# Audit Report: Kawiare - Experience of Taste
**Website:** https://kawiare.ee/
**Date:** 2026-07-06
**Overall Score:** 58 / 100
**Status:** 🟠**Poor**
**Confidence:** high
**Audit Coverage:** 100% — all sources returned data
## Summary
Mobile performance is critically low (PSI 50) driven by a 10.0 s LCP and 11 render-blocking scripts, which severely impacts user experience on mobile devices. Security headers are incomplete (40/100) with missing CSP and weak HSTS, though the site lacks auth/payment signals. Accessibility is mostly strong (PSI 97) but contains one serious contrast violation and structural issues (3 H1s). Desktop performance is significantly better (68), highlighting a mobile-first optimization gap.
## PageSpeed Insights — Mobile vs Desktop
_Lower is worse for Performance; higher is worse for LCP and CLS. Worse value is **bolded**._
| Strategy | Performance (M / D) | LCP (M / D) | CLS (M / D) |
| --- | --- | --- | --- |
| Mobile vs Desktop | **50** / 68 | **9.97 s** / 1.62 s | 0.000 / **0.637** |
## Optimization Checklist
**4 of 6 passing** — 4 pass · 1 warn · 1 fail · 1 n/a
| Item | Status | Detail |
| --- | --- | --- |
| Page caching plugin / CDN active | **Pass** | Caching plugin detected (WP Rocket) |
| Images lazy-loaded | **Pass** | All raster images use loading="lazy". |
| Hero image eagerly loaded | **Pass** | Hero image is eagerly loaded (inferred from DOM order/size — Lighthouse LCP element unavailable). |
| Hero is a real ![]()
(not a CSS background-image) | N/A | No CSS background-images detected on raster-image-eligible elements. |
| Responsive images (srcset / ) | **Warn** | Only 15/22 raster images use srcset or (68%). |
| Reasonable number of image sizes | **Pass** | 17 distinct srcset widths. |
| JS scripts not blocking in | **Fail** | 5 render-blocking scripts in . Move to footer or add defer/async. |
## Fixes
### Priority 1: Critical
*Immediate action — impacts user experience, search rankings, or site safety.*
**1A. Eliminate render-blocking JavaScript**
- **Impact:** LCP, FCP, TBT
- **Problem:** 11 render-blocking scripts delay first paint; FCP is 3.89 s and LCP is 10.0 s on mobile.
- **Solution:**
Add `defer` or `async` to non-critical scripts in ``. Move scripts to footer where possible.
```html
```
**1B. Optimize Largest Contentful Paint (LCP) image**
- **Impact:** LCP, Page Weight
- **Problem:** LCP is 10.0 s; hero image is 1.46 MB total page weight with 6 images missing lazy loading.
- **Solution:**
Compress hero image to WebP/AVIF. Add `fetchpriority="high"` to LCP image. Ensure `loading="lazy"` on below-fold images.
```html
```
### Priority 2: Important
*Essential for compliance, user reach, and search visibility.*
**2A. Fix heading structure and contrast**
- **Impact:** Accessibility, SEO
- **Problem:** 3 `` elements detected; 1 serious color-contrast violation on `#cookiescript_accept`.
- **Solution:**
Ensure exactly one `` per page. Increase contrast ratio on cookie button text to ≥4.5:1.
```css
#cookiescript_accept { color: #333; background: #fff; } /* Example */
```
**2B. Strengthen HSTS and add baseline headers**
- **Impact:** Security, Transport
- **Problem:** HSTS missing preload directive; Security Headers grade is 40/100.
- **Solution:**
Add `preload` to HSTS and ensure `X-Frame-Options` is consistent.
```apache
Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
```
### Priority 3: Best Practice
*Recommended for long-term maintainability.*
**3A. Implement Content Security Policy (CSP)**
- **Impact:** XSS Defense
- **Problem:** CSP is missing. Site signals indicate no auth/payments/UGC, so risk is lower but defense-in-depth is recommended.
- **Solution:**
Deploy a nonce-based CSP rather than a static allowlist.
```apache
Header always set Content-Security-Policy "default-src 'self'; script-src 'nonce-{random}' 'strict-dynamic'"
```