Scan Results
Here is what we found for thevocket.com. Review the checks below and take action on anything flagged in red.
Overall Score: 85/100
Great job! Your website covers most of the fundamentals. There are still a few areas worth improving.
Fix these first
The changes that raise your score and lower your risk the most, in order.
Website Preview
Capturing screenshot…
Google SERP Preview
This is how your page may appear in Google search results.
https://thevocket.com
AI Readiness
Who can read this page for AI search, AI answers and model training. Blocking training does not remove you from AI search; blocking the search crawlers does.
| Crawler | Used for | robots.txt | Firewall test |
|---|---|---|---|
| AI search and answers | |||
| OAI-SearchBotOpenAI | ChatGPT search index | Allowed | Testing… |
| Claude-SearchBotAnthropic | Claude search index | Allowed | Not tested |
| PerplexityBotPerplexity | Perplexity search index | Allowed | Testing… |
| GooglebotGoogle | Google Search, AI Overviews and AI Mode | Allowed | Not tested |
| BingbotMicrosoft | Bing, Copilot and partners using the Bing index | Allowed | Not tested |
| ApplebotApple | Siri and Spotlight suggestions | Allowed | Not tested |
| DuckAssistBotDuckDuckGo | DuckDuckGo AI answers | Allowed | Not tested |
| Reading a page for a user | |||
| ChatGPT-UserOpenAI | ChatGPT reading a page for a user | Allowed | Testing… |
| Claude-UserAnthropic | Claude reading a page for a user | Allowed | Not tested |
| Perplexity-UserPerplexity | Perplexity reading a page for a user | Allowed | Not tested |
| Model training | |||
| GPTBotOpenAI | OpenAI model training | Allowed | Testing… |
| ClaudeBotAnthropic | Anthropic model training | Allowed | Testing… |
| Google-ExtendedGoogle | Gemini training and grounding (token only) | Allowed | Not tested |
| Applebot-ExtendedApple | Apple Intelligence training (token only) | Allowed | Not tested |
| meta-externalagentMeta | Meta AI training | Allowed | Not tested |
| CCBotCommon Crawl | Open dataset used by many AI labs | Allowed | Not tested |
| BytespiderByteDance | ByteDance model training | Allowed | Not tested |
| AmazonbotAmazon | Alexa answers and Amazon AI | Allowed | Not tested |
The firewall test requests the page with each crawler's user agent from our server and compares the answer with a normal browser. A firewall that checks crawlers' published IP addresses may treat the real crawler differently.
Structured Data
Schema.org markup found on this page, checked against the properties Google requires for each search feature.
Search feature: Organization logo and knowledge panel details
Recommended to add: description
Search feature: Site name in search results
Recommended to add: alternateName
The sitelinks search box (SearchAction) was retired by Google in November 2024. It is harmless but no longer used.
Verify with Google's Rich Results Test or the Schema Markup Validator.
WordPress Detected
Login page is hidden or restricted. Good security practice.
User enumeration via REST API is blocked. Good.
XML-RPC enables brute-force and DDoS amplification attacks. Disable with add_filter('xmlrpc_enabled', '__return_false') or block in .htaccess.
Remove unnecessary head links: remove_action('wp_head', 'rsd_link'), remove_action('wp_head', 'wlwmanifest_link'), remove_action('wp_head', 'wp_oembed_add_discovery_links')
WordPress detected from page source. Version and theme details are hidden.
Email & DNS
Whether mail from your domain reaches the inbox and whether others can send email pretending to be you.
TLS & Certificate
Certificate lifetimes are shrinking: 200 days since 15 March 2026, 100 days from 15 March 2027 and 47 days from 2029. Renewal must be automatic.
Domain Information
CDN & Infrastructure
Cloudflare edge (2606:4700::6812:a0a)
cloudflare
detected in HTML
detected in HTML
detected in HTML
PageSpeed Insights
Powered by Google Lighthouse. Scores are out of 100.
Industry Fit
What customers and regulators expect from a site in your industry, including Malaysian rules (PDPA, e-commerce disclosure, agent registration). These are disclosure signals, not legal advice, and they do not change the overall score.
44/100 industry fit for E-commerce
- Phone and email visible
Show both a phone number and an email address so customers and regulators can reach you.
- Privacy policy linked
No privacy policy link found. Any site that collects names, emails or phone numbers needs one.
- Business registration number shown
Registration number found (201801043651). Malaysian businesses are expected to show their SSM number on their website.
- Privacy notice in Bahasa Melayu and English
No privacy notice found. PDPA section 7(3) requires a written notice in both Bahasa Melayu and English.
- WhatsApp click-to-chat
No wa.me link found. Most Malaysian customers expect to reach a business on WhatsApp.
- Seller disclosure (CPETTR 2024)
Malaysia's Consumer Protection (Electronic Trade Transactions) Regulations 2024 require online sellers to show their name, registration number, email, phone and address. Missing on this page: email.
- Refund or return policy
No refund or return policy link found. Shoppers and payment gateways expect one before checkout.
- Shipping or delivery policy
No shipping or delivery policy link found.
- Product markup with price and currency
No valid Product markup on this page. If this is the homepage, check a product page: each needs Product schema with offers to show price and stock in Google.
- Payment options
No payment gateway scripts detected on this page (they often load only at checkout).
- Organization schema with logo and profiles
Organization markup found. Missing: description.
39/100 industry fit for Local business, clinic or F&B
- Phone and email visible
Show both a phone number and an email address so customers and regulators can reach you.
- Privacy policy linked
No privacy policy link found. Any site that collects names, emails or phone numbers needs one.
- Business registration number shown
Registration number found (201801043651). Malaysian businesses are expected to show their SSM number on their website.
- Privacy notice in Bahasa Melayu and English
No privacy notice found. PDPA section 7(3) requires a written notice in both Bahasa Melayu and English.
- WhatsApp click-to-chat
No wa.me link found. Most Malaysian customers expect to reach a business on WhatsApp.
- LocalBusiness markup
No LocalBusiness markup (or a subtype such as Dentist or Restaurant). It helps Google and AI assistants answer "near me" questions with your address and hours.
- Tap-to-call phone link
No tel: link. Most local searches happen on phones; make the number tappable.
- Opening hours shown
Opening hours were not found in the page text.
- Map or directions link
No Google Maps or Waze link found.
- Reviews shown
No reviews widget found. Showing Google reviews builds trust with first-time visitors.
- Other languages
Only one language detected. In Malaysia, Bahasa Melayu and Chinese versions widen your reach.
- Organization schema with logo and profiles
Organization markup found. Missing: description.
59/100 industry fit for Finance, broker or fintech
- Phone and email visible
Show both a phone number and an email address so customers and regulators can reach you.
- Privacy policy linked
No privacy policy link found. Any site that collects names, emails or phone numbers needs one.
- Business registration number shown
Registration number found (201801043651). Malaysian businesses are expected to show their SSM number on their website.
- Privacy notice in Bahasa Melayu and English
No privacy notice found. PDPA section 7(3) requires a written notice in both Bahasa Melayu and English.
- WhatsApp click-to-chat
No wa.me link found. Most Malaysian customers expect to reach a business on WhatsApp.
- Risk warning
No risk warning found. Brokers and investment platforms are expected to show one on every page, usually in the footer.
- Regulator named
No regulator named. State which authority licenses you (for example Labuan FSA or the Securities Commission Malaysia).
- Licence number shown
No licence number found. Show it next to the regulator name so clients can verify it.
- Complaints procedure
A complaints or dispute page is linked.
- Secure login and platform links
All login and trading platform links use HTTPS.
- HSTS enforced
Strict-Transport-Security is set with a long max-age.
- Legal entity in markup
Adding legalName to Organization markup ties the brand to the licensed entity for search engines and AI assistants.
50/100 industry fit for SaaS or software
- Phone and email visible
Show both a phone number and an email address so customers and regulators can reach you.
- Privacy policy linked
No privacy policy link found. Any site that collects names, emails or phone numbers needs one.
- Business registration number shown
Registration number found (201801043651). Malaysian businesses are expected to show their SSM number on their website.
- Privacy notice in Bahasa Melayu and English
No privacy notice found. PDPA section 7(3) requires a written notice in both Bahasa Melayu and English.
- WhatsApp click-to-chat
No wa.me link found. Most Malaysian customers expect to reach a business on WhatsApp.
- SoftwareApplication markup
No SoftwareApplication markup. It can show price and rating for your app in Google.
- Pricing page
A clear pricing page is one of the most-cited pages for software in AI answers.
- Status page
No status page linked. Customers and AI assistants look for one when checking reliability.
- security.txt
No /.well-known/security.txt. Enterprise buyers check for a vulnerability disclosure contact.
- Documentation and llms.txt
For product documentation, an llms.txt index helps coding assistants such as Claude Code and Cursor find the right pages.
- Terms of service
Terms are linked.
50/100 industry fit for Education
- Phone and email visible
Show both a phone number and an email address so customers and regulators can reach you.
- Privacy policy linked
No privacy policy link found. Any site that collects names, emails or phone numbers needs one.
- Business registration number shown
Registration number found (201801043651). Malaysian businesses are expected to show their SSM number on their website.
- Privacy notice in Bahasa Melayu and English
No privacy notice found. PDPA section 7(3) requires a written notice in both Bahasa Melayu and English.
- WhatsApp click-to-chat
No wa.me link found. Most Malaysian customers expect to reach a business on WhatsApp.
- Educational organization markup
No EducationalOrganization (or School / CollegeOrUniversity) markup.
- Course markup
No Course markup on this page. Add it to programme pages to appear in course carousels.
- Accreditation shown
Accreditation or ministry approval is mentioned.
- Admissions or apply link
No clear apply or admissions link found.
42/100 industry fit for Real estate
- Phone and email visible
Show both a phone number and an email address so customers and regulators can reach you.
- Privacy policy linked
No privacy policy link found. Any site that collects names, emails or phone numbers needs one.
- Business registration number shown
Registration number found (201801043651). Malaysian businesses are expected to show their SSM number on their website.
- Privacy notice in Bahasa Melayu and English
No privacy notice found. PDPA section 7(3) requires a written notice in both Bahasa Melayu and English.
- WhatsApp click-to-chat
No wa.me link found. Most Malaysian customers expect to reach a business on WhatsApp.
- Agent registration number
No REN, PEA or E (1) firm number found. Malaysian estate agents and negotiators registered with BOVAEA should show it in ads and listings.
- Agency markup
No RealEstateAgent markup.
- Listing markup
No listing markup on this page (RealEstateListing or Residence with Offer). Add it to individual listing pages.
- Map or location
No map embed or link found.
- WhatsApp click-to-chat
No wa.me link found. Most Malaysian customers expect to reach a business on WhatsApp.
64/100 industry fit for Corporate or other
- Phone and email visible
Show both a phone number and an email address so customers and regulators can reach you.
- Privacy policy linked
No privacy policy link found. Any site that collects names, emails or phone numbers needs one.
- Business registration number shown
Registration number found (201801043651). Malaysian businesses are expected to show their SSM number on their website.
- Privacy notice in Bahasa Melayu and English
No privacy notice found. PDPA section 7(3) requires a written notice in both Bahasa Melayu and English.
- WhatsApp click-to-chat
No wa.me link found. Most Malaysian customers expect to reach a business on WhatsApp.
- Organization schema with logo and profiles
Organization markup found. Missing: description.
- About page
An about page tells customers and AI assistants who is behind the business.
- Terms of use
Terms are linked.
Detailed Analysis
SEO
Search engine optimisation checks
Page Title
Title: "VOCKET | Portal Berita, Hiburan, Teknologi, Fesyen & Kreativiti" (63 chars). Too long, may be truncated in search results. Aim for 50-60 characters.
Meta Description
Description (107 chars). Too short. Aim for 140-160 characters for full SERP visibility.
H1 Heading
No H1 heading found. Every page should have exactly one H1 for SEO.
Image Alt Attributes
4 of 27 images are missing alt attributes.
Canonical URL
Canonical tag found. This helps prevent duplicate content issues in search engines.
Robots Noindex Check
No noindex directive found, so your page is eligible for Google indexing.
URL Length
URL is 21 characters. Good. Short URLs are easier to share and rank better in search.
Content Length
2003 words detected. Good content length, enough for search engines to understand and rank the page.
Schema.org Structured Data
Valid structured data eligible for: Organization logo and knowledge panel details and Site name in search results. Types found: Place, Organization, WebSite and CollectionPage.
Hreflang Tags
No hreflang tags found. If your site targets multiple languages or regions, add hreflang tags to avoid duplicate content issues across locales.
Noindex Header Test
No noindex directive in HTTP headers (X-Robots-Tag). The server is not blocking indexing via response headers.
Robots.txt
robots.txt file found with valid directives. This file controls which parts of your site search engines can crawl.
Blocked by Robots.txt
This page is NOT blocked by robots.txt. Search engines are free to crawl and index it.
XML Sitemap
XML sitemap found at /sitemap_index.xml. Consider referencing it in your robots.txt for better discovery.
WWW Redirect Consistency
Both www and non-www versions resolve. www.thevocket.com correctly redirects to thevocket.com.
AI Readiness
How AI search engines and assistants can read and cite this page
AI Search Crawler Access
robots.txt lets the AI search and answer crawlers (ChatGPT search, Claude, Perplexity, Google AI Overviews, Bing Copilot) read this page. Training crawlers blocked: 0 of 8. Blocking training is a business choice and does not affect AI search.
AI Crawler Firewall Test
Testing whether your firewall lets AI crawlers in…
AI Usage Preferences
Content Signals declared in robots.txt: search=yes, ai-input=yes, ai-train=no. These lines state whether content may be used for search, AI answers (ai-input) and AI training (ai-train). Cloudflare's Content Signals is in use today; the IETF AI Preferences standard is still a draft, so treat both as statements of intent that crawlers may ignore.
Snippet Controls
No snippet restrictions. The page can be quoted in search results and cited in AI Overviews.
llms.txt
No /llms.txt. It is optional: Google says its search and AI features do not use it, and server logs show the big AI crawlers rarely fetch it. It does help AI coding assistants and documentation tools, and Lighthouse 13.3 now audits it.
# Company Name, a one-line > summary, then sections of Markdown links to your key pages. See llmstxt.org. Content Without JavaScript
2003 words are present in the HTML itself, so crawlers that do not run JavaScript still see your content.
Answer-Ready Structure
3 of 6 signals that make a page easy to quote and attribute. Present: lists or tables, an about or author link and 4 sameAs profile links. Missing: a heading order without skipped levels (3 skips found), question-style headings and a visible publish or update date.
sameAs. WebMCP Agent Tools
No WebMCP tools. WebMCP is an experimental Chrome API that lets a page offer actions (search, book, add to cart) to AI agents in the browser. Lighthouse 13.3 has started auditing it. Worth watching, not yet worth building for most sites.
Security
Security and safety checks
HTTPS / SSL Certificate
Your site uses HTTPS, which is good for security and Google rankings.
Security Headers
2 of 4 core headers set: HSTS, X-Content-Type-Options. Missing: Content-Security-Policy, Clickjacking protection. Recommended extras not set: Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy.
X-Content-Type-Options: nosniff, Content-Security-Policy: frame-ancestors 'self' (replaces X-Frame-Options) and Strict-Transport-Security: max-age=31536000; includeSubDomains. Content-Security-Policy
No Content-Security-Policy. A CSP is the main browser defence against injected scripts (XSS), card-skimming code and malicious redirects.
default-src 'self'; script-src 'self' 'nonce-RANDOM'; object-src 'none'; base-uri 'self'; frame-ancestors 'self', fix what it reports, then enforce it. Use nonces or hashes instead of 'unsafe-inline'. HSTS Policy
HSTS is set for 365 days, including subdomains.
Server Technology Exposure
No server technology or version information is leaked in HTTP headers.
Permissions-Policy
No Permissions-Policy header. Third-party scripts could access browser features like camera, microphone, or geolocation without restriction.
Referrer-Policy
No Referrer-Policy set. The browser will send the full URL as referrer to third-party sites, potentially leaking private URLs or query strings.
Google Safe Browsing
Checking Google Safe Browsing…
VirusTotal Reputation
Checking VirusTotal threat intelligence…
Malware & Suspicious Code
No common malware indicators found in the page source. No hidden iframes, obfuscated scripts, crypto miners, or suspicious redirects detected.
Cookie Security
All cookies have proper security attributes, or no cookies were set on initial load.
Mixed Content
No mixed content detected. All resources load over HTTPS.
JS Library Versions
No outdated JavaScript libraries detected in page source.
Staging / Debug References
No staging, development, or debug references found in page source.
security.txt
No /.well-known/security.txt. Security researchers who find a problem on your site have no published way to tell you.
/.well-known/security.txt with Contact: mailto:security@yourdomain and Expires: 2027-12-31T23:59:59Z. Generator: securitytxt.org. Exposed Sensitive Files
None of the 13 commonly leaked files are publicly readable (.env, .git, backups, database dumps, phpinfo, admin tools).
Certificate Expiry & Renewal
Testing the TLS connection…
TLS Protocol Versions
Testing the TLS connection…
Email & DNS
Email authentication and DNS records for your domain
SPF Record
Looking up DNS records…
DMARC Policy
Looking up DNS records…
DKIM Signing
Looking up DNS records…
CAA Record
Looking up DNS records…
Performance
Speed and delivery checks
Server Response Time
Your server responded in 0.4s. Excellent response time.
HTML Page Size
HTML size is 245 KB, which is lightweight and fast to download.
Gzip / Brotli Compression
Compression is enabled, so pages are served compressed to reduce transfer size.
Cache Headers
Caching is active: Cache-Control: public, max-age=300. Expires: Sun, 08 Nov 2026 19:15:28 GMT. Last-Modified present. CF-Cache-Status: MISS.
China Firewall Compatibility
Server location: Canada. Your site loads 9 resource(s) that may be blocked in China: Google Fonts, Google Tag Manager, YouTube, Facebook, Facebook SDK, Twitter / X, Instagram, WordPress.com (Jetpack), WordPress.com Stats. If you need to reach visitors in mainland China, these may need to be replaced. <a href="/whatsapp?service=china-web-performance">Contact us</a> for a China compatibility audit.
HTTP/2 & HTTP/3
Served over HTTP/2. HTTP/3 is not advertised.
Image Dimensions
1 of 27 images have no width and height attributes. The browser cannot reserve their space, so content jumps as they load (Cumulative Layout Shift).
Third-Party Scripts
8 external script hosts: pagead2.googlesyndication.com, securepubads.g.doubleclick.net, media.innity.net, static.chartbeat.com, xhr.invl.co, pcto.revmedia.my, stats.wp.com, releva.ai. Each adds DNS, connection and execution cost, and is code you do not control.
Mobile & UX
Mobile-friendliness and user experience
Viewport Meta Tag
Viewport meta tag is present, so your site should render properly on mobile devices.
Favicon
Favicon found. Your site has a browser tab icon.
Accessibility
Basics that screen readers and keyboard users depend on
Page Language
The page declares its language (lang="ms"), so screen readers use the right voice and search engines and AI tools detect the language reliably.
Form Labels
2 of 2 form fields have no label (2 rely on placeholder text, which disappears while typing). Screen reader users cannot tell what to enter.
<label for="id">, or an aria-label when a visible label does not fit the design. Link Names
2 link(s) have no text or accessible name, typically icon-only social or menu links. Screen readers announce them as just "link".
aria-label="Facebook" (or visually hidden text) to icon-only links. Trust & Legal
Pages and details visitors and regulators look for
Privacy Policy
No privacy policy link found. Any site with a contact form, analytics or ads collects personal data and needs one (PDPA in Malaysia, GDPR in Europe).
Terms of Use
Terms and conditions are linked.
Contact Details
Found: phone number and address or contact page. Missing: email address. Visible contact details are a trust signal for visitors, Google's quality raters and AI assistants answering "is this business legitimate?".
Copyright Year
No copyright year found (it may be added by JavaScript).
Cookie Consent
Tracking found (Meta Pixel) but no consent banner. Malaysian PDPA does not require a cookie banner, but GDPR and the UK rules do for EU and UK visitors. Fonts load from Google's servers, which shares visitor IP addresses with Google; self-hosting them avoids this under GDPR.
Social & Analytics
Social sharing and tracking
Open Graph Tags
Open Graph tags detected, so your page will display properly when shared on Facebook, LinkedIn, and WhatsApp.
Analytics Detection
Analytics detected: Google Tag Manager, Facebook Pixel.
Need help fixing these issues?
Our team can optimise your website for speed, SEO, security and AI search. Get a free consultation with no obligations.
FAQ
Website Scan FAQ
Common questions about our free website scanning tool.
Disclaimer: This scan is provided for informational purposes only and does not constitute professional security advice. XCII Technologies makes no warranties regarding the accuracy, completeness, or reliability of the results. Third-party data sources used in this report include:
- Domain & WHOIS data: sourced via the IANA RDAP Bootstrap service, with registry and registrar RDAP referral. Providers include MYNIC (.my domains), Google Registry (.app, .dev, .page, .new and other Google TLDs), Verisign, PIR (.org), Identity Digital, Aliyun, CNNIC (.cn domains), and individual registrar RDAP endpoints. Accuracy depends on the respective provider.
- PageSpeed Insights: performance, accessibility, best practices, and SEO audits are powered by Google PageSpeed Insights and Lighthouse. Results may vary between runs.
- Google Safe Browsing: threat detection data is provided by Google Safe Browsing. A clean result does not guarantee the site is free from all threats.
- VirusTotal: domain and IP reputation data is provided by VirusTotal (a Google subsidiary). Results reflect analysis from 70+ security vendors and may include false positives.
- WPScan Vulnerability Database: WordPress vulnerability data is provided by WPScan. Coverage depends on their database and may not include all known vulnerabilities.
- WPVulnerability Database: WordPress, PHP, Apache, and nginx vulnerability data is provided by WPVulnerability. This free, community-maintained database may not include all known vulnerabilities.
- WordPress.org & Envato: plugin and theme metadata is sourced from WordPress.org and Envato/CodeCanyon APIs.
- Joomla Extensions Directory: Joomla extension metadata is sourced from the Joomla Extensions Directory (JED). Not all extensions may be listed in JED.
- Server geolocation: IP-based server location data is provided by ip-api.com. Geolocation accuracy may vary.
- DNS records: SPF, DMARC, DKIM, CAA, MTA-STS and BIMI lookups use Google Public DNS and Cloudflare DNS over HTTPS. DKIM can only be checked for common selector names.
- HSTS preload status: provided by hstspreload.org.
- AI crawler and structured data checks: crawler rules follow each vendor's published robots.txt tokens. The firewall test sends requests with those crawlers' user agents from our own server. Structured data rules follow Google's Search Gallery as reviewed in October 2026.
- Industry and legal signals: references to the PDPA 2010, the Consumer Protection (Electronic Trade Transactions) Regulations 2024 and agent registration rules describe what the page shows. They are not legal advice.
XCII Technologies is not affiliated with any of the above services and is not responsible for the data they provide. Use this report at your own discretion.
Recent Scans
Recently Scanned Websites
See the latest websites scanned by our tool. Try scanning yours!