Technical
88
MorrowVault — a private check-in app and personal message vault for final messages, voice notes and video, triggered by silence rather than death alone. Audited across all 13 HTML pages via local source analysis, live testing, Google field data (GSC / GA4 / PSI) and Playwright desktop & mobile capture.
MorrowVault sits on an unusually solid technical base: fully server-rendered static HTML on Vercel edge (3 ms TTFB), near-perfect Core Web Vitals, complete structured data, clean robots / canonical / sitemap, all AI crawlers allowed, llms.txt live, and 12/12 pages indexed by Google with zero errors. The points lost are almost entirely on the content and commercial side, not the technical one: weak authority and product-trust signals, near-zero multimodal and brand-entity presence for AI search, and a single waitlist CTA with no pricing. Scoring is calibrated as a non-YMYL emotional consumer product — trust is judged by privacy transparency, real authorship and user feedback, not by legal/financial compliance artifacts.
LCP 1.1–1.3 s mobile, CLS ~0, TTFB 3 ms, 60 KB page weight over 5 requests. Only two small wins left.
Clean crawl/index setup end to end; deductions come from 'unsafe-inline' CSP, passive IndexNow and minor redirect/HSTS gaps.
One clean H1 per page, all titles 46–57 chars, full canonical and OG coverage; five descriptions run long.
25+ JSON-LD blocks, 100% valid, no deprecated types; the dangling Article.publisher @id is the main defect.
Strong Experience & Trust (real founder byline, honest privacy policy); E-E-A-T ≈63 held back by zero third-party endorsement and no at-rest encryption disclosure.
No missing alt text anywhere, but the site carries zero content imagery — no product screenshots at all.
Crawler access is excellent (90/100), but multimodal is 22/100 and brand-entity signal 35/100 — nothing for an AI to cite visually or verify externally.
Fix the GA4 tracking defect (T1) first — organic traffic is currently 100% misattributed to Direct, so every downstream traffic analysis is untrustworthy. Then take the two cheapest high-yield wins: rewrite title/description on the five pages already ranking on page one with 0% CTR (T6) and add defer to icons.js/footer.js (T7). After that, the structural work: unblock the mobile hero CTA hidden behind the cookie banner (T4), state at-rest encryption for a product that calls itself a private vault (T11), and close the keyword/topic mismatch on what-happens-to-accounts-when-you-die (T5).
Order by number (e.g. "how do we fix T5"). By default the audit delivers findings only — no code is changed until you assign a task. Status: ⬜ Open · 🔄 In Progress · ✅ Done.
| # | Item | Status |
|---|---|---|
| T1 | Analytics — Fix GA4 tracking: switch to Consent Mode v2 and restore organic channel attribution (currently 100% misread as Direct) | ⬜ Open |
| T4 | Visual / UX — Stop the mobile cookie banner from covering the CTA; move the homepage mobile primary CTA above the fold | ⬜ Open |
| # | Item | Status |
|---|---|---|
| T5 | SXO / Content — what-happens-to-accounts-when-you-die keyword/topic mismatch → retarget to a precise long-tail term, or add a bank/financial-accounts section with intent splitting | ⬜ Open |
| T6 | On-Page / GSC — Rewrite title/description on the 5 pages ranking page-one with 0% CTR (emergency-access 5.8, final-messages 6.9, dead-mans-switch-alternative 7.4, check-in-without-location 8.2, digital-legacy-vault 14.5) | ⬜ Open |
| T7 | Performance — Add defer to the icons.js/footer.js script tags (mobile Speed Index 3.8s → ~2.5s) | ⬜ Open |
| T8 | Performance / Images — Convert og-default.png (252 KB) to WebP/AVIF under 100 KB | ⬜ Open |
| T9 | Schema — Fix the dangling Article.publisher @id on 9 landing pages (inline name/logo) | ⬜ Open |
| T10 | On-Page — Trim 5 over-length meta descriptions to ≤160 chars (letter 202, elderly 195, dms-email 195, about 172, accounts 165) | ⬜ Open |
| T11 | Product Trust — Document encryption at rest and related data-security handling — the core trust point for a "private vault" holding voice, video and final messages (unrelated to YMYL); optionally cite GDPR/CCPA terms | ⬜ Open |
| T12 | Content / E-E-A-T — Add clickable source links to the cited statistics (Euromonitor / Pew) and re-check freshness of the 2023 figures | ⬜ Open |
| T13 | Content / E-E-A-T — Start collecting and displaying beta-user testimonials / external endorsement (authority signal is currently near zero) | ⬜ Open |
| # | Item | Status |
|---|---|---|
| T2 | Content / Trust — Add a Terms of Service page + footer link + sitemap entry (the product has paid plans and a content-release mechanism, so basic user terms are good practice, not a legal compliance requirement) | ⬜ Open |
| T14 | GEO / Images — Multimodal: add 1–2 real product screenshots (with descriptive alt) to the homepage and each of the 3 core pages | ⬜ Open |
| T15 | GEO / SXO — Convert the generic comparison content into a real <table> and name actual competitors (Vital Watchdog / Cipherwill / DGLegacy / GoodTrust / Evaheld) | ⬜ Open |
| T16 | GEO — Establish the brand entity: LinkedIn / YouTube company pages + sameAs on Organization schema | ⬜ Open |
| T17 | GEO — Expand FAQ answers back to 150–220 words (the long-form text already exists in llms.txt); keep visible FAQ and schema in sync | ⬜ Open |
| T18 | Schema / GEO — Add HowTo JSON-LD to pages that contain numbered steps | ⬜ Open |
| T19 | GEO / Technical — Add the missing /digital-legacy-vault to llms.txt and sitemap; verify all three content inventories match | ⬜ Open |
| T20 | Content / E-E-A-T — Build a standalone Trust & Security page (security architecture, data regions, disaster recovery, certification roadmap) | ⬜ Open |
| T21 | Content / E-E-A-T — Bring in 1–2 domain advisors for endorsement; add professional review/disclaimer notes to sensitive articles | ⬜ Open |
| T22 | Technical / Security — Remove 'unsafe-inline' from CSP (externalise the 3 inline scripts into .js files) | ⬜ Open |
| T23 | Schema — Normalisation: operatingSystem to a string, contactType → "customer service", add mentions:{@id:#app} to Article | ⬜ Open |
| T24 | Technical — Wire active IndexNow submission into the deploy pipeline (indexnow_submit.py) | ⬜ Open |
| T25 | SXO / Commercial — Evaluate publishing a price range / early-bird pricing (closes the Action gap on commercial-intent pages) | ⬜ Open |
| T26 | On-Page / UX — Show visible published/updated dates; add a mobile hamburger menu; bring all tap targets to ≥48px | ⬜ Open |
| # | Item | Status |
|---|---|---|
| T3 | Content / Transparency — Add operator and contact transparency (who runs it, how to reach them) to the privacy policy and footer (not a legal-entity registration requirement) | ⬜ Open |
| T27 | Technical — Add includeSubDomains; preload to HSTS; eliminate the 3-hop www+.html redirect chain; drop the non-standard IndexNow: line from robots.txt | ⬜ Open |
| T28 | Technical / Performance — Pre-compile icons to inline SVG at build time (removes the CLS risk and retires icons.js); fix the style-hover dead code | ⬜ Open |
| T29 | Technical — Confirm the relationship between morrowvault.app and the main domain to avoid duplicate content / diluted authority | ⬜ Open |
| T30 | Content — Moderate the repeated brand phrasing to reduce the "AI-written" feel; add a support prompt to verify-contact-result; add verifiable external identity links to About | ⬜ Open |
Minimal, open robots.txt declaring both Sitemap and IndexNow; self-referencing canonicals across the site with canonical / vercel.json / sitemap in perfect three-way agreement; privacy and verify-contact-result correctly noindex and excluded from the sitemap; single-hop 301/308 redirects in all normal cases; a solid security header baseline (HSTS / CSP / X-Frame / nosniff); all core content, navigation, metadata and JSON-LD present in the raw HTML with no JS-rendering dependency; clean mobile rendering verified live.
'unsafe-inline' — three inline scripts (waitlist form, slide-to-confirm demo, scroll animation) render the XSS protection ineffective. Externalise them, then tighten script-src (application/ld+json is unaffected). · T22<i data-lucide> reserves no box dimensions. Pre-compile to inline SVG at build time. · T28includeSubDomains; preload; the edge www+.html combination produces a 3-hop chain; the IndexNow: line in robots.txt is flagged as an invalid directive by Lighthouse (dragging the Lighthouse SEO score to 92). · T27Classification: an emotional consumer product, not judged under the legal/financial/estate YMYL framework. Trust is measured the way this product should be measured — privacy transparency, a real author with real lived experience, data-security disclosure, user feedback. For an emotional product the founder's personal experience is itself the most relevant experience/expertise signal; legal or compliance credentials are not required.
Every landing page carries a visible author byline (Tim Wang, Founder, with genuine personal backstory — not schema-only); the About page contains a full founder narrative plus Person schema; all content pages hit 1,600–2,100 words without padding; FAQs are written independently per page; a clear product-boundary statement appears site-wide ("Not a legal will or estate-planning service."); the privacy policy is detailed and honestly discloses what the product does not do. Experience and Trust are consequently already strong.
sameAs is empty. Normal for a pre-launch product, but still the main drag on E-E-A-T; close it as soon as you launch. · T13One unique H1 per page with a clean heading hierarchy; every title lands in the 46–57 character range; canonical coverage is complete; internal linking is healthy (33 links on the homepage, ~21 on landing pages); OG and Twitter Card tags are complete; no <img> anywhere is missing alt text.
verify-contact-result has no description (already noindex, so impact is minimal). · T3025+ JSON-LD blocks site-wide, 100% syntactically valid with no deprecated types; a well-formed @graph entity graph on the homepage; nine landing pages consistently ship FAQPage + Article + BreadcrumbList; Article.author is fully inlined; the Offer honestly declares PreOrder.
Article.publisher points at a dangling @id — the complete Organization node exists only on the homepage, so a per-page parser cannot resolve it (paste-ready fix in findings/schema.md). · T9operatingSystem should be a string rather than an array; contactType should be "customer service"; landing-page Article nodes should add mentions:{@id:#app}. · T23HowTo schema, despite several pages containing numbered step sequences. · T18| Metric | Homepage (mobile / desktop) | Landing pages (mobile / desktop) | Threshold |
|---|---|---|---|
| LCP | 1.3s / 0.4s | 1.1s / 0.3s | ≤2.5s ✅ |
| CLS | 0 / 0.0006 | 0 / 0 | ≤0.1 ✅ |
| TBT (≈INP) | 23–70ms / 0ms | 0ms / 0ms | ✅ |
| TTFB | 3ms | 3ms | ✅ |
| Lighthouse Perf | 98 / 100 | 100 / 100 | — |
Total page weight is just 60 KB / 56 KB across 5 requests; fonts are self-hosted woff2 with preload and font-display:optional; Google Analytics loads asynchronously behind the consent gate. Note: CrUX returns no field data for this site (Chrome traffic below threshold), so the figures above are PSI/Lighthouse lab values.
defer to icons.js / footer.js — mobile Speed Index drops from 3.8s to roughly 2.5s for a one-line change. · T7og-default.png is 252 KB — convert to WebP. · T8Technical accessibility scores 90/100: GPTBot, ClaudeBot, PerplexityBot, OAI-SearchBot and Google-Extended all return 200 in live testing; server-rendered static HTML is ideal for AI crawlers; llms.txt is live (29 KB); FAQ and Article schema plus visible bylines are in place. Directional platform readiness: Perplexity ~60 / ChatGPT ~58 / Google AIO ~55 / Bing Copilot ~45.
sameAs, no external home for the brand anywhere. · T16/digital-legacy-vault; HowTo markup is missing. · T19 / T23 / T18No image on the site is missing alt text, and image weight is not hurting Core Web Vitals — the whole site loads in 60 KB.
og-default.png at 252 KB should be served as WebP/AVIF under 100 KB. · T8| Page | Intent match | SXO gap | Primary issue |
|---|---|---|---|
| letter-to-be-opened-after-death | ALIGNED | 65 | No downloadable template, no authoritative citations |
| dead-mans-switch-alternative | MEDIUM | 55 | Generic comparison table, zero security signals |
| digital-legacy-vault | MEDIUM-HIGH | 53 | Behind competitors that have already launched |
| check-in-app-for-elderly-parents | HIGH | 49 | Should be a landing page; competitors publish prices |
| what-happens-to-accounts-when-you-die | CRITICAL | 48 | Keyword/topic mismatch (T5) |
Desktop is strong: visual hierarchy, whitespace and the warm green palette suit a sensitive subject well, and landing pages carry the founder byline in the desktop viewport without scrolling.
prefers-reduced-motion and add a no-JS fallback.Indexation is healthy: the sitemap submits 12 URLs with zero errors, URL Inspection returns PASS on 12/12 pages, and canonicals agree throughout. GSC over the last 28 days (≈ the last 90, as the site is new): 2 clicks, 188 impressions, 1.06% CTR, average position 27.0. CrUX confirms no field data — a traffic-volume issue, not a technical one.
footer.js: GA4 (G-D6PDQSLKC2) only loads gtag.js after the user clicks "Accept" on the cookie banner, so (1) visitors who decline or ignore the banner are never recorded, and (2) the delayed load means document.referrer has already become an internal self-reference by first fire, which is then misread as Direct. Fix with Consent Mode v2. Until this is fixed, treat GA4 organic numbers as unusable and rely on GSC. · T1/emergency-access-for-family (5.8), /final-messages (6.9), /dead-mans-switch-alternative (7.4), /check-in-app-without-location-tracking (8.2), /digital-legacy-vault (14.5). The ranking is already there; only the title and description need rewriting. · T6/about receives a referral link from morrowvault.app; confirm the relationship between the two domains. · T29