Deep audit of a service company website.
A real audit of a real Ukrainian B2B company — fully anonymized. The niche is generalised to «IT infrastructure outsourcing»; the domain, brand and phone numbers are masked. The entire methodology, the journey structure and every factual observation are preserved unchanged. An independent senior audit of lead capture / visibility / entity, where every finding is reproducible: query → page → artifact → metric. The BROWSER-ONLY scope is honesty, not a shortcut: we never pass a risk off as a proven loss of revenue.
The audit in 90 seconds.
- The site is invisible where it is searched for: across eight core commercial queries («IT support outsourcing», «IT infrastructure audit», «cloud server rental» and others) the site does not appear in the top 30 for a single one.
- The domain ranks for the wrong things: sixteen keywords in total, and the number-one among them is an English technical query unrelated to the services. Not one keyword describes what the company sells.
- A second brand domain serves an expired certificate: it sits in the top five for the company name, and the browser shows a security warning on it. The certificate expired twenty days ago.
- Zero structured data: not one JSON-LD block across eighteen pages. To search engines and AI answers the company is not an entity — just a body of text.
- Leaving an enquiry is harder than it looks: there is no email address anywhere on the site, and the only
<h1>in the articles is the cookie banner heading.
- HTTP/2 + Brotli: 378 KB of markup ships as 60 KB.
- HSTS; http→https and www→apex both closed with 301s.
- LCP 813 ms, CLS 0.00 in the lab measurement — speed is not the problem here.
- GA4 + GTM + Microsoft Clarity are installed and firing.
- Images are already webp/avif; the legal pages are in place.
- We never saw GA4/GSC — so we do not price lost enquiries in money.
- We do not know how many leads the phone and Telegram bring in off-site.
- There is no CrUX field data for the domain — too little traffic for Chrome to collect it. That is a signal, not a verdict.
- Reissue the certificate on the brand domain ranking in the top five for the company name.
- Add Organization + Service JSON-LD: right now there is no markup at all.
- Generate sitemap.xml and fill the empty robots.txt.
Can you trust this audit?
Honesty question #1: we have no access to GA4 / GSC / CRM / admin — and we never contacted the company. So every conclusion about enquiries is friction + visibility risk (directional), not a proven loss of money. We audit what is observable from the public site, a live browser and open SERP data. While access is closed, the report honestly carries the T1 (browser-only) scope.
| Check | State | What it means |
|---|---|---|
| Public site + journey | OBSERVED | All 17 pages and 5 articles walked in a live Chromium — navigation, forms and CTAs reproduced. |
| Structure & schema (rendered DOM) | OBSERVED | JSON-LD, canonical, robots, sitemap and headings checked in the rendered DOM, not in curl. |
| Rankings and demand | OBSERVED | 8 core queries via SerpApi (Google UA, Ukrainian) + the domain's ranked keywords via DataForSEO Labs. |
| TLS certificates of the brand's domains | OBSERVED | openssl s_client against each host — validity dates recorded. |
| Real on-site conversion (GA4) | NO ACCESS | We see the friction but not its price. |
| Lead volume and quality (CRM) | NO ACCESS | How many enquiries the phone and Telegram produce is unknown. |
| Search Console metrics | NO ACCESS | Index coverage estimated from the outside, via site: and ranked keywords. |
Once access opens, this same report is promoted to T2 scope and every «directional» is re-scored as measured. We do not rewrite conclusions after the fact: we add numbers to them.
The company's state at a glance.
The headline conclusion (directional): the site is built with care — it is fast, responsive, has honest legal pages and working analytics. And yet it is invisible to the market and unreadable to machines. The company invested in presentation and did not invest in the two layers that bring enquiries: visibility against real demand (zero rankings, zero structured data) and brand entity (three domains, one of them serving an expired certificate in the top five for the company's own name). The consequence is predictable: the search engine knows this company as an employer — through job-board vacancies — rather than as a supplier.
Six layers where the service loses enquiries.
The composite 37/100 is a rubric score (T1, browser-only): the weighted mean of six layers at T1 weights (Lead capture 25 · Visibility 25 · Entity 15 · Content 15 · Technical 10 · Measurement 10). Below is each layer's score and its key findings.
- No email address anywhere on the site — phone or Telegram only (LEAD-01).
- Forms submit through the builder's default handler: no
action, method GET, no email field (LEAD-02). - No contacts page in the menu and no
<address>markup (LEAD-03). - No pricing, no SLA, no description of the process — what B2B looks for before a call (LEAD-04).
- Email addresses on the site: 0.
- Form fields: 5 + 8 hidden UTM.
- Thank-you page after submission: none.
- Phone numbers: 2, neither with NAP markup.
- 0 of 8 core commercial queries in the top 30 (VIS-01).
- 16 keywords in the index, and none describes the service (VIS-02).
sitemap.xml→ 404;robots.txt→ 200 but 0 bytes (VIS-03, VIS-04).- 12 service pages carry an English
<title>above Ukrainian copy (VIS-07).
- Ranking on core queries: outside the top 30 (8 of 8).
- Ranked keywords: 16.
- #1 for an irrelevant English query (140/month).
- Pages with a description and a canonical: 0 / 18.
- An expired TLS certificate on a brand domain ranking in the top five for the company name (GEO-02).
- 0 JSON-LD blocks across 18 pages (GEO-01).
- Three brand hosts with no
sameAs— the entity never fuses (GEO-03). - Off-site mentions are job boards: the machine knows the company as an employer (GEO-04).
- Brand domains: 3; linked by markup: 0.
- Certificate expired 20 days ago.
- Knowledge Panel: none.
- AI Overview on the queries: 8 of 8; brand citations: 0.
- The only
<h1>on an article is the cookie banner; the title is an<h2>(CNT-01). - No dates, no authors, no
Articlemarkup (CNT-02). - Slugs are inconsistent:
blog-post-8beside a whole sentence run into one string (CNT-03). - The copy itself is written by someone who knows the subject — there is a base to grow from.
- Articles: 5; with a date or an author: 0.
- Text as a share of the markup: 4.3%.
- Article meta description: four words.
ArticleJSON-LD: 0.
- The transport layer is done right: HTTP/2, Brotli, HSTS, correct 301s.
- 0 of 18 pages carry a canonical or a description (VIS-05, VIS-06).
- 146 of 158 images lack
width/height(TEC-01). - Two
<h1>s on the homepage: the cookie banner and the hero (TEC-02).
- Markup: 378 KB → 60 KB (Brotli).
- DOM nodes: 4,789.
- LCP 813 ms · CLS 0.00 (lab).
- Pages in the
site:result: ~31.
- GA4, GTM and Microsoft Clarity are installed and firing.
- The privacy policy and terms of service are in place.
- No CrUX field data — too little traffic for Chrome to gather it.
- No email is offered for data-deletion requests.
- Analytics systems: 3.
- CrUX: no data.
- Legal pages: 2.
- Cookie banner: present.
- HTTP/2 + Brotli: 60 KB instead of 378 KB — compression is configured correctly.
- HSTS plus 301s from http and from www to the canonical host.
- LCP 813 ms, CLS 0.00 (lab, desktop) — speed is not the problem here.
- webp/avif instead of png/jpg on 150 of 158 images.
- GA4 + GTM + Clarity are alive; the policy and terms are in place.
- Speed: there is nothing to optimise — the numbers are already healthy.
- Compression and HSTS: configured correctly, do not rework them.
- Image formats: webp/avif are already in place.
- Do not move the analytics — it works and it is collecting data.
- Do not break the service structure or the navigation: they are clear.
24 findings — each with its evidence.
Every finding = layer + observation (query → page → artifact) + severity. Roadmap buckets (§7): P0/P1 → Fix this week/month · P2 → Test/validate · P3 → Backlog.
| # | Layer | Finding (observation) | Sev. |
|---|---|---|---|
| VIS-01 | Visibility | Across eight core commercial queries (Google UA, Ukrainian) the site does not appear in the top 30 for a single one. SerpApi measurement, 2026-07-09. | P0 |
| VIS-02 | Visibility | The domain ranks for just 16 keywords (DataForSEO Labs, Ukraine/Ukrainian). None of them describes the service the company sells. | P0 |
| GEO-01 | Entity | Not one of the 18 crawled pages carries a JSON-LD block. Zero Organization, Service, FAQPage, Article. | P0 |
| GEO-02 | Entity | The second brand domain sits in the top five for the company name and serves an expired TLS certificate (20 days past expiry) — the browser shows a security warning. | P0 |
| CNT-01 | Content | In the rendered DOM of an article the only <h1> is the cookie banner heading; the article title is marked up as an <h2>. | P0 |
| VIS-03 | Visibility | sitemap.xml returns 404. No sitemap exists, neither generated nor hand-written. | P1 |
| VIS-04 | Visibility | robots.txt answers 200 but is zero bytes: no directives, no sitemap reference. | P1 |
| VIS-05 | Visibility | Not one of the 18 pages has a meta description. The articles do have one — four words long. | P1 |
| VIS-06 | Visibility | Not one of the 18 pages has a canonical. | P1 |
| VIS-07 | Visibility | 12 service pages carry an English <title> («Cloud infrastructure», «Cybersecurity») above entirely Ukrainian H1s and copy. | P1 |
| GEO-03 | Entity | The brand is stretched across at least three hosts; sameAs and Organization are absent, so a search engine has nothing to fuse them into one entity with. | P1 |
| GEO-04 | Entity | The brand's off-site mentions in the top 10 are predominantly job boards and vacancy pages. The machine classifies the company as an employer, not a supplier. | P1 |
| CNT-02 | Content | Articles carry no publication date, no author and no Article markup — the three signals AI answer engines use to decide whether to cite a source. | P1 |
| LEAD-01 | Lead | There is no email address anywhere on the site. Contact is by phone or Telegram only. | P1 |
| GEO-05 | Entity | All eight queries we checked return an AI Overview. The brand is cited in none of them. | P2 |
| GEO-06 | Entity | The company's sibling domain carries JSON-LD; the flagship does not. The entity signals contradict each other. | P2 |
| CNT-03 | Content | Article slugs are inconsistent: placeholder blog-post-8 and blog-post-9 sit next to a whole sentence run together into one string. | P2 |
| LEAD-02 | Lead | Forms submit through the site builder's default handler: no action, method GET, no email field. Fields: name, role, contact method, phone, telegram. | P2 |
| LEAD-03 | Lead | There is no contacts page in the navigation and no <address> markup. Two phone numbers are plain text, with no NAP markup. | P2 |
| LEAD-04 | Lead | There is no pricing, no SLA and no «how we work» page — the three things a B2B buyer looks for before the first call. | P2 |
| TEC-01 | Technical | 146 of 158 homepage images lack width/height; the DOM holds 4,789 nodes. | P2 |
| TEC-02 | Technical | The homepage carries two <h1>s: the cookie banner and the hero. The banner comes first in DOM order. | P3 |
| CNT-04 | Content | A typo in an H2 on the cybersecurity page: two words run together into one. | P3 |
| CNT-05 | Content | Text accounts for 4.3% of the markup (6,500 characters of text inside 152 KB of HTML). | P3 |
Where hot demand fails to find a supplier.
Eight queries a B2B buyer uses to look for exactly these services. Checked via SerpApi: Google UA, Ukrainian, desktop, 2026-07-09. Competitors anonymized.
| Search query | Site's position | Who holds the top 3 | AI Overview |
|---|---|---|---|
| IT support outsourcing | not in top 30 | 3 niche competitors | yes |
| IT outsourcing Kyiv | not in top 30 | 3 niche competitors | yes |
| IT infrastructure audit | not in top 30 | 2 competitors + Big-4 consultancy | yes |
| cloud server rental | not in top 30 | 3 hosting providers | yes |
| cybersecurity for business | not in top 30 | government portal + media | yes |
| outsourced IT department | not in top 30 | 3 niche competitors | yes |
| private cloud for business | not in top 30 | 3 cloud providers | yes |
| company data backup | not in top 30 | encyclopaedia + 2 vendors | yes |
Eight out of eight are outside the top 30. Eight out of eight carry an AI Overview, and the brand is cited in none. Which means that even where the demand exists, someone else is writing the answer the buyer reads.
| Keyword | Position | Volume/month | Relation to the services |
|---|---|---|---|
| an English technical query | 1 | 140 | none |
| the company's own name | 1 | 70 | brand |
| a similarly-spelled foreign tech media brand | 38 | 390 | none (brand confusion) |
| generic «IT companies» | 32–54 | 210 | very weak |
Sixteen keywords in all. The domain does exist in the index — it just attracts the wrong people.
Three AI systems. One result.
We put your real commercial queries to three AI systems live — Perplexity (sonar API), Gemini 2.5 Flash with Google Search grounding, and Claude with web search — and recorded whether they cite your domain. ChatGPT has no citation API, so it is absent here — an honest boundary, not a gap.
| Query (of 7 commercial) | Perplexity | Gemini | Claude |
|---|---|---|---|
| IT support outsourcing | — | — | — |
| IT infrastructure audit | — | — | — |
| cloud server rental | — | — | — |
| cybersecurity for business | — | — | — |
| outsourced IT department | — | — | — |
| company data backup | cited | cited | — |
| private cloud for business | — | — | — |
21 probes (7 queries × 3 systems): cited twice. The only exception is «data backup» (Perplexity + Gemini). On the rest, the AIs recommend niche competitors, industry directories and consultancies — not you. On the brand query all three do find you, but alongside a sibling domain and job boards (the same stretched entity, §2③).
Bot access — this part is actually fine.
Before it can cite you, an AI has to read you. We requested the homepage and an inner page with each bot's User-Agent, live. This is a rare green layer: the site is open to all of them.
| Bot | Home | Page | State |
|---|---|---|---|
| Googlebot | 200 | 200 | ok |
| GPTBot (OpenAI training) | 200 | 200 | ok |
| OAI-SearchBot (ChatGPT search) | 200 | 200 | ok |
| ChatGPT-User | 200 | 200 | ok |
| PerplexityBot | 200 | 200 | ok |
| ClaudeBot | 200 | 200 | ok |
All six bots receive live HTML — there is no retrieval blocker. So the cause of the invisibility (§4b) is not access: there is simply nothing to read. Zero structured data and a stretched entity (§2③) give the AIs no reason to cite you. That is good news — it is fixed with content, not by unblocking.
Where the drop-off really is.
Without GA4 we do not have real step-to-step rates — so we show the observable friction at each step and flag explicitly where the risk is greatest. This is a directional map, not a measured funnel.
| Step | Observable friction | Risk rating |
|---|---|---|
| Search → site | The drop-off happens before the site: for core queries the site is not in the top 30. | CRITICAL |
| Company name → site | The second brand domain, ranking in the top five, serves a browser warning about an insecure connection. | CRITICAL |
| Home → service page | Works: the navigation is clear, the services are separated, the copy is to the point. | LOW |
| Service page → form | A CTA is present on every page and the form opens without a hitch. | LOW |
| Form → submission | No email field; required fields are not marked; no thank-you page exists. | MEDIUM |
| Outside the form | No email address anywhere on the site: phone and Telegram only. In B2B that cuts off settling things over email. | HIGH |
| Before the call | No pricing, no SLA, no description of the process — the buyer cannot prepare for the conversation. | MEDIUM |
The biggest hole is not in the form. It sits before the site: the buyer either never finds the company, or finds it and walks into a browser warning.
Three findings ready to ship.
The §4 methodology format: Problem → Evidence → Recommendation → Acceptance criteria. Ready to hand to a developer.
1 · Expired certificate on a brand domain
GEO-02 · P0 · entity · devops2 · Entity: Organization + Service + sameAs
GEO-01 / GEO-03 · P0 · entity · frontend3 · Title, description, canonical, sitemap
VIS-03…07 · P1 · visibility · seoWin the visibility back first, then go deeper.
Four buckets by rubric priority (severity × scope × confidence × effort). No promises of «+X% enquiries» — only directional mechanics.
Fix this week (P0)
Reissue the brand domain's certificate (GEO-02). Add Organization + Service JSON-LD (GEO-01). Generate sitemap.xml and populate robots.txt (VIS-03/04). Take the <h1> away from the cookie banner and give it back to the articles (CNT-01). These are the cheapest actions with the greatest leverage.
Fix this month (P1)
Ukrainian titles + descriptions + canonicals on all 18 pages (VIS-05/06/07). Dates, authors and Article markup on the posts (CNT-02). An email address, and an email field in the form (LEAD-01/02). A sameAs that ties the three brand domains together (GEO-03).
Test & validate (P2)
A contacts page, pricing/SLA, a «how we work» page (LEAD-03/04). Rewrite the article slugs and 301 the old ones (CNT-03). Content against the eight core queries — one page per cluster. Record baseline rankings and re-measure in 60 days.
Backlog (P3)
width/height on images, a smaller DOM (TEC-01/02). Fix the typo (CNT-04). Work on off-site mentions so the brand stops being «only an employer» in the machine's picture of the world.
The order is not arbitrary: while the site cannot be found and cannot be read by machines, there is simply nobody to show an improved enquiry form to.
Post-audit monitoring — within an agreed scope.
An audit is a snapshot taken on a defined date. If ongoing monitoring is in scope, we agree the data sources, checks, cadence, and alert route. The platform records exceptions for the manager; an accountable specialist applies material changes.
Entity and certificates
A certificate on any brand domain is nearing expiry · a new host appeared without sameAs · Organization vanished from the homepage · the brand dropped out of AI Overviews.
Visibility and indexation
sitemap.xml stopped responding · a canonical broke · a title was replaced with an English one · a page fell out of the index · a ranking on a core keyword slipped.
Enquiries and content
The form stopped submitting · the email address disappeared · an article lost its h1 or its date · a page shipped without a description.
Coverage + validation.
| What | Coverage (sampling rule) |
|---|---|
| Site pages | all 17 public URLs: home · 12 service pages · blog hub · privacy · terms ×2 |
| Blog articles | all 5 that existed at the time of the audit |
| Rendering | live Chromium: DOM, headings, forms, cookie banner, third-party scripts |
| Search demand | 8 core commercial queries (Google UA, Ukrainian, desktop) + the domain's ranked keywords |
| Brand domains | 3 hosts: TLS, redirects, presence of schema, cross-links |
| Transport | HTTP/2, Brotli/gzip, HSTS, 301s from http and www, response headers |
- live Chromium (rendered DOM, performance trace, LCP/CLS)
- curl + openssl s_client (headers, redirects, TLS dates)
- SerpApi — rankings, AI Overview, brand SERP
- DataForSEO Labs — the domain's ranked keywords
- CrUX — checking whether field data exists at all
- Every finding was captured as an artifact: a command, a server response, a DOM snapshot.
- An independent reviewer then reproduced it from scratch.
- Findings that could not be reproduced never entered the report.
- Validation status: PASS.