# Audit Report: foxway.com

**Website:** https://foxway.com/  
**Date:** 03.09.2026  
**Audit Coverage:** 43% — axe-core: page.goto: Timeout 60000ms exceeded.
Call log:
  - navigating to "https://foxway.com/", waiting until "networkidle"
; Browser Runtime: page.goto: Timeout 60000ms exceeded.
Call log:
  - navigating to "https://foxway.com/", waiting until "networkidle"
; HTML Inventory: page.goto: Timeout 60000ms exceeded.
Call log:
  - navigating to "https://foxway.com/", waiting until "networkidle"
; Optimized-Web Checklist: Requires html and securityHeaders to succeed  
**Confidence:** medium

**Pages Audited (1 of 1):**

- https://foxway.com/

## Summary of results

**Overall Score:** 38 / 100  
**Status:** ⚠ 🟠 **Poor**

Site overall 38 is the mean of 1 page. PSI mobile performance 40/100 is catastrophic (LCP 5.5s >4s heavy penalty, TBT 2.13s >600ms heavy penalty, FCP 3.03s >3s heavy penalty). Desktop is better at 69 but Google uses mobile-first indexing. W3C validator found 53 HTML errors including structural issues (h3 inside role=button ×9, duplicate IDs, heading order violations). Security headers score 47/100 with missing CSP and insecure cookie flags. SEO scores 100/100 and CLS is excellent at 0.000. Confidence is medium because PSI succeeded but axe-core, Browser Runtime, and HTML Inventory all timed out, leaving accessibility and image analysis unverifiable.

### Per-page scores

🟠 **Poor** · https://foxway.com/

| Score | Performance | Accessibility | Best Practices | SEO | Security |
| --- | --- | --- | --- | --- | --- |
| 38 | 40 | 95 | 77 | 100 | 47 |

## PageSpeed Insights — Mobile vs Desktop

_Lower is worse for Performance; higher is worse for LCP and CLS. Worse value is **bolded**._

| URL | Performance (M / D) | LCP (M / D) | CLS (M / D) |
| --- | --- | --- | --- |
| https://foxway.com/ | **40** / 69 | **5.53 s** / 2.63 s | 0.000 / **0.002** |

## Fixes

### Priority 1: Critical
*Immediate action — impacts user experience, search rankings, or site safety.*

**1A. Reduce third-party script impact (recaptcha, gtag, cookie consent)** `Performance`
- **Impact:** TBT 2.13s, LCP 5.5s, FCP 3.03s, Speed Index 6.51s
- **Problem:** Multiple long tasks from recaptcha (268ms, 264ms, 186ms, 139ms, 138ms), gtag (329ms, 232ms), and cookie consent modal (1.21s). 169KB+ wasted JS from recaptcha alone.
- **Solution:**
  - Load recaptcha with `defer` or `async` and only when needed (e.g., on form interaction)
  - Use `requestIdleCallback` or `setTimeout` to delay non-critical scripts
  - Consider self-hosting recaptcha or using a lighter alternative
  - Defer Google Tag Manager until after LCP
  - Lazy-load cookie consent modal (only show after user interaction)

**1B. Implement proper caching headers** `Performance`
- **Impact:** Cache savings of 606 KiB, repeat visit performance
- **Problem:** No cache-control header set; caching behavior is unpredictable. TTFB field data shows 2505ms (slow) despite 4ms lab.
- **Solution:**
  Add cache-control for static assets:
  ```apache
  <IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType image/webp "access plus 1 year"
    ExpiresByType image/jpeg "access plus 1 year"
    ExpiresByType text/css "access plus 1 month"
    ExpiresByType application/javascript "access plus 1 month"
  </IfModule>
  Header set Cache-Control "max-age=31536000, public" for static assets
  ```

**1C. Fix AWSALB cookie security flags** `Security`
- **Impact:** Session hijacking, CSRF risk
- **Problem:** AWSALB cookie missing Secure, HttpOnly, and SameSite flags. Cookie sent over HTTP and accessible to JavaScript.
- **Solution:**
  Configure load balancer to set:
  ```
  Set-Cookie: AWSALB=...; Secure; HttpOnly; SameSite=Lax
  ```
  This prevents XSS exfiltration and CSRF attacks.

### Priority 2: Important
*Essential for compliance, user reach, and search visibility.*

**2A. Fix heading order and role=button violations** `Accessibility`
- **Impact:** Screen reader navigation, WCAG 1.3.1, 2.4.6
- **Problem:** 9 instances of h3 inside role=button elements. Heading order skips from h2 to h6 (skipping 3 levels). Multiple duplicate IDs (accordion, text-block, social-links, clip0).
- **Solution:**
  - Remove role=button from elements containing headings; use `<button>` with proper text instead
  - Fix heading hierarchy: h1 → h2 → h3 (no skips)
  - Ensure each ID is unique across the page
  - Add section headings where missing (section #form-2 lacks heading)

**2B. Add Content-Security-Policy header** `Security`
- **Impact:** XSS defense-in-depth
- **Problem:** CSP missing. Site has no auth/payments/UGC signals, but WordPress sites are common XSS targets.
- **Solution:**
  Start with a restrictive CSP and iterate:
  ```
  Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' https://www.gstatic.com https://www.googletagmanager.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; frame-src https://www.google.com;
  ```
  Use nonce/hash approach for production.

### Priority 3: Best Practice
*Recommended for long-term maintainability.*

**3A. Fix W3C HTML validation errors** `Best Practices`
- **Impact:** SEO, cross-browser compatibility, maintainability
- **Problem:** 53 HTML errors including meta name not allowed (×7), style in body (×5), bad target attribute (×4), stray end tags, duplicate IDs.
- **Solution:**
  - Move `<style>` from body to head
  - Fix meta tags: use `property` for Open Graph, remove `name` where not allowed
  - Add proper target values (remove empty strings)
  - Fix video element: remove `disableRemotePlayback` attribute
  - Ensure `<link>` elements have proper `rel` attributes