{"url":"https://gigainvesteeringud.giga.ee/","date":"2026-08-31","siteName":"Giga Investeeringud","overall":73,"reasoning":"Site overall 73 is the mean of 5 pages. Scores range 68 (https://gigainvesteeringud.giga.ee/uudised/tutvustame-uusi-kodusid-raadil) → 87 (https://gigainvesteeringud.giga.ee/). Weakest page: Mobile performance is the primary constraint with an LCP of 4.1 s and FCP of 3.04 s, both exceeding recommended thresholds. Security posture is critically weak with a 0/100 header score, missing HSTS and CSP despite user-generated content signals. Accessibility has two serious axe violations regarding color contrast and link names that require immediate remediation. HTML validation errors in `srcset` and script attributes further degrade code quality. SEO is hindered by missing meta descriptions and structured data.","confidence":"high","fixes":[{"priority":1,"category":"Security","title":"Add HSTS and X-Content-Type-Options headers","impact":"Transport security, MIME sniffing protection","problem":"Security Headers grade is 0/100; HSTS and X-Content-Type-Options are missing despite HTTPS being enabled.","solution":"Add the following headers to your server configuration (Apache example):\n```apache\nHeader always set Strict-Transport-Security \"max-age=63072000; includeSubDomains\"\nHeader always set X-Content-Type-Options \"nosniff\"\n```"},{"priority":1,"category":"Accessibility","title":"Fix color contrast on navigation links","impact":"WCAG 1.4.3 Compliance, Screen Reader usability","problem":"axe-core reports 1 serious violation: color-contrast on multiple menu items (e.g., .menu-item-543).","solution":"Increase the contrast ratio between text and background to at least 4.5:1. Adjust CSS for `.menu-item-543 > a` and similar selectors to use darker text or lighter backgrounds."},{"priority":1,"category":"Security","title":"Implement Critical Security Headers (HSTS, CSP)","impact":"Transport security, XSS defense","problem":"Security Headers grade is 0/100; HSTS and CSP are missing. Site signals indicate user-generated content (upload anchor), elevating XSS risk.","solution":"Add HSTS with preload and a strict CSP:\n```http\nStrict-Transport-Security: max-age=63072000; includeSubDomains; preload\nContent-Security-Policy: default-src 'self'; script-src 'nonce-{random}' 'strict-dynamic';\n```"},{"priority":1,"category":"Performance","title":"Optimize Largest Contentful Paint (LCP)","impact":"LCP 4.1 s, FCP 3.04 s","problem":"Mobile LCP is 4.1 s (heavy penalty zone >4 s) and FCP is 3.04 s. Unused JS (23 KB) and image delivery (227 KiB savings) identified.","solution":"- Preload LCP image resource.\n- Defer unused JavaScript (`jquery.7e52f38a196e6397.js`).\n- Optimize image delivery (227 KiB savings potential)."},{"priority":1,"category":"SEO","title":"Resolve 404 Status Code","impact":"SEO, User Experience","problem":"W3C, PSI, and Browser Runtime all confirm the URL returns HTTP 404 (Page Not Found).","solution":"Ensure the target URL returns a 200 OK status if content is intended to be live. If this is a test page, do not index it (add `noindex` meta tag) or move it to a staging environment."},{"priority":2,"category":"SEO","title":"Add a meta description","impact":"Search result click-through rate, SEO audit score","problem":"Lighthouse SEO audit fails `metaDescription`; HTML Inventory confirms Description meta tag is not set.","solution":"Add a concise description (150–160 characters) in the ``:\n```html\n\n```"},{"priority":2,"category":"Best Practices","title":"Fix srcset width descriptors on SVGs","impact":"HTML Validation, Image rendering consistency","problem":"W3C Validator reports 9 errors where `srcset` lacks width specifications (e.g., `giga-invest.svg`) while `sizes` is present.","solution":"Update `` tags to include width descriptors in `srcset` (e.g., `srcset=\"image.svg 100w\"`) or remove `sizes` if not needed for SVGs."},{"priority":2,"category":"Accessibility","title":"Fix Color Contrast and Link Names","impact":"WCAG 1.4.3, 2.4.4 compliance","problem":"axe-core reports 2 serious violations: color-contrast on menu links and link-name on gallery images.","solution":"- Increase contrast ratio on `.menu-item-543` links to ≥4.5:1.\n- Add `aria-label` or visible text to gallery links (e.g., `data-fancybox` elements)."},{"priority":2,"category":"Best Practices","title":"Resolve W3C HTML Validation Errors","impact":"Code quality, rendering consistency","problem":"4 errors found: `srcset` missing width (x2), `sizes` 'auto' without `loading='lazy'`, and invalid `script` type/defer combination.","solution":"- Add width descriptors to `srcset` (e.g., `100w`).\n- Add `loading=\"lazy\"` to images with `sizes=\"auto\"`.\n- Remove `defer` from non-JS script types or correct MIME type."},{"priority":2,"category":"Security","title":"Add Baseline Security Headers","impact":"Transport security, clickjacking, MIME sniffing","problem":"Security Headers grade is 0/100. HSTS, X-Frame-Options, and X-Content-Type-Options are missing.","solution":"Send the following headers from the server (Apache example):\n```\nHeader always set Strict-Transport-Security \"max-age=63072000; includeSubDomains\"\nHeader always set X-Content-Type-Options \"nosniff\"\nHeader always set X-Frame-Options \"SAMEORIGIN\"\n```"},{"priority":2,"category":"Performance","title":"Enable Browser Caching","impact":"Repeat visit load time, TTFB","problem":"Cache-Control header is set to `no-store, no-cache, max-age=0`, preventing the browser from caching the document despite WP Rocket being active.","solution":"Update server configuration to allow caching for static assets and the document itself (e.g., `Cache-Control: public, max-age=31536000` for assets, `max-age=600` for HTML)."},{"priority":2,"category":"Accessibility","title":"Fix Color Contrast on Navigation","impact":"WCAG 1.4.3 Contrast","problem":"axe-core reports a serious color-contrast violation on 23+ nodes, including menu links like `.menu-item-543`.","solution":"Increase the contrast ratio of text against its background to at least 4.5:1. Adjust CSS for `.menu-item-543 > a` and similar classes."},{"priority":2,"category":"Security","title":"Implement Baseline Security Headers","impact":"Transport security, clickjacking protection, MIME sniffing","problem":"Security Headers grade is 0/100; HSTS, X-Frame-Options, and X-Content-Type-Options are missing despite HTTPS being active.","solution":"Add the following headers to the server configuration (Apache example):\n```apache\nHeader always set Strict-Transport-Security \"max-age=63072000; includeSubDomains\"\nHeader always set X-Frame-Options \"SAMEORIGIN\"\nHeader always set X-Content-Type-Options \"nosniff\"\n```"},{"priority":2,"category":"Accessibility","title":"Fix Color Contrast on Navigation Links","impact":"WCAG 1.4.3 (Contrast), Accessibility Score","problem":"axe-core reports 1 serious violation: multiple menu links (e.g., `.menu-item-543 > a`) fail minimum contrast ratios.","solution":"- Increase text color luminance or darken background for affected links.\n- Target a contrast ratio of at least 4.5:1 for normal text.\n- Verify changes with a contrast checker tool before deployment."},{"priority":2,"category":"Security","title":"Add baseline security headers (HSTS, X-Content-Type-Options, X-Frame-Options)","impact":"Transport security, clickjacking protection, MIME sniffing","problem":"Security Headers grade is 0/100; HSTS, X-Content-Type-Options, and X-Frame-Options are missing.","solution":"Configure server to send:\n```\nStrict-Transport-Security: max-age=63072000; includeSubDomains\nX-Content-Type-Options: nosniff\nX-Frame-Options: SAMEORIGIN\n```"},{"priority":2,"category":"Accessibility","title":"Provide accessible names for buttons","impact":"WCAG 4.1.2 Name, Role, Value","problem":"PSI failing audit `button-name` (score 0.00) indicates buttons lack accessible names.","solution":"Ensure all `