RoastMySite
.co.za
RoastMySite
.co.za
Dark mode. Yellow accents. A typewriter effect that actually works. A mascot in a flaming bucket hat and SA-flag tracksuit. The copy reads like your braai buddy who's had one too many brandies and decided to tell you the truth about your website. Then you notice the logo has empty alt text, the H1 is a JavaScript animation that search engines might not even see, and the whole thing is a single 138KB HTML file held together by raw CSS and the sheer force of South African personality. This site sells SEO audits. It roasted itself to a 7/10 on the sample report page. The confidence is admirable. The irony is a whole extra service offering.
The brand voice is genuinely excellent — 'Before your customers ghost you, let us Roast you' is the kind of line most agencies would kill for. The pricing cards comparing R89 to 'less than a quarter chicken at Nando's' are specific, funny, and instantly relatable to every South African who has stared at a menu. The typewriter hero animation is smooth, the yellow particle dust background is atmospheric without being distracting, and the mascot character (Springboy in a flaming bucket hat) has real personality. The FAQ is genuinely funny — 'Can I roast a client's site? Only if you have permission. Don't be that oke sending enemies into the braai.' The JSON-LD structured data is solid. The sample report showing their own 7/10 is genuinely bold marketing.
Dark mode with yellow accents, self-hosted Space Grotesk + JetBrains Mono, floating yellow particle dust, a character mascot with genuine personality. Atmospheric and cohesive — held together by raw CSS force and sheer commitment to the bit.
Clear navigation with a well-explained 3-step process, well-designed pricing cards with real SA price comparisons. But no breadcrumbs, no contact form, inconsistent subpage nav, and a JS-dependent blog that degrades fast.
Testimonials with real names, helpful FAQ with actual personality, solid structured data. But no visible cookie consent banner on first load, no payment badge graphics, no real-time order status tracking.
Excellent page titles and meta descriptions, well-structured JSON-LD, good sitemap and robots.txt. But the blog is API-driven with fragile allow rules, blog posts missing from the main sitemap, H1 depends on JS execution, and About page meta is short.
Fully responsive with vertical-stack pricing, touch-friendly 22px-padded CTAs, proper viewport meta. Snappy 28ms response time. Just text-heavy with limited visual breaks on small screens.
15 things your visitors noticed before you did.
Your site sells SEO audits, but your H1 is a JavaScript typewriter animation that search engine crawlers might never see. That's like a mechanic with a Ferrari that won't start because he left the lights on. You literally wrote a sample report finding about this problem (#9) and then... left it. The audacity is honestly impressive.
The logo has alt="" — screen readers get silence where your brand lives. For a service that promises to 'find the leaks,' you've got a leak the size of the hole in Eskom's balance sheet. Your own sample report flagged this (#1). It's still there. Eish.
The mascot stamp image uses alt='Brutally honest, surprisingly helpful — the original roast service' — that's a 16-word marketing tagline, not image description. Screen readers will announce this at every visitor like the SABC licence man who won't leave your gate.
No HSTS header. No CSP header. No X-Content-Type-Options. Your security posture is like leaving your front door wide open while telling the neighbourhood you're a security company. The ZAP scan found 15 Medium alerts including Missing Anti-clickjacking Header and Strict-Transport-Security Header Not Set.
Nginx 1.14.1 — a version from 2018. That's older than most of the TikTok trends your target market watches. Running a server version this old is like driving a 1998 Corolla to pitch for a fleet management contract.
🔍 SEO: The blog posts don't appear in the main sitemap.xml. There's a separate API sitemap, but the main sitemap only lists 8 pages. Every blog post you write is invisible to Google unless it knows about the secret second sitemap. That's like having two menus at a restaurant.
🔍 SEO: Your blog is powered by a JS-dependent API endpoint. The robots.txt allows it by exception, but it's a fragile setup. Your content engine runs on 'vibes and a prayer' energy — one JS update away from breaking.
🧭 UX: The navigation is inconsistent across subpages. The homepage nav includes 'Blog' but the About, Services, and Contact page navs don't. Visitors landing on your About page can't navigate to your blog. Your site has the navigation consistency of a taxi rank after a drivers' meeting.
🧭 UX: No breadcrumbs anywhere on the site. If a visitor lands on the Fix My Site page from Google, there's zero sense of where they are. It's like arriving at a mall and finding the map has been replaced by a mirror.
📝 Copy: The Contact page has only an email link and WhatsApp number. No contact form. For a business that sells website audits, asking potential customers to manually compose an email is like a plumber who says 'just describe the leak in a letter.' Your own sample report flagged this (#6). Still not fixed.
🛡️ Security: Cross-Domain JavaScript Source File Inclusion detected. You're loading Google Fonts and Google Analytics from external sources with no SRI integrity attributes. A compromised CDN could inject code into every page visit. It's the web equivalent of installing a R5 lock on a R50,000 door.
🛡️ Security: The server leaks its version in the 'Server: nginx/1.14.1' HTTP header. Every bot and script kiddie that visits knows exactly what you're running. It's like wearing your CV as a t-shirt to a job interview.
🛡️ Security: Information Disclosure via Suspicious Comments found in the HTML source. Internal developer comments potentially leak tech-stack details. For a site that sells security checks, leaving internal notes visible in the page source is like a password manager with 'passwords' on a sticky note on the monitor.
🛡️ Security: Content Security Policy (CSP) Header Not Set. Without a CSP, any script can run on your page. For a service that offers a 'Visible security confidence check' as a selling point, having no CSP is the equivalent of a bodyguard who forgot his gun at home.
The whole site is a single-page HTML monolith. 138KB. One file. No CMS, no build tool, no component system. It's impressive that it works so well, but scaling this will be like trying to braai for 50 people on a R79 Weber you bought at Game. It'll hold until it doesn't.
The single biggest problem is the gap between product promise and product delivery. This site sells advanced audits that find '47 average issues' and promises security checks — yet its own H1 is JS-dependent, it has no CSP, it's running nginx 1.14.1, and its own blog is absent from its own main sitemap. Every customer who buys an Advanced Scan and gets told to fix alt text, add security headers, and improve their blog SEO is going to land back on this site and see the same issues. The disconnect between what you sell and what you ship is the real revenue leak. You're the cobbler's children, and your shoes have holes.
15 Medium-severity alerts from the OWASP ZAP passive scan reads like a checklist of everything that should be configured but isn't. No HSTS, no CSP, no X-Frame-Options, no X-Content-Type-Options, running nginx 1.14.1 from 2018. For a site that literally sells 'security confidence checks' as a premium feature, this is the equivalent of a personal trainer who can't touch their toes.
Sorted by effort — start at the top, thank us later.
Add a proper H1 that renders server-side before the JavaScript typewriter kicks in
SEO crawlers may not execute JS. Your primary header is invisible to Googlebot. For a site selling SEO audits, this is a self-inflicted wound.
Add Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options, and a Content Security Policy header to your nginx config
ZAP flagged all of these as Medium severity. No HSTS, no CSP, no anti-clickjacking. Selling security checks with none of these is like SARS auditing you while you're filing your own return late.
Update nginx from 1.14.1 to the latest stable version
Version 1.14.1 was released in 2018. Multiple CVEs since then. Running this on a production site in 2026 is like driving without airbags because 'they weren't standard in '98.'
Include blog posts in the main sitemap.xml and remove the separate API sitemap dependency
Your main sitemap has only 8 pages. Every blog post you publish is invisible unless Google knows about the hidden second sitemap. Your content engine has no fuel line.
Add 'Blog' to the navigation on every subpage — About, Contact, Sample Report, Services pages all need it
Inconsistent navigation confuses users and wastes link equity. Your own sample report flagged this. Visitors on About can't reach Blog.
Add a contact form to the Contact page instead of just an email link
Email links don't convert. A form turns interest into trackable leads. Your own sample report said this was a gap. Every day without one is potential revenue floating away like data at month-end.
Add SRI integrity attributes to all external scripts (Google Analytics, Google Fonts)
Cross-domain JS inclusion without subresource integrity means a compromised CDN could inject malicious code. ZAP flagged it as Medium.
Hide the nginx version from the Server header (set server_tokens off;)
Every bot knows you're on nginx 1.14.1. Information disclosure is the first step in targeted attacks. Stop wearing your CV to the fight.
Set proper Cache-Control headers on static HTML pages instead of no-cache
Your own ZAP scan found cache-control directives leaving performance on the table. Static pages with no-cache waste bandwidth.
Remove internal developer comments from HTML source that leak tech-stack info
ZAP flagged suspicious comments potentially exposing internal details. For a site selling security confidence checks, burying breadcrumbs in your source is counterproductive.
Extend the About page meta description beyond 135 characters to the 150-160 sweet spot
Your own sample report flagged this. Letting Google truncate your meta is like letting someone else write your brand's dating profile bio.
Fix the stamp image alt text — 'Brutally honest, surprisingly helpful...' is a tagline, not image description
Screen readers will read that 16-word sentence at every visitor. Alt text describes what the image IS, not your marketing copy.
Add breadcrumbs to subpages (About, Contact, Services, Sample Report)
No breadcrumbs means no orientation for users landing on inner pages from search. It's a basic UX staple that costs nothing to implement.
Break the monolithic 138KB HTML file into smaller components, or adopt a static site generator
One 138KB file is impressive for a solo project but terrifying for a professional service business. When something breaks, everything breaks. Scale this properly before it scales itself into a crash.
Display payment method badge graphics near the checkout CTA instead of plain text
Your own sample report flagged this. Plain text 'Secured by Paystack' has the reassurance value of a bouncer saying 'trust me, he's friendly' without a dog in sight.
Do these in order. Seriously — in order.
Add proper security headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options) to nginx — non-negotiable for a site selling security checks
Hide nginx server version and upgrade from 1.14.1 to latest stable
Add a static server-side rendered H1 before the JS typewriter animation fires
Include blog posts in the main sitemap.xml and remove the API sitemap workaround
Add consistent navigation across all subpages — Blog needs to be everywhere
Add SRI integrity attributes to all external script loads (Google Analytics, Google Fonts)
Fix Cache-Control headers for static pages to allow caching
Add a proper contact form instead of just an email link
Remove internal comments from HTML source that leak tech-stack details
Fix stamp image alt text to describe the image, not recite your marketing slogan
“RoastMySite.co.za is the bravest website in South Africa — it roasted itself to a 7/10 and published the results for the world to see. That takes guts. But here's the thing: you found 15 issues in your own site, called yourself out publicly, and then... fixed some of them. The logo still has empty alt text. The H1 still depends on JavaScript. The nav is still inconsistent. The contact form is still missing. The main sitemap still has zero blog posts. You're the cobbler's children, and your shoes aren't just full of holes — you wrote a report about the holes, published it, and then left some of them unfixed. Your site has the energy of a taxi driver who tells passengers 'I know this route has potholes, I'm the one who reported them to the municipality!' — great that you noticed, now fix the suspension. Eish.”
Too accurate not to share? Screenshot it and tag @RoastMySite — the bravest roastees get a shout-out.
The Expert Scan (R249) adds conversion analysis, a 30-day roadmap, a passive security confidence check and our strategic “If we owned this website” breakdown — the difference between knowing and having a plan.
Upgrade to Expert →Everything above is the actual deliverable — hosted report, PDF attached, straight to your inbox in minutes. Mini roast is free. The full truth starts at R89.
🔥 Roast my site — from R89