The Pulse Check we run on thepulse.net.
Same pipeline, same rubric, same rules as every Pulse Check Pro audit. Our score is public because we couldn't ask anyone to trust the product if we hid ours. This page refreshes daily — what you're looking at was generated by the same audit service Pulse Check Pro customers use.
Most recent successful audit: 28 May 2026 · 13:36 · Pulse Score rubric version 4
thePulse
Solid foundation across all four pillars. Review the lower-scoring sections for incremental wins.
Measured under simulated Fast 3G + 4× CPU throttling (Lighthouse Mobile profile).
Performance
Core Web Vitals captured from a headless Chromium render.
Web vitals timeline headless · cold cache
Modernization
PWA, security, transport, and ecosystem checks derived from the response and manifest.
Brand extraction
Logo, color palette, and typography lifted from the manifest, the OG image, and computed CSS variables.
Manifest icons 4 icons
Typography 1 family
Extracted palette 19 colors
css.theme-color
css.--tpn-bg
css.--tpn-accent-bg
css.--tpn-fg-muted
css.--tpn-n-1000
css.--tpn-border-subtle
css.--tpn-accent-500
css.--tpn-n-800
css.--tpn-accent-700
css.--tpn-info-bg
css.--tpn-bg-active
css.--tpn-fg
css.--tpn-err
css.--tpn-svg-secondary-color
css.--tpn-info
css.--tpn-ok-bg
css.--tpn-accent-100
css.--tpn-err-bg
manifest.theme_color
Captured renders
Viewport captures from the audit pipeline: light, dark, and the social-card image.
Manifest
Parsed contents of /manifest.webmanifest.
/manifest.webmanifest application/manifest+json
{
"name": "thePulse",
"short_name": "thePulse",
"description": "thePulse",
"theme_color": "#0F172A",
"background_color": "#0f1216",
"start_url": "/?ver=#{appVersion}#",
"scope": "/",
"display": "standalone",
"orientation": null,
"lang": null,
"categories": [],
"icons": [
{
"src": "https://thepulse.net/android-chrome-192x192.png",
"sizes": "192x192",
"type": "image/png",
"purpose": null
},
{
"src": "https://thepulse.net/android-chrome-512x512.png",
"sizes": "512x512",
"type": "image/png",
"purpose": null
},
{
"src": "https://thepulse.net/favicon-16x16.png",
"sizes": "16x16",
"type": "image/png",
"purpose": null
},
{
"src": "https://thepulse.net/favicon-32x32.png",
"sizes": "32x32",
"type": "image/png",
"purpose": "monochrome"
}
],
"screenshots": [
{
"src": "https://thepulse.net/images/screenshots/thePulseNet-Services-Wide.png",
"sizes": "1920x1080",
"label": null,
"form_factor": "wide"
},
{
"src": "https://thepulse.net/images/screenshots/thePulseNet-Services-Narrow.png",
"sizes": "1080x1920",
"label": null,
"form_factor": "narrow"
}
],
"shortcuts": [
{
"name": "thePulse Services",
"short_name": null,
"description": "Production-grade .NET software tailored to your domain \u2014 no templates, no boilerplate, no shortcuts.",
"url": "/services",
"icons": [
{
"src": "/android-chrome-512x512.png",
"sizes": "512x512",
"type": "image/png",
"purpose": "any"
}
]
},
{
"name": "thePulse Case Studies",
"short_name": null,
"description": "Production-grade .NET software tailored to your domain \u2014 no templates, no boilerplate, no shortcuts.",
"url": "/case-studies",
"icons": [
{
"src": "/android-chrome-512x512.png",
"sizes": "512x512",
"type": "image/png",
"purpose": "any"
}
]
},
{
"name": "thePulse Pulse Check",
"short_name": null,
"description": "Get a free analysis of your website\u0027s performance, legal compliance, and user experience.",
"url": "/pulse-check",
"icons": [
{
"src": "/android-chrome-512x512.png",
"sizes": "512x512",
"type": "image/png",
"purpose": "any"
}
]
}
]
}Standard files & policy pages
Backend convention files (robots.txt, sitemap.xml, .well-known/*) and user-facing legal pages.
Meta & headers
Raw <meta> tags and selected response headers from the homepage GET.
HTML <meta> tags 25 extracted
Response headers 10 captured
Signals & recommendations
Synthesized from the raw findings, ordered high → low impact.
How we look for it: (1) the largest icon in your /manifest.webmanifest, (2) an obvious <img> near the top of the page with a meaningful alt attribute, (3) the og:image meta tag. Adding any one of these will populate the report's Logo tile. (Captured value: no; earned 0/15.)
How we detect: response headers from the home-page request — cf-ray (Cloudflare), x-amz-cf-id (CloudFront), x-fastly-request-id (Fastly), x-vercel-id (Vercel), x-azure-ref (Azure Front Door), or a recognizable server header. Putting any of these in front of your origin earns the points and gives you HTTPS / HTTP/3 / Brotli for free. (Captured value: no; earned 0/15.)
Serve HTML, CSS, JS, and SVG with Brotli (or gzip as a fallback). Most platforms enable this with a single setting; the bandwidth savings translate directly to faster first paint. (Captured value: no; earned 0/12.)
Your terms should state which jurisdiction's law governs disputes. Any clear governing-law clause now earns the points (was Florida-only in v1). (Captured value: no; earned 0/12.)
Disclose what cookies and trackers your site sets, their purpose, and how to opt out — pairs with the cookie consent banner. (Captured value: warn; earned 0/8.)
How we look for them: <a href> links anywhere on the page (header, footer, contact section) pointing at LinkedIn, X/Twitter, Facebook, Instagram, YouTube, TikTok, or GitHub, plus any URLs in your Organization JSON-LD's sameAs array. We count distinct platforms (capped at 5). (Captured value: 4 platforms; earned 28/35.)
Beyond having a policy page, make sure the page text actually describes the entitlement (window, condition, who pays return shipping). (Captured value: no; earned 0/6.)
Privacy regulators expect a clear retention period and a deletion path. "We keep account data for X days after deletion request" is the floor. (Captured value: no; earned 0/6.)
How we detect: the AI extractor scans your home page, contact page, and footer for a visible email, phone number, or postal address. Required by GDPR / CAN-SPAM / CCPA and most payment providers, and a strong trust signal. (Captured value: no; earned 0/6.)
One-line header that prevents browsers from MIME-sniffing responses into executable types (e.g. interpreting an image upload as HTML). (Captured value: no; earned 0/4.)
Default browser referrer behaviour leaks the full URL to other origins. strict-origin-when-cross-origin is a safe default. (Captured value: no; earned 0/4.)
Allow-list which powerful browser features (camera, microphone, geolocation, USB, fullscreen) your site is allowed to use; reduces blast radius of any XSS. (Captured value: no; earned 0/4.)
INP measures the worst delay between a click/tap and the next paint. Break up long JS tasks (>50 ms), defer non-critical scripts, and avoid heavy synchronous work inside event handlers. (Captured value: 264 ms; earned 16.1/18.)