Website readiness profile · Snapshot 23 October 2026

on.com

on.com's public homepage, certificate and DNS checked against 31 practices and compared with 5,718 E-Commerce & Marketplaces sites.

Readiness index: 84/100
Ahead of: 94%
Practices observed: 24/31
Popularity band: Top 10K

Measured 2026-10-23 12:01:11 UTC from one location. How we measure

Readiness by lane

Green: on.com. Thin bar: E-Commerce & Marketplaces peer median.

Enable

92/100

Peers 86

Harden

77/100

Peers 60

Accelerate

90/100

Peers 69

Recover

0/100

Peers 11

Priority fixes for on.com

Ordered by impact and by how common each practice is among peers.

Priority 1 · Harden
DMARC policy enforces quarantine or reject
Observed: The DMARC policy for on.com was p=none, which asks receivers to take no action on failing mail.
Why it matters: An enforcing DMARC policy helps receiving mail systems reject email that falsely claims to come from your domain, a common route for phishing your customers.
What to do: Publish DMARC with p=none and a reporting address first, fix any legitimate senders that fail SPF or DKIM alignment, then move to quarantine and finally reject.
39% of E-Commerce & Marketplaces peers do this. Limit: Read from public DNS at the time of the check; records may have changed since.
Guide: A Practical Website Health Check for Owners
Priority 2 · Accelerate
Offscreen images lazy-loaded
Observed: The homepage had 40 images and none used loading="lazy".
What to do: Add loading="lazy" to images below the fold. Do not lazy-load the main hero image, because that delays the largest visible element.
72% of E-Commerce & Marketplaces peers do this.
Guide: Lazy Loading Without Broken Pages
Priority 3 · Enable
Social preview image set
Observed: The homepage had no og:image, so shared links may show without a preview image.
What to do: Add Open Graph tags, including og:image with a 1200 x 630 image.
60% of E-Commerce & Marketplaces peers do this.
Guide: SEO Checklist for a New Website
Priority 4 · Harden
security.txt published
Observed: No valid /.well-known/security.txt with a Contact field was returned.
What to do: Publish /.well-known/security.txt with at least Contact and Expires fields, as RFC 9116 requires, and review it before it expires.
On Cloudflare: Cloudflare Security Center can serve a security.txt file for the zone.
7.6% of E-Commerce & Marketplaces peers do this.
Guide: A Practical Website Health Check for Owners

What on.com already does well

Practices fewer than half of E-Commerce & Marketplaces peers use.

CAA records limit who can issue certificatesCAA limits issuance to amazontrust.com, comodoca.com, digicert.com and others.16% of peers
HSTS kept for at least a yearHSTS with a 365-day max-age covering subdomains.32% of peers
Reachable over IPv6IPv6 address published.40% of peers

What we saw

Homepage checked: https://www.on.com/
Homepage response: HTTP 200, after 1 redirect
TLS: TLSv1.3, HTTP/2
Certificate: Google Trust Services, 90-day validity, expiring 2027-01-05
CDN or edge: Cloudflare
Platform or framework: Nuxt
DNS operators: Cloudflare
HSTS: max-age 365 days, includeSubDomains, preload
DMARC policy: p=none
Homepage HTML: 609 KB, br
Images on homepage: 40 (jpg 350, png 24)

Limits: homepage only, one location, one moment. Header checks reflect the homepage response; other pages may differ.

Stack and providers

Seen in the homepage response, certificate and DNS. Provider pages compare how their customers configure the same checks.

Nuxt readiness playbook Nuxt on Cloudflare playbook Cloudflare (cdn and edge platform)Cloudflare (dns operator)Google Trust Services (certificate authority)Service guide: Cloudflare

All 31 checks

Select a gap for the method and fix. How each check works

Not observed 7

Observed 24

HTTP requests move to HTTPS
HSTS kept for at least a year
TLS 1.3 negotiated
Certificate has more than 14 days left
Certificate lifetime of 100 days or less
CAA records limit who can issue certificates
X-Content-Type-Options: nosniff
Framing restricted
Content Security Policy present
HTTP/2 negotiated
HTTP/3 advertised
HTML compressed
Static files cached for 30 days or more
Modern image formats in use
No render-blocking scripts in <head>
robots.txt published
XML sitemap discoverable
Reachable over IPv6
Canonical URL declared
Meta description written
Mobile viewport configured
Structured data present
Page language declared
At most one redirect to the homepage

Own on.com?

Re-run the checks after a change, keep a private action plan in a free workspace, or report a mistake.

Re-check on.com now Add to owner workspace Request a correction or removal

Live status for this site: Status Is Down: on.com. This profile covers configuration only.

Compare with other E-Commerce & Marketplaces sites

E-Commerce & Marketplaces readiness benchmark