ongboit.com — SEO + GEO Audit

CWV (Core Web Vitals) — Google's UX metrics: LCP (load), INP (responsiveness), CLS (visual stability). They feed ranking + the Technical score.

LCP — Largest Contentful Paint — when the largest element renders. Good <2.5s, Poor ≥4.0s. Driven mostly by server response time (TTFB).

INP / CLS — INP = Interaction-to-Next-Paint (target <200ms, replaced FID). CLS = layout shift (target <0.1).

GEO / AEO — Generative / Answer Engine Optimization — being citable by AI engines (ChatGPT, Perplexity, Gemini, AI Overviews), not just ranking in blue links.

llms.txt — An emerging 2026 manifest that tells LLMs which URLs to read. A broken/missing one costs AI-citation coverage.

AI crawler access — Whether bots like GPTBot / ClaudeBot / PerplexityBot are allowed in robots.txt. Blocking them removes you from AI answers.

Schema (structured data) — JSON-LD that labels your content (Article, FAQ, Organization, Person…). Helps both rich results and AI extraction.

Canonical — The <link rel="canonical"> tag declaring the preferred URL for a page — prevents duplicate-content dilution.

Striking distance — Keywords ranking on page 2 (positions 11-20) with real impressions — small wins can push them to page 1.

Crawl budget — How many pages a search engine will fetch per visit. Wasted on junk URLs = important pages crawled less often.

E-E-A-T — Experience, Expertise, Authoritativeness, Trustworthiness — Google's content-quality framework.

Evidence: https://ongboit.com/ — site search <input type="search" name="s" placeholder="Tìm bài viết..."> inside <form role="search"> has no <label> and no aria-label; newsletter <input type="email" placeholder="Email của bạn"> has no <label>, no aria-label, no role=search wrapper. grep: 2

Impact: Screen-reader users get no persistent field name once typing begins; placeholder disappears. Search role partially mitigates the search box but email field is unlabeled. Low SEO impact, real assistive-tech impact.

Evidence: Homepage 101 and post 96 inline `color: #hex` declarations (e.g. figcaption color:#666 on light bg). Foreground/background pairing and WCAG 1.4.3 ratio require rendered DOM; cannot be measured from curl'd HTML. Flagged for Lighthouse/axe pass, NOT scored as a confirmed failure.

Impact: Potential AA contrast issues (e.g. #666 captions) unconfirmed; needs rendered audit to close.

Evidence: Domain-filtered firecrawl_search (includeDomains: wikipedia.org, wikidata.org) for '"Ông Bố IT" Thế DevOps blog ongboit' returned web: [] (empty). No knowledge-panel-eligible entity exists. AI engines (Perplexity/ChatGPT/Gemini) disproportionately cite entities with a knowledge-g

Impact: Establishing a verifiable entity (even via consistent sameAs + author schema + a Wikidata item once notability thresholds are met) raises AI-citation eligibility and disambiguates the brand for E-E-A-T.

Evidence: /about page links to https://www.youtube.com/@nextgrowth-ai (titled 'NextGrowthWithAI') and https://github.com/thenguyenvn90, plus https://nextgrowth.ai/. Brand-name searches for 'Ông Bố IT'/'ongboit' on youtube.com and github.com returned web: [] — the author's owned channels do

Impact: Consolidating naming (cross-brand 'Ông Bố IT (NextGrowth)' on YouTube/GitHub, pinned links both ways) concentrates brand-signal and lets existing channel authority reinforce ongboit.com.

Evidence: firecrawl_search includeDomains [viblo.asia, spiderum.com, tinhte.vn, reddit.com] for the brand returned web: []. WebSearch '"ongboit" OR "Ông Bố IT" viblo OR tinhte OR spiderum' surfaced only unrelated Spiderum content; no brand match. Viblo in particular is the primary VN techn

Impact: 3-5 well-cited Viblo/Spiderum cross-posts would create authoritative third-party citation paths and likely lift Vietnamese-language AI-engine citations for Claude Code / n8n topics.

Evidence: firecrawl_search: TikTok @ongbo.it (videos ~119 likes) and a second handle @ongboit (channel '217 Lượt thích' total). Two handles dilute follower consolidation. Only one organic third-party mention found anywhere (Threads @irenejuann referencing 'ongboit.com ... dashboard về SEO

Impact: Consolidate to a single TikTok handle (301-redirect followers/bio-link the secondary), which strengthens the social sameAs signal and avoids splitting audience.

Evidence: Phase 3 noted only 4 sameAs platforms (recommend >=5). /about links GitHub, LinkedIn, Facebook (ongboitvuitinh), YouTube, TikTok (@ongbo.it) — but the TikTok-second-handle and the cross-brand mismatch mean sameAs likely does not include all live profiles, and linked profiles do n

Impact: Add TikTok + nextgrowth.ai to Organization/Person sameAs and make every linked profile bio say 'Ông Bố IT' — tightens the sameAs verification loop AI uses to confirm authorship.

Evidence: mcp__dataforseo-mcp__backlinks_summary(target=ongboit.com) -> 'Access denied. Visit Plans and Subscriptions to activate your subscription' (Code 40204). No measured referring-domain/backlink count obtained.

Impact: Activate a DataForSEO Backlinks subscription (or use Moz / Ahrefs / the GSC Links report) to get measured authority data next audit. Blocks precise gap quantification today.

Evidence: DataForSEO ranked_keywords avg_backlinks_info for the SERPs ongboit competes on: 'claude code' competitors avg referring_main_domains ~2,940; 'claude code download' ~4,567. ongboit ranks pos 71-83 on these. Strong content (seo-page score 88) ranking page 7-8 => the limiter is off

Impact: A focused link-building + digital-PR program (guest posts on Viblo/Spiderum, HN/Reddit citations, dev community profiles) is the highest-leverage off-page action to unlock page-1 for the marquee terms.

Evidence: Cross-agent: geo-brand-mentions found only TikTok handles + 1 Threads mention and zero presence on Reddit/YouTube/GitHub/Viblo/Wikipedia under the brand. Consistent with a fresh domain ranking only is_new keywords.

Impact: Establishes the baseline: almost any quality referring domain is incremental authority. Prioritize 5-10 foundational citations (author bios, dev directories, community profiles) first.

Evidence: Homepage HTML contains no CMP signature (grep for cookieyes|complianz|cmplz|onetrust|usercentrics|cookiebot|borlabs|moove_gdpr = 0 matches) yet loads https://www.googletagmanager.com/gtag/js?id=GT-K8HP8DDM and calls gtag('config','GT-K8HP8DDM') unconditionally. Vietnam Decree 13/

Impact: Analytics + email PII processed before consent; PDPD non-compliance for the Vietnam market and a GDPR risk for any EU visitors. Highest-priority compliance fix.

Evidence: Homepage has <input type="email" placeholder="Email của bạn"> Subscribe form; /contact/ returns 200. No consent checkbox and no CMP present to gate submission. Source: curl -s https://ongboit.com/ | grep email/form, /contact/ HTTP 200, 2026-06-02.

Impact: Email is personal data under PDPD; collecting it without an explicit consent affirmation weakens lawful-basis posture. Add an unticked consent checkbox linking the privacy policy.

Evidence: Assets expose ?ver=1.4.5 and ?ver=7.0; <meta name="generator" content="Site Kit by Google 1.179.0">. Reveals exact plugin/component versions, easing targeted exploitation. Source: curl -s https://ongboit.com/ | grep ?ver=/generator, 2026-06-02.

Impact: Low direct privacy impact but aids attacker reconnaissance; remove version query strings and generator meta.

Evidence: curl -sIL https://ongboit.com/ returns no Set-Cookie header for anonymous requests (caching/static front page). Secure/HttpOnly/SameSite flags therefore could not be measured; assessment deferred to authenticated/session contexts. Source: curl -sIL, 2026-06-02.

Impact: Not a defect — informational. WP login/session cookies (wordpress_*) should still be re-checked for HttpOnly+Secure in an authenticated session.

Evidence: curl -sIL https://ongboit.com/llms.txt → HTTP/1.1 301 Moved Permanently, header 'X-Redirect-By: Rank Math', Location: https://ongboit.com/wp-content/uploads/2026/04/llms.txt; following that target → HTTP/1.1 404 Not Found (curl FINAL_CODE: 404, size 0). Canonical /llms.txt theref

Impact: Deploying a valid /llms.txt (and removing the dead Rank Math redirect) gives AI crawlers a curated map of ~140 pages, improving citation eligibility in ChatGPT/Perplexity/Claude/Gemini for high-intent VN queries (e.g. 'claude code la gi', 'n8n self-host'). Emerging standard; low

Evidence: Response header 'X-Redirect-By: Rank Math' on the 301 from /llms.txt to /wp-content/uploads/2026/04/llms.txt (404). The redirect was configured in Rank Math (date stamp 2026/04) but the target upload no longer exists. The fix must delete/replace this redirect, otherwise a static

Impact: Removing the stale redirect prevents the new llms.txt from being shadowed by the broken 301; avoids serving a redirect-to-404 to AI agents that probe /llms.txt.

Evidence: firecrawl_map (sitemap-backed) returned ~140 URLs with clean taxonomy: 5 category hubs (/category/claude-code, /category/n8n, /category/self-hosting, /category/ai-101, /category/codex-cli), core pages (/about, /blog, /contact, /dich-vu), VN legal pages (/dieu-khoan-su-dung, /chin

Impact: A curated llms.txt covering the 5 category hubs + ~20-25 flagship tutorials/glossary pages maximizes AI-engine comprehension with minimal maintenance, giving the buyer a deployable deliverable.

Evidence: Computed from observed signals. Google AIO=72/100 (structure 32/40, authority 18/30, technical 22/30); ChatGPT=68/100 (entity 18/35, content 35/40, crawler 25/25); Gemini=64/100 (ecosystem 18/35, KG 16/30, content 30/35); Bing Copilot=60/100 (index 15/30, content 25/30, ecosystem

Impact: Roadmap: closing entity + community gaps lifts average ~64 -> ~78

Evidence: curl https://ongboit.com/llms.txt returns 301 redirecting to https://ongboit.com/wp-content/uploads/2026/04/llms.txt which returns 404. No working llms.txt served at root. Affects all 5 AI engines that consume the emerging llms.txt convention for content discovery.

Impact: Cross-platform AI discoverability; cleaner crawl guidance for ChatGPT/Perplexity/Gemini

Evidence: Article /claude-code-audit-geo-ai-search/ has question-format H2s ('GEO la gi va business impact 2026 ra sao?') and the body discusses FAQPage, but the JSON-LD @graph contains only Person, WebSite, ImageObject, BreadcrumbList, WebPage, Person(author), BlogPosting -- no FAQPage ty

Impact: Higher passage-level citation rate on ChatGPT + Perplexity for question queries

Evidence: firecrawl_search for '"ongboit" OR "Ong Bo IT" Claude Code blog' returned only self-owned pages + Facebook + TikTok + one Threads mention. No Wikipedia article, no Wikidata item, no Knowledge-Graph indicator. Wikipedia presence is the strongest entity signal for ChatGPT web searc

Impact: Entity recognition uplift for ChatGPT (18/35 -> ~26) and Gemini KG signals

Evidence: Brand-mention search surfaced Facebook, TikTok (#ongboit hashtag), and a third-party Threads post -- but zero Reddit threads, Stack Overflow, or Q&A-forum discussion. Perplexity heavily weights Reddit + forum validation; presence here is social-broadcast only, not community-discu

Impact: Perplexity community score 9/30 -> ~18/30 with seeded authentic discussion

Evidence: Person schema sameAs = [facebook.com/ongboitvuitinh, github.com/thenguyenvn90, tiktok.com/@ongbo.it, linkedin.com/in/minh-the-nguyen-...]. 4 platforms (Phase3 M1 recommends >=5). No YouTube channel (Gemini ecosystem gap) and no sameAs to Wikidata/Crunchbase to anchor the entity f

Impact: Entity disambiguation across ChatGPT + Gemini; small but compounding

Evidence: No IndexNow key file referenced and no msvalidate.01 meta tag observed in homepage HTML head scan. Bing Webmaster Tools verification status is unverifiable from external analysis. Bingbot itself is allowed (robots wildcard-open), so Copilot can crawl -- but faster index freshness

Impact: Faster Bing index refresh -> fresher Copilot answers

Evidence: Phase3 H1: CSP, HSTS, X-Content-Type-Options, X-XSS-Protection, Referrer-Policy, Permissions-Policy all absent. Not a direct citation blocker, but HTTPS/security hygiene is a soft trust input for AIO source-quality and Copilot enterprise-context ranking. Listed here as a shared d

Impact: Marginal trust uplift across AIO + Copilot

Evidence: https://ongboit.com/ ships TWO unlinked identity blocks: (a) Rank Math @graph node @id=https://ongboit.com/#person type=Person name='Ông Bố IT' sameAs=[facebook.com/ongboitvuitinh, github.com/thenguyenvn90, tiktok.com/@ongbo.it, linkedin.com/in/minh-the-nguyen-6b995960]; (b) a se

Impact: Removes entity ambiguity so AI engines resolve one canonical 'Ông Bố IT' node instead of two competing ones; consolidates sameAs into a single authoritative entity.

Evidence: BlogPosting @id=.../tiet-kiem-token-claude-code/#richSnippet and About Article both set publisher -> {@id: https://ongboit.com/#person} (a Person node). Google Article rich-result guidance expects publisher as an Organization carrying a logo ImageObject. The Organization block th

Impact: Restores valid Article publisher signal (Organization+logo) for rich-result eligibility and clearer publisher entity for AI attribution.

Evidence: #person sameAs covers 4 platforms (LinkedIn, GitHub, TikTok, Facebook). No Wikidata entity, no X/Twitter, no YouTube channel linked. No Wikipedia (likely N/A for this entity size). Source: home/post JSON-LD #person + author/ongboit138 nodes, 2026-06-02.

Impact: Each additional verified profile strengthens cross-platform entity resolution for AI engines; Wikidata is the highest-value addition if/when an entity exists.

Evidence: String 'speakable' not present in JSON-LD on home, /about/, or /tiet-kiem-token-claude-code/ (grep=False, 2026-06-02). No cssSelector/xpath markup signalling voice/AI-readable sections.

Impact: Adds an explicit AI-assistant/voice readability signal pointing engines to the TL;DR and FAQ answers — underused GEO lever for a tutorial-heavy blog.

Evidence: author Person @id=https://ongboit.com/author/ongboit138/ image.url=https://ongboit.com/wp-content/uploads/2026/03/ongboit-logo-transparent-150x150.webp (the brand logo, caption 'Nguyễn Minh Thế'). Author node also omits knowsAbout and worksFor that the homepage #person carries. S

Impact: A genuine author headshot plus knowsAbout/worksFor on the author node improves E-E-A-T and author-entity verification for AI engines.

Evidence: https://ongboit.com/tiet-kiem-token-claude-code/ block 1 type=FAQPage with 7 well-formed Question/acceptedAnswer pairs. Since Aug 2023 Google shows FAQ rich results only for government/health authority sites; this is a non-authority blog so no rich result will render. Schema is v

Impact: Keep as-is: no Google rich-result benefit but retains genuine Q&A semantic value for AI answer engines.

Evidence: curl -D - https://ongboit.com/ (2026-06-02): response headers contain only Alt-Svc, Content-Type, Date, Link, Server (Apache/2.4.66 Debian), Vary, Transfer-Encoding. None of the 6 security headers returned on any tested URL.

Impact: Trust/safety signal gap; clickjacking + MIME-sniff + downgrade exposure. Low direct ranking effect but a measurable hygiene deficit and easy win. Fix in Apache vhost/.htaccess: add Strict-Transport-Security "max-age=31536000; includeSubDomains; preload", X-Content-Type-Options "n

Evidence: curl -D - https://ongboit.com/ (2026-06-02): no Cache-Control, ETag, Expires, or Last-Modified header on the 200 HTML response. No CDN signals (no CF-*, X-Cache, Via, Age). Origin = Apache/2.4.66 over HTTP/1.1 (Alt-Svc advertises h3 but origin serves 1.1). TTFB measured 0.33-0.34

Impact: Repeat visits and crawler re-fetches are uncached at the edge; every request hits origin PHP. Adds latency risk under load and wastes crawl budget. Put Cloudflare (free) in front for edge caching + HTTP/2/3 + automatic Brotli, and add Cache-Control/ETag for static assets. Improve

Evidence: curl -L https://ongboit.com/llms.txt (2026-06-02): HTTP 301 -> Location https://ongboit.com/wp-content/uploads/2026/04/llms.txt -> HTTP 404 Not Found. Redirect appears Rank-Math-generated.

Impact: The emerging AI-discovery manifest is unreachable, so LLM crawlers that look for /llms.txt get a 404. For a publisher whose explicit goal is AI-engine citations this is a missed signal. Remove the Rank Math redirect and serve a valid llms.txt at the root (200) listing key posts/s

Evidence: curl https://ongboit.com/robots.txt (2026-06-02): User-agent: * / Disallow: /wp-admin/ / Allow: /wp-admin/admin-ajax.php / Sitemap: https://ongboit.com/sitemap_index.xml. No GPTBot/ClaudeBot/PerplexityBot/Google-Extended/CCBot/etc. rules. Live UA tests show GPTBot and ClaudeBot a

Impact: AI bots are not blocked (good for citation goal) but there is no explicit allow either. Optional: add explicit User-agent allow stanzas for the 11 major AI bots (GPTBot, ChatGPT-User, OAI-SearchBot, ClaudeBot, Claude-User, Claude-SearchBot, PerplexityBot, Perplexity-User, Google-

Evidence: Homepage HTML (2026-06-02): only 2 preconnect hints (fonts.googleapis.com, fonts.gstatic.com), no dns-prefetch, no rel=preload. 6 stylesheets in <head>; 11 scripts (0 defer, 2 async). Hero handled reasonably: 1 fetchpriority=high img, 11/12 imgs have width+height, 8 lazy.

Impact: Render-blocking CSS in head plus Google Fonts without preload/font-display can delay LCP. Add rel=preload for the LCP hero and the primary woff2 font, and ensure font-display:swap. Static-signal only; validate against field data in seo-performance.

Evidence: https://ongboit.com/llms.txt returns HTTP 301 -> https://ongboit.com/wp-content/uploads/2026/04/llms.txt which is 404 (curl, 2026-06-02; corroborates Phase 1 signal). Goal includes AI-engine citations, so a dead llms.txt directly undercuts the stated objective.

Impact: AI crawlers (ChatGPT, Perplexity) that honor llms.txt get a 404 instead of a content map; removes an easy AI-citation signal for an AI-coding-topic site.

Evidence: curl -I https://ongboit.com/ shows no Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, or Referrer-Policy (0 matches, 2026-06-02; matches Phase 1 0/6). HTTPS works but no HSTS to enforce it.

Impact: No HSTS leaves a downgrade window; missing X-Content-Type-Options/Referrer-Policy are baseline hygiene reviewers and some trust heuristics expect. Low direct ranking effect, easy win.

Evidence: Phase 1: robots.txt is WP-default (Disallow /wp-admin/ only, Sitemap -> sitemap_index.xml); no AI crawler user-agents addressed. For a site whose goal is AI-engine citations, the absence of explicit allow directives is a missed positioning opportunity (and no control over trainin

Impact: Site cannot signal welcome/blocking intent to AI answer engines; combined with broken llms.txt, AI-discovery surface is weaker than the content quality warrants.

Evidence: https://ongboit.com/blog/page/2/ ... /page/19/ all return HTTP 200 with meta robots 'follow, index' and self-referential canonicals (curl, 2026-06-02). 185 posts at 10/page = 19 archive pages, each thin listing markup. (Pagination correctly 404s beyond page 19 — no soft-200 overr

Impact: Crawl budget spent on low-value listing pages and potential index dilution; Google generally prefers these consolidated or noindex,follow. Minor for a 185-post site but trivially fixable in Rank Math.

Evidence: Raw HTML of /, /blog/, and article pages contains repeated <title>Hours</title>, <title>Toggle Menu</title>, <title>Scroll to top</title> from Kadence inline SVGs (curl, 2026-06-02). Not document-title conflicts (the real <title> is first and correct) but they add meaningless lab

Impact: No ranking penalty; mild a11y/clarity noise. Cosmetic markup hygiene.

Evidence: Homepage/about/blog/category use 'follow, index, ...'; the article /tiet-kiem-token-claude-code/ uses 'index, follow, ...' (curl, 2026-06-02). Functionally equivalent to crawlers but signals two different meta-config paths (theme vs Rank Math per-post), worth normalizing.

Impact: No SEO impact; indicates template/config drift to clean up for consistency.

Evidence: https://ongboit.com/ meta description = 117 chars (Rank Math, scraped 2026-06-02); ~155 chars available before SERP truncation, leaving ~38 chars of unused snippet real estate / no keyword reinforcement.

Impact: Minor CTR uplift; fuller, keyword-bearing snippet in Google SERP.

Evidence: https://ongboit.com/ H1 = 'Hành Trình Zero → Hero với AI Coding và Automation' (scraped 2026-06-02). No primary keyword (Claude Code / AI coding blog) in the on-page H1; weak alignment between H1 and the keyword-rich <title>/og:title.

Impact: Tighter H1↔title keyword alignment can reinforce homepage topical relevance for brand+category queries.

Evidence: https://ongboit.com/ og:title = 'Ông Bố IT | Claude Code, AI Coding & Self-hosting Blog' (scraped 2026-06-02). Social/AI cards may render the literal '&' instead of '&'.

Impact: Cosmetic — cleaner social/AI share-card title.

Evidence: https://ongboit.com/llms.txt returns HTTP 301 -> https://ongboit.com/wp-content/uploads/2026/04/llms.txt which is 404 (curl, 2026-06-02; corroborates Phase 1 signal). Goal includes AI-engine citations, so a dead llms.txt directly undercuts the stated objective.

Impact: AI crawlers (ChatGPT, Perplexity) that honor llms.txt get a 404 instead of a content map; removes an easy AI-citation signal for an AI-coding-topic site.

Evidence: curl -I https://ongboit.com/ shows no Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, or Referrer-Policy (0 matches, 2026-06-02; matches Phase 1 0/6). HTTPS works but no HSTS to enforce it.

Impact: No HSTS leaves a downgrade window; missing X-Content-Type-Options/Referrer-Policy are baseline hygiene reviewers and some trust heuristics expect. Low direct ranking effect, easy win.

Evidence: Phase 1: robots.txt is WP-default (Disallow /wp-admin/ only, Sitemap -> sitemap_index.xml); no AI crawler user-agents addressed. For a site whose goal is AI-engine citations, the absence of explicit allow directives is a missed positioning opportunity (and no control over trainin

Impact: Site cannot signal welcome/blocking intent to AI answer engines; combined with broken llms.txt, AI-discovery surface is weaker than the content quality warrants.

Evidence: https://ongboit.com/blog/page/2/ ... /page/19/ all return HTTP 200 with meta robots 'follow, index' and self-referential canonicals (curl, 2026-06-02). 185 posts at 10/page = 19 archive pages, each thin listing markup. (Pagination correctly 404s beyond page 19 — no soft-200 overr

Impact: Crawl budget spent on low-value listing pages and potential index dilution; Google generally prefers these consolidated or noindex,follow. Minor for a 185-post site but trivially fixable in Rank Math.

Evidence: Raw HTML of /, /blog/, and article pages contains repeated <title>Hours</title>, <title>Toggle Menu</title>, <title>Scroll to top</title> from Kadence inline SVGs (curl, 2026-06-02). Not document-title conflicts (the real <title> is first and correct) but they add meaningless lab

Impact: No ranking penalty; mild a11y/clarity noise. Cosmetic markup hygiene.

Evidence: Homepage/about/blog/category use 'follow, index, ...'; the article /tiet-kiem-token-claude-code/ uses 'index, follow, ...' (curl, 2026-06-02). Functionally equivalent to crawlers but signals two different meta-config paths (theme vs Rank Math per-post), worth normalizing.

Impact: No SEO impact; indicates template/config drift to clean up for consistency.

Evidence: GSC 90d striking distance (pos 8-30, impr>=8): 'claude code pricing' pos 11.0 (29 impr), 'giá claude code pro' pos 8.7 (33 impr), 'claude code giá rẻ' pos 12.9 (37 impr), 'các gói claude code' pos 8.1 (22 impr). All commercial-intent, all mapping to /claude-code-gia-bao-nhieu/ (c

Impact: Pushing the pricing hub from pos 8.5 to top-5 captures the highest-commercial-intent VN queries; realistic with on-page + internal-link consolidation + a few links.

Evidence: GSC top pages: /tiet-kiem-token-claude-code/ 194 clicks + /claude-code-gioi-han-su-dung/ 143 + /claude-code-gia-bao-nhieu/ 86 = 423 of 737 total clicks (57%) from 3 of 185 posts. Long tail (e.g. /claude-md-la-gi/ 38c, /claude-code-vs-code/ 15c) drops off fast.

Impact: Spreading authority from the 3 winners to cluster siblings (internal links + refresh) raises portfolio-wide traffic; pairs with /blog-audit-pipeline decay/cluster work.

Evidence: GSC avg position 7.4; DataForSEO Labs: 'claude code' (SV 33,100) ranks pos ~78. GSC shows the VN-intent variants rank far better (page 1) than the broad English head term. The head term is gated by domain authority (see seo-backlinks BL2).

Impact: Head-term page-1 is a long-game authority play, not an on-page fix; the near-term ROI is the striking-distance VN terms (GG1).

Evidence: GSC: 'ongboit' 47 clicks / 57 impr / CTR 82.5% / pos 1. Homepage / pos 2.0 with 80 clicks. Brand is being searched and clicked - a foundation to build entity authority on.

Impact: Positive signal; reinforce with the knowledge-graph + brand-consolidation work (M1/M4).

Evidence: https://ongboit.com/ — <img decoding='async' src='claude-code-goal-command-hero.webp'> rendered first in post grid; no fetchpriority='high', no <link rel='preload'> in <head>. Image file is 250,806 bytes (250KB) at Content-Length from server. Logo has fetchpriority='high' but is

Impact: Estimated 300-600ms LCP improvement (confidence=low/inferred). fetchpriority='high' and a matching preload hint move the image into the browser's high-priority fetch queue, removing the post-CSS discovery delay.

Evidence: https://ongboit.com/ HTML: <img ... sizes='(max-width: 2400px) 100vw, 2400px'> on a card image rendered at height:180px. srcset includes 300w, 768w, 1024w, 1536w, 2048w, 2400w variants. On a 390px mobile screen the sizes expression resolves to ~390px, so 768w is fetched — still o

Impact: Reduces LCP image transfer weight by ~60-70% on mobile if corrected to sizes matching actual rendered size (approx 350px). Saves ~150-200KB per mobile pageload (confidence=low/inferred).

Evidence: https://ongboit.com/ <head> contains: kadence-global.min.css (28KB), kadence-header.min.css, kadence-content.min.css, kadence-footer.min.css, kadence-rankmath.min.css — all media='all', none deferred or inlined as critical. Combined uncompressed estimated ~80-100KB. source: curl

Impact: Eliminating or inlining critical CSS can reduce render-blocking time by 150-400ms depending on RTT (confidence=low/inferred). Kadence Pro has a Critical CSS feature that should be enabled.

Evidence: https://ongboit.com/ <head>: <link rel='stylesheet' id='kadence-fonts-gfonts-css' href='https://fonts.googleapis.com/css?family=Open%20Sans:regular,700|Rubik:700,regular,500,600|Heebo:500&display=swap' media='all'> — this is a render-blocking cross-origin request. display=swap is

Impact: Adding <link rel='preload' as='font' crossorigin> for the 2-3 primary font files (Open Sans regular, Rubik 500) reduces FOUT and shaves 100-200ms from font-induced layout shifts (confidence=low/inferred).

Evidence: curl -sI https://ongboit.com/wp-content/themes/kadence/assets/css/global.min.css: headers show only Etag and Last-Modified, no Cache-Control or Expires. curl -sI on LCP image (claude-code-goal-command-hero.webp): same — Content-Length: 250806, no Cache-Control. Repeat visitors mu

Impact: Adding Cache-Control: public, max-age=31536000, immutable to versioned static assets eliminates revalidation RTT for returning visitors, reducing page load time by 200-800ms for cached assets (confidence=low/inferred).

Evidence: curl -w '%{time_starttransfer}' https://ongboit.com/: 0.384471s from Frankfurt/EU edge. Apache/2.4.66 on Debian, no CDN caching layer detected in response headers (no X-Cache, no CDN vendor header). Gzip is active (23KB compressed HTML). source: curl timing

Impact: Enabling a full-page caching plugin (e.g. WP Rocket, W3 Total Cache) or CDN-level HTML caching can bring TTFB under 200ms for cached responses. Estimated LCP improvement 200-400ms (confidence=low/inferred).

Evidence: https://ongboit.com/ HTML: <script src='https://www.googletagmanager.com/gtag/js?id=GT-K8HP8DDM' async> — async is correct for load, but GTM containers can inject third-party scripts that run long tasks on the main thread post-load, raising INP above 200ms. No measured data avail

Impact: Auditing GTM container for long-running tags; using Server-side GTM or Partytown can reduce main-thread blocking. Estimated INP improvement variable (confidence=low/inferred).

Evidence: DataForSEO on_page_lighthouse (Lighthouse 13.3.0, desktop simulated) on /tiet-kiem-token-claude-code/: largest-contentful-paint 2769ms, first-contentful-paint 2278ms, speed-index 2673ms, server-response-time 949ms, cumulative-layout-shift 0.002, max-potential-fid 24ms, total-byte

Impact: Full-page caching to cut server-response from ~950ms to <200ms would pull LCP from 2.77s into the green (<2.5s, likely ~2.0s). fetchpriority + cache-control add marginal gains. Now confidence=high (measured).

Evidence: https://ongboit.com/ meta description = 117 chars (Rank Math, scraped 2026-06-02); ~155 chars available before SERP truncation, leaving ~38 chars of unused snippet real estate / no keyword reinforcement.

Impact: Minor CTR uplift; fuller, keyword-bearing snippet in Google SERP.

Evidence: https://ongboit.com/ H1 = 'Hành Trình Zero → Hero với AI Coding và Automation' (scraped 2026-06-02). No primary keyword (Claude Code / AI coding blog) in the on-page H1; weak alignment between H1 and the keyword-rich <title>/og:title.

Impact: Tighter H1↔title keyword alignment can reinforce homepage topical relevance for brand+category queries.

Evidence: https://ongboit.com/ og:title = 'Ông Bố IT | Claude Code, AI Coding & Self-hosting Blog' (scraped 2026-06-02). Social/AI cards may render the literal '&' instead of '&'.

Impact: Cosmetic — cleaner social/AI share-card title.

Evidence: https://ongboit.com/ — <img decoding='async' src='claude-code-goal-command-hero.webp'> rendered first in post grid; no fetchpriority='high', no <link rel='preload'> in <head>. Image file is 250,806 bytes (250KB) at Content-Length from server. Logo has fetchpriority='high' but is

Impact: Estimated 300-600ms LCP improvement (confidence=low/inferred). fetchpriority='high' and a matching preload hint move the image into the browser's high-priority fetch queue, removing the post-CSS discovery delay.

Evidence: https://ongboit.com/ HTML: <img ... sizes='(max-width: 2400px) 100vw, 2400px'> on a card image rendered at height:180px. srcset includes 300w, 768w, 1024w, 1536w, 2048w, 2400w variants. On a 390px mobile screen the sizes expression resolves to ~390px, so 768w is fetched — still o

Impact: Reduces LCP image transfer weight by ~60-70% on mobile if corrected to sizes matching actual rendered size (approx 350px). Saves ~150-200KB per mobile pageload (confidence=low/inferred).

Evidence: https://ongboit.com/ <head> contains: kadence-global.min.css (28KB), kadence-header.min.css, kadence-content.min.css, kadence-footer.min.css, kadence-rankmath.min.css — all media='all', none deferred or inlined as critical. Combined uncompressed estimated ~80-100KB. source: curl

Impact: Eliminating or inlining critical CSS can reduce render-blocking time by 150-400ms depending on RTT (confidence=low/inferred). Kadence Pro has a Critical CSS feature that should be enabled.

Evidence: https://ongboit.com/ <head>: <link rel='stylesheet' id='kadence-fonts-gfonts-css' href='https://fonts.googleapis.com/css?family=Open%20Sans:regular,700|Rubik:700,regular,500,600|Heebo:500&display=swap' media='all'> — this is a render-blocking cross-origin request. display=swap is

Impact: Adding <link rel='preload' as='font' crossorigin> for the 2-3 primary font files (Open Sans regular, Rubik 500) reduces FOUT and shaves 100-200ms from font-induced layout shifts (confidence=low/inferred).

Evidence: curl -sI https://ongboit.com/wp-content/themes/kadence/assets/css/global.min.css: headers show only Etag and Last-Modified, no Cache-Control or Expires. curl -sI on LCP image (claude-code-goal-command-hero.webp): same — Content-Length: 250806, no Cache-Control. Repeat visitors mu

Impact: Adding Cache-Control: public, max-age=31536000, immutable to versioned static assets eliminates revalidation RTT for returning visitors, reducing page load time by 200-800ms for cached assets (confidence=low/inferred).

Evidence: curl -w '%{time_starttransfer}' https://ongboit.com/: 0.384471s from Frankfurt/EU edge. Apache/2.4.66 on Debian, no CDN caching layer detected in response headers (no X-Cache, no CDN vendor header). Gzip is active (23KB compressed HTML). source: curl timing

Impact: Enabling a full-page caching plugin (e.g. WP Rocket, W3 Total Cache) or CDN-level HTML caching can bring TTFB under 200ms for cached responses. Estimated LCP improvement 200-400ms (confidence=low/inferred).

Evidence: https://ongboit.com/ HTML: <script src='https://www.googletagmanager.com/gtag/js?id=GT-K8HP8DDM' async> — async is correct for load, but GTM containers can inject third-party scripts that run long tasks on the main thread post-load, raising INP above 200ms. No measured data avail

Impact: Auditing GTM container for long-running tags; using Server-side GTM or Partytown can reduce main-thread blocking. Estimated INP improvement variable (confidence=low/inferred).

Evidence: DataForSEO on_page_lighthouse (Lighthouse 13.3.0, desktop simulated) on /tiet-kiem-token-claude-code/: largest-contentful-paint 2769ms, first-contentful-paint 2278ms, speed-index 2673ms, server-response-time 949ms, cumulative-layout-shift 0.002, max-potential-fid 24ms, total-byte

Impact: Full-page caching to cut server-response from ~950ms to <200ms would pull LCP from 2.77s into the green (<2.5s, likely ~2.0s). fetchpriority + cache-control add marginal gains. Now confidence=high (measured).

Evidence: curl -D - https://ongboit.com/ (2026-06-02): response headers contain only Alt-Svc, Content-Type, Date, Link, Server (Apache/2.4.66 Debian), Vary, Transfer-Encoding. None of the 6 security headers returned on any tested URL.

Impact: Trust/safety signal gap; clickjacking + MIME-sniff + downgrade exposure. Low direct ranking effect but a measurable hygiene deficit and easy win. Fix in Apache vhost/.htaccess: add Strict-Transport-Security "max-age=31536000; includeSubDomains; preload", X-Content-Type-Options "n

Evidence: curl -D - https://ongboit.com/ (2026-06-02): no Cache-Control, ETag, Expires, or Last-Modified header on the 200 HTML response. No CDN signals (no CF-*, X-Cache, Via, Age). Origin = Apache/2.4.66 over HTTP/1.1 (Alt-Svc advertises h3 but origin serves 1.1). TTFB measured 0.33-0.34

Impact: Repeat visits and crawler re-fetches are uncached at the edge; every request hits origin PHP. Adds latency risk under load and wastes crawl budget. Put Cloudflare (free) in front for edge caching + HTTP/2/3 + automatic Brotli, and add Cache-Control/ETag for static assets. Improve

Evidence: curl -L https://ongboit.com/llms.txt (2026-06-02): HTTP 301 -> Location https://ongboit.com/wp-content/uploads/2026/04/llms.txt -> HTTP 404 Not Found. Redirect appears Rank-Math-generated.

Impact: The emerging AI-discovery manifest is unreachable, so LLM crawlers that look for /llms.txt get a 404. For a publisher whose explicit goal is AI-engine citations this is a missed signal. Remove the Rank Math redirect and serve a valid llms.txt at the root (200) listing key posts/s

Evidence: curl https://ongboit.com/robots.txt (2026-06-02): User-agent: * / Disallow: /wp-admin/ / Allow: /wp-admin/admin-ajax.php / Sitemap: https://ongboit.com/sitemap_index.xml. No GPTBot/ClaudeBot/PerplexityBot/Google-Extended/CCBot/etc. rules. Live UA tests show GPTBot and ClaudeBot a

Impact: AI bots are not blocked (good for citation goal) but there is no explicit allow either. Optional: add explicit User-agent allow stanzas for the 11 major AI bots (GPTBot, ChatGPT-User, OAI-SearchBot, ClaudeBot, Claude-User, Claude-SearchBot, PerplexityBot, Perplexity-User, Google-

Evidence: Homepage HTML (2026-06-02): only 2 preconnect hints (fonts.googleapis.com, fonts.gstatic.com), no dns-prefetch, no rel=preload. 6 stylesheets in <head>; 11 scripts (0 defer, 2 async). Hero handled reasonably: 1 fetchpriority=high img, 11/12 imgs have width+height, 8 lazy.

Impact: Render-blocking CSS in head plus Google Fonts without preload/font-display can delay LCP. Add rel=preload for the LCP hero and the primary woff2 font, and ensure font-display:swap. Static-signal only; validate against field data in seo-performance.

Evidence: GSC 90d striking distance (pos 8-30, impr>=8): 'claude code pricing' pos 11.0 (29 impr), 'giá claude code pro' pos 8.7 (33 impr), 'claude code giá rẻ' pos 12.9 (37 impr), 'các gói claude code' pos 8.1 (22 impr). All commercial-intent, all mapping to /claude-code-gia-bao-nhieu/ (c

Impact: Pushing the pricing hub from pos 8.5 to top-5 captures the highest-commercial-intent VN queries; realistic with on-page + internal-link consolidation + a few links.

Evidence: GSC top pages: /tiet-kiem-token-claude-code/ 194 clicks + /claude-code-gioi-han-su-dung/ 143 + /claude-code-gia-bao-nhieu/ 86 = 423 of 737 total clicks (57%) from 3 of 185 posts. Long tail (e.g. /claude-md-la-gi/ 38c, /claude-code-vs-code/ 15c) drops off fast.

Impact: Spreading authority from the 3 winners to cluster siblings (internal links + refresh) raises portfolio-wide traffic; pairs with /blog-audit-pipeline decay/cluster work.

Evidence: GSC avg position 7.4; DataForSEO Labs: 'claude code' (SV 33,100) ranks pos ~78. GSC shows the VN-intent variants rank far better (page 1) than the broad English head term. The head term is gated by domain authority (see seo-backlinks BL2).

Impact: Head-term page-1 is a long-game authority play, not an on-page fix; the near-term ROI is the striking-distance VN terms (GG1).

Evidence: GSC: 'ongboit' 47 clicks / 57 impr / CTR 82.5% / pos 1. Homepage / pos 2.0 with 80 clicks. Brand is being searched and clicked - a foundation to build entity authority on.

Impact: Positive signal; reinforce with the knowledge-graph + brand-consolidation work (M1/M4).

Evidence: curl https://ongboit.com/sitemap_index.xml = 200, valid sitemapindex with 3 children. The X-Robots-Tag: noindex header is on the sitemap document response only. Verified: first URL in post-sitemap.xml returns HTTP 200 with no X-Robots-Tag noindex. This is correct Rank Math behavi

Impact: No action required - documented so it is not misread as an indexation bug in future audits.

Evidence: curl https://ongboit.com/sitemap.xml returned empty in Phase 1; the working entry point is /sitemap_index.xml, which robots.txt correctly references. Some third-party tools probe /sitemap.xml by default.

Impact: Optional: add a /sitemap.xml -> /sitemap_index.xml alias/redirect for tool compatibility. Google uses the robots.txt declaration so indexing is unaffected.

Evidence: sitemap_index.xml lists only post/page/category sub-sitemaps. Articles are image-heavy (screenshots, diagrams per seo-page/visual agents) but images are not surfaced via an image sitemap.

Impact: An image sitemap could improve Google Images discovery for tutorial screenshots - minor incremental discovery channel.

Evidence: DOM analysis at https://ongboit.com/ (375x812 and 1920x1080 viewports, Playwright, 2026-06-02): totalImages=41, undimensionedImages=30 (73%). Emoji SVGs from s.w.org (15+ instances) have no dimensions; post thumbnail images and content images also missing. CLS score likely above

Impact: Eliminating CLS by adding width/height to all img tags (or using Kadence/WordPress image size settings) can recover Core Web Vital CLS pass and improve ranking eligibility for Top Stories / rich results.

Evidence: DOM getBoundingClientRect() at 375x812 viewport: CTA top=817px, viewport innerHeight=812px. Button is 124x46px. Screenshot (screenshots/mobile.png, 2026-06-02) confirms the button is visible in the screenshot due to rendering timing, but computed position places it below fold. Co

Impact: Moving CTA above 812px fold improves immediate conversion signal and reduces bounce for mobile users arriving from SERP. Small CSS tweak to reduce hero padding.

Evidence: DOM measurement at 375x812 viewport (Playwright, 2026-06-02): BUTTON 'Open menu' w=37, h=31. Google recommends minimum 48x48px touch targets. 25 additional interactive links measured at h=46px (borderline). Hamburger failure is the most critical as it blocks all navigation on mob

Impact: Fixing hamburger to 48x48px min eliminates a Lighthouse accessibility failure and improves mobile UX for the majority of Vietnamese mobile-first users.

Evidence: DOM computed style scan at 375x812 (Playwright, 2026-06-02): 31 p/li/td elements with computed fontSize < 16px. Specific font sizes not individually enumerated, but count is non-trivial. Google Mobile-Friendly test warns on text too small to read.

Impact: Increasing base font to 16px minimum improves readability for Vietnamese mobile users and avoids mobile usability issues in GSC.

Evidence: DOM query 'noscript' returns 0 elements (Playwright DOM analysis, 2026-06-02). However, H1, intro paragraph, CTA, and nav ARE present in raw server-rendered HTML (curl confirms body_length=113,167, h1_content_preview='Hanh Trinh Zero → Hero voi AI Coding va Automation'). Risk is

Impact: Low priority given server-rendered core content. Adding a noscript fallback for the search widget would be a minor improvement for accessibility completeness.