cassiltoun.org.uk · accessibility, security, SEO & technical review
A manual review of the Cassiltoun Housing Association website covering accessibility, security posture, search visibility, and technical currency - the areas that most affect real tenants trying to get things done, and how the organisation is represented online. Findings below are prioritised by impact, not by how they were discovered.
3
Critical
7
Should Fix
3
Minor
5
Working Well
Critical
Fix First
No security headers configured
The site is missing some standard browser-level safety settings (technically: Content-Security-Policy, X-Frame-Options, HSTS). In plain terms, another website could secretly load Cassiltoun's page inside its own, invisibly, and trick a visitor into clicking a real payment or login button without realising it.
Session cookie lacks Secure / HttpOnly flags
The small file (a "cookie") that keeps a visitor logged in isn't locked down as tightly as it should be. A quick, low-effort fix that limits the damage if any other bug is ever found on the site.
Seven <h1> tags on one page
Every page should have one clear main heading, like a book has one title page. This one has seven, including small section titles like "Facebook" and "Cookies and Privacy" wrongly marked as the page's title. Visitors using screen readers, who often jump around a page by its headings, get a confusing list instead of a clear title. It also weakens how well the page shows up in search.
Should Fix
Next
Missing image alt text & form labels
5 of 23 homepage images have no written description attached, and 6 form boxes (like the search field) have no label. A visitor using a screen reader hears nothing useful for either.
Core assets last updated 2019 / 2022
The site's underlying styling and code files are dated Oct 2019 and Jun 2022, suggesting the platform hasn't had a proper maintenance check in a while and may be due one.
Six third-party trackers load on every visit
Facebook sharing buttons, Google Maps, Google Translate, a spam-checker, and a "listen to this site" tool all quietly load and contact outside companies on every visit, some of them apparently before the visitor has agreed to the cookie popup, which is exactly what that popup is meant to prevent.
Unrestricted-looking Maps API key in source
The map on the site needs a Google "key" to work, and that key is visible in the page. This is normal, but it's only safe if it's been restricted so it only works on Cassiltoun's own site, otherwise someone else could copy it and rack up charges on the account. Worth a quick check with whoever manages the Google account.
404 pages return HTTP 200
Type in a wrong web address and the site shows a friendly "page not found" message, but technically tells Google "this page worked fine!" Over time, this quietly hurts how well the site shows up in search results.
Thin page title & meta description
The text Google shows for this page in search results is just "Cassiltoun HA" and "Home, Cassiltoun HA" - it doesn't say what the organisation actually does or where, which makes it harder for people to find.
Deep, nested navigation
The menu nests up to four levels deep. Someone who can't use a mouse (relying on the keyboard instead) has to step through a lot of hidden sub-menus before reaching the page content.
Minor
Polish
Sparse Open Graph tags
The site hasn't set up the details that control how a shared link looks on Facebook, Twitter, or Slack, so those links show a blank or oddly-guessed preview instead of a proper title and image.
reCAPTCHA v2 rather than v3
The "prove you're not a robot" check is the older, clunkier tick-box kind, instead of the newer version that works invisibly in the background without interrupting the visitor.
Legacy Google Translate widget
The "translate this page" button uses an old Google tool that's no longer actively improved, and can mistranslate important things like form instructions or legal text.
What's Working Well
Looks and works fine on a phone - the menu tidies itself away neatly and nothing overlaps or spills off the screen.
Loads quickly - just over a second to become usable, and it isn't a heavy, bloated page.
A genuinely good cookie consent popup - lets visitors choose exactly which types of cookies they're okay with, rather than a blunt "accept everything or nothing."
The behind-the-scenes basics are in place, including a shortcut that lets keyboard users jump straight to the main content.
Secure connection confirmed - if someone types the address without "https", the site automatically switches them to the secure, encrypted version, and a few other basic safety settings are correctly in place.
Recommended Priority Order
Turn on the missing security settings and lock down the login cookie - both are quick server settings, not a rebuild of the site.
Fix the page-title mix-up and add the missing image/form descriptions - a day's work for a developer, and a meaningful accessibility improvement.
Make broken links say "not found" properly, and rewrite the homepage's search listing text.
Check the outside tools against the cookie popup, and confirm the Google Maps key can't be misused.
Book in a general health check, given how long it's been since the last one.
How this was checked: by opening the live site in a browser and inspecting its code, styling, and the data it sends and receives, plus testing a few specific things directly (its robots file, sitemap, and what happens on a broken link). All counts (missing descriptions, heading issues, etc.) come from the homepage only, not the whole site, so the real totals are likely higher. This was a manual expert review, not a formal accessibility certification (WCAG audit) or an automated scan (e.g. Lighthouse) - a fuller review would go further.