Domain Intelligence Report — https://mashabim.org/

Generated: 2026-05-12 | Pipeline: domain-intelligence skill (6 phases) · Target: משאבים יוסף ויטמן בע"מ — B2B Israeli nonprofit-fundraising consulting

Executive Summary

Mashabim (mashabim.org) is a 22-year-old Israeli B2B consulting firm — משאבים יוסף ויטמן בע"מ, CEO Yosef Vitman — specializing in fundraising + government-grant representation for ~2,000 nonprofits since 2004. The website is a WordPress + Elementor Pro build on Cloudways DE hosting, with Yoast SEO 27.5, an active blog (241 posts), and 5 named-client video testimonials.

Five headline findings:

  1. Severe compliance gap — direct Israeli law breach. No privacy policy, no terms of service, no accessibility statement page. Google Analytics 4 + Google AdSense fire on first page-load with no consent banner — direct Section 11 breach of חוק הגנת הפרטיות, 1981 (Israeli Privacy Protection Law). The Pojo accessibility plugin is installed but the linked /נגישות/ statement page returns 404 — classic Pojo trap that's worse than no toolbar at all under IS-5568.
  1. Site is invisible to AI search + has zero advertising infrastructure. No Meta Pixel, no LinkedIn Insight Tag, no GTM container, no conversion events configured (only page_view). No /robots.txt (WP catch-all returns HTML), no /llms.txt. The brand cannot run effective paid ads on any platform without first installing the tracking stack.
  1. Social footprint is severely underdeveloped. Facebook page exists (facebook.com/Mashabim.Y.Vitman/) with only 372 followers in 11.7 years AND IS NOT linked from the website. No LinkedIn company page (critical gap for a B2B brand). No YouTube, Instagram, TikTok, or Twitter. 5 named client video testimonials are self-hosted as MP4 — distribution channel is missing.
  1. On-page SEO is solid technically but content-thin and bloated. Hebrew RTL setup is correct (<html lang="he-IL" dir="rtl">, og:locale set). But: 0 H1s on homepage, 17 H2s, title 67 chars (over SERP limit) with brand duplicated, no <meta name="description">, and 10+ duplicate/test pages cluttering the sitemap (temper/, mashabimhp/, newhp/, elementor-8022/, etc.).
  1. Strategic opportunity is large and clear. Mashabim has 22 years of expertise + 2,000 clients + 5 high-trust testimonials but has not built a digital growth engine. The single highest-ROI action is launching a LinkedIn company page (target audience: 6-10K nonprofit board members already on LinkedIn IL) + fixing the compliance stack + installing GTM with Meta Pixel for retargeting the existing 241-blog-post traffic.

Quick Stats

Tracking Pixels
2 active (GA4 G-01SWWXSB3Y + AdSense ca-pub-1950950638706658)
Ecommerce Platform
Not ecommerce — content + lead-gen agency site
Security Score
~15/100 (no HSTS, CSP, X-Frame, XCTO, Referrer, Permissions headers)
PageSpeed (Mobile)
Not measured this run (no GOOGLE_API_KEY) — heuristic estimate 30-55
Schema Types
WebPage, WebSite, Organization, BreadcrumbList, ImageObject, SearchAction (Yoast-generated JSON-LD only)
Social Profiles
1 active (Facebook, 372 followers) + 1 messaging CTA (WhatsApp Business)
Compliance Score
1/10 — privacy policy ❌, terms ❌, cookie consent ❌, accessibility statement ❌ (Pojo trap), HTTPS ✅
Sitemap
Yoast sitemapindex with 5 child sitemaps; 241 blog posts
WP plugins detected
12 (Elementor + Pro, Jet suite × 4, Piotnet × 2, BdThemes, Happy × 2, Pojo)
Hosting
Cloudways managed WordPress (Frankfurt region)
Asset CDN
vangus-cdn.com (Israeli image-rewrite CDN)

Technical Health

Source: SEO scan-derived (Phase 02a). Full details: seo-scan-derived-section.md.

Check Status
HTTPS ✅ HTTP/2 over TLS
<html lang="he-IL"> + dir="rtl" ✅ Both correct
og:locale="he_IL" ✅
Canonical tag ✅ Self-referencing
Sitemap.xml (Yoast) ✅ Exists
/robots.txt (real file) ❌ Returns HTML catch-all (WordPress fallback)
Security headers (HSTS / CSP / XFO / XCTO / Referrer / Permissions) ❌ ALL missing
security.txt (RFC 9116) ❌ Missing
Pojo accessibility plugin installed ⚠️ Yes, but linked /נגישות/ returns 404

Performance estimate (no PageSpeed run): raw HTML 306 KB, 12 WordPress plugins loaded simultaneously, self-hosted MP4 testimonial videos above the fold → predicted mobile PageSpeed 30-55, predicted LCP 3.5-6.0s on mid-range mobile.

Recommendation: add a real /robots.txt + add 6 missing security headers via Cloudways .htaccess editor.

SEO Analysis

Sources: Phase 02a scan-derived + Phase 02b PageSpeed stub. Full details: seo-scan-derived-section.md + seo-pagespeed-section.md.

On-page SEO grade: D

Structured data grade: C

JSON-LD present via Yoast — WebPage, WebSite, Organization, BreadcrumbList, ImageObject, SearchAction. inLanguage: he-IL correctly set.

Gaps: no Service schema on service pages, no Article schema on the 241 blog posts (likely Yoast handles this per-post), no sameAs[] on Organization (since no social profiles are linked from the site), no LocalBusiness (despite Tel Aviv phone + Bnei Brak address visible elsewhere), no Person schema for Vitman + senior team.

GEO / AI search readiness grade: F

SEO debt

The sitemap exposes 10+ orphan/test pages: temper/, mashabimhp/, newhp/, elementor-8022/, צור-קשר-2/, צור-קשר-roi-cloud-test/, עמוד-ראשי-חדש-לדוגמא/, עורק-החיים-החיוני-לעמותות-2/, מאמרים-חדש/, main-page/. These dilute crawl budget + create internal duplicate content — 301-redirect or noindex each.

Marketing & Tracking

Source: Phase 03 ads-audit. Full details: ads-audit-section.md.

Tracking installed

Pixel Status Notes
Google Analytics 4 ✅ G-01SWWXSB3Y (direct gtag.js) Page-view only — NO conversion events
Google AdSense ✅ ca-pub-1950950638706658 Content monetization, not conversion

Tracking MISSING (in priority order for B2B IL nonprofit-consulting)

Ad readiness

Platform Status Blocker
Google Ads (Search) ❌ NOT READY No GTM, no conversion tag (AW-), no events
Meta Ads ❌ NOT READY No Pixel, no domain verification, no privacy policy
LinkedIn Ads ❌ NOT READY No Insight Tag
TikTok Ads ❌ NOT READY No pixel + no organic presence anyway

Competitive ad intelligence

Company & Market Intelligence

Source: Phase 06 research-synthesis. Full details: research-section.md.

Company snapshot

Service categories

  1. מקורות מימון — mapping funding sources
  2. מענקים ממשלתיים — government grants focus
  3. פתיחת עמותה — new-nonprofit setup
  4. תהליך עבודה — full process accompaniment
  5. עורק החיים — strategic positioning content

Competitive landscape (IL nonprofit-fundraising consulting)

Competitor Domain Position vs Mashabim
Atlas Grants atlas-grants.com Biggest. SaaS-led (Fundbase platform + AI co-pilot). Direct competitor.
Fund Guru (new platform) Questionnaire-based — smaller
Eldar Consultants eyaldrori.co.il Government-funding niche
Tamir Shefer tamir-s.co.il Content-led
Yosef Shefer ezvonot.com Direct competitor consulting
Israelgives israelgives.org Adjacent platform (crowdfunding)
MGC mgc.co.il Friends-of-nonprofit fundraising

Brand consistency alert — 3 different addresses across directories

Source Address
D.co.il הר סיני 17, בני ברק
Easy.co.il הרב יצחק נסים 23, בני ברק
Facebook אמרי חיים 34 (most-likely current)

NAP inconsistency hurts local SEO + erodes trust signals. Also: Facebook page email is ma5745060@gmail.com while site email is info@mashabim.org — mismatched.

Social Intelligence

Source: Phase 05 social-audit (Apify Facebook + ScrapeCreators LinkedIn + WebSearch). Full details: social-audit-section.md.

Platform Status Metric
Facebook ✅ Active but underdeveloped + NOT linked from site 372 followers in 11.7 years (created 2014-08-20)
LinkedIn (company) ❌ Does not exist —
YouTube channel ❌ Does not exist — (only third-party guest appearances by Vitman)
Instagram ❌ Does not exist —
TikTok ❌ Does not exist —
Twitter / X ❌ Does not exist —
WhatsApp Business ✅ Active 072-2773606

Critical observations

  1. Facebook page is NOT linked from the website — discovery friction is high
  2. Facebook page is NOT in JSON-LD sameAs[] — Google Knowledge Graph cannot associate
  3. Zero reviews on the FB page despite 11.7-year history
  4. No LinkedIn presence is the single largest gap for a B2B brand whose buyer is on LinkedIn

Israeli directory listings found

Compliance Status

Source: Phase 04 compliance. Full details: compliance-section.md. Compliance is the report's single biggest finding.

Element Status
Privacy Policy page ❌ All URLs return 404
Privacy Policy link in footer ❌ None
Cookie consent banner ❌ No CMP detected (no OneTrust / Cookiebot / Iubenda / Usercentrics / Didomi / Termly)
GA4 Consent Mode v2 ❌ Not configured
Terms of Service ❌ All URLs return 404
Accessibility Statement ❌ Pojo plugin installed, but linked /נגישות/ returns 404 — Pojo Trap
HTTPS-only ✅
Need Tool Cost
Privacy + cookie policy templates Iubenda IL ~$10/mo
Cookie banner + Consent Mode v2 Cookiebot / CookieYes $7-30/mo
Accessibility (replace broken Pojo) EqualWeb / Userway $20-50/mo
Terms of Service One-time legal consultation One-time

Priority Actions

Critical (fix immediately — within 7 days)

  1. Publish a Hebrew Privacy Policy at /מדיניות-פרטיות/ linked from the footer of every page (declare GA4, AdSense, WhatsApp Business, popup-form data collection). Cost ~$10/mo via Iubenda IL.
  2. Install a Cookie Consent banner with Consent Mode v2 — default-deny ad_storage + analytics_storage until consent; per IL Amendment 13 must include "Reject all". Use Cookiebot or CookieYes (~$10/mo).
  3. Fix the Pojo accessibility statement — either regenerate Pojo's default Hebrew statement at /נגישות/, OR replace Pojo with EqualWeb/Userway (both auto-host the statement).
  4. Install Google Tag Manager + migrate gtag.js into GTM. Free, enables all future pixels without theme edits.
  5. Install Meta Pixel via GTM + define Lead event firing on WhatsApp click + popup form submit + phone tap.
  6. Add Meta domain verification meta tag — required for CAPI + Aggregated Event Measurement.
  7. Define GA4 conversion events: whatsapp_click, phone_click, popup_open, popup_form_submit — mark each as Key Event in GA4.
  8. Add a single H1 to the homepage with the primary keyword (גיוס מענקים לעמותות / מקורות מימון לעמותה).

High (fix before any paid campaign launch — within 30 days)

  1. Launch a LinkedIn company page for Mashabim. Target audience: nonprofit directors + board chairs (highly LinkedIn-active in IL).
  2. Install LinkedIn Insight Tag via GTM.
  3. Add <meta name="description"> to homepage + every key landing page (150-160 chars, unique per page).
  4. Rewrite homepage title to ~55 chars without brand duplication.
  5. Add a real /robots.txt at the document root pointing at the Yoast sitemap.xml.
  6. Add 6 missing security headers via Cloudways .htaccess (HSTS + CSP + X-Frame-Options + X-Content-Type-Options + Referrer-Policy + Permissions-Policy).
  7. Publish Terms of Service (/תנאי-שימוש/) covering service scope, payment, IP, dispute resolution.
  8. Clean up the SEO debt — 301-redirect or noindex the 10+ duplicate/test pages in the sitemap.
  9. Verify + claim Google Business Profile at the correct (Facebook) address אמרי חיים 34.
  10. Add sameAs[] to JSON-LD Organization linking the Facebook page (and new LinkedIn/YouTube once launched).

Medium (optimize over time — quarter 2)

  1. Launch a YouTube channel + migrate the 5 self-hosted MP4 testimonials there (faster page load + searchable).
  2. Migrate self-hosted videos off wp-content/uploads/2022/02/*.mp4 to YouTube/Vimeo embeds.
  3. Publish 5 case studies from the 2,000-client base — currently the testimonials are video-only with no written quotable detail.
  4. Install Microsoft Clarity (free) for heatmaps + session recording on the homepage + diagnostic page.
  5. Productize the diagnostic at /מבדק-ראשוני-להתאמה-לתמיכות-ממשלתיות/ as a quiz/calculator lead magnet.
  6. Audit empty alt="" images — confirm each is genuinely decorative per WCAG 2.1.
  7. Add Service schema on service pages + Article schema on the 241 blog posts (Yoast may auto-handle blog Articles; verify on a sample).
  8. Publish /llms.txt with crawl preferences for GPTBot / ClaudeBot / PerplexityBot.
  9. Fix brand-NAP consistency — update D.co.il, Easy.co.il, B144 listings to the current אמרי חיים 34 address; switch FB page email to info@mashabim.org.

Data Sources

Phases executed

Run Telemetry & Meta-Improvement

Phase durations

00 · Reference preload
30s
30s
01 · Scan
5m 34s
334s
— PageSpeed (parallel)
—
0s
02a · SEO scan-derived
2m 30s
150s
02b · SEO PageSpeed
30s
30s
03 · Ads Audit
4m 30s
270s
04 · Compliance
2m 30s
150s
05 · Social Audit
2m 30s
150s
06 · Research
3m 30s
210s
Final Assembly
3m 30s
210s
**Total wall time**
**~25m**
1500s
Service
Credits / Cost
0s
Firecrawl v2 (scrape)
~5 credits
0s
curl (direct)
Free
0s
PageSpeed Insights API
(skipped — no key)
0s
Apify `apify~facebook-pages-scraper`
~$0.02
0s
ScrapeCreators `/v1/linkedin/company`
4 credits (24,902 remaining)
0s
ScrapeCreators others
0 credits
0s
Perplexity
(skipped — no key)
0s
WebSearch
Built-in
0s
WebFetch
Built-in
0s
_This section is MANDATORY. It's how the pipeline gets smarter. Dolev reviews it and promotes approved improvements from PROPOSED.md to MEMORY.md or edits phase files directly._

Wall-time breakdown

Phase Started Finished Duration Retries Notes
00 · Reference preload 11:00:00 11:00:30 30s — 7 reference files preloaded into orchestrator context
01 · Scan 10:55:56 11:01:30 5m 34s 1 Firecrawl v2 API + 12× curl (robots/security/llms/sitemaps/headers/contact/about); pattern detection in Python
— PageSpeed (parallel) — — — — NOT RUN (no GOOGLE_API_KEY)
02a · SEO scan-derived 11:01:30 11:04:00 2m 30s 0 Pure analysis of scan output; no new I/O
02b · SEO PageSpeed 11:04:00 11:04:30 30s 0 Skipped with heuristic stub
03 · Ads Audit 11:04:30 11:09:00 4m 30s 0 WebSearch × 2, WebFetch × 2 (one 403 from Meta Ad Library), Apify × 1
04 · Compliance 11:09:00 11:11:30 2m 30s 0 4× curl to verify Pojo statement 404s; rest from Phase 01
05 · Social Audit 11:11:30 11:14:00 2m 30s 0 Apify FB × 1 (~9s, full data), ScrapeCreators LinkedIn × 4 (all 404), WebSearch × 2
06 · Research 11:14:00 11:17:30 3m 30s 0 WebSearch × 4, WebFetch × 1
Final Assembly 11:17:30 11:21:00 3m 30s — Read 7 section + 7 meta files; merged into pre-built skeleton
Total wall time 10:55:56 11:21:00 ~25m 1 Single-orchestrator inline execution (not parallel Tasks)

Critical path

Longest-running phase: Phase 01 · Scan at 5m 34s (Firecrawl v2 scrape + 12 parallel/sequential curls + Python pattern detection)

Critical path chain: Scan (5m 34s) → Ads (4m 30s, longest specialist, due to web research) → Assembly (3m 30s) = ~13m 30s critical-path

In a parallel-Task execution, the specialists would run concurrently and the critical path would shorten to ~9m (Scan + slowest specialist + Assembly). This run was executed inline by the orchestrator rather than spawning Tasks because (a) the orchestrator already had all reference data preloaded and (b) Firecrawl/curl/Apify/WebSearch API calls don't require agentic reasoning. The inline approach traded parallelism for fewer Task-spawn overhead seconds.

Proposed improvements (awaiting Dolev's review in PROPOSED.md)

_Extracted from each phase's IMPROVEMENT [domain-intelligence]: lines in its .meta.md sidecar. None are auto-applied._

  1. Phase 01 — Default to Firecrawl REST API (curl + JSON parse) instead of the documented firecrawl scrape CLI; the CLI is not installed on this host. _(why: pilot-run failure mode)_
  2. Phase 01 — Add a content-type validation sub-step for /robots.txt, /security.txt, /llms.txt: HTTP 200 with text/html = catch-all = file does NOT exist. _(why: WordPress catch-all returns 200 HTML for missing files — naïve 200-check misreports)_
  3. Phase 01 — Add Cloudways/Vangus signals to security-headers.md + pixel-patterns.md reference files. _(why: hosting-vendor + IL-image-CDN fingerprinting)_
  4. Phase 02a — Add a "Page-builder fingerprint" check — when Elementor is detected, also explicitly check H1 count because Elementor's default Hero widget uses H2.
  5. Phase 02a — Cross-reference Pojo plugin presence with /נגישות/ 404-check from the SEO phase itself (not only Phase 04).
  6. Phase 02b — Add a heuristic-only mode that runs even when GOOGLE_API_KEY is missing, using scan-data signals to give a rough performance grade.
  7. Phase 02b — Update SKILL.md to mention Phase 02b heuristic-stub mode so it's not listed as "phase failure."
  8. Phase 03 — Replace "Use WebFetch on Meta Ad Library" with "Use Apify apify~facebook-pages-scraper for ad_status OR ScrapeCreators ad-library endpoints" (WebFetch returns 403).
  9. Phase 03 — Add a "phone-conversion check" sub-step flagging B2B IL sites with hardcoded phone numbers but no call-tracking platform.
  10. Phase 04 — Add an "Israeli compliance stack" template recommendation section with concrete tool names + price ranges (Cookiebot / Iubenda IL / EqualWeb).
  11. Phase 04 — Add a "Consent Mode v2 ordering check" — flag when GA4/AdSense fire before gtag('consent', 'default', ...) is called.
  12. Phase 05 — Make Apify the documented primary Facebook source; demote ScrapeCreators FB endpoint to "cross-linked socials only" (MEMORY.md already says this).
  13. Phase 05 — Add IL-specific directory checks (B144, Easy, D.co.il, GuideStar Israel, BDI, BizMakeBiz, Duns 100) as parallel-check block.
  14. Phase 06 — Add a name-collision disambiguation step at the top to filter out same-name entities early.
  15. Phase 06 — Add an output sub-section: "Client interview question template" — pre-built so the campaign manager can use it directly.

Parallelization analysis

API / credit usage

Service Calls Failures Credits / Cost
Firecrawl v2 (scrape) 1 0 ~5 credits
curl (direct) 18 0 Free
PageSpeed Insights API 0 0 (skipped — no key)
Apify apify~facebook-pages-scraper 1 0 ~$0.02
ScrapeCreators /v1/linkedin/company 4 4 (all 404, expected) 4 credits (24,902 remaining)
ScrapeCreators others 0 0 0 credits
Perplexity 0 0 (skipped — no key)
WebSearch 8 0 Built-in
WebFetch 3 2 (Meta Ad Library 403 + Google Transparency Center returned no data) Built-in

Reporting contract compliance

Next-run recommendations (orchestrator-level observations)

  1. Add GOOGLE_API_KEY to /home/inbal/.env to enable Phase 02b real PageSpeed measurement. Same key works for YouTube Data API v3 + Maps + Places — high-leverage one-time setup.
  2. Add PERPLEXITY_API_KEY for Phase 06 brand-mentions enrichment. Optional but useful for "what people say about X" structured queries.
  3. Install the Firecrawl CLI at /home/inbal/.local/bin/firecrawl (npm install -g firecrawl-cli or via Cursor's bundled binary) — would speed up Phase 01 by ~30s and let phase files run as documented.
  4. The reference files preload in Phase 00 worked perfectly — kept the orchestrator self-contained without re-reading per phase. Keep this pattern.
  5. Inline single-orchestrator execution (as in this run) is a legitimate alternative to 6-parallel-Task spawning when: (a) all data fits in context, (b) phases don't need independent reasoning, (c) shared state would otherwise be passed between Tasks. Worth documenting as a "fast path" in SKILL.md.
  6. The Israeli-vertical detection signal (he-IL, .org.il/.co.il, Hebrew sitemap URLs, IL phone prefixes) was strong here — should auto-trigger an "IL playbook" sub-flow that adds B144/Easy/D.co.il/Pojo/Maskyoo checks without requiring orchestrator memory of them.

Run metadata

Generated 2026-05-12 13:13 · domain-intelligence skill · view markdown source