Website Audit · SignalRed Studio (Internal Audit)

NOTE — this is an internal audit, not a sales prospect report. Sections normally pitched at the client (recommendations, investment, outreach) are here repurposed as Fergus’s own pre-launch checklist. No numbers in phases: because this is in-house effort, not a quoted engagement.

At-a-glance dashboard

The audience panel renders “insufficient data” because the domain is brand new (zero Wayback snapshots, 1 Google-indexed page). Re-run this audit in 3-6 months once there’s real field traffic.

What’s actually there

• Positioning: “East Anglia’s Premier Digital Agency” — four service lines (Custom Software & Apps, Creative & Branding, Managed IT Support, SEO & Growth Marketing).
• Real registered address: Abbey Hall, Buxhall Road, Great Finborough, Suffolk, IP14 3AU.
• Real phone: +44 (0) 1449 541255.
• Real team: Fergus Kendall (Director), Duncan Roome (Head of Sales & Marketing), Kelly Innocent (Head of Design), Toby Calver (Technology Director).
• Live AI feature: “Project Assistant” with voice input + brief generator.
• Working pricing widget: “Tailor Your Solution” toggles services and totals an estimated starting budget.
• Working contact form: budget select, services multi-select, project details, name/email/phone/company.

Tech stack detected

Strengths

1. Real, populated team section — four named humans with roles and photos. Most new-agency sites have stock photos or a single founder. This already feels like a 4-person studio, which is rare and credible.
2. Address, phone, email all real and consistent — Suffolk HQ matches Companies House style; phone is a proper Suffolk landline (01449); email on the company’s own domain via Google Workspace.
3. The “Project Assistant” AI brief generator is a genuine differentiator — most local agencies don’t have this. Lean into it.
4. The pricing toggle widget is novel and good UX — gives prospects a feel of cost without forcing a sales call. Few competitors do this.
5. PSI Best Practices = 100/100 on both mobile and desktop — no insecure resources, no mixed content, no JS console errors. Clean baseline.
6. Lighthouse Accessibility 84/90 (mobile/desktop) — not perfect (see weaknesses) but already better than most agency sites that ship with 50–60.
7. Desktop LCP is 1.9 s — fine. The catastrophic 13.3 s LCP is only on simulated mobile (slow 4G).
8. Mobile screenshot is visually impressive — the dark red gradient hero with the “SCROLL” indicator and trust strip looks like a £15k agency site, not a starter template.

Weaknesses

1. Fake clients, fake testimonial, fake scale claim

Issue: Three intertwined fabrications on the homepage: - A scrolling “TRUSTED BY 500+ UK BUSINESSES FROM SHOREDITCH TO EDINBURGH” strip with logos labelled FinTech Ltd, GreenEnergy, London Legal, CreativeArts, NorthShore Hub, TechStart, Urban Logistics. None of these are real companies. The “500+” figure is unsupportable. - A testimonial: “SignalRed helped us scale our platform from 10k to 100k users in just 3 months. Their technical expertise is unmatched.” — attributed to Sarah Jenkins, CTO, FINTECH LTD. There is no such person at any such company. - The geographic claim “Shoreditch to Edinburgh” contradicts the “East Anglia’s Premier” positioning two screens earlier.

Impact: This is the headline finding and the reason the site CANNOT go customer-facing in its current state. - UK CAP Code (CAP 3.7, 3.45) prohibits misleading commercial representations of testimonials and customer numbers. The ASA can require correction and publish adjudications publicly under SignalRed’s name. Penalty escalates to ICO/Trading Standards referral if repeated. - Trust erosion if a prospect figures it out — one Google search for “FinTech Ltd Sarah Jenkins” returns no relevant result. Modern B2B buyers DO check. - Sets a tone that taints everything else on the page — the “20 years industry experience” line on Fergus’s bio, the “500+ UK businesses” — every other claim becomes suspect once one is busted. - Inconsistent with the actual brand asset Fergus already has — mycobrew.signalredstudio.com is a real live e-commerce build. That’s the case study. Use it.

Severity: Critical · Launch-blocker.

2. The whole site is a single client-rendered SPA — Google has indexed 1 page

Issue: The HTML source is a 1 KB shell (<div id="root"></div> + a single JS bundle reference). All routes (/#services, /#team, /#portfolio, /#pricing, /#brief, /#contact) are scroll-anchors within the same page, not separate URLs. site:signalredstudio.com on Google returns one result.

Impact: - Zero deep SEO — Google cannot rank “custom software development Suffolk” against a /services/custom-software page that doesn’t exist. The entire keyword universe is competing on one URL with one <title>. - Social shares lose context — every shared link is the homepage. - No internal-linking SEO equity — there are no internal pages to link to. - Crawlers that don’t run JS get nothing — including some social previewers, RSS readers, and lower-tier search engines. - Mobile users on slow connections see a white screen for 5.7 s (FCP) and the largest content block at 13.3 s (LCP) because EVERYTHING is gated behind the JS bundle.

Impact (quantified): for an agency selling SEO services, ranking on one indexed page is the kind of optic that disqualifies you in the first 30 seconds of a buyer’s research.

Severity: Critical

3. robots.txt and sitemap.xml return the SPA HTML, not their intended content

Issue: curl https://www.signalredstudio.com/robots.txt returns the React shell HTML with HTTP 200 and Content-Type: text/html. Same for /sitemap.xml. Same for ANY unknown URL — /this-does-not-exist returns HTTP 200. This is why PSI reports “robots.txt is not valid — 25 errors found”.

Impact: - Google can’t find a sitemap to crawl → all pages forever undiscovered. - No robots.txt means every soft-404 is indexable → Google may index garbage URLs forever. - Soft 404s on /this-does-not-exist mean Google must reverse-engineer 404s — a known SEO penalty signal. - This is a 10-minute nginx config fix.

Severity: Critical

4. Mobile performance — 13.3 s LCP, 5.7 s FCP, 3.5 MB total weight

Issue: On simulated mobile (Lighthouse 4G): - LCP 13.3 s (Google “good” threshold is 2.5 s — this is 5.3× over) - FCP 5.7 s (good = 1.8 s) - Time to Interactive 13.7 s - Total page weight 3.5 MB — of which images are 2.7 MB and JS is 620 KB - No real-user (CrUX) data yet because the site has no field traffic to measure.

Root causes (all fixable): - Hero image hero-bg.png is a 1024×1024 PNG at 546 KB — should be WebP at ~60 KB. - kelly_innocent.png is 914 KB, toby_calver_tech.png is 782 KB — both PNGs of photos. JPG/WebP would cut these by 80–90 %. - The 620 KB JS bundle is served uncompressed. No Content-Encoding: gzip on /assets/*.js despite the client sending Accept-Encoding: gzip, br. nginx gzip is off for static files. Gzipped this would be ~170 KB. - The 55 KB CSS is also uncompressed — gzipped ~12 KB. - No Cache-Control: max-age= headers on bundles → repeat visits re-download everything. - Lighthouse: “Use efficient cache lifetimes — Est savings 3,328 KiB” and “Improve image delivery — Est savings 2,455 KiB”. Together that’s 5.6 MB of pure config wins.

Impact: Mobile bounce rates on sites with LCP > 8 s typically exceed 50 %. The agency is on the wrong side of every Core Web Vitals threshold while selling SEO.

Severity: High

5. No JSON-LD structured data

Issue: The rendered DOM has zero <script type="application/ld+json"> blocks. Despite the page declaring a business with address, phone, services, team, and pricing, Google sees no Organization, LocalBusiness, ProfessionalService, Person, Service, or OpeningHoursSpecification markup.

Impact: - No Google Knowledge Panel chance for “SignalRed Studio”. - No rich results in SERPs — competitors with schema get sitelinks, ratings, FAQs. - Local Pack invisibility — even with a real Suffolk address, Google can’t confidently associate the entity. - For an agency that sells “SEO & Growth Marketing”, this is a credibility-puncturing omission.

Severity: High

6. GA4 fires before user consent — UK GDPR / PECR breach

Issue: <script async src="...gtag/js?id=G-RG23L353WW"></script> is in the static HTML and fires unconditionally on page load. There is no cookie consent banner. The privacy policy is linked in the footer but is referenced by the form, not the cookies.

Impact: - PECR Regulation 6 requires consent before non-essential cookies (analytics included) are dropped. ICO has been actively fining UK companies on this since 2024. - Specifically risky for an agency — clients evaluating SignalRed’s “Managed IT Support” / “Custom Software” offerings will run automated scans (e.g. Cookiebot, OneTrust) and see the violation in 30 seconds. - The HTML even contains the betraying comment <!-- Google Analytics (Replace G-PLACEHOLDER with your actual ID) --> — looks like a half-finished checklist item.

Fix: Add Cookiebot, Klaro, or a lightweight in-house gate. Block GA4 until consent is given. ~3 hours.

Severity: High

7. Zero security headers

Issue: Response headers from curl -I https://www.signalredstudio.com/ show NONE of: - Strict-Transport-Security - Content-Security-Policy - X-Frame-Options - X-Content-Type-Options - Referrer-Policy - Permissions-Policy

This will score D or F on securityheaders.com.

Impact: - HSTS missing means a downgrade attack on first visit is possible. - No CSP means any future XSS is unmitigated; for the AI Project Assistant which presumably accepts user input and may render markdown, this is a present-tense risk. - No X-Frame-Options means the site can be iframed and clickjacked. - Optics for a “Managed IT Support” offering — prospects who test the agency’s own security posture will be put off.

Fix: 10 lines of nginx config. 30 minutes total including testing.

Severity: High

8. No real portfolio / case studies / proof-of-work

Issue: The nav has “Portfolio” and “Clients” links, but both point to the fake-logos strip. There is no mycobrew.signalredstudio.com showcase, no screenshot grid, no “Here’s a real thing we built” — despite Fergus having at least one live, real, mature build to show.

Impact: - Once the fake clients are removed (and they MUST be), the homepage will have a vacuum where social proof should sit. - Buyers don’t believe an agency without case studies. Even one is dramatically better than fabricated ones. - The MyCoBrew build is genuinely good and is exactly the kind of “bespoke Laravel + Stripe e-commerce” that justifies the “Custom Software” service line — it’s free marketing collateral, sitting unused.

Severity: High

9. Accessibility — failing button names, low contrast, unlabelled selects

Issue: PSI Mobile flagged: - button-name — buttons with no accessible name (likely the icon-only nav or scroll-down arrow). - color-contrast — at least one element fails WCAG AA 4.5:1 ratio (likely the red-on-dark accents in the trust strip or the muted body copy on the dark hero). - select-name — the budget / services dropdowns in the contact form lack associated <label> elements.

Impact: - Equality Act 2010 (Service Provision) — UK businesses providing services online are required to make reasonable accessibility adjustments. Fines are rare, but lawsuits are not (Greggs, Tesco, RNIB cases). - Selling websites to other UK SMEs while being inaccessible is an own-goal — half of B2B procurement now asks “is this WCAG AA compliant?”. - Project Assistant voice button especially needs accessible name — irony if a voice-first feature isn’t screen-reader-friendly.

Severity: High

10. Hero copy fails the 3-second test

Issue: Hero copy reads:

EAST ANGLIA’S PREMIER DIGITAL AGENCY Building the Future of Online Business From bespoke software to rock-solid IT support. We design, build, and secure your digital infrastructure using next-gen technologies.

This is generic agency-speak. A visitor cannot tell after 3 seconds: - WHO the agency works with (SMEs? Enterprise? B2B SaaS? Local retail?). - WHAT the actual deliverable is (a website? An app? An IT helpdesk?). - WHY they’d pick SignalRed over the dozens of other agencies in Suffolk/Cambridge/London.

Impact: the first 3 seconds determine whether someone scrolls. Generic = scroll-past. By contrast, MyCoBrew’s homepage immediately tells you “specialty coffee for cyclists” — the SignalRed homepage tells you nothing comparable.

Severity: Medium

11. Service blocks are skeletal

Issue: Each of the four services has a 1-sentence summary and a “Learn More →” link that scrolls to the same block (since there are no separate service pages). No deliverables list, no example outputs, no per-service pricing, no portfolio link.

Impact: Buyers in B2B services research like academics — they want depth before they engage. Skeletal blocks signal “we haven’t thought this through” and create friction where there should be momentum.

Severity: Medium

12. Pricing widget undersells — anchor is £500

Issue: “Estimated Starting Investment” defaults to £500. With all four toggles on the maximum scenario would be roughly £9k + £2k/mo. The £500 anchor is psychologically self-defeating — it positions SignalRed in “Fiverr logo guy” territory, not “bespoke Laravel storefront agency” territory.

Impact: Anchoring is the single most powerful pricing lever — once a number is in the buyer’s head, every subsequent quote is judged against it. £500 anchors the wrong buyer (price-sensitive micro-projects) and disqualifies the right one (£10k+ project budgets — which the contact form even has as a selectable range).

Fix: raise the floor to £2,500 (matching the smallest contact-form bucket “£5k – £10k” or “Micro Project (< £5k)” being honest about being the bottom rung). Or remove the headline number and only show it once the buyer has toggled at least one service.

Severity: Medium

13. Mixed US/UK English

Issue: <html lang="en-GB"> is correct, but the meta description says “specializing” (US). The page targets UK businesses, has Suffolk geography and Sterling pricing.

Impact: Minor on its own, but stacks with other “feels rushed” signals (G-PLACEHOLDER comment, fake clients, etc.). UK B2B buyers DO notice “z” vs “s” — it telegraphs “templated foreign agency” vs “your local people”.

Severity: Low (but trivial to fix)

14. G-PLACEHOLDER comment shipped to production

Issue: Live HTML contains: <!-- Google Analytics (Replace G-PLACEHOLDER with your actual ID) -->. The actual ID G-RG23L353WW is correctly present in the script, but the placeholder comment was never removed.

Impact: Any prospect who right-clicks → View Source (and they will, this is a tech agency) sees a half-finished checklist. Small signal, big tell.

Severity: Low

15. OG image is a relative path to the abstract hero background

Issue: <meta property="og:image" content="/hero-bg.png"> — two problems: - Relative path. Some social platforms (older LinkedIn previews, certain email clients) fail to resolve to absolute. Should be https://www.signalredstudio.com/hero-bg.png. - The image itself is the abstract red gradient hero background — not a designed social card with logo + tagline.

Impact: Every share on LinkedIn / Twitter / WhatsApp / Slack looks like a featureless red square. Free brand impressions wasted.

Fix: 1080×1080 social card PNG with the wordmark and the tagline, absolute URL. 1 hour in Figma.

Severity: Low

16. No content strategy / no blog / no insights

Issue: A digital agency that sells “SEO & Growth Marketing” has no blog, no insights section, no thought-leadership content. The only content on the entire indexable web for this domain is the homepage.

Impact: The most cost-effective sales channel for a service business is content. Even one well-targeted post a fortnight (“How we cut MyCoBrew’s LCP from 4.5s to 0.9s”) would build domain authority over 12 months and provide the entire sales team with reusable email collateral. Skipping content entirely is leaving the strongest moat unbuilt.

Severity: Medium

17. info@ instead of a named human

Issue: Contact email is info@signalredstudio.com. Most B2B buyers prefer reaching a named human; info@ reads as “this will go to a queue”.

Impact: Reduces reply-rate on cold outreach (less personal). Reduces trust signal (which human owns this lead?).

Fix: Direct sales enquiries to duncan@signalredstudio.com (named head of sales) or hello@ with Duncan’s name + photo next to the form. 10-minute change.

Severity: Low

18. Voice Assistant / Generate Brief — functional UX unverified

Issue: Two unique features prominent on the page (“Use Voice Assistant” + “Generate Brief”), but it’s unclear from the audit whether they reliably round-trip a user input to a useful output, whether the resulting brief is sent to the SignalRed inbox as a sales signal, whether the experience is graceful on mobile, and whether failure modes are handled.

Impact: A broken AI feature on the homepage of an agency selling Custom Software is worse than no feature at all. Needs end-to-end testing on real devices before launch.

Severity: Medium (assumption-flagged — verify with Toby)

Quick Metrics

Lighthouse (mobile / desktop, simulated 4G / cable):

Page weight breakdown (uncompressed where headers showed no encoding): - HTML shell: 1 KB - JS bundle index-CnROpfTM.js: 620 KB (uncompressed — would be ~170 KB gzipped) - CSS bundle index-TZVhRrvC.css: 55 KB (uncompressed — would be ~12 KB gzipped) - hero-bg.png: 546 KB - kelly_innocent.png: 914 KB - toby_calver_tech.png: 782 KB - fergus_new.jpg: 333 KB - duncan_new.jpg: 154 KB - Combined hero+team assets: ~2.7 MB. Total page: 3.5 MB.

SEO surface: - Pages indexed by Google for site:signalredstudio.com: 1 - Wayback snapshots: 0 (brand new domain) - Backlinks: unknown (no Ahrefs data in this audit — worth checking once a few outreach campaigns are run) - Structured data: none - robots.txt: invalid (serves HTML) - sitemap.xml: missing (serves HTML)

Audit screenshots: - Desktop: reports/signalredstudio-2026-05-28/sr-home-desktop.png - Mobile: reports/signalredstudio-2026-05-28/sr-home-mobile.png

Pre-launch Roadmap

Sequenced so the legal/trust blockers are fixed first, then the SEO/perf foundation, then the polish. Effort estimates are wall-clock for one focused dev/designer working part-time. No money line because this is internal — opportunity cost only.

Phase 0 — Stop the Bleed (THIS WEEK, before any outreach)

These three things alone justify pulling the site offline temporarily if needed:

1. Strip the fake-clients trust strip entirely. Replace with a single “Selected work” tile featuring MyCoBrew (real link, real screenshot, real outcome line like “Custom Laravel + Stripe storefront, sub-1s LCP, live 2026”). One real case study beats seven fake ones at any conversion test ever run.
2. Delete the fabricated Sarah Jenkins testimonial. Either replace with a real quote from a real MyCoBrew stakeholder (with permission and full name + photo + LinkedIn link) or omit the testimonial section until one exists.
3. Remove the “TRUSTED BY 500+ UK BUSINESSES” claim and the “Shoreditch to Edinburgh” geography line. Replace with honest positioning — e.g. “Suffolk-based digital studio. Recent work: MyCoBrew.” Specific beats grandiose for new entrants.

Effort: 1 day (copy + design). Risk-without-doing: ASA referral, legal exposure, trust collapse on first cold lead.

Phase 1 — SEO + Performance Foundation (1–2 weeks)

Mechanical wins, no content/design dependency. Most can be done by Toby in an afternoon each.

4. Add a static /robots.txt allowing all + sitemap reference. Add a real /sitemap.xml. Configure nginx so .txt/.xml requests are NOT routed to the SPA fallback.
5. Fix the soft-404: nginx try_files should return a 404 status for text/html requests to unknown URLs, with a real 404 page.
6. Enable nginx gzip/brotli for /assets/* — drops JS+CSS from 675 KB to ~180 KB.
7. Set Cache-Control: public, max-age=31536000, immutable on hashed assets, no-cache on the HTML shell.
8. Compress + convert hero + team photos to WebP. Drop hero to ~60 KB, team photos to ~40 KB each. sharp CLI does this in one command. Expected mobile LCP drop: 13.3 s → ~3 s.
9. Add full meta tag set to the HTML shell: absolute og:image URL pointing at a proper 1200×630 social card, og:locale: en_GB, Twitter card, canonical, generator, and a real Description that uses British spelling (specialising).
10. Pre-render the homepage with Vite SSG / vite-plugin-prerender / Astro migration. Even just SSG-ing the homepage to static HTML (no SSR runtime needed) means Google sees the full content without running JS. This single change usually moves a SPA from 1 indexed page to many.
11. Add JSON-LD structured data to the shell: Organization, LocalBusiness, ProfessionalService, OpeningHoursSpecification, four Service objects, four Person objects (the team), PostalAddress, ContactPoint.
12. Implement a consent gate (Klaro or in-house) that blocks GA4 until consent. Update the privacy policy with the cookies list.
13. Add a security-headers block to nginx: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, Permissions-Policy: camera=(), microphone=(self), geolocation=(). Validate at securityheaders.com — target A or better.
14. Fix the three PSI accessibility failures — accessible names on icon buttons, <label> association on the form selects, bump the failing contrast pair (likely the muted-grey body copy on the dark red — push the text to #C9CCD1 or lighter).
15. Remove the G-PLACEHOLDER comment and the <!-- Tailwind CSS is now built via PostCSS --> comments. Production HTML shouldn’t carry dev notes.
16. Wire a real form backend if it isn’t already (the contact form should send to info@ AND log to a CRM/sheet — verify with Duncan).

Phase 2 — Real Content + Real Portfolio (2–4 weeks)

Now the foundation is solid, fill it with truth.

17. Build out /portfolio/mycobrew as a long-form case study: brief → discovery → tech choices → screenshots → outcomes (LCP numbers, conversion delta, hosting savings). This single page becomes the strongest sales asset.
18. Real testimonials — one per service line, ideally. If only one exists (MyCoBrew), use it loud and proud, don’t pad with imaginary ones.
19. Service pages — one per service line, real URLs: /services/custom-software, /services/creative-branding, /services/managed-it, /services/seo-growth. Each with: who it’s for, what’s included, sample deliverables, indicative pricing/timeline, FAQ. This is the SEO multiplier.
20. Rewrite the hero to pass the 3-second test. Candidate: “Bespoke software, websites and IT for UK SMEs. Built in Suffolk, deployed everywhere.” (Concrete WHO, concrete WHAT, concrete WHERE.) Stress-test five variants with Duncan + Kelly.
21. Raise the pricing-widget floor to £2,500. Or convert it to a “typical project” comparator (e.g. “A brand refresh + 8-page site like our MyCoBrew rebuild = ~£12k”).
22. Add a “How we work” or “Process” section — discovery → design → build → handover → retainer. Buyers want to know what working with you looks like.
23. Open a /blog or /insights — first post: the MyCoBrew performance write-up. Aim for 1 post / 2 weeks. Each becomes inbound SEO + outbound email collateral.
24. Verify the AI Project Assistant works end-to-end on real mobile devices with real users. If it doesn’t, hide it until it does.
25. LinkedIn integration on the team section — every team member’s tile should link to their LinkedIn. Currently the bios are read-only.
26. Replace info@ with hello@ or named addresses + a “Reply within 1 business day” promise.

Phase 3 — Growth + Retainable Posture (ongoing)

Once 0–2 are done, you can credibly point real prospects at the site. After that:

27. Cloudflare in front of the nginx VPS — free, gives global CDN, edge image-optimisation, free WAF, free DNSSEC. Will pull mobile LCP down for international visitors.
28. Set up Plausible (or self-hosted) alongside GA4 — privacy-friendly, no consent banner needed for the basics. Avoids GA4 sampling above traffic thresholds.
29. Search Console + Bing Webmaster Tools — submit the new sitemap, monitor indexing, watch the queries you start ranking for.
30. Content cadence — 1 post per 2 weeks, tied to a service line. By month 6 you’ll have ~12 long-form posts, each ranking for at least one long-tail.
31. Quarterly internal audit — re-run tools/audit-new.sh signalredstudio https://signalredstudio.com and compare against this one. PSI, audience, indexed pages, backlinks. Treat your own site like a paying client.

Effort estimate (internal)

Nothing here needs a third-party agency. All of Phases 0–2 are well within the in-house team’s capability — that’s the whole point of being SignalRed.

Internal next-action (for Fergus)

This section is the SignalRed equivalent of the “Outreach Angle” we’d write for a prospect. For our own site it’s a one-week plan:

This week — before ANY cold outreach with the URL attached: 1. Phase 0 items 1–3. Get the fake clients off the page. This is a Monday-morning job. 2. Run tools/audit-new.sh again next Friday and check the severity bar dropped from 3 Critical to 0 Critical.

Next week: 3. Knock out Phase 1 items 4–9 (the nginx + perf + SSG block). Toby’s afternoon × 3. 4. Make the JSON-LD + consent gate + security-headers pass (Phase 1 items 11–13).

Then: the site is genuinely ready to be sent to a paying-prospect-shaped inbox. Until then, link to mycobrew.signalredstudio.com instead — it’s a stronger artefact than the brochure site is today.

Single biggest lift available: Phase 0 + Phase 1 together would move every Lighthouse metric from amber/red to green, get the indexed-page count above 1, and remove the legal/trust risk. Maybe 12 person-days of work to take the site from “do not ship” to “send to clients with pride”.

Evidence Pack

Raw data captured

• reports/signalredstudio-2026-05-28/pagespeed-mobile.json
• reports/signalredstudio-2026-05-28/pagespeed-desktop.json
• reports/signalredstudio-2026-05-28/traffic-stats.json
• reports/signalredstudio-2026-05-28/serp-brand.json
• reports/signalredstudio-2026-05-28/serp-site.json
• reports/signalredstudio-2026-05-28/wayback-cdx.json
• reports/signalredstudio-2026-05-28/sr-home-desktop.png
• reports/signalredstudio-2026-05-28/sr-home-mobile.png

Specific findings backed by raw responses

• curl https://www.signalredstudio.com/ → 1041-byte SPA shell, contains G-PLACEHOLDER comment.
• curl https://www.signalredstudio.com/robots.txt → HTML SPA shell, HTTP 200, Content-Type text/html.
• curl https://www.signalredstudio.com/sitemap.xml → same.
• curl -I -H "Accept-Encoding: gzip,br" .../assets/index-CnROpfTM.js → no Content-Encoding header (uncompressed).
• curl -I on homepage → no Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, or Permissions-Policy.
• Playwright headless render → confirmed live homepage content matches body_text_sample in sr-info.json.
• SerpAPI site:signalredstudio.com → 1 result. SerpAPI brand search “signalredstudio” → SignalRed is position 1 (good — own the brand).

Tools used

• Google PageSpeed Insights API (mobile + desktop) — tools/pagespeed.sh
• Wayback Machine CDX + SerpAPI + DNS fingerprint — tools/traffic-stats.sh
• Playwright (headless Chromium via system Chrome) — full SPA render + screenshots + DOM inspection
• curl for header / status code / robots / sitemap probes
• openssl s_client for SSL cert + SAN verification

Pages crawled / referenced

• Homepage: https://www.signalredstudio.com/
• robots.txt + sitemap.xml + a known-bad URL (/this-does-not-exist) — all return SPA HTML
• Static assets: /assets/index-CnROpfTM.js, /assets/index-TZVhRrvC.css, /hero-bg.png, team photos