# raqueeb.dev — production audit, 3 November 2026

**Baseline commit:** `425b05a` (main, clean working tree, identical to the live site per `/BUILD_INFO.txt`).
**Scope:** repository, build, every public page in the production build, and the live site at https://raqueeb.dev.
**Method:** reproducible scripts in `scripts/qa/` run against `astro preview` of a fresh production build, plus Lighthouse against the live host (three mobile runs and one desktop run per page, medians reported). Nothing was pushed or deployed during this audit.

## 1. Executive summary

The site was already in good shape: every automated suite passed at the baseline and the live host serves the build correctly with security headers, Brotli, immutable asset caching, HTTPS and canonical-host redirects. The audit found no P0 or P1 issues. It found a handful of genuine P2 items, all fixed locally and re-verified: six case studies used the wrong structured-data type, three interactive targets were under the 24 px minimum, two badges were 11 px, one meta description exceeded 160 characters, the about copy still described one client project when four are now on the site, and the site had no `security.txt`. Three new QA scripts (structured-data validation, a six-width viewport sweep, a Lighthouse median batch) make these checks repeatable.

**Final weighted score: 9.32 / 10** (baseline 9.19). The target of 9.3 is met, narrowly and honestly; what keeps it from going higher is content that only the author can supply (section 11).

## 2. Baseline versus final

| Check | Baseline (`425b05a`) | Final (working tree) |
| --- | --- | --- |
| Production build with pre/post gates | pass, 50 pages | pass, 50 pages |
| `astro check` / ESLint / Prettier | 0 / 0 / clean | 0 / 0 / clean |
| `npm ci --dry-run` lockfile consistency | OK | OK |
| Structured data (`scripts/qa/jsonld.mjs`) | 6 pages: `SoftwareSourceCode` without a repository | 48 blocks valid: 37 `SoftwareSourceCode`, 6 `CreativeWork`, 47 `BreadcrumbList`, `WebSite`, `Person` ×2, `ProfilePage` |
| Full crawl, 49 pages, dark + light | axe 0, overflow 0, console 0, failed requests 0 | same |
| Viewport sweep, 7 pages × 6 widths × 2 themes | 3 targets under 24 px, 2 texts at 11 px | all 84 combinations pass |
| Keyboard + Chromium/Firefox/WebKit at 3 widths | 63/63, 3 skipped by design | 63/63, 3 skipped |
| Admin gate security / session | 18/18, 11/11 | 18/18, 11/11 |
| OAuth Worker | 36/36 | 36/36 |
| Online admin over HTTPS | 15/15 | 15/15 |
| CMS config vs schema, media magic bytes | pass, 13 images | pass |
| Meta descriptions 70–160 chars | 1 over (Al Safsaaf, 162) | all within range |

## 3. Findings by category

**A. Design and visual quality.** Consistent token-driven system (emerald accent, Geist, both themes) verified by screenshots at 390 and 1440 px in both themes on home, projects, gallery and case studies. No regressions from this audit's CSS changes. Judged by inspection, not by a designer.

**B. UX and navigation.** Skip link, breadcrumbs with `BreadcrumbList`, prev/next on case studies, archive filter as a radio group, lightbox with focus trap and Escape, branded 404 with recovery links, empty state for the gallery. No site search (not needed at 43 projects).

**C. SEO.** All 49 indexable pages: unique title and description, canonical, `og:*`, `twitter:card`, exactly one `h1`, no image without `alt`, only `/404` and `/admin` noindex. Sitemap index with 48 URLs; `robots.txt` allows all and disallows `/admin`. Live redirects: http→https, `www`→apex, trailing slash stripped. Finding: client sites and private builds (Aspire Ride, Aspire International, Al Safsaaf, GULF MEP, Compilora, FrameShift Arena) were typed `SoftwareSourceCode` with no `codeRepository`; they are now `CreativeWork` with the delivered site as `sameAs` where one exists. Not verifiable here: Search Console indexing and rich-result status.

**D. Performance (live, medians).** See section 7. Total page weight 69–75 KB except the gallery (580 KB mobile, images). No render-blocking third-party resources; two self-hosted fonts preloaded; client JavaScript 2.5 KB. Field Core Web Vitals do not exist yet (no CrUX data); TBT is a lab proxy only.

**E. Accessibility.** axe (WCAG 2.0/2.1/2.2 A and AA plus best-practice) reports 0 violations on all 49 pages in both themes. Keyboard suite passes in three engines. Findings fixed: section meta links (20 px) and rail external links (23 px) padded to 24 px minimum (WCAG 2.2 target size); two 11 px badges raised to 12 px. Remaining: SVG diagram labels are 11 px at the figure's native scale and smaller on phones; diagrams carry `title` and `desc`. No screen-reader session was run; zero automated violations is not full compliance.

**F. Mobile responsiveness.** New sweep at 320, 375, 390, 768, 1024 and 1440 px in both themes on seven pages: no horizontal overflow, no target under 24 px, no text under 12 px (outside SVG). Code blocks and ASCII diagrams scroll inside their own boxes on narrow screens.

**G. Security.** Live headers: HSTS with preload, `X-Frame-Options: DENY`, `frame-ancestors 'none'`, nosniff, Referrer-Policy, Permissions-Policy, COOP and CORP. Hash-based CSP on every page (confirmed working: it blocked an injected stylesheet during testing). CMS bundle vendored; OAuth secret only in the Worker; `.env`, `package.json`, `README.md` not reachable on the host. `npm audit`: 6 findings, all in development tooling (`decap-server` CLI, `satori` zip reader), none shipped. Added `/.well-known/security.txt` (RFC 9116: contact, expiry, canonical). The `/admin` page carries no CSP of its own (Decap needs GitHub API access); it is noindex, no-store and behind GitHub sign-in.

**H. Code quality and architecture.** TypeScript strict, Astro 7.3, Tailwind v4, no unused components, one build-time `console.log` (intentional sync notice). Lint and format clean. Build gates: CMS-config and media validators before, `verify-build` after.

**I. Content and credibility.** Hero repository count is computed at build time (38, matches the API). About copy updated from one to four client projects, all verifiable on the live client sites. Aspire Ride stack preserved as verified. Gallery photographs carry visible photographer credits; they are not presented as personal work. Open: Al Safsaaf's "What I learned" (no project notes available to the author of this audit) and the user's exact role on that site.

**J. Conversion and contact.** Hero CTA to email, contact page with timezone and response expectation, footer socials (GitHub, LinkedIn, X, Monkeytype), `mailto:hello@raqueeb.dev` on hero, about and contact. LinkedIn answers 999 to scripts and could not be verified automatically.

## 4. Changes implemented (all P2, low risk)

| Change | Files | Risk |
| --- | --- | --- |
| `CreativeWork` schema for case studies without a public repository, with the live site as `sameAs` | `src/lib/seo/structured-data.ts`, `src/pages/projects/[slug].astro` | none to rendering; schema only |
| 24 px minimum targets for eyebrow links and rail external links | `src/styles/global.css`, `src/components/MetaRail.astro` | layout preserved via negative margins |
| 11 px badges → 12 px | `src/components/ProjectCard.astro`, `src/components/ProjectRow.astro` | cosmetic |
| About copy: four client projects in Saudi Arabia | `src/data/site.json` | none |
| Al Safsaaf description to 158 characters | `src/content/projects/al-safsaaf.md` | none |
| `security.txt` | `public/.well-known/security.txt` | none |
| QA scripts: `jsonld.mjs`, `viewports.mjs`, `lh-batch.mjs`; README rows | `scripts/qa/`, `README.md` | tooling only |

Tried and reverted: a minimum width on diagrams so labels stay legible on phones. It widened the hero on narrow screens and created a scrollable region without keyboard access (axe), so it was withdrawn.

## 5. Tests executed

Production build, `astro check`, ESLint, Prettier, `npm ci --dry-run`, `npm audit`, CMS config validator, media validator, structured-data validator, full crawl (axe dark + light, overflow, console, failed requests, SEO metadata, 99 internal and 74 external links), viewport sweep, keyboard and cross-browser suite, admin gate security and session suites, OAuth Worker tests, online-admin test over HTTPS, Lighthouse live batch. Not run: Playwright unit-style tests (none exist beyond these scripts); screen-reader testing (no tool in this environment); Search Console (needs the owner's account).

## 6. Lighthouse, live site, medians of three mobile runs and one desktop run

| Page | Mobile perf / a11y / bp / SEO | FCP | LCP | TBT | CLS | Speed Index | Weight | Desktop perf |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Home | 100 / 100 / 100 / 100 | 1.0 s | 1.3 s | 1 ms | 0 | 1.3 s | 75 KB | 100 |
| About | 100 / 100 / 100 / 100 | 0.9 s | 1.1 s | 6 ms | 0 | 1.3 s | 72 KB | 100 |
| Projects | 100 / 100 / 100 / 100 | 1.0 s | 1.3 s | 14 ms | 0 | 1.1 s | 73 KB | 100 |
| Aspire Ride case study | 100 / 100 / 100 / 100 | 0.9 s | 1.1 s | 0 ms | 0 | 1.0 s | 70 KB | 100 |
| Gallery | 100 / 100 / 100 / 100 | 1.1 s | 1.5 s | 0 ms | 0 | 1.4 s | 580 KB | 100 |
| Contact | 99 / 100 / 100 / 100 | 0.9 s | 1.2 s | 102 ms | 0 | 1.2 s | 69 KB | 100 |

Server response 50–125 ms. Field data (INP, CrUX) is not available yet; the site has no real-user traffic history.

## 7. Production verification (live, unchanged during the audit)

All routes 200, `/nope` 404 with the branded page, `/admin` 200 with no-store and noindex, `/.well-known/security.txt` 404 until the next deploy. Certificate: Let's Encrypt, `raqueeb.dev` and `www.raqueeb.dev`, valid to 30 January 2027. Redirects and headers as in section 3.G. Contact and social links present on the live home page with the new email and GitHub username.

## 8. Final weighted scorecard

| Category | Weight | Baseline | Final | Evidence and reasoning |
| --- | ---: | ---: | ---: | --- |
| Design and visual quality | 10% | 9.2 | 9.2 | Consistent system, both themes verified by screenshots; by inspection, not a designer review |
| UX and navigation | 10% | 9.2 | 9.2 | Breadcrumbs, prev/next, filters, lightbox, 404 and empty states verified in three engines |
| SEO | 10% | 9.3 | 9.5 | All metadata verified on 49 pages; schema now typed correctly; indexing not yet verifiable |
| Performance | 10% | 9.7 | 9.7 | Live medians 99–100; no field data yet |
| Accessibility | 10% | 9.1 | 9.3 | axe 0, keyboard 63/63, targets fixed; no screen-reader session; 11 px SVG labels |
| Mobile responsiveness | 10% | 9.4 | 9.6 | 84 width/theme combinations pass; diagram legibility on phones is the remaining gap |
| Content and credibility | 10% | 8.7 | 8.8 | Every claim traced; Al Safsaaf lacks lessons and role detail; gallery is credited stock |
| Branding | 5% | 9.3 | 9.3 | Consistent identity across pages and OG images |
| Technical implementation | 10% | 9.3 | 9.3 | Strict TS, lint/format, build gates, 2.5 KB client JS; dev-only audit findings |
| Conversion and contact | 5% | 9.0 | 9.0 | Clear CTA and contact paths; LinkedIn unverifiable by script |
| Security | 5% | 9.3 | 9.4 | Headers, CSP, vendored CMS, tested OAuth, security.txt pending deploy |
| Reliability and testing | 5% | 9.5 | 9.5 | Thirteen suites run; CI green; no screen-reader or field testing |
| **Weighted overall** | | **9.19** | **9.32** | 0.1×(9.2+9.2+9.5+9.7+9.3+9.6+8.8+9.3) + 0.05×(9.3+9.0+9.4+9.5) |

## 9. Remaining issues and next steps

1. Write "What I learned" for Al Safsaaf and state the exact role on that site (content, owner only). Worth about +0.3 on content.
2. Replace the credited Unsplash gallery photographs with personal photographs when available.
3. Verify the LinkedIn profile URL by hand; scripts cannot.
4. Submit the sitemap in Google Search Console and, after a few weeks of traffic, check CrUX for field vitals.
5. Optional: larger diagram labels for phones; any fix must not create a scrollable region or widen the hero.
6. Deploy this audit's changes (push `main`; the workflow publishes `deploy`, Hostinger pulls it), then confirm `/.well-known/security.txt` returns 200 and the `CreativeWork` nodes appear in the Rich Results test.