x.com’s homepage scored 94 on Inspectrosite

We pointed Inspectrosite at https://x.com/. It came back HTTP 200 with no redirect, title “X. It’s what’s happening / X,” and scored 94 out of 100, grade A. That sounds like a full homepage win. It isn’t quite that.

What the tool actually saw was a thin JavaScript homepage shell: about 39 visible words, 0 images, 8 inline scripts and no external script files, in a 45.8 KB HTML document fetched in 0.79s. That is not a logged-in timeline or feed. It’s the real HTTP 200 page at x.com/, but it’s still a lean shell rather than the full app UI — the same kind of honesty we used when Amazon, eBay, and Meta notes said they weren’t the storefront.

Disclosure: Inspectrosite is Byteslip’s own free tool. The badge above is a picture of our scan, not proof. You can re-scan x.com yourself and check the same checks.

94 is a check average, not a grade of X

Inspectrosite’s score averages the checks that count. A pass is worth 100, a warning 60, and a fail 0. Info checks are left out. A lean shell with strong security headers can score high even with little visible content. So 94 is how this HTML document did on our checklist — not a grade of X the company, and not a claim that the full product UI looks like this.

The request stayed on https://x.com/ (redirected=false, truncated=false). Inventory: 8 scripts (0 external, 8 inline), 0 images, 1 stylesheet, 21 links, 1 form, ~39 visible words. Across 53 checks: 41 passed, 5 warned, 1 failed, and 6 were info only.

Viewport disables pinch-zoom

The only fail was titled exactly “Viewport disables pinch-zoom”. The viewport meta is present, but its content is width=device-width,initial-scale=1,maximum-scale=1,user-scalable=0,viewport-fit=cover. The tool’s detail: visitors with low vision can’t zoom the page.

The five warnings, by their exact titles

• 2 <h1> headings (should be 1). The check doesn’t name the heading text, so we won’t invent it.
• 2/4 landmarks (header, nav, main, footer). Found: header:false · nav:true · main:false · footer:true.
• Inline JS totals 14.0 KB. Eight inline script blocks; no external script files.
• Very little visible text (~39 words). The check itself says: “If the content is rendered by JavaScript, crawlers and link previews that don’t run JS see just this. Fine for a deliberate splash/landing page.”
• robots.txt blocks this page for other crawlers. Detail: Disallow: / under User-agent: * matches /. Googlebot has its own group that allows it, but Bing and other crawlers are blocked.

On indexing, the tool also reported a separate verdict of risk because of that thin text (~39 words), while still saying: HTTP 200; robots.txt allows this path (“No rule matches this path, so crawling is allowed.”); no noindex; self-referencing canonical. So the same scan both flagged a soft-404 risk for thin text and said the path is allowed — plus the SEO warning that other crawlers are blocked. We’re quoting both rather than inventing a reconciliation.

robots.txt itself was fetched (HTTP 200, 3.0 KB, 11 groups, including a Googlebot-specific group) and lists 2 sitemaps (not fetched): https://x.com/sitemap.xml and https://x.com/sitemaps/finance0.

Lean HTML, strong security headers

Connection: HTTPS; “HTML fetched in 0.79s”; “HTML document is 45.8 KB” (46,940 bytes). Structure: doctype; lang=en; charset utf-8; viewport present (with the pinch-zoom fail above); title “X. It’s what’s happening / X” (28 chars); meta description 109 chars (“Good length.”); canonical https://x.com/; favicon via apple-touch-icon; theme color #FFFFFF; manifest /manifest.json; heading order logical (2 headings); 20 unique IDs; no obsolete tags.

JavaScript: no document.write; no console.log leftovers in inline scripts; no inline event handlers; no empty scripts. Detected tech (info): Cloudflare (cf-ray header). SEO/social: 3/3 Open Graph tags and consistent; Twitter/X card present (summary_large_image); no structured data / JSON-LD (info). Accessibility: no <img> tags (info); no layout-shift check needed (info); all 1 buttons have names; all 1 fields are labeled; 21 links all with text; no skip link (info). Performance: 9 blocking resources (8 JS + 1 CSS) — pass; 5 HTML comments — pass (“Looks minified already.”).

Security all passed: HSTS enabled (7305 days) — Strict-Transport-Security: max-age=631138519; includeSubdomains; X-Content-Type-Options: nosniff; clickjacking protection via CSP frame-ancestors plus X-Frame-Options: SAMEORIGIN; no mixed content; 17 new-tab links all with rel=noopener; no meta-refresh; a CSP header is present (we’re not pasting the policy — it includes a nonce and a long host list); referrer policy set (strict-origin-when-cross-origin, Referrer-Policy header); 1 form posts securely.

Where 94 sits next to the others

The earlier notes: google.com scored 75, wikipedia.org scored 89, and hawaii.gov scored 67 while its portal scored 91. amazon.com’s bot-check page scored 82, ebay.com’s 403 page scored 78, and meta.com’s 400 page scored 75. toyota.com’s homepage scored 78, walmart.com’s homepage scored 85 (wal-mart.com didn’t connect), and byteslip.org’s homepage scored 100 — that last one is our own site and our own tool, so read it as a self-check, not an independent audit.

Among sites we do not operate, 94 sits above portal.ehawaii.gov’s 91 and wikipedia.org’s 89, with the caveat that this was a thin JS homepage shell rather than a content-heavy public page.

Scores change

This scan ran at 3:29 AM Hawaii time (HST) on November 6, 2026. Homepages change, and Inspectrosite gets updates too. Re-scan x.com yourself, or try your own site.