We sell IT security, managed IT and POPIA compliance scans. We tell businesses every day that they need to look hard at their own systems.
So a few weeks ago someone asked a fair question: had we ever looked at ours?
We hadn't. We ordered an external audit of bytefusion.co.za, read the report, laughed a bit nervously, and spent the last 24 hours fixing things. This post covers what we found.
Finding #1: We couldn't spell our own town
For years our site proudly announced that we serve Hartebeesport.
The town is called Hartbeespoort. We got it wrong 22 times, in page titles, meta descriptions and body copy. Google read every one of them, and presumably so did every local business owner who has lived there for 30 years.
We fixed all 22. We were quite pleased with ourselves for about fifteen hours.
Finding #2: Our office isn't in Hartbeespoort anyway
While filling in the address fields for our structured data, we had to find our real street address. We found it on our own privacy policy page, where it had been sitting the whole time.
Our registered office is in Skeerpoort.
So we had spent a whole evening carefully correcting the spelling of a town we're not actually in. It's like proofreading a wedding invitation and then realising you've got the wrong venue.
We don't only serve one town either. We work with businesses all across South Africa. The next morning, every mention of Hartbeespoort came out of the marketing copy. Twenty-two careful corrections were followed by twenty-something careful deletions. Nobody will ever know the correct spelling was live for a few hours, except you, now.
Finding #3: Three of our pages officially didn't exist
The audit described a seven-page site. The live server had eight.
Our Privacy, Risk Intelligence and Technical Support pages were live and public, and some of you have read them. They had never been committed to our code repository. They lived only on the server, like a lodger who never signed a lease.
So we ran a risk intelligence service whose own Risk Intelligence page had no version control. We've accepted that.
All three are now properly in the repo, and we're pretending this was always the plan.
Finding #4: Google didn't know where our front door was
Our homepage answered at bytefusion.co.za, www.bytefusion.co.za and bytefusion.co.za/index.html. To a search engine those are three separate sites, all claiming to be us.
We had no robots.txt, no sitemap Google could trust, no canonical tags and no structured data. For a search engine, visiting our site was like arriving at a party where everyone insists they're the host.
Now we have one canonical address, proper one-hop 301 redirects, a clean sitemap of all eight pages, lang="en-ZA" on every page, and JSON-LD structured data describing us and our services. Google now knows who we are. Our mothers already did.
Finding #5: The scanner was wrong, and we checked
One automated scan warned that 78% of the images on our homepage were missing alt text. That sounded bad.
We looked. The seven “offending” images were small decorative icons sitting next to visible text labels, inside containers already hidden from screen readers. That's the correct accessibility pattern for decorative images, so there was nothing to fix. Adding descriptions would have helped nobody and cluttered the page.
The lesson, which we also give our clients: a scan result is where the investigation starts, not the verdict.
Finding #6: The mysterious “links not optimized” email
Mid-project, an unsolicited outreach email arrived warning that our “links are not optimized.” There were no details, just a vague sense of doom and probably an invoice waiting in the wings.
Out of professional pride we checked every link that opens in a new tab. All of them had the correct security attributes except one: the Shop button on our homepage.
That button also pointed at our old, retired Shopify address, which then redirected to our real store. So the most important button on the site was taking a small detour on every click.
It's fixed now. To whoever sent that email: technically you were right about one link. You're not getting the contract.
Finding #7: We weren't wearing our seatbelt
We sell IT security, yet our website wasn't sending the standard browser security headers. These tell browsers to always use HTTPS, not to let other sites frame our pages, and to be careful about which scripts they load.
We added a full set, tuned to the few outside services our site really uses. Then we tested the live site to make sure we hadn't locked ourselves out of our own homepage. We hadn't. It was close, though.
The scorecard
In about 24 hours we:
- fixed 22 spelling mistakes, then deleted most of the words we'd just fixed
- found our own office address on our own privacy page
- adopted three orphaned pages
- gave Google one front door instead of three
- added structured data, canonical tags, a sitemap and robots.txt
- added security headers without breaking anything
- successfully ignored a scanner, and mostly ignored a spammer
Every change went through version control, was deployed, and was checked on the live site. We're told that's what grown-ups do.
The actual point
It's easy to spot problems in someone else's systems. Your own website, the one you built and walk past every day, becomes invisible. You stop seeing the typo in your town's name. You forget that three pages never made it into version control.
That's why an outside view helps, and why we do what we do. If our own site hid seven findings, yours may hide a few too.
Want us to take a look? We promise to spell your town right. Eventually.