Website Audit & Assessment
Website Audit & Technical Assessment

Light Action is fast — and almost invisible.

A technical, accessibility and conversion review of lightactioninc.com. The site loads quickly and every link works. The problems are elsewhere: the testing tools we ran were served an error page instead of the site, most AI crawlers are blocked from it, and the visitors who do arrive have almost no way to enquire.

Prepared for Light Action, Inc. Site www.lightactioninc.com Date 19 August 2026 By Klik Digital Agency
0Health score

Verdict: rebuild, don’t patch

The underlying platform is recent and the hosting is fast — both worth keeping. But the site is a 2018-era page-builder build with no search foundation, no conversion measurement, no general enquiry route, and a configuration that publishes its own administrator usernames.

Three of the findings below are severe enough to act on this week regardless of what happens with a redesign.

3
Critical
10
High
9
Medium
3
Low
01 — Executive summary

Six numbers that frame the conversation

Each of these was verified directly against the live site. Full evidence, business impact and recommended fixes are in the findings section.

403

Automated tools get an error page, not the website

Google’s PageSpeed and securityheaders.com both received HTTP 403 and a Cloudflare challenge. Any automated assessment of this site may be scoring the wrong page.

9

Crawlers blocked by name in robots.txt

GPTBot, ClaudeBot, Google-Extended and six others are disallowed by a Cloudflare default. Search crawling is still permitted — AI visibility is what suffers.

2

Admin usernames published openly

The WordPress API hands out the usernames admin and woz. The login page is open and XML-RPC is reachable.

0

Enquiry forms on the Contact page

General contact requires the visitor to write their own email. No form, no routing, no record, no lead attribution.

0

Conversion tracking of any kind

No GA4, no Tag Manager, no pixel, no goals. Beyond a raw visitor count in Cloudflare, nothing about behaviour or enquiries is measured.

75%

Of pages last edited in 2018

38 of 51 pages are unchanged in over seven years. The footer still reads ©2025 and the retired Twitter bird is still in the header.

The counter-intuitive part. Run this site through the usual tools and it looks healthy. Google PageSpeed Insights returns Performance 96, Accessibility 93 and Best Practices 96; securityheaders.com awards it an A. We are not quoting those numbers as results, because both tools were served a Cloudflare error page instead of the website — PageSpeed’s own SEO score of 45 flags the giveaway, “unsuccessful HTTP status code 403”. Measured directly in a real browser, the site genuinely is fast, but it is materially less secure than that A grade implies. If you or the client run these tools and see reassuring scores, this is why.
02 — Scorecard

Where the site stands, by discipline

Klik Digital’s own assessment across eight areas, scored from the evidence gathered in this audit. These are our judgements, not tool outputs. Performance is the outlier — and it is the one area needing least work.

Conversion & Lead Capture 20/100
No enquiry form, no conversion tracking, weak calls to action
SEO & Discoverability 25/100
AI crawlers blocked, no metadata, no business schema, no H1
Security Posture 35/100
Usernames exposed, login open, key headers missing
Design & Brand 35/100
Dated build, visible layout defect, off-brand elements
Accessibility 45/100
Zoom disabled, contrast failures, missing landmarks
Mobile Experience 48/100
Fixed bar covers content, hero letterboxed, overflow
Technical Health 55/100
Current core, but legacy theme and unused assets
Performance & Delivery 70/100
Genuinely fast; images and bundling unoptimised
03 — Findings

25 findings, ranked by priority

Click any finding to expand the evidence, the business impact and our recommended fix. Filter by priority to focus the conversation.

Showing all 25 findings
What we found
  • Google’s PageSpeed Insights (Lighthouse) received HTTP 403 and flagged “Page has unsuccessful HTTP status code 403” and “Page is blocked from indexing”.
  • securityheaders.com independently reported “Scan was blocked — We got a 403 when trying to scan”, with the response header cf-mitigated: challenge and HTTP/2 403.
  • Instead of the homepage, both tools received a Cloudflare “Performing security verification” interstitial.
  • The behaviour is intermittent and client-dependent: our own instrumented Chrome session reached the real page normally, and Google’s desktop PageSpeed run was attempted twice and never completed.
  • Important context: the site is currently indexed by Google — the homepage, Contact, Gallery and several service and rental pages all appear in search results. This is a crawl-reliability and measurement risk, not a confirmed deindexing.
Captured evidence — click to enlarge
Why it matters
Cloudflare’s bot protection is intermittently serving a 403 challenge page in place of the website. Two consequences follow. First, crawl reliability becomes a risk: intermittent 403s to search and AI crawlers cause crawl errors and delay re-indexing, and uptime monitors and SEO tools will fail unpredictably. Second, and immediately relevant here, third-party scan results for this site cannot be trusted — both tools we ran returned favourable-looking scores that describe Cloudflare’s challenge page rather than lightactioninc.com. Anyone assessing this website with an automated tool may be reading the wrong page without realising it.
Recommended fix
Review the Cloudflare bot-protection configuration — the first step is to check Google Search Console for actual crawl-error volume, which will show whether Googlebot is affected in practice. Then explicitly allow verified search-engine, AI-retrieval and monitoring crawlers, move from a blanket challenge to a managed rule set, and re-validate with Search Console’s URL Inspection tool.
What we found
  • robots.txt contains a Cloudflare-managed block list with Disallow: / for nine user-agents: GPTBot (OpenAI), ClaudeBot (Anthropic), Google-Extended (Gemini grounding and training), Applebot-Extended (Apple Intelligence), CCBot (Common Crawl), Bytespider, Amazonbot, meta-externalagent and CloudflareBrowserRenderingCrawler.
  • The full content signal is search=yes, ai-train=no, use=reference, with Allow: / for all other agents. To be precise: conventional search crawling is permitted and citation by reference is permitted; AI training is refused.
  • Not currently blocked: PerplexityBot, OAI-SearchBot and ChatGPT-User (the agents behind ChatGPT search and browsing), and bingbot. So the exposure is partial rather than total.
  • This block list was injected by Cloudflare’s “Managed Content” feature — it is a platform default, not an evidenced business decision.
Why it matters
AI assistants are becoming a real route to finding suppliers, and Light Action has been opted out of a large part of that channel by a platform default rather than a decision. Blocking Common Crawl, GPTBot, ClaudeBot and Google-Extended reduces the chance of the business appearing in AI-generated recommendations and summaries, and it removes it from the training and grounding data those systems draw on. Competitors who permit these crawlers accumulate that presence instead. The effect is a meaningful reduction in AI visibility rather than complete absence — several retrieval agents remain unblocked — but it is a self-inflicted disadvantage in a channel that is still growing.
Recommended fix
Make the AI-visibility policy a deliberate decision rather than a Cloudflare default. If discoverability is the goal, permit the retrieval and grounding agents (GPTBot, ClaudeBot, Google-Extended) while keeping ai-train=no if training is genuinely unwanted. Pair this with structured data so AI systems can parse services, service area and contact routes accurately — being crawlable achieves little if there is nothing machine-readable to read.
What we found
  • /wp-json/wp/v2/users returns HTTP 200 and publicly exposes two accounts: admin and woz (John Wozniak).
  • /wp-sitemap-users-1.xml and /author/admin/ both return 200, confirming the default admin username is in use.
  • /wp-login.php is publicly reachable (200) with no rename, IP restriction or 2FA layer detected.
  • /xmlrpc.php responds with 422 rather than being disabled or blocked, indicating the endpoint is reachable. XML-RPC is a well-known brute-force amplification vector and is unnecessary on most modern sites.
Why it matters
An attacker needs two things to break into WordPress: a valid username and a password. The site publishes the usernames. Combined with an open login page and enabled XML-RPC, this is a complete, ready-made target for automated credential-stuffing. A compromise of the site also puts the connected WooCommerce rental catalogue and PayPal payment page at risk.
Recommended fix
Immediate: rename or remove the admin account, disable REST user enumeration and the user sitemap, disable XML-RPC, and enforce two-factor authentication on all administrator accounts. Then add rate limiting on the login endpoint and a maintained security plugin with file-integrity monitoring.
What we found
  • The Contact page contains no enquiry form. The only <form> element on it is the theme’s search box.
  • The page is a staff phone directory: a table of names, job titles, extensions and direct email addresses (visible in the screenshot below).
  • Contact Form 7 is installed and loads its CSS and JavaScript on the Contact page — but no form is rendered there. The CF7 PayPal add-on is also installed, so a form most likely exists on the /pay-online/ page; we did not test that page, and it is a payment form rather than an enquiry route.
  • No form was found on the homepage either. The site-wide purple bar instructs visitors to “send an email” rather than offering one.
  • No map embed, no callback request, no general quote form and no newsletter capture on the pages tested.
Captured evidence — click to enlarge
Why it matters
A visitor who wants to make general contact has to open their own email client and compose a message from scratch. That is the highest-friction option available, it is unreliable on mobile, and it produces no record, no routing, no response-time tracking and no lead attribution. Enquiries that do arrive land in an inbox with no structured project detail, so the team spends time chasing basics. The rental catalogue’s Request for Quote flow is the exception — and it demonstrates that the mechanism is achievable.
Recommended fix
Build a proper enquiry system: a primary contact form, a project-specific “Request a Quote” form capturing event type, dates, venue and budget range, and a quote-request form wired into the rental catalogue. Route submissions to the right project manager, store them in the database, and add spam protection.
What we found
  • No Google Analytics or GA4 — gtag, ga and dataLayer are all absent from the page.
  • No Google Tag Manager container.
  • No Meta/Facebook pixel, no LinkedIn insight tag, and no conversion or event tracking of any kind.
  • The one exception: Cloudflare Insights is loading (static.cloudflareinsights.com), which provides basic page-view and visitor counts in the Cloudflare dashboard. It does not support goals, funnels, conversion events, traffic-source attribution or remarketing audiences.
  • Chrome UX Report returns “No Data” for this domain, indicating traffic below Google’s reporting threshold.
Why it matters
Beyond a raw visitor count in Cloudflare, nobody can see which services people look at, which pages lose them, or where enquiries come from. There is no usable baseline, which means no marketing spend can be justified or measured, no remarketing audience exists, and website decisions are being made on instinct. It also means the cost of every other problem in this report is currently invisible — and that the improvement from fixing them would be unprovable.
Recommended fix
Install GA4 via Google Tag Manager, define conversion events (form submission, quote request, phone tap, email click), connect Google Search Console for query and impression data, and set up a simple monthly dashboard. Do this before a redesign so the improvement is provable.
What we found
  • The homepage contains zero <h1> elements. Its first heading is an <h3>, then an <h2> — the hierarchy runs backwards.
  • axe-core flags both page-has-heading-one and heading-order.
  • The hero is a single large photograph of the company logo. There is no headline, no sub-headline and no call-to-action button above the fold.
  • The only positioning statement is a small italic line of text in the top utility bar, above the logo.
Captured evidence — click to enlarge
Why it matters
A first-time visitor cannot tell within five seconds what Light Action does, who it serves, or what to do next — the hero shows a logo, not an offer. For search engines, the page is missing its single strongest on-page relevance signal. The result is a homepage that neither ranks nor converts.
Recommended fix
Rebuild the hero around a clear H1 stating what the company does and for whom, a supporting sub-headline covering the service range and region, and two prominent calls to action (Request a Quote / Browse Rentals). Correct the heading hierarchy site-wide to a single H1 followed by ordered H2s.
What we found
  • No meta description on the homepage, on the main rental catalogue page, or on the rental category page we sampled.
  • No structured data on the homepage — zero JSON-LD blocks. No LocalBusiness, Organization or Service schema anywhere we looked. Rental category pages do carry one JSON-LD block, which is WooCommerce’s default product markup rather than anything configured.
  • Zero Open Graph and Twitter Card tags on the homepage, so links shared to Facebook, LinkedIn, WhatsApp or iMessage render without a title, description or image.
  • The site is using WordPress core sitemaps and no SEO plugin was detected in the front-end output — no Yoast, Rank Math or SEOPress markup is present. Consistent with the complete absence of descriptions, Open Graph tags and business schema.
Why it matters
Google has to write its own snippet for every page because the site never supplies one, so search listings are unpredictable and rarely persuasive — the business has no control over its own sales copy in search results. With no business schema, Google and AI systems cannot reliably identify the company, its service area or its opening hours, which weakens eligibility for rich results and map prominence and makes accurate AI citation less likely. And every link a salesperson shares on LinkedIn or in a message appears as a bare URL with no image or description.
Recommended fix
Install and properly configure an SEO plugin. Write unique titles and meta descriptions across all 51 pages. Add LocalBusiness schema with address, service area, hours and phone; Service schema per production service; and complete the Product schema across the rental catalogue. Add Open Graph and Twitter Card tags with branded share images.
What we found
  • The homepage title tag is literally Welcome - Light Action Inc. | Welcome - Light Action Inc. — the name is repeated twice.
  • Every page inherits the word “Welcome”: Contact | Welcome - Light Action Inc., Gallery | Welcome - Light Action Inc., All Products | Welcome - Light Action Inc.
  • These duplicated titles are visible right now in Google search results for the site.
Why it matters
Title tags are the headline of every search listing and the single most-read piece of copy the business publishes. Light Action is spending that space on the word “Welcome”, repeated — instead of on the services and locations people actually search for. It reads as neglected and it ranks for nothing.
Recommended fix
Rewrite every title tag around the service and the market, e.g. “Concert & Event Lighting Rental in Wilmington, DE | Light Action”. Remove the duplicated site name and eliminate “Welcome” from the template.
What we found
  • The viewport meta tag sets maximum-scale=1.0, user-scalable=0.
  • axe-core rates this critical and cites WCAG 2.0 Level AA, success criterion 1.4.4 (Resize Text).
  • It was the highest-severity issue found in the automated accessibility scan.
Why it matters
Any visitor who needs to enlarge text on a phone — which includes a large share of the over-40 decision-makers who book production services — simply cannot. Beyond excluding real customers, this is a well-documented WCAG failure and a standard finding in accessibility complaints and ADA-related web claims, which increasingly name small and mid-sized businesses.
Recommended fix
Remove maximum-scale and user-scalable from the viewport tag. This is a one-line change and should be done immediately, independently of any redesign.
What we found
  • Measured directly in-browser against the live page: Strict-Transport-Security — missing. Content-Security-Policy — missing. X-Frame-Options — missing. Permissions-Policy — missing.
  • Referrer-Policy is set, but to no-referrer-when-downgrade — which is weaker than the modern browser default of strict-origin-when-cross-origin. The site is actively opting into more referrer leakage than it would get by setting nothing.
  • X-Content-Type-Options: nosniff is correctly present.
  • Note: securityheaders.com awards this site an “A” — but that grade was measured against the Cloudflare challenge page it was served, not the website. The real page is materially weaker.
Captured evidence — click to enlarge
Why it matters
Without X-Frame-Options the site can be framed by a third party for clickjacking. Without HSTS, a first visit over HTTP can be intercepted. Without a CSP there is no defence-in-depth against injected scripts — a real concern on a site that also runs a payment page. This finding also demonstrates why third-party scan grades cannot be trusted here.
Recommended fix
Add HSTS with a sensible max-age, X-Frame-Options: SAMEORIGIN (or a CSP frame-ancestors directive), a Permissions-Policy denying unused browser features, and a stricter Referrer-Policy. Then introduce a Content-Security-Policy in report-only mode before enforcing.
What we found
  • At a 1440×900 viewport the logo image sits on top of the active navigation item, and the small red mark collides with the current-page label.
  • Reproduced on every page we tested — the homepage, the Contact page, the rental catalogue and a category page — so it is a template-level defect rather than a one-off.
  • The header remains visible as the page scrolls, so the defect stays on screen rather than passing by.
Captured evidence — click to enlarge
Why it matters
This is the first thing a visitor sees, and it is visibly broken on the most common desktop screen size. For a company selling large-scale technical production — where precision and reliability are the product — a broken header quietly undermines the core sales message on every single page view.
Recommended fix
Rebuild the header with a modern responsive layout (CSS grid or flexbox) with correctly reserved logo space and tested breakpoints. In a redesign this is resolved by default; as an interim fix the existing header can be patched with corrected widths and spacing.
What we found
  • A bright purple notification bar is fixed to the bottom of the viewport on every page we tested.
  • At mobile widths it wraps to two lines and obscures a significant portion of the screen.
  • It appears in every screenshot captured in this audit, at every breakpoint and on every page visited.
  • Its colour matches nothing else in the brand palette, which is red, white and dark grey.
Captured evidence — click to enlarge
Why it matters
The single most persistent element on the mobile site is an off-brand purple banner covering content — and its message is to go and write an email. It reduces usable screen space, damages perceived quality, and directs visitors to the highest-friction contact method available.
Recommended fix
Remove the bar. Replace it with the actual conversion mechanism it is standing in for: a properly designed quote-request flow, plus a tap-to-call button in a brand-consistent sticky element if a persistent CTA is wanted.
What we found
  • Of the 51 pages in the sitemap, 38 (75%) were last modified in 2018 — the earliest is dated 2018-10-17.
  • Modification years break down as: 2018 ×38, 2019 ×4, 2022 ×1, 2023 ×2, 2024 ×2, 2025 ×1, 2026 ×3. So 13 pages have been touched since 2018, and the site is not abandoned — the most recent edit is 2026-08-10. But three quarters of it has not changed in over seven years.
  • The footer reads “Copyright ©2025” — already out of date.
  • The top-bar social icons use the retired Twitter bird and a dated icon style. There is no link to the company’s LinkedIn page, although one exists.
Captured evidence — click to enlarge
Why it matters
Around seven years of completed projects, new equipment, new capabilities and new credibility are missing from the website. Drone light shows — clearly a growth service — sit in the navigation with little supporting content. Meanwhile a stale copyright year and a retired Twitter logo suggest to every visitor that the company may not be paying close attention, which is a difficult first impression when the buyer is about to trust you with a live event.
Recommended fix
Rebuild the content around current services and recent work: dated case studies with named venues and client outcomes, a refreshed and captioned project gallery, a dedicated drone light show section, and team and safety/certification credentials. Automate the copyright year and update all social links.
What we found
  • The active navigation item renders as #AD0000 dark red on a #292E35 dark slate header — a measured contrast ratio of approximately 1.8:1. WCAG AA requires 4.5:1 (3:1 for large bold text).
  • axe-core returns 18 elements where contrast cannot be computed because of complex text shadows over a background image — meaning contrast is unverifiable across the entire main navigation.
  • Inactive navigation items pass comfortably at 7.51:1.
Why it matters
Visitors cannot easily see which page they are on, and the navigation becomes hard to read in bright conditions or for anyone with reduced vision. Using a background photograph behind menu text means legibility changes unpredictably from page to page.
Recommended fix
Set the active state to a colour meeting at least 4.5:1 against the header. Replace the background-image header with a solid or subtly gradiented surface so contrast is deterministic, and remove decorative text shadows from navigation.
What we found
  • Full axe-core scan (WCAG 2.0/2.1 A & AA plus best-practice rules): 8 violations across 22 elements — 1 critical, 3 serious, 4 moderate, with 37 checks passing. To be precise about severity: 3 of the 8 are mapped to WCAG success criteria (13 elements); the other 5 are best-practice rules (9 elements) that affect real usability but are not formal conformance failures.
  • link-name (serious, 10 elements, WCAG 2.4.4 & 4.1.2) — ten links, including the gallery carousel arrows, have no text a screen reader can announce.
  • listitem (serious, 2 elements, WCAG 1.3.1) — <li> elements sit outside any <ul> or <ol>.
  • label-title-only (serious) — the search field relies on a title attribute instead of a real visible label.
  • landmark-one-main and region (moderate, best practice, 6 elements between them) — the page has no <main> landmark and content sits outside landmark regions, so keyboard and screen-reader users cannot skip to content.
  • Note: axe reports the 10 unlabelled links by count, not by name. The gallery carousel arrows (et-pb-arrow-prev / et-pb-arrow-next) are confirmed separately as unlabelled controls.
Why it matters
The site is difficult to operate without a mouse and confusing with a screen reader. Ten unlabelled links are announced only as “link”, and with no main landmark there is no way to skip past repeated navigation. Beyond excluding users, this is the profile of site that attracts accessibility complaints — and public-sector, university and municipal buyers increasingly require accessibility conformance in procurement, which matters for an organisation whose project photography shows work at exactly those kinds of venues.
Recommended fix
Resolve all eight violations, then adopt semantic HTML5 landmarks, accessible names on every interactive control, and a visible skip-to-content link. Target WCAG 2.1 AA and re-test with both automated tooling and manual keyboard and screen-reader passes.
What we found
  • 18 of 19 homepage images carry an empty alt="" attribute — including meaningful content images, not just decorative ones.
  • 11 of 19 have no srcset, so mobile visitors download desktop-sized files.
  • 13 of 19 are not lazy-loaded.
  • No modern formats detected — of the 19 images, 11 are PNG and 2 are JPEG (the format of the remaining 6 could not be resolved). No WebP or AVIF was found.
  • Oversized delivery confirmed: CLAY-PAKY.jpg is served at 1000×1000 to fill a 348×348 slot.
  • 6 of 19 images declare no width/height. On the rental catalogue we observed tiles rendering blank in our first screenshot and populating shortly afterwards, which is the signature of lazy-loaded images without reserved space.
Captured evidence — click to enlarge
Why it matters
Empty alt text strips the photo library — the company’s strongest asset — of any descriptive signal, so it competes poorly in image search and conveys nothing to a screen reader. Oversized files waste mobile data. Missing dimensions mean tiles render blank and then fill in as images arrive, which reads as a broken page on a slower connection; we observed this on the rental catalogue, though the homepage itself measured near-zero layout shift.
Recommended fix
Write descriptive alt text on all content images. Serve WebP with responsive srcset, lazy-load below-the-fold media, always declare width and height (or an aspect-ratio box) to eliminate pop-in, and add an image CDN or optimisation pipeline.
What we found
  • 41 rental categories are published.
  • In the category we sampled (“Automated Lighting”, 19 products across 2 pages), all 15 products on page one carried a working “Request for Quote” button — a genuine strength.
  • But: no prices or indicative day rates anywhere; no product descriptions or technical specifications (measured content length: 0 characters); no filtering or sorting beyond a keyword search and a results-per-page selector.
  • No meta description on the category pages we tested, so 41 potentially valuable landing pages hand their search snippets over to Google to write. These pages are indexed — the issue is that they compete with no descriptions, no intro copy and no specifications.
  • The quote basket is the default WooCommerce cart: a page titled “Request for Quote” that uses e-commerce language such as “Your cart is currently empty” and “continue shopping”, and no date-range fields for a rental enquiry.
Captured evidence — click to enlarge
Why it matters
A technical buyer choosing between fixtures needs specifications, and cannot get them here — so they leave and check a competitor or a manufacturer site. Meanwhile 41 category pages that could rank for high-intent searches like “moving head light rental Delaware” are published with no descriptions and no metadata to compete on. The quote flow itself works, but it reads as an e-commerce checkout, which is the wrong mental model for a rental enquiry.
Recommended fix
Add specifications, datasheets and photography to each product, plus indicative rates or a clear “rates on request” treatment. Add filtering by type, brand, wattage and availability. Rewrite the quote basket language for rentals and add date-range fields. Give every category page unique metadata and intro copy.
What we found
  • At 768px the hero photograph is letterboxed into a thin strip with large empty white bands above and below.
  • Content sections are separated by very large areas of unused whitespace, producing an unnecessarily long scroll (the desktop homepage is already 3,961px tall).
  • Eight elements overflow the layout edge at narrow widths — the gallery carousel arrows and the top-bar social icons. Worth noting: this produces no horizontal scrollbar, so the content is quietly clipped rather than scrollable, which makes it easy to miss when resizing a browser by eye.
  • 15 interactive elements are under 24px in one dimension, below comfortable tap-target guidance.
  • Note: the narrow-viewport captures in this report were taken at approximately 600px, the minimum width the test browser allows; the mobile layout and its issues are fully active at that width.
Captured evidence — click to enlarge
Why it matters
Most enquiries for event services begin on a phone. The mobile experience is a desktop page squeezed down rather than a layout designed for a small screen: the hero loses its impact, key content sits below long empty gaps, and controls are hard to hit accurately.
Recommended fix
Design mobile-first with the hero, value proposition and primary call to action visible without scrolling. Enforce a minimum 44×44px tap target, contain the overflowing elements within the viewport, and tighten vertical rhythm so content density suits a phone.
What we found
  • The Contact page — which has no form — loads Contact Form 7 assets: styles.css, redirect_method.js and two index.js bundles.
  • The same page loads the full WooCommerce front end despite containing no shop content: wc-blocks.css, woocommerce-layout.css, woocommerce-smallscreen.css, woocommerce.css, jquery.blockUI.min.js, js.cookie.min.js, woocommerce.min.js, sourcebuster.min.js, order-attribution.min.js.
  • WonderPlugin Gallery JavaScript also loads on the Contact page, which contains no gallery.
  • The homepage requests 20 scripts and 12 stylesheets as separate files — 59 resources in total — rather than bundled together.
Why it matters
On the Contact page alone we counted 14 asset requests that page has no use for. The real site is fast enough that this is not yet critical, but it is pure waste, it slows mobile visitors on weaker connections, and it is exactly the accumulated overhead that makes an ageing Divi build progressively harder and riskier to maintain.
Recommended fix
Conditionally dequeue plugin assets on pages that do not need them, then bundle, minify and defer what remains. A rebuild on a lean modern theme removes most of this overhead structurally.
What we found
  • jQuery Migrate 3.4.1 is loaded in production alongside jQuery 3.7.1 — a compatibility shim whose presence indicates deprecated jQuery code still in use.
  • The site runs the Divi page-builder theme with a child theme (lightactioninc-child). The bulk of the content dates from 2018, which is the best available indication of when the build was last substantially worked on.
  • 32 separate CSS and JavaScript files load on the homepage, unbundled.
  • The underlying platform is recent: WordPress 7.0.4 and WooCommerce 10.5.3, both actively maintained release lines.
Why it matters
The foundation is sound but the presentation layer is many years of accumulated page-builder output. Practically this means changes are slow and risky, Divi’s shortcode-based markup makes content difficult to migrate later, and each update carries a real chance of visual regressions — which is usually why sites like this stop being updated at all.
Recommended fix
Rebuild the front end on a lean modern stack — native Gutenberg blocks or a purpose-built theme — and remove jQuery Migrate along with the deprecated code that requires it. Retain WordPress and WooCommerce; the core platform is not the problem.
What we found
  • The website is lightactioninc.com, but all 17 unique published email addresses use @lightaction.com.
  • This affects the footer on every page, the site-wide purple bar, and all 20 mailto links on the Contact page.
  • Two brand names run in parallel: page titles and the footer say “Light Action Inc.”, while the logo artwork reads “LIGHTACTION PRODUCTIONS” and the Facebook and Instagram accounts are both LightActionProductions.
Why it matters
A visitor about to email a stranger about a five-figure production notices when the email domain does not match the website domain — it reads like a phishing signal. Combined with two different company names in use, the brand presents as inconsistent at precisely the moment trust matters most.
Recommended fix
Confirm with the client which domain is canonical, then align consistently. Verify that email authentication (SPF, DKIM, DMARC) is correctly configured for the sending domain so enquiry replies are not filtered as spam. Settle on one public-facing brand name.
What we found
  • The Contact page publishes 20 mailto links covering 17 unique addresses, in plain HTML with no obfuscation.
  • Each is tied to a named individual with a job title and a direct phone extension — the captured screenshot shows the VP of Accounting, the COO, the Director of Operations and the project management team.
  • Departmental finance addresses (ap@ and ar@) appear in the same list.
Why it matters
This is a ready-made target list for spam and, more seriously, for business email compromise. Publishing the finance addresses next to named senior staff and their extensions gives an attacker everything needed to construct a convincing invoice-fraud or payment-redirection attempt against a company that handles large production invoices.
Recommended fix
Replace direct mailto links with a routed contact form offering a department selector. If individual contacts must remain public, obfuscate the addresses and keep finance addresses off the public site entirely. Brief the finance team on payment-redirection fraud.
What we found
  • Meta generator tags publish exact versions: WordPress 7.0.4, WooCommerce 10.5.3 and the child theme name.
Why it matters
Version disclosure lets automated scanners match the site instantly against known vulnerabilities for those exact releases. Both versions are current, so present risk is low — but the moment a vulnerability is published, this site is trivially identified as a target.
Recommended fix
Remove generator meta tags and version query strings from enqueued assets.
What we found
  • No embedded map on the Contact page, despite the business operating a physical gear pickup and drop-off location.
  • The footer links to “Directions to Light Action”, so the need is already recognised.
Why it matters
Crews collecting or returning equipment have to copy the address into a separate app. A small friction point, but it affects the operational audience daily.
Recommended fix
Embed an interactive map with the pickup entrance clearly marked, plus a one-tap “Open in Maps” action and loading-dock notes.
What we found
  • Chrome UX Report field data returns “No Data” for the domain, which means it falls below Google’s minimum sample threshold for reporting real-user Core Web Vitals. The most likely explanation is low traffic volume, though CrUX eligibility depends on several factors.
Why it matters
This is a symptom rather than a cause, but it is a useful independent signal: the site does not generate enough measurable traffic to appear in Google’s public field dataset. It also makes a convenient milestone — once analytics and SEO fundamentals are in place and traffic grows past the threshold, field data becomes available as ongoing, third-party proof of improvement.
Recommended fix
Treat CrUX data availability as a milestone. Once analytics and SEO fundamentals are in place, rising traffic should bring the domain above the reporting threshold.
04 — Visual evidence

What we captured

Screenshots taken from the live site on 19 August 2026. Click any image to view it full size.

Homepage, above the foldThe logo overlaps the active navigation item. No H1, no headline, no call to action — the hero is a photograph of the logo. The off-brand purple bar is fixed at the bottom.
Primary calls to actionThe two main actions are small dark-red buttons set in a large field of whitespace, with no visual hierarchy signalling which matters more.
Photo gallery sectionStrong project photography, but thumbnails sit over a busy laser background at inconsistent aspect ratios, reducing legibility.
FooterCopyright reads ©2025. The published email address uses lightaction.com while the website is lightactioninc.com. Social links appear only in the top utility bar, not here, and there is no map.
Tablet — 768px wideThe hero photograph is letterboxed into a thin strip with large empty bands, and the purple bar wraps onto two lines.
Narrow viewport — topMobile layout active. The hero loses all impact and the fixed purple bar occupies a substantial share of the screen.
Narrow viewport — contentVery large vertical gaps between sections produce an unnecessarily long scroll on a phone.
Contact page — no formA staff phone directory with 20 exposed mailto links and no enquiry form anywhere on the page. Note the logo overlapping the CONTACT label.
Rental catalogue — 41 categoriesA substantial catalogue with real commercial value, but no filtering, no prices and category images that load late leaving blank tiles.
Category page — Automated LightingAll 15 products on page one have a working Request for Quote button — but no specifications, no descriptions and no prices to decide with.
Google PageSpeed Insights — mobileNote the page thumbnail on the right: Lighthouse never reached the website. It measured a Cloudflare security-verification page, so these scores are not the site’s.
What the PageSpeed test receivedThe Cloudflare interstitial served to Google’s PageSpeed testing infrastructure in place of the homepage. This is Google’s test tooling, not Googlebot — the site itself remains indexed.
securityheaders.com — grade AAn apparently excellent result — but it graded the challenge page’s headers, not the website’s.
The same scan’s warnings“Scan was blocked — We got a 403”, with HTTP/2 403 and cf-mitigated: challenge in the raw headers. Independent confirmation of the blocking.
05 — Strengths

What is already working

An honest audit has to say what is right as well as what is wrong — and several of these are genuine assets that a redesign should build on rather than replace.

No broken links

All 24 main navigation and footer URLs were tested and every one returned HTTP 200. No 404s, no redirect chains.

Genuinely fast delivery

Measured in-browser on the real page: TTFB 246ms, DOM ready 788ms, fully loaded 1.76s, served over HTTP/3 via Cloudflare’s CDN.

Near-perfect visual stability

Homepage Cumulative Layout Shift measured at 0.0001 — effectively zero, well inside Google’s 0.1 “good” threshold. (This figure is for the homepage; catalogue pages, where image dimensions are undeclared, were not separately measured.)

Recent, supported platform

WordPress 7.0.4 and WooCommerce 10.5.3 are both recent, actively maintained releases. The foundation is worth keeping — this is a presentation and strategy problem, not a platform migration.

A working quote mechanism already exists

All 15 products on page one of the rental category we sampled had a functioning “Request for Quote” button feeding a quote basket. The concept is proven — it needs extending and finishing, not inventing.

An exceptional photo library

Extensive, genuine project photography across concerts, touring, film and TV, architectural installation and large-scale staging — including recognisable venues and events. This is the single strongest asset available for a redesign.

Indexed and structurally crawlable

51 pages in a valid WordPress sitemap, a canonical tag present on the homepage, robots.txt allowing search crawlers, and pages confirmed present in Google’s index — so SEO gains can compound on existing foundations rather than starting from zero.

Substantial service depth

Seven distinct production service lines plus drone light shows and 41 rental categories — far more capability than the current site communicates.

06 — Recommendations

A four-phase plan

Sequenced so that the cheapest, highest-risk items are resolved first, measurement is in place before the redesign begins, and the rebuild can be judged against a real baseline.

Phase 1
Immediate fixes
Days, not weeks
  • Re-enable pinch-to-zoom (one-line viewport fix)
  • Rename the admin account, enforce 2FA, disable REST user enumeration and XML-RPC
  • Review Cloudflare bot rules so crawlers and monitors are not served 403s
  • Decide the AI-crawler policy deliberately and update robots.txt
  • Add security headers (HSTS, X-Frame-Options, Permissions-Policy)
  • Install GA4 and Search Console to establish a measurement baseline
  • Fix the stale copyright year and replace the retired Twitter icon
Why this orderRemoves the critical security exposure and stops the bleeding on discoverability. Establishes the baseline that proves everything after this point.
Phase 2
Capture the demand already arriving
Weeks
  • Build a real contact form and a structured “Request a Quote” form
  • Wire quote requests into the rental catalogue with date ranges
  • Route submissions to the right project manager with tracking
  • Replace exposed mailto links with routed forms
  • Remove the purple bar and add proper calls to action
  • Define and track conversion events
Why this orderWhatever traffic the site currently receives has almost no way to convert. Building the enquiry routes is inexpensive relative to a redesign and is usually the fastest measurable return of any phase — and with Phase 1’s analytics in place, the effect becomes visible immediately.
Phase 3
Become findable
Weeks, ongoing
  • Install and configure an SEO plugin properly
  • Unique titles and meta descriptions across all 51 pages
  • LocalBusiness, Service and Product schema
  • Open Graph and Twitter Card tags with branded share images
  • Descriptive alt text across the photo library
  • Unique intro copy and metadata for the 41 rental category pages
Why this orderTurns 51 existing pages and 41 category pages into search assets, and makes the business legible to both Google and AI assistants.
Phase 4
Rebuild the website
The main project
  • Mobile-first redesign on a lean modern stack
  • New hero with a clear H1, value proposition and calls to action
  • Corrected heading hierarchy and semantic landmarks throughout
  • WCAG 2.1 AA accessibility conformance
  • Rebuilt rental catalogue with specifications, filtering and photography
  • Dated case studies, refreshed gallery, dedicated drone light show section
  • Retire Divi and jQuery Migrate; optimise images to WebP with responsive sizing
Why this orderResolves the design defects, the ageing content and the accumulated technical debt in one deliberate project — on a platform that is already sound.
07 — Technical appendix

Raw measurements

The underlying data behind the findings, for technical review.

Performance — measured in-browser

MetricMeasuredGoogle’s “good” thresholdAssessment
Time to First Byte246 ms< 800 msGood
First Contentful Paint1,756 ms< 1,800 msGood
Largest Contentful Paint1,756 ms< 2,500 msGood
Cumulative Layout Shift0.0001< 0.1Excellent
DOM Content Loaded788 ms—Good
Fully loaded1,762 ms—Good
ProtocolHTTP/3 (h3)HTTP/2 or betterModern
LCP elementHeader background image (main-menu-bg.jpg)—Optimisable
Requests on homepage59 resources — 20 scripts, 12 stylesheets—Unbundled
Real-user field data (CrUX)No DataSufficient traffic to reportBelow threshold
Lighthouse lab scoresExcluded — the run measured a 403 Cloudflare challenge page (Performance 96, Accessibility 93, Best Practices 96, SEO 45)—Not valid for this site
Desktop PageSpeed runAttempted twice; never completed—Inconclusive

Measured directly in Chrome against the live page over a desktop broadband connection on 19 August 2026, so these figures are favourable relative to a mobile visitor on cellular data. They describe the real website. Google’s Lighthouse scores are reported but excluded from assessment, because that run was served a Cloudflare challenge page rather than the site — see the critical findings above.

Security & SSL

CheckResultStatus
HTTPS / TLSHTTPS loads cleanly over HTTP/3 via Cloudflare, no certificate warningsPass
X-Content-Type-OptionsnosniffPass
Strict-Transport-SecurityNot setMissing
Content-Security-PolicyNot set on the real pageMissing
X-Frame-OptionsNot set — clickjacking exposureMissing
Permissions-PolicyNot setMissing
Referrer-PolicySet to no-referrer-when-downgrade — weaker than the modern browser defaultWeak
REST API user enumeration/wp-json/wp/v2/users → 200, exposes admin, wozCritical
Author archive/author/admin/ → 200Fail
User sitemap/wp-sitemap-users-1.xml → 200Fail
Login page/wp-login.php → 200, no protection detectedFail
XML-RPC/xmlrpc.php → 422 (endpoint reachable, not blocked)Reachable
Version disclosureWordPress 7.0.4, WooCommerce 10.5.3 in meta generator tagsDisclosed
HTTP→HTTPS redirectNot tested in this audit—
readme.html404 — correctly removedPass
Exposed email addresses17 unique staff addresses in plain HTMLFail

Accessibility violations

ViolationImpactElementsWCAG criterion
Zooming and scaling disabledCritical12.0 AA — 1.4.4 Resize Text
Links without discernible textSerious102.0 A — 2.4.4, 4.1.2
List items outside a listSerious22.0 A — 1.3.1
Form element labelled only by titleSerious1Best practice
Content outside landmark regionsModerate5Best practice
No main landmarkModerate1Best practice
Invalid heading orderModerate1Best practice
No level-one headingModerate1Best practice
Colour contrast indeterminate (text shadows)Incomplete — not a violation182.0 AA — 1.4.3 (unverifiable)

Scanned with axe-core 4.10.2 against WCAG 2.0/2.1 Level A and AA plus best-practice rules: 8 violations across 22 elements (1 critical, 3 serious, 4 moderate), with 37 checks passing. The first three rows are formal WCAG failures (13 elements); the next five are best-practice rules (9 elements) that harm usability without being conformance failures. The final row was returned as incomplete rather than failed — axe could not compute contrast because of the text shadows — so it is listed for manual review and excluded from the violation count. Automated tools surface only a portion of accessibility problems; a manual keyboard and screen-reader review would likely find more.

Technology stack

LayerDetectedNote
CMSWordPress 7.0.4Recent, actively maintained
E-commerceWooCommerce 10.5.3Recent; used as a quote catalogue
ThemeDivi + lightactioninc-childPage-builder build dated 2018
FormsContact Form 7 + CF7 PayPal add-onLoading on the Contact page, which renders no enquiry form
GalleryWonderPlugin GalleryLoads on the Contact page, which has no gallery
JavaScriptjQuery 3.7.1 + jQuery Migrate 3.4.1Migrate shim in production
CDN / WAFCloudflare (incl. managed robots.txt and bot challenge)Served 403 challenges to both scanners we ran
Third-party scriptsTrustwave trust seal, Cloudflare InsightsMinimal footprint — only 2 external hosts
AnalyticsCloudflare Insights onlyNo GA4, GTM, pixel, dataLayer or conversion tracking
SEO pluginNone detected in front-end output — WordPress core sitemaps onlyNo SEO layer present
Page count51 pages in sitemap; 41 rental categoriesSubstantial content base

Broken links & navigation

ScopeResult
URLs tested24 — all main navigation, dropdown and footer links
HTTP 200 (OK)24 of 24
HTTP 404 (not found)0
Redirect chains0
Horizontal overflow at narrow widths8 elements (carousel arrows, social icons) extend past the layout edge. Note: no horizontal scrollbar appears — the content is clipped rather than scrollable, so this is easy to miss by eye

This is a clean result and worth stating plainly: the site’s link structure is sound — every navigation and footer destination resolves correctly. The overflow row is included for completeness; it is a layout issue rather than a link issue.

08 — Methodology

How this audit was conducted

So that every figure in this report can be independently reproduced and challenged.

Live browser testing

The site was loaded in Chrome and inspected directly — DOM structure, response headers, resource timing, Core Web Vitals via the Performance API, and rendering at three viewport widths.

Automated accessibility scan

axe-core 4.10.2 run against WCAG 2.0 and 2.1 Level A and AA rule sets plus best practices, with per-element failure detail captured.

Google PageSpeed Insights

Lighthouse 13.4.1 on an emulated Moto G Power over throttled 4G, plus a Chrome UX Report field-data lookup. The mobile run completed but measured a challenge page; the desktop run was attempted twice and never completed.

Security review

Response header inspection, securityheaders.com cross-check, and non-intrusive endpoint checks for common WordPress information-disclosure paths. No credentials were submitted and no intrusive testing was performed.

Link integrity

Every main navigation, dropdown and footer URL requested individually with redirect following, and status codes recorded.

Technology fingerprinting

Platform, theme, plugins and third-party scripts identified from asset paths, generator metadata and runtime JavaScript globals. This reveals what the front end loads; it cannot detect plugins that produce no front-end output.

On the third-party scan results. Two independent tools — Google PageSpeed Insights and securityheaders.com — were served an HTTP 403 Cloudflare challenge page instead of the website. Both produced favourable-looking results (Performance 96 / Accessibility 93 / Best Practices 96, and a security grade of A) that describe that challenge page rather than lightactioninc.com. We are reporting those numbers openly here so they are not a surprise if you run the tools yourself, but we have not used them as findings. Every figure presented in this report as a measurement of the real site comes from direct in-browser inspection of the actual rendered page. Our own instrumented Chrome session reached the real site without difficulty, which is why the challenge behaviour is described as intermittent and client-dependent rather than absolute.
Scope and limitations. This is an external, non-intrusive assessment of the public website conducted on 19 August 2026. It did not include access to WordPress admin, hosting, Cloudflare configuration, Google Search Console or analytics — a follow-up review with those would allow firmer conclusions on crawl-error volume, traffic patterns and plugin inventory. Narrow-viewport screenshots were captured at approximately 600px, the minimum width the test browser permits; the mobile layout is fully active at that width. The 403 challenge behaviour appeared intermittent: the site remains present in Google’s index, so this is a crawl-reliability risk rather than a confirmed deindexing. Findings marked for client confirmation — such as the email-domain difference — may reflect deliberate business decisions.

The platform is sound. The website needs rebuilding.

Light Action has the equipment, the project history and the photography of a company that should be highly visible in its regional market. What it has instead is a 2018 brochure with no search foundation, no measurement and no enquiry route — sitting behind a bot filter that makes it hard for automated systems to see properly. Every one of those is fixable, and the first handful of fixes take days rather than weeks.

Discuss the findings with Klik Digital
Website audit prepared by Klik Digital Agency — 19 August 2026 Subject: www.lightactioninc.com