SEO Audit: Critical issues — score 28/100

[rubenhensen]

SEO Audit Report: postguard.eu

Date: 2026-04-21
Business Type: SaaS / Open Source Software (Encryption Tool)
Framework: SvelteKit
Built by: Radboud University / Yivi / Caesar Groep

---

SEO Health Score: 28/100

Category	Score	Weight	Weighted
Technical SEO	25/100	22%	5.5
Content Quality	30/100	23%	6.9
On-Page SEO	20/100	20%	4.0
Schema / Structured Data	5/100	10%	0.5
Performance (CWV)	65/100	10%	6.5
AI Search Readiness	10/100	10%	1.0
Images	35/100	5%	1.75
Total			26.2

---

1. Technical SEO (25/100)

CRITICAL: Sub-Pages Are 100% Client-Side Rendered (CSR)

The most severe issue on this site. Only the homepage (/) is server-side rendered with full HTML content (16,151 bytes). Every other page (/about, /fileshare, /addons, /privacy, /decrypt, all blog posts) returns an identical 1,757-byte empty HTML shell containing only SvelteKit bootstrap JavaScript:

/ (homepage)     → 16,151 bytes, full SSR with meta tags, content, headings
/about           → 1,757 bytes, empty shell, NO content
/fileshare       → 1,757 bytes, empty shell, NO content
/addons          → 1,757 bytes, empty shell, NO content
/privacy         → 1,757 bytes, empty shell, NO content
/blog/*          → 1,757 bytes, empty shell, NO content
/decrypt         → 1,757 bytes, empty shell, NO content

All sub-pages share the same ETag (69e388ed-6dd), confirming they serve identical content. Search engines see empty pages for everything except the homepage.

Impact: Google may index these pages but with no title, no description, no content, and no headings. They are effectively invisible.

Fix: Enable SvelteKit SSR/prerendering for all public pages. In +page.ts or +layout.ts:

export const prerender = true; // for static pages
// OR ensure ssr = true (default) and deploy with SSR adapter

CRITICAL: /blog/ Returns 403 Forbidden

The blog listing page returns a 403 Forbidden from nginx:

curl https://postguard.eu/blog/ → 403 Forbidden

The /blog (without trailing slash) returns a 301 redirect to http://postguard.eu/blog/ (HTTP, not HTTPS), which then 403s.

HIGH: Blog Redirect Uses HTTP Instead of HTTPS

/blog → 301 → http://postguard.eu/blog/  (should be https://)

This is a protocol downgrade. The HSTS header (max-age=31536000; includeSubDomains) should prevent browsers from following it, but search engine crawlers may not respect HSTS.

HIGH: No Canonical Tags

No <link rel="canonical"> on any page. This leaves duplicate content resolution entirely to Google's discretion.

HIGH: No Security Headers

Missing from all responses:

• X-Frame-Options
• Content-Security-Policy
• X-Content-Type-Options
• Referrer-Policy
• Permissions-Policy

Only Strict-Transport-Security is present (good).

MEDIUM: No IndexNow Support

No IndexNow key file found.

MEDIUM: Cache-Control Set to no-cache

All pages return cache-control: no-cache. Immutable assets use hashed filenames (good), but HTML pages could benefit from short-lived caching.

---

2. Content Quality (30/100)

Homepage Content (SSR'd — the only indexable page)

• H1: "PostGuard"
• H2: "Why PostGuard?"
• H3s: "End-to-end encrypted", "Identity-based", "Free & open source"
• Meta description: "PostGuard offers free, easy-to-use end-to-end encryption for emails and files. Your data never leaves your browser unencrypted."
• Word count: ~150 words (thin for a primary landing page)

CRITICAL: All Sub-Page Content Invisible to Crawlers

Since sub-pages are CSR, their content quality is irrelevant for SEO until SSR is enabled.

MEDIUM: Only 2 Blog Posts

Very thin blog presence for an encryption/security tool. No author attribution visible.

E-E-A-T Signals

Signal	Status
Experience	Medium — product is actively used, developed by university
Expertise	High — Radboud University, cryptographic research
Authoritativeness	Medium — academic backing, but no press/media links visible
Trustworthiness	Medium — HSTS enabled, open source, but missing security.txt

---

3. On-Page SEO (20/100)

Homepage (only SSR page)

Element	Present	Value
Title	Yes	"Secure File Sharing & Email Encryption | PostGuard"
Meta Description	Yes	Present
OG Title	Yes	"Secure File Sharing & Email Encryption"
OG Description	Yes	Same as meta description
OG Image	Yes	/pg_logo.png
OG Type	Yes	website
Twitter Card	Yes	summary_large_image
Canonical	No	Missing
Hreflang	No	Missing (despite NL/EN switcher)
JSON-LD	No	Missing

All Other Pages

All elements missing — no title, meta description, OG tags, canonical, H1, or any content.

---

4. Schema / Structured Data (5/100)

No JSON-LD or structured data found anywhere on the site.

Recommended Schema

Page	Schema Type	Priority
/	SoftwareApplication + Organization	High
/about	Organization (with Radboud University affiliation)	High
/blog/*	Article with author info	High
/blog	CollectionPage	Medium
/addons	SoftwareApplication (per addon)	Medium

---

5. Performance / Core Web Vitals (65/100)

Metric	Estimate	Rating
LCP	~1.5s	Good
INP	~100ms	Good
CLS	~0.05	Good
FCP	~1.2s	Good
TTFB	~200ms	Good

SvelteKit is lightweight with modulepreload hints and hashed asset filenames. Main concern: CSR pages require full JS execution before content appears, hurting LCP on sub-pages.

---

6. AI Search Readiness (10/100)

Check	Status
llms.txt	Missing
robots.txt AI crawlers	Not blocked (OK)
Passage-level citability	Very poor — sub-pages have no server-rendered text
Brand mention signals	Weak
Structured data for AI	None
Content depth for citation	Poor — homepage ~150 words

Platform-Specific AI Scores

Platform	Score
Google AI Overviews	5/100
ChatGPT	10/100
Perplexity	12/100
Bing Copilot	8/100

---

7. Sitemap Analysis

URL: https://postguard.eu/sitemap.xml

Check	Status
Valid XML	Yes
URL count	6 (very small)
<lastmod>	Missing on all URLs
<changefreq>	Missing
<priority>	Missing

Missing from sitemap: /addons

---

8. Robots.txt

User-agent: *
Allow: /
Disallow: /fileshare
Disallow: /decrypt
Disallow: /download
Disallow: /debug
Sitemap: https://postguard.eu/sitemap.xml

Sensible configuration. Functional pages correctly excluded.

---

9. Internationalization

NL/EN language switcher exists but:

• No hreflang tags on any page
• No /nl/ or /en/ URL structure
• Language switching is client-side only

---

Prioritized Action Plan

CRITICAL (Fix Immediately)

#	Issue	Fix
1	Sub-pages are 100% CSR	Enable SSR or prerendering in SvelteKit for all public routes
2	/blog/ returns 403	Fix nginx configuration for /blog/ path
3	/blog redirects to HTTP	Fix redirect to use https://

HIGH (Fix Within 1 Week)

#	Issue	Fix
4	No canonical tags	Add <link rel="canonical"> to all pages
5	No hreflang tags	Implement hreflang for en/nl variants
6	No structured data	Add Organization + SoftwareApplication JSON-LD
7	No security headers	Add CSP, X-Frame-Options, Referrer-Policy
8	Meta tags missing on sub-pages	Add unique meta tags per page (requires SSR fix first)

MEDIUM (Fix Within 1 Month)

#	Issue	Fix
9	Sitemap missing lastmod	Add <lastmod> dates to all sitemap entries
10	Sitemap missing /addons	Add /addons to sitemap.xml
11	No llms.txt	Create /llms.txt with site summary
12	Thin homepage content	Expand to 400+ words with use cases, trust signals
13	Only 2 blog posts	Publish regularly on encryption, privacy, security topics
14	No security.txt	Add /.well-known/security.txt

LOW (Backlog)

#	Issue	Fix
15	No IndexNow	Implement IndexNow for blog posts
16	OG image is logo only	Create branded social preview images
17	No author bios on blog	Add author attribution with credentials
18	cache-control: no-cache	Set short-lived cache for HTML pages
19	No Wikipedia article	Create stub (NWO funding + Radboud affiliation establish notability)
20	No YouTube presence	Create explainer video on Radboud University channel

---

Key Takeaway

The #1 issue is SSR/prerendering. Fixing the SvelteKit rendering mode to serve pre-rendered HTML for all public pages will unlock the majority of SEO value. Without this fix, only the homepage is visible to search engines. Everything else depends on this being fixed first.

Enabling SSR + adding llms.txt alone (no content changes) would lift the AI readiness score from ~21 to ~60-65/100.

[rubenhensen]

Additional GEO (AI Search) Findings

The GEO analysis scored PostGuard at 21/100 for AI search readiness. Key additional insights:

Docusaurus docs as interim bridge

The developer docs at encryption4all.github.io/postguard/ are already SSR and AI-readable. Adding llms.txt there first would provide an immediate AI entry point while the main site SSR migration happens.

Suggested llms.txt content

# PostGuard
> PostGuard is an open-source, identity-based encrypted file sharing and email encryption service developed at Radboud University, funded by NWO. No key exchange is required — recipients are identified by Yivi (IRMA) attributes such as email address.

## Key Pages
- https://postguard.eu/about: About PostGuard, Radboud University affiliation, and funding sources
- https://postguard.eu/addons: Browser extensions and integrations
- https://postguard.eu/blog/introducing-postguard: Introduction to PostGuard's IBE approach
- https://encryption4all.github.io/postguard/docs/intro: Developer documentation

Security audit disclaimer impact

The "not audited — use at your own risk" warning suppresses AI citation in security contexts. Once audited, softening this will meaningfully lift citation willingness for queries like "safe open-source email encryption tools."

Recommended JSON-LD for homepage (once SSR is enabled)

{
  "@context": "https://schema.org",
  "@type": "SoftwareApplication",
  "name": "PostGuard",
  "description": "Free, open-source identity-based encryption for emails and files using Yivi identity attributes.",
  "applicationCategory": "SecurityApplication",
  "operatingSystem": "Web Browser",
  "offers": {
    "@type": "Offer",
    "price": "0",
    "priceCurrency": "EUR"
  },
  "author": {
    "@type": "Organization",
    "name": "Radboud University",
    "url": "https://www.ru.nl"
  },
  "license": "https://opensource.org/licenses/MIT",
  "url": "https://postguard.eu",
  "sameAs": [
    "https://github.com/encryption4all"
  ]
}

/dobby

[dobby-coder]

Dobby has seen the GEO findings, sir! Dobby is most excited to help PostGuard become more visible to the AI search engines! 🧦

Dobby will immediately begin working on:

• Adding llms.txt to the Docusaurus docs site as an interim bridge
• Preparing JSON-LD structured data for the homepage
• Any other improvements Dobby can make from these excellent findings

Dobby is on it, sir!

[rubenhensen]

/dobby can you fix the issues highlighted above?

[dobby-coder]

Dobby sees the SEO audit findings, sir! Dobby is most excited to tackle these issues! 🧦

Dobby will start with the most critical fixes:

• Enabling SSR/prerendering on all sub-pages
• Adding canonical tags, hreflang, and JSON-LD structured data
• Creating llms.txt for AI search readiness
• Adding /addons to the sitemap and fixing lastmod dates
• Adding a security.txt file

Dobby will open one or more draft PRs for rubenhensen to review. Dobby is on it, sir!

[dobby-coder]

Draft PR opened: #104

What's fixed in this PR

Root cause of the 28/100 score: the static build was emitting /about.html, /blog.html, etc., but nginx's default try_files $uri $uri/ /200.html was looking for /about/ as a directory, missing the .html sibling and falling through to the empty SPA shell. Setting trailingSlash: 'always' on the marketing layout makes SvelteKit emit /about/index.html, /blog/index.html, /blog/<slug>/index.html, etc., which nginx serves out of the box. It also fixes the 403 on /blog/ (the directory no longer clashes with a sibling /blog.html).

Audit item	Status
Sub-pages 100% CSR / empty shell	✅ Fixed — every route now prerenders to a populated index.html
/blog/ returns 403	✅ Fixed by trailing-slash routing
/blog redirects to HTTP	⚠️ Still an nginx reverse-proxy issue (see below)
No canonical tags	✅ Auto-generated from pathname
No hreflang	✅ Added (en, nl, x-default — all same URL until i18n becomes URL-based)
No structured data	✅ SoftwareApplication + Organization on homepage, Article on blog posts
/addons not indexable	✅ Moved from (app) to (marketing) → prerendered, with SEO tags + footer
Sitemap missing /addons	✅ Added
Sitemap missing <lastmod>	✅ Added on every entry, plus <changefreq> + <priority>
No llms.txt	✅ Added at /llms.txt
No security.txt	✅ Added at /.well-known/security.txt
Missing security headers	⏸️ Left for a follow-up nginx PR

Intentionally left for a follow-up

These all live in the nginx layer and I'd rather address them in a dedicated PR so an infra-minded reviewer can weigh in on CSP scope, etc.:

1. Security headers shadowing. docker/default.conf.template already sets X-Frame-Options and Referrer-Policy at the server level, but the inner location / block adds Cache-Control and — per nginx's header-inheritance rules — that wipes out every outer add_header. Fix is to use always + duplicate the headers inside location / (or pull them into an included snippet).
2. CSP / X-Content-Type-Options / Permissions-Policy. Straightforward to add once the shadowing fix is in.
3. /blog → http://… downgrade. nginx isn't honoring X-Forwarded-Proto from the TLS-terminating proxy, so its 301s emit http://. After this PR the redirect still exists but now goes to a page that actually serves content, so it's no longer search-engine-blocking.
4. Proper hreflang per language. Pointing en and nl at the same URL is valid but pointless — it only becomes useful once the site has /en/ + /nl/ URL variants.

Local verification

CI is green (Svelte Check, builds on amd64 + arm64, conventional-commit title all pass). Locally:

• npm run check — 0 errors, 0 warnings
• npm run build — every expected /<route>/index.html is emitted with full SSR'd content (17–20 KB per page, up from the 1,757-byte shell)
• Dev server: curl /about/ | grep canonical returns https://postguard.eu/about/; curl /llms.txt, curl /.well-known/security.txt, and curl /sitemap.xml all serve as expected

PR is left as draft because routing/trailing-slash changes are exactly the kind of thing that deserves a human sanity-check in staging before it reaches production. Happy to mark ready once you've had a look.