The Bad Site — Website Audit Anti-Pattern Playground
WELCOME TO MY WEBSITE!!!!
★ ★ ★ NO REFUNDS · NO PRIVACY · FAST CRASHES ★ ★ ★
Click here! Or click here! We covered your screen because Google mobile guidelines don’t apply here!
VIP LOGIN (Plain Text!)
FLAW #2: Cleartext PasswordYour password is completely unmasked and visible to anyone standing behind you.
type="password" with optional reveal toggle, and transmit strictly over HTTPS/TLS.AUTOPLAY AUDIO: 240%
FLAW #9: No Audio ControlLoud background audio plays automatically on page load with zero mute toggle.
Title: <title>(empty)</title> ❌
Meta Description: MISSING ❌
H1 Tags: 5 duplicate H1s on one page ❌
Schema JSON-LD: None (Google index: 0 rank) ❌
Layout Shift Simulator (CLS)
FLAW #4: CLS 1.48Late-loading images without fixed dimensions pop into the DOM and push buttons right when you click.
Fatal Server Error (HTTP 500)
FLAW #3: CWE-209Unhandled backend exceptions dump full Java stack traces, database schema, and server paths.
Can you read this text easily? Light yellow on light green has a contrast ratio of only 1.16:1. WCAG AA requires a minimum of 4.5:1. Users with visual impairments or on mobile phones in daylight cannot read this at all!
The 4 Catastrophic Audit Pillars
Deep dive into each architectural breakdown and understand why modern search engines and security scanners flag it.
Cleartext Credentials & Expired TLS
Passwords submitted via unmasked inputs over cleartext HTTP can be read by anyone on the network. Raw stack traces expose database tables and credentials.
- • Insecure cleartext HTTP (No HSTS)
- • CWE-319: Passwords visible on screen and in transit
- • CWE-209: 500 error page dumps raw backend stack traces
6.4s LCP & 1.48 Cumulative Layout Shift
Serving 15MB uncompressed bitmap files without width/height tags stalls the browser parser and causes massive layout jumps when images pop in.
- • LCP: 6.4s (Google threshold is < 2.5s)
- • CLS: 1.48 (Fails acceptable < 0.10 standard)
- • Render-blocking scripts executed synchronously in <head>
Empty Title Tags & Duplicate H1 Chaos
Search bots cannot determine what the page is about. Without meta descriptions, SERP snippets appear blank or pull random button text.
- • Missing <meta name="description">
- • Multiple competing H1 headings violate document hierarchy
- • Zero Schema.org JSON-LD structured data for products
1.16:1 Contrast & Multiplying Popups
Users with low vision cannot read light yellow text on green. Unskippable interstitials destroy mobile navigation and trigger search engine penalties.
- • Contrast ratio 1.16:1 fails WCAG AA minimum 4.5:1
- • Autoplay audio violates WCAG 1.4.2 Audio Control
- • Popups trap keyboard focus and cannot be dismissed
The 10-Point Bad Site Defect Checklist
Identify all 10 catastrophic flaws inside the sandbox above. Your progress is saved locally.
Broken HTTPS & Expired Certificate
SecuritySite is loaded over unencrypted HTTP with an expired SSL certificate badge, exposing data to MITM attacks.
Critical (Severity 10/10)
Plain-Text Password & Credential Leak
SecurityPassword field uses type="text" and leaks what the user typed in plain text, violating CWE-319.
Critical (Severity 10/10)
Raw Stack Trace & Information Disclosure
SecurityServer error dumps internal Java/Spring stack traces and server paths to the public (CWE-209).
High (Severity 8/10)
Severe Cumulative Layout Shift (CLS > 1.0)
PerformanceLate-loading un-dimensioned banner images push buttons down suddenly, causing accidental misclicks.
High (Severity 8/10)
Uncompressed Heavy Images (6.4s LCP)
Performance15MB raw bitmap hero asset blocks rendering, resulting in a 6.4s Largest Contentful Paint.
High (Severity 8/10)
Missing Page Title & Empty Meta Description
SEOTitle is empty ("Document") and meta description is missing, making search ranking impossible.
High (Severity 7/10)
Broken Heading Structure (Multiple H1s)
SEOFive separate H1 tags scattered across buttons and cards; H3 tags appear before H2s.
Medium (Severity 6/10)
Multiplying & Unskippable Spam Popups
UX / AccessibilityAggressive modal interstitials block primary content, triggering Google mobile interstitial penalties.
High (Severity 8/10)
300% Autoplay Audio Without Controls
UX / AccessibilityLoud background sound plays automatically with no mute toggle, violating WCAG 1.4.2 audio control.
Medium (Severity 6/10)
Severe Color Contrast Failure (1.16:1 Ratio)
UX / AccessibilityNeon yellow text on light green background fails WCAG AA minimum 4.5:1 ratio, rendering text unreadable.
High (Severity 7/10)
Bad Website Auditing Quiz
Question-by-question diagnostic quiz. Submit each answer to immediately verify the flaw rationale.
Why is exposing raw backend stack traces in 500 error pages considered a severe security defect?
Ready to see the production-grade benchmark?
Contrast this horror simulation with the Perfect Store (Aura Athletics): 0.8s LCP, zero layout shift, AES-256 tokenization, semantic Schema.org JSON-LD, and zero full-screen ads.
10 Production Anti-Patterns Simulated Safely
Explore 20 Exploit Post-Mortems →The Bad Site intentionally reproduces ten high-impact defects commonly caught in real security and SEO audits: unencrypted HTTP transport, plaintext password exposure, CSP omission, leaked framework 500 stack traces, +0.45 Cumulative Layout Shift interstitials, intrusive modal popups, blocked index directives, broken canonicals, and WCAG 1.16:1 color contrast failures. Toggle the defect inspector to log each issue and validate your remediation understanding in the diagnostic quiz.