CMS
Wix audit: headers the editor will never send
· Configuration notes, not a newsroom.
SiteRune fingerprints Wix from static.wixstatic.com and x-wix headers. CSP and HSTS almost always need Cloudflare in front. The HTML still has to contain words.
Hosted means no arbitrary headers
Wix will not let you set HSTS, CSP, or frame-ancestors in the editor. SiteRune still scores them missing. The fix in the playbook is a proxy — Cloudflare transform rules or equivalent — not another Wix app. Same family as Webflow and Squarespace in the engine.
What the canvas hides
If the hero is a background image with the copy in a canvas, seo-thin and AEO question findings fire even though the preview looks finished. Publish real text, a title, a description, Organization JSON-LD, and an llms.txt at the origin. We fetch HTML. We do not run the Wix client runtime.
Run it on a live URL
The brief will name your CMS and attach the files. Three guest scans, no card.