web.dev website health report

83Overall

Website health report

web.dev scores 83/100

Good overall, with a few things worth fixing. We found 18 issues; the weakest area is Performance (64/100).

Last checked October 27, 2026 · 2 scans

1 High
6 Medium
11 Low
32 Passed

Free expert review

Send this report to SuperSiteBros. An expert will look it over and email you with the highest-impact fixes — no obligation.

Free weekly monitoring

Weekly monitoring is built and ready, but outbound email from this server is not reliable yet (no SPF/DKIM/DMARC and no SMTP). Sign-ups stay closed until that is fixed — use the free expert review above in the meantime.

Matched SuperSiteBros services

Based on the categories that need work. Prices are from supersitebros.com.

Super Plan$99/month

Everything in Starter, plus weekly backups, security scans and performance optimizations.

View on SuperSiteBros →

Score history

Previous scans (2)

Date (UTC)	Score	Grade	Security	Performance	SEO	Accessibility	Best practices
Oct 27, 2026 18:06	83	B	93	64	83	90	97
Oct 27, 2026 18:00	83	B	93	62	83	90	97

Lighthouse speed test (mobile)

Performance

Accessibility

Best practices

SEO

Largest Contentful Paint: 3.0 s
Cumulative Layout Shift: 0
Total Blocking Time: 3,730 ms
First Contentful Paint: 2.8 s
Speed Index: 3.5 s

Top opportunities

Eliminate render-blocking resources~0.7 s
Reduce unused JavaScript~1066 KiB
Serve images in next-gen formats~39 KiB
Properly size images~21 KiB

Lab data from headless Chrome; results vary slightly between runs.

We crawled the first 25 pages; larger sites have more.

Pages checked

Page	Status	Title	Words	Issues
/	200	web.dev	1280	no H1
/html	200	HTML \| web.dev	1330	no description, no H1
/css	200	CSS \| web.dev	1421	no description, no H1
/javascript	200	JavaScript \| web.dev	1279	no description, no H1
/performance	200	Web performance \| web.dev	1420	no description, no H1
/accessibility	200	Accessibility \| web.dev	808	no description, no H1
/identity	200	Identity \| web.dev	909	no description, no H1
/learn/html	200	Learn HTML \| web.dev	729	—
/learn/css	200	Learn CSS \| web.dev	1608	—
/learn/javascript	200	Learn JavaScript \| web.dev	785	—
/learn/ai	200	Learn AI \| web.dev	555	—
/learn/performance	200	Learn Performance \| web.dev	1231	—
/learn/accessibility	200	Learn Accessibility \| web.dev	709	—
/learn	200	Learn web development \| web.dev	568	no description, no H1
/explore/ai	200	Artificial Intelligence \| web.dev	1145	no description, no H1
/explore	200	Explore \| web.dev	532	no description, no H1
/shows	200	Shows \| web.dev	586	no H1
/newsletter	200	Newsletter \| web.dev	318	no description, no H1
/about	200	About \| web.dev	740	no description, no H1
/discover	200	Discover \| web.dev	234	no description, no H1
/baseline	200	Baseline \| web.dev	1577	no description, no H1
/how-to-use-baseline	200	How to use Baseline \| web.dev	1101	no description, no H1
/blog	200	Blog \| web.dev	303	no H1
/case-studies	200	Case studies \| web.dev	315	no description, no H1
/explore/how-to-optimize-inp?utm_source=web.dev&utm_medium=cards&utm_campaign=inp-cwv	200	How to Optimize Interaction to Next Paint (INP) \| web.dev	703	no description, no H1

Issues to fix on web.dev

HighHeavy JavaScript blocks the page (TBT)Performance

Total Blocking Time was 3,730 ms (good is 200 ms or less); long tasks like this usually mean slow interactions (INP).

Why it matters

Total Blocking Time adds up the long tasks that stop the browser responding to taps and clicks. It is the lab stand-in for Interaction to Next Paint (INP).

How to fix it

Remove unused scripts and third-party tags, defer non-critical JavaScript, and split large bundles.

MediumLinks without readable textAccessibility

6 link(s) have no text or accessible name.

Why it matters

Icon-only or empty links are announced as just “link”, so screen-reader and voice-control users can’t tell where they go.

How to fix it

Add visible text, an aria-label, or alt text on the image inside the link.

MediumSlow Largest Contentful Paint (LCP)Performance

Largest Contentful Paint was 3.0 s in the mobile lab test (good is 2.5 s or less).

Why it matters

LCP is when the biggest thing in the first screen (usually a hero image or heading) finishes rendering. Google treats over 2.5 s as needing improvement and over 4 s as poor, and it is one of the three Core Web Vitals.

How to fix it

Speed up the server response, preload or prioritise the hero image (`fetchpriority="high"`), serve it as WebP/AVIF at the right size, and remove render-blocking CSS/JS above the fold.

MediumNo H1 headingSEO

No H1 heading on the page.

Why it matters

The H1 is the page’s main headline. It helps search engines and screen-reader users understand what the page is about.

How to fix it

Add one clear H1 that matches the page topic.

Mediumhreflang tags have errorsSEO

2 problem(s) in 44 hreflang tags.

Why it matters

Invalid language codes or relative URLs make search engines ignore your hreflang set, so visitors may get the wrong language version.

How to fix it

Use ISO 639-1 language codes (optionally with an ISO 3166 region, e.g. en-GB) and absolute URLs.

Details

Invalid code “pt-BR-cn”
Invalid code “es-419-cn”

MediumPages without meta descriptionsSEO

16 of 24 other indexable page(s) have no meta description.

Why it matters

Google will pick its own snippet for these pages, which usually earns fewer clicks.

How to fix it

Add a 120–160 character description to your important pages.

Affected pages

/html
/css
/javascript
/performance
/accessibility
/identity
/learn
/explore/ai
/explore
/newsletter
/about
/discover
/baseline
/how-to-use-baseline
/case-studies
…and 1 more

MediumPages without an H1SEO

18 page(s) have no H1 heading.

Why it matters

A clear main heading helps search engines and screen-reader users understand each page.

How to fix it

Give each page one descriptive H1.

Affected pages

/html
/css
/javascript
/performance
/accessibility
/identity
/learn
/explore/ai
/explore
/shows
/newsletter
/about
/discover
/baseline
/how-to-use-baseline
…and 3 more

LowFrames without titlesAccessibility

1 iframe(s) without a title.

Why it matters

Embedded frames (videos, maps) need a title so assistive tech can describe them.

How to fix it

Add a descriptive title="" attribute to each iframe.

LowImages without width/heightPerformance

8 of 8 images have no width/height attributes.

Why it matters

When the browser doesn’t know an image’s size, content jumps as it loads — that’s Cumulative Layout Shift, a Core Web Vital.

How to fix it

Add width and height attributes (CSS can still make them responsive with `height:auto`).

LowImages not in modern formatsPerformance

8 of 8 images are JPEG/PNG/GIF without a WebP/AVIF alternative.

Why it matters

WebP and AVIF are typically 25–50% smaller than JPEG/PNG at the same quality and are supported by all current browsers.

How to fix it

Serve WebP/AVIF (with <picture> fallbacks if you need them) or let an image CDN negotiate the format.

LowWeb fonts may block text renderingPerformance

Google Fonts URL without &display=swap: https://fonts.googleapis.com/css2?family=Material+Icons&family=Material+Symbols+Outlined&display=block

Why it matters

Without font-display: swap (or optional), text can stay invisible until the font file arrives.

How to fix it

Add `font-display: swap` to @font-face rules, or `&display=swap` to Google Fonts URLs. Self-hosting fonts saves extra connections too.

Details

Google Fonts URL without &display=swap: https://fonts.googleapis.com/css2?family=Material+Icons&family=Material+Symbols+Outlined&display=block

LowNo security.txt fileBest practices

/.well-known/security.txt was not found (or has no Contact: line).

Why it matters

security.txt (RFC 9116) tells researchers how to report a vulnerability to you instead of disclosing it publicly or not at all.

How to fix it

Publish /.well-known/security.txt with at least a `Contact:` and an `Expires:` line.

LowNo Referrer-PolicySecurity

No Referrer-Policy header.

Why it matters

Browsers default to a reasonable policy today, but setting one explicitly guarantees full URLs (which can contain tokens or search terms) aren’t leaked to other sites.

How to fix it

Send `Referrer-Policy: strict-origin-when-cross-origin`.

LowNo Permissions-PolicySecurity

No Permissions-Policy header.

Why it matters

Permissions-Policy switches off powerful browser features (camera, microphone, geolocation, payment…) that your site doesn’t use, so injected or third-party code can’t use them either.

How to fix it

Send e.g. `Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=()`, allowing only what you need.

LowNo SPF recordSecurity

No SPF TXT record on web.dev.

Why it matters

SPF lists the servers allowed to send email for your domain. Without it, anyone can send convincing mail “from” you, and your real mail is more likely to land in spam.

How to fix it

Publish a TXT record like `v=spf1 include:_spf.your-provider.com ~all`. If the domain never sends mail, use `v=spf1 -all`.

LowNo DMARC recordSecurity

No DMARC record at _dmarc.web.dev.

Why it matters

DMARC tells mailbox providers what to do with mail that fails SPF/DKIM and sends you reports. Gmail and Yahoo now require it for bulk senders, and it’s the main defence against spoofing your domain.

How to fix it

Add a TXT record at `_dmarc.yourdomain` such as `v=DMARC1; p=none; rua=mailto:dmarc@yourdomain`, review the reports, then tighten to `p=quarantine` or `p=reject`.

LowTitle is very shortSEO

“web.dev” is 7 characters.

Why it matters

A very short title wastes space in search results that could explain what the page offers.

How to fix it

Expand it to roughly 30–60 characters: main topic first, brand last.

LowMeta description is shortSEO

“Guidance to build modern web experiences that work on any browser.” is 66 characters.

Why it matters

There’s room in search results to make a stronger case for clicking.

How to fix it

Aim for 120–160 characters describing the page’s value.

InfoBrotli compression not offeredPerformance

The server answered a Brotli-capable request with gzip.

Why it matters

Gzip is fine, but Brotli typically makes text files another 15–20% smaller and is supported by every modern browser.

How to fix it

Enable Brotli on the server (nginx brotli module, Apache mod_brotli) or let your CDN handle it.

Passed checks (32)

Valid SSL certificate — Trusted certificate for web.dev, valid until 2026-12-21 (55 days left), issued by Google Trust Services.
HTTP redirects to HTTPS — http://web.dev/ → https://web.dev/ (301).
HSTS enabled — Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
HSTS preload-ready header — max-age ≥ 1 year with includeSubDomains and preload.
Content-Security-Policy restricts scripts — base-uri 'self'; object-src 'none'; script-src 'strict-dynamic' 'unsafe-inline' https: http: 'nonce-5BfFqq81bkKcdwAXm83wN25VBjeqWo' 'unsafe-eval'; frame-ancestors 'self' https://developers.google.com/
Clickjacking protection — CSP frame-ancestors is set.
MIME sniffing disabled — X-Content-Type-Options: nosniff
No mixed content — Every resource referenced in the HTML uses https://.
Fast server response — Time to first byte 0.36s.
Text compression enabled — Content-Encoding: gzip
HTTP/2 and HTTP/3 supported — Served over HTTP/2 and advertises HTTP/3 (QUIC) via Alt-Svc.
Lean HTML — The HTML document is 129.6 KB.
Few render-blocking resources — 0 blocking script(s), 3 stylesheet(s).
Off-screen images are lazy-loaded
Page loads successfully — HTTP 200.
Page is indexable — No noindex directive in meta robots or X-Robots-Tag.
Canonical URL set — https://web.dev/
Mobile viewport set — width=device-width, initial-scale=1
Open Graph tags present — og:title, og:description and og:image are set.
Structured data found — Types: Article, Organization, WebSite.
robots.txt allows crawling — 1 rule group(s).
XML sitemap found — https://web.dev/sitemap.xml (index with 2 entries).
Missing pages return 404 — A made-up URL returned 404.
Page language declared — lang="en"
All images have alt attributes — 10 images checked.
Form fields are labelled — 2 fields checked.
Logical heading structure — 49 headings in order.
Standards-mode HTML5 document — Doctype and charset are declared.
CAA records restrict certificate issuance — issue pki.goog; issue letsencrypt.org
Reachable over IPv6 — web.dev has an AAAA record.
No broken links found — Checked 25 page(s) and 60 linked URL(s).
Page titles are unique — Across 25 crawled page(s).

Technology detected

Google Tag Manager
Google Fonts

Want these fixed for you?

SuperSiteBros care plans take care of security hardening, speed, updates and monitoring so your grade stays high.

See care plans

This report was generated automatically from public information. How we score sites · Own this site? Request removal

web.dev website health report

web.dev scores 83/100

Free expert review

Free weekly monitoring

Matched SuperSiteBros services

Score history

Lighthouse speed test (mobile)

Top opportunities

Site crawl

Issues to fix on web.dev

Why it matters

How to fix it

Why it matters

How to fix it

Why it matters

How to fix it

Why it matters

How to fix it

Why it matters

How to fix it

Details

Why it matters

How to fix it

Affected pages

Why it matters

How to fix it

Affected pages

Why it matters

How to fix it

Why it matters

How to fix it

Why it matters

How to fix it

Why it matters

How to fix it

Details

Why it matters

How to fix it

Why it matters

How to fix it

Why it matters

How to fix it

Why it matters

How to fix it

Why it matters

How to fix it

Why it matters

How to fix it

Why it matters

How to fix it

Why it matters

How to fix it

Site facts

Technology detected

Want these fixed for you?