tiktok.com’s homepage scored 78 on Inspectrosite

We pointed Inspectrosite at https://tiktok.com/. The server redirected to https://www.tiktok.com/, returned HTTP 200, and scored 78 out of 100, grade C. That is not the logged-in For You feed.

What the tool actually audited was a JavaScript-heavy homepage shell: about 0 visible words, 0 images, 0 links, 0 forms, 69 script tags (62 external, 7 inline), and no stylesheets in the inventory. Title: “TikTok - Make Your Day.” The HTML document was 389.5 KB (398,812 bytes), fetched in 1.61s. So this is a real 200 at www.tiktok.com — but the HTML body Inspectrosite sees without running the app’s JavaScript is essentially empty of readable text, not a populated feed.

Disclosure: Inspectrosite is Byteslip’s own free tool. The badge above is a picture of our scan, not cryptographic proof (the score in the badge URL is a query param and can be spoofed). You can re-scan www.tiktok.com yourself and check the same checks.

78 is a check average, not a grade of TikTok

Inspectrosite’s score averages the checks that count. A pass is worth 100, a warning 60, and a fail 0. Info checks are left out. A big JS shell can still pass a lot of security and structure checks while failing on weight, headings, and visible text. So 78 is how this HTML document did on our checklist — not a grade of TikTok the company, and not a claim that the For You page looks like this in a logged-in browser.

Across 53 checks: 29 passed, 9 warned, 6 failed, and 9 were info only. Redirected=true, truncated=false.

The six fails, by their exact titles

• HTML document is 389.5 KB. “Large HTML document. Everything above ~120 KB slows first paint, especially on mobile.”
• Missing meta description. No meta[name=description].
• No <h1> heading.
• 0/4 landmarks (header, nav, main, footer). Found: header:false · nav:false · main:false · footer:false.
• Inline JS totals 361.9 KB. Seven inline script blocks inside that large document.
• 69 blocking resources (69 JS + 0 CSS).

The nine warnings, by their exact titles

• HTML fetched in 1.61s. Fetch took 1610ms (proxy included).
• No canonical URL.
• No favicon link found.
• No theme-color meta.
• No headings at all.
• 1 render-blocking script(s) in <head>.
• 0/3 Open Graph tags (title, description, image).
• No Twitter/X card tag.
• Very little visible text (~0 words). The check itself says: “If the content is rendered by JavaScript, crawlers and link previews that don’t run JS see just this. Fine for a deliberate splash/landing page.”

On indexing, the tool’s verdict was risk because of that thin text (~0 words), while still saying: HTTP 200; robots.txt allows this path (“No rule matches this path, so crawling is allowed.”); no noindex; and (info) no canonical tag. So the same scan both flagged a soft-404 risk for thin text and said the path is allowed. We’re quoting both rather than inventing a reconciliation.

robots.txt was fetched from https://www.tiktok.com/robots.txt (HTTP 200, 1.5 KB, 3 groups) and allows this page. Info note: no Sitemap: line in robots.txt.

HTTPS, pinch-zoom, security headers

Connection: HTTPS; page reachable (HTTP 200) at the final URL. Structure: doctype; lang=en; charset UTF-8; viewport present with pinch-zoom allowed (width=device-width, initial-scale=1.0); title “TikTok - Make Your Day” (22 chars); web app manifest /manifest.json; 9 unique IDs; no obsolete tags.

JavaScript: no empty scripts; no document.write; no console.log leftovers in inline scripts; no inline event handlers. Detected tech (info): Server: nginx, Powered by: Goofy Node. SEO: page is indexable (no noindex). Accessibility info notes: no <img> tags; no layout-shift check needed; no <button> elements; no form fields; no skip link (recommended). Performance: “0 HTML comments + large file — maybe unminified” still passed (“Looks minified already.”).

Security all passed (8): HSTS enabled (365 days) — Strict-Transport-Security: max-age=31536000; includeSubdomains; X-Content-Type-Options: nosniff; clickjacking protection via CSP frame-ancestors plus X-Frame-Options: SAMEORIGIN; no mixed content; no new-tab links to harden; no meta-refresh; a CSP header is present (we’re not pasting the policy); referrer policy set (strict-origin-when-cross-origin, Referrer-Policy header).

Where 78 sits next to the others

The earlier notes: google.com scored 75, wikipedia.org scored 89, and hawaii.gov scored 67 while its portal scored 91. amazon.com’s bot-check page scored 82, ebay.com’s 403 page scored 78, and meta.com’s 400 page scored 75. toyota.com’s homepage scored 78, walmart.com’s homepage scored 85 (wal-mart.com didn’t connect), byteslip.org’s homepage scored 100 — our own site and our own tool — and x.com’s thin JS homepage scored 94.

TikTok’s 78 matches toyota.com’s homepage 78 and ebay.com’s 403 page 78 on the number, with a very different kind of page underneath: a heavy JS shell with almost no visible HTML text, not an error document and not a content-rich marketing homepage.

Scores change

This scan ran at 3:59 AM Hawaii time (HST) on November 6, 2026. Homepages change, and Inspectrosite gets updates too. Re-scan www.tiktok.com yourself, or try your own site.