Everything our own SEO still gets wrong
Six specific failures on the site selling an SEO playbook, each with what it costs and how it would be fixed. Published because a claim of completeness is not checkable and a list of gaps is.
By Nabeel Sharafat · 2026-07-27 · 4 min read · 729 words
Why this post exists
A document claiming to be a complete implementation inventory has an obvious problem: you cannot verify completeness from the inside.
So here is the list of what this site gets wrong. It is generated by the same self-audit that produces the public proof page, which means it cannot quietly stop being accurate when it becomes inconvenient.
Gap 1: the CSP allows inline script
script-src includes 'unsafe-inline'. Everything else in the policy is locked down: no external script origins, object-src 'none', base-uri 'self', a constrained form-action, frame-ancestors 'none'.
What it costs. If an XSS hole exists, the CSP will not stop it executing. It will still stop remote script loading, base-tag hijacking, plugin execution and form exfiltration.
Why it is not fixed. A strict script-src needs a per-request nonce. A nonce needs request headers read in the root layout, which makes every route dynamic. That contradicts the static-first requirement, which exists so a database outage cannot take down the sales funnel.
The fix. Either move to nonces and accept dynamic rendering on marketing routes, or split the deployment so authenticated routes use nonces and static routes do not. The Code Kit supports both modes. This site runs the second-best one and says so.
Gap 2: no image CDN
Images are optimised at build time rather than served through a transforming CDN, so a device that would be better served by an intermediate size gets the next size up.
What it costs. Under 40ms on the landing page. Small, and still a gap.
The fix. Point the image loader at a transforming CDN. A config change plus a cost line.
Gap 3: search does not cover paid chapters for free users
Full-text search covers only chapters the user can access.
What it costs. A signed-out visitor searching for a term that appears only in a paid chapter gets nothing, rather than a locked result naming the chapter it appears in. The second would convert better.
The fix. Two indexes: one with titles and headings only, shown as locked results, and one with bodies restricted to accessible content. On the roadmap, not built.
Gap 4: the citation check covers three engines
The monthly seed query check runs against three answer engines. There are more.
What it costs. The trend line is directionally right and incomplete.
The fix. Add the remaining engines as a separate series with its own start date. Merging them into the existing series would break comparability, which is worse than the gap.
Gap 5: no automated rich results validation in CI
Structured data is validated by unit tests for shape and by manual runs of the Rich Results Test for eligibility. The second is not automated.
What it costs. A change producing valid JSON-LD that is nonetheless ineligible for a rich result would not be caught until someone checked by hand.
The fix. There is no public API for the Rich Results Test. The practical substitute is a schema validation library in CI plus a scheduled manual check, which is what the checklist prescribes.
Gap 6: uneven internal link depth across tiers
Sibling linking distributes links evenly within a tier, but tiers are not equally linked from the rest of the site. The glossary is linked from every chapter that uses a term; the schema type pages are linked mostly from one hub.
What it costs. Uneven crawl frequency across tiers that should be equivalent.
The fix. Automatic term detection in chapter content, linking the first occurrence of any glossary term or schema type name. The mechanism exists for the glossary and has not been extended.
The counterintuitive part
Publishing this raises conversion rather than lowering it.
A buyer evaluating a technical product already assumes there are gaps. Naming them removes the suspicion that you are hiding worse ones, and it is the only claim on the page they can independently verify in thirty seconds.
A proof page showing 100 percent on everything is what a marketing page says. One showing 94 percent and naming the six misses is what an audit says, and this product's entire claim is that it is an audit.
If you find a seventh, the address is on the about page, and it will be added here with attribution. The live version is at /proof and the chapter is free at /playbook/known-gaps.
Questions
Why publish your own SEO failures?
A document claiming to be a complete implementation inventory cannot be verified from the inside. A specific, checkable list of what is missing is the only useful evidence, and it is the one claim on the page a reader can verify independently.
Why does the site allow unsafe-inline in its CSP?
A strict script-src requires a per-request nonce, which requires reading request headers in the root layout, which makes every route dynamic. That contradicts the static-first requirement that keeps the sales funnel independent of the database. The tradeoff is documented rather than hidden.