# Audit Report: Kawiare - Experience of Taste

**Website:** https://kawiare.ee/  
**Date:** 2026-07-07

**Overall Score:** 60 / 100  
**Status:** 🟡 **Needs Improvement**  
**Confidence:** high  
**Audit Coverage:** 100% — all sources returned data

**Pages Audited (10 of 10):**

- https://kawiare.ee/
- https://kawiare.ee/artiklid
- https://kawiare.ee/kuidas-eristada-kvaliteetset-punast-kalamarja
- https://kawiare.ee/kaaviar-kui-looduslik-toidulisand-ehk-kaaviar-ilma-muutideta
- https://kawiare.ee/kuidas-ara-tunda-toeliselt-head-kaheksajalga
- https://kawiare.ee/kuidas-eristada-kvaliteetset-kaaviari
- https://kawiare.ee/kammkarp
- https://kawiare.ee/ahven-ja-koha
- https://kawiare.ee/lumekrabi
- https://kawiare.ee/kaaviar-tanapaeval

## Summary

Site overall 60 is the mean of 10 pages. Scores range 52 (https://kawiare.ee/) → 68 (https://kawiare.ee/lumekrabi). Weakest page: Mobile PSI score of 49 with catastrophic Core Web Vitals (LCP 9.2s, CLS 1.0) places this site in the Poor band despite excellent TTFB (5ms). Accessibility is mostly functional but contains 1 serious contrast violation and structural heading issues (3 h1s). Security headers are weak (40/100) with missing CSP and HSTS preload, though basic protections like X-Frame-Options exist. WooCommerce scripts indicate e-commerce capability despite signals, justifying stricter security recommendations.

## Per-Page Scores

| Page | Score | Status | Confidence |
| --- | --- | --- | --- |
| https://kawiare.ee/ | 52 | 🟠 **Poor** | high |
| https://kawiare.ee/artiklid | 55 | 🟠 **Poor** | high |
| https://kawiare.ee/kuidas-eristada-kvaliteetset-punast-kalamarja | 58 | 🟠 **Poor** | high |
| https://kawiare.ee/kaaviar-kui-looduslik-toidulisand-ehk-kaaviar-ilma-muutideta | 62 | 🟡 **Needs Improvement** | high |
| https://kawiare.ee/kuidas-ara-tunda-toeliselt-head-kaheksajalga | 65 | 🟡 **Needs Improvement** | high |
| https://kawiare.ee/kuidas-eristada-kvaliteetset-kaaviari | 55 | 🟠 **Poor** | high |
| https://kawiare.ee/kammkarp | 62 | 🟡 **Needs Improvement** | high |
| https://kawiare.ee/ahven-ja-koha | 58 | 🟠 **Poor** | high |
| https://kawiare.ee/lumekrabi | 68 | 🟡 **Needs Improvement** | high |
| https://kawiare.ee/kaaviar-tanapaeval | 60 | 🟡 **Needs Improvement** | high |

## PageSpeed Insights — Mobile vs Desktop

_Lower is worse for Performance; higher is worse for LCP and CLS. Worse value is **bolded**._

| URL | Performance (M / D) | LCP (M / D) | CLS (M / D) |
| --- | --- | --- | --- |
| https://kawiare.ee/ | **49** / 70 | **9.24 s** / 1.81 s | **1.000** / 0.637 |
| https://kawiare.ee/artiklid | **68** / 93 | **9.58 s** / 1.66 s | 0.001 / **0.001** |
| https://kawiare.ee/kuidas-eristada-kvaliteetset-punast-kalamarja | **61** / 93 | **8.64 s** / 1.50 s | 0.000 / **0.000** |
| https://kawiare.ee/kaaviar-kui-looduslik-toidulisand-ehk-kaaviar-ilma-muutideta | **71** / 94 | **6.05 s** / 1.51 s | 0.000 / **0.000** |
| https://kawiare.ee/kuidas-ara-tunda-toeliselt-head-kaheksajalga | **69** / 94 | **8.91 s** / 1.53 s | 0.000 / **0.000** |
| https://kawiare.ee/kuidas-eristada-kvaliteetset-kaaviari | **60** / 95 | **8.57 s** / 1.44 s | 0.000 / **0.000** |
| https://kawiare.ee/kammkarp | **61** / 96 | **8.50 s** / 1.26 s | 0.000 / **0.000** |
| https://kawiare.ee/ahven-ja-koha | **59** / 97 | **9.32 s** / 1.13 s | 0.000 / **0.000** |
| https://kawiare.ee/lumekrabi | **69** / 98 | **8.50 s** / 993 ms | 0.000 / **0.000** |
| https://kawiare.ee/kaaviar-tanapaeval | **69** / 95 | **7.23 s** / 1.44 s | 0.000 / **0.000** |

## Optimization Checklist

**4 of 7 passing** — 4 pass · 2 warn · 1 fail

| Item | Status | Detail |
| --- | --- | --- |
| Page caching plugin / CDN active | **Pass** | Caching plugin detected (WP Rocket) |
| Images lazy-loaded | **Pass** | All raster images use loading="lazy". |
| Hero image eagerly loaded | **Pass** | Hero image is eagerly loaded (inferred from DOM order/size — Lighthouse LCP element unavailable). |
| Hero is a real <img> (not a CSS background-image) | **Warn** | Hero element uses a CSS background-image (no image-set() variants), so the browser always loads the original asset regardless of viewport — there is no srcset equivalent. Move the hero to a real <img> with srcset/sizes (or <picture>) so smaller viewports can fetch a smaller file. |
| Responsive images (srcset / <picture>) | **Warn** | Only 15/22 raster images use srcset or <picture> (68%). |
| Reasonable number of image sizes | **Pass** | 17 distinct srcset widths. |
| JS scripts not blocking in <head> | **Fail** | 5 render-blocking scripts in <head>. Move to footer or add defer/async. |

## Fixes

### Priority 1: Critical
*Immediate action — impacts user experience, search rankings, or site safety.*

**1A. Fix Largest Contentful Paint (LCP) and Layout Shift (CLS)**
- **Impact:** Performance, Core Web Vitals
- **Problem:** LCP is 9.2s (target <2.5s) and CLS is 1.0 (target <0.1), driven by render-blocking scripts and unoptimized hero images.
- **Solution:**
  - Preload the hero image: `<link rel="preload" as="image" href="/hero.webp">`.
  - Convert hero image to WebP/AVIF and ensure explicit width/height attributes.
  - Defer non-critical JavaScript to reduce render-blocking time.

**1B. Eliminate Render-Blocking JavaScript**
- **Impact:** FCP, LCP, TBT
- **Problem:** 11 render-blocking scripts detected (5 in head), including jQuery and WooCommerce assets, delaying page rendering.
- **Solution:**
  - Add `defer` or `async` to all non-critical scripts.
  - Move script loading to the footer where possible.
  - Inline critical CSS and defer non-critical stylesheets.

**1C. Enforce HTTPS Redirect**
- **Impact:** Security, Data Integrity
- **Problem:** HTTP traffic (http://kawiare.ee/artiklid) does not redirect to HTTPS, leaving initial requests vulnerable to interception.
- **Solution:**
  Configure the web server (Apache/Nginx) to return a 301 redirect for all HTTP requests to HTTPS:
  ```apache
  RewriteEngine On
  RewriteCond %{HTTPS} off
  RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
  ```

**1D. Optimize Largest Contentful Paint (LCP)**
- **Impact:** LCP, FCP, Mobile Performance
- **Problem:** LCP is 9.6s on mobile due to 16 render-blocking scripts and a hero image implemented as a CSS background (no srcset optimization).
- **Solution:**
  - Move non-critical scripts to `defer` or `async`.
  - Replace the CSS background hero with a real `<img>` or `<picture>` element with `fetchpriority="high"` and `srcset`.
  - Inline critical CSS and defer the rest.

**1E. Force HTTPS redirect for all HTTP requests**
- **Impact:** Security, Transport Layer
- **Problem:** Security Headers audit shows http://kawiare.ee/... does not redirect to HTTPS, allowing downgrade attacks.
- **Solution:**
  Configure the web server (Apache/Nginx) to return a 301 redirect for all HTTP traffic to HTTPS.
  ```apache
  RewriteEngine On
  RewriteCond %{HTTPS} off
  RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
  ```

**1F. Defer or async render-blocking JavaScript**
- **Impact:** LCP, FCP, Performance
- **Problem:** 11 render-blocking scripts (including main.js 224KB) delay FCP to 2.57s and LCP to 6.1s on mobile.
- **Solution:**
  Add `defer` or `async` attributes to non-critical scripts in `<head>`. Critical CSS should be inlined.
  ```html
  <script src="/js/main.js" defer></script>
  ```

**1G. Force HTTPS redirect**
- **Impact:** Security, Transport Layer
- **Problem:** HTTP does not redirect to HTTPS (http://kawiare.ee... does not redirect), leaving traffic vulnerable to interception.
- **Solution:**
  Configure server to redirect all HTTP traffic to HTTPS:
  ```apache
  RewriteEngine On
  RewriteCond %{HTTPS} off
  RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
  ```

**1H. Enforce HTTPS redirect for HTTP requests**
- **Impact:** Security, Transport Layer
- **Problem:** http://kawiare.ee/kammkarp does not redirect to HTTPS, leaving the site vulnerable to downgrade attacks despite the final URL being HTTPS.
- **Solution:**
  Configure the web server (Apache/Nginx) to return a 301 redirect for all HTTP traffic:
  ```apache
  RewriteEngine On
  RewriteCond %{HTTPS} off
  RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
  ```

**1I. Defer or async non-critical JavaScript**
- **Impact:** LCP, FCP, Performance Score
- **Problem:** 11 render-blocking scripts in <head> contribute to LCP 8.5s and FCP 4.6s on mobile.
- **Solution:**
  Add `defer` or `async` attributes to scripts that do not need to execute before DOM parsing. Move non-critical scripts to the footer.
  ```html
  <script src="..." defer></script>
  ```

**1J. Defer render-blocking JavaScript**
- **Impact:** LCP, FCP, Mobile Performance
- **Problem:** 11 render-blocking scripts in <head> contribute to LCP 9.3 s and FCP 4.6 s on mobile, despite TTFB being 4 ms.
- **Solution:**
  Add `defer` or `async` to non-critical scripts in the `<head>`. Critical CSS should be inlined, and JS moved to the footer or deferred:
  ```html
  <script src="/js/main.js" defer></script>
  ```

### Priority 2: Important
*Essential for compliance, user reach, and search visibility.*

**2A. Strengthen Security Headers (CSP & HSTS)**
- **Impact:** Security, XSS protection
- **Problem:** CSP is missing and HSTS lacks preload directive. WooCommerce scripts suggest potential cart functionality, increasing XSS risk.
- **Solution:**
  - Add Content-Security-Policy with nonce/hash strategy: `Content-Security-Policy: script-src 'nonce-{random}' 'strict-dynamic';`.
  - Update HSTS: `Strict-Transport-Security: max-age=63072000; includeSubDomains; preload`.

**2B. Fix SEO and Document Structure**
- **Impact:** SEO, Accessibility
- **Problem:** Missing meta description, 3 h1 elements (should be 1), and missing skip-to-content link.
- **Solution:**
  - Add `<meta name="description" content="...">`.
  - Consolidate to a single `<h1>` per page.
  - Add `<a href="#main" class="skip-link">Skip to content</a>` before the header.

**2C. Fix Accessibility Violations**
- **Impact:** WCAG Compliance, Usability
- **Problem:** 1 serious color-contrast violation (#cookiescript_accept) and 1 moderate heading-order skip (h1→h3). Form inputs lack labels.
- **Solution:**
  - Increase contrast ratio for `.lead-text` and cookie button to ≥4.5:1.
  - Insert an `<h2>` between the existing `<h1>` and `<h3>` elements.
  - Add `<label>` elements or `aria-label` attributes to all form inputs.

**2D. Defer Render-Blocking JavaScript**
- **Impact:** FCP, TBT, Mobile Performance
- **Problem:** 11 render-blocking scripts identified (e.g., main.js, jQuery), contributing to 3.6s FCP.
- **Solution:**
  Add `defer` or `async` attributes to non-critical scripts in `<head>`:
  ```html
  <script src="main.js" defer></script>
  ```
  Move critical scripts to the footer or inline critical CSS.

**2E. Fix color contrast and landmark structure**
- **Impact:** Accessibility (WCAG 1.4.3, 1.3.1)
- **Problem:** axe-core reports 1 serious contrast violation on #cookiescript_accept and 3 moderate landmark violations (duplicate main).
- **Solution:**
  - Increase contrast on cookie accept button to ≥4.5:1.
  - Ensure only one `<main>` element exists and it is not nested inside another landmark.
  - Add a skip-to-content link at the top of the page.

**2F. Fix color contrast on cookie consent**
- **Impact:** Accessibility (WCAG 1.4.3)
- **Problem:** axe-core reports 1 serious violation: `#cookiescript_accept` fails minimum contrast ratio.
- **Solution:**
  Increase contrast between text and background on the cookie accept button to at least 4.5:1 (e.g., darker text or lighter background).

**2G. Add Content Security Policy (CSP)**
- **Impact:** XSS Defense, Security Headers
- **Problem:** CSP is missing. WooCommerce plugins are detected, suggesting potential cart/checkout interactions elsewhere on the site.
- **Solution:**
  Implement a strict CSP with nonce/hash for scripts. Start with a report-only policy to avoid breaking functionality.
  ```apache
  Header set Content-Security-Policy "default-src 'self'; script-src 'nonce-{random}' 'strict-dynamic';"
  ```

**2H. Fix color contrast on cookie consent button**
- **Impact:** Accessibility (WCAG 1.4.3)
- **Problem:** axe-core reports a serious violation on `#cookiescript_accept` where foreground/background contrast is insufficient.
- **Solution:**
  Increase contrast ratio to at least 4.5:1 for normal text. Adjust the button background or text color in CSS:
  ```css
  #cookiescript_accept { color: #333; background: #fff; }
  ```

**2I. Add meta description for SEO**
- **Impact:** Search Visibility, CTR
- **Problem:** SEO audit fails `metaDescription` check; document does not have a meta description.
- **Solution:**
  Add a unique, descriptive meta tag in the `<head>`:
  ```html
  <meta name="description" content="Kammkarp retsept ja kasu: lihtne fast food, mis ei vaja keerulisi tehnikaid.">
  ```

**2J. Add meta description**
- **Impact:** SEO, Click-through rate
- **Problem:** SEO audit fails `metaDescription`; HTML Inventory confirms description meta tag is not set.
- **Solution:**
  Add a unique, descriptive meta description (150–160 characters) in the `<head>`:
  ```html
  <meta name="description" content="Lugege, kuidas ahven ja koha on väärtuslikud Balti järvede kalad ning kuidas neid valmistada.">

**2K. Fix Color Contrast on Cookie Button**
- **Impact:** Accessibility (WCAG 1.4.3)
- **Problem:** axe-core reports a serious contrast violation on `#cookiescript_accept`, making text hard to read for users with visual impairments.
- **Solution:**
  Increase contrast ratio to at least 4.5:1. Adjust button background or text color:
  ```css
  #cookiescript_accept { color: #333; background: #f0f0f0; }
  ```

**2L. Strengthen Security Headers**
- **Impact:** Transport Security, XSS Defense
- **Problem:** HSTS is missing the preload directive; CSP is absent (though site signals indicate low XSS risk).
- **Solution:**
  Add HSTS preload and a basic CSP:
  ```apache
  Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
  Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://www.googletagmanager.com;"
  ```

### Priority 3: Best Practice
*Recommended for long-term maintainability.*

**3A. Fix HTML Validation Errors**
- **Impact:** Maintainability, Compatibility
- **Problem:** 1 W3C error (style not allowed in div) and 6 warnings (obsolete charset, missing headings).
- **Solution:**
  - Move inline `<style>` blocks to external CSS or `<head>`.
  - Remove obsolete `charset` attributes from script tags.
  - Ensure all `<section>` elements have appropriate heading levels.

**3B. Implement Content Security Policy (CSP)**
- **Impact:** XSS Defense-in-Depth
- **Problem:** CSP is missing. Site signals indicate no auth/payments/UGC, so this is calibrated to Priority 3 per the security rubric.
- **Solution:**
  Deploy a strict CSP with nonce/hash for scripts:
  ```apache
  Header set Content-Security-Policy "default-src 'self'; script-src 'nonce-{random}' 'strict-dynamic'; object-src 'none'; base-uri 'none';"
  ```

**3C. Add Meta Description and Fix W3C Errors**
- **Impact:** SEO, Code Quality
- **Problem:** SEO audit flags missing meta description. W3C validator reports 2 errors (style in div, heading skip).
- **Solution:**
  - Add `<meta name="description" content="...">` summarizing the article content.
  - Move inline `<style>` blocks to the `<head>` or external CSS file.
  - Ensure heading levels increment sequentially without skipping.

**3D. Add Content Security Policy (CSP)**
- **Impact:** XSS Defense-in-Depth
- **Problem:** CSP header is missing. Site signals indicate no auth/payments, lowering priority to P3 per rubric.
- **Solution:**
  Implement a strict CSP with nonce/hash for scripts:
  ```apache
  Header set Content-Security-Policy "default-src 'self'; script-src 'nonce-{random}' 'strict-dynamic';"
  ```

**3E. Resolve W3C Validation Errors**
- **Impact:** Code Quality, SEO
- **Problem:** 2 errors found: `<style>` not allowed in `div` context, and unescaped `<` character.
- **Solution:**
  - Move `<style>` blocks to `<head>` or use `<style>` inside allowed containers.
  - Escape special characters in text content (e.g., `&lt;` instead of `<`).

**3F. Fix W3C validation errors and add meta description**
- **Impact:** SEO, Code Quality
- **Problem:** W3C reports 2 errors (invalid `<style>` in `<div>`, unescaped `<`) and SEO audit notes missing meta description.
- **Solution:**
  - Move `<style>` blocks to `<head>` or use `<div>`-safe CSS.
  - Escape unescaped `<` characters as `&lt;`.
  - Add `<meta name="description" content="...">` summarizing the article content.

**3G. Add meta description**
- **Impact:** SEO, Click-through rate
- **Problem:** PSI SEO audit fails `metaDescription`; document does not have a meta description.
- **Solution:**
  Add a concise summary in the `<head>`:
  ```html
  <meta name="description" content="Learn how to identify high-quality octopus with our guide on texture, origin, and preparation.">
  ```

**3H. Add meta description and skip link**
- **Impact:** SEO, Accessibility
- **Problem:** SEO audit flags missing meta description; HTML inventory confirms no skip-to-content link.
- **Solution:**
  - Add `<meta name="description" content="...">` summarizing the article.
  - Add a skip link at the top of the `<body>`:
  ```html
  <a href="#main" class="skip-link">Skip to content</a>
  ```

**3I. Add Meta Description and Image Lazy Loading**
- **Impact:** SEO, Page Weight
- **Problem:** Meta description is missing for SEO; 2 images below the fold lack `loading="lazy"`.
- **Solution:**
  Add meta description in `<head>` and lazy load non-critical images:
  ```html
  <meta name="description" content="...">
  <img src="..." loading="lazy" alt="...">
  ```

**3J. Resolve W3C HTML Validation Errors**
- **Impact:** Maintainability, SEO
- **Problem:** 2 errors found: `<style>` not allowed as child of `div`, and unescaped `<` character.
- **Solution:**
  - Move `<style>` blocks to `<head>` or use `<div>`-safe containers.
  - Escape special characters in text content (e.g., use `&lt;` instead of `<`).