About this audit
nettikasinopro.com scored 5.6/10
Well-engineered, genuinely trustworthy — and undermined by two defects. Three "different" pages ship an identical 36-casino list, and analytics cookies fire before any consent on a Finnish-language site.
This is a full example audit — 14 evidence-led findings across accessibility, performance, SEO, structured data, privacy and security, each with a measurement, a screenshot and a concrete fix. The headline issue: Three "different" pages ship the identical 36-casino list in the identical order.
What we found
criticalThree "different" pages ship the identical 36-casino list in the identical order
The homepage, /paras-nettikasino/ and /turvalliset-nettikasinot/ render the same 36 operators in the same rank order — Pelipeto #1, hurmio #2, OneRush #3, Oh Casino #4, Tikkari #5 … spinlander #36. Comparing the three rendered card sequences gives an exact string match. Only the <h1> and a three-line intro differ; ever
critical_ga cookies are written on first paint with no consent banner anywhere
Loading the homepage in a clean browser and reading document.cookie immediately returns _ga_QSKKDY20GW and _ga — Google Analytics 4 identifiers, set before any interaction. No cookie banner and no consent-management platform were detected on any of the six pages; there is nothing to accept or reject. Google Tag Manager
mobileAll 36 rank numbers are display:none below 768 px — the ranking disappears on mobile
One CSS rule removes the entire ranking from mobile and tablet: Every card still carries aria-label="Pelipeto casino — Rank 1", and the desktop layout shows a numbered circle beside each logo — but at 375 px, 36 of 36 .casino-card__rank elements compute to display: none. A sighted mobile visitor scrolls 30,640 px past
mobile30,640 px of page: the first editorial word lands at 16,665 px and the author's credentials at 28,398 px
Measured live at 375 × 812 on the homepage: the first casino card starts at a healthy 362 px — the collapsed Lue lisää intro does its job and gets a visitor to value fast. Then 36 cards run to 16,207 px, and everything that makes the case for trusting you sits *after* them. The table of contents — the element whose ent
desktop1000 px text column at 16 px runs 100–126 characters per line across 37 paragraphs
On a 1440 px viewport the content column measures 1000 px wide and body copy is set at 16 px / 25.6 px. Counting rendered lines against character totals, the editorial paragraphs run 100–126 characters per line — roughly double the 45–75 range at which the eye reliably finds the start of the next line. This affects 37
warningOne axe rule fails site-wide: color-contrast at 2.54:1 on the ranking badges, 90 elements across six pages
axe-core reports exactly one violation type on the whole site — color-contrast, impact serious, WCAG 2.1 AA criterion 1.4.3. That is a good result: no missing labels, no unlabelled controls, no image without alt, no invalid ARIA. It is worth saying that the rest of the accessibility surface is clean. The failure itself
warningThe Article schema on all six pages carries three properties — your authorship is invisible to machines
You have done the hard part of E-E-A-T. There is a named regulatory analyst with a 111-word bio page at /vilma-koskinen/, a personal LinkedIn profile, an editorial-principles page, an advertiser-disclosure page, and an on-page author box with credentials and profile links. Very few sites in this category have that. Non
warning36 of 56 <h2> elements on the homepage are bonus amounts like 100% jopa 500€
Every casino card marks its bonus value as <h2 class="casino-card__bonus">. On the homepage that produces 36 heading-level elements reading +50 ilmaiskierrosta, Jopa 15 % päivä-cashback, 100% jopa 500€ — and because the cards come first in the document, all 36 land before the first real heading. The pattern repeats on
warningThe affiliate disclosure is well written — and sits at 98% of page depth, below 72 monetised links
You do disclose, and the wording is better than most: *"Saatamme saada provisiota listatuilta operaattoreilta ilman lisäkustannuksia käyttäjille, mutta tämä ei vaikuta arviointimenetelmään tai sijoitustuloksiin."* There is also a dedicated Mainostajan ilmoitus page linked in the footer. This is a placement finding, not
diyTable of Contents is still in English on 5 of 6 Finnish pages
The SimpleTOC block renders <h2 class="simpletoc-accordion-heading">Table of Contents</h2> on /paras-nettikasino/, /nettikasino-ilman-rekisteroitymista/, /uudet-nettikasinot/, /parhaat-nettikasino-bonukset/ and /turvalliset-nettikasinot/. The homepage has the correct Sisällysluettelo — which means someone already fixed
diybonusket — a footer nav typo on 6 of 6 pages, plus a nav label that disagrees with its own page
The footer link list reads Parhaat nettikasino bonusket. The destination page's own H1 is Parhaat nettikasino bonukset elokuussa 2026 — the footer transposes the last two letters. It appears on all six audited pages, so it is in the shared footer menu and one edit fixes every instance. The primary navigation has a rela
warningPerformance is strong — the one real opportunity is a 106,466-byte logo rendered at 220 × 44
Lighthouse mobile returns 95 (homepage), 97 (/paras-nettikasino/) and 100 (/parhaat-nettikasino-bonukset/), with CLS 0.011 and TBT of 17 / 14 / 33 ms. For a WordPress build carrying 36 lazy-loaded logos, Google Tag Manager, Plausible and Cloudflare telemetry, that is a genuinely good result and not a freebie — the lazy
warningNo security response headers on any of the six pages
HTTPS is correct and there is no mixed content anywhere — the padlock is clean. But a passive header check across all six pages returns nothing for CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy. For a site whose product is telling people which gambling operators are safe, th
warningNo DMARC record, and SPF authorises Porkbun while your mail is delivered by Google
The domain receives mail — MX points at smtp.google.com (Google Workspace), and the footer publishes info@nettikasinopro.com as the contact address. So email deliverability is a live concern, not a theoretical one. Two problems. There is no DMARC record at all on _dmarc.nettikasinopro.com, which means no policy telling