CNN — site-wide review — sample audit, scored 5.8/10

← gallery
5.8/10
Open ↗

About this audit

cnn.com scored 5.8/10

Sound newsroom product · A broken error template and a 9,662 ms mobile homepage drag an otherwise competent build below the line

This is a full example audit — 10 evidence-led findings across accessibility, performance, SEO, structured data, privacy and security, each with a measurement, a screenshot and a concrete fix. The headline issue: The 404 template runs a separate legacy stack — 34 console errors, 10 CORS-blocked brand fonts, one TLS cert failure.

What we found

  1. criticalThe 404 template runs a separate legacy stack — 34 console errors, 10 CORS-blocked brand fonts, one TLS cert failure

    Any mistyped or expired CNN URL lands on a template that is visibly not part of the current site. Loading edition.cnn.com/faq live produced 34 console errors. Among them: 10 brand-font files at https://www.i.cdn.cnn.com/.a/fonts/cnn/3.9.0/cnnsans-*.woff2 blocked by CORS (No 'Access-Control-Allow-Origin' header is prese

  2. criticalThe 404 page's own recovery links 404 — 5 dead /specials/ URLs in its footer

    The error template's legacy footer carries 234 links, offering a topic menu as the recovery path. Checked live, 5 of them return a hard 404 with no redirect: /specials/health/fitness-excercise (CNN's own spelling), /specials/health/vital-signs, /specials/health/wellness, /specials/politics/elections-101 and /specials/t

  3. criticalNewsletter frequency labels fail WCAG AA at 2.14:1 — on all 21 cards

    Every card on the newsletter hub labels its cadence — Daily, Weekly, 3X Weekly, Daily Monday - Friday — in #b1b1b1 on #ffffff at 10px bold. axe measures 2.14:1 against a required 4.5:1 (color-contrast, WCAG 2.1 AA, 1.4.3, serious), failing on 21 elements. This is not decorative text. Frequency is the one attribute that

  4. criticalMobile homepage: LCP 9,662 ms, TBT 5,288 ms, 32,454 KiB — ~19 MB of it autoplay video at ?c=original

    Lighthouse (mobile, lab) scores the homepage 16. LCP 9,662 ms, TBT 5,288 ms, Speed Index 25,300 ms, TTI 84,431 ms, CLS 0.197. Server response is 68 ms — the origin is fast; everything after it is not. Total payload is 32,454 KiB, and the five largest assets are all .mp4 loops requested at full source resolution: final-

  5. warningNewsletter hub ships every card image at 1600×900 into a 249×140 slot — 1,298 KiB avoidable

    All 21 newsletter card images load at their full source size and are displayed at 249×140 — a 6.4× linear over-fetch. None carry srcset; none carry loading="lazy", so all 21 fetch on load. The worst single asset is logo_wondertheory.png at 587,336 bytes (verified live, byte-for-byte matching Lighthouse) for that same 2

  6. warningHomepage card links and one video embed lose their accessible name intermittently — 4 CNN-owned instances at scan time

    At collection time axe recorded two serious violations on the homepage. link-name (WCAG 2.0 A, 2.4.4 + 4.1.2) failed on 8 elements, and frame-title (WCAG 2.0 A, 4.1.2) on 1 — a 375×211 allowfullscreen iframe with no title, aria-label or role="presentation". The split matters for triage: 4 of the 8 nameless links sit in

  7. warningHomepage has no <h1> — 20 <h2>s and nothing above them

    The homepage renders 0 <h1> elements against 20 <h2>s (confirmed live in the DOM, not just in the snapshot). The document outline opens at level 2 with whichever story leads at that moment — today Drafts of potential US-Iran agreement 'being circulated,' Qatar says. The no-JavaScript crawler view agrees: h1ContentInRaw

  8. warningcanonical and hreflang contradict each other on the international edition

    Requesting cnn.com from outside the US redirects to edition.cnn.com, which then declares <link rel="canonical" href="https://www.cnn.com/"> — pointing away from itself. Its own hreflang set simultaneously declares edition.cnn.com as both en-gb and x-default. So the same page is announced as the canonical target for int

  9. warningEvery audited page shares one cnn-placeholder-image.jpeg share card and has no og:description

    The homepage, the newsletter hub and the log-in page all set og:image to the identical https://media.cnn.com/api/v1/images/cnn/cnn-placeholder-image.jpeg, and all three have og:description absent (verified live on the homepage). twitter:description is populated on all three — so the description copy exists and simply i

  10. warningNo HSTS on any page, including /account/log-in

    Strict-Transport-Security is absent on all four audited pages — confirmed live by reading response headers, including on the credential-entry page. Without it, a first visit typed as cnn.com is a plaintext request before the redirect to HTTPS. The rest of the header posture is deliberate and worth crediting rather than

Audit your own site →← more sample audits