Every site Chan-Piu has built and deployed, tested on the same day with two free public instruments anyone can run: securityheaders.com, which grades the security instructions a site sends to your browser, and Google's PageSpeed Insights, which audits accessibility, best practices and search readiness. The readings are below, with a link beside each one so you can take it again yourself.
Scores in blue are what the instruments returned. The last column opens the same test against the live site, so the reading can be checked rather than trusted.
| Site | Headers | Access. | Best prac. | SEO | Run it yourself |
|---|---|---|---|---|---|
| SwiftMedia & TechThis site | A+ | 100 | 100 | 100 | HeadersPageSpeed |
| Sports GurusAfrica's home of sport | A+ | 100 | 100 | 100 | HeadersPageSpeed |
| Serengeti StudiosNairobi · Africa, US, UK | A+ | 100 | 100 | 100 | HeadersPageSpeed |
| Abidha DinUganda's MDRT pioneer | A+ | 100 | 100 | 100 | HeadersPageSpeed |
| SolodifiedReal people raps only | A+ | 100 | 100 | 100 | HeadersPageSpeed |
| Coffee SafarisEvery bean has a story | A+ | 100 | 100 | 100 | HeadersPageSpeed |
| Gaure MdeeJournalist & traveller | A+ | 100 | 100 | 100 | HeadersPageSpeed |
Headers: securityheaders.com grade for the home page. Access., Best prac. and SEO: Google PageSpeed Insights, mobile. Performance is left out on purpose — see section 04.
The same two instruments were run on 23 September, before a round of work on the client sites, and again on 25 September, after it. Two sites were already at the top on both instruments. The other five each had something the tests could see.
| Site | 23 September | 25 September | What changed |
|---|---|---|---|
| SwiftMedia & Tech | A+ / 100 / 100 / 100 | A+ / 100 / 100 / 100 | Already at the top on both instruments. Its own inline code was removed, and its security policy tightened, on 16 September. |
| Sports Gurus | A+ / 100 / 100 / 100 | A+ / 100 / 100 / 100 | Already at the top on both instruments. Separately, its article pages moved from a D to an A+ header grade on 24 September. |
| Serengeti Studios | A / 100 / 100 / 100 | A+ / 100 / 100 / 100 | The policy still allowed inline code, which caps the grade at A. 95 inline styles and 21 inline scripts were moved into files; the icon and animation libraries are now served from the site itself instead of a third-party network; the studio's videos moved to its own domain. |
| Abidha Din | A+ / 100 / 92 / 100 | A+ / 100 / 100 / 100 | The policy blocked an image the analytics service loads, and the audit logged the refusal as an error. The policy now names every host the analytics actually uses; the tracking snippets moved into a file; a page that answered every mistyped address with the home page now returns a real not-found. |
| Solodified | A+ / 100 / 92 / 100 | A+ / 100 / 100 / 100 | Two analytics services were being refused by the policy, logging errors. Their hosts were added, and eight per-script exceptions were retired as those scripts moved into files. |
| Coffee Safaris | A / 100 / 92 / 100 | A+ / 100 / 100 / 100 | 279 inline styles and 20 inline scripts were moved into files so the policy could drop its exceptions. The host's script-rewriting feature, which the audit tripped over, was instructed to leave the site's scripts alone. |
| Gaure Mdee | A+ / 96 / 96 / 100 | A+ / 100 / 100 / 100 | A footer link was distinguished by colour alone, which fails accessibility; it is now underlined. The film clips moved from a development address to the site's own domain, and the second clip now loads only when a visitor engages — see section 04. |
Each cell reads headers grade / accessibility / best practices / SEO. Amber marks the figure that moved.
Each site tells your browser exactly which sources it may load code, styles and media from, and nothing else. None of the seven carries the two exemptions scanners flag — permission to run code written into the page itself, or to evaluate code from text. To hold that line, every style and every script lives in its own file; no page carries inline script or inline style.
The hosting platform adds a header to every response saying any other website may read it. On a public site that exposes nothing that is not already public — it was removed because a header that cannot be justified should not be sent. It is one line in each site's configuration.
A mistyped address returns a real “not found” rather than quietly showing the home page, which search engines read as duplicate content. Every site publishes a security.txt, so anyone who finds a problem knows where to report it. Video is served from each site's own domain, not from a development address the host warns against using in production.
Before a release leaves, every page is loaded in a browser under its final security policy and every interactive part is exercised; old and new versions are compared pixel by pixel, and the release is expected to show no difference except the one intended. After it is deployed, the files the live site serves are checked against the files that were shipped, one by one.
Performance is not quoted. Google's performance score is a timing taken on a simulated slow phone, and it moves between runs of an unchanged page — in one test run for this practice, by 32 points between two runs seven minutes apart. A single performance figure says more about the moment of the test than about the site.
A reading is a date, not a promise. Gaure Mdee's site scored 100 for best practices on 24 September and 96 the next day, with nothing on the site changed. Google's test had begun downloading a 35 MB film clip meant for the page's second scene, and the download was cut off when the test ended — which the audit counts as an error. The clip now loads only once a visitor starts to scroll or tap, which also spares anyone on mobile data a film they may never reach. Re-read after the change: 100.
Some of what a site sends is added by its host. The hosting platform inserts a small bot-detection script into three of these sites as they are served. Their security policies refuse to run it, which leaves one line in the browser console. It does not affect the scores above and is disclosed here rather than hidden.
A header grade is not a security audit. The largest real risks to a website are rarely in its headers: a takeover of the hosting or domain account, email sent in the owner's name, a contact form flooded until real enquiries are buried. Those are covered in the security practice, and they are where an engagement starts.
Code is marked, not locked. Each site's scripts ship minified and obfuscated, as a mark of ownership and a deterrent to casual copying. Anything a browser runs can be read by the person running it; this is not protection, and it is not sold as protection.
Send the address of a site you run or are about to commission. Chan-Piu will run the same instruments against it and tell you what they found and what fixing it involves, before either of you commits to anything.