wptavern.com website health report
Website health report
wptavern.com scores 88/100
Good overall, with a few things worth fixing. We found 24 issues; the weakest area is Security (81/100).
- 8 Medium
- 16 Low
- 27 Passed
Free expert review
Send this report to SuperSiteBros. An expert will look it over and email you with the highest-impact fixes — no obligation.
Free weekly monitoring
Weekly monitoring is built and ready, but outbound email from this server is not reliable yet (no SPF/DKIM/DMARC and no SMTP). Sign-ups stay closed until that is fixed — use the free expert review above in the meantime.
Matched SuperSiteBros services
Lighthouse speed test (mobile)
- Largest Contentful Paint
- 3.1 s
- Cumulative Layout Shift
- 0.01
- Total Blocking Time
- 20 ms
- First Contentful Paint
- 2.1 s
- Speed Index
- 2.1 s
Top opportunities
- Eliminate render-blocking resources~1.1 s
- Reduce unused CSS~0.3 s
- Reduce unused JavaScript~0.2 s
- Serve images in next-gen formats~0.2 s
- Properly size images~0.2 s
- Avoid serving legacy JavaScript to modern browsers~23 KiB
Site crawl
- Pages crawled
- 25
- Broken links
- 4
- Redirect chains
- 0
- Missing titles
- 0
- Duplicate titles
- 1
- Missing descriptions
- 24
- Missing H1
- 2
- Thin pages
- 2
- Noindex pages
- 0
- Mixed content pages
- 0
Pages checked
| Page | Status | Title | Words | Issues |
|---|---|---|---|---|
| / | 200 | WP Tavern – WordPress News — Free as in Beer. | 1033 | no description, no H1 |
| /category/news | 200 | News – WP Tavern | 1121 | no description |
| /category/opinion | 200 | Opinion – WP Tavern | 1016 | no description |
| /category/plugins | 200 | Plugins – WP Tavern | 1077 | no description |
| /category/themes | 200 | Themes – WP Tavern | 1117 | no description |
| /category/wordcamps-meetups | 200 | Events – WP Tavern | 1045 | no description |
| /forums | 200 | Forums – WP Tavern | 128 | no description, thin |
| /podcast | 200 | Episode – WP Tavern | 1210 | no description |
| /contact | 200 | Contact Us – WP Tavern | 143 | no description, no H1, thin |
| /podcast/238-chris-huber-on-how-static-site-importer-makes-migrating-any-website-to-wordpress-easier-than-ever/ | 200 | #238 – Chris Huber on How Static Site Importer Makes Migrating Any Website to WordPress E… | 9044 | no description |
| /blog | 200 | Blog – WP Tavern | 1096 | no description, no H1 |
| /podcast/237-robert-abela-on-wordpress-security-and-the-battle-against-ai-threats/ | 200 | #237 – Robert Abela on WordPress Security and the Battle Against AI Threats – WP Tavern | 9242 | no description |
| /podcast/236-brian-coords-on-wordpress-as-the-source-of-truth/ | 200 | #236 – Brian Coords on WordPress as the Source of Truth – WP Tavern | 10565 | no description |
| /podcast/235-rob-pugh-and-tony-arcangelini-on-bringing-podcasting-to-jetpack/ | 200 | #235 – Rob Pugh and Tony Arcangelini on Bringing Podcasting to Jetpack – WP Tavern | 8429 | no description |
| /podcast/234-k-adam-white-on-migrating-to-blocks-with-artisanal-care-and-enterprise-efficiency/ | 200 | #234 – K. Adam White on Migrating to Blocks With Artisanal Care and Enterprise Efficiency… | 9087 | no description |
| /podcast/233-chris-reynolds-on-building-trust-with-project-contracts-for-reliable-ai-development/ | 200 | #233 – Chris Reynolds on Building Trust With Project Contracts for Reliable AI Developmen… | 10464 | no description |
| /podcast/232-aaron-d-campbell-on-navigating-wordpress-security-in-the-ai-era/ | 200 | #232 – Aaron D Campbell on Navigating WordPress Security in the AI Era – WP Tavern | 9342 | no description |
| /podcast/231-damon-cook-on-how-wp-trend-watcher-keeps-him-up-to-date-with-wordpress/ | 200 | #231 – Damon Cook on How WP Trend Watcher Keeps Him Up to Date With WordPress – WP Tavern | 7003 | no description |
| /podcast/230-adrian-sticea-on-navigating-the-decline-of-wordpress-work-on-upwork-and-the-rise-of-new-opportunities/ | 200 | #230 – Adrian Sticea on Navigating the Decline of WordPress Work on Upwork and the Rise o… | 6994 | no description |
| /2015/12/28/pique-a-free-small-business-theme-for-wordpress/ | 200 | Pique: A Free Small Business Theme for WordPress – WP Tavern | 1713 | no description |
| /2025/01/08/wordpress-com-launches-studio-sync/ | 200 | WordPress.com Launches Studio Sync – WP Tavern | 361 | no description |
| /2024/12/09/wordpress-core-team-proposes-adding-wp-consent-api-to-wordpress-core/ | 200 | WordPress Core Team Proposes Adding WP Consent API to WordPress Core – WP Tavern | 686 | no description |
| /2023/11/09/wordfence-launches-bug-bounty-program/ | 200 | Wordfence Launches Bug Bounty Program – WP Tavern | 1602 | no description |
| /2017/03/30/new-wpstats-me-site-displays-wordpress-org-plugin-download-stats/ | 200 | New WPstats.me Site Displays WordPress.org Plugin Download Stats – WP Tavern | 2061 | no description |
| /forums/topic/238-chris-huber-on-how-static-site-importer-makes-migrating-any-website-to-wordpress-easier-than-ever/ | 200 | #238 – Chris Huber on How Static Site Importer Makes Migrating Any Website to WordPress E… | 471 | no description |
Issues to fix on wptavern.com
MediumSlow Largest Contentful Paint (LCP)Performance
Largest Contentful Paint was 3.1 s in the mobile lab test (good is 2.5 s or less).
Why it matters
LCP is when the biggest thing in the first screen (usually a hero image or heading) finishes rendering. Google treats over 2.5 s as needing improvement and over 4 s as poor, and it is one of the three Core Web Vitals.
How to fix it
Speed up the server response, preload or prioritise the hero image (`fetchpriority="high"`), serve it as WebP/AVIF at the right size, and remove render-blocking CSS/JS above the fold.
MediumNo clickjacking protectionSecurity
Neither X-Frame-Options nor CSP frame-ancestors is set.
Why it matters
Without frame-ancestors (or X-Frame-Options), another site can load yours invisibly inside a frame and trick visitors into clicking buttons they can’t see.
How to fix it
Send `Content-Security-Policy: frame-ancestors 'self'` (modern) and/or `X-Frame-Options: SAMEORIGIN` (legacy browsers).
MediumWordPress usernames are publicly listedSecurity
/wp-json/wp/v2/users lists 5 user slug(s) to anonymous visitors.
Why it matters
The REST API endpoint /wp-json/wp/v2/users lists author usernames, giving brute-force bots half of every login.
How to fix it
Restrict the users endpoint to logged-in users and use strong passwords plus two-factor authentication.
MediumMissing meta descriptionSEO
No meta description tag found.
Why it matters
The meta description is your pitch in search results. Without one, Google picks a random snippet, which usually earns fewer clicks.
How to fix it
Write a unique 120–160 character summary that tells searchers why to click.
MediumNo H1 headingSEO
No H1 heading on the page.
Why it matters
The H1 is the page’s main headline. It helps search engines and screen-reader users understand what the page is about.
How to fix it
Add one clear H1 that matches the page topic.
MediumBroken linksSEO
2 broken internal and 2 broken external link(s) found.
Why it matters
Links to missing pages frustrate visitors and waste the authority you pass through links.
How to fix it
Update or remove links that return 404/410 or server errors; redirect deleted pages to their closest replacement.
Details
- https://wptavern.com/2024/03/13/reflections-on-my-2-weeks-writing-for-the-tavern/ (429) ← linked from /category/opinion
- https://wptavern.com/2024/03/12/surprising-tech-trends-in-wordpress-and-beyond/ (429) ← linked from /category/opinion
- http://twitter.com/wptavern (520) ← linked from /, /category/news
- https://axeazy.com/wordpress-accessibility (404) ← linked from /podcast/238-chris-huber-on-how-static-site-importer-makes-migrating-any-website-to-wordpress-easier-than-ever/
MediumDuplicate page titlesSEO
1 title(s) are shared by more than one page.
Why it matters
When several pages share a title, search engines struggle to tell which to rank and searchers can’t tell them apart.
How to fix it
Give every page a unique title describing its own content.
Details
- “#238 – chris huber on how static site importer makes migrating any web” on /podcast/238-chris-huber-on-how-static-site-importer-makes-migrating-any-website-to-wordpress-easier-than-ever/, /forums/topic/238-chris-huber-on-how-static-site-importer-makes-migrating-any-website-to-wordpress-easier-than…
MediumPages without meta descriptionsSEO
24 of 24 other indexable page(s) have no meta description.
Why it matters
Google will pick its own snippet for these pages, which usually earns fewer clicks.
How to fix it
Add a 120–160 character description to your important pages.
Affected pages
- /category/news
- /category/opinion
- /category/plugins
- /category/themes
- /category/wordcamps-meetups
- /forums
- /podcast
- /contact
- /podcast/238-chris-huber-on-how-static-site-importer-makes-migrating-any-website-to-wordpress-easier-than-ever/
- /blog
- /podcast/237-robert-abela-on-wordpress-security-and-the-battle-against-ai-threats/
- /podcast/236-brian-coords-on-wordpress-as-the-source-of-truth/
- /podcast/235-rob-pugh-and-tony-arcangelini-on-bringing-podcasting-to-jetpack/
- /podcast/234-k-adam-white-on-migrating-to-blocks-with-artisanal-care-and-enterprise-efficiency/
- /podcast/233-chris-reynolds-on-building-trust-with-project-contracts-for-reliable-ai-development/
- …and 9 more
LowRender-blocking scripts and stylesheetsPerformance
2 blocking script(s) and 10 stylesheet(s) in the page head.
Why it matters
Scripts in the <head> without async/defer, and stylesheets, must download before the browser paints anything.
How to fix it
Add `defer` to scripts that don’t need to run early, inline small critical CSS, and load the rest asynchronously.
LowImages not in modern formatsPerformance
9 of 9 images are JPEG/PNG/GIF without a WebP/AVIF alternative.
Why it matters
WebP and AVIF are typically 25–50% smaller than JPEG/PNG at the same quality and are supported by all current browsers.
How to fix it
Serve WebP/AVIF (with <picture> fallbacks if you need them) or let an image CDN negotiate the format.
LowHeavy imagesPerformance
1 sampled image(s) are over 400 KB.
Why it matters
Images are usually the biggest part of a page. Oversized files slow the Largest Contentful Paint and burn mobile data.
How to fix it
Resize images to the size they’re shown at, compress them, and serve WebP or AVIF.
Details
- https://wptavern.com/wp-content/uploads/2026/10/238-Chris-Huber-on-How-Static-Site-Importer-Makes-Migrating-Any-Website-to-WordPress-Easier-Than-Ever.jpg (470 KB)
LowWeb fonts may block text renderingPerformance
Google Fonts URL without &display=swap: https://fonts.googleapis.com/css?family=Lato:400,700%7CLibre+Baskerville:400,700,ital@0;1&ver=1.0.0
Why it matters
Without font-display: swap (or optional), text can stay invisible until the font file arrives.
How to fix it
Add `font-display: swap` to @font-face rules, or `&display=swap` to Google Fonts URLs. Self-hosting fonts saves extra connections too.
Details
- Google Fonts URL without &display=swap: https://fonts.googleapis.com/css?family=Lato:400,700%7CLibre+Baskerville:400,700,ital@0;1&ver=1.0.0
LowNo security.txt fileBest practices
/.well-known/security.txt was not found (or has no Contact: line).
Why it matters
security.txt (RFC 9116) tells researchers how to report a vulnerability to you instead of disclosing it publicly or not at all.
How to fix it
Publish /.well-known/security.txt with at least a `Contact:` and an `Expires:` line.
LowNo Content-Security-PolicySecurity
No Content-Security-Policy header.
Why it matters
A CSP limits which scripts, frames and other resources the browser will run, which makes cross-site scripting (XSS) and injected code far less damaging.
How to fix it
Start with a report-only policy, then enforce. A practical baseline: `default-src 'self'; frame-ancestors 'self'; object-src 'none'; base-uri 'self'; upgrade-insecure-requests`, adding the third-party hosts you actually use. Prefer nonces or hashes over 'unsafe-inline'.
LowX-Content-Type-Options missingSecurity
X-Content-Type-Options: nosniff is not set.
Why it matters
Without `nosniff`, some browsers guess a file’s type from its contents, which can turn an uploaded “image” into executable script.
How to fix it
Send `X-Content-Type-Options: nosniff` on all responses.
LowNo Referrer-PolicySecurity
No Referrer-Policy header.
Why it matters
Browsers default to a reasonable policy today, but setting one explicitly guarantees full URLs (which can contain tokens or search terms) aren’t leaked to other sites.
How to fix it
Send `Referrer-Policy: strict-origin-when-cross-origin`.
LowNo Permissions-PolicySecurity
No Permissions-Policy header.
Why it matters
Permissions-Policy switches off powerful browser features (camera, microphone, geolocation, payment…) that your site doesn’t use, so injected or third-party code can’t use them either.
How to fix it
Send e.g. `Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=()`, allowing only what you need.
LowXML-RPC is enabledSecurity
/xmlrpc.php responds (405).
Why it matters
xmlrpc.php is a legacy API that is widely abused for password-guessing (many attempts per request) and pingback DDoS.
How to fix it
If you don’t use the WordPress mobile app, Jetpack or remote publishing, block xmlrpc.php at the server.
LowNo DMARC recordSecurity
No DMARC record at _dmarc.wptavern.com.
Why it matters
DMARC tells mailbox providers what to do with mail that fails SPF/DKIM and sends you reports. Gmail and Yahoo now require it for bulk senders, and it’s the main defence against spoofing your domain.
How to fix it
Add a TXT record at `_dmarc.yourdomain` such as `v=DMARC1; p=none; rua=mailto:dmarc@yourdomain`, review the reports, then tighten to `p=quarantine` or `p=reject`.
LowNo structured dataSEO
No JSON-LD or microdata found.
Why it matters
Structured data (schema.org JSON-LD) helps search engines understand your organisation, articles, products or FAQs and can unlock rich results.
How to fix it
Add JSON-LD for your organisation/website, plus the type that fits each page (Article, Product, LocalBusiness…). Check it with Google’s Rich Results Test.
Lowrobots.txt doesn’t list a sitemapSEO
No “Sitemap:” line in robots.txt.
Why it matters
The Sitemap line is how crawlers that you haven’t submitted to (Bing, others) find your sitemap.
How to fix it
Add `Sitemap: https://yourdomain/sitemap.xml` (absolute URL).
LowInternal links point at redirectsSEO
9 internal link target(s) redirect.
Why it matters
Each redirect adds a round-trip before the page loads and dilutes link signals slightly.
How to fix it
Update internal links to point straight at the final URL.
Details
- /category/news → /category/news/
- /category/opinion → /category/opinion/
- /category/plugins → /category/plugins/
- /category/themes → /category/themes/
- /category/wordcamps-meetups → /category/wordcamps-meetups/
- /forums → /forums/
- /podcast → /podcast/
- /contact → /contact/
- /blog → /blog/
LowPages without an H1SEO
2 page(s) have no H1 heading.
Why it matters
A clear main heading helps search engines and screen-reader users understand each page.
How to fix it
Give each page one descriptive H1.
Affected pages
- /contact
- /blog
LowThin pagesSEO
2 page(s) have fewer than 200 words of visible text.
Why it matters
Pages with very little unique text rarely rank and can drag down how search engines judge the site’s overall quality.
How to fix it
Expand them with genuinely useful content, merge similar pages, or noindex utility pages.
Affected pages
- /forums (128 words)
- /contact (143 words)
InfoDuplicate element IDsAccessibility
3 id value(s) are used more than once.
Why it matters
Duplicate IDs break label/field associations and ARIA references, so assistive tech may read the wrong thing.
How to fix it
Make every id attribute unique on the page.
InfoNo IPv6 addressBest practices
wptavern.com has no AAAA record.
Why it matters
A growing share of mobile users connect over IPv6. It works fine without, but IPv6 can be slightly faster on those networks.
How to fix it
Add an AAAA record if your host or CDN supports IPv6.
InfoNot ready for the HSTS preload listSecurity
For preload the header still needs: includeSubDomains, preload.
Why it matters
Preloading bakes your domain into browsers as HTTPS-only, protecting even the very first visit. It’s optional and hard to undo, so only do it once every subdomain supports HTTPS.
How to fix it
Serve `max-age=31536000; includeSubDomains; preload` on the root domain, redirect http→https on the same host first, then submit at hstspreload.org.
InfoNo CAA recordSecurity
No CAA records for wptavern.com — any public CA may issue certificates.
Why it matters
CAA records say which certificate authorities may issue certificates for your domain, reducing the risk of a mis-issued certificate.
How to fix it
Add e.g. `yourdomain. CAA 0 issue "letsencrypt.org"` for each CA you use (check your CDN’s required CAs first).
No issues match these filters.
Passed checks (27)
- Valid SSL certificate — Trusted certificate for wptavern.com, valid until 2026-12-08 (42 days left), issued by Google Trust Services.
- HTTP redirects to HTTPS — http://wptavern.com/ → https://wptavern.com/ (301).
- HSTS enabled — Strict-Transport-Security: max-age=31536000
- No mixed content — Every resource referenced in the HTML uses https://.
- Fast server response — Time to first byte 0.03s.
- Brotli compression — Content-Encoding: br
- HTTP/2 supported — Served over HTTP/2.
- Lean HTML — The HTML document is 152.4 KB.
- Off-screen images are lazy-loaded
- Static files are cacheable — 4 sampled CSS/JS files have long cache lifetimes.
- Page loads successfully — HTTP 200.
- Page is indexable — No noindex directive in meta robots or X-Robots-Tag.
- Good page title — “WP Tavern – WordPress News — Free as in Beer.” (45 characters).
- Canonical URL set — https://wptavern.com/
- Mobile viewport set — width=device-width, initial-scale=1
- Open Graph tags present — og:title, og:description and og:image are set.
- robots.txt allows crawling — 3 rule group(s).
- XML sitemap found — https://wptavern.com/sitemap.xml (index with 3 entries).
- Missing pages return 404 — A made-up URL returned 404.
- One preferred hostname — www.wptavern.com redirects (301) to the preferred version.
- Page language declared — lang="en-US"
- All images have alt attributes — 11 images checked.
- Form fields are labelled — 4 fields checked.
- Links and buttons have names
- Logical heading structure — 19 headings in order.
- Standards-mode HTML5 document — Doctype and charset are declared.
- SPF record present — v=spf1 a mx ip4:208.97.156.73 include:_spf.google.com ~all
Site facts
- Final URL
- https://wptavern.com/
- HTTP status
- 200
- Server response (TTFB)
- 32 ms
- Protocol
- HTTP/2
- Compression
- br
- HTML size
- 152.4 KB
- DOM elements
- 521
- Words on page
- 1033
- Certificate
- Valid, 42 days left (Google Trust Services)
- Email DNS
- SPF ✓ · DMARC ✗ · CAA ✗ · IPv6 ✗
- Server
- nginx
Technology detected
Want these fixed for you?
SuperSiteBros care plans take care of security hardening, speed, updates and monitoring so your grade stays high.
See care plans