{"url":"https://kawiare.ee/","date":"2026-07-07","siteName":"Kawiare - Experience of Taste","overall":57,"reasoning":"Site overall 57 is the mean of 10 pages. Scores range 46 (https://kawiare.ee/ahven-ja-koha) → 62 (https://kawiare.ee/kammkarp). Weakest page: Mobile LCP of 9.6 s is a critical failure (>4 s threshold), dragging performance to 68 despite a 90 desktop score. Security is compromised by a missing HTTP-to-HTTPS redirect and a 40/100 header grade. Accessibility is strong (97 PSI) but has 1 serious contrast violation. W3C validation shows 2 errors. Confidence is high as all tools returned data.","confidence":"high","fixes":[{"priority":1,"title":"Optimize Largest Contentful Paint (LCP) Image","impact":"LCP, Performance Score","problem":"LCP is 9.2s on mobile (threshold ≤2.5s), caused by the hero image loading without priority.","solution":"Preload the LCP image and serve it in WebP/AVIF format:\n```html\n\n\"...\"\n```"},{"priority":1,"title":"Fix Cumulative Layout Shift (CLS)","impact":"CLS, User Experience","problem":"CLS is 1.000 (threshold ≤0.1), caused by images and content shifting during load.","solution":"Reserve space for all images and dynamic content using explicit `width` and `height` attributes or aspect-ratio CSS:\n```css\nimg { aspect-ratio: attr(width) / attr(height); }\n```"},{"priority":1,"title":"Force HTTPS redirect on HTTP requests","impact":"Security, Transport Layer","problem":"HTTP does not redirect to HTTPS (http://kawiare.ee/artiklid does not redirect), leaving users vulnerable to downgrade attacks.","solution":"Configure the web server (Apache/Nginx) to return a 301 redirect for all HTTP traffic:\n```apache\nRewriteEngine On\nRewriteCond %{HTTPS} off\nRewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]\n```"},{"priority":1,"title":"Fix Mobile LCP (9.5 s) by deferring JS and optimizing hero","impact":"Performance, Core Web Vitals","problem":"LCP is 9.5 s on mobile due to 16 render-blocking scripts and a hero image implemented as a CSS background (no srcset).","solution":"- Move non-critical scripts to footer or add `defer`/`async`.\n- Replace CSS background hero with a real `` or `` element with `fetchpriority=\"high\"`.\n- Defer unused JavaScript (224 KB wasted)."},{"priority":1,"title":"Enforce HTTPS Redirect","impact":"Security, Trust","problem":"HTTP requests to http://kawiare.ee do not redirect to HTTPS, exposing users to potential MITM attacks if they type the URL manually.","solution":"Configure the web server (Apache/Nginx) to return a 301 redirect for all HTTP traffic to HTTPS:\n```apache\nRewriteEngine On\nRewriteCond %{HTTPS} off\nRewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]\n```"},{"priority":1,"title":"Eliminate Render-Blocking JavaScript","impact":"LCP, FCP, Performance","problem":"11 render-blocking scripts delay FCP (2.65 s) and contribute to LCP (4.6 s); unused JS totals ~290 KB.","solution":"Add `defer` or `async` to non-critical scripts in ``. Move critical CSS inline and defer remaining JS:\n```html\n\n```\nConsider code-splitting the 224 KB `main.js` bundle."},{"priority":1,"title":"Force HTTPS redirect for all HTTP traffic","impact":"Security, Data Integrity","problem":"Security audit shows 'http://kawiare.ee/... does not redirect to HTTPS', leaving users on unencrypted connections.","solution":"Configure the web server (Apache/Nginx) to return a 301 redirect from HTTP to HTTPS for all requests.\n```apache\nRewriteEngine On\nRewriteCond %{HTTPS} off\nRewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]\n```"},{"priority":1,"title":"Optimize Largest Contentful Paint (LCP)","impact":"Performance, Mobile UX","problem":"Mobile LCP is 8.5 s (heavy penalty), driven by 11 render-blocking scripts and a large hero image (2560px).","solution":"- Defer non-critical JavaScript (11 render-blocking scripts found).\n- Preload the LCP image resource.\n- Compress the hero image to WebP/AVIF and reduce dimensions to viewport size.\n```html\n\n```"},{"priority":1,"title":"Defer render-blocking JavaScript","impact":"LCP, FCP, Performance Score","problem":"11 render-blocking scripts delay FCP to 4.6s and LCP to 8.9s on mobile.","solution":"Add `defer` or `async` to non-critical scripts in ``. Move critical CSS inline and load JS at the bottom or via `defer`:\n```html\n\n```"},{"priority":1,"title":"Eliminate render-blocking JavaScript to fix LCP","impact":"LCP (8.8s), FCP (2.6s), Mobile Performance (69)","problem":"5 render-blocking scripts in delay rendering; LCP is 8.8s on mobile, far above the 2.5s target.","solution":"Move non-critical scripts to the footer or add `defer`/`async` attributes. Prioritize deferring WooCommerce and Google Tag Manager scripts:\n```html\n\n\n```"},{"priority":2,"title":"Defer Render-Blocking JavaScript","impact":"FCP, LCP, TBT","problem":"11 render-blocking scripts (including jQuery and WooCommerce) delay first paint.","solution":"Add `defer` or `async` to non-critical scripts in ``:\n```html\n\n```"},{"priority":2,"title":"Strengthen Security Headers","impact":"Transport Security, Clickjacking","problem":"HSTS is missing the preload directive; CSP is absent (signals show no auth/payments, so P2/P3).","solution":"Update HSTS header and add CSP:\n```\nStrict-Transport-Security: max-age=63072000; includeSubDomains; preload\nContent-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' https://www.googletagmanager.com;\n```"},{"priority":2,"title":"Fix accessibility violations (Contrast & Headings)","impact":"WCAG Compliance, Usability","problem":"1 serious color-contrast violation (#cookiescript_accept) and heading order skips (H1 → H3).","solution":"- Increase contrast ratio for `.cookiescript_accept` to ≥4.5:1.\n- Insert an H2 between the H1 and H3s, or change the H3s to H2s to maintain sequential order."},{"priority":2,"title":"Strengthen Security Headers (HSTS, COOP, CORP)","impact":"Transport Security, Context Isolation","problem":"HSTS missing preload directive; COOP and CORP missing (grade 40/100).","solution":"Add the following headers:\n```apache\nHeader always set Strict-Transport-Security \"max-age=63072000; includeSubDomains; preload\"\nHeader always set Cross-Origin-Opener-Policy \"same-origin\"\nHeader always set Cross-Origin-Resource-Policy \"same-origin\"\n```"},{"priority":2,"title":"Fix Accessibility Violations","impact":"WCAG 2.1 AA Compliance","problem":"One serious color-contrast violation on `#cookiescript_accept` and moderate landmark issues (duplicate main, main not top-level).","solution":"- Increase contrast ratio on `#cookiescript_accept` to ≥4.5:1.\n- Ensure `
` is a direct child of `` and remove duplicate `role=\"main\"` attributes.\n- Add a skip-to-content link at the top of the DOM."},{"priority":2,"title":"Add Content-Security-Policy (CSP) and HSTS Preload","impact":"XSS Defense, Transport Security","problem":"CSP is missing and HSTS lacks the preload directive; Security Headers grade is 40/100.","solution":"- Add CSP with nonce/hash strategy (even for brochure sites, it mitigates injection risks).\n- Add `preload` to HSTS header.\n```apache\nHeader set Content-Security-Policy \"default-src 'self'; script-src 'nonce-{random}' 'strict-dynamic'\"\nHeader set Strict-Transport-Security \"max-age=63072000; includeSubDomains; preload\"\n```"},{"priority":2,"title":"Fix Accessibility Violations (Contrast & Landmarks)","impact":"WCAG Compliance, Screen Reader Support","problem":"axe-core reports 1 serious color-contrast violation (#cookiescript_accept) and missing skip-to-content link.","solution":"- Increase contrast ratio for `.lead-text` and cookie banner to ≥4.5:1.\n- Add a skip link at the top of the DOM:\n```html\nOtse sisule\n```"},{"priority":2,"title":"Fix color contrast on cookie consent buttons","impact":"Accessibility (WCAG 1.4.3)","problem":"axe-core reports 1 serious violation: `#cookiescript_accept` and `#cookiescript_reject` fail contrast thresholds.","solution":"Increase text color contrast to at least 4.5:1 against the background. Use browser dev tools to test contrast ratios before deploying:\n```css\n#cookiescript_accept, #cookiescript_reject {\n color: #333333; /* Adjust to meet ratio */\n background: #ffffff;\n}\n```"},{"priority":2,"title":"Harden security headers","impact":"Transport security, Context isolation","problem":"HSTS missing preload directive; COOP, CORP, and Permissions-Policy are missing.","solution":"Update server headers to include preload and context isolation:\n```apache\nHeader always set Strict-Transport-Security \"max-age=63072000; includeSubDomains; preload\"\nHeader always set Cross-Origin-Opener-Policy \"same-origin\"\nHeader always set Cross-Origin-Resource-Policy \"same-origin\"\n```"},{"priority":2,"title":"Defer Render-Blocking Scripts","impact":"FCP, TBT, Performance","problem":"HTML Inventory reports 11 render-blocking external scripts, including WooCommerce and jQuery, delaying page interactivity.","solution":"Add `defer` or `async` attributes to non-critical scripts in ``:\n```html\n\n```\n- Move critical CSS inline and defer the rest.\n- Remove unused JavaScript identified in PSI (224 KB wasted)."},{"priority":2,"title":"Fix Color Contrast Violation","impact":"Accessibility, WCAG 1.4.3","problem":"axe-core reports 1 serious violation on `#cookiescript_accept` where foreground/background contrast is insufficient.","solution":"Increase text color contrast to at least 4.5:1 ratio for the cookie consent button text. Use a darker text color or lighter background in CSS."},{"priority":3,"title":"Correct HTML Structure and Accessibility","impact":"SEO, Screen Readers","problem":"Page has 3 `

` elements and missing skip-to-content link; serious contrast violation on cookie button.","solution":"Ensure only one `

` per page, add `Skip to content`, and fix contrast on `#cookiescript_accept`."},{"priority":3,"title":"Implement Content Security Policy (CSP)","impact":"XSS Defense-in-Depth","problem":"CSP is missing. Site signals indicate no auth/payments/UGC, so risk is lower, but WP sites benefit from CSP.","solution":"Deploy a nonce-based CSP rather than a flat allowlist:\n```apache\nHeader always set Content-Security-Policy \"default-src 'self'; script-src 'nonce-{random}' 'strict-dynamic';\"\n```"},{"priority":3,"title":"Improve SEO & HTML Validity","impact":"Search Visibility, Code Quality","problem":"Missing meta description affects SEO snippet; W3C reports 2 errors (invalid `