Bud Authority — Sentinel
Monthly Deep Audit · Unified Command Center
Download MD Download PDF ← Back to audits

Apex Sentinel — Firestorm Cultivation Monthly Audit

URL: https://firestormcultivation.com/

Platform: unknown

Archetype: fun

Run ID: 2026-04-19T06-18-18-831Z

Scanned: 2026-04-19T06:30:50.563Z

Duration: 585s

This is a monthly deep audit. The crawler performed a full-site scan including

Lighthouse performance, axe-core accessibility (WCAG 2.2 AA), cross-browser compatibility,

security headers, schema markup validation, and SEO best-practice checks.

Because this site is not a repository we control, Apex Sentinel **cannot automatically

apply fixes** — instead, each finding below includes an AI-generated plain-English

explanation + step-by-step recommended fix you can hand to a developer or execute

in your CMS directly.

Executive Summary

Overall grade: F

DimensionCountMeaning
Pages crawled22Full sitemap + linked pages
P0 (critical)1Site-down or compliance-breaking
P1 (urgent)3Significant revenue / SEO / UX impact
P2 (high)13Quality / ranking / trust degradation
P3 (medium)63Polish + optimization
"Do first" items4AI-flagged top priorities
Quick wins (< 30 min)50Fastest ROI items

Top 10 Actions (Ranked)

If you only have time for ten things this month, do these — in this order.

  1. [P0] 🔴 DO FIRST Sensitive artifact exposed: /wp-login.php — _Exposing your WordPress login page increases the risk of brute-force attacks that could compromise your site, customer data, and compliance records — critical for a licensed cannabis retailer._

Page: https://firestormcultivation.com/wp-login.php

Effort: Quick win (< 30 min)

  1. [P1] 🔴 DO FIRST 2 mixed-content references (http://) — _Broken images and security warnings reduce customer confidence, especially critical for a cannabis retailer where age verification and trust are paramount._

Page: https://firestormcultivation.com/

Effort: Moderate (1-3 hours)

  1. [P1] 🔴 DO FIRST A11y: Frames must have an accessible name (×2) — _Accessibility violations expose Firestorm to legal risk under the ADA and WCAG compliance standards, and exclude disabled customers from finding your dispensary location._

Page: https://firestormcultivation.com/

Effort: Quick win (< 30 min)

  1. [P1] 🔴 DO FIRST A11y: Links must have discernible text — _Visually impaired customers cannot navigate your site, reducing traffic and creating legal liability under the ADA; accessibility violations can trigger lawsuits and damage brand reputation._

Page: https://firestormcultivation.com/

Effort: Quick win (< 30 min)

  1. [P2] 🟠 HIGH Missing security header: strict-transport-security — _Missing HSTS weakens customer trust and compliance posture, especially critical for a cannabis retailer handling customer payment and compliance data; it also signals to search engines that your security practices may be incomplete._

Page: https://firestormcultivation.com/

Effort: Quick win (< 30 min)

  1. [P2] 🟠 HIGH Missing security header: x-frame-options — _Missing this header increases the risk of clickjacking attacks where users unknowingly interact with hidden elements on your site, potentially compromising account security or enabling unauthorized transactions—a serious liability for a licensed cannabis retailer._

Page: https://firestormcultivation.com/

Effort: Quick win (< 30 min)

  1. [P2] 🟠 HIGH Missing security header: content-security-policy — _Missing CSP lowers your security posture score, which can affect trust signals to customers and may impact SEO rankings for competitive cannabis keywords where Google favors secure sites._

Page: https://firestormcultivation.com/

Effort: Moderate (1-3 hours)

  1. [P2] 🟠 HIGH No SPF record on root domain — _Customers won't receive critical transactional emails like order confirmations or account recovery links, leading to lost sales, support tickets, and trust damage._

Page: https://firestormcultivation.com/

Effort: Quick win (< 30 min)

  1. [P2] 🟠 HIGH 22 tap targets under 44px at mobile-320 — _Visitors on phones will mis-tap buttons, abandon checkout flows, and bounce to competitors; customers also assume a site with poor mobile experience is unprofessional or unsafe._

Page: https://firestormcultivation.com/

Effort: Moderate (1-3 hours)

  1. [P2] 🟠 HIGH 21 tap targets under 44px at mobile-375 — _Small tap targets frustrate mobile visitors—they misclick, abandon checkout, and leave bad reviews. For a cannabis retailer, this directly cuts conversion on age-verified purchases and loyalty sign-ups, while exposing you to accessibility complaints._

Page: https://firestormcultivation.com/

Effort: Moderate (1-3 hours)

Findings by Severity

P0 — 1 finding

1. Sensitive artifact exposed: /wp-login.php

What it means (plain English)

Your WordPress login page (/wp-login.php) is publicly accessible and returns a successful response. This is a security risk because attackers can use automated tools to discover and target your admin login page, potentially attempting to gain unauthorized access to your site.

Why it matters for your business: Exposing your WordPress login page increases the risk of brute-force attacks that could compromise your site, customer data, and compliance records — critical for a licensed cannabis retailer.

Technical root cause: WordPress login pages are publicly accessible by default. Your site does not have firewall rules or server-level blocks preventing direct access to /wp-login.php.

Recommended fix — step by step

  1. Log in to your hosting control panel (cPanel, Plesk, or your host's dashboard) and locate the Web Application Firewall (WAF) or ModSecurity rules
  2. Add a rule to block direct access to /wp-login.php and /wp-admin/ from non-administrative IP addresses, or restrict to your office IP only
  3. If your host doesn't offer WAF, install the Wordfence Security plugin (free tier): WordPress Admin → Plugins → Add New → search 'Wordfence' → Install & Activate → Wordfence → Login Security → enable 'Limit Login Attempts'
  4. Alternatively, rename your WordPress login URL using a plugin like WPS Hide Login: Plugins → Add New → search 'WPS Hide Login' → Install & Activate → Settings → WPS Hide Login → change login slug to a custom path (e.g., /secure-admin-panel/)
  5. Test by visiting https://firestormcultivation.com/wp-login.php in an incognito browser — you should see a 403 Forbidden error or be redirected
  6. Request your hosting provider enable IP whitelisting for /wp-admin/ to restrict access to your office network only

P1 — 3 findings

1. 2 mixed-content references (http://)

What it means (plain English)

Your website is loaded over HTTPS (secure), but it's pulling 2 image files from an HTTP (insecure) URL. Modern browsers will block these resources or show security warnings to visitors, degrading trust and potentially breaking the visual appearance of your site.

Why it matters for your business: Broken images and security warnings reduce customer confidence, especially critical for a cannabis retailer where age verification and trust are paramount.

Technical root cause: The SVG files are hosted on an HTTP endpoint (ihm.nmi.mybluehost.me) instead of your HTTPS domain. This typically happens when assets were uploaded or linked before the site migrated to HTTPS, or when a CDN/backup service was misconfigured.

Recommended fix — step by step

  1. Log into your WordPress admin (usually yoursite.com/wp-admin).
  2. Go to Media Library and search for 'Arrow-3-1.svg' to locate the affected image.
  3. Note the current URL and delete this file.
  4. Re-upload the Arrow-3-1.svg file directly to your WordPress media library (Plugins → Add New, or upload via Media → Add New).
  5. Use Find & Replace (install the free 'Better Find and Replace' plugin if not available) to search for 'http://ihm.nmi.mybluehost.me' and replace all instances with 'https://firestormcultivation.com'.
  6. If you use a CDN or backup service, contact Bluehost support (vendor-escalate path: Bluehost account → Support → Chat) to disable the alternate domain and ensure all assets redirect to HTTPS.
  7. Test the homepage in an incognito browser window and open Developer Tools (F12 → Console tab) to confirm no mixed-content errors appear.

2. A11y: Frames must have an accessible name (×2)

What it means (plain English)

Your site has two embedded maps (iframes) that lack accessible names. Screen reader users—including those with visual impairments—cannot understand what these maps are for. Adding a title or aria-label to each iframe fixes this.

Why it matters for your business: Accessibility violations expose Firestorm to legal risk under the ADA and WCAG compliance standards, and exclude disabled customers from finding your dispensary location.

Technical root cause: The iframe elements (likely Google Maps embeds) have no title attribute, aria-label, or aria-labelledby property. Screen readers require one of these to announce the iframe's purpose.

Recommended fix — step by step

  1. Inspect the two affected iframes in your page HTML (use browser DevTools: F12 → Elements tab, search for 'elementor-element-f311e65' and 'elementor-element-9b62e25').
  2. For the first iframe, add title="Firestorm Cultivation Location Map" inside the <iframe> tag.
  3. For the second iframe, add title="Firestorm Cultivation Hours & Address Map" inside the <iframe> tag.
  4. If you use Elementor (likely, given the class names), edit each map widget in Elementor → Advanced tab → Accessibility section, and enter the same titles in the 'ARIA Label' field.
  5. Save and republish the page.
  6. Re-run your accessibility test (axe, WAVE, or Lighthouse) to confirm both iframes now pass.

3. A11y: Links must have discernible text

What it means (plain English)

An icon link on your homepage has no text label that screen readers can announce to visually impaired visitors. The link appears to open a menu or panel, but assistive technologies can't tell users what clicking it does. This violates accessibility law (WCAG 2.4.4) and excludes customers using screen readers.

Why it matters for your business: Visually impaired customers cannot navigate your site, reducing traffic and creating legal liability under the ADA; accessibility violations can trigger lawsuits and damage brand reputation.

Technical root cause: The icon link built with Elementor (a WordPress page builder) lacks an aria-label attribute or visible text. The link only contains an <a> tag with an icon class but no descriptive text for assistive technology to read.

Recommended fix — step by step

  1. Log into WordPress admin → Pages → Home (or whichever page contains this icon)
  2. Switch to edit mode and find the icon-box element that triggers the off-canvas menu (look for the menu icon in the visual editor)
  3. Click the icon-box element to open its settings panel
  4. Under Advanced settings (or Accessibility section if available), add an aria-label attribute with text like 'Open navigation menu'
  5. Alternatively, if Elementor settings don't expose aria-label, add the label via the element's link settings or description field
  6. Test the fix by pressing Tab to navigate to the icon with a keyboard and use a free screen reader (NVDA on Windows or VoiceOver on Mac) to confirm the label is announced
  7. Publish and re-scan with an accessibility checker (e.g., axe DevTools browser extension) to verify the fix

P2 — 13 findings

1. Missing security header: strict-transport-security

What it means (plain English)

Your site is missing the Strict-Transport-Security (HSTS) security header, which tells browsers to always connect via encrypted HTTPS. Without it, browsers may allow initial unencrypted HTTP connections, creating a window for attackers to intercept data. You're already using HTTPS and Cloudflare, so adding this header is a simple configuration change.

Why it matters for your business: Missing HSTS weakens customer trust and compliance posture, especially critical for a cannabis retailer handling customer payment and compliance data; it also signals to search engines that your security practices may be incomplete.

Technical root cause: The HSTS header is not being set by your origin server or Cloudflare configuration. WordPress sites typically require either a server-level (Apache/Nginx) directive or a plugin to emit this header.

Recommended fix — step by step

  1. Log into Cloudflare dashboard → Security → Security Headers and verify HSTS is not already enabled; if not, click 'Enable HSTS' and set Max Age to 31536000 (1 year) with 'Include Subdomains' checked.
  2. If Cloudflare doesn't expose the toggle, add the header via Cloudflare Workers: create a new Worker script that adds the header Strict-Transport-Security: max-age=31536000; includeSubDomains; preload to all responses.
  3. Verify the header is now present by visiting https://securityheaders.com and pasting your URL; you should see HSTS listed in green.
  4. After verification, submit your domain to the HSTS Preload List at https://hstspreload.org to gain maximum protection across all browsers.

2. Missing security header: x-frame-options

What it means (plain English)

Your website is missing the X-Frame-Options security header, which tells browsers whether your site can be embedded inside another website's iframe. Without this header, attackers could embed your site in a malicious page to trick users or steal data. This is a standard security control that protects both your users and your business reputation.

Why it matters for your business: Missing this header increases the risk of clickjacking attacks where users unknowingly interact with hidden elements on your site, potentially compromising account security or enabling unauthorized transactions—a serious liability for a licensed cannabis retailer.

Technical root cause: The server (Bluehost via Cloudflare) is not configured to emit the X-Frame-Options HTTP response header. This is typically set at the web server level (Apache/Nginx), via .htaccess, or through a WordPress plugin.

Recommended fix — step by step

  1. Log into your WordPress admin dashboard and go to Plugins → Add New, then search for and install 'WP Security Headers' or 'Wordfence' (free tier includes this header).
  2. After activation, open the plugin settings and locate the 'Security Headers' or 'HTTP Headers' section.
  3. Set X-Frame-Options to 'SAMEORIGIN' (allows your site to frame itself but blocks external embedding).
  4. Save and test using https://securityheaders.com/?q=firestormcultivation.com to confirm the header is now present.
  5. If your hosting provider (Bluehost) offers cPanel, you can also add this via .htaccess: log in to cPanel → File Manager → edit .htaccess in your public_html folder and add the line 'Header always set X-Frame-Options "SAMEORIGIN"'.
  6. Clear your Cloudflare cache after applying changes: log into Cloudflare dashboard → select your domain → Caching → Purge Everything.

3. Missing security header: content-security-policy

What it means (plain English)

Your website is missing a Content Security Policy (CSP) header. This is a security instruction that tells browsers which sources (scripts, images, stylesheets) are trusted. Without it, your site is more vulnerable to malicious code injection, and search engines / security tools flag it as a weaker fortress.

Why it matters for your business: Missing CSP lowers your security posture score, which can affect trust signals to customers and may impact SEO rankings for competitive cannabis keywords where Google favors secure sites.

Technical root cause: The HTTP response headers from your server do not include a Content-Security-Policy directive. This is typically configured at the server (Cloudflare, hosting control panel, or WordPress plugin level). Since you're on WordPress + Cloudflare, the CSP is likely missing from both layers.

Recommended fix — step by step

  1. Log in to your Cloudflare dashboard → select your domain → Security → WAF → Content Security Policy and enable the CSP managed rules
  2. Then log into WordPress admin → Settings → Security Headers (or install the 'HTTP Headers' or 'WP Security Headers' plugin) and set a basic CSP like 'default-src https: self; script-src https: self; style-src https: self unsafe-inline'
  3. Test the fix by visiting https://securityheaders.com/ and entering your domain; CSP should appear in the headers report
  4. Once enabled, monitor Cloudflare's Security Analytics to catch any blocked resources and adjust your CSP allowlist accordingly

4. No SPF record on root domain

What it means (plain English)

Your domain (firestormcultivation.com) doesn't have an SPF record — a simple text file that tells email providers which servers are allowed to send mail from your domain. Without it, legitimate emails from your business (order confirmations, password resets, newsletters) are likely being filtered as spam or rejected entirely.

Why it matters for your business: Customers won't receive critical transactional emails like order confirmations or account recovery links, leading to lost sales, support tickets, and trust damage.

Technical root cause: No SPF (Sender Policy Framework) DNS record exists for the domain. This is a DNS configuration issue, not a website problem — your hosting or email provider hasn't published the required record.

Recommended fix — step by step

  1. Log in to your domain registrar (GoDaddy, Namecheap, etc.) or DNS host and navigate to DNS/Zone File settings for firestormcultivation.com
  2. Identify your email service provider (Gmail, Office 365, Mailchimp, Klaviyo, custom server) and obtain their SPF include string (e.g., 'include:sendgrid.net')
  3. Add a TXT record with Name='@' or '' and Value='v=spf1 include:[your-provider] ~all' (the ~all means 'softfail' for unknown sources; use -all for stricter enforcement later)
  4. Save and wait 15–60 minutes for DNS propagation
  5. Verify the record is live using a free SPF checker tool (e.g., mxtoolbox.com) — search for your domain
  6. Once SPF is live, consider adding DKIM and DMARC records for additional email security (can be done in the same DNS settings)

5. 22 tap targets under 44px at mobile-320

What it means (plain English)

Twenty-two interactive elements (buttons, links, menu items) on your homepage are smaller than 44×44 pixels when viewed on a mobile phone. This makes them hard to tap accurately — especially for people with limited dexterity, older visitors, or anyone on a small screen. Mobile visitors account for most traffic to retail sites, so this directly affects usability.

Why it matters for your business: Visitors on phones will mis-tap buttons, abandon checkout flows, and bounce to competitors; customers also assume a site with poor mobile experience is unprofessional or unsafe.

Technical root cause: The site likely uses default or compressed tap targets in CSS, or menu/button styling inherits small padding and font sizes without accounting for WCAG mobile accessibility minimums (44×44 pixels is the standard).

Recommended fix — step by step

  1. Open your browser DevTools (F12 → Mobile 320px view) and inspect each clickable element (buttons, links, menu items) to identify which ones appear smaller than 44×44 pixels.
  2. In your site's CSS file, increase padding on all interactive elements: buttons should have at least 12px padding (top/bottom) + 16px (left/right); menu links should have 10px+ vertical padding.
  3. Increase font size for small links/buttons from 12–14px to 16px+ to make text naturally larger.
  4. On your navigation menu, if items are stacked horizontally and cramped, add 8–12px margin between them to increase spacing.
  5. Test at mobile-320 viewport again after changes; use a tool like WAVE (wave.webaim.org) to confirm tap targets now meet 44×44 minimum.
  6. If you use a page builder (Elementica, Divi, Beaver Builder, etc.), check element settings for 'Padding' and 'Min Height' and adjust there rather than CSS.

6. 21 tap targets under 44px at mobile-375

What it means (plain English)

Your website has 21 clickable buttons, links, and form fields that are smaller than 44×44 pixels on mobile phones. This makes them hard to tap accurately, especially for people with larger fingers, motor control challenges, or vision difficulties. It's a legal accessibility standard (WCAG) that search engines and regulators increasingly check.

Why it matters for your business: Small tap targets frustrate mobile visitors—they misclick, abandon checkout, and leave bad reviews. For a cannabis retailer, this directly cuts conversion on age-verified purchases and loyalty sign-ups, while exposing you to accessibility complaints.

Technical root cause: Buttons, navigation links, or form inputs were likely styled with padding or font-size values too small, or CSS was applied globally without respecting the 44px minimum touch-target guideline. This often happens when designs are scaled down from desktop without mobile-first testing.

Recommended fix — step by step

  1. Use Chrome DevTools (right-click → Inspect) on mobile view (375px width) to identify which elements are undersized—focus on navigation, CTAs like 'Add to Cart', age-gate buttons, and form inputs.
  2. Increase padding inside buttons/links: aim for at least 12px padding + 18px+ font-size to reliably hit 44×44px.
  3. For navigation links in headers or footers, increase line-height to ≥44px or wrap in larger clickable containers.
  4. Test form fields: input boxes, checkboxes, and dropdowns should be ≥44px tall; add vertical padding if needed.
  5. If using a page builder (WordPress, Webflow, Squarespace), inspect each component's mobile style settings and bump min-height/padding values.
  6. After changes, retest at 375px viewport width using axe DevTools or WAVE browser extension to confirm all interactive elements now meet 44×44px.
  7. Add a note to your design/brand guidelines: 'All interactive elements must be ≥44×44px on mobile.'

7. 21 tap targets under 44px at mobile-414

What it means (plain English)

Your website has 21 buttons, links, or other clickable elements that are smaller than 44×44 pixels on mobile phones. This makes them hard to tap accurately, especially for people with motor control issues, older visitors, or anyone using a phone one-handed. Mobile visitors will likely mis-tap and get frustrated.

Why it matters for your business: Customers visiting on phones may abandon your site due to friction when trying to navigate menus, add products to cart, or reach your age gate—directly reducing mobile conversions and repeat visits.

Technical root cause: The site's CSS or HTML uses touch targets below the WCAG 2.5.5 minimum of 44×44 CSS pixels, likely due to tight spacing in navigation, icon buttons, or product selectors that were designed for desktop or without mobile accessibility in mind.

Recommended fix — step by step

  1. Open your site on a mobile phone at 414px width and identify which elements feel hard to tap (likely: menu toggles, social icons in footer, product quantity buttons, or age-gate confirm button)
  2. In your site's CSS file, find those small elements and increase their padding or min-width/min-height to at least 44×44px (example: if a button is 24×24px, add 10px padding on all sides)
  3. If buttons appear too close together, add margin-left or margin-right to create breathing room without overlapping tap zones
  4. Test on a real phone: each button should require only a gentle tap, not a pinpoint touch
  5. Use Chrome DevTools mobile emulation (Menu → More tools → Device toolbar) to verify each element is ≥44×44px before publishing
  6. Pay special attention to your age-gate confirmation button and product quantity +/− buttons—these drive revenue and compliance, so they must be easy to tap

8. 23 tap targets under 44px at tablet-768

What it means (plain English)

Your website has 23 clickable buttons, links, and interactive elements that are smaller than 44x44 pixels when viewed on a tablet. This makes them hard to tap accurately—especially for people with motor control challenges, tremors, or arthritis. WCAG 2.5.5 is an accessibility standard that requires tap targets to be at least 44x44 pixels to ensure usability for all visitors.

Why it matters for your business: Customers on tablets and mobile devices struggle to navigate your site, complete purchases, or verify age—leading to lost sales and potential compliance issues since cannabis retail requires reliable age-gating.

Technical root cause: Interactive elements (navigation links, buttons, menu items, or CTAs) have been styled with padding, font-size, or width/height values below 44px. At tablet viewport sizes (768px width), these targets remain too small because CSS breakpoints may not have enlarged them proportionally.

Recommended fix — step by step

  1. Inspect your site on a tablet (Chrome DevTools: toggle device toolbar, select iPad or Samsung Galaxy Tab 10-inch, zoom to 100%). Identify which elements are hard to tap.
  2. Check your CSS for button, link, and interactive element definitions. Add min-height: 44px; min-width: 44px; padding: 12px 16px; (or similar) to all clickable elements.
  3. If using a WordPress theme, go to Customizer → Additional CSS and add a rule: button, a[href], input[type='button'], .menu-item { min-height: 44px; min-width: 44px; } to catch missed targets.
  4. Test tap accuracy by opening DevTools on tablet view, hovering over each small element, and checking its computed dimensions in the Inspector. Adjust padding and margin until all interactive elements meet or exceed 44x44.
  5. Pay special attention to your age-gate button, 'Enter Dispensary' link, and menu toggles—these must be easily tappable for compliance and UX.
  6. Re-run an accessibility audit (use WAVE browser extension or axe DevTools) at tablet-768 viewport to confirm all 23 targets are now ≥44px.

9. Lighthouse perf (mobile): 61/100

What it means (plain English)

Google's Lighthouse tool measured your mobile site's performance at 61/100—below the target of 85. The main culprit is Largest Contentful Paint (LCP), which measures when the biggest visible element finishes loading; yours is taking 8.2 seconds, when it should be under 2.5 seconds. Visitors are waiting too long to see your main content, which hurts engagement and search rankings.

Why it matters for your business: Slow mobile load times directly reduce conversion rates, increase bounce rates, and harm your Google search visibility—especially for local 'dispensaries near me' queries where speed is a ranking factor.

Technical root cause: LCP delay typically stems from unoptimized hero images, render-blocking JavaScript or CSS, or slow third-party scripts (analytics, ads, age-gate verification). Without inspecting the HTML report, the most common culprit for cannabis sites is an oversized banner image or video loading before the page becomes interactive.

Recommended fix — step by step

  1. Open the Lighthouse HTML report at the path provided and scroll to 'Diagnostics' → 'Largest Contentful Paint' to identify which element is slow (usually an image or video).
  2. If it's an image: convert to modern format (WebP), compress using TinyPNG or ImageOptim, and add 'loading="lazy"' to below-the-fold images.
  3. If it's a render-blocking script: use 'defer' or 'async' attributes on <script> tags, or move non-critical JavaScript to load after page render.
  4. Defer non-critical CSS: audit your stylesheet for unused rules and move animations/hover effects to separate stylesheet loaded asynchronously.
  5. Audit third-party tags (Google Analytics, Meta Pixel, age-verification widget): defer their load until after LCP using a tag manager (Google Tag Manager recommended) or native defer attributes.
  6. Run a fresh Lighthouse test and aim for LCP under 2.5s; retest after each change to confirm improvement.
  7. Monitor ongoing with PageSpeed Insights (pagespeed.web.dev) monthly—set a recurring calendar reminder.

10. A11y: Document should have one main landmark (×3)

What it means (plain English)

Your website is missing a 'main' landmark—a semantic HTML element that tells screen readers where the primary content begins. This is like a book missing a table of contents: assistive technology users can't easily find the main content. The issue appears in the main page and in embedded iframes (likely video or widget players).

Why it matters for your business: Users relying on screen readers or keyboard navigation will struggle to access your product listings and purchasing flow, reducing accessibility compliance and excluding a segment of potential customers.

Technical root cause: The page structure uses generic divs (likely Elementor page-builder sections) without wrapping the main content in a <main> HTML tag or role='main' attribute. Embedded iframes lack proper document structure entirely.

Recommended fix — step by step

  1. Open Elementor editor (Dashboard → Pages → Homepage or affected page)
  2. Select the outermost container that wraps your product content and main information
  3. In the Advanced tab, scroll to Attributes → add Custom CSS Classes: 'elementor-main-content' or check if Elementor exposes a semantic 'role' setting; if not, proceed to next step
  4. Export page HTML and add role='main' to the outermost content wrapper div, or switch primary container to a <main> tag if using custom code sections
  5. For embedded iframes (videos/widgets): contact the iframe provider (YouTube, Vimeo, etc.) to confirm they include proper document structure, or wrap iframe in a <section role='region'> with aria-label
  6. Re-test with axe DevTools (Chrome extension) or WAVE to confirm one main landmark is present
  7. Document this fix in your accessibility checklist for future page updates

11. A11y: All page content should be contained by landmarks (×23)

What it means (plain English)

Your site has 23 sections of content that aren't wrapped in semantic landmark regions (like <main>, <nav>, <footer>, or <aside>). Screen reader users rely on these landmarks to navigate and understand page structure—without them, they have to read through every element linearly, like listening to a wall of text. This is a usability problem for visitors with visual disabilities.

Why it matters for your business: Customers using screen readers or assistive tech may struggle to navigate your product menu, age gate, or compliance info, reducing conversions and potentially exposing you to accessibility lawsuits or ADA complaints.

Technical root cause: Elementor (your page builder) is creating generic <div> containers without semantic landmark roles. The page lacks a proper <main> wrapper around primary content and <nav> tags around navigation areas, leaving assistive tech unable to identify functional regions.

Recommended fix — step by step

  1. Log in to WordPress admin → Elementor → edit the homepage.
  2. Select the top-level container wrapping your hero/banner section → In the Advanced tab, set the HTML tag from 'div' to 'main' (or add role='main' if HTML tag option unavailable).
  3. Find your navigation menu container → select it → change HTML tag to 'nav' or add role='navigation'.
  4. Identify any sidebar or secondary content areas → set HTML tag to 'aside' or add role='complementary'.
  5. If you have a footer container, set its HTML tag to 'footer' or add role='contentinfo'.
  6. Save and republish; run an accessibility audit tool (WAVE, axe DevTools) to confirm the remaining 17 untagged elements and repeat the process for smaller sections (testimonials, product cards, etc.).
  7. After fixes, test with a screen reader (NVDA on Windows, VoiceOver on Mac) to confirm landmark navigation works.

12. No DMARC policy published

What it means (plain English)

Your domain does not have a DMARC policy published in DNS. DMARC (Domain-based Message Authentication, Reporting and Conformance) is a email security standard that tells receiving mail servers how to handle emails claiming to be from your domain. Without it, attackers can more easily send fraudulent emails that appear to come from Firestorm Cultivation, damaging your brand and potentially confusing customers.

Why it matters for your business: Fraudsters can impersonate your dispensary via email to phish your customers or damage trust; you also lose visibility into who is sending mail from your domain, which matters for compliance and customer communications.

Technical root cause: No DMARC record (starting with v=DMARC1) exists at the DNS subdomain _dmarc.firestormcultivation.com. This is a DNS configuration that must be explicitly created by whoever manages your domain's DNS records.

Recommended fix — step by step

  1. Log into your domain registrar or DNS hosting provider (GoDaddy, Namecheap, Route 53, Cloudflare, etc.).
  2. Navigate to DNS Records or DNS Management for firestormcultivation.com.
  3. Create a new TXT record with Hostname/Name: _dmarc and Value: v=DMARC1; p=none; rua=mailto:admin@firestormcultivation.com (replace admin@... with your actual email).
  4. Save and allow 24–48 hours for DNS propagation.
  5. Verify the record is live using MXToolbox.com: search 'DMARC Lookup' and enter firestormcultivation.com.
  6. Once confirmed, monitor the abuse@ email address for DMARC reports to see if anyone is spoofing your domain.
  7. After 1–2 months of monitoring, consider upgrading the policy from p=none to p=quarantine or p=reject if you see no legitimate external senders.

13. A11y: Heading levels should only increase by one

What it means (plain English)

Your homepage has a heading hierarchy problem: an h3 (third-level heading) appears without an h2 (second-level heading) before it. Screen readers and search engines expect headings to follow a logical outline—like a document where you don't jump from Chapter 1 directly to Section 3.2. This confuses assistive technology users about page structure.

Why it matters for your business: Visitors using screen readers may struggle to navigate your site and understand content organization, reducing accessibility and potentially losing customers; search engines also use heading structure to understand page topics.

Technical root cause: Elementor (your page builder) has placed an h3 for 'Firestorm Bangor' without a preceding h2. This typically happens when sections are copy-pasted or the page structure was built without a clear hierarchy plan.

Recommended fix — step by step

  1. Log into your WordPress admin and go to Pages → Home (or your homepage).
  2. Click 'Edit with Elementor' to open the page builder.
  3. Find the section containing 'Firestorm Bangor' (likely an Icon Box element).
  4. Click the Icon Box element and check the Content tab for the heading.
  5. Change the heading tag from h3 to h2, or add an h2 before this section with a parent category (e.g., 'Our Locations').
  6. If there are multiple location cards below, ensure they are all h2s, or make them h3s under a single h2 parent.
  7. Click Update and preview the page in a new tab; use a free tool like WAVE (wave.webaim.org) to verify the heading order is now correct.

P3 — 63 findings

1. Title length 210 chars

What it means (plain English)

Your homepage title is 210 characters long, but search engines typically display only 50–60 characters in search results before truncating. The full title wastes space on keywords that users never see, and the truncation may cut off your brand name or key value proposition, making your listing less compelling to potential customers.

Why it matters for your business: Customers searching for cannabis dispensaries in Maine see a cut-off title in Google results, which reduces click-through rate and makes your listing look unprofessional compared to competitors with concise, fully-visible titles.

Technical root cause: The title tag was written to cram multiple keywords (city names, product types) and all service areas into one tag, exceeding the recommended 50–65 character range that displays without truncation on desktop and mobile.

Recommended fix — step by step

  1. Rewrite the title to 50–65 characters max, prioritizing: brand name + primary keyword + key differentiator. Example: 'Firestorm Cannabis | Craft Dispensary & Weed Delivery ME'
  2. Move secondary keywords (city names, product types) into the meta description instead, which has more character budget (150–160 chars) and still influences search ranking
  3. Test the new title in Google's SERP preview tool (search.google.com → URL Inspection → Preview) to confirm it displays fully without truncation
  4. Verify this is the homepage (/)—the affected URL shows '?elementor_library=elementor-footer-13', which suggests a staging or footer template page; apply the fix to your actual homepage title tag

2. SSL Labs grade: unknown

What it means (plain English)

Your SSL certificate cannot be validated by SSL Labs, which is a trusted third-party testing tool. This typically means either your server is not responding correctly to the test, or there's a configuration issue with how your HTTPS (secure connection) is set up. While visitors may still access your site, search engines and security tools cannot verify your security credentials.

Why it matters for your business: Poor SSL grades reduce user trust, may trigger browser warnings on older systems, and can negatively impact search rankings—especially critical for a cannabis retailer where compliance and legitimacy are paramount.

Technical root cause: The server is returning an HTTP 400 error when SSL Labs attempts to handshake, usually caused by misconfigured TLS settings, incomplete certificate chains, or server firewall rules blocking the test.

Recommended fix — step by step

  1. Visit https://www.ssllabs.com/ssltest/ and enter your domain to confirm the HTTP 400 error and see detailed error logs
  2. Contact your hosting provider's support (identify your host via https://www.whoishostingthis.com/) and share the SSL Labs report, asking them to fix the TLS handshake failure
  3. Request they enable TLS 1.3 and ensure the certificate chain includes all intermediate certificates
  4. Once fixed, ask your host to enable HSTS (HTTP Strict-Transport-Security) header and CAA (Certification Authority Authorization) DNS records
  5. Retest on SSL Labs after 24 hours to confirm an A or A+ grade
  6. If hosting provider cannot resolve within 48 hours, escalate to their senior support or consider migrating to a managed host (e.g., WP Engine, Kinsta) with built-in SSL automation

3. No DKIM selectors found (standard selectors)

What it means (plain English)

DKIM (DomainKeys Identified Mail) is a security protocol that digitally signs outgoing emails from your domain, proving they actually came from you and weren't forged. Your domain doesn't currently have DKIM set up, which means emails you send—including order confirmations, age-verification emails, and marketing—are more likely to land in spam folders or be rejected by email providers.

Why it matters for your business: Missing DKIM causes legitimate transactional and marketing emails to fail delivery or appear untrustworthy, directly reducing customer engagement, order confirmations reaching customers, and email marketing ROI.

Technical root cause: DKIM records (DNS TXT records with cryptographic signatures) have not been created and published in your domain's DNS settings. Without them, receiving mail servers cannot verify that emails claiming to be from firestormcultivation.com are authentic.

Recommended fix — step by step

  1. Contact your email service provider (e.g., Mailchimp, Klaviyo, your hosting company's built-in SMTP) and request DKIM setup instructions—they will provide you with a selector name (e.g., 'default' or 'k1') and a TXT record value.
  2. Log in to your domain registrar (GoDaddy, Namecheap, etc.) and navigate to DNS / Records management.
  3. Add a new TXT record with the name provided by your email vendor (typically something like 'default._domainkey.firestormcultivation.com') and paste the full TXT value they gave you.
  4. Wait 24–48 hours for DNS propagation, then verify DKIM is active using a free tool like MXToolbox (mxtoolbox.com) or Google Admin Toolbox.
  5. In your email provider's dashboard, mark the DKIM setup as 'verified' or 'complete' (varies by vendor).
  6. While you're in DNS, also set up SPF and DMARC records (your email vendor will provide those TXT records too); together they form a complete email authentication suite.

4. robots.txt does not reference sitemap

What it means (plain English)

Your robots.txt file (the instructions you give search engines about what to crawl on your site) doesn't tell Google and Bing where to find your sitemap. A sitemap is like a table of contents for search engines, listing all your important pages. Without this pointer, search engines may take longer to discover new products, menus, or compliance pages.

Why it matters for your business: Slower indexing of your product pages, menu updates, and compliance information in Google Search results means potential customers may not find you as quickly, and new strains or inventory changes take longer to appear in search.

Technical root cause: The robots.txt file is missing a 'Sitemap:' directive (a one-line URL pointer). This is a simple configuration omission that doesn't prevent crawling but does make it less efficient.

Recommended fix — step by step

  1. Locate or create your XML sitemap file (typically sitemap.xml in the root directory; check https://firestormcultivation.com/sitemap.xml)
  2. Open your robots.txt file (https://firestormcultivation.com/robots.txt) in a text editor or your web host's file manager
  3. Add this line at the end of robots.txt: Sitemap: https://firestormcultivation.com/sitemap.xml
  4. Save and upload the updated robots.txt
  5. Verify the change by visiting https://firestormcultivation.com/robots.txt in your browser and confirming the Sitemap line appears
  6. Submit your sitemap directly to Google Search Console (search.google.com) → Sitemaps section for immediate indexing confirmation

5. Missing OpenGraph metadata

What it means (plain English)

When someone shares your blog post on Facebook, Instagram, or other social platforms, those sites pull a preview image and title from special HTML tags called OpenGraph metadata. Without these tags, your post shows up as a plain link with no preview — making it far less likely people will click through.

Why it matters for your business: Social shares of your blog content won't display rich previews, reducing click-through rates and limiting organic reach for educational content that builds brand authority in the cannabis space.

Technical root cause: The page HTML is missing og:title and og:image meta tags in the <head> section. Social platforms fall back to generic or missing previews when these tags are absent.

Recommended fix — step by step

  1. Open the blog post HTML source or template editor and locate the <head> section
  2. Add <meta property="og:title" content="Your Blog Post Title"> immediately after the standard <title> tag
  3. Add <meta property="og:image" content="https://firestormcultivation.com/path/to/image.jpg"> using a high-quality image (1200×630px minimum)
  4. Add <meta property="og:url" content="https://firestormcultivation.com/blog/hello-world/"> to ensure the canonical URL is shared
  5. Add <meta property="og:type" content="article"> to specify this is a blog post
  6. Test the result using Facebook's Open Graph Debugger (facebook.com/developers/tools/debug/og/object) and Pinterest Rich Pins validator

6. 1 image(s) missing alt text

What it means (plain English)

One image on your blog post page doesn't have alt text — a short text description that screen readers read aloud and search engines use to understand the image. This affects both customers with visual impairments and your SEO ranking.

Why it matters for your business: Missing alt text reduces your search visibility for image-based queries and excludes visitors using screen readers, shrinking your potential customer base.

Technical root cause: The image element is missing the alt attribute, which is required by accessibility standards (WCAG 2.1) and helps search engines index image content.

Recommended fix — step by step

  1. Open https://firestormcultivation.com/blog/hello-world/ in a browser and inspect the page (right-click → Inspect or F12).
  2. Search the HTML for <img tags without an alt attribute (look for img tags that don't have alt="..." or alt='' in them).
  3. Add descriptive alt text to the image — for example, if it's a photo of a product, use alt="Firestorm Cultivation cannabis flower product". Keep it 8–15 words, descriptive but concise.
  4. Save and republish the blog post.
  5. Verify the fix by re-running an accessibility scan (use https://wave.webaim.org/ or your site audit tool).

7. Title length 178 chars

What it means (plain English)

Your page title (the text that appears in browser tabs and search results) is 178 characters long, but search engines like Google typically display only 50–60 characters before truncating. This means visitors searching on Google will see an incomplete or cut-off title, reducing click-through rates. The extra length doesn't help search ranking and wastes space that could highlight your strongest keywords.

Why it matters for your business: Potential customers searching for cannabis education content may skip your result if the title appears cut off or less relevant than competitors' titles in search results, directly impacting traffic to your educational content page.

Technical root cause: The title tag includes multiple location names and descriptive phrases that collectively exceed the optimal length. While individual elements are relevant, they're not prioritized—the most important message gets buried.

Recommended fix — step by step

  1. Identify your primary keyword for this page (likely 'cannabis education' or 'marijuana strains').
  2. Rewrite the title to 50–60 characters, leading with the primary keyword and value proposition (e.g., 'Cannabis Education & Strain Guides | Firestorm').
  3. Move secondary location names and descriptors to the meta description field instead (a 150–160 character field below the title in search results).
  4. Update the meta description to include: 'Learn about terpene profiles, THC dosing, and safe consumption. Firestorm Cannabis in Bangor, Orono, Corinth, Levant, Dexter, ME.'
  5. Test the update by searching 'cannabis education bangor me' and verifying the title and description display correctly and completely in Google search results.

8. Description length 165 chars

What it means (plain English)

Your page description (the short text shown under your site name in Google search results) is 165 characters long. Google typically displays 150–160 characters before cutting off on desktop, so yours gets truncated. This means potential customers don't see your complete message in search results.

Why it matters for your business: A cut-off description reduces click-through rates from search results, meaning fewer dispensary visitors and lost revenue from search traffic.

Technical root cause: The meta description tag in the HTML head of the /education/ page exceeds the recommended 160-character limit, causing Google to truncate the visible text in search listings.

Recommended fix — step by step

  1. Open https://firestormcultivation.com/education/ in your browser, right-click → Inspect, and find the <meta name="description" content="..."> tag in the <head>
  2. Count the characters in the current description or paste it into a character counter (e.g., https://www.charactercountonetool.com/)
  3. Rewrite the description to 155 characters or fewer, keeping the most important keywords and call-to-action at the start
  4. Replace the old meta description with the new one in your site editor or HTML

9. Title length 178 chars

What it means (plain English)

Your contact page title is 178 characters long, but search engines (Google, Bing) typically only display the first 50–60 characters in search results before truncating with an ellipsis. This means most of your carefully crafted title gets hidden, wasting valuable real estate that could drive clicks.

Why it matters for your business: Potential customers searching for 'cannabis dispensary near me' or 'Bangor ME cannabis' see a cut-off title in Google, reducing click-through rates and making your contact page look less professional than competitors with concise, clear titles.

Technical root cause: The title tag was likely written to include all service areas and keywords for SEO, but modern search engines prioritize readability and truncate excessively long titles to fit mobile and desktop search result layouts.

Recommended fix — step by step

  1. Open https://firestormcultivation.com/contact/ in your browser and inspect the page source (right-click → Inspect or View Page Source).
  2. Find the <title> tag (usually near the top in the <head> section).
  3. Replace it with a concise, scannable title: 'Contact Firestorm Cannabis | Bangor & Orono ME Dispensary' (58 characters).
  4. If using WordPress, log in → Pages → Contact → Edit → change the SEO title in Yoast SEO (or All in One SEO) plugin's title field to the new version.
  5. If using a page builder (Elementum, Divi, etc.), look for 'SEO Settings' or 'Meta Settings' on the page editor.
  6. Save and clear any browser cache to verify the change appears in search results within 24–48 hours.

10. Title length 174 chars

What it means (plain English)

Your page title (the blue clickable text in search results) is 174 characters long, but search engines display only 50–60 characters on desktop and fewer on mobile. The second half of your title—everything after 'Discounts |'—gets cut off and wasted. You're working harder than you need to and confusing visitors who see an incomplete title.

Why it matters for your business: Searchers see a truncated, messy title that doesn't clearly say what the page offers, reducing click-through rates from search results and weakening your loyalty program's visibility.

Technical root cause: The title tag was written to stuff keywords (city names) rather than to communicate clearly to humans. Search engines reward concise, descriptive titles; oversized ones dilute message clarity.

Recommended fix — step by step

  1. Open https://firestormcultivation.com/loyalty/ in your browser and inspect the page source (Ctrl+U or Cmd+U) to locate the <title> tag.
  2. Rewrite the title to 50–60 characters maximum. Example: 'Firestorm Loyalty Program | Cannabis Rewards & Discounts'
  3. If using WordPress, edit the page and update the title in the SEO plugin (Yoast, Rank Math, etc.) or in the page settings under 'Document Title'.
  4. If custom HTML/code, locate the <title> tag in the page template and replace with the shorter version.
  5. Test the new title in Google Search Console (property > URL Inspection) to confirm it displays fully in search results.
  6. Repeat for any other loyalty or landing pages with oversized titles.

11. Description length 162 chars

What it means (plain English)

Your page description (the text Google shows under your page title in search results) is 162 characters long. Google typically displays 150–160 characters on desktop before cutting off. This means potential customers may see an incomplete or truncated summary of what your loyalty program offers.

Why it matters for your business: A cut-off description reduces click-through rates from search results because visitors can't read your full value proposition—they may choose a competitor's result instead.

Technical root cause: The meta description tag in your HTML for the loyalty page exceeds the recommended length limit, causing search engines to truncate it in search result previews.

Recommended fix — step by step

  1. Open your loyalty page HTML or page editor and locate the meta description tag (usually found in the page <head> or managed via an SEO plugin)
  2. Edit the description to 155–160 characters maximum, ensuring it clearly states the core benefit (e.g., 'Earn rewards on every purchase at Firestorm Cultivation. Join our loyalty program for exclusive member perks and discounts.')
  3. Preview the updated description in Google Search Console (go to Search Appearance → HTML Improvements) or use a free tool like seotester.com to confirm it displays fully
  4. If using WordPress, install Yoast SEO or Rank Math, navigate to the loyalty page editor, and adjust the snippet preview until the green light appears

12. Title length 190 chars

What it means (plain English)

Your 'About Us' page title is 190 characters long, but search engines (Google, Bing) typically display only 20–65 characters in search results. Everything beyond ~65 characters gets truncated with an ellipsis (…), so visitors see an incomplete message. This wastes valuable real estate where you could highlight what makes Firestorm unique.

Why it matters for your business: Potential customers scanning search results won't see your full value proposition, reducing click-through rates from organic search and losing visibility for location-specific terms.

Technical root cause: The title tag was likely written to stuff multiple keywords and location names rather than optimized for human readability in search snippets. Search engines index the full title, but only display the first 50–65 characters depending on device and context.

Recommended fix — step by step

  1. Open https://firestormcultivation.com/about-us/ in a browser and inspect the <title> tag in the page source (Ctrl+U or Cmd+U, then Ctrl+F and search for '<title>')
  2. Rewrite the title to 50–60 characters max. Example: 'Craft Cannabis Cultivation in Bangor & Orono, ME' (54 chars)
  3. Keep the strongest keywords first: craft cultivation, location (Bangor/Orono), and mention 'dispensary' if critical for SEO
  4. Move secondary locations (Orrington, Hampden, Bucksport, Milford, Brewer) to the meta description instead—that's 155–160 characters and can list all service areas
  5. If using WordPress, go to Yoast SEO → Title Settings or All in One SEO → Title Editor and paste the new title
  6. If using a CMS or custom HTML, locate the <title> tag in the page template and update it directly
  7. After publishing, wait 24–48 hours and check Google Search Console (GSC) → Pages → click the About URL → expand 'Inspection' to confirm Google re-crawled it

13. Title length 210 chars

What it means (plain English)

Your homepage title tag is 210 characters long, but search engines work best with titles between 20–65 characters. The current title is stuffed with location names and product keywords, which dilutes the main message and gets truncated in search results (Google typically shows 50–60 characters on desktop). A shorter, clearer title helps both users and search rankings.

Why it matters for your business: Potential search ranking penalty and reduced click-through rate from search results, since truncated titles look less trustworthy and don't convey your core offering clearly to customers searching for cannabis in Maine.

Technical root cause: The title tag was likely auto-generated or manually created to include all service areas and product types at once, without optimization for search engine display limits.

Recommended fix — step by step

  1. Navigate to your homepage HTML or CMS page editor and locate the <title> tag in the <head> section.
  2. Replace the current title with a concise 50–60 character version, e.g.: 'Cannabis Dispensary in Bangor, ME | Firestorm Cultivation'
  3. Verify the new title in Google Search Console → Pages → click your homepage URL to confirm it displays correctly in search results.
  4. If using WordPress, install Yoast SEO or RankMath, edit your homepage, set the SEO title to the new short version, and save.
  5. Test the change by searching 'cannabis bangor maine' in Google Incognito mode within 24–48 hours to see the updated title in results.

14. Missing OpenGraph metadata

What it means (plain English)

OpenGraph tags are metadata snippets that tell social media platforms (Facebook, Instagram, LinkedIn, etc.) how to display your page when someone shares it. Without them, your posts look plain—no custom title, description, or image—making shares less engaging and less likely to drive traffic back to your site.

Why it matters for your business: Poor social sharing appearance reduces click-through rates from social media, limiting organic reach and brand visibility in a competitive cannabis market where community engagement and word-of-mouth are key.

Technical root cause: The page is missing og:title, og:image, og:description, and og:url meta tags in the <head> section. This is likely a template or theme issue where the OpenGraph implementation is incomplete or disabled.

Recommended fix — step by step

  1. Inspect the page source (right-click → View Page Source) and search for '<meta property="og:' to confirm which OpenGraph tags are missing
  2. If using WordPress, install Yoast SEO or Rank Math plugin (both free versions include OpenGraph generation)
  3. In your chosen plugin's settings, enable OpenGraph for posts/pages, then edit this specific post to set a custom social image (minimum 1200×630 pixels) and verify the og:title and og:description preview
  4. If not on WordPress, add these four meta tags to your page template's <head> section: og:title, og:description, og:image (full URL), and og:url (canonical URL of the page)
  5. After saving, use the Facebook Share Debugger (facebook.com/developers/tools/debug/sharing) to validate and refresh the cache

15. Title length 194 chars

What it means (plain English)

Your homepage title tag is 194 characters long, but search engines like Google typically display only 20–65 characters in search results before truncating with '…'. This means users see an incomplete, awkward headline that doesn't clearly communicate what Firestorm does. The extra length wastes real estate and dilutes your key message.

Why it matters for your business: Potential customers searching for 'cannabis dispensary near me' or 'weed delivery' won't see your full value proposition in Google results, reducing click-through rate and competitive visibility.

Technical root cause: The title was likely created to include all service areas and product keywords for SEO breadth, but modern search algorithms reward clarity and user experience over keyword stuffing.

Recommended fix — step by step

  1. Open your site's HTML head or page template and locate the <title> tag in the /hub/ page source.
  2. Rewrite the title to: 'Cannabis Dispensary & Weed Delivery | Firestorm Cultivation – Maine' (54 chars).
  3. If using a CMS (WordPress, Shopify, etc.), find the page SEO settings and update the 'Page Title' field.
  4. Verify in Google Search Console → Pages that the new title displays correctly (wait 24–48 hours for re-crawl).
  5. Test the new title in a Google SERP simulator (e.g., Moz's title preview tool) to confirm it renders without truncation.

16. Missing OpenGraph metadata

What it means (plain English)

Your /hub/ page is missing OpenGraph tags—special metadata that controls how the page appears when shared on Facebook, Instagram, LinkedIn, and other social platforms. Without them, social shares will display a generic preview instead of your branded image and custom title, making clicks less likely.

Why it matters for your business: Social media sharing is a key traffic driver for cannabis retail; poor preview cards reduce click-through rates and miss opportunities to build brand awareness when customers share your content.

Technical root cause: The page's HTML <head> section lacks og:title, og:image, og:description, and related OpenGraph meta tags that social platforms use to generate rich preview cards.

Recommended fix — step by step

  1. View the page source (right-click → Inspect → search for '<head>' section) and note the exact URL: https://firestormcultivation.com/hub/
  2. Add these four meta tags to the <head> section: <meta property='og:title' content='[Your Hub Page Title]'>, <meta property='og:image' content='[URL to 1200x630px image]'>, <meta property='og:description' content='[50-160 character summary]'>, and <meta property='og:url' content='https://firestormcultivation.com/hub/'>
  3. If using WordPress: install Yoast SEO or Rank Math plugin, go to the /hub/ page editor, scroll to the plugin settings, and fill in 'Social Title', 'Social Image', and 'Social Description' fields
  4. If using a static site or custom CMS: add the tags directly to hub/index.html or the template file that renders that page
  5. Test the fix by pasting https://firestormcultivation.com/hub/ into Facebook's Sharing Debugger (facebook.com/developers/tools/debug/) and Instagram's own sharing preview tool to confirm the card displays correctly

17. Title length 183 chars

What it means (plain English)

Your homepage title (the text that appears in browser tabs and search results) is 183 characters long. Search engines typically display only the first 50–60 characters to users, so everything after that gets cut off. This means potential customers see an incomplete, truncated headline that may not include your strongest selling point.

Why it matters for your business: Customers searching for cannabis dispensaries in your service areas see a cut-off title in Google results, reducing click-through rates and making your listing look less polished than competitors.

Technical root cause: The title tag was over-optimized with excessive keyword stuffing (listing every town you serve). While location keywords help SEO, packing them all into one title exceeds the practical display limit.

Recommended fix — step by step

  1. Open the homepage HTML source (right-click → View Page Source, search for <title>) or access your site's page editor / CMS admin.
  2. Replace the current title with: 'Cannabis Dispensary in Bangor, ME | Recreational Marijuana & THC Delivery | Firestorm Cultivation' (58 chars).
  3. Keep your strongest keyword (Bangor) and unique value prop (THC Delivery) front and center.
  4. If using WordPress or a CMS, check Settings → General or install Yoast SEO; go to the post editor, scroll to Yoast section, and edit the SEO title field.
  5. Test the new title by searching your brand name in Google; verify it displays fully in the search result snippet within 1–2 days.
  6. Consider creating separate, optimized meta titles for landing pages targeting other towns (e.g., '/hampden/' gets 'Cannabis Dispensary in Hampden, ME | Firestorm') instead of cramming all towns into one title.

18. Missing OpenGraph metadata

What it means (plain English)

OpenGraph tags are snippets of code that tell social media platforms (Facebook, Instagram, LinkedIn) what image and text to display when someone shares your page. Without them, social shares show a generic preview or no preview at all, making your posts look unprofessional and less clickable.

Why it matters for your business: When customers share your products or promotions on social media, missing preview images reduce click-through rates and make your brand look less polished—especially important for a cannabis retailer where visual appeal drives engagement.

Technical root cause: The page at /hub1/ lacks og:title and og:image meta tags in the HTML <head> section, so social platforms cannot extract visual metadata for sharing.

Recommended fix — step by step

  1. Inspect the /hub1/ page source (right-click → View Page Source) and locate the <head> section.
  2. Add og:title, og:image, og:description, and og:url meta tags just before the closing </head> tag. Example: <meta property="og:title" content="Hub1 Products | Firestorm Cultivation"> and <meta property="og:image" content="https://firestormcultivation.com/path-to-hero-image.jpg">
  3. Choose a high-quality product or brand image (1200×630px minimum) and upload it to your server.
  4. Test the fix using Facebook's Open Graph Debugger (facebook.com/developers/tools/debug/og/object) and LinkedIn Post Inspector to confirm the preview renders correctly.
  5. Apply the same og:title and og:image pattern to all other hub pages and product pages for consistency.

19. Title length 187 chars

What it means (plain English)

Your homepage title is 187 characters long. Search engines display only the first 50–60 characters in results, so the tail end—including location names—gets cut off and wasted. A shorter, stronger title helps both search ranking and click-through rate.

Why it matters for your business: Potential customers searching for cannabis in your service areas may not see all your city names in search results, reducing click-through rates and local visibility.

Technical root cause: The title was stuffed with all service area cities to capture local search traffic. While understandable, this bloats the title beyond what search engines and browsers display.

Recommended fix — step by step

  1. Open your site's head section or page settings (likely in WordPress → Settings → General, or a theme customizer panel) and find the homepage title field.
  2. Trim the title to 50–60 characters, keeping only your brand name and primary keyword: 'Cannabis Dispensary & Weed Store in Maine | Firestorm'
  3. Move full location list to the meta description (155–160 chars max), e.g.: 'Recreational marijuana delivery in Orrington, Corinna, Bradley, Hermon & more. Open now.'
  4. Test the change by searching your brand name in Google and confirming the full title displays in results.
  5. If you use an SEO plugin (Yoast, Rank Math, All in One SEO), use its title preview tool to verify character count before saving.

20. Missing OpenGraph metadata

What it means (plain English)

When someone shares a link to your site on Facebook, Instagram, or other social platforms, those networks use special metadata tags (called OpenGraph tags) to decide what title and image to display in the preview card. Without these tags, the preview looks generic or broken, which reduces click-through rates from social sharing.

Why it matters for your business: Customers are less likely to click through from social media when they see a plain or missing preview — this directly reduces traffic from word-of-mouth and social promotion, which is critical for a cannabis retail brand.

Technical root cause: The page /hub2/ is missing og:title and og:image meta tags in the HTML head section. These tags must be explicitly added to each page to control social media previews.

Recommended fix — step by step

  1. Audit your current site architecture to identify all publicly shared pages (product pages, blog posts, hub pages, etc.)
  2. For each page, add og:title tag with a keyword-rich, customer-facing title (e.g., <meta property="og:title" content="Premium Cannabis Strains | Firestorm Cultivation"/>)
  3. Add og:image tag pointing to a high-quality image (1200×630px recommended) relevant to each page (e.g., <meta property="og:image" content="https://firestormcultivation.com/images/hub2-preview.jpg"/>)
  4. Also add og:description, og:url, and og:type tags for consistency across all platforms
  5. Test each shared URL using Facebook's Sharing Debugger (facebook.com/sharing/debugger) and LinkedIn Post Inspector to verify the preview renders correctly
  6. If using a CMS, check for a built-in SEO plugin (Yoast, Rank Math, etc.) that can auto-generate OG tags — many allow bulk editing

21. Title length 155 chars

What it means (plain English)

Your page title (the text that appears in browser tabs and search results) is 155 characters long, but search engines prefer 20–65 characters. Titles longer than 60 characters typically get truncated in Google search results, meaning the end of your message ('Firestorm') may be cut off and invisible to potential customers.

Why it matters for your business: Customers searching for cannabis dispensaries may not see your brand name or key product offerings in search results, reducing click-through rates and foot traffic to your Orono location.

Technical root cause: The title tag was written to cram in keywords and location names for SEO. While longer titles sometimes appear to help with rankings, Google displays only 50–60 characters on desktop and ~40 on mobile, so excess text wastes space and confuses your message.

Recommended fix — step by step

  1. Open the page source (right-click → View Page Source) or use a CMS editor and locate the <title> tag in the <head> section.
  2. Rewrite the title to 50–58 characters, prioritizing brand + primary keyword + location: example: 'Cannabis Dispensary in Orono ME | Firestorm'.
  3. Verify the new title displays fully in Google search results by searching 'cannabis dispensary orono me' and checking the SERP snippet.
  4. Apply the same fix to any other location pages (/dispensary-near-old-town-me/, /milford-me/, /bradley-me/) using the same pattern: 'Cannabis [Product] in [Town] ME | Firestorm'.
  5. If on WordPress, install Yoast SEO → go to each page → Readability tab → check 'Title width' indicator and adjust until green.

22. Title length 161 chars

What it means (plain English)

Your page title is 161 characters long, but search engines like Google typically display only 50-60 characters in search results before truncating with an ellipsis. The extra words are invisible to searchers and waste valuable real estate. A shorter, punchy title keeps your key message — dispensary location and product types — front and center.

Why it matters for your business: Searchers see a cut-off title in Google results, which reduces click-through rates and makes your listing look less polished than competitors with concise, clear titles.

Technical root cause: The title tag in the HTML head section exceeds the effective display limit for search engine result pages. Search engines cut off titles to maintain consistent formatting, so the effort to write a longer title is wasted.

Recommended fix — step by step

  1. Open the page source or inspect element on https://firestormcultivation.com/bangor-me/dispensary-near-bangor-airport-bgr/ and locate the <title> tag in the <head>
  2. Shorten the title to 50-60 characters maximum; suggested format: 'Cannabis Dispensary Near Bangor Airport | Firestorm Cultivation'
  3. Keep the most important keywords first: location, product type (vapes/edibles), and brand name
  4. Remove redundant words like 'Adult-Use' and 'Serving Hermon & Brewer' — use meta descriptions for secondary location info instead
  5. Update the title tag and test the change using Google Search Console Preview Tool (Search Appearance > HTML Improvements) to confirm the title displays without truncation
  6. Apply this same truncation pattern to all dispensary location pages (Hermon, Brewer, etc.) for consistency

23. Title length 176 chars

What it means (plain English)

Your page title—the clickable headline in search results—is 176 characters long. Google typically displays 50-65 characters on desktop and fewer on mobile, so the extra text gets cut off and wasted. Search engines and visitors never see the full benefit of that keyword stuffing.

Why it matters for your business: Visitors clicking from Google see a truncated title that may look incomplete or spammy, reducing click-through rates and trust in your dispensary listing.

Technical root cause: The title tag was written to cram multiple city names and product types (Bangor, Brewer, Hampden, etc.) hoping to rank for each, but search engines ignore anything past ~65 characters and may penalize keyword stuffing as low-quality SEO.

Recommended fix — step by step

  1. Open your site's HTML head or CMS page editor for https://firestormcultivation.com/bangor-me/
  2. Locate the <title> tag (or 'SEO Title' / 'Page Title' field if using a CMS like WordPress)
  3. Trim to 50–60 characters, prioritizing your main city and primary keyword: 'Bangor ME Cannabis Dispensary | Firestorm Cultivation' (59 chars)
  4. Remove secondary cities (Brewer, Hampden, etc.) from the title; move them to the meta description or H1 heading instead
  5. Test the new title in Google's SERP preview tool (search.google.com → your URL → inspect in mobile/desktop view) to confirm it displays fully
  6. Repeat this audit for other location pages (e.g., /brewer-me/) using the same formula

24. Title length 176 chars

What it means (plain English)

Your page title (the text that appears in browser tabs and search results) is 176 characters long. Search engines typically display only 50–60 characters before truncating with '…', so everything after 'Bangor ME |' gets cut off in Google results. This wastes prime real estate where you could reinforce your brand or call-to-action.

Why it matters for your business: Customers searching for 'cannabis near me' see a truncated title in results, reducing click-through rate and missing the opportunity to highlight Firestorm's name and key differentiators.

Technical root cause: The title was written to stuff multiple location keywords and product types, but didn't account for display length limits in search engines and browsers.

Recommended fix — step by step

  1. Open the Orono page source (right-click → View Page Source) and locate the <title> tag
  2. Rewrite the title to 50–60 characters max. Suggested: 'Firestorm Cannabis Dispensary | Orono, ME'
  3. Test the new title in Google Search Console preview tool (console.google.com → URL Inspection → search results preview) to confirm it displays fully
  4. Apply the same 50–60 character limit to title tags on all location pages (/veazie-me/, /bangor-me/, etc.)
  5. Keep location + 'cannabis' + 'dispensary' in the title; move secondary keywords (THC edibles, craft flower, pre-rolls) to the meta description instead

25. Description length 161 chars

What it means (plain English)

Your homepage meta description (the preview text shown in Google search results) is 161 characters long. Search engines prefer 80–160 characters because longer text gets cut off on mobile and desktop, making your listing look incomplete. A trimmed version will display fully and encourage more clicks.

Why it matters for your business: A truncated search result preview reduces click-through rate from organic search, directly lowering qualified traffic to your dispensary's site.

Technical root cause: The meta description tag in the page's HTML head contains 161 characters instead of staying within the 80–160 character sweet spot that displays uncut in most search engines.

Recommended fix — step by step

  1. Open https://firestormcultivation.com/ in a browser and inspect the page source (right-click → View Page Source) to locate the <meta name="description" content="..."> tag
  2. Copy the current description text and paste it into a word counter (e.g., charactercounter.com)
  3. Rewrite it to 155 characters or fewer, keeping your key message (e.g., 'Premium cannabis cultivation in [city]. Licensed dispensary with lab-tested flower, concentrates, and edibles.').
  4. If using WordPress, navigate to Yoast SEO → Settings → Titles & Metas → Homepage, find the Meta description field, paste the trimmed text, and click Save
  5. If using Elementor, go to the Elementor dashboard, open the home page, scroll to SEO settings (usually in the page settings panel), update the meta description, and Publish
  6. Verify the change by searching 'site:firestormcultivation.com' in Google, waiting 24–48 hours for the cache to refresh, and confirming the search result preview now shows the full text

26. Title length 210 chars

What it means (plain English)

Your homepage title is 210 characters long, but search engines display only 50–60 characters in results. Everything beyond that gets cut off, wasting space on keywords that users never see. This particular title also repeats location names and the brand name, which dilutes the message.

Why it matters for your business: Users searching for cannabis in your service areas see a truncated title in Google results, missing key differentiators like 'Live Hash Rosin' or 'Weed Delivery' that could drive clicks.

Technical root cause: The title was likely built by concatenating product categories, location names, and brand name without optimizing for display length or search intent hierarchy.

Recommended fix — step by step

  1. Open your site's HTML <head> and locate the <title> tag (or use browser DevTools → Inspector → Elements → search for '<title>')
  2. Rewrite to: 'Firestorm Cannabis Dispensary | Hash Rosin, Edibles & Delivery | Bradley, ME' (58 chars) — prioritize your strongest differentiator and lead location
  3. If using WordPress, go to Settings → General and check if a SEO plugin (Yoast, Rank Math, All in One SEO) is overriding the title; if so, update the title rule there instead of in <head>
  4. If using a page builder (Elementor, etc.), check the page settings panel for 'SEO Title' or 'Meta Title' field and paste the new title there
  5. Test the result using Google Search Console → URL Inspection tool → paste your homepage URL and verify the new title renders in preview

27. Description length 161 chars

What it means (plain English)

Your homepage meta description (the short text that appears below your site title in Google search results) is 161 characters long. Google typically displays 150–160 characters on desktop before cutting off, so yours will be truncated. This means potential customers won't see your complete message.

Why it matters for your business: A cut-off description reduces click-through rates from search results because visitors can't see your full value proposition or call-to-action before deciding whether to visit your site.

Technical root cause: The meta description tag in your HTML head contains more text than the recommended 160-character limit. Most CMS platforms or manual HTML editing allowed this without warning.

Recommended fix — step by step

  1. Open your homepage in a browser and right-click → Inspect → search for <meta name="description" content=
  2. Copy the current description text and count the characters (or use a tool like https://www.charactercoun.com)
  3. Trim the description to 155 characters maximum while keeping the most important keywords (e.g., 'Firestorm Cultivation — premium cannabis products in [city]. Order online or visit our dispensary.')
  4. Paste the revised description back into your meta description tag (ask your web host or CMS admin if you don't have direct access)
  5. Clear your browser cache and re-check the page in Google Search Console → Pages → click your URL → see the preview update within 24 hours

28. Title length 210 chars

What it means (plain English)

Your homepage title is 210 characters long, but search engines like Google typically display only the first 50–65 characters in search results. Everything after that gets cut off, wasting valuable real estate and making your listing look incomplete. A concise title helps customers quickly understand what you offer and improves click-through rates from search results.

Why it matters for your business: Shortened, focused titles increase clicks from Google search results, directly driving more qualified traffic to your dispensary's site and improving conversion potential.

Technical root cause: The title tag was written to include every service, location, and product type to maximize keyword coverage, but this violates search engine display constraints and reduces readability.

Recommended fix — step by step

  1. Open your site's head HTML or CMS page settings and locate the title tag for the homepage
  2. Rewrite the title to 50–60 characters maximum. Example: 'Firestorm Cannabis Dispensary | Maine Marijuana Delivery'
  3. Keep your highest-priority keywords first: brand name, primary service (dispensary/delivery), and location
  4. If using Elementor (detected in URL), check Elementor → Theme Builder → Header/Title settings for any dynamic title overrides
  5. If you cannot directly edit HTML, check if your hosting control panel or site builder (WordPress, Shopify, etc.) has an SEO plugin; install Yoast SEO (WordPress) or equivalent and set the title there
  6. Test the shortened title in Google Search Console (search-console.google.com) under 'Performance' to see how it renders in real search results
  7. Create a secondary title for interior category pages (e.g., 'Live Hash Rosin | Firestorm Cannabis Maine') to target specific products without cluttering the homepage

29. Description length 161 chars

What it means (plain English)

Your homepage meta description—the text that appears below your site title in Google search results—is 161 characters long. Google typically displays 150–160 characters on desktop before truncating. This means the end of your message gets cut off, potentially losing important information like your location or key offer.

Why it matters for your business: Customers browsing search results may not see your complete message, reducing click-through rates and losing an opportunity to highlight your dispensary's unique value (location, special deals, license status).

Technical root cause: The meta description tag in your page's HTML header exceeds the recommended character limit, likely because the description was written without length constraints or automated length validation.

Recommended fix — step by step

  1. Identify your current meta description by visiting https://firestormcultivation.com/ in a browser, right-clicking, selecting 'View Page Source,' and searching for '<meta name="description"'
  2. Rewrite the description to 155 characters or fewer, prioritizing the most important details (e.g., 'Premium cannabis dispensary in [City]. Licensed, lab-tested flower & products. Shop online or visit us today.')
  3. If using Elementor or a page builder, check the page settings for an SEO/Meta tab and update the description field directly
  4. If on WordPress, install Yoast SEO (free version), edit the homepage, scroll to the Yoast SEO box, paste your new description in the 'Snippet Preview' section, and verify the length indicator shows green
  5. After updating, clear your site's cache (if you have WP Super Cache or similar installed) and re-run an audit tool to confirm the change

30. Title length 16 chars

What it means (plain English)

Your blog category page has a title tag that's too short — only 16 characters. Search engines use the title tag as the main headline for your page in search results. A title between 20–65 characters gives you room to include relevant keywords and a clear description of what visitors will find, making your page more likely to be clicked.

Why it matters for your business: A weak title reduces click-through rates from search results, meaning fewer people discover your blog content and your brand — missed opportunities for engagement and trust-building with potential customers.

Technical root cause: The page title "Blog | Firestorm" is incomplete and doesn't describe the blog's content or value proposition. Most CMS platforms auto-generate category titles as "Category Name | Site Name," which often undershoots the recommended length.

Recommended fix — step by step

  1. Identify your blog's primary topic or focus (e.g., 'cannabis growing tips,' 'strain reviews,' 'cultivation news') and audience.
  2. Open the blog category page settings in your CMS admin panel (usually under Pages > Blog Category or similar).
  3. Edit the title to be 20–65 characters and include the focus topic — example: "Cannabis Growing Tips & Insights | Firestorm" (52 chars).
  4. Ensure the new title naturally includes keywords your audience searches for (use Google Search Console or free tools like Ubersuggest to verify search volume).
  5. Save changes and verify the new title appears in a browser tab and Google's mobile preview tool (search.google.com > URL Inspection).

31. Description length 18 chars

What it means (plain English)

Your blog category page has a meta description (the snippet shown in Google search results) that is only 18 characters long. Google recommends 80–160 characters so the full description appears in search results instead of being cut off. A truncated description gives searchers less information to decide if your page is relevant.

Why it matters for your business: Incomplete search result snippets reduce click-through rate from potential customers searching for cannabis education or product info, directly impacting traffic to your blog.

Technical root cause: The page's meta description tag is either missing, empty, or contains only a very short string. Search engines fall back to truncating page content when a proper description is not provided.

Recommended fix — step by step

  1. Log into your CMS admin panel and navigate to the blog category page settings.
  2. Find the meta description field (often labeled 'Meta Description' or 'SEO Description') in the page editor.
  3. Write a 80–160 character description that includes your target keyword (e.g., 'Cannabis education, growing tips, and strain reviews from Firestorm Cultivation. Explore our blog for expert insights.') — exactly 128 characters.
  4. Save and publish the page.
  5. Wait 1–2 weeks for Google to recrawl, then check Google Search Console (Search Appearance > HTML Improvements) to confirm the description is now recognized.

32. Missing OpenGraph metadata

What it means (plain English)

When your blog posts or pages are shared on Facebook, Instagram, or other social platforms, those networks look for OpenGraph tags to know what image and title to display. Without them, social shares show a generic preview instead of your custom branding and content.

Why it matters for your business: Missing social preview cards reduce click-through rates on shared posts and make your brand look unprofessional when customers tag or recommend Firestorm content on social media.

Technical root cause: The blog category page lacks og:title and og:image meta tags in its HTML head. Social platforms default to page title or first image found when these tags are absent.

Recommended fix — step by step

  1. Open your site's blog category page in a browser, right-click, select 'View Page Source', and search for '<meta property="og:' to confirm tags are missing
  2. Access your site's template or CMS for the blog category page (if WordPress: Appearance → Theme File Editor; if custom HTML: edit the .html file directly)
  3. Add '<meta property="og:title" content="Firestorm Cultivation Blog"/>' in the <head> section
  4. Add '<meta property="og:image" content="[URL to a 1200×630px branded image]"/>' in the <head> section
  5. Add '<meta property="og:type" content="website"/>' for consistency
  6. Test the fix using Facebook's Sharing Debugger (facebook.com/sharing/debugger) — paste the URL and verify the preview now shows your custom image and title
  7. Repeat for other category or archive pages that users might share

33. 1 image(s) missing alt text

What it means (plain English)

One image on your blog category page doesn't have alt text — a short text description that tells screen readers and search engines what the image shows. This hurts both accessibility (customers using screen readers can't understand that image) and SEO (Google can't index it properly).

Why it matters for your business: Customers with visual impairments may leave your site frustrated, and you're missing an SEO signal that could help your blog rank higher in search results.

Technical root cause: The image element lacks an alt attribute, or the alt attribute is empty. This is typically a content management or template oversight during blog post creation.

Recommended fix — step by step

  1. Visit https://firestormcultivation.com/category/blog/ and inspect the page to identify which image is missing alt text (use Chrome DevTools: right-click → Inspect, search for <img tags without alt or with empty alt)
  2. Log into your site admin (WordPress dashboard, Shopify, or equivalent) and navigate to that blog post
  3. Click on the image to select it and open its settings/properties panel
  4. Add descriptive alt text (2–10 words; e.g., 'Firestorm Cultivation cannabis flower on white background') and save
  5. If using WordPress: confirm the alt field is filled in the Media Library attachment details, then re-save the post
  6. Run the page through a free accessibility checker (wave.webaim.org or axe DevTools Chrome extension) to confirm the alt text is now present

34. Multiple H1s on homepage (2)

What it means (plain English)

Your homepage has two H1 headings (the largest, most important heading level). Search engines expect exactly one H1 per page—it acts like the page's main title. Multiple H1s confuse search engines about what your page is actually about and dilute the SEO signal you're sending.

Why it matters for your business: Multiple H1s weaken your search visibility for key cannabis retail terms; customers searching for your dispensary or products are slightly less likely to find you in Google results.

Technical root cause: The page HTML contains two <h1> tags instead of one. This typically happens when a logo/brand name and a page headline are both marked as H1, or when multiple sections each claim top-level importance.

Recommended fix — step by step

  1. View the homepage source code (right-click → View Page Source) and search for '<h1' to locate both instances.
  2. Decide which heading is your main page topic (usually something like 'Premium Cannabis Products' or your dispensary name)—keep that as H1.
  3. Change the other H1 to an H2 (or H3 if it's a sub-section) by editing the HTML or your page builder.
  4. If using WordPress, check your theme settings or a plugin like Yoast SEO (Admin → SEO → Search Appearance) to see if logo markup is auto-generating an H1; disable if possible.
  5. If you're using a page builder (Elementor, Divi, etc.), select the secondary heading block and change its 'Heading Level' dropdown from H1 to H2.
  6. Verify the change: refresh the homepage and re-check the source code to confirm only one <h1> remains.

35. Missing security header: x-content-type-options

What it means (plain English)

Your site is missing the X-Content-Type-Options security header, which tells browsers not to guess the file type of responses. Without it, a browser might misinterpret a text file as executable code (MIME-type sniffing), creating a potential security gap. This is a best-practice header that takes seconds to add.

Why it matters for your business: Missing this header slightly weakens your site's security posture and may lower your fortress/security score in audits, which can affect customer trust and compliance standing in regulated cannabis markets.

Technical root cause: Your WordPress site (running on Bluehost via Cloudflare) is not configured to emit this header. It's likely either the server, the WordPress configuration, or a security plugin is not setting it.

Recommended fix — step by step

  1. Log into WordPress admin → Plugins → search for 'security headers' and install one of: Wordfence, All In One WP Security & Firewall, or iThemes Security.
  2. Activate the plugin and navigate to its security/headers section.
  3. Enable 'X-Content-Type-Options: nosniff' in the plugin's HTTP headers settings.
  4. Save and clear any caching plugins (Autoptimize, W3 Total Cache, etc.) to force a refresh.
  5. Verify the header is now present by opening DevTools (F12) → Network tab → click the homepage request → Headers tab and look for 'x-content-type-options: nosniff'.

36. Missing security header: permissions-policy

What it means (plain English)

Your website is missing a Permissions-Policy security header, which is a directive that tells browsers which device features (camera, microphone, geolocation, payment APIs) your site is allowed to use. Without it, third-party scripts embedded on your site could potentially request access to these features without your explicit control.

Why it matters for your business: Missing this header slightly weakens your site's security posture and could expose customer data or device access if a malicious script is injected; for a cannabis retailer handling age verification and payment data, security gaps create compliance and liability risk.

Technical root cause: The server (hosted on Bluehost via Cloudflare) is not configured to emit the Permissions-Policy header in HTTP responses. This is a server-side or hosting-level configuration that must be set explicitly.

Recommended fix — step by step

  1. Log into your Bluehost cPanel → File Manager → navigate to your WordPress root directory (public_html)
  2. Open or create an .htaccess file in the root directory and add the line: Header set Permissions-Policy "geolocation=(), microphone=(), camera=(), payment=()"; (adjust the parentheses contents if your site legitimately uses any of these features)
  3. Save the file and test the header is present by visiting https://securityheaders.com and entering your domain URL
  4. If .htaccess editing fails, contact Bluehost Support and request they add the Permissions-Policy header at the server level for your domain

37. DNSSEC not enabled

What it means (plain English)

Your domain's DNS records are not cryptographically signed. This means someone could theoretically intercept or redirect your domain traffic without detection. DNSSEC (DNS Security Extensions) adds a verification layer that confirms your DNS answers are legitimate and unaltered.

Why it matters for your business: Without DNSSEC, a sophisticated attack could redirect your customers to a fake site, compromising customer data, payments, and your license compliance documentation.

Technical root cause: DNSSEC is not enabled at your domain registrar. It requires DS records to be added to your registrar's console and corresponding DNSSEC signing at your DNS provider.

Recommended fix — step by step

  1. Log in to your domain registrar (GoDaddy, Namecheap, Google Domains, etc.) and locate your domain settings.
  2. Find the DNS or DNSSEC management section.
  3. Check if your DNS provider (likely the same registrar) offers DNSSEC signing; if yes, enable 'DNSSEC signing' in their DNS console.
  4. The registrar will provide DS records (Delegation Signer); add these to the registrar's DNSSEC tab.
  5. Wait 24–48 hours for propagation, then verify at a DNSSEC checker tool like Zonemaster (https://zonemaster.iis.se/) or your registrar's validation tool.
  6. Document completion for your compliance file (helpful if audited on security practices).

38. No CAA DNS records

What it means (plain English)

Your domain's DNS settings don't include CAA records, which are a security safeguard that tells certificate authorities (companies that issue SSL certificates) which ones are allowed to create certificates for your site. Without CAA records, any CA could potentially issue a fraudulent certificate for firestormcultivation.com, allowing someone to impersonate your site.

Why it matters for your business: A rogue SSL certificate could let attackers intercept customer orders, steal payment data, or redirect visitors to a fake dispensary site, directly damaging trust and revenue.

Technical root cause: CAA (Certification Authority Authorization) DNS records have not been configured. Your DNS provider has no restrictions in place limiting which certificate authorities can issue certificates for your domain.

Recommended fix — step by step

  1. Log into your domain registrar's DNS control panel (likely GoDaddy, Namecheap, or your web host's cPanel).
  2. Locate the DNS records section and add a new CAA record with flags=0, tag=issue, value="letsencrypt.org".
  3. Add a second CAA record with flags=0, tag=issue, value="digicert.com" (or your current cert issuer—check your SSL cert provider).
  4. Add a third CAA record with flags=0, tag=issuewild, value="letsencrypt.org" to protect wildcard subdomains.
  5. Wait 15–30 minutes for DNS propagation and verify using a DNS checker tool (e.g., mxtoolbox.com CAA lookup).

39. Lighthouse a11y (mobile): 92/100

What it means (plain English)

Your mobile site scores 92/100 on accessibility—close to your 95 target, but missing a few small fixes. Accessibility means people with disabilities (vision, hearing, motor) can use your site fully. Common issues at this score level are missing image labels, low color contrast on text, or interactive buttons that aren't keyboard-friendly.

Why it matters for your business: Better accessibility expands your customer base, improves trust with age-gated compliance tools, and signals to Google that your site is well-maintained—all good for search rankings.

Technical root cause: The Lighthouse audit detected at least one of: missing or incorrect alt text on images, insufficient color contrast ratios (text must be legible for low-vision visitors), form fields without labels, or interactive elements not operable via keyboard or screen reader.

Recommended fix — step by step

  1. Download the full Lighthouse HTML report linked in the evidence (lighthouse-mobile.html) and open it in a browser to see the exact failed audits listed under 'Accessibility'.
  2. For each failed audit, note the specific rule (e.g., 'Image elements must have alt text') and affected element (e.g., which image or button).
  3. If issues are image alt text: add descriptive alt attributes to all product/menu images (e.g., alt='Fire OG strain product photo').
  4. If issues are color contrast: identify text with contrast ratio < 4.5:1 for normal text or < 3:1 for large text; increase font weight or darken background color to meet WCAG AA standards.
  5. If issues are form/button labels: ensure every input field has an associated <label> element or aria-label attribute, and all clickable elements have visible text or icon labels.
  6. Re-run Lighthouse on mobile (DevTools → Lighthouse → Mobile) and confirm score reaches 95+.

40. LH mobile: Reduce unused CSS (Est savings of 42 KiB)

What it means (plain English)

Your site is loading 42 kilobytes of CSS code on mobile devices that isn't being used on the visible page. This is like shipping a truck full of supplies when you only need a handful—the extra weight slows down page load. By removing or deferring unused styles, mobile visitors see your site faster.

Why it matters for your business: Faster mobile load times directly reduce bounce rates and improve conversion for mobile customers browsing your menu, pricing, or compliance information.

Technical root cause: CSS files are likely being loaded globally across all pages, or third-party stylesheets (animations, icon libraries, unused framework components) are included without being optimized for the critical path.

Recommended fix — step by step

  1. Run Chrome DevTools (F12 → Coverage tab) on the homepage to identify which CSS rules are unused; note the file names and line ranges.
  2. Audit your stylesheet includes: open page source (Ctrl+U) and list all <link rel="stylesheet"> tags, checking if any third-party libraries (Bootstrap, Font Awesome, etc.) can be replaced with minimal alternatives.
  3. If using a CMS or page builder: disable unused extensions/plugins (e.g., animation libraries, extra font packs) that load CSS globally.
  4. For critical above-the-fold CSS: move it inline in a <style> tag in the <head> and defer non-critical CSS using <link rel="preload" as="style" onload="this.onload=null;this.rel='stylesheet'">.
  5. Use PurgeCSS or similar tool: identify unused selectors across your HTML files and remove them from your main stylesheet.
  6. Test mobile load time via Lighthouse (F12 → Lighthouse → Mobile) after each change and confirm the 42 KiB reduction appears.

41. LH mobile: Serve images in next-gen formats (Est savings of 210 KiB)

What it means (plain English)

Your site is serving images in older formats (PNG and JPEG) that are larger than necessary. Modern formats like WebP can compress the same images 25–35% smaller, meaning faster page loads and lower bandwidth costs. This is especially noticeable on mobile phones with slower connections.

Why it matters for your business: Faster pages reduce bounce rate, improve search ranking, and lower your hosting bandwidth bill—every KB saved compounds across thousands of monthly visitors.

Technical root cause: Images are being uploaded and delivered without conversion to next-gen formats. Most web servers and browsers now support WebP (and newer browsers support AVIF), but the site hasn't implemented automatic format selection based on browser capability.

Recommended fix — step by step

  1. Audit which images on the homepage and product pages are largest (use Chrome DevTools → Network → Images tab, sort by size). Prioritize hero images and product photos.
  2. If using a CDN (Cloudflare, Akamai, etc.): enable 'Polish' or 'Image Optimization' in CDN settings to auto-convert to WebP/AVIF. If self-hosted, install a WordPress plugin like 'ShortPixel' or 'Smush' to batch-convert existing images to WebP with JPEG fallback.
  3. Update image HTML tags to use <picture> element with srcset fallback: <picture><source srcset='image.webp' type='image/webp'><img src='image.jpg' alt='...'></picture> for manual control.
  4. Re-run Lighthouse mobile audit (Chrome DevTools → Lighthouse → Mobile) after conversion to confirm savings.

42. LH mobile: Properly size images (Est savings of 23 KiB)

What it means (plain English)

Your site is serving full-sized images to mobile phones when smaller versions would load faster and use less data. For example, a phone displays a 400-pixel-wide image but downloads a 1200-pixel version. This wastes bandwidth and slows page load, especially on slower 4G connections.

Why it matters for your business: Slow mobile load times frustrate customers on their phones, increase bounce rates, and hurt your Google search ranking—especially critical since most dispensary visitors search on mobile to find hours, products, and locations.

Technical root cause: The site is not using responsive image techniques (HTML srcset attribute or CSS media queries) to serve different image sizes based on device screen width. All visitors receive the same large image file regardless of their device.

Recommended fix — step by step

  1. Audit current images: Use Chrome DevTools (F12 → Network tab, set throttle to 'Slow 4G', reload) to identify images over 300 KiB on mobile view.
  2. For WordPress sites: Install the Smush Pro or ShortPixel plugin, enable 'Adaptive Images' setting, and regenerate thumbnails for existing images.
  3. For non-WordPress/custom HTML: Add srcset attribute to <img> tags (e.g., <img src='large.jpg' srcset='small.jpg 480w, medium.jpg 800w, large.jpg 1200w' sizes='(max-width:600px) 480px, 800px'>).
  4. Create image breakpoints: Generate 3–4 versions of each hero/product image (480px, 800px, 1200px widths).
  5. Test on real devices: Use Chrome Mobile DevTools or BrowserStack to verify load times on iPhone and Android at 4G speed.
  6. Monitor improvement: Re-run Lighthouse in Chrome (F12 → Lighthouse tab) after changes; confirm 'Properly size images' score improves.

43. Lighthouse a11y (desktop): 91/100

What it means (plain English)

Your site scored 91/100 on Google's accessibility audit, missing the 95 target by 4 points. Accessibility means your site works well for people using screen readers, keyboards, or other assistive tools. A score of 91 is solid but indicates a few small barriers remain that prevent some visitors from using your site comfortably.

Why it matters for your business: Accessibility barriers can exclude customers and expose you to legal risk under the ADA; moreover, accessible sites rank better in Google search results and load faster for all visitors.

Technical root cause: The detailed Lighthouse report lists specific issues (likely missing alt text on images, low color contrast, or unlabeled form fields). Without seeing the full HTML report, the exact culprits are unclear, but they are almost certainly minor markup or styling oversights.

Recommended fix — step by step

  1. Open the Lighthouse HTML report at /Users/markwallace/BKH/apex-sentinel/runs/2026-04-19T06-18-18-831Z/lighthouse/firestorm/lighthouse-desktop.html and scroll to the 'Accessibility' section to see the list of failed audits (e.g., 'Image elements do not have alt attributes').
  2. For each failed audit, note the rule name and affected elements (e.g., 'Heading levels should not be skipped' or 'Buttons do not have an accessible name').
  3. If your CMS is WordPress, use a plugin like Accessibility Checker (free) to scan the pages listed in the report and auto-flag issues in the editor.
  4. For images: add descriptive alt text in the image settings that explains what the image shows in 5–10 words (do not repeat the filename).
  5. For forms: ensure all input fields have associated <label> elements (in HTML: <label for="input-id">Label Text</label><input id="input-id" />), or use ARIA labels if labels are not visually shown.
  6. For color contrast: use a tool like WebAIM Contrast Checker to test text/background pairs; aim for WCAG AA (4.5:1 for body text).
  7. Re-run Lighthouse in Chrome DevTools (F12 → Lighthouse → Analyze page load) on the homepage to confirm the score improved above 95.

44. Lighthouse seo (desktop): 85/100

What it means (plain English)

Lighthouse is reporting an SEO score of 85 out of 100 on desktop, which falls short of your target of 95. This score reflects missing or incomplete on-page SEO signals—such as missing meta descriptions, heading hierarchy issues, or structured data gaps—that search engines use to understand and rank your content.

Why it matters for your business: A sub-95 SEO score means you're leaving search visibility on the table; potential customers searching for cannabis dispensaries, strains, or products in your area may not find you as readily, directly impacting foot traffic and online orders.

Technical root cause: Lighthouse's SEO audit flags common issues: meta descriptions may be missing or too short, heading structure (H1, H2, etc.) may be inconsistent or absent, or schema.org structured data (product, organization, or local business markup) may be incomplete or malformed.

Recommended fix — step by step

  1. Download the full Lighthouse HTML report from the path provided (/Users/markwallace/BKH/apex-sentinel/runs/2026-04-19T06-18-18-831Z/lighthouse/firestorm/lighthouse-desktop.html) and review the 'SEO' audit section to identify which specific signals are failing.
  2. Check that every page (home, product pages, about, contact) has a unique meta description (120–160 characters) that includes your primary keyword and a call-to-action.
  3. Verify your homepage has exactly one H1 tag containing your main keyword (e.g., 'Premium Cannabis Dispensary [City Name]'), and all subheadings follow H2 → H3 hierarchy with no skipped levels.
  4. Add schema.org structured data: use LocalBusiness markup for your dispensary (name, address, phone, hours, license number), Product markup for each strain/product listing, and FAQPage if applicable. Use Google's Structured Data Testing Tool (schema.org/tools) to validate.
  5. Ensure your robots.txt and sitemap.xml are present and correctly configured; submit your sitemap to Google Search Console and Bing Webmaster Tools.
  6. Check for duplicate content issues across canonical URLs; ensure each page has a self-referential canonical tag or relies on your CMS default.
  7. Audit internal linking: ensure key pages (product categories, license/compliance page) are reachable within 2–3 clicks from the homepage with descriptive anchor text.

45. Description length 161 chars

What it means (plain English)

Your homepage meta description (the snippet Google shows under your site name in search results) is 161 characters long. Search engines typically display 150–160 characters before truncating, so your message is being cut off. This means potential customers see an incomplete pitch.

Why it matters for your business: A truncated meta description reduces click-through rate from search results because visitors can't read your full value proposition before deciding whether to visit your site.

Technical root cause: The meta description tag in your HTML head contains more text than the recommended 80–160 character range. Search engines truncate longer descriptions to fit their display format.

Recommended fix — step by step

  1. Open your homepage HTML (or CMS editor) and locate the meta description tag.
  2. Rewrite it to be 155–160 characters max. Example: 'Premium cannabis products in [your city]. Lab-tested flowers, edibles & concentrates. Licensed dispensary. Shop now.' (adjust for your actual offerings).
  3. Count characters carefully using an online counter (search 'character counter') to stay within range.
  4. If using a CMS (WordPress, Shopify, etc.), the meta description is usually in an 'SEO' or 'Head' section of the page editor.
  5. Save and republish the page.
  6. Check Google Search Console > Pages to confirm the change is indexed within 24–48 hours.

46. Description length 167 chars

What it means (plain English)

Your contact page's search engine preview text is 167 characters long, exceeding the recommended 80–160 character range. Search engines will truncate this in results, cutting off the end of your message. This is a minor formatting issue that doesn't affect your site's functionality, but it does affect how potential customers see you in Google.

Why it matters for your business: A truncated meta description may fail to communicate your key contact information or call-to-action in search results, slightly reducing click-through rates from local search.

Technical root cause: The meta description HTML tag on the contact page contains more text than search engines typically display in their results snippets (usually 155–160 characters on desktop, fewer on mobile).

Recommended fix — step by step

  1. Open your contact page in your website editor or CMS admin panel.
  2. Locate the page's meta description field (often labeled 'SEO Description' or 'Meta Description').
  3. Trim the text to 150 characters or fewer, ensuring it includes your key message (e.g., 'Contact Firestorm Cultivation to order premium cannabis products. Phone: [number]. Email: [email].').
  4. Save and publish the page.
  5. In Google Search Console, navigate to 'Pages' and verify the contact page URL updates within 1–2 days.

47. Description length 161 chars

What it means (plain English)

Your page description—the text that appears below your link in Google search results—is 161 characters long, one character over the recommended 80-160 range. Google will truncate it in search results on mobile devices, cutting off the end of your message. This is a minor formatting issue that doesn't break anything, but it wastes the opportunity to make your full message visible to potential customers searching for you.

Why it matters for your business: Customers searching for cannabis deals won't see your complete value proposition in search results, potentially reducing click-through rates from Google searches to your site.

Technical root cause: The meta description tag on this page contains 161 characters. Search engines display roughly 155-160 characters on mobile and 155-160 on desktop before truncating.

Recommended fix — step by step

  1. Navigate to https://firestormcultivation.com/?elementor_library=deals-for-dispensaries in your browser
  2. Open your page editor (likely Elementor if your platform uses it) and locate the SEO/Meta section
  3. Find the 'Meta Description' field
  4. Count the current text and trim it to 155 characters or fewer
  5. Ensure the shortened version still includes your key message (e.g., 'Firestorm Cultivation: Premium cannabis deals & dispensary offers')
  6. Save and republish the page
  7. Re-run an SEO audit tool or Google Search Console to confirm the fix

48. Description length 161 chars

What it means (plain English)

Your homepage meta description (the preview text that appears under your link in Google results) is 161 characters long, which is 1 character over the ideal 80–160 range. Google may truncate it on mobile devices, cutting off your message. This is a minor visibility issue that's easy to fix.

Why it matters for your business: Customers searching for cannabis products may see an incomplete description in search results, reducing click-through rates and potentially losing traffic to competitors with cleaner, fully-visible snippets.

Technical root cause: The meta description tag in the page's HTML head is slightly too long; most search engines display 155–160 characters on desktop and ~120 on mobile before truncation.

Recommended fix — step by step

  1. Log in to your website admin (WordPress dashboard, page builder, or CMS backend)
  2. Navigate to the homepage or home page settings
  3. Find the SEO or Meta section (often labeled 'Meta Description' or in an SEO plugin like Yoast SEO / Rank Math)
  4. Edit the description to be exactly 150–158 characters; aim for a clear, benefit-focused message like 'Premium cannabis cultivated for potency & quality. [Your City] delivery & in-store pickup. Licensed & tested.'
  5. Preview the new description in Google's search results preview tool to confirm it displays fully
  6. Save and publish the change

49. Description length 161 chars

What it means (plain English)

Your homepage meta description (the short text that appears under your site name in Google search results) is 161 characters long. Google typically shows 150-160 characters on desktop before truncating. This means the end of your message gets cut off in search results, potentially losing important information like a call-to-action or location detail.

Why it matters for your business: Customers searching for cannabis dispensaries may not see your complete value proposition or location info in search results, reducing click-through rates and foot traffic.

Technical root cause: The meta description tag in your HTML head is slightly too long; it exceeds the recommended 160-character limit by one character, causing truncation in search engine display.

Recommended fix — step by step

  1. Open your site in a browser and right-click → Inspect on the homepage to view the page source
  2. Search the code for the <meta name="description" content="..." /> tag
  3. Count the text between the quotes and identify which words can be removed or shortened to get under 160 characters
  4. Edit the description to trim 1-2 characters while keeping the most important info (business name, location, key service) intact
  5. Save changes and wait 1-2 minutes for cache refresh, then verify in Google Search Console (Appearance → Title and Meta Descriptions) that it displays fully

50. Missing security header: referrer-policy

What it means (plain English)

Your website is missing a referrer-policy security header. This header controls what information is sent when visitors click links away from your site (e.g., whether the destination sees they came from your domain). Without it, browsers use their default behavior, which may leak visitor data unnecessarily.

Why it matters for your business: Missing security headers reduce your site's security posture and trust signals, which can affect search rankings and visitor confidence—especially important for a regulated industry like cannabis where compliance and professionalism matter.

Technical root cause: The server response headers do not include a Referrer-Policy directive. This is typically set at the web server level (nginx/Apache), in a CDN rule (you're behind Cloudflare), or via WordPress plugin.

Recommended fix — step by step

  1. Log in to your Cloudflare dashboard (cloudflare.com) and navigate to your domain
  2. Go to Rules > Transform Rules > Modify Response Header
  3. Create a new rule that adds header 'Referrer-Policy' with value 'strict-origin-when-cross-origin'
  4. Deploy the rule and verify it appears in response headers using curl -i https://firestormcultivation.com or a browser DevTools Network tab
  5. Alternative (if you have WordPress admin access): Install the 'Security Headers' plugin, enable Referrer-Policy, set it to 'strict-origin-when-cross-origin', and save

51. LH mobile: Preload Largest Contentful Paint image

What it means (plain English)

Your homepage's main visual element (the largest image visitors see first) is being loaded slower than it could be. By telling the browser to fetch this image earlier, before it renders the page, you'll show your hero image or banner faster to customers.

Why it matters for your business: Faster page load improves customer experience and slightly boosts Google's ranking algorithm—especially on mobile phones where many dispensary customers shop.

Technical root cause: The LCP (Largest Contentful Paint) image is either injected dynamically via JavaScript or not marked for preloading in the HTML head, so the browser doesn't prioritize downloading it until the page layout is processed.

Recommended fix — step by step

  1. Inspect the homepage source code (right-click → View Page Source) and locate the largest hero image or banner image URL
  2. In your site's <head> section (or in WordPress header.php or theme settings), add: <link rel="preload" as="image" href="[IMAGE-URL]" fetchpriority="high">
  3. If using WordPress, install the 'Smush' or 'Autoptimize' plugin, go to Settings, enable 'Lazy Load' and 'Image Preloading', and check 'Preload LCP images'
  4. If the image is part of a slider or dynamically loaded section, ensure the image URL is hardcoded in the initial HTML, not loaded via JavaScript after page load
  5. After deploying, test using Google's PageSpeed Insights tool (https://pagespeed.web.dev) to confirm LCP improved

52. Title length 210 chars

Detail

Title should be 20-65 chars. Got: "Firestorm Cannabis: Craft Cannabis Dispensary, Recreational Marijuana, THC Edibles, Live Hash Rosin, Pre-Rolls & Weed Delivery | Bradley ME, Hampden ME, Dexter ME, Old Town ME, Holden ME | Firestorm Cultivation"

53. Title length 159 chars

Detail

Title should be 20-65 chars. Got: "Recreational Dispensary Near Brewer ME - Adult-Use Cannabis Flower, THC Edibles, Live Rosin & Pre-Rolls | Serving Hampden, Hermon & Veazie | Firestorm Cannabis"

54. Title length 210 chars

Detail

Title should be 20-65 chars. Got: "Firestorm Cannabis: Craft Cannabis Dispensary, Recreational Marijuana, THC Edibles, Live Hash Rosin, Pre-Rolls & Weed Delivery | Bradley ME, Hampden ME, Dexter ME, Old Town ME, Holden ME | Firestorm Cultivation"

55. Title length 210 chars

Detail

Title should be 20-65 chars. Got: "Firestorm Cannabis: Craft Cannabis Dispensary, Recreational Marijuana, THC Edibles, Live Hash Rosin, Pre-Rolls & Weed Delivery | Bradley ME, Hampden ME, Dexter ME, Old Town ME, Holden ME | Firestorm Cultivation"

56. Title length 210 chars

Detail

Title should be 20-65 chars. Got: "Firestorm Cannabis: Craft Cannabis Dispensary, Recreational Marijuana, THC Edibles, Live Hash Rosin, Pre-Rolls & Weed Delivery | Bradley ME, Hampden ME, Dexter ME, Old Town ME, Holden ME | Firestorm Cultivation"

57. Lighthouse seo (mobile): 85/100

Detail

Score 85 is below target 95. See HTML report for details.

58. LH mobile: Eliminate render-blocking resources (Est savings of 4,270 ms)

Detail

Resources are blocking the first paint of your page. Consider delivering critical JS/CSS inline and deferring all non-critical JS/styles. https://developer.chrome.com/docs/lighthouse/performance/render-blocking-resources/" target="_blank" rel="noreferrer">Learn how to eliminate render-blocking resources.

59. LH desktop: Preload Largest Contentful Paint image

Detail

If the LCP element is dynamically added to the page, you should preload the image in order to improve LCP. https://web.dev/articles/optimize-lcp#optimize_when_the_resource_is_discovered" target="_blank" rel="noreferrer">Learn more about preloading LCP elements.

60. LH desktop: Reduce unused CSS (Est savings of 42 KiB)

Detail

Reduce unused rules from stylesheets and defer CSS not used for above-the-fold content to decrease bytes consumed by network activity. https://developer.chrome.com/docs/lighthouse/performance/unused-css-rules/" target="_blank" rel="noreferrer">Learn how to reduce unused CSS.

61. LH desktop: Serve images in next-gen formats (Est savings of 210 KiB)

Detail

Image formats like WebP and AVIF often provide better compression than PNG or JPEG, which means faster downloads and less data consumption. https://developer.chrome.com/docs/lighthouse/performance/uses-webp-images/" target="_blank" rel="noreferrer">Learn more about modern image formats.

62. LH desktop: Properly size images (Est savings of 25 KiB)

Detail

Serve images that are appropriately-sized to save cellular data and improve load time. https://developer.chrome.com/docs/lighthouse/performance/uses-responsive-images/" target="_blank" rel="noreferrer">Learn how to size images.

63. Dutchie menu iframe not found on /, /menu, or /shop

Detail

No Dutchie iframe detected. If this client uses a different menu provider, add it to clients.yaml dutchieSlug=null + we'll stop flagging.

Findings by Page

Grouped by URL — useful when working through the site one page at a time.

https://firestormcultivation.com/

_40 findings on this page_

Your website is loaded over HTTPS (secure), but it's pulling 2 image files from an HTTP (insecure) URL. Modern browsers will block these resources or show security warnings to visitors, degrading trus

Your site has two embedded maps (iframes) that lack accessible names. Screen reader users—including those with visual impairments—cannot understand what these maps are for. Adding a title or aria-labe

An icon link on your homepage has no text label that screen readers can announce to visually impaired visitors. The link appears to open a menu or panel, but assistive technologies can't tell users wh

Your site is missing the Strict-Transport-Security (HSTS) security header, which tells browsers to always connect via encrypted HTTPS. Without it, browsers may allow initial unencrypted HTTP connectio

Your website is missing the X-Frame-Options security header, which tells browsers whether your site can be embedded inside another website's iframe. Without this header, attackers could embed your sit

Your website is missing a Content Security Policy (CSP) header. This is a security instruction that tells browsers which sources (scripts, images, stylesheets) are trusted. Without it, your site is mo

Your domain (firestormcultivation.com) doesn't have an SPF record — a simple text file that tells email providers which servers are allowed to send mail from your domain. Without it, legitimate emails

Your domain does not have a DMARC policy published in DNS. DMARC (Domain-based Message Authentication, Reporting and Conformance) is a email security standard that tells receiving mail servers how to

Twenty-two interactive elements (buttons, links, menu items) on your homepage are smaller than 44×44 pixels when viewed on a mobile phone. This makes them hard to tap accurately — especially for peopl

Your website has 21 clickable buttons, links, and form fields that are smaller than 44×44 pixels on mobile phones. This makes them hard to tap accurately, especially for people with larger fingers, mo

Your website has 21 buttons, links, or other clickable elements that are smaller than 44×44 pixels on mobile phones. This makes them hard to tap accurately, especially for people with motor control is

Your website has 23 clickable buttons, links, and interactive elements that are smaller than 44x44 pixels when viewed on a tablet. This makes them hard to tap accurately—especially for people with mot

Google's Lighthouse tool measured your mobile site's performance at 61/100—below the target of 85. The main culprit is Largest Contentful Paint (LCP), which measures when the biggest visible element f

Your homepage has a heading hierarchy problem: an h3 (third-level heading) appears without an h2 (second-level heading) before it. Screen readers and search engines expect headings to follow a logical

Your website is missing a 'main' landmark—a semantic HTML element that tells screen readers where the primary content begins. This is like a book missing a table of contents: assistive technology user

Your site has 23 sections of content that aren't wrapped in semantic landmark regions (like <main>, <nav>, <footer>, or <aside>). Screen reader users rely on these landmarks to navigate and understand

Your homepage meta description (the snippet Google shows under your site name in search results) is 161 characters long. Search engines typically display 150–160 characters before truncating, so your

Your homepage has two H1 headings (the largest, most important heading level). Search engines expect exactly one H1 per page—it acts like the page's main title. Multiple H1s confuse search engines abo

Your site is missing the X-Content-Type-Options security header, which tells browsers not to guess the file type of responses. Without it, a browser might misinterpret a text file as executable code (

Your website is missing a referrer-policy security header. This header controls what information is sent when visitors click links away from your site (e.g., whether the destination sees they came fro

Your website is missing a Permissions-Policy security header, which is a directive that tells browsers which device features (camera, microphone, geolocation, payment APIs) your site is allowed to use

Your SSL certificate cannot be validated by SSL Labs, which is a trusted third-party testing tool. This typically means either your server is not responding correctly to the test, or there's a configu

Your domain's DNS records are not cryptographically signed. This means someone could theoretically intercept or redirect your domain traffic without detection. DNSSEC (DNS Security Extensions) adds a

Your domain's DNS settings don't include CAA records, which are a security safeguard that tells certificate authorities (companies that issue SSL certificates) which ones are allowed to create certifi

DKIM (DomainKeys Identified Mail) is a security protocol that digitally signs outgoing emails from your domain, proving they actually came from you and weren't forged. Your domain doesn't currently ha

Your mobile site scores 92/100 on accessibility—close to your 95 target, but missing a few small fixes. Accessibility means people with disabilities (vision, hearing, motor) can use your site fully. C

Your homepage's main visual element (the largest image visitors see first) is being loaded slower than it could be. By telling the browser to fetch this image earlier, before it renders the page, you'

Your site is loading 42 kilobytes of CSS code on mobile devices that isn't being used on the visible page. This is like shipping a truck full of supplies when you only need a handful—the extra weight

Your site is serving images in older formats (PNG and JPEG) that are larger than necessary. Modern formats like WebP can compress the same images 25–35% smaller, meaning faster page loads and lower ba

Your site is serving full-sized images to mobile phones when smaller versions would load faster and use less data. For example, a phone displays a 400-pixel-wide image but downloads a 1200-pixel versi

Your site scored 91/100 on Google's accessibility audit, missing the 95 target by 4 points. Accessibility means your site works well for people using screen readers, keyboards, or other assistive tool

Lighthouse is reporting an SEO score of 85 out of 100 on desktop, which falls short of your target of 95. This score reflects missing or incomplete on-page SEO signals—such as missing meta description

https://firestormcultivation.com/category/blog/

_4 findings on this page_

Your blog category page has a title tag that's too short — only 16 characters. Search engines use the title tag as the main headline for your page in search results. A title between 20–65 characters g

Your blog category page has a meta description (the snippet shown in Google search results) that is only 18 characters long. Google recommends 80–160 characters so the full description appears in sear

When your blog posts or pages are shared on Facebook, Instagram, or other social platforms, those networks look for OpenGraph tags to know what image and title to display. Without them, social shares

One image on your blog category page doesn't have alt text — a short text description that tells screen readers and search engines what the image shows. This hurts both accessibility (customers using

https://firestormcultivation.com/blog/hello-world/

_2 findings on this page_

When someone shares your blog post on Facebook, Instagram, or other social platforms, those sites pull a preview image and title from special HTML tags called OpenGraph metadata. Without these tags, y

One image on your blog post page doesn't have alt text — a short text description that screen readers read aloud and search engines use to understand the image. This affects both customers with visual

https://firestormcultivation.com/education/

_2 findings on this page_

Your page title (the text that appears in browser tabs and search results) is 178 characters long, but search engines like Google typically display only 50–60 characters before truncating. This means

Your page description (the short text shown under your site name in Google search results) is 165 characters long. Google typically displays 150–160 characters before cutting off on desktop, so yours

https://firestormcultivation.com/contact/

_2 findings on this page_

Your contact page title is 178 characters long, but search engines (Google, Bing) typically only display the first 50–60 characters in search results before truncating with an ellipsis. This means mos

Your contact page's search engine preview text is 167 characters long, exceeding the recommended 80–160 character range. Search engines will truncate this in results, cutting off the end of your messa

https://firestormcultivation.com/loyalty/

_2 findings on this page_

Your page title (the blue clickable text in search results) is 174 characters long, but search engines display only 50–60 characters on desktop and fewer on mobile. The second half of your title—every

Your page description (the text Google shows under your page title in search results) is 162 characters long. Google typically displays 150–160 characters on desktop before cutting off. This means pot

https://firestormcultivation.com/please-do-not-delete-this-metasync-test-post/

_2 findings on this page_

Your homepage title tag is 210 characters long, but search engines work best with titles between 20–65 characters. The current title is stuffed with location names and product keywords, which dilutes

OpenGraph tags are metadata snippets that tell social media platforms (Facebook, Instagram, LinkedIn, etc.) how to display your page when someone shares it. Without them, your posts look plain—no cust

https://firestormcultivation.com/hub/

_2 findings on this page_

Your homepage title tag is 194 characters long, but search engines like Google typically display only 20–65 characters in search results before truncating with '…'. This means users see an incomplete,

Your /hub/ page is missing OpenGraph tags—special metadata that controls how the page appears when shared on Facebook, Instagram, LinkedIn, and other social platforms. Without them, social shares will

https://firestormcultivation.com/hub1/

_2 findings on this page_

Your homepage title (the text that appears in browser tabs and search results) is 183 characters long. Search engines typically display only the first 50–60 characters to users, so everything after th

OpenGraph tags are snippets of code that tell social media platforms (Facebook, Instagram, LinkedIn) what image and text to display when someone shares your page. Without them, social shares show a ge

https://firestormcultivation.com/hub2/

_2 findings on this page_

Your homepage title is 187 characters long. Search engines display only the first 50–60 characters in results, so the tail end—including location names—gets cut off and wasted. A shorter, stronger tit

When someone shares a link to your site on Facebook, Instagram, or other social platforms, those networks use special metadata tags (called OpenGraph tags) to decide what title and image to display in

https://firestormcultivation.com/?elementor_library=search

_2 findings on this page_

Your homepage meta description (the preview text shown in Google search results) is 161 characters long. Search engines prefer 80–160 characters because longer text gets cut off on mobile and desktop,

https://firestormcultivation.com/?elementor_library=default-kit

_2 findings on this page_

Your homepage title is 210 characters long, but search engines display only 50–60 characters in results. Everything beyond that gets cut off, wasting space on keywords that users never see. This parti

Your homepage meta description (the short text that appears below your site title in Google search results) is 161 characters long. Google typically displays 150–160 characters on desktop before cutti

https://firestormcultivation.com/?elementor_library=deals-for-dispenaries

_2 findings on this page_

Your page description—the text that appears below your link in Google search results—is 161 characters long, one character over the recommended 80-160 range. Google will truncate it in search results

https://firestormcultivation.com/?elementor_library=product-category-carousel

_2 findings on this page_

Your homepage title is 210 characters long, but search engines like Google typically display only the first 50–65 characters in search results. Everything after that gets cut off, wasting valuable rea

Your homepage meta description (the preview text that appears under your link in Google results) is 161 characters long, which is 1 character over the ideal 80–160 range. Google may truncate it on mob

https://firestormcultivation.com/?elementor_library=elementor-footer-13

_2 findings on this page_

Your homepage title is 210 characters long, but search engines typically display only 50–60 characters in search results before truncating. The full title wastes space on keywords that users never see

Your homepage meta description—the text that appears below your site title in Google search results—is 161 characters long. Google typically displays 150–160 characters on desktop before truncating. T

https://firestormcultivation.com/?elementor_library=elementor-header-11

_2 findings on this page_

Your homepage meta description (the short text that appears under your site name in Google search results) is 161 characters long. Google typically shows 150-160 characters on desktop before truncatin

https://firestormcultivation.com/robots.txt

_1 finding on this page_

Your robots.txt file (the instructions you give search engines about what to crawl on your site) doesn't tell Google and Bing where to find your sitemap. A sitemap is like a table of contents for sear

https://firestormcultivation.com/about-us/

_1 finding on this page_

Your 'About Us' page title is 190 characters long, but search engines (Google, Bing) typically display only 20–65 characters in search results. Everything beyond ~65 characters gets truncated with an

https://firestormcultivation.com/orono-me/dispensary-near-old-town-me/

_1 finding on this page_

Your page title (the text that appears in browser tabs and search results) is 155 characters long, but search engines prefer 20–65 characters. Titles longer than 60 characters typically get truncated

https://firestormcultivation.com/bangor-me/dispensary-near-brewer-me/

_1 finding on this page_

https://firestormcultivation.com/bangor-me/dispensary-near-bangor-airport-bgr/

_1 finding on this page_

Your page title is 161 characters long, but search engines like Google typically display only 50-60 characters in search results before truncating with an ellipsis. The extra words are invisible to se

https://firestormcultivation.com/bangor-me/

_1 finding on this page_

Your page title—the clickable headline in search results—is 176 characters long. Google typically displays 50-65 characters on desktop and fewer on mobile, so the extra text gets cut off and wasted. S

https://firestormcultivation.com/orono-me/

_1 finding on this page_

Your page title (the text that appears in browser tabs and search results) is 176 characters long. Search engines typically display only 50–60 characters before truncating with '…', so everything afte

https://firestormcultivation.com/wp-login.php

_1 finding on this page_

Your WordPress login page (/wp-login.php) is publicly accessible and returns a successful response. This is a security risk because attackers can use automated tools to discover and target your admin

_Generated by Apex Sentinel Monthly Audit · 2026-04-19T06:40:35.190Z · Powered by Bud Authority._

Generated by Apex Sentinel · © 2026 Bud Authority