Data-Driven Digital Marketing Agency in Dubai

Technology and measurement fingerprints

• Insight TagAdvertising

  published Google Tag Manager container · 2 signals · view sampled page

• ClarityExperience analytics

  browser network request · 1 signal · view sampled page

• Google tag, GA4, Ads or FloodlightGoogle measurement

  published Google Tag Manager container · 1 signal · view sampled page
  browser network request · 1 signal · view sampled page

• Universal Analytics codeLegacy

  published Google Tag Manager container · 1 signal · view sampled page

• HubSpot tracking codeMarketing and calls

  published Google Tag Manager container · 1 signal · view sampled page

• Container bootstrapTag management

  browser network request · 1 signal · view sampled page

Hosting, registration and authority

Hosting or edge

Cloudflare

Registered domain

acquisit.io

Registrar

Not published

Registry source

Registry RDAP via the IANA bootstrap

Registered

Not published

Expires

Not published

Domain Rating · Domain Rating by Ahrefs

21 / 100

Reputation check

Google Web Risk

No current Google Web Risk match

No match is not a safety guarantee. Investigate any warning independently.

Evidence and key metrics

Open any card to inspect the public evidence, source and collection details.

All corrected findings

• Mobile Core Web Vitals do not all passhigh

  CrUX origin p75: LCP 3801ms, INP 103ms, CLS 0.

  Suggested fix: Investigate the failing field metric with route-level RUM and repeatable lab traces. Do not substitute TBT for INP.

  Show evidence and next steps

  Why it matters: Core Web Vitals reflect real-user loading, responsiveness and visual stability at the 75th percentile.

  What we found:

  • Chrome UX Report API
  • origin scope

  How to verify: Recheck the next CrUX rolling period and compare owned-site RUM if available.

  Confidence: observedSuggested owner: DeveloperEstimated effort: days

• Marketing tags observed without a supported consent signalhigh

  No supported consent interface was identified in the fresh pre-consent browser state. This is not proof that the site has no banner: region, timing, prior-state logic and unsupported CMPs can change the result.

  Suggested fix: Implement and test a consent platform appropriate to the site's regions and data uses.

  Show evidence and next steps

  Why it matters: Consent state can determine which storage and requests are permitted. Automated detection is not a legal conclusion.

  How to verify: Trace baseline, reject and accept sessions in fresh browser contexts.

  Confidence: observedSuggested owner: MarketerEstimated effort: days

• 2 sampled fields lack an explicit accessible labelhigh

  2 forms were inspected with static label heuristics.

  Suggested fix: Associate visible labels with controls or supply an equivalent accessible name.

  Show evidence and next steps

  Why it matters: Labels make controls understandable and enlarge the reliable interaction target.

  What we found:

  • Static label, aria-label and aria-labelledby checks

  How to verify: Inspect each rendered control in the accessibility tree.

  Confidence: inferredSuggested owner: DeveloperEstimated effort: hours

• 4 potentially parser-blocking external scriptshigh

  29 external script tags were found in source HTML.

  Suggested fix: Use defer, async or modules where dependency ordering allows.

  Show evidence and next steps

  Why it matters: Parser-blocking scripts can delay initial rendering. Browser preload and response timing can change the actual effect.

  What we found:

  • acquisit.io
  • js-eu1.hsforms.net
  • www.google.com

  How to verify: Confirm with a Lighthouse trace and rendered waterfall.

  Confidence: inferredSuggested owner: DeveloperEstimated effort: hours

• Legacy tracking technology observedhigh

  Universal Analytics code

  Suggested fix: Confirm whether the legacy bootstrap is still needed and remove it if not.

  Show evidence and next steps

  Why it matters: Retired measurement code can add requests and create misleading expectations without a supported destination.

  What we found:

  • Public source fingerprint

  How to verify: Rescan the published page and container after removal.

  Confidence: observedSuggested owner: MarketerEstimated effort: hours

• Content Security Policy not observedmedium

  The header was absent from the sampled final HTML response.

  Suggested fix: Add a tested Content-Security-Policy. Start in report-only mode if necessary.

  Show evidence and next steps

  Why it matters: CSP can limit the impact of injected content.

  What we found:

  • Final HTTP response headers

  How to verify: Inspect the final response headers after deployment.

  Confidence: observedSuggested owner: DeveloperEstimated effort: hours

• No click-ID field was visible on sampled formsmedium

  2 forms were observed; 0 exposed a supported click-ID field.

  Suggested fix: Verify click IDs are captured, stored on the CRM record and returned with eligible outcomes.

  Show evidence and next steps

  Why it matters: Persisting ad click identifiers can make later qualified outcomes joinable to the original ad interaction.

  What we found:

  • Public form field names only

  How to verify: Submit an authorised test lead manually and inspect the receiving record.

  Confidence: inferredSuggested owner: MarketerEstimated effort: hours

• Strict-Transport-Security not observedmedium

  The header was absent from the sampled final HTML response.

  Suggested fix: Add a suitable Strict-Transport-Security policy after confirming every subdomain is HTTPS-ready.

  Show evidence and next steps

  Why it matters: HSTS tells supporting browsers to keep using HTTPS.

  What we found:

  • Final HTTP response headers

  How to verify: Inspect the final response headers after deployment.

  Confidence: observedSuggested owner: DeveloperEstimated effort: hours

• 2 H1 headings foundmedium

  37 headings were found in the source HTML.

  Suggested fix: Use one useful top-level heading and a logical nested hierarchy.

  Show evidence and next steps

  Why it matters: A clear top-level heading helps users and automated systems understand the page structure.

  What we found:

  • H2: Let’s Talk Growth
  • H1: Growth marketing for clear-cut impact
  • H2: We deliver growth through Traffic Generation, Conversion Rate, and Lifetime Value Optimization.
  • H2: What we do
  • H3: Performance Marketing
  • H3: SEO/GEO/ASO

  How to verify: Inspect the rendered heading outline.

  Confidence: observedSuggested owner: SEOEstimated effort: minutes

• Heading levels are skipped in source ordermedium

  H1 to H3, H2 to H6, H2 to H6, H2 to H6, H2 to H6

  Suggested fix: Use headings to represent nested document structure, not visual size.

  Show evidence and next steps

  Why it matters: A logical heading outline helps keyboard and screen-reader navigation.

  What we found:

  • Static heading order

  How to verify: Inspect the rendered heading outline.

  Confidence: inferredSuggested owner: DeveloperEstimated effort: hours

• MIME sniffing protection not observedmedium

  The header was absent from the sampled final HTML response.

  Suggested fix: Set X-Content-Type-Options: nosniff.

  Show evidence and next steps

  Why it matters: X-Content-Type-Options reduces MIME confusion.

  What we found:

  • Final HTTP response headers

  How to verify: Inspect the final response headers after deployment.

  Confidence: observedSuggested owner: DeveloperEstimated effort: hours

• No frame-embedding restriction was observedmedium

  No frame-embedding restriction was observed

  Suggested fix: Set CSP frame-ancestors or X-Frame-Options where legacy support is needed.

  Show evidence and next steps

  Why it matters: Clickjacking protection reduces unwanted framing.

  What we found:

  • HTTP response headers

  How to verify: Repeat the same public check after the change.

  Confidence: observedSuggested owner: DeveloperEstimated effort: minutes

• Permissions policy not observedmedium

  The header was absent from the sampled final HTML response.

  Suggested fix: Set a restrictive Permissions-Policy for unused browser capabilities.

  Show evidence and next steps

  Why it matters: Permissions-Policy limits access to powerful browser features.

  What we found:

  • Final HTTP response headers

  How to verify: Inspect the final response headers after deployment.

  Confidence: observedSuggested owner: DeveloperEstimated effort: hours

• Referrer policy not observedmedium

  The header was absent from the sampled final HTML response.

  Suggested fix: Set an explicit Referrer-Policy appropriate to the site.

  Show evidence and next steps

  Why it matters: A referrer policy limits URL information sent to other origins.

  What we found:

  • Final HTTP response headers

  How to verify: Inspect the final response headers after deployment.

  Confidence: observedSuggested owner: DeveloperEstimated effort: hours

• No DNSSEC DS record observedlow

  No DS record was returned. This does not test every resolver or validate the complete chain.

  Suggested fix: Consider enabling DNSSEC with coordinated registrar and DNS-provider configuration.

  Show evidence and next steps

  Why it matters: DNSSEC can provide origin authentication for DNS answers when the validation chain is correct.

  What we found:

  • DS query through DNS over HTTPS

  How to verify: Validate the complete chain with an independent DNSSEC tool.

  Confidence: inferredSuggested owner: ITEstimated effort: hours

Methodology and limitations

Bounded analysis of publicly accessible pages, DNS, registries and configured providers. No login, form submission, port scan or exploit testing.

• The report is a bounded public sample, not a complete crawl, account audit, accessibility certification, legal compliance review or penetration test.
• Technology and hosting detections are confidence-ranked fingerprints. They do not prove ownership, configuration quality, exact version or vulnerability.
• A browser request shows that the page attempted a destination. It does not prove storage, reporting, attribution or use by an advertising algorithm.
• The public scanner does not log in, submit forms, complete checkout, download files, scan ports or test exploits.