What Our Own Audit Tooling Found

The first article in this series carried a caveat: one Lighthouse run, on one page, isn't something to build a decision on. Rather than repeat that caveat indefinitely, we built a second, independent way to check our own work — and pointed it at everything, not just the pages we already knew about.

One score isn't the whole picture

Automated scoring tools are good at what they measure and silent about what they don't. Run two different, legitimate methods over the same page at the same moment, and they can land in genuinely different places — one reporting a page as largely fine, the other flagging real, serious problems the first method's own rules don't weigh heavily enough to surface. Neither number is wrong. They're answering different questions: how much of a checklist did this page pass, versus how serious are the things it didn't.

The practical lesson: a single score, from a single tool, isn't a verdict. It's one read, worth cross-checking before it drives a decision — which is exactly why we built a second method rather than just running the first one more often.

A page nobody meant to leave live

Pointing our audit tooling at the old site's own sitemap — rather than just the handful of pages linked from the navigation — turned up something a person reading the menu would never find: a leftover template page from the page-builder era, still live, still returning normally, still carrying our company name in its title, years after anyone had reason to look at it.

Nothing sinister — a forgotten artefact from the tool the old site was built with, not a breach or a deliberate act by anyone. But it's a real governance lesson: an unexamined legacy page under your own name is exactly the kind of thing that erodes trust with a visitor or a search engine, quietly, for as long as nobody's looking. The fix was simple once it was found. Finding it took actually crawling the site rather than trusting the nav to represent everything that's live.

Why we don't quote a single run

The same unchanged page, measured twice on the same day with the same tool, can return meaningfully different performance numbers — not because anything changed on the page, but because of how much else was competing for the same machine's attention at the moment of the test. That's not a flaw specific to any one tool; it's a property of measuring anything on shared, general-purpose hardware.

It's also the concrete reason this series treats every number as provisional until it's been checked more than once, under conditions that are actually comparable to each other. A number worth building a decision on is a number that's been re-checked, not a number that looked good the one time it was run.

What this doesn't settle

• Response header work is still in progress, being rolled out deliberately in stages rather than switched on all at once — worth its own update once it's finished, not a status line buried here.
• The manual accessibility pass, and a real device pass on iOS and Android, remain owed — automated tooling, of any kind, catches a meaningful minority of real accessibility problems. Treat every automated score in this series as a floor, not a certificate.
• This covers what our own tooling can see from the outside, as a visitor or a crawler would. It isn't a penetration test, and doesn't claim to be one.