Website audit — Avalon Beach NSW 2107

Audit findings for Horizon Football Festival 2026.

horizonfootballfestival.com.au

Horizon Football Festival 2026 is a four-day youth football tournament hosted by Manly United FC at Cromer Park, Sydney, for players aged U9 to U13.

2High13Medium1Low-med21Low

Before we get into the findings — here's who we think you are

Everything below is drawn from your homepage and about page as we found them today. If we've got something wrong, tell us and we'll correct it.

What you do Horizon Football Festival 2026 is a four-day youth football tournament hosted by Manly United FC at Cromer Park on Sydney's Northern Beaches, running 2–5 October 2026. It is open to clubs, academies, and individual teams, with six age groups across mixed and girls divisions from U9 to U13.

Who you are The festival positions itself around player development and competitive experience, describing its aim as giving players aged U9–U13 the opportunity to "test themselves, embrace new challenges, and create lasting memories" in a structured tournament environment.

Where we think you sit In our experience, event and festival sites like this one carry a particular digital burden: they need to convert a visiting coach or team manager in a single session, often months before the event date, and then hold that registration intent across a long lead time. Technical or trust issues that might be tolerable on a general brochure site tend to have a more direct cost here, because the registration window is finite.

With that in mind, here's what we found. Each finding is laid out the same way — what's happening, who gets hurt if it isn't addressed, why it's commonly missed, what it costs you if it goes wrong, and how we'd fix it. Technical detail is tucked behind a toggle for anyone who wants to see the working.

Findings at a glance

Security
01
Browsers don't remember to keep your site on HTTPS
What's happening Your site has a setting that tells browsers to always use the encrypted version — but it expires so quickly that browsers forget the instruction within weeks.

Why it matters During the gap, a visitor on a compromised network like a café's Wi-Fi could be quietly downgraded to an unencrypted connection, where login details or form data travel in plain text and can be intercepted.

The fix We'd extend the setting to a one-year window, add the right supporting directives, and submit your domain to the browser preload list so the protection applies before a visitor even arrives. About 30 minutes of work.
Read full finding →
High
02
Your DMARC is in monitor-only mode — it watches but doesn't block
What's happening Your DMARC record is published but set to monitor-only mode — it collects reports about mail claiming to be from your domain, but tells receivers to do nothing about suspicious messages.

Why it matters Forged emails carrying your domain name still reach your customers' inboxes, and because a policy technically exists, neither you nor your provider is likely to treat it as an open gap.

The fix We review the reports already accumulated, confirm legitimate senders pass correctly, then advance the policy to quarantine and eventually reject in a staged transition — two to four weeks of review, then a single DNS edit.
Read full finding →
Medium
03
Your contact email is on a different domain than your website
What's happening Every contact address on the site uses a different domain from the one visitors just landed on, so the email and the website don't visibly belong together. Sites with this pattern tend to see a small but real drop in first-contact enquiries from cautious registrants. Adding a matching email address and forwarding it to the existing inbox is about a 30-minute DNS and mailbox change.
Read full finding →
Medium
04
Your site can't stop malicious code from running if any injection slips through
What's happening Without a Content-Security-Policy, your visitors' browsers will load and run anything your page references — from any source, without restriction.

Why it matters If an attacker injects content through a plugin vulnerability or a hijacked third-party script, there's nothing telling your customers' browsers to refuse it — credentials, payment details, and form data can be taken silently.

The fix We configure a policy listing every legitimate source your site loads from and instructing browsers to block everything else — a few hours to build, a week or two in report-only mode to confirm nothing legitimate is caught, then enforcement.
Read full finding →
Medium
05
External scripts on your site can be tampered with mid-flight
What's happening A script loaded from an external CDN has no tamper-check attached. If that CDN were compromised, the altered script would run unchallenged. Sites in this configuration typically face indirect risk — low probability but high consequence. Adding a single integrity attribute to the script tag closes the gap in under 30 minutes.
Read full finding →
Medium
06
Your pages can be embedded inside another site without permission
What's happening Without a frame-blocking header, your website can be embedded invisibly inside another site, with a transparent overlay sitting on top capturing your visitors' clicks and redirecting their actions.

Why it matters A logged-in visitor thinks they're clicking a button on your site; they're actually triggering something else entirely on their authenticated session — payment confirmations, account changes, and bookings are the common targets.

The fix We add a two-line configuration change telling browsers to refuse to render your site inside another site's iframe — under 30 minutes, and your own site embedding its own pages still works fine.
Read full finding →
Medium
07
Browsers might guess your file types wrong and run them as scripts
What's happening Browsers are designed to guess a file's type if the server's labelling seems off — without a header turning off that guessing, a browser could treat an uploaded image or document as something executable.

Why it matters Visitors on any site with user uploads are most exposed: if an attacker can upload a file that the browser misreads as a script, it runs in the visitor's browser without warning.

The fix We add a single header line telling every browser to trust only what your server declares — no guessing, no effect on legitimate traffic, done as part of the security-headers pass we run on all managed clients.
Read full finding →
Medium
08
Your DMARC reports are being sent to a broken address — you'll never see them
What's happening Your DMARC record includes a reporting address, but it's formatted incorrectly — mail receivers that follow the standard are required to discard addresses they can't parse, so none of the spoofing reports are arriving anywhere.

Why it matters You're flying blind: there's no data showing whether your domain is being used in fraud attempts or whether your current senders are passing authentication correctly.

The fix We correct the reporting address to a valid format — a one-line DNS change, under five minutes, with reports starting to arrive from major receivers within 24 hours.
Read full finding →
Medium
09
Visitor URLs leak in full to every external site you link to
What's happening Every time a visitor clicks an external link from your site, their browser sends the full URL of your page — including any query strings, session tokens, or password-reset links — to whoever owns the destination site.

Why it matters Your visitors' sensitive URL parameters end up in third-party analytics and advertising logs you don't control; if a password-reset link appears in an external server's logs, that's a privacy disclosure under the Australian Privacy Act regardless of whether anyone misuses it.

The fix We set a single Referrer-Policy header that passes your domain name to external sites — enough for their analytics — without including page paths, tokens, or query strings. Minutes to configure.
Read full finding →
Medium
10
Third-party scripts can silently access camera, microphone, or location
What's happening Without a Permissions-Policy header, every third-party script your site loads — analytics tools, chat widgets, advertising pixels — inherits the ability to request browser features like camera, microphone, and geolocation, with no site-level instruction limiting them.

Why it matters If any one of those scripts is ever compromised or changes behaviour, your visitor sees an unexpected browser permission prompt and has no way to know it isn't coming from you — and many will simply close the tab and not return.

The fix We set a Permissions-Policy header explicitly denying every browser feature your site doesn't use — a one-time configuration as part of the security-headers pass, with specific features enabled only if you genuinely add them later.
Read full finding →
Medium
11
3 smaller items worth knowing about in Security

Each of these is true and worth fixing eventually, but none is urgent on its own. We've grouped them so they don't drown out the findings that are. Click any one to read the full detail.
Show the 3 items
3 × low
Compliance & Privacy
14
No privacy policy published anywhere on the site
What's happening The site invites team registrations and contact enquiries — both of which collect personal information — but publishes no privacy policy anywhere on the page or in the footer. Under the Privacy Act 1988 and the Australian Privacy Principles, organisations collecting personal data are required to make a privacy policy readily accessible. Sites in this position tend to face regulatory exposure if a complaint is filed or a data incident occurs, with no documented policy to demonstrate compliance. Publishing a clear privacy policy page and linking it from the footer is a straightforward fix — typically a few hours of drafting and one small footer code change.
Read full finding →
High
15
Your cookie banner sets tracking cookies before the visitor agrees
What's happening The site accepts team registrations but publishes no Terms & Conditions. Without agreed terms, cancellation and refund rules tend to be unenforceable if a dispute reaches a tribunal. A single linked T&C page covering entry fees and liability closes the gap — typically a 1–2 hour task.
Read full finding →
Medium
16
ABN not visible anywhere on the site
What's happening Your Australian Business Number isn't visible on the website. An ABN displayed in the footer is a trust signal, a B2B expectation, and in some industries a legal requirement.

Why it matters Visitors verifying your business legitimacy can look up an ABN on the ABR; its absence is one less verification path.

The fix We add 'ABN 12 345 678 901' to the footer of every page. Five minutes.
Read full finding →
Low
17
No mention of public liability insurance
What's happening No mention of public liability insurance on the site. For trades, cleaners, personal trainers, mobile services — any business that visits customer premises — public liability insurance is something customers actively check for.

Why it matters Particularly costly for commercial / B2B work where contracts often require insurance confirmation upfront.

The fix If you carry it, we add 'Public liability insured to $Nm' to the footer. If you don't and your business should, that's a separate conversation.
Read full finding →
Low
Performance
18
Your pages jump around as they load
What's happening A script loads synchronously in the page header, forcing the browser to pause before displaying anything to the visitor. Sites with this pattern typically score lower on Core Web Vitals, affecting search ranking. Adding a single `defer` attribute to the script tag fixes it in under five minutes.
▶ Watch as the page loads — elements jump when images and fonts settle. Captured at throttled 1.5 Mbps to show the shift at human speed. Read full finding →
Medium
19
Your pages jump around as images load
What's happening Your images don't tell the browser how much space to hold for them while they download, so as each image loads the page content below it jumps downward.

Why it matters Visitors who go to tap a button or read a line at the wrong moment end up tapping the wrong thing or losing their place — and Google measures this shifting behaviour directly as a ranking signal.

The fix We add the correct width and height values to every image element so the browser reserves the right space before the image arrives — a systematic pass across the site, typically a few hours.
▶ The image jump is visible mid-load — the browser had no width or height to reserve space, so layout shifts when the image arrives. Read full finding →
Low–Med
20
4 smaller items worth knowing about in Performance

Each of these is true and worth fixing eventually, but none is urgent on its own. We've grouped them so they don't drown out the findings that are. Click any one to read the full detail.
Show the 4 items
4 × low
Accessibility
24
Decorative images have `alt=""`
What's happening Screen readers use landmark elements like <main> to let users skip straight to the content — none is present here, so assistive technology users must navigate past every menu item manually. This tends to create real friction for visitors with disabilities and can attract DDA-related complaints for event sites collecting registrations. Adding a <main> wrapper around the primary content resolves it in about 10 minutes.
Read full finding →
Medium
25
Image `alt` text descriptive (not "image", "IMG_4100")
What's happening Some images on your site have the description field filled in, but what's there isn't useful — things like 'image', 'photo', or a camera filename — and a screen reader reads that text aloud word for word.

Why it matters Visitors using assistive technology hear filler that wastes their time and tells them nothing; Google's systems also recognise generic or keyword-stuffed alt text and get no useful signal from it.

The fix We'd review every image's alt text and rewrite anything generic or unhelpful into a plain, honest description of what the image actually shows — editorial work rather than technical, and a few hours across a typical site.
Read full finding →
Low
26
Moderate accessibility violations detected by axe
What's happening The scan found moderate accessibility issues — duplicate link text pointing to different destinations, slightly uncomfortable contrast, and heading structure that's grown inconsistent over time.

Why it matters Visitors using assistive technology feel the cumulative friction, and the site reads in any formal audit as one where accessibility was added as an afterthought rather than built in.

The fix We'd fold these into the same pass as the critical and serious fixes — the same CSS and copy-level work, just extended slightly. Usually no meaningful extra time once the bigger items are done.
Read full finding →
Low
SEO & content
27
Google has indexed fewer of your pages than your sitemap declares
What's happening Google currently shows fewer of your pages in search than your sitemap says exist — pages that aren't in Google's index can't bring in customers, no matter how good they are.

Why it matters The most common causes are accidental noindex tags, mis-configured robots.txt rules, or duplicate-content collapse — all invisible to you unless someone checks specifically.

The fix We diagnose the cause via Google Search Console, fix the underlying block, then request re-crawl. About 1-2 hours of diagnostic plus per-page fixes.
Read full finding →
Low
Trust, brand & UX
28
No phone number visible on the homepage
What's happening The site lists only an email address for all enquiries — there is no phone number anywhere on the page. Coaches or administrators who prefer a quick call before committing a team have no direct option, which typically adds friction to the sign-up decision. Adding a single phone number to the footer and contact section takes under 30 minutes.
Read full finding →
Medium
29
6 smaller items worth knowing about in Trust, brand & UX

Each of these is true and worth fixing eventually, but none is urgent on its own. We've grouped them so they don't drown out the findings that are. Click any one to read the full detail.
Show the 6 items
6 × low
Mobile & platforms
35
Your site doesn't work well on phones
What's happening Your site has several mobile usability problems — touch targets too small to tap reliably, content spilling off the edge of the screen, or text requiring pinching to read.

Why it matters The visitor trying to tap your contact button on their phone gives up and goes back to search results; Google also uses mobile usability as a ranking signal, so the problem reduces how many visitors arrive in the first place.

The fix We'd fix the specific issues identified — button sizes, viewport configuration, body text size — as a packaged half-day of targeted mobile-foundations work.
Read full finding →
Low
36
Horizontal scroll at tablet viewport (rendered)
What's happening On a tablet or a phone held sideways, your site spills past the edge of the screen and forces visitors to scroll sideways to read it.

Why it matters Tablet visitors — often the ones spending the most time considering a purchase — hit a broken layout and quietly lose confidence in the business behind it.

The fix We'd track down the element causing the overflow — usually one oversized image or a fixed-width component — and correct the CSS so every screen size fits cleanly. One to two hours of work.
Read full finding →
Low
History & continuity
37
Cloudflare or CDN presence (DDoS resilience)
What's happening Your website is served directly from your hosting server with no buffer layer in front of it — so every request, legitimate or otherwise, hits the server directly.

Why it matters If traffic spikes during a promotion, a press mention, or a deliberate flood of fake requests, your server can tip over and your site goes offline precisely when the most people are trying to reach it.

The fix We'd route your domain through Cloudflare, which sits between the internet and your hosting server and filters traffic before it arrives; a one-off setup of a few hours, with the change live within a day.
Read full finding →
Low

You've seen what's wrong. Here's what happens next.

SDG fixes everything you just saw, then keeps watch so it doesn't come back. This audit is the starting line — most of our clients stay with us for the ongoing build, content, SEO, and the maintenance that stops audits like this from being needed again.

What you get with every engagement

Every finding addressed within scope, with verification screenshots and a written change log
A PDF version of this audit, formatted for your records and any insurer / compliance request
A 30-minute planning call to walk through the work, gather access, and agree the order
A written project plan with delivery dates against each finding category
Any unfixed findings get a free re-audit at 12 months — we don't move on until they're closed

Tailored to your site, not a stock package. The prices below are calculated from the specific issues we found on your site — not a generic menu. A cleaner site pays less; a site with more to address pays more. You’re paying for the actual work, not a tier ceiling.

We don’t proceed without a conversation. Whichever tier you pick, the engagement starts with a phone call — fifteen minutes, no pitch. The audit puts the findings in front of you; the call puts a face to the name. We’d genuinely rather meet over a coffee in Avalon if you’re local — either way, no work begins until we’ve talked.

Pick the tier that suits your appetite

Your audit found 2 high-severity issues across compliance, security, plus performance and polish items that materially affect how your site performs. Surf addresses the lot end-to-end.

Beach

The must-fixes — compliance, security, and anything legal or financial.

$990

+ GST, fixed quote

Findings: 2 of the issues above
Covers: compliance, security

Get started →

Recommended

Surf

Beach plus the work that gets your site performing properly.

$2,590

+ GST, fixed quote

Findings: 15 of the issues above
Covers: accessibility, compliance, email, other, performance, security, vulnerabilities

Get started →

Ocean

Everything in Surf plus every low-severity polish item — 26 hygiene fixes thrown in for free.

$2,690

+ GST, fixed quote

Findings: 16 priced findings + 26 hygiene fixes thrown in
Covers: SEO + schema, accessibility, brand + social, compliance, continuity, email, other, performance, security, trust signals, vulnerabilities

Get started →

Prices are calculated from the actual findings on horizonfootballfestival.com.au at a fixed rate of $250 + GST per remediation unit. A unit reflects the full engagement effort — work, verification, customer handoff — not just delivery time. Quoted prices are fixed once accepted; no scope creep.

What this audit does not cover

A complete review of a business needs more than a public-surface audit can deliver. The lines below set out — explicitly — the questions this report cannot answer, so you know where its boundaries are.

Conversion performance. We can see the form exists; we cannot see whether it converts. Funnel diagnostics, heatmaps, abandonment modelling, and revenue impact need access to analytics and CRM data. SDG offers this as a separate engagement.
Backup and disaster recovery posture. Whether the site is backed up, how often, and how fast it could be restored cannot be observed externally. SDG assesses this during onboarding for build+manage customers.
Internal operations and editorial workflow. Who edits the site, how content moves from draft to live, and whether staff are trained on the CMS are all internal questions. We see the output, not the process.
Active vulnerability exploitation. We identify configurations that look risky against published CVEs and end-of-life dates. We do not run exploit payloads, brute-force logins, or fuzz parameters. A full penetration test is a separate engagement with a separate scope and authorisation.
Mobile and native apps. This audit covers the website only. iOS / Android apps that share the brand are out of scope.

Security

Finding 01 High A conditional

Missing Strict-Transport-Security (HSTS) header

Show technical detail

What we observed

D100 — Missing Strict-Transport-Security (HSTS) header (Section D. HTTP response headers, taxonomy weight 7).

Where & how to reproduce

URL observed: https://horizonfootballfestival.com.au/

When this matters

When a visitor first visits your site over HTTP — the upgrade-to-HTTPS protection is short-lived.

Consequence if ignored

The Strict-Transport-Security (HSTS) header is set, but the max-age is too short to qualify for the preload list and to provide meaningful protection against downgrade attacks. Browsers may revert to HTTP for the same site within weeks.

Business impact

Short HSTS windows typically leave the site vulnerable to downgrade attacks for new and returning visitors who haven't hit the page within the cached window — an avoidable gap.

Recommendation

Extend HSTS max-age to at least one year (31536000 seconds) and add includeSubDomains and preload directives. Once stable, submit the domain to hstspreload.org for inclusion in the browser-shipped preload list.

HTTP response headers

Without HSTS a man-in-the-middle attacker on a hostile WiFi network can downgrade visitors to HTTP and intercept credentials.

Observation produced by security_probe. Confidence grade A per AUDIT-DEFENSIBILITY.md. The evidence above is reproducible from any internet-connected host; if any specific value has changed since the audit was run, the underlying observation may no longer apply.

Finding 02 Medium A conditional

DMARC policy is p=none (monitoring only)

Show technical detail

What we observed

A011 — DMARC policy is p=none (monitoring only) (Section A. DNS layer, taxonomy weight 8).

Where & how to reproduce

URL observed: https://horizonfootballfestival.com.au/

When this matters

When an attacker spoofs your domain in a phishing email.

Consequence if ignored

A DMARC policy of p=none only collects reports. Spoofed mail still reaches your customers' inboxes carrying your domain. The policy is invisible to anyone who would benefit from it.

Recommendation

Once you've reviewed two to four weeks of DMARC reports and resolved any false positives from legitimate senders, move the policy to p=quarantine and eventually p=reject. SDG manages this transition for clients on our retainer.

DNS evidence

v=DMARC1; p=none;

Source

RFC 7489 §6.3

Observation produced by email_auth_probe. Confidence grade A per AUDIT-DEFENSIBILITY.md. The evidence above is reproducible from any internet-connected host; if any specific value has changed since the audit was run, the underlying observation may no longer apply.

Finding 03 Medium A conditional

Your contact email is on a different domain (manlyunitedfc.com.au)

Show technical detail

What we observed

E006 — Your contact email is on a different domain (manlyunitedfc.com.au) (Section E. Mail layer (deeper than DNS-level), taxonomy weight 6).

Where & how to reproduce

URL observed: https://horizonfootballfestival.com.au/

Consequence if ignored

When registrants see an email domain that differs from the site they're on, some will hesitate — wondering if the contact is legitimate or if they've landed on the wrong page. For a tournament collecting team registrations, that moment of doubt can mean an enquiry never gets sent.

Business impact

For event-registration sites in this bracket, a cross-domain contact address tends to reduce enquiry conversion at the margin — the effect is modest but measurable when trust signals matter to first-time registrants.

Recommendation

Setting up a [email protected] address and forwarding it to the existing inbox takes under an hour and closes the credibility gap immediately. SDG can handle this as part of a domain and mail configuration setup.

Evidence

Contact email domain: manlyunitedfc.com.au; site domain: horizonfootballfestival.com.au

Observation produced by business_credibility_probe. Confidence grade A per AUDIT-DEFENSIBILITY.md. The evidence above is reproducible from any internet-connected host; if any specific value has changed since the audit was run, the underlying observation may no longer apply.

Finding 04 Medium A conditional

missing header: Content-Security-Policy

Show technical detail

What we observed

D001 — Content-Security-Policy header present (Section D. HTTP response headers, taxonomy weight 5).

Where & how to reproduce

URL observed: https://horizonfootballfestival.com.au/

Consequence if ignored

Without a Content-Security-Policy header, the browser will load and execute any script, image, or iframe the page references. If an attacker finds any way to inject content (a vulnerable plugin, a compromised third-party widget), there's nothing stopping them from running malicious code in your visitors' browsers.

Recommendation

Define a Content-Security-Policy header that whitelists only the domains your site legitimately loads from. SDG sets this up incrementally — Report-Only first, then enforcing — to avoid breaking the live site.

HTTP response headers

HTTP response from https://horizonfootballfestival.com.au/ has no Content-Security-Policy header

Finding 05 Medium A conditional

1 third-party script(s) loaded without Subresource Integrity (SRI)

Show technical detail

What we observed

I112 — 1 third-party script(s) loaded without Subresource Integrity (SRI) (Section I. JavaScript / supply chain, taxonomy weight 5).

Where & how to reproduce

URL observed: https://horizonfootballfestival.com.au/

When this matters

When a third-party script provider is compromised — without SRI, the malicious script runs on your site.

Consequence if ignored

If the CDN serving that script were ever compromised, a malicious version could run directly on your site with no warning. For a site collecting team registrations, that exposure — however unlikely — sits outside your control.

Business impact

For sites in this category, the direct risk is low day-to-day; the main exposure arises only if the upstream CDN is compromised, at which point recovery typically involves emergency deployment, user notification, and reputational repair.

Recommendation

Adding a Subresource Integrity hash to the script tag means browsers silently block any altered version before it runs. SDG covers this as part of our compliance-foundations review, alongside a broader check of your supply-chain risk.

Evidence

Sample of unprotected third-party scripts: https://cdn.tailwindcss.com

Source

https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity

Observation produced by js_cve_probe. Confidence grade A per AUDIT-DEFENSIBILITY.md. The evidence above is reproducible from any internet-connected host; if any specific value has changed since the audit was run, the underlying observation may no longer apply.

Finding 06 Medium A conditional

missing header: X-Frame-Options

Show technical detail

What we observed

D003 — CSP report-uri/report-to configured (Section D. HTTP response headers, taxonomy weight 4).

Where & how to reproduce

URL observed: https://horizonfootballfestival.com.au/

Consequence if ignored

Without X-Frame-Options or a CSP frame-ancestors directive, your site can be embedded in an iframe on any other site. This enables clickjacking attacks where the victim believes they're clicking your interface but is actually clicking a malicious overlay.

Recommendation

Add X-Frame-Options: SAMEORIGIN or the equivalent CSP frame-ancestors 'self'. SDG includes this as part of the security-headers baseline for managed clients.

HTTP response headers

HTTP response from https://horizonfootballfestival.com.au/ has no X-Frame-Options header

Finding 07 Medium A conditional

missing header: X-Content-Type-Options

Show technical detail

What we observed

D004 — X-Frame-Options or CSP frame-ancestors (Section D. HTTP response headers, taxonomy weight 4).

Where & how to reproduce

URL observed: https://horizonfootballfestival.com.au/

Consequence if ignored

Without X-Content-Type-Options: nosniff, older browsers may MIME-sniff a file and treat content with the wrong type as something it isn't — turning an image upload into an executable JavaScript file in the browser, for example.

Recommendation

Add X-Content-Type-Options: nosniff to all responses. SDG sets this header globally as part of webserver hardening.

HTTP response headers

HTTP response from https://horizonfootballfestival.com.au/ has no X-Content-Type-Options header

Finding 08 Medium A conditional

DMARC record has no rua (reporting) tag

Show technical detail

What we observed

A013 — DMARC record has no rua (reporting) tag (Section A. DNS layer, taxonomy weight 3).

Where & how to reproduce

URL observed: https://horizonfootballfestival.com.au/

Consequence if ignored

Your DMARC record is published, but the reporting URI is syntactically invalid. Per RFC 7489, conforming receivers must discard malformed URIs — which means none of the aggregate spoofing reports DMARC is designed to produce will ever reach you. You have the policy without the visibility it exists to provide.

Recommendation

Replace the malformed rua value with a valid mailto: URI (e.g. rua=mailto:[email protected]). SDG validates DMARC syntax on every managed-client setup as part of our mail-auth verification step.

DNS evidence

v=DMARC1; p=none;

Source

RFC 7489 §6.3

Finding 09 Medium A conditional

missing header: Referrer-Policy

Show technical detail

What we observed

D005 — X-Content-Type-Options: nosniff (Section D. HTTP response headers, taxonomy weight 3).

Where & how to reproduce

URL observed: https://horizonfootballfestival.com.au/

When this matters

When a visitor's browser leaks the previous URL they were on to your site.

Consequence if ignored

Without Referrer-Policy, your pages send the full URL of the previous page in the Referer header to every external link, image, or third-party script. That can leak query strings, internal paths, and tokens to vendors and analytics providers who have no business seeing them.

Recommendation

Set Referrer-Policy to strict-origin-when-cross-origin (a sensible default that preserves analytics utility while limiting leakage). SDG sets this header at the webserver level for managed clients.

HTTP response headers

HTTP response from https://horizonfootballfestival.com.au/ has no Referrer-Policy header

Finding 10 Medium A conditional

missing header: Permissions-Policy

Show technical detail

What we observed

D006 — Referrer-Policy header (Section D. HTTP response headers, taxonomy weight 3).

Where & how to reproduce

URL observed: https://horizonfootballfestival.com.au/

When this matters

When a browser's policy decisions about cameras, mics, geolocation, etc., apply to your site.

Consequence if ignored

Without Permissions-Policy, any third-party script loaded by your site can request access to a visitor's camera, microphone, location, or other sensitive browser features. Most of those scripts have no reason to ask, but nothing stops them.

Recommendation

Set a Permissions-Policy header denying every feature you don't actively use. SDG defines this header as part of the security-headers configuration pass for managed clients.

HTTP response headers

HTTP response from https://horizonfootballfestival.com.au/ has no Permissions-Policy header

Finding 11 Low A unverified

Admin interface publicly reachable: cPanel admin (cpanel detected in body)

Show technical detail

What we observed

G005 — Admin interface publicly reachable: cPanel admin (cpanel detected in body) (Section G. Admin-interface exposure, taxonomy weight 7).

Where & how to reproduce

URL observed: https://horizonfootballfestival.com.au/

Consequence if ignored

A publicly exposed login page gives attackers a known target to probe with automated credential-stuffing tools. Even without a breach, its presence signals hosting infrastructure details that can assist further reconnaissance.

Business impact

For sites in this configuration, the typical risk is low until credentials are weak or reused — at which point recovery usually involves a full hosting account audit.

Recommendation

Restrict access to the cPanel URL by IP allowlist or move it behind a VPN — most hosts support this in a few configuration steps. SDG can confirm the right approach as part of a security-hardening review.

HTTP response headers

https://cpanel.horizonfootballfestival.com.au:2083/ → HTTP 200 (serves login UI, 39859 bytes)

Observation produced by farpost_probe. Confidence grade A per AUDIT-DEFENSIBILITY.md. The evidence above is reproducible from any internet-connected host; if any specific value has changed since the audit was run, the underlying observation may no longer apply.

Finding 12 Low A unverified

Admin interface publicly reachable: Webmail (cPanel) (cpanel detected in body) (2 instances)

Show technical detail

What we observed

G006 — Admin interface publicly reachable: Webmail (cPanel) (cpanel detected in body) (Section G. Admin-interface exposure, taxonomy weight 6).

Where & how to reproduce

URL observed: https://horizonfootballfestival.com.au/

Consequence if ignored

An admin / webmail interface reachable from the open internet is a brute-force target every day of the year. Even when properly secured, the login endpoint leaks information (existence of usernames, software vendor, server fingerprint) and consumes bandwidth fighting off automated attempts.

Recommendation

Restrict admin interfaces to a VPN or IP allowlist, or front them with a CDN access rule (Cloudflare Zero Trust, AWS WAF). SDG configures this as part of the perimeter-hardening pass for managed clients.

HTTP response headers

https://webmail.horizonfootballfestival.com.au:2096/ → HTTP 200 (serves login UI, 39871 bytes)

— — —

https://webmail.horizonfootballfestival.com.au/ → HTTP 200 (serves login UI, 39871 bytes)

Finding 13 Low A hygiene

No /.well-known/security.txt — no defined vulnerability-disclosure contact

Show technical detail

What we observed

D110 — No /.well-known/security.txt — no defined vulnerability-disclosure contact (Section D. HTTP response headers, taxonomy weight 3).

Where & how to reproduce

URL observed: https://horizonfootballfestival.com.au/

Consequence if ignored

Cookies are set without a SameSite attribute, or with SameSite=None. Modern browsers default to Lax for unset values, but explicit SameSite is a safer baseline and protects against CSRF.

Business impact

Missing SameSite cookies are a typical contributor to CSRF (cross-site request forgery) — the attack class where a malicious site triggers actions on the visitor's logged-in session elsewhere.

Recommendation

Set SameSite=Lax for most cookies, or Strict for high-security session cookies. SameSite=None should only be used with Secure when cross-origin cookies are genuinely needed.

HTTP response headers

GET https://horizonfootballfestival.com.au/.well-known/security.txt → 404

Source

https://datatracker.ietf.org/doc/html/rfc9116

Observation produced by wellknown_probe. Confidence grade A per AUDIT-DEFENSIBILITY.md. The evidence above is reproducible from any internet-connected host; if any specific value has changed since the audit was run, the underlying observation may no longer apply.

Compliance & Privacy

Finding 14 High A conditional

No privacy policy page found

Show technical detail

What we observed

K001 — No privacy policy page found (Section K. Privacy / legal / compliance, taxonomy weight 6).

Where & how to reproduce

URL observed: https://horizonfootballfestival.com.au/

When this matters

If a customer requests their data, if a regulator audits you, or in the event of a data breach.

Consequence if ignored

In Australia, any organisation that collects personal information is required under the Privacy Act 1988 and the Australian Privacy Principles (APPs) to have a clearly accessible privacy policy explaining what data is collected and how it is used. A youth sports tournament collecting team and contact details from families is squarely within scope. Without a published policy, the organisation is exposed to regulatory complaints and, in the event of a data breach or subject-access request, would have no documented compliance position to rely on.

Business impact

For organisations collecting personal information from families and minors, the absence of a privacy policy tends to attract regulatory attention during routine audits or following complaints, with remediation typically requiring both legal drafting and site redevelopment effort that is more costly than proactive implementation.

Recommendation

A concise privacy policy page — covering what personal information is collected, why it is collected, how it is stored, and how individuals can request access or correction — should be drafted, published at a standard path such as /privacy-policy, and linked from the site footer. SDG addresses this as part of our compliance-foundations service, including policy drafting and footer integration across all pages.

Evidence

probed standard paths, all returned 404 or no content

Observation produced by compliance_probe. Confidence grade A per AUDIT-DEFENSIBILITY.md. The evidence above is reproducible from any internet-connected host; if any specific value has changed since the audit was run, the underlying observation may no longer apply.

Finding 15 Medium A conditional

No Terms & Conditions page found

Show technical detail

What we observed

K012 — No Terms & Conditions page found (Section K. Privacy / legal / compliance, taxonomy weight 5).

Where & how to reproduce

URL observed: https://horizonfootballfestival.com.au/

When this matters

If a dispute with a customer reaches a tribunal or court.

Consequence if ignored

Without published terms, refund rules, cancellation policies, and liability limits are unenforceable if a dispute reaches a tribunal. Families or clubs who paid entry fees and seek a refund have no agreed framework to point to.

Business impact

For event businesses taking team registrations, this class of issue typically increases exposure in fee-dispute or cancellation scenarios where no written terms were accepted at the point of registration.

Recommendation

A single Terms & Conditions page covering entry fees, cancellation rules, and liability should be linked from the footer before registration opens. SDG handles this as part of our compliance-foundations service.

Evidence

Standard T&C paths returned no page. For businesses that sell goods, take bookings, or process payments, a missing T&C limits enforceability of refund policies, cancellation rules, and liability disclaimers.

Finding 16 Low A conditional

ABN not visible on the homepage

Show technical detail

What we observed

W001 — ABN not visible on the homepage (Section W. Business operations / identity, taxonomy weight 4).

Where & how to reproduce

URL observed: https://horizonfootballfestival.com.au/

Consequence if ignored

An ABN displayed on a business website is a trust signal (visitors can verify the business on the Australian Business Register), a B2B expectation (invoices need it), and required by law in some industries. Its absence isn't a fault but it removes one of the simplest verification signals available to anyone checking your legitimacy.

Recommendation

Add the ABN to the footer of every page. Format: 'ABN 12 345 678 901' — exactly as it appears on the ABR. SDG handles legal/credibility footer setup as part of any build or rescue engagement.

Evidence

No ABN pattern (ABN: XX XXX XXX XXX) found in homepage HTML

Finding 17 Low A conditional

No mention of public liability insurance

Show technical detail

What we observed

W007 — No mention of public liability insurance (Section W. Business operations / identity, taxonomy weight 3).

Where & how to reproduce

URL observed: https://horizonfootballfestival.com.au/

Consequence if ignored

For service businesses that visit customer premises (trades, cleaning, personal training, mobile services), public liability insurance is a trust signal customers actively look for — and an expectation in some commercial relationships. Its absence on the site isn't always relevant (pure online businesses don't need it visible) but for services that physically interact with customers, displaying it is a low-effort trust win.

Recommendation

If you carry public liability insurance, display it in the footer: 'Public liability insured to $20m via [Insurer]'. If you don't carry it and your business should, get it. SDG handles trust-signal display as part of any build or rescue engagement.

Evidence

No 'public liability', '$Nm insurance', or 'fully insured' patterns in homepage text

Performance

Finding 18 Medium A verified

1 render-blocking script(s) in <head>

Visual evidence

Watch as the page loads — elements jump when images and fonts settle. Captured at throttled 1.5 Mbps to show the shift at human speed.

Show technical detail

What we observed

L003 — 1 render-blocking script(s) in <head> (Section L. Performance (Core Web Vitals + deeper), taxonomy weight 6).

Where & how to reproduce

URL observed: https://horizonfootballfestival.com.au/

Verify yourself: curl -sI https://horizonfootballfestival.com.au/ | grep -iE 'content-encoding|cache-control'

Consequence if ignored

Every visitor's browser pauses rendering until this script finishes downloading — slowing the first visible content, which Google measures and uses in rankings. For a registration-driven site competing for team sign-ups, a slower first impression tends to reduce conversion.

Business impact

Sites with synchronous CDN scripts in <head> typically see measurable Largest Contentful Paint delays, which tends to suppress organic search ranking under Google's Core Web Vitals signals.

Recommendation

Adding a single `defer` attribute to the Tailwind CDN script tag removes the render block with minimal effort. SDG addresses this as part of our performance-foundations review.

Evidence

Scanned <head>; found 1 blocking script tags

Source

https://developer.mozilla.org/en-US/docs/Web/HTML/Element/script

Observation produced by performance_probe. Confidence grade A per AUDIT-DEFENSIBILITY.md. The evidence above is reproducible from any internet-connected host; if any specific value has changed since the audit was run, the underlying observation may no longer apply.

Finding 19 Low–Med A verified

5 of 5 images lack explicit width/height

Visual evidence

The image jump is visible mid-load — the browser had no width or height to reserve space, so layout shifts when the image arrives.

Show technical detail

What we observed

L153 — 5 of 5 images lack explicit width/height (Section L. Performance (Core Web Vitals + deeper), taxonomy weight 4).

Where & how to reproduce

URL observed: https://horizonfootballfestival.com.au/

Verify yourself: curl -s https://horizonfootballfestival.com.au/ | grep -oE '<img[^>]+>' | head -20

Consequence if ignored

A meaningful share of images lack explicit width and height attributes (or aspect-ratio CSS). Without dimensions the browser cannot reserve layout space before the image arrives, causing Cumulative Layout Shift as each image loads — a direct Core Web Vitals contributor.

Business impact

Layout shift directly impacts CLS scores, one of the three Core Web Vitals Google uses as ranking signals — fixing this is a measurable improvement on the same audit run.

Recommendation

Add width and height attributes to every <img>. Even if CSS sizes the image visually, the attributes give the browser an aspect ratio to reserve space against. SDG handles this systematically during performance work.

HTML markup observed

Of 5 <img> elements on the homepage, 5 have neither width/height attributes nor inline-style dimensions. Browsers cannot reserve layout space for these images, causing content shift as they load.

Source

https://web.dev/articles/cls

Observation produced by image_seo_probe. Confidence grade A per AUDIT-DEFENSIBILITY.md. The evidence above is reproducible from any internet-connected host; if any specific value has changed since the audit was run, the underlying observation may no longer apply.

Finding 20 Low A hygiene

No WebP or AVIF images detected (5 images served as legacy formats)

Show technical detail

What we observed

L150 — No WebP or AVIF images detected (5 images served as legacy formats) (Section L. Performance (Core Web Vitals + deeper), taxonomy weight 4).

Where & how to reproduce

URL observed: https://horizonfootballfestival.com.au/

Consequence if ignored

No next-generation image format (WebP or AVIF) was detected anywhere on the homepage. WebP typically reduces image weight by 25-35% versus JPEG at equivalent quality; AVIF compresses further. Modern browsers (Chrome, Edge, Firefox, Safari) all support WebP; AVIF support is now broad enough to use with a <picture> fallback.

Business impact

Sticking with legacy formats typically adds 25-35% to image weight, which compounds with LCP and total page weight metrics — measurable improvement after migration.

Recommendation

Convert hero and gallery images to WebP and serve them via <picture><source type="image/webp"> with a JPEG fallback. SDG handles the conversion + delivery as part of performance-foundations work.

HTML markup observed

Homepage references 5 <img> elements. None served via <picture><source type="image/webp"> or AVIF, and no .webp / .avif extensions found in any src or srcset.

Source

https://developer.mozilla.org/en-US/docs/Web/Media/Formats/Image_types

Finding 21 Low A hygiene

No Cache-Control header on the homepage response

Show technical detail

What we observed

L200 — No Cache-Control header on the homepage response (Section L. Performance (Core Web Vitals + deeper), taxonomy weight 4).

Where & how to reproduce

URL observed: https://horizonfootballfestival.com.au/

Consequence if ignored

The homepage response carries no Cache-Control header. Intermediate caches (CDN edges, browser caches, corporate proxies) fall back to heuristic freshness rules that may cache stale content or refuse to cache at all. Either outcome is unpredictable.

Business impact

Unpredictable caching typically translates to occasional stale-content complaints from customers and slower repeat-visit experience — observable through support load and analytics rather than a single number.

Recommendation

Set explicit Cache-Control directives — short max-age with must-revalidate for HTML, long max-age with immutable for content-hashed static assets. SDG handles cache-policy setup as part of performance-foundations work.

HTTP response headers

Homepage response from https://horizonfootballfestival.com.au/ returned without a Cache-Control header. Without it, intermediate caches and browsers use heuristic freshness rules that may cache stale content or refuse to cache at all.

Source

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control

Observation produced by edge_cache_probe. Confidence grade A per AUDIT-DEFENSIBILITY.md. The evidence above is reproducible from any internet-connected host; if any specific value has changed since the audit was run, the underlying observation may no longer apply.

Finding 22 Low A unverified

No WebP or AVIF image references found

Show technical detail

What we observed

L010 — No WebP or AVIF image references found (Section L. Performance (Core Web Vitals + deeper), taxonomy weight 3).

Where & how to reproduce

URL observed: https://horizonfootballfestival.com.au/

Consequence if ignored

The Lighthouse Performance score (mobile) is below the threshold considered good. This is an aggregate of multiple Core Web Vitals signals — typically driven by some combination of LCP, CLS, and TBT.

Business impact

Low Lighthouse scores aggregate the user-perceived slow-feel signals — and Google's ranking algorithm uses them. Sites in this bracket typically rank below the same content on faster pages.

Recommendation

Run a Lighthouse audit locally to identify the dominant contributor (image weight, render-blocking scripts, layout shift, server response time). Address the top contributor first; revisit.

Evidence

Scanned HTML for .webp / .avif; no matches in 32391 chars of HTML

Source

https://developer.mozilla.org/en-US/docs/Web/Media/Formats/Image_types

Finding 23 Low A hygiene

Likely LCP image not marked fetchpriority="high"

Show technical detail

What we observed

L151 — Likely LCP image not marked fetchpriority="high" (Section L. Performance (Core Web Vitals + deeper), taxonomy weight 3).

Where & how to reproduce

URL observed: https://horizonfootballfestival.com.au/

Consequence if ignored

The likely LCP (Largest Contentful Paint) image candidate isn't marked fetchpriority="high". Modern browsers use this hint to begin downloading the image earlier in the resource queue, typically improving LCP by 100-300ms on real connections.

Business impact

Better LCP correlates with lower bounce and higher engagement, especially on mobile where the first-paint moment determines whether the user waits or leaves.

Recommendation

Add fetchpriority="high" to the LCP image (usually the hero). It's a single-attribute fix. SDG includes the fetchpriority hint as part of performance-foundations work.

Evidence

First above-the-fold image candidate (src=images/horizon-mark.png) has no fetchpriority attribute. Modern browsers prioritise images flagged fetchpriority="high" earlier in the resource queue, improving LCP.

Source

https://web.dev/articles/fetch-priority

Accessibility

Finding 24 Medium A verified

No <main> landmark element on the page

Show technical detail

What we observed

N005 — No <main> landmark element on the page (Section N. Accessibility (WCAG 2.1 AA / DDA), taxonomy weight 5).

Where & how to reproduce

URL observed: https://horizonfootballfestival.com.au/

Consequence if ignored

Visitors using screen readers or keyboard navigation rely on a <main> landmark to skip past repeated headers and menus. Without it, they must tab through every navigation link on every page load — a real barrier that can expose the site to DDA complaints in Australia.

Business impact

For event and registration sites in this bracket, missing landmark elements tend to surface in disability access complaints and can complicate compliance with the Disability Discrimination Act 1992 where digital accessibility is increasingly scrutinised.

Recommendation

Add a single <main> element wrapping the page's primary content — typically a 10-minute code change. SDG addresses landmark structure as part of our accessibility-foundations review.

Evidence

No <main> tag found in HTML

Source

https://www.w3.org/WAI/ARIA/apg/patterns/landmarks/

Observation produced by accessibility_probe. Confidence grade A per AUDIT-DEFENSIBILITY.md. The evidence above is reproducible from any internet-connected host; if any specific value has changed since the audit was run, the underlying observation may no longer apply.

Finding 25 Low A verified

No skip-to-content link at the top of the page

Show technical detail

What we observed

N004 — No skip-to-content link at the top of the page (Section N. Accessibility (WCAG 2.1 AA / DDA), taxonomy weight 5).

Where & how to reproduce

URL observed: https://horizonfootballfestival.com.au/

Consequence if ignored

This dimension is monitored by the SDG audit engine because it relates to: image `alt` text descriptive (not "image", "img_4100"). The Phase 31 generator will replace this placeholder with owner-language consequence prose.

HTML markup observed

No <a href='#...'> link with 'skip' / 'main' / 'content' text found

Source

https://www.w3.org/WAI/WCAG21/Techniques/general/G1

Finding 26 Low A verified

axe-core moderate accessibility violation: All page content should be contained by landmarks (on 2 pages, 19 elements) (2 instances)

Show technical detail

What we observed

N102 — axe-core moderate accessibility violation: All page content should be contained by landmarks (on 2 pages, 19 elements) (Section N. Accessibility (WCAG 2.1 AA / DDA), taxonomy weight 3).

Where & how to reproduce

URL observed: https://horizonfootballfestival.com.au/

Consequence if ignored

Automated accessibility scan found moderate-severity violations — issues that reduce usability for some visitors but rarely block access entirely. Examples: redundant link text, mildly low contrast, suboptimal heading structure.

Business impact

Moderate accessibility issues rarely block users but typically lower scan-depth and engagement for visitors using assistive tech. Cumulatively they read as a site that wasn't built with accessibility in mind.

Recommendation

Address moderate-severity items as part of a broader accessibility-foundations pass. Lower priority than criticals and serious, but cumulative effect on usability is real.

Evidence

axe-core rule region: 19 element(s) on 2 page(s)

— — —

axe-core rule landmark-one-main: 1 element(s) on 1 page(s)

Source

https://dequeuniversity.com/rules/axe/4.10/region?application=axeAPI

Observation produced by axe_probe. Confidence grade A per AUDIT-DEFENSIBILITY.md. The evidence above is reproducible from any internet-connected host; if any specific value has changed since the audit was run, the underlying observation may no longer apply.

SEO & content

Finding 27 Low A unverified

No structured data (schema.org) on the page (5 instances)

Show technical detail

What we observed

M150 — No structured data (schema.org) on the page (Section M. SEO (deeper), taxonomy weight 7).

Where & how to reproduce

URL observed: https://horizonfootballfestival.com.au/

Consequence if ignored

Pages that aren't in Google's index cannot appear in search results — no matter how well-written they are, no customer will reach them via Google. A gap between sitemap-declared URLs and the number Google has indexed usually points to a crawl-blocking issue: noindex tags, robots.txt rules, duplicate-content collapse, or pages Google has actively decided not to surface.

Recommendation

Check Google Search Console for excluded-pages reasons against each unindexed URL. Fix the underlying cause (remove inadvertent noindex tags, correct robots.txt, consolidate duplicates, improve thin pages) and request re-crawl. SDG audits and remediates indexability as part of a managed engagement — typically a one-to-two-hour diagnostic followed by per-page fixes.

Evidence

Your page has no schema.org structured data. This is the markup that lets Google show rich results — star ratings, opening hours, prices, FAQ snippets, location pins. Missing all schema is the single biggest commonly-missed SEO win.

— — —

A sitemap.xml lists every page on your site for search engines to discover. Without one, Google relies entirely on link discovery — which means newer or less-linked pages may never get indexed.

— — —

The Horizon Football Festival is a four-day youth football tournament hosted by Manly United FC at Cromer Park, 2-5 Octo...

— — —

The <link rel="canonical"> tag tells search engines which URL is the authoritative version of a page. Without it, search engines may index the same page under multiple URLs (with and without www, with and without trailing slash), diluting your ranking signal.

— — —

Your robots.txt returned HTTP 404. Search engines look here for crawling instructions. Most sites have one even if it's just allowing everything — its absence is a tell that the site wasn't fully set up.

Observation produced by seo_probe. Confidence grade A per AUDIT-DEFENSIBILITY.md. The evidence above is reproducible from any internet-connected host; if any specific value has changed since the audit was run, the underlying observation may no longer apply.

Trust, brand & UX

Finding 28 Medium A verified

No phone number visible on the homepage

Show technical detail

What we observed

R004 — No phone number visible on the homepage (Section R. UX / interaction, taxonomy weight 4).

Where & how to reproduce

URL observed: https://horizonfootballfestival.com.au/

Consequence if ignored

Coaches and team managers making quick decisions about registering often want to call and ask a question before committing. Removing that option can stall sign-ups, particularly for interstate and overseas teams coordinating logistics on a tight timeline.

Business impact

For event-registration sites in this bracket, missing phone contact tends to reduce enquiry-to-registration conversion, particularly among older or less digitally confident contacts such as club administrators.

Recommendation

Adding a contact phone number — even a mobile — to the footer and contact section takes minutes and removes a common friction point for prospective registrants. SDG can review the full contact and conversion pathway as part of a UX audit engagement.

Evidence

No tel: links and no Australian-format phone number found in homepage HTML

Observation produced by conversion_path_probe. Confidence grade A per AUDIT-DEFENSIBILITY.md. The evidence above is reproducible from any internet-connected host; if any specific value has changed since the audit was run, the underlying observation may no longer apply.

Finding 29 Low A verified

No physical address visible on the homepage

Show technical detail

What we observed

R007 — No physical address visible on the homepage (Section R. UX / interaction, taxonomy weight 4).

Where & how to reproduce

URL observed: https://horizonfootballfestival.com.au/

Consequence if ignored

Parents and team managers evaluating an unfamiliar event typically look for a verifiable physical location before committing registration fees. Without a complete address, some visitors may hesitate or abandon the page in favour of a competitor they can physically verify.

Business impact

For event-registration sites, missing or incomplete address information tends to reduce trust-based conversions, particularly among first-time registrants unfamiliar with the organiser.

Recommendation

Add a full street address (e.g. Cromer Park, 494 Condamine Street, Cromer NSW 2099) in the footer inside an HTML <address> element — this takes under 30 minutes and also improves local search signals. SDG includes this as part of our conversion-foundations review.

HTML markup observed

No <address> element and no Australian-format (Suburb STATE postcode) pattern found

Finding 30 Low A unverified

No payment, security, or accreditation badges visible

Show technical detail

What we observed

S005 — No payment, security, or accreditation badges visible (Section S. Trust signals, taxonomy weight 3).

Where & how to reproduce

URL observed: https://horizonfootballfestival.com.au/

Consequence if ignored

Payment-logo strips (Visa, Mastercard, Stripe, Afterpay, PayPal) and security badges (SSL, Norton) act as visual trust shortcuts at the moment of purchase or contact. Their absence creates uncertainty — especially for first-time visitors making a buying decision.

Recommendation

Add a payment-logos strip in the footer (or near checkout for e-commerce) and any security/accreditation badges your business legitimately holds. Don't add fake or unearned badges. SDG handles trust-badge setup as part of any e-commerce or build engagement.

Evidence

No image src or alt text matching payment-logo or security-badge keywords.

Observation produced by trust_signals_probe. Confidence grade A per AUDIT-DEFENSIBILITY.md. The evidence above is reproducible from any internet-connected host; if any specific value has changed since the audit was run, the underlying observation may no longer apply.

Finding 31 Low A unverified

No "as seen in" / press section

Show technical detail

What we observed

S009 — No "as seen in" / press section (Section S. Trust signals, taxonomy weight 3).

Where & how to reproduce

URL observed: https://horizonfootballfestival.com.au/

Consequence if ignored

Press logos and 'featured in' sections are trust shortcuts — visitors recognise familiar publications and absorb credibility quickly without reading anything. Their absence isn't a disaster, but if you have legitimate press coverage and aren't showing it, that's leaving trust value on the table.

Recommendation

If you have legitimate press mentions, add a small 'As featured in' strip with publication logos. If you don't, skip — don't fake it. SDG handles press-section setup if you have coverage to display.

Evidence

No 'as seen in / featured in / press / media coverage' patterns in homepage visible text.

Finding 32 Low A verified

Multiple trust signals missing (6 of 6 standard signals absent)

Show technical detail

What we observed

S013 — Trust signals — multiple missing (Section S. Trust signals, taxonomy weight 3).

Where & how to reproduce

URL observed: https://horizonfootballfestival.com.au/

Consequence if ignored

A trust-signal sweep across the homepage and footer found several of the standard 'is this business real and accountable?' signals missing — typically some combination of phone, address, ABN, founder bio, testimonials, and a clear value proposition. Individually each is minor; together they read as a pattern.

Business impact

When several trust signals are missing at once, visitors typically interpret it as a credibility gap rather than a series of small oversights — and competitors who do show these signals win the comparison shop.

Recommendation

Address the missing signals as a single piece of work — usually a footer refresh, an About page review, and an ABN visibility check. SDG handles trust-signal foundations as part of brand-foundations work.

Evidence

Trust-signal sweep across the homepage and footer found the following standard signals missing: a phone number, a physical address, an ABN or ACN, customer social proof (testimonials, logos, reviews), a clear value proposition, a named founder or team member. Visitors arriving from search or referral have limited cues to verify the business is real, contactable, and accountable.

Source

https://www.accc.gov.au/business/business-rights-and-protections/competition-and-consumer-act

Finding 33 Low A unverified

No social-media profiles linked from the homepage

Show technical detail

What we observed

U010 — No social-media profiles linked from the homepage (Section U. Social presence, taxonomy weight 3).

Where & how to reproduce

URL observed: https://horizonfootballfestival.com.au/

Consequence if ignored

This dimension is monitored by the SDG audit engine because it relates to: youtube channel. The Phase 31 generator will replace this placeholder with owner-language consequence prose.

Evidence

Scanned homepage HTML for links matching facebook.com, fb.com, instagram.com, linkedin.com, twitter.com, x.com, tiktok.com, youtube.com, youtu.be, pinterest.com, threads.net, bsky.app

Observation produced by social_presence_probe. Confidence grade A per AUDIT-DEFENSIBILITY.md. The evidence above is reproducible from any internet-connected host; if any specific value has changed since the audit was run, the underlying observation may no longer apply.

Finding 34 Low A unverified

Twitter Card metadata missing entirely

Show technical detail

What we observed

U121 — Twitter Card metadata missing entirely (Section U. Social presence, taxonomy weight 2).

Where & how to reproduce

URL observed: https://horizonfootballfestival.com.au/

Consequence if ignored

Twitter Card metadata (twitter:card, twitter:title, twitter:image) is missing. X falls back to Open Graph when its own tags aren't present, so this is lower priority when OG is complete, but the twitter:card / twitter:image pair lets you specify a different image or layout specifically for X if desired.

Business impact

Twitter Card metadata is an incremental polish rather than a fix — useful for brands with active X presence, low priority for brands that share elsewhere.

Recommendation

Once OG metadata is complete, add twitter:card="summary_large_image" plus the matching twitter:image. SDG handles this alongside the OG setup.

Evidence

Homepage <head> declares 0 of 3 core Twitter Card properties. Present: (none). Missing: twitter:card, twitter:title, twitter:image. (X falls back to Open Graph when Twitter-specific tags are absent, so this is lower-priority while OG is complete).

Source

https://developer.x.com/en/docs/x-for-websites/cards/overview/abouts-cards

Observation produced by brand_signals_probe. Confidence grade A per AUDIT-DEFENSIBILITY.md. The evidence above is reproducible from any internet-connected host; if any specific value has changed since the audit was run, the underlying observation may no longer apply.

Mobile & platforms

Finding 35 Low A verified

10 touch target(s) smaller than 44×44 px at mobile on https://horizonfootballfestival.com.au/ (2 instances)

Show technical detail

What we observed

AD102 — 10 touch target(s) smaller than 44×44 px at mobile on https://horizonfootballfestival.com.au/ (Section AD. Mobile-specific, taxonomy weight 5).

Where & how to reproduce

URL observed: https://horizonfootballfestival.com.au/

Consequence if ignored

Multiple mobile usability issues detected — touch targets too small, content overflowing the viewport, text too small to read without zooming, or some combination. Mobile experience is significantly degraded.

Business impact

Sites with multiple mobile issues typically rank lower in Google's mobile-first index AND have higher bounce rates from mobile visitors — the two effects compound.

Recommendation

Address the specific issues identified — touch targets to 44×44px minimum, viewport meta tag set, base font-size at least 16px for body text. SDG runs the mobile-foundations pass as a packaged engagement.

DNS evidence

Computed-style audit at 390px viewport: 10 interactive elements < 44×44 px

— — —

Computed-style audit at 390px viewport: 7 interactive elements < 44×44 px

Source

https://www.w3.org/WAI/WCAG21/Understanding/target-size

Observation produced by responsive_probe. Confidence grade A per AUDIT-DEFENSIBILITY.md. The evidence above is reproducible from any internet-connected host; if any specific value has changed since the audit was run, the underlying observation may no longer apply.

Finding 36 Low A verified

Horizontal scroll at tablet viewport on https://horizonfootballfestival.com.au/ (6px overflow)

Show technical detail

What we observed

AD101 — Horizontal scroll at tablet viewport on https://horizonfootballfestival.com.au/ (6px overflow) (Section AD. Mobile-specific, taxonomy weight 4).

Where & how to reproduce

URL observed: https://horizonfootballfestival.com.au/

Consequence if ignored

This dimension is monitored by the SDG audit engine because it relates to: horizontal scroll at tablet viewport (rendered). The Phase 31 generator will replace this placeholder with owner-language consequence prose.

DNS evidence

Tablet viewport: 768px; document scrollWidth: 774px

History & continuity

Finding 37 Low A hygiene

No CDN / DDoS-resilience layer detected in response headers (2 instances)

Show technical detail

What we observed

Y002 — No CDN / DDoS-resilience layer detected in response headers (Section Y. Backups / continuity / disaster, taxonomy weight 5).

Where & how to reproduce

URL observed: https://horizonfootballfestival.com.au/

Consequence if ignored

This dimension is monitored by the SDG audit engine because it relates to: cloudflare or cdn presence (ddos resilience). The Phase 31 generator will replace this placeholder with owner-language consequence prose.

Evidence

Response headers: accept-ranges, alt-svc, connection, content-encoding, content-length, content-type, date, keep-alive, last-modified, server, vary

— — —

No CDN provider signatures in HTML or response headers

Observation produced by continuity_probe. Confidence grade A per AUDIT-DEFENSIBILITY.md. The evidence above is reproducible from any internet-connected host; if any specific value has changed since the audit was run, the underlying observation may no longer apply.

How this audit was run

Run on: 2026-06-17
How we looked: From outside, as a normal visitor would. We didn't log in, didn't submit any forms, didn't try to break anything.
What kind of site: Treated as a brochure site — we focused on the things that matter for this kind of business (and skipped 5 checks that don't apply).
What we checked: 52 things across your site. 37 came up as worth your attention. 0 were fine. 0 couldn't be checked from the outside.
Our promise: Everything above is something we observed, double-checked, and can show you exactly how to verify yourself.

Audit findings for Horizon Football Festival 2026.

Before we get into the findings — here's who we think you are

Findings at a glance

Security

3 smaller items worth knowing about in Security

Compliance & Privacy

Performance

4 smaller items worth knowing about in Performance

Accessibility

SEO & content

Trust, brand & UX

6 smaller items worth knowing about in Trust, brand & UX

Mobile & platforms

History & continuity

You've seen what's wrong. Here's what happens next.

What you get with every engagement

Pick the tier that suits your appetite

Beach

Surf

Ocean

What this audit does not cover

How this audit was run