{"url":"https://demo.playandnope.com/","date":"2026-07-12","siteName":"Tere tulemast Paws N' Play veebilehele! — gotoAndPlay Demo WordPress Base","overall":78,"reasoning":"Mobile performance is strong (90) but LCP (2.9s) falls in the warning zone due to the hero image incorrectly using lazy loading. Security posture is critically weak (20/100) because HTTP traffic does not redirect to HTTPS and HSTS is missing, despite the site being a brochure with no auth/payments. Accessibility is excellent (0 axe violations) but 10 W3C validation errors indicate code quality issues. The site is a pet care community/marketing site, which lowers CSP priority but not basic header requirements.","confidence":"high","fixes":[{"priority":1,"title":"Force HTTPS redirect for all HTTP traffic","impact":"Security, Data Integrity","problem":"http://demo.playandnope.com/ does not redirect to HTTPS, leaving users vulnerable to MITM attacks on unencrypted connections.","solution":"Configure the web server (Apache/Nginx) to return a 301 redirect for all HTTP requests to the HTTPS version:\n```apache\nRewriteEngine On\nRewriteCond %{HTTPS} off\nRewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]\n```"},{"priority":1,"title":"Remove lazy loading from hero image","impact":"LCP, FCP, Performance","problem":"Hero image has loading=\"lazy\", which delays rendering and contributes to LCP of 2.9s on mobile.","solution":"Remove `loading=\"lazy\"` from the largest above-the-fold image and add `fetchpriority=\"high\"`:\n```html\n<img src=\"hero.jpg\" alt=\"...\" fetchpriority=\"high\" width=\"...\" height=\"...\">\n```"},{"priority":2,"title":"Add HSTS and X-Content-Type-Options headers","impact":"Security Headers Grade, Transport Security","problem":"HSTS and X-Content-Type-Options are missing; Security Headers grade is 20/100.","solution":"Add these headers to the server configuration:\n```apache\nHeader always set Strict-Transport-Security \"max-age=63072000; includeSubDomains\"\nHeader always set X-Content-Type-Options \"nosniff\"\n```"},{"priority":2,"title":"Fix W3C HTML validation errors","impact":"Code Quality, Accessibility","problem":"10 errors found including invalid `aria-expanded` values, `target` on span, and script `type`/`defer` mismatches.","solution":"- Set `aria-expanded=\"true\"` or `\"false\"` (not empty string) on buttons.\n- Remove `target` attribute from `<span>` elements.\n- Change script `type=\"text/rocketlazyloadscript\"` to `type=\"module\"` or remove `defer` if not a valid MIME type."},{"priority":3,"title":"Implement Content-Security-Policy (CSP)","impact":"XSS Defense-in-Depth","problem":"CSP is missing. Site signals show no auth/payments/UGC, so this is lower priority than headers, but still recommended.","solution":"Deploy a strict CSP with nonce/hash approach rather than a flat allowlist:\n```apache\nHeader always set Content-Security-Policy \"default-src 'self'; script-src 'nonce-{random}' 'strict-dynamic'; object-src 'none'; base-uri 'none';\"\n```"}],"coverage":{"pct":100,"missing":[]},"psiSnapshot":{"rows":[{"pageUrl":null,"perfMobile":90,"perfDesktop":100,"lcpMobileMs":2855.2035970124375,"lcpDesktopMs":726.7035980883855,"clsMobile":0,"clsDesktop":0.002559571311917956}]},"optimizationChecklist":{"items":[{"id":"caching","title":"Page caching plugin / CDN active","status":"pass","detail":"Caching plugin detected (WP Rocket)","evidence":["HTML markers: WP Rocket","generator: WP Rocket 3.22.0.3"]},{"id":"lazyload","title":"Images lazy-loaded","status":"pass","detail":"All non-hero raster images use loading=\"lazy\".","evidence":[]},{"id":"heroEager","title":"Hero image eagerly loaded","status":"fail","detail":"Hero image has loading=\"lazy\", which delays LCP (inferred from DOM order/size — Lighthouse LCP element unavailable). Use loading=\"eager\" (or omit loading) and add fetchpriority=\"high\".","evidence":["hero: …ayandnope.com/wp-content/uploads/2024/06/6027eb05ed4efb000419981a-155x155.png","loading: lazy","fetchpriority: (not set)"]},{"id":"heroBackground","title":"Hero is a real <img> (not a CSS background-image)","status":"n/a","detail":"No CSS background-images detected on raster-image-eligible elements.","evidence":[]},{"id":"responsive","title":"Responsive images (srcset / <picture>)","status":"pass","detail":"20/20 raster images use srcset or <picture> (100%).","evidence":[]},{"id":"imageSizes","title":"Reasonable number of image sizes","status":"pass","detail":"48 distinct srcset widths.","evidence":["widths: 100, 116, 124, 150, 155, 200, 225, 233, 240, 242, 248, 280, 300, 310, 324, 400, 410, 483, 500, 510, 512, 560, 600, 626, 648, 667, 700, 768, 800, 840, 959, 972, 1024, 1120, 1152, 1284, 1296, 1400, 1440, 1472, 1536, 1680, 1920, 1944, 1960, 2048, 2240, 2560"]},{"id":"scriptsFooter","title":"JS scripts not blocking in <head>","status":"warn","detail":"1 render-blocking script in <head>. Move to footer or add defer/async.","evidence":["https://cdn-cookieyes.com/client_data/29b8e2e5821bed2234ee953c/script.js"]}],"summary":{"passed":4,"warned":1,"failed":1,"notApplicable":1},"priorities":[{"title":"Hero image eagerly loaded","severity":"high","detail":"Hero image has loading=\"lazy\", which delays LCP (inferred from DOM order/size — Lighthouse LCP element unavailable). Use loading=\"eager\" (or omit loading) and add fetchpriority=\"high\"."},{"title":"JS scripts not blocking in <head>","severity":"medium","detail":"1 render-blocking script in <head>. Move to footer or add defer/async."}]}}