Sample data. An illustrative example for a cafe that does not exist. Every number is invented; the format is the one a paying client receives, generated from the same template.
Living System Audit
sample.coffee
Measured 3 July 2026 · https://sample.coffee/ · 12 pages
Scoreboard
Where you stand
Needs work. A carbon baseline with easy wins in it and clean transport security, against real accessibility gaps and one claim that needs rewording before it goes any further.
Needs work means: real things to fix, nothing that needs a rebuild.
What needs action now
Ordered by what buys you the most for the least work. Everything else in this report is the evidence behind these 4 calls.
-
1
Reword or remove the carbon neutral claim before it appears anywhere else.
High impact · Low effort
A copy change, no build work
See 4. Claim-safety, the evidence for action 1 -
2
Fix the footer contrast, the missing form labels and the focus state.
High impact · Medium effort
One token, some markup, three lines of CSS, but across every page
See 2. Accessibility, the evidence for action 2 -
3
Compress the terrace hero image.
Medium impact · Low effort
One asset, re-exported and re-uploaded
See 3. Performance and UX, the evidence for action 3 -
4
Route bookings into a shared calendar.
Medium impact · High effort
An integration to build and test, not a settings change
See 6. Workflow and automation, the evidence for action 4
1. Digital footprint
D · Needs workThe environmental cost of the site, with the same method we apply to every project, so the number still means something when you measure again next year.
- Homepage weight
- 1.8MB
- CO₂e per visit
- 0.27g
- Per 10,000 visits about 16 km in an average car
- 2.67kg
- Site average per page
- 0.20g
- Heaviest page
- /gallery at 3.2MB
- Green hosting
- not verified
The site sits in the middle of the pack. A D on this scale is where many small business sites land, since the top grades are reserved for the leanest few percent of pages. The homepage still carries more than it needs to, and the gallery is the outlier at nearly twice that. Confirming green hosting would bring every figure on this page down on its own, without changing a single asset.
2. Accessibility
Act nowConformance with WCAG 2.2 AA and the friction points affecting the broadest range of users, as a starting point for improvement rather than a pass or fail verdict.
None of these need a redesign. The contrast fix is a colour token, the labels and alt text are markup, and the focus state is three lines of CSS. Together they affect every page on the site.
- Automated findings
- 14
- Rules failing
- 5
- Serious or critical
- 4
- Pages affected
- 12
Top 5 friction points, in remediation order
| # | Friction point | Pages | Priority |
|---|---|---|---|
| 1 | Footer links are hard to read against the background. | 12 pages | Act now |
| 2 | Booking form fields have no labels a screen reader can announce. | 1 page | Act now |
| 3 | The mobile menu button shows nothing when reached by keyboard. | 12 pages | Act now |
| 4 | Gallery images have no alternative text. | 1 page | Act now |
| 5 | The menu page jumps from a first-level heading to a third. | 1 page | Needs work |
Evidence for friction point 1: contrast
1.86:1 measured4.5:1 neededthe WCAG 2.2 AA minimum
First seen on the homepage. Elements must meet minimum color contrast ratio thresholds · color-contrast · .footer__links a · 12.0pt (16px), #B9B2A5 on #F4F1EA
Evidence for friction point 2: form labels
First seen on the /book page. Form elements must have labels · label · #booking input[name=name]
Evidence for friction point 3: focus state
First seen on the homepage. Interactive elements must show a visible focus state · focus-visible · .nav__toggle
3. Performance and UX
Needs workHow efficiently the site delivers, and how many steps a visitor takes to reach the thing you want them to do.
- PageSpeed on a phone
- 61 of 100
- PageSpeed on desktop
- 84 of 100
- Main content visible after Largest Contentful Paint · 2.5s or less is good
- 3.4s
- Page jumps while loading Cumulative Layout Shift · 0.1 or less is good
- 0.18
- Delay after a tap Interaction to Next Paint · 200ms or less is good
- 240ms
- Clicks to book a table
- 4
- Biggest saving available images saved larger than they need to be (hero-terrace.jpg)
- about 2.1s on a phone
Desktop is comfortable. Mobile is held back by one image: the terrace photo loads at full size before anything else appears, which is most of the gap between 61 and the 80s. It is also four clicks from the homepage to a completed booking, which is two more than it needs to be.
Agent readiness: can an AI assistant read your site?
- Structured data schema.org
- 1 of 12 pages (business details)
- Content without JavaScript
- every page
- AI crawlers allowed robots.txt
- none blocked
- Sitemap
- present
- Summary file for AI tools llms.txt
- absent
Needs work: Homepage business data, where: homepage
An assistant reading the data alone finds your name, address and phone number, but nothing about what you sell or what it costs. It cannot answer someone asking which cafes nearby serve breakfast and what they charge. Suggested fix: Add the menu and table bookings as offerings with a price range, inside the block that already carries your address.
Fine: Content in the raw HTML, where: site-wide
Every measured page carries its full text in the page itself, so a reader that never runs scripts sees the same words a visitor does.
Needs work: Crawler policy and discovery files, where: site-wide
You told us you want AI assistants to be able to read the site. Nothing blocks them and the sitemap is reachable, so that holds. There is no llms.txt, which is the one file these tools look for to get a plain summary of who you are. Suggested fix: Add a short llms.txt at the root: who you are, what you sell, where you are, and how to get in touch.
4. Claim-safety
Act nowWhat you can and cannot say publicly about the site's environmental profile, so your marketing is defensible under EU Directive 2024/825 before a regulator or a customer asks.
Act now: “Carbon neutral cafe”, where: homepage
Nothing on the site substantiates it, and a neutrality claim resting on offsetting is one of the practices the Directive names outright. This is the finding most worth acting on before it appears anywhere else. Suggested wording: “We measure and publish our website's carbon footprint”.
Needs work: “Eco-friendly packaging”, where: /order
True in part: the cup lids are compostable, the cups are not. As written it reads as a claim about all the packaging. Suggested wording: “Compostable cup lids, standard cups”.
Fine: “Locally roasted beans, sourced within 50km”, where: homepage
Specific, checkable, and supported by the suppliers page, which names the roastery and the distance.
AI surfaces
Needs work: Help chat launcher, bottom right corner, where: all pages
The chat is an AI assistant, but the only place that says so is a line near the bottom of the about page. Someone who opens the chat from the button never sees it, so they are talking to an AI without having been told. Suggested disclosure: “AI assistant. A person can take over any time”.
5. Security and resilience
Needs workBaseline security hygiene as measured on one date, using the same checks our own pre-launch gate enforces.
Headers and connection: 3 of 6 missing, connection secure
- Secure connection HTTPS / TLSIn place
- Which scripts the page may run Content-Security-Policy · set to start from default-src 'self'Missing
- What other sites learn about your visitors Referrer-Policy · set to strict-origin-when-cross-originMissing
- Camera, microphone and location locked off Permissions-Policy · set to camera=(), microphone=(), geolocation=()Missing
- Browsers forced onto HTTPS on return visits Strict-Transport-SecurityIn place
- Cannot be framed by another site X-Frame-OptionsIn place
- File types taken at face value X-Content-Type-OptionsIn place
Loaded script libraries with a known issue
Scroll the table sideways for the remaining columns.
| Library | Version | Verdict retire.js severity | Reference |
|---|---|---|---|
| jQuery | 3.4.1 | Needs work | CVE-2020-11022 (public record) |
Transport security is in good shape: a current certificate, modern TLS, and http traffic redirected. Three response headers are missing, which most hosts add in a control panel without touching the site. The slider still loads a jQuery version with a known issue, and updating it is a version bump.
6. Workflow and automation
Mapped, not scoredWhat actually happens behind the site, so any automation decision is based on the real process rather than an assumption about it.
Bookings arrive by email and are copied into a paper diary by hand each morning. Online orders are re-typed into the till system before service.
- Route bookings straight into a shared calendar, which removes the copying step and the double-booking risk that comes with it.
- Send online orders into the till automatically, so the morning re-typing disappears.
Page by page
Every page measured, using the standard grid electricity figure
Scroll the table sideways for the remaining columns.
| Page | Weight | CO₂e per visit | PageSpeed on a phone | Findings accessibility |
|---|---|---|---|---|
| / | 1.8MB | 0.27g D | 61 | 5 |
| /menu | 2.4MB | 0.36g E | 52 | 3 |
| /book | 900KB | 0.13g B | 74 | 2 |
| /order | 1.1MB | 0.16g C | 70 | 1 |
| /about | 1.6MB | 0.24g D | 63 | 1 |
| /gallery | 3.2MB | 0.47g F | 44 | 1 |
| /events | 1.3MB | 0.19g C | 66 | 0 |
| /suppliers | 800KB | 0.12g B | 78 | 0 |
| /contact | 700KB | 0.10g B | 80 | 1 |
| /blog | 1.4MB | 0.21g C | 65 | 0 |
| /privacy | 500KB | 0.07g A | 86 | 0 |
| /terms | 500KB | 0.07g A | 86 | 0 |
Where to start
First thing Monday
Reword or remove the carbon neutral claim before it appears anywhere else. A copy change, no build work. Everything else on this page can wait until that one is done.
See 4. Claim-safety, the evidence for this actionEverything above was measured from the outside, on one date. What it cannot show is proof that the fixes happened: that record (the Digital Impact Passport) is built alongside the work, so anyone can check the claims without taking your word for it.
Sent with this report
So you can hand the detail to a developer without going through us first:
- Google's PageSpeed results for every page, phone and desktop, untouched (open them in the Lighthouse viewer).
- The full accessibility scan: every issue with its rule, pages and element.
- The raw measurement file behind every number here, so anything can be checked or re-run.
How we measured
Every figure here comes from public tools anyone can re-run, measured on one date. None of it is a certification or a legal opinion, and each method states exactly where it stops.
Method: Digital footprint
The Sustainable Web Design model (version 4) via the Green Web Foundation's CO2.js library, an estimate rather than a certified measurement. Grid intensity defaults to the global average until green hosting is confirmed, so this figure should fall on its own once your host is verified.
Back to 1. Digital footprintMethod: Accessibility
Automated scan with axe-core against WCAG 2.2 AA at desktop and mobile widths. Automated tools reliably catch roughly a third of real barriers, so treat 14 as a floor rather than a total. The rest need human testing, which is a scoped piece of work we can quote separately.
Back to 2. AccessibilityMethod: Performance and UX
Google PageSpeed Insights (Lighthouse 12.6.0) on one date. Lab figures describe a single simulated visit; where real-user field data exists it is shown instead and marked as such. Your own analytics will differ, and are worth comparing against this baseline once you have a few months of them.
Back to 3. Performance and UXMethod: Agent readiness
We read each measured page the way a research agent that does not run JavaScript would, checking structured data (schema.org JSON-LD and microdata), the properties a buyer-agent needs (name, what is sold, pricing basis, area served, contact), whether the substantive content is in the raw HTML, and the site's robots.txt, sitemap, and llms.txt. This measures legibility, which is checkable. It is not search engine, answer engine, or AI visibility work, and we make no promise about rankings, citations, or appearing in any AI answer, because nobody can substantiate that.
Back to 3. Performance and UXMethod: Claim-safety
Your published claims checked against EU Directive 2024/825 guidance. This is a claim-safety assessment rather than a legal opinion, so a regulated claim in a specific jurisdiction still wants a lawyer's sign-off before it goes out.
Back to 4. Claim-safetyMethod: AI surfaces
We look for chat widgets, assistants, and AI-generated content on the measured pages and check whether a first-time visitor is told, at the point they meet it, that they are talking to or reading something made by AI. The EU AI Act (Regulation (EU) 2024/1689, Article 50) asks for the same thing, in its words "in a clear and distinguishable manner at the latest at the time of the first interaction or exposure", and has applied since August 2026. Which duty falls on you and which on the company that supplies your chat tool depends on your role under that Act, which is a question for a lawyer. This is a brand and interaction-design read, not a legal opinion, a certification, or a review of any vendor's terms.
Back to 4. Claim-safetyMethod: Security and resilience
External header, redirect, and certificate checks on every measured page, and a retire.js scan of the scripts your pages load, on one date. This is baseline hygiene rather than a penetration test, and it wants re-running after any hosting or dependency change.
Back to 5. Security and resilienceMethod: Workflow and automation
A walkthrough of the current process as you described it. These are opportunities, not delivered automation, and we don't attach hours-saved figures to them until something is built and measured. That number belongs in the Digital Impact Passport, the proof record we build alongside the work, not before it.
Back to 6. Workflow and automationTools and pages measured
Node v24.13.1 · Playwright 1.60.0 · CO2.js 0.18.0 · axe-core 4.10.2 · retire.js 5.2.7 · Lighthouse 12.6.0 via PageSpeed Insights · Green Web Foundation greencheck API. Pages measured: /, /menu, /book, /order, /about, /gallery, /events, /suppliers, /contact, /blog, /privacy, /terms.
Want this level of clarity for your own site?
Same structure, same plain language about what the numbers do and don't mean, measured on your site instead of this one.
Get your own audit