick manual check.

None of this affected the Best Practices score, which is 100. These are extra-credit settings, not failures.

HTTPS enforced site-wide, no deprecated code in use, no errors in the browser console, no third-party cookies.

The page doesn’t publish which version of its software it runs, and none of the installed tools leak a version number through the page either. A separate check for whether staff usernames could be listed through a public data endpoint came back correctly locked down.

A file that ships by default with this site’s software (readme.html) can still be loaded directly. It doesn’t reveal a version number in this case, but there’s no reason to leave it reachable.

All three standard checks are in place: SPF, DKIM, and DMARC. Together they let a receiving mail server verify that a message claiming to be from clearflowmedia.com actually came from an approved source.

DMARC, the strictest of the three, is partway through a staged rollout. Right now, a forged message from a subdomain is rejected outright. A forged message from the main domain is quarantined rather than delivered normally. The next step is to reject those too, once a monitoring period confirms nothing legitimate gets caught in the process.

The domain is registered through April 2027 and locked against unauthorized transfer. Not urgent, but close enough to be worth a calendar reminder ahead of time.