{"url":"https://kawiare.ee/","date":"2026-07-07","siteName":"Kawiare - Experience of Taste","overall":60,"reasoning":"Site overall 60 is the mean of 10 pages. Scores range 52 (https://kawiare.ee/) → 68 (https://kawiare.ee/lumekrabi). Weakest page: Mobile PSI score of 49 with catastrophic Core Web Vitals (LCP 9.2s, CLS 1.0) places this site in the Poor band despite excellent TTFB (5ms). Accessibility is mostly functional but contains 1 serious contrast violation and structural heading issues (3 h1s). Security headers are weak (40/100) with missing CSP and HSTS preload, though basic protections like X-Frame-Options exist. WooCommerce scripts indicate e-commerce capability despite signals, justifying stricter security recommendations.","confidence":"high","fixes":[{"priority":1,"title":"Fix Largest Contentful Paint (LCP) and Layout Shift (CLS)","impact":"Performance, Core Web Vitals","problem":"LCP is 9.2s (target <2.5s) and CLS is 1.0 (target <0.1), driven by render-blocking scripts and unoptimized hero images.","solution":"- Preload the hero image: ``.\n- Convert hero image to WebP/AVIF and ensure explicit width/height attributes.\n- Defer non-critical JavaScript to reduce render-blocking time."},{"priority":1,"title":"Eliminate Render-Blocking JavaScript","impact":"FCP, LCP, TBT","problem":"11 render-blocking scripts detected (5 in head), including jQuery and WooCommerce assets, delaying page rendering.","solution":"- Add `defer` or `async` to all non-critical scripts.\n- Move script loading to the footer where possible.\n- Inline critical CSS and defer non-critical stylesheets."},{"priority":1,"title":"Enforce HTTPS Redirect","impact":"Security, Data Integrity","problem":"HTTP traffic (http://kawiare.ee/artiklid) does not redirect to HTTPS, leaving initial requests vulnerable to interception.","solution":"Configure the web server (Apache/Nginx) to return a 301 redirect for all HTTP requests to HTTPS:\n```apache\nRewriteEngine On\nRewriteCond %{HTTPS} off\nRewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]\n```"},{"priority":1,"title":"Optimize Largest Contentful Paint (LCP)","impact":"LCP, FCP, Mobile Performance","problem":"LCP is 9.6s on mobile due to 16 render-blocking scripts and a hero image implemented as a CSS background (no srcset optimization).","solution":"- Move non-critical scripts to `defer` or `async`.\n- Replace the CSS background hero with a real `` or `` element with `fetchpriority=\"high\"` and `srcset`.\n- Inline critical CSS and defer the rest."},{"priority":1,"title":"Force HTTPS redirect for all HTTP requests","impact":"Security, Transport Layer","problem":"Security Headers audit shows http://kawiare.ee/... does not redirect to HTTPS, allowing downgrade attacks.","solution":"Configure the web server (Apache/Nginx) to return a 301 redirect for all HTTP traffic to HTTPS.\n```apache\nRewriteEngine On\nRewriteCond %{HTTPS} off\nRewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]\n```"},{"priority":1,"title":"Defer or async render-blocking JavaScript","impact":"LCP, FCP, Performance","problem":"11 render-blocking scripts (including main.js 224KB) delay FCP to 2.57s and LCP to 6.1s on mobile.","solution":"Add `defer` or `async` attributes to non-critical scripts in ``. Critical CSS should be inlined.\n```html\n\n```"},{"priority":1,"title":"Force HTTPS redirect","impact":"Security, Transport Layer","problem":"HTTP does not redirect to HTTPS (http://kawiare.ee... does not redirect), leaving traffic vulnerable to interception.","solution":"Configure server to redirect all HTTP traffic to HTTPS:\n```apache\nRewriteEngine On\nRewriteCond %{HTTPS} off\nRewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]\n```"},{"priority":1,"title":"Enforce HTTPS redirect for HTTP requests","impact":"Security, Transport Layer","problem":"http://kawiare.ee/kammkarp does not redirect to HTTPS, leaving the site vulnerable to downgrade attacks despite the final URL being HTTPS.","solution":"Configure the web server (Apache/Nginx) to return a 301 redirect for all HTTP traffic:\n```apache\nRewriteEngine On\nRewriteCond %{HTTPS} off\nRewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]\n```"},{"priority":1,"title":"Defer or async non-critical JavaScript","impact":"LCP, FCP, Performance Score","problem":"11 render-blocking scripts in contribute to LCP 8.5s and FCP 4.6s on mobile.","solution":"Add `defer` or `async` attributes to scripts that do not need to execute before DOM parsing. Move non-critical scripts to the footer.\n```html\n\n```"},{"priority":1,"title":"Defer render-blocking JavaScript","impact":"LCP, FCP, Mobile Performance","problem":"11 render-blocking scripts in contribute to LCP 9.3 s and FCP 4.6 s on mobile, despite TTFB being 4 ms.","solution":"Add `defer` or `async` to non-critical scripts in the ``. Critical CSS should be inlined, and JS moved to the footer or deferred:\n```html\n\n```"},{"priority":2,"title":"Strengthen Security Headers (CSP & HSTS)","impact":"Security, XSS protection","problem":"CSP is missing and HSTS lacks preload directive. WooCommerce scripts suggest potential cart functionality, increasing XSS risk.","solution":"- Add Content-Security-Policy with nonce/hash strategy: `Content-Security-Policy: script-src 'nonce-{random}' 'strict-dynamic';`.\n- Update HSTS: `Strict-Transport-Security: max-age=63072000; includeSubDomains; preload`."},{"priority":2,"title":"Fix SEO and Document Structure","impact":"SEO, Accessibility","problem":"Missing meta description, 3 h1 elements (should be 1), and missing skip-to-content link.","solution":"- Add ``.\n- Consolidate to a single `
` per page.\n- Add `Skip to content` before the header."},{"priority":2,"title":"Fix Accessibility Violations","impact":"WCAG Compliance, Usability","problem":"1 serious color-contrast violation (#cookiescript_accept) and 1 moderate heading-order skip (h1→h3). Form inputs lack labels.","solution":"- Increase contrast ratio for `.lead-text` and cookie button to ≥4.5:1.\n- Insert an `