PlainsightCheck your own site

Apps & websites

nilabhstudio.com

Checked 21 Oct 2026, 06:47 pm IST · on an ordinary phone and mobile connection

2 worth fixing 24 working well 3 good to know

We found 2 things to fix and 24 that already work well. Start with the two below. Open "Evidence" on any point to see exactly how we know.

Screenshot of nilabhstudio.com as it first appears on a phone
What a visitor sees first, before scrolling

Start here

  1. 1There's no clear "get started" buttonYou can do this yourself
  2. 2No privacy policy or terms on your homepageYou can do this yourself

First impressions

2 to fix · 1 working
Worth fixing

There's no clear "get started" button

Most visitors decide within seconds. A clear action on the first screen (sign up, try it, join the waitlist) turns interest into users.

What to do: Put one primary button near the top that says exactly what happens: "Start free", "Join the waitlist", "Try the demo". You can do this yourself

Evidence
  • On the first screen: none

Best guess Looked for links and buttons with action words (start, sign up, try, join, download…) and whether they appear in the first phone screen.

Rule business.cta v1 · Plainsight rule

Worth fixing

No privacy policy or terms on your homepage

Stripe, Google sign-in verification, Apple and the app stores ask for both, and privacy laws such as GDPR and India's DPDP Act expect a privacy notice once you collect emails or analytics.

What to do: Publish short, plain pages: what you collect and why, who sees it, how to delete it; and the basic rules of using your product. Link both in the footer. You can do this yourself

Evidence
  • Privacy link: not found
  • Terms link: not found

Measured Searched all homepage links for privacy and terms pages.

Rule business.legal v1 · source: support.google.com

Users can find a way to reach you
Evidence
  • EMAIL → mailto:nilabh.ranjan@gmail.com

Best guess Looked for email links and contact, support, help or community links.

Rule business.contact v1 · Plainsight rule

Code and secrets

Nothing to fix · 2 working
No secret keys found in the 1 JavaScript file your site sends
Evidence
  • Checked for 26 kinds of secret, including Stripe, OpenAI, Anthropic, AWS, GitHub and Supabase keys, private keys and database passwords
  • 4 KB of JavaScript read

Measured Read the JavaScript files your homepage downloaded from your own domain, plus the page itself: the same files any visitor's browser gets. Nothing else was requested.

Rule code.secrets v1 · Plainsight rule

No JavaScript errors on first load
Evidence

Measured Captured uncaught exceptions and console errors during the first load, as a new visitor with no cookies.

Rule code.errors v1 · source: developer.mozilla.org

Speed on a phone

Nothing to fix · 5 working
Your main content appears in 0.7 s on a typical phone — Under 2.5 seconds is what Google considers good.
Evidence
  • Largest Contentful Paint: 688 ms
  • First Contentful Paint: 688 ms

Measured Largest Contentful Paint from the browser's PerformanceObserver. Measured once on a Pixel 7 (mid-range Android), Slow 4G (150 ms latency, 1.6 Mbps), 4x slower than this computer. A single lab run varies by roughly ±20%.

Rule speed.main-content v1 · source: web.dev

Opening your homepage uses 139 KB of a visitor's mobile data — That is light. Pages under about 1.5 MB load comfortably on mobile networks.
Evidence
  • 9 files downloaded
  • 24 KB nilabhstudio.com/fonts/newsreader-400-italic.woff2
  • 23 KB nilabhstudio.com/fonts/cormorant-garamond-400-italic.woff2
  • 23 KB nilabhstudio.com/fonts/cormorant-garamond-500.woff2
  • 23 KB nilabhstudio.com/fonts/cormorant-garamond-400.woff2
  • 22 KB nilabhstudio.com/fonts/newsreader-400.woff2

Measured Sum of bytes transferred over the network during page load (compressed sizes), cache disabled. Measured once on a Pixel 7 (mid-range Android), Slow 4G (150 ms latency, 1.6 Mbps), 4x slower than this computer.

Rule speed.page-weight v1 · source: httparchive.org

Your page sends a light amount of JavaScript (2 KB)
Evidence
  • 1 JavaScript files, 2 KB compressed
  • 2 KB nilabhstudio.com/9ebb661d939c8bdc/script.js

Measured Sum of compressed bytes for every script the page loaded. Under 350 KB is comfortable on phones; over 1 MB is heavy. Measured once on a Pixel 7 (mid-range Android), Slow 4G (150 ms latency, 1.6 Mbps), 4x slower than this computer.

Rule speed.javascript v1 · source: web.dev

Your server responds quickly (under 0.1 s)
Evidence
  • Time to first byte: 25 ms

Measured Navigation Timing (responseStart − requestStart). The phone-network simulation does not apply to this number, so it shows your server's real response time from the computer running this check.

Rule speed.server-response v1 · source: web.dev

The page stays steady while it loads
Evidence
  • Cumulative Layout Shift: 0 (good ≤ 0.1)

Measured Layout-shift entries from the browser's PerformanceObserver during load, before any scrolling.

Rule speed.layout-shift v1 · source: web.dev

Being found and shared

Nothing to fix · 7 working
Good to know

Google Discover may only show a small image for your pages

Discover, the feed in the Google app, gives much more space to pages that allow large image previews.

What to do: Add <meta name="robots" content="max-image-preview:large">, and use images at least 1200 px wide on pages you want featured. You can do this yourself

Evidence
  • robots meta: (none)

Measured Read the robots and googlebot meta tags.

Rule findability.discover v1 · source: developers.google.com

Search engines are allowed to list your site
Evidence

Measured Checked the robots meta tag, the X-Robots-Tag header, and robots.txt for rules that block indexing.

Rule findability.hidden v1 · source: developers.google.com

Your homepage has a clear title
Evidence
  • Title: "Nilabh Ranjan · Nilabh Studio" (29 characters)

Measured Read the <title> tag.

Rule findability.title v1 · source: developers.google.com

Your homepage has a search description
Evidence
  • "Nilabh Ranjan — Principal Performance Engineer, builder, and writer. An independent space for engineering, experiments, writing, and thoughtful digital work."

Measured Read the description meta tag.

Rule findability.description v1 · source: developers.google.com

Links to your site show a picture and title when shared
Evidence
  • og:title: Nilabh Ranjan · Nilabh Studio
  • og:image: https://nilabhstudio.com/og-default.png
  • Image check: 200, 55 KB
  • In the HTML before JavaScript runs: og:image present, og:title present

Measured Read the Open Graph tags both in the page as first delivered (what preview bots see) and after it finished loading, then requested the image.

Rule findability.share-preview v1 · source: ogp.me

Links shared on X show a large image card
Evidence
  • twitter:card: summary_large_image

Measured Read the twitter:card meta tag.

Rule findability.x-card v1 · source: developer.x.com

Google can read what your product is
Evidence
  • Structured data types found: Person

Measured Parsed JSON-LD structured data blocks on the page.

Rule findability.business-details v1 · source: developers.google.com

Your site has a sitemap for search engines
Evidence
  • https://nilabhstudio.com/sitemap-index.xml
  • Declared in robots.txt

Measured Read robots.txt for a Sitemap line, then tried the standard sitemap addresses.

Rule findability.sitemap v1 · source: sitemaps.org

Visitor privacy

Nothing to fix · 2 working
Good to know

Your homepage loads everything from your own domain

Evidence

Measured All network requests to domains other than nilabhstudio.com. Recorded on first page load with no clicks, scrolling or consent given.

Rule privacy.third-parties v1 · Plainsight rule

No advertising trackers load when someone opens your site — Visitors are not handed to ad networks just for reading your page.
Evidence

Measured Matched every network request against known advertising services, and every cookie against known advertising cookies. Recorded on first page load with no clicks, scrolling or consent given.

Rule privacy.advertising v1 · source: gdpr.eu

No cookies are placed on first visit
Evidence

Measured All cookies in the browser after load, matched by name against well-documented tracking cookies. Recorded on first page load with no clicks, scrolling or consent given.

Rule privacy.cookies v1 · source: gdpr.eu

Security

Nothing to fix · 5 working
Good to know

Your site announces its software versions

Not a hole by itself, but it makes it easy to look up known weaknesses for that exact version.

What to do: Ask your host or developer to hide version numbers in headers and generator tags.

Evidence
  • Generator tag: Astro v7.3.8

Measured Read the Server and X-Powered-By response headers and the generator tags in the page.

Rule security.version-disclosure v1 · source: owasp.org

Your site uses a secure connection (HTTPS)
Evidence
  • Final address: https://nilabhstudio.com/

Measured Checked the address the browser ended up on after redirects.

Rule security.https v1 · source: web.dev

The old http:// address forwards to the secure one
Evidence
  • http:// returned 308 → https://nilabhstudio.com/

Measured Requested http://<your domain>/ without following redirects.

Rule security.http-redirect v1 · source: web.dev

Your security certificate is valid for 81 more days
Evidence
  • Issuer: YR2
  • Protocol: TLS 1.3
  • Expires: 2027-01-11

Measured Read from the TLS connection the browser made.

Rule security.certificate v1 · source: letsencrypt.org

All six recommended security headers are set
Evidence
  • ✓ HSTS — forces browsers to always use the secure connection
  • ✓ X-Content-Type-Options — stops browsers guessing file types (a known attack route)
  • ✓ Clickjacking protection — stops other sites embedding yours invisibly to trick clicks
  • ✓ Content-Security-Policy — limits which scripts may run on your pages
  • ✓ Referrer-Policy — controls what your page addresses reveal to other sites
  • ✓ Permissions-Policy — switches off camera, microphone and location access you don't use

Measured Read the response headers of the homepage. Passive check: only the headers and page any visitor receives. No hidden, admin or login paths were requested.

Rule security.headers v1 · source: owasp.org

Security researchers can find how to contact you (security.txt)
Evidence
  • /.well-known/security.txt: 200

Measured Requested the standard /.well-known/security.txt file (RFC 9116), a public file like robots.txt.

Rule security.security-txt v1 · new check · source: rfc-editor.org

Polish

Nothing to fix · 2 working
Your footer is up to date (© 2026)
Evidence
  • Footer copyright year: 2026

Measured Read the copyright line in the page footer.

Rule upkeep.copyright-year v1 · Plainsight rule

How this check works

What we did

  • Opened your homepage like a phone browser: Pixel 7 (mid-range Android), Slow 4G (150 ms latency, 1.6 Mbps), CPU 4x slower than this computer.
  • Recorded every file, cookie and connection during the first visit, with no clicks or consent given.
  • Read the JavaScript your homepage downloaded from your own domain (the same files any visitor gets) and looked for known secret-key formats. Anything found is masked; the full value is never stored.
  • Read your page as it first arrives, before JavaScript runs, the way link-preview bots on X, LinkedIn and WhatsApp see it.
  • Read your public robots.txt and sitemap, and the http:// version of your address.
  • Checked up to 20 links on your homepage that point to your own site.
  • Every visit identified itself as Plainsight/0.1.0.

What we didn't do

  • No logging in, no form submissions, no guessing hidden or admin pages.
  • No attempts to break in or test for vulnerabilities.
  • No AI judged your site. Every finding comes from a written rule you can read.
  • This report contains no trackers and loads nothing from other websites.

Findings marked Best guess come from patterns in the page and can be wrong. Speed is a lab measurement and can vary by about 20% between runs. The full list of rules is published as the Plainsight methodology. Plainsight 0.1.0.