mozilla.org website health report
Website health report
mozilla.org scores 92/100
Excellent — only minor polish left. We found 14 issues; the weakest area is SEO (79/100).
- 3 Medium
- 11 Low
- 38 Passed
Free expert review
Send this report to SuperSiteBros. An expert will look it over and email you with the highest-impact fixes — no obligation.
Free weekly monitoring
Weekly monitoring is built and ready, but outbound email from this server is not reliable yet (no SPF/DKIM/DMARC and no SMTP). Sign-ups stay closed until that is fixed — use the free expert review above in the meantime.
Matched SuperSiteBros services
Site crawl
- Pages crawled
- 25
- Broken links
- 1
- Redirect chains
- 2
- Missing titles
- 0
- Duplicate titles
- 0
- Missing descriptions
- 12
- Missing H1
- 3
- Thin pages
- 0
- Noindex pages
- 1
- Mixed content pages
- 0
Pages checked
| Page | Status | Title | Words | Issues |
|---|---|---|---|---|
| /en-US/ | 200 | Mozilla - Internet for people, not profit (US) | 1510 | 2 redirects |
| /en-US/privacy/websites/cookie-settings/ | 200 | Cookie settings — Mozilla | 695 | — |
| /en-US/products/ | 200 | Mozilla’s products — Mozilla (US) — Mozilla | 636 | — |
| /en-US/products/vpn/ | 200 | Get Mozilla VPN — Mozilla (US) | 668 | — |
| /en-US/products/monitor/ | 200 | Mozilla Monitor | 281 | no description, no H1 |
| /en-US/about/ | 200 | Learn about Mozilla | 714 | — |
| /en-US/about/manifesto/ | 200 | The Mozilla Manifesto | 1270 | — |
| /en-US/contribute/ | 200 | Volunteer Opportunities at Mozilla — Mozilla | 1197 | no description |
| /en-US/advertising/ | 200 | Advertising — Mozilla | 431 | no description |
| /en-US/privacy/websites/ | 200 | Websites, Communications & Cookies Privacy Notice — Mozilla | 1731 | — |
| /en-US/about/leadership/ | 200 | Mozilla Leadership — Mozilla | 2234 | no description |
| /en-US/careers/ | 200 | Mozilla Careers — Feel good about your work again. | 1774 | — |
| /en-US/contact/ | 200 | Contacts, Spaces and Communities — Contact us — Mozilla | 357 | no description |
| /en-US/security/ | 200 | Mozilla Security | 984 | no description |
| /locales/ | 200 | Choose your language or locale to browse Mozilla.org — Mozilla | 338 | — |
| /en-US/foundation/licensing/website-content/ | 200 | Mozilla.org Site Licensing Policies | 939 | no description |
| /en-US/about/legal/ | 200 | Legal — Mozilla | 898 | no description |
| /en-US/about/governance/policies/participation/ | 200 | Community Participation Guidelines — Mozilla | 3006 | no description |
| /en-US/about/this-site/ | 200 | About this site — Mozilla | 437 | noindex |
| /en-US/firefox/enterprise/ | 200 | Firefox Enterprise — Firefox.com | 862 | no description, 2 redirects |
| /en-US/account/ | 200 | Get a Mozilla account – Keep your data private, safe and synced — Mozilla | 408 | — |
| /en-US/products/vpn/resource-center/ | 200 | VPN Resource Center — Mozilla VPN | 1157 | no description, no H1 |
| /en-US/products/vpn/features/ | 200 | Features - Mozilla VPN | 653 | no description |
| /en-US/products/vpn/download/ | 200 | Download Mozilla VPN | 506 | — |
| /en-US/products/vpn/resource-center/do-you-need-a-vpn-at-home-here-are-5-reasons-you-might/ | 200 | Do you need a VPN at home? Here are 5 reasons you might. — Mozilla VPN | 755 | no H1 |
Issues to fix on mozilla.org
MediumNo XML sitemap foundSEO
Checked robots.txt, /sitemap.xml, /sitemap_index.xml and /wp-sitemap.xml.
Why it matters
A sitemap lists the pages you want indexed and when they changed, helping search engines find new and deep pages faster.
How to fix it
Generate an XML sitemap, reference it in robots.txt and submit it in Google Search Console and Bing Webmaster Tools.
MediumBroken linksSEO
1 broken internal and 0 broken external link(s) found.
Why it matters
Links to missing pages frustrate visitors and waste the authority you pass through links.
How to fix it
Update or remove links that return 404/410 or server errors; redirect deleted pages to their closest replacement.
Details
- https://www.mozilla.org/exp/opt-out/ (no response) ← linked from /en-US/privacy/websites/
MediumPages without meta descriptionsSEO
12 of 23 other indexable page(s) have no meta description.
Why it matters
Google will pick its own snippet for these pages, which usually earns fewer clicks.
How to fix it
Add a 120–160 character description to your important pages.
Affected pages
- /en-US/products/monitor/
- /en-US/contribute/
- /en-US/advertising/
- /en-US/about/leadership/
- /en-US/contact/
- /en-US/security/
- /en-US/foundation/licensing/website-content/
- /en-US/about/legal/
- /en-US/about/governance/policies/participation/
- /en-US/firefox/enterprise/
- /en-US/products/vpn/resource-center/
- /en-US/products/vpn/features/
LowFirst large image is lazy-loadedPerformance
The first image in the page is marked loading="lazy".
Why it matters
The first image is often the Largest Contentful Paint element. Lazy-loading it delays the most important paint.
How to fix it
Remove loading="lazy" from the first visible image and consider `fetchpriority="high"`.
Details
- https://www.mozilla.org/media/cms/images/mozilla-org-website.2e16d0ba.fill-400x200.png
LowImages not in modern formatsPerformance
10 of 10 images are JPEG/PNG/GIF without a WebP/AVIF alternative.
Why it matters
WebP and AVIF are typically 25–50% smaller than JPEG/PNG at the same quality and are supported by all current browsers.
How to fix it
Serve WebP/AVIF (with <picture> fallbacks if you need them) or let an image CDN negotiate the format.
LowWeb fonts may block text renderingPerformance
protocol-mozilla.eafbcba9bb2a.css: 2 @font-face rule(s) without font-display.
Why it matters
Without font-display: swap (or optional), text can stay invisible until the font file arrives.
How to fix it
Add `font-display: swap` to @font-face rules, or `&display=swap` to Google Fonts URLs. Self-hosting fonts saves extra connections too.
Details
- protocol-mozilla.eafbcba9bb2a.css: 2 @font-face rule(s) without font-display.
LowObsolete HTML elementsBest practices
Found: .
Why it matters
Elements like <font>, <center> and <marquee> were removed from HTML and may render inconsistently.
How to fix it
Replace them with CSS.
LowCSP allows unsafe inline scriptsSecurity
script-src: 'self' 'unsafe-eval' 'unsafe-inline' *.google-analytics.com *.googletagmanager.com google-analytics.com googletagmanager.com js.stripe.com s.ytimg.com tagmanager.google.com www.mozilla.org www.youtube
Why it matters
With 'unsafe-inline' in script-src (and no nonce, hash or strict-dynamic), injected <script> tags still run, so the policy gives little XSS protection.
How to fix it
Replace 'unsafe-inline' with per-request nonces or script hashes, ideally with 'strict-dynamic'.
LowNo Permissions-PolicySecurity
No Permissions-Policy header.
Why it matters
Permissions-Policy switches off powerful browser features (camera, microphone, geolocation, payment…) that your site doesn’t use, so injected or third-party code can’t use them either.
How to fix it
Send e.g. `Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=()`, allowing only what you need.
LowNo structured dataSEO
No JSON-LD or microdata found.
Why it matters
Structured data (schema.org JSON-LD) helps search engines understand your organisation, articles, products or FAQs and can unlock rich results.
How to fix it
Add JSON-LD for your organisation/website, plus the type that fits each page (Article, Product, LocalBusiness…). Check it with Google’s Rich Results Test.
Lowrobots.txt doesn’t list a sitemapSEO
No “Sitemap:” line in robots.txt.
Why it matters
The Sitemap line is how crawlers that you haven’t submitted to (Bing, others) find your sitemap.
How to fix it
Add `Sitemap: https://yourdomain/sitemap.xml` (absolute URL).
LowInternal links point at redirectsSEO
1 internal link target(s) redirect.
Why it matters
Each redirect adds a round-trip before the page loads and dilutes link signals slightly.
How to fix it
Update internal links to point straight at the final URL.
Details
- /en-US/firefox/enterprise/ → /en-US/enterprise/?redirect_source=mozilla-org
LowRedirect chainsSEO
2 URL(s) go through 2 or more redirects.
Why it matters
Each hop adds latency, and Google stops following after a handful of hops.
How to fix it
Point redirects (and links) directly at the final destination in one hop.
Details
- /en-US/ → 2 hops
- /en-US/firefox/enterprise/ → 2 hops
LowPages without an H1SEO
3 page(s) have no H1 heading.
Why it matters
A clear main heading helps search engines and screen-reader users understand each page.
How to fix it
Give each page one descriptive H1.
Affected pages
- /en-US/products/monitor/
- /en-US/products/vpn/resource-center/
- /en-US/products/vpn/resource-center/do-you-need-a-vpn-at-home-here-are-5-reasons-you-might/
InfoNot ready for the HSTS preload listSecurity
For preload the header still needs: includeSubDomains, preload.
Why it matters
Preloading bakes your domain into browsers as HTTPS-only, protecting even the very first visit. It’s optional and hard to undo, so only do it once every subdomain supports HTTPS.
How to fix it
Serve `max-age=31536000; includeSubDomains; preload` on the root domain, redirect http→https on the same host first, then submit at hstspreload.org.
InfoPages set to noindexSEO
1 crawled page(s) are set to noindex.
Why it matters
These pages ask search engines not to index them. That’s fine for thank-you or account pages, but a mistake for content you want found.
How to fix it
Check the list and remove noindex from any page you want in search results.
Affected pages
- /en-US/about/this-site/
No issues match these filters.
Passed checks (38)
- Valid SSL certificate — Trusted certificate for www.mozilla.org, valid until 2027-01-19 (83 days left), issued by Let's Encrypt.
- HTTP redirects to HTTPS — http://www.mozilla.org/ → https://www.mozilla.org/ (301).
- HSTS enabled — Strict-Transport-Security: max-age=31536000
- Clickjacking protection — X-Frame-Options: DENY
- MIME sniffing disabled — X-Content-Type-Options: nosniff
- Referrer-Policy set — strict-origin-when-cross-origin
- No mixed content — Every resource referenced in the HTML uses https://.
- Fast server response — Time to first byte 0.36s.
- Brotli compression — Content-Encoding: br
- HTTP/2 supported — Served over HTTP/2.
- Lean HTML — The HTML document is 112.7 KB.
- Few render-blocking resources — 2 blocking script(s), 5 stylesheet(s).
- Off-screen images are lazy-loaded
- Static files are cacheable — 4 sampled CSS/JS files have long cache lifetimes.
- Page loads successfully — HTTP 200 after 2 redirect(s).
- Page is indexable — No noindex directive in meta robots or X-Robots-Tag.
- Good page title — “Mozilla - Internet for people, not profit (US)” (46 characters).
- Good meta description — 86 characters.
- One clear H1 — “Welcome to Mozilla”
- Canonical URL set — https://www.mozilla.org/en-US/
- Mobile viewport set — width=device-width, initial-scale=1
- Open Graph tags present — og:title, og:description and og:image are set.
- Valid hreflang annotations — 86 language alternates.
- robots.txt allows crawling — 1 rule group(s).
- Missing pages return 404 — A made-up URL returned 404.
- One preferred hostname — mozilla.org redirects (301) to the preferred version.
- Page language declared — lang="en"
- All images have alt attributes — 22 images checked.
- Form fields are labelled — 6 fields checked.
- Links and buttons have names
- Logical heading structure — 42 headings in order.
- Standards-mode HTML5 document — Doctype and charset are declared.
- security.txt published — /.well-known/security.txt has a Contact field.
- SPF record present — v=spf1 include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email include:_spf.mozilla.com include:_spf.google.com include:spf.fundraiseup.com ~all
- DMARC policy enforced — v=DMARC1; p=reject; pct=100; adkim=r; aspf=r; rua=mailto:dmarc_agg@vali.email,mailto:dmarc@mozilla.com
- CAA records restrict certificate issuance — issue comodoca.com; issue amazon.com; issue awstrust.com; issue letsencrypt.org
- Reachable over IPv6 — www.mozilla.org has an AAAA record.
- Page titles are unique — Across 24 crawled page(s).
Site facts
- Final URL
- https://www.mozilla.org/en-US/
- HTTP status
- 200
- Server response (TTFB)
- 359 ms
- Protocol
- HTTP/2
- Compression
- br
- HTML size
- 112.7 KB
- DOM elements
- 1140
- Words on page
- 1510
- Certificate
- Valid, 83 days left (Let's Encrypt)
- Email DNS
- SPF ✓ · DMARC ✓ · CAA ✓ · IPv6 ✓
- Server
- granian
Technology detected
Want these fixed for you?
SuperSiteBros care plans take care of security hardening, speed, updates and monitoring so your grade stays high.
See care plans