When a website contradicts itself

What this is about

Most checks measure a website against a norm — against the WCAG, against a law, against a recommendation from Google. This one does not.

Here two statements that both come from your website are put side by side to see whether they fit together. A service the page loads but the privacy policy does not name. Opening hours that read differently in the text than in the structured data. A page that tells visitors “does not exist” and tells search engines “all fine”. A sitemap entry for a page that itself says noindex.

On top of that, the simplest question of all: can a prospect get from your website to a human being?

Why it matters

The appeal of this category is that there is nothing to argue about. With a contrast value you can argue about the norm. With a threshold you can ask who set it. Here two of your own statements stand side by side — there is no authority to argue against.

The case that matters most in practice is the undocumented service. Your page loads something from a third-party server, and that provider is not named in your privacy policy. That rarely happens out of carelessness — it happens because a plugin was installed and the privacy policy is a year older. Whether this amounts to a breach of the information duties under Art. 13 GDPR depends on the processing and the contracts behind it; that is a legal question. The contradiction itself is a fact.

A sharper case is a subdomain that is technically foreign. analytics.yourdomain.com looks like your server, but in the DNS it points to a service provider's server. That construction exists for exactly this: tracking blockers do not catch it, and a cookie set through it counts as a first-party cookie with a correspondingly long lifetime. The page says “this is mine”, the DNS says something else.

Fairness includes the other direction: your own CDN under your own subdomain is not a third-party company. Anyone who distinguishes only by whether the hostname differs from the site's ends up with their own image server on a list of undocumented recipients.

With opening hours it is about something concrete: the marked-up version is what appears next to your search result. If it says something different from the contact page, the wrong information sits in the place more people see.

And reachability: here we are talking about things no norm regulates and that still decide whether someone calls. Is the phone number clickable, so that it starts the call on a phone? Does it even look like a real German number? Is there any way at all to a human being — number, form, email?

Because this is not a norm, it also does not belong under a heading that lends it an authority it does not have. It is an observation, not a requirement.

On the copyright year in the footer, which people like to smile at: on its own it is a trifle. On a website under a maintenance contract, a year nobody has touched is a fair question about what else has not been touched.

How to check it yourself

For the undocumented services: open the developer tools (F12), “Network” tab, reload the page, sort by domain. Write down all foreign domains. Then open your privacy policy and tick them off. Whatever remains is the finding.

For the opening hours: search for your company name on Google and compare the hours shown with those on your contact page.

For the phone number: open the page on your phone and tap the number. Does the call start?

For the contradiction between visitor and search engine: open a page that shows an error message and check in the developer tools (“Network” tab, first row) which status code is delivered. “Page not found” in the text plus status 200 is exactly this case.

And for the year: take one look at the footer.

What to do if it is missing

Keep a list of the services you embed and maintain it together with the privacy policy. Best with every plugin change: when a plugin brings a third-party service along, it goes into the policy in the same step.

Add missing providers — or remove the service. The second option is often the better one, because many of these embeds come from a trial phase nobody cleaned up.

Check for every subdomain where it actually points. If it leads to a service provider, that provider has to be named.

Bring the opening hours together in one place and derive both text and markup from the same source. In a MetaBox setup that means: one field group from which both are generated — then they cannot drift apart at all.

Make the phone number clickable, with tel: and international notation. The national form stays visible.

And the copyright year: set it dynamically instead of forgetting it every January. In Etch the built-in dynamic date takes care of that — no snippet needed.

Sources

• Contradiction between a loaded third-party service and your own privacy policy; an origin that cannot be identified is reported as unidentified rather than guessed, because naming the wrong company is worse than naming none; privacy policy names services the page does not use at all; page tells visitors “not there” and search engines “fine”; subdomain on your own name as an alias for a foreign server, so that tracking blockers do not catch it and a cookie gets first-party lifetime; sitemap entry the page itself forbids; written and marked-up opening hours differ, the marked-up version fills the panel next to the search result; your own CDN under your own subdomain is not a third-party company and is distinguished by name ownership rather than by a differing host; no norm is claimed, two of your own statements stand side by side; the legal assessment under Art. 13 GDPR is not made -- @ctx:projects-tools-checky-workbench-docs-tech-specs-probe-catalog-trust@7
• Copyright year, clickable phone numbers, plausibility of German phone numbers and the existence of a way to a human being as a category of their own, because none of these points is a norm or a law and a heading would lend them an authority they do not have; the copyright year only carries weight in the context of a maintenance contract; the year comes from the configuration rather than the clock, so that stored comparisons stay valid; the reachability check compares subscriber digits, because the correct implementation writes nationally and links internationally -- @ctx:projects-tools-checky-workbench-docs-tech-specs-probe-catalog-experience@7
• GDPR Art. 13/14 information duties at the point of collection; data processing agreements with every processor including hosting and analytics -- @ctx:atlas-legal-dach-website-compliance-stack@1
• Etch provides the current date as site.currentDate -- @ctx:atlas-wordpress-plugins-etch-dynamic-data@3
• Date output through the modifier .dateFormat(format) in PHP DateTime syntax, for example {site.currentDate.dateFormat("Y")} for the year -- @ctx:atlas-wordpress-plugins-etch-dynamic-data-modifiers@3