mostlybetter

Expert website audit report

Café Ríosol — Lavapiés, Madrid

📄 Reference: MB-2026-0142 📅 Date: 01/08/2026 🌐 Site audited: cafe-riosol.example 👤 Auditor: Lucía Ferrán ⚠ 100 % fictional · sample data
0/100

Overall health: needs attention

The site works, but it is quietly losing customers in five specific, fixable places. No rebuild is needed: three focused sprints should bring it to an estimated target of 80–90/100, always confirmed by re-measuring after each sprint.

Performance58
SEO61
Trust54
Accessibility63
Security71

How this score is calculated

Weighted average of five categories. Weights prioritise what moves the most customers: performance and trust outweigh security for a local business. Formula: 45·0.25 + 61·0.20 + 54·0.25 + 63·0.15 + 71·0.15 = 57.

Performance · weight 25 %
SEO · weight 20 %
Trust · weight 25 %
Accessibility · weight 15 %
Security · weight 15 %

Weights are always published; they change little between reports and are never tuned to make the number look nicer.

☰ Contents

  1. Executive summary
  2. Detailed findings (18)
  3. Impact × effort matrix
  4. Raw evidence
  5. Action plan

01 Executive summary

Café Ríosol's site works, but it loses customers in five specific spots. The worst: the reservation form has been down for at least 18 days and nobody noticed because no alerts are configured. On top of that, the page weighs 4.1 MB (mostly uncompressed photos), which pushes away mobile users from the neighbourhood — exactly a local café's audience.

Findings overview — 18 total: 5 critical · 9 warnings · 4 improvements
IDFindingSeverityImpactEffort
H-04Reservation form returns HTTP 500Critical●●●2–3 h
H-014.1 MB homepage: uncompressed photos (LCP 7.2 s on 4G)Critical●●●4–6 h
H-07Google opening hours stale since ChristmasWarning●●○0.5 h
H-027 broken links (2 in the main menu)Warning●●○1 h
H-09SSL certificate expires in 23 days, no auto-renewalWarning●●○0.5 h
H-05No cookie notice (GDPR)Warning●●○2 h
H-03No alt text on 34 of 41 imagesWarning●●○1.5 h
H-06Menu only in-house; no downloadable version on the siteWarning●●○1 h
H-08Insufficient button contrast (3.1:1)Warning●○○0.5 h
H-10Duplicate h1 on homepageImprovement●○○0.25 h
… plus 8 more minor findings (see raw evidence)

Verdict: No rebuild needed. Three sprints (≈ 32 h) should bring it to an estimated target of 80–90/100. That is an estimate, not a promise: every sprint ends with re-measurement and the real number is published then.

02 Detailed findings

Three findings shown in full (the five pieces + illustrated evidence); the rest summarised.

H-04 Critical

Reservation form returns HTTP 500

What happened

Booking a table from the site returns an internal server error and the reservation never arrives. The cause is the hosting's SMTP credentials, which expired on July 14. Since then, every online booking has failed silently.

Why it matters

According to analytics, the form gets ≈ 220 visits/month with clear booking intent. At an estimated 40 % conversion, that is ≈ 88 bookings/month never arriving. At €14 average ticket × 2.3 people, the impact is around €2,800/month in lost revenue (an estimate, not an exact figure). On top of that, customers assume you ignored them.

Evidence 
POST /reservar  →  HTTP 500  (3/3 intentos, 1 ago 2026, 11:20 CET)
Log servidor:    "SMTP connect() failed. #535 Authentication failure" × 214
                 (14 jul 18:55 → 1 ago 11:20)
Última reserva entregada con éxito: 14 jul 2026, 18:42
Recommended action
  1. Renew the hosting's SMTP credentials or connect a mail service (e.g. Resend/Brevo — the free tier is enough).
  2. Send a test email and confirm delivery to the business's real inbox (not spam).
  3. Show a visible confirmation to the user (“Booking received ✓, we confirm by email within 2 h”).

Effort: 2–3 h Priority: today

“Done” means…

A test booking sent from the site lands in Café Ríosol's inbox within 2 minutes, and the visitor sees a clear on-screen confirmation. Verified from a phone on mobile data (not wifi).

H-01 Critical

4.1 MB homepage: uncompressed photos (LCP 7.2 s on 4G)

What happened

The 12 gallery photos are camera originals (3–4 MB each) uploaded uncompressed. On a phone over normal 4G, the customer waits 7.2 seconds to see the first image of the place. Google estimates that 53 % leave if it takes more than 3 s.

Why it matters

71 % of visits arrive on mobile (from their own analytics), most from “café near me” searches in the area. Every extra second sends people back to Google and into the café next door. Google also penalises speed in local ranking.

Evidence 
LCP (moto g4, 4G simulado):  7,2 s   — objetivo < 2,5 s
Peso total de la página:     4,1 MB  — 92 % son imágenes
Mayor imagen: /img/galeria/IMG_4821.JPG  →  3,8 MB (original de cámara)
Compresión WebP estimada:    4,1 MB → 0,4 MB (−90 %) sin pérdida visible
Herramienta: Lighthouse 12.1 + WebPageTest (Madrid, 3G/4G perfil)
Recommended action
  1. Convert the gallery to WebP/AVIF at quality 80 (indistinguishable by eye).
  2. Lazy-load images below the fold.
  3. Compress and resize the remaining images to their real on-screen size.

Effort: 4–6 h Priority: sprint 1

“Done” means…

LCP under 2.5 s in the same test (moto g4 / 4G), page under 1 MB, and the gallery still looks just as good on a desktop screen.

H-07 Warning

Google opening hours stale since Christmas

What happened

The Google Business listing shows the old opening hours. A customer who arrives at 8:30 and finds you open is pleased; the problem is the ones who never come because Google says “opens at 9”.

Why it matters

64 % of visits come from Google Maps and local search. Wrong hours directly hit the breakfast rush — a café's most profitable window.

Evidence 
Ficha Google Business (1 ago 2026):  "Abre a las 9:00"  L–V
Web cafe-riosol.example/contacto:    "Abrimos a las 8:00"
Diferencia detectada también en:     Apple Maps (horario 2024)
Recommended action
  1. Update the hours on Google Business and Apple Maps (30 minutes).
  2. Write down who updates the hours whenever they change (Christmas, summer).

Effort: 0.5 h Priority: this week

“Done” means…

Google, Apple Maps and the site all show the same hours, verified from a phone with no account logged in.

Remaining findings (condensed)

  • H-02Warning 7 broken links — 2 in the main menu (“Menu” and “Events” point to pages deleted in 2025). Every dead click is a small trust loss. 1 h
  • H-03Warning 34 of 41 images lack alt text — invisible to screen readers and wasted for local SEO (“specialty coffee lavapiés”). 1.5 h
  • H-05Warning No cookie notice — the site loads Google Analytics before consent (GDPR risk). 2 h
  • H-06Warning The menu only exists as a scanned PDF and in-house — a customer deciding from home can't see it. 1 h
  • H-08Warning Button contrast 3.1:1 (recommended minimum 4.5:1) — hard to read in terrace sunlight. 0.5 h
  • H-09Warning SSL certificate expires in 23 days with no auto-renewal — on day 24 the site would show “Not secure”. 0.5 h
  • H-10Improvement Duplicate h1 on the homepage — confuses Google about the page's main topic. 0.25 h

03 Impact × effort matrix

Recommended work order: the “hurts & cheap” quadrant first. Impacts and efforts are audit estimates; the real quote is closed in writing before each sprint.

IDFindingImpactEffortQuadrant
H-04Reservation form returns HTTP 500High — ≈€2,800/mo2–3 h🔥 Hurts & cheap
H-07Google opening hours stale since ChristmasMedium — breakfast rush hour0.5 h🔥 Hurts & cheap
H-027 broken links (2 in the main menu)Medium — trust1 h🔥 Hurts & cheap
H-09SSL certificate expires in 23 days, no auto-renewalMedium — “Not secure” imminent0.5 h🔥 Hurts & cheap
H-014.1 MB homepage: uncompressed photos (LCP 7.2 s on 4G)High — 71 % of traffic is mobile4–6 h⚡ Plan now
H-05No cookie notice (GDPR)Medium — legal risk2 h⚡ Plan now
H-03No alt text on 34 of 41 imagesMedium — SEO + accessibility1.5 h⚡ Plan now
H-06Menu only in-house; no downloadable version on the siteMedium — purchase decision1 h⚡ Plan now
H-08Insufficient button contrast (3.1:1)Low0.5 h🌱 Sprint filler
H-10Duplicate h1 on homepageLow0.25 h🌱 Sprint filler

04 Raw evidence

This is what the tools measured, without our interpretation. We always include this section so any trusted technician can verify everything.

mb-scan · cafe-riosol.example · 2026-08-01T09:14:32Z · v0.9.2

lighthouse.performance
58 · LCP 7.2 s · CLS 0.19 · INP 312 ms · TBT 890 ms
lighthouse.seo
61 · 1× h1 duplicado · 34 img sin alt · meta description OK
lighthouse.a11y
63 · contraste 3.1:1 en .btn-reserva · 2 enlaces sin texto
page_weight
4.1 MB · 92 % imágenes · 142 peticiones
links
118 internas · 7 → HTTP 404 (lista: /carta-2024, /eventos, …)
https
TLS 1.3 ✓ · HSTS ✗ · caducidad 2026-08-24 (23 días)
sitemap_robots
sitemap.xml ✓ (desactualizado: falta /carta) · robots.txt ✓
form_check
POST /reservar → 500 × 3/3 · SMTP auth failure en log
images
41 totales · 0 en WebP/AVIF · mayor: 3.8 MB
mobile_viewport
✓ presente · texto <12 px en pie de página
gdpr
analytics.js cargado antes de consentimiento ✗

The full bundle (screenshots, HAR, logs) ships as evidencias-MB-2026-0142.zip alongside the report.

05 Action plan

Three suggested sprints. Every task ships with its “done means…” — nothing left to interpretation. The improvement numbers are estimated targets, verified by re-measuring when each sprint closes.

Sprint 1 · this week

Stop the booking leak — 4.5–6 h · ≈ €420

H-04 reservation form · H-07 Google hours · H-02 broken links · H-09 SSL auto-renewal. “Done”: test booking lands in the real inbox; identical hours on Google/Maps/site; zero 404s from the site; certificate auto-renewal verified. Estimated target after re-measuring: online bookings operational and trust +10–15 points.

Sprint 2 · weeks 2–3

Speed & legality — 7.5–9.5 h · ≈ €690

H-01 WebP images + lazy loading · H-05 cookie notice with consent before Analytics · H-03 alt text on 34 images. “Done”: LCP < 2.5 s in the same 4G test; Analytics loads only after acceptance; screen reader announces every image. Estimated target after re-measuring: LCP < 2.5 s (confirmed with the same tool and profile).

Sprint 3 · week 4

Trust & polish — 3–4 h · ≈ €280

H-06 downloadable online menu · H-08 button contrast · H-10 single h1 · footer text 12 px+. “Done”: menu visible on mobile without registering; contrast ≥ 4.5:1 verified with a tool; a single h1. Estimated target after re-measuring: overall health 80–90/100 (the real number gets published, not the estimate).

Suggested total: ≈ 32 h · ≈ €1,390 · estimated Sprint 1 impact: recovery of up to €2,800/month in bookings (estimate based on their analytics, to confirm after the fix).

Prices and targets in this report are fictional sample estimates; real quotes are always closed in writing before work starts.

Request a real audit → See the methodology

MB-2026-0142 · generated by Mostly Better · All data in this document is fictional and used solely to demonstrate the report format.