Prepared
for
Kendall PC
Live Site Audit forkendallpc.com · Wynnewood, PA
Technical Audit · Verified Live · 2026-08-20

The cookie banner records a refusal.
The ad tags ignore it.

Every page of kendallpc.com was fetched and inspected on August 20, 2026 — all 125 URLs in the sitemap, plus headers, TLS, structured data, the full tracking stack, and a clean-cookie consent test run in a real browser. This report contains only what was observed live. Where an earlier draft assessment was wrong, it is corrected here rather than repeated.

Firm Kendall PC
Scope Technical · Privacy · SEO · Conversion
Method Full crawl + live browser test
Analyst Bryan Fikes
125
Pages crawled · all 200 OK
3×
LinkedIn tag copies per page
5 yr
Since privacy policy updated
62
Of 83 posts link nowhere
BONSAI MARKETING · CONFIDENTIAL
kendallpc.com
2026-08-20
Section 01 · Executive Summary

The content is strong. The plumbing
underneath it is not.

Kendall PC's website is in better editorial shape than most boutique firms twice its size. Titles are keyword-led and correctly sized across every practice page. The blog is deep — a median of 952 words per article — and publishing steadily, with the most recent piece dated July 30, 2026. Structured data is clean and present on all 125 pages. Page speed is good. None of that needs fixing.

What needs attention sits underneath: a consent banner that collects a preference nothing reads, a tracking stack carrying duplicated and unidentified third-party IDs, a privacy policy five years stale that describes a technology stack the site no longer runs, and a set of internal-linking and canonical gaps that quietly split the firm's authority in half.

The through-line: for most firms these are housekeeping items. For a practice that sells GDPR, CCPA, HIPAA and privacy-governance counsel, the firm's own privacy surface is part of the pitch. That is what makes this worth an hour of someone's attention.
A note on method

An earlier draft assessment of this site circulated with three claims that do not survive contact with the live pages. They are corrected below rather than repeated, because a wrong finding in a compliance conversation is worse than no finding at all.

Draft claimWhat the live site actually shows
Practice Areas H1 reads "Class Action Defense Attorneys"Not true. The H1 is Practice Areas. Title: Practice Areas | FDA Compliance & Corporate Law | Kendall PC (60 characters — correctly sized).
Legal notices claim "We guarantee 100% privacy"Not found anywhere across 125 pages. This quote should not be attributed to the firm.
Title tags and homepage lack search positioningOverstated. Titles are already strong sitewide. The weaker signal is the homepage H1 ("Bold Counsel for Today's Business") — not the title tag.
Section 02 · Cookie Consent
Priority 0 · Immediate

The banner asks. Nothing listens.

This was tested directly, in a real browser, with every cookie cleared first — and deliberately on the privacy policy page itself. The consent banner was still displayed and un-actioned. Every non-essential category was recorded as declined.

Recorded consent state at time of testcookielawinfo-checkbox-advertisement = no cookielawinfo-checkbox-analytics = no cookielawinfo-checkbox-performance = no

With that refusal on record, the following had already loaded and transmitted:

Loaded despite refusalgoogletagmanager.com/gtm.js?id=GTM-NWPTQWF googletagmanager.com/gtag/js?id=GT-PH3VB86Q google-analytics.com/analytics.js ← legacy Universal Analytics s.adroll.com/j/Q662CQHHTBEERDPAEE76NW/roundtrip.js snap.licdn.com/li.lms-analytics/insight.min.js Outbound beacons firedpx.ads.linkedin.com ipv4.d.adroll.com stats.g.doubleclick.net Advertising cookies written before consent_gcl_au · __adroll_fpc · __ar_v4 · _ga · _gid _ga_BH9SXK13F8 · _ga_F8YKJP02GP · _gat_UA-208884916-1

Why it happens

The site runs the WebToffee/CookieYes plugin (cookie-law-info). That plugin blocks scripts by rewriting them to type="text/plain" until consent is granted. Across all 125 pages of kendallpc.com there are zero such rewritten tags — because the advertising and analytics tags are hard-coded directly into the theme, where the plugin never sees them.

So the banner is functioning exactly as installed. It records a preference. Nothing downstream reads it.

This is an implementation gap, not a finding of legal violation — that determination belongs to the firm's own privacy counsel, who are considerably better placed to make it than we are. What we can say with certainty is that the mechanism a visitor sees does not govern the behavior that follows, and this is observable by anyone who opens developer tools on the privacy policy page.
Section 03 · Tracking Stack Integrity
Priority 0 · Immediate

Duplicated tags, and one account
nobody has identified.

The tag configuration is uniform across all 125 pages — meaning this is a template-level issue, not a stray page.

TagCopies / pageAssessment
LinkedIn Insight 96589082Duplicated — double-counts audience and conversion events
LinkedIn Insight 43193211Different account. Unidentified owner — most likely a former vendor's
Google Tag Manager GTM-NWPTQWF2Duplicated container
Google GT-PH3VB86Q2Duplicated
GA4 _ga_BH9SXK13F8 + _ga_F8YKJP02GP2 propertiesCompeting GA4 streams — neither is a clean source of truth
Universal Analytics UA-208884916-1liveSunset property still firing
AdRoll Q662CQHHTBEERDPAEE76NW1Not disclosed anywhere in the privacy policy

The practical consequence is that no analytics number coming out of this site should currently be trusted — sessions, conversions and campaign attribution are all inflated to an unknown degree by the duplication.

The item that matters most: LinkedIn partner ID 4319321 is a second, separate LinkedIn advertising account receiving visitor data from every page of kendallpc.com. Identify who owns it. If it belongs to a former vendor, that is an active data-sharing relationship with a third party that no one is currently managing — and it should be resolved before any hosting or vendor transition, not after.
Section 04 · Privacy Policy vs. Reality
Priority 0 · Immediate

It describes a stack the site
no longer runs.

All of the following is live on kendallpc.com/privacy-policy/ as of August 20, 2026.

The disclosure is inaccurate in both directions at once: it names a platform that isn't there, and it hides two that are. Separately, the websitepro.hosting address is the kind of detail that reads, to a sophisticated reader, as a site nobody has audited since launch — which is an unfortunate impression for a firm whose privacy practice is a revenue line.

To the firm's credit, the Legal Notices page handles the attorney-client question correctly — it states plainly that viewing the site creates no attorney-client relationship and that information submitted through the site is not privileged. That language is sound. The problem is placement, addressed in Section 08.

Section 05 · Duplicate Pages & Entity Split
Priority 1 · 30 days

Jamie Kendall has two pages.
Search engines see two people.

Attorney pages exist at two URL patterns. One attorney is consolidated correctly; two are not.

URLCanonical points toWordsStatus
/jamie-kendall/itself1,937Split
/team/jamie-kendall/itself3,041Split
/alexandra-schulz/itself1,078Split
/team/alexandra-schulz/itself2,766Split
/brad-welsh/itself1,370Correct
/team/brad-welsh/→ /brad-welsh/1,370Correct

Brad Welsh's duplicate is properly canonicalized to a single URL. Jamie Kendall's and Alexandra Schulz's are not — both versions declare themselves canonical, and both are listed in the sitemap. The result is that the firm's named principal has her authority, her citations, and her entity signal divided across two competing URLs.

This matters more than a typical duplicate-content issue because attorney identity is precisely the signal that E-E-A-T evaluation and AI entity resolution depend on. When an answer engine tries to establish "who is Jamie Kendall," it finds two partial answers instead of one authoritative one.

Two blog posts are also exact duplicates: the Connecticut/Colorado privacy law piece and the FY2021 HCFAC report, each published twice at different URLs.

Section 06 · Structured Data & AI Visibility
Priority 1 · 30 days

Clean schema. None of it
says "law firm."

Structured data is deployed and valid on all 125 pages via Yoast — nothing here is broken. Organization, WebSite, WebPage and BreadcrumbList appear everywhere; Article and Person appear on all 83 blog posts.

What's absent is every type that would identify Kendall PC as a law firm to a search or answer engine:

The Person markup that does exist is author attribution on blog posts — it establishes who wrote an article, not who practices law and in what. For a firm whose buyers increasingly shortlist counsel through AI answer surfaces, that distinction is the entire opportunity: the content to be cited already exists, but nothing in the markup tells a machine that Kendall PC is the kind of entity that answers FDA regulatory questions.
Section 07 · Content & Internal Linking
Priority 1 · 30 days

Deep articles that route
nowhere.

First, the good news, because it reframes everything else: the content is not thin. Measured in-article across 83 posts, the median is 952 words, the mean 1,132, and 40 posts run past 1,000 words. Publishing is current — the newest post is dated July 30, 2026, with an archive reaching back to December 2021.

What's working

Genuine subject-matter depth on FDA warning letters, DOJ investigations, medical-device guidance, MSL compliance and drug pricing. This is material that answer engines are actively looking for, written by people who clearly know the subject.

What's broken

62 of 83 posts contain zero in-article links to any practice-area, industry or attorney page. Only one post has three or more. The articles attract attention and then hand it back.

There is a promising detail in the data: the three best-linked posts are the three most recent, carrying 8 to 13 internal links each. Someone changed the template partway through 2026 and started doing this correctly. The remaining 62 older posts were never backfilled — which makes this a finite, well-defined cleanup rather than an open-ended content program.

Other on-page items

Section 08 · Conversion & UX
Priority 2

Every inquiry arrives looking
exactly the same.

The intake form is Gravity Forms: Full Name, Email, Phone, and a free-text field. There is not a single select field on the page — no matter type, no urgency, no industry.

The practical effect is that a company that received an FDA Warning Letter yesterday and has fifteen working days to respond arrives in the inbox identically to someone asking about forming an LLC. Those two inquiries have wildly different urgency and value, and nothing in the current intake distinguishes them. A single required "What do you need help with?" dropdown would fix triage, routing and response time in one change.

Privilege disclosure sits two clicks from where it matters

The Legal Notices page correctly warns that information submitted through the site is not privileged. But a prospective client typing the facts of a federal investigation into a textarea is on the contact page, not the legal notices page. That warning belongs directly beneath the form field — where it protects both the visitor and the firm at the moment it is relevant.

The 404 page is a dead end

Good news first: the 404 returns a correct HTTP 404 status, and it no longer leaks PHP errors — an issue flagged in an earlier review has since been fixed. But the page body now consists solely of the words "404 not found..." — no search, no links, no route back into the practice areas. Any traffic that reaches it is lost.

One minor item: http://www.kendallpc.com/ takes two redirect hops to reach the canonical address. The apex and https-www variants are clean.

Section 09 · Assets Worth Protecting
Do not let a migration break these

What is already right.

This section exists because the most common way a website migration destroys value is by rebuilding things that were working. These items should be treated as requirements to preserve, not blank slate.

Search foundation
  • Title tags are keyword-led and correctly sized (42–60 characters) on every money page. Real work was done here.
  • Structured data is valid and complete on all 125 pages.
  • Sitemap is clean — 125 URLs, every one returning 200.
  • Content depth and publishing cadence are genuinely strong.
Infrastructure
  • Present: HSTS (1 year, includeSubDomains), X-Frame-Options, X-Content-Type-Options, X-XSS-Protection.
  • Missing: Referrer-Policy, Content-Security-Policy, Permissions-Policy.
  • TLS valid through October 13, 2026. WordPress 7.0.3, custom theme.
  • Performance is good — 0.30s to first byte, 91KB of HTML.
Two technical notes for whoever maintains the site next. Ten stylesheets and four synchronous scripts load in the document head — the remaining render-blocking cleanup, and a straightforward one. Separately, the CDN was serving HTML roughly 10.7 days old at the time of testing, so cache-purge behavior on deploy is worth verifying before anyone concludes a change didn't take.
Section 10 · Priority Order

Seven moves, in the order
they should happen.

  1. Gate the advertising and analytics tags behind actual consent — or remove the banner and stop implying a choice exists. The current state is the worst of both options.
  2. Deduplicate the tracking stack. Identify or remove LinkedIn account 4319321, retire Universal Analytics, and consolidate to one GA4 property.
  3. Rewrite the privacy policy against the stack that is actually running. Remove the websitepro.hosting address and the "CLIENT" placeholder; disclose AdRoll and LinkedIn.
  4. Canonicalize Jamie Kendall and Alexandra Schulz to one URL each, following the pattern already used correctly for Brad Welsh.
  5. Add LegalService and Attorney schema with sameAs, bar admissions and practice specialties; publish llms.txt. Add the three missing security headers.
  6. Backfill internal links across the 62 orphaned posts and write the 37 missing meta descriptions. Finite, well-defined work.
  7. Segment the intake form and move the privilege disclaimer to sit directly beneath it.

Before any vendor or hosting transition

A migration is the single most likely moment for the working parts of this site to be lost. Capture the following before anything is touched:

Items 1 through 3 are the ones a new provider will otherwise inherit and faithfully reproduce, because nothing about them is visible from the outside unless someone goes looking. They are also the three that a firm selling privacy counsel would least want a client, a competitor, or opposing counsel to find first.
Kendall PC × Bonsai Marketing
— A Bonsai Marketing Audit —

Findings are easy to send.
Fixes are the hard part.

Everything in this report was observed live and can be reproduced in a browser in about ten minutes. If it's useful to walk through what's involved in items 1 through 3 — the consent gating, the tag cleanup, and the policy rewrite — I'm glad to spend an hour on it, whoever ends up doing the work.

Call Bryan · (707) 548-7812 Email Bryan