{"url":"https://kawiare.ee/","date":"2026-07-13","siteName":"Kawiare - Experience of Taste","overall":56,"reasoning":"Site overall 56 is the mean of 10 pages. Scores range 45 (https://kawiare.ee/kuidas-eristada-kvaliteetset-punast-kalamarja) → 62 (https://kawiare.ee/kaaviar-tanapaeval). Weakest page: Mobile performance is critically low (63/100) with an LCP of 8.6 s, far exceeding the 2.5 s threshold and dragging the overall score. A critical security configuration error exists where HTTP traffic does not redirect to HTTPS, exposing users to downgrade attacks. Accessibility has a serious contrast violation and missing skip-link, though desktop performance is strong (95/100). Security headers are weak (40/100) with missing CSP and preload, but the HTTP redirect failure is the most urgent security fix. The site functions but requires significant optimization for mobile users and security hardening.","confidence":"high","fixes":[{"priority":1,"title":"Optimize images for WebP and lazy loading","impact":"LCP, Page Weight, CLS","problem":"Images total 1.45 MB with no WebP format; 6 images missing loading='lazy' contribute to LCP 9.3 s.","solution":"Convert all PNG/JPEG to WebP/AVIF. Add `loading=\"lazy\"` to non-hero images. Ensure hero image has `fetchpriority=\"high\"`.\n```html\n\n```"},{"priority":1,"title":"Defer non-critical JavaScript","impact":"LCP, TBT, FCP","problem":"11 render-blocking scripts identified; main.js (163 KB) and GTM (64 KB) cause long tasks and delay rendering.","solution":"Add `defer` or `async` to all non-critical scripts in ``. Move WooCommerce/Contact Form scripts to footer if not needed for initial paint.\n```html\n\n```"},{"priority":1,"title":"Enforce HTTPS redirect for all HTTP traffic","impact":"Security, Data Integrity","problem":"Audit shows http://kawiare.ee/artiklid does not redirect to HTTPS, leaving users vulnerable to interception on unencrypted connections.","solution":"Configure the web server (Apache/Nginx) to return a 301 redirect for all HTTP requests to the HTTPS equivalent:\n```apache\nRewriteEngine On\nRewriteCond %{HTTPS} off\nRewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]\n```"},{"priority":1,"title":"Defer or async non-critical JavaScript to fix LCP","impact":"LCP, FCP, TBT","problem":"16 render-blocking scripts and 224 KB unused JS delay first paint; LCP is 7.8 s on mobile.","solution":"Add `defer` or `async` to all non-critical scripts in ``. For WordPress, use a plugin like 'WP Rocket' or 'Autoptimize' to defer JS, or manually update theme files:\n```html\n\n```"},{"priority":1,"title":"Force HTTPS Redirect","impact":"Security, Transport Layer","problem":"HTTP traffic (http://kawiare.ee/...) does not redirect to HTTPS, leaving users vulnerable to downgrade attacks and mixed content warnings.","solution":"Configure the web server (Apache/Nginx) to redirect all HTTP requests to HTTPS:\n```apache\nRewriteEngine On\nRewriteCond %{HTTPS} off\nRewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]\n```"},{"priority":1,"title":"Optimize Largest Contentful Paint (LCP)","impact":"Mobile Performance, LCP (8.6 s)","problem":"Mobile LCP is 8.6 s (threshold 2.5 s), driven by render-blocking scripts and heavy resource loading.","solution":"- Defer non-critical JavaScript (11 render-blocking scripts found).\n- Preload the LCP image (hero) with ``.\n- Optimize server response time (TTFB is 4 ms, so focus on resource delivery)."},{"priority":1,"title":"Force HTTP to HTTPS Redirect","impact":"Security, Data Integrity","problem":"Security Headers audit confirms http://kawiare.ee/... does not redirect to HTTPS, allowing unencrypted traffic.","solution":"Configure the web server (Apache/Nginx) to return a 301/302 redirect for all HTTP requests to the HTTPS equivalent.\n\n**Apache Example:**\n```apache\nRewriteEngine On\nRewriteCond %{HTTPS} off\nRewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]\n```"},{"priority":1,"title":"Defer Render-Blocking JavaScript","impact":"LCP, FCP, Performance","problem":"11 render-blocking scripts in cause LCP to reach 8.5s and FCP 4.6s on mobile.","solution":"Add `defer` or `async` attributes to non-critical scripts in the ``. Move critical CSS inline and defer the rest.\n\n**Example:**\n```html\n\n```"},{"priority":1,"title":"Enforce HTTPS Redirect","impact":"Security, Transport Layer","problem":"Security Headers audit reports 'HTTPS redirect: ✗ http://kawiare.ee... does not redirect to HTTPS'.","solution":"Configure the web server (Apache/Nginx) to return a 301 redirect for all HTTP requests to HTTPS.\n\n**Apache (.htaccess):**\n```apache\nRewriteEngine On\nRewriteCond %{HTTPS} off\nRewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]\n```"},{"priority":1,"title":"Optimize Mobile Largest Contentful Paint (LCP)","impact":"Performance, Mobile UX","problem":"Mobile LCP is 9.0s (threshold is 2.5s), driven by render-blocking scripts and heavy assets.","solution":"- Defer non-critical JavaScript (11 render-blocking scripts found).\n- Preload the LCP image (hero) with `fetchpriority=\"high\"`.\n- Compress images to WebP/AVIF.\n- Remove unused JavaScript (224KB wasted in `main.js`)."},{"priority":1,"title":"Enforce HTTP to HTTPS redirect","impact":"Security, Transport Layer","problem":"Security Headers audit shows http://kawiare.ee... does not redirect to HTTPS, leaving users vulnerable on unencrypted connections.","solution":"Configure the web server (Apache/Nginx) to return a 301 redirect for all HTTP requests to HTTPS:\n```apache\nRewriteEngine On\nRewriteCond %{HTTPS} off\nRewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]\n```"},{"priority":1,"title":"Eliminate render-blocking JavaScript","impact":"LCP, FCP, Performance Score","problem":"PSI mobile LCP is 8.6 s; HTML Inventory shows 11 render-blocking scripts including main.js and jQuery.","solution":"Add `defer` or `async` to non-critical scripts in ``. Critical CSS should be inlined, and JS moved to footer or deferred:\n```html\n\n```"},{"priority":2,"title":"Strengthen security headers","impact":"Security Grade, XSS/Clickjacking Defense","problem":"Security Headers grade 40/100; missing CSP, COOP, CORP. HSTS lacks preload directive.","solution":"Add missing headers via server config (Apache example):\n```apache\nHeader set Content-Security-Policy \"default-src 'self'; script-src 'self' 'unsafe-inline' https://www.googletagmanager.com\"\nHeader set Cross-Origin-Opener-Policy \"same-origin\"\nHeader set Cross-Origin-Resource-Policy \"same-origin\"\n```"},{"priority":2,"title":"Fix HTML structure and navigation","impact":"SEO, Accessibility","problem":"Page contains 3 `
` elements; missing skip-to-content link; W3C error on `\n\n```"},{"priority":2,"title":"Fix Color Contrast Violation","impact":"Accessibility (WCAG 1.4.3)","problem":"axe-core reports 1 serious violation on `#cookiescript_accept` element.","solution":"Increase text contrast ratio to at least 4.5:1 for the cookie consent button text. Adjust CSS color values or background opacity."},{"priority":2,"title":"Fix accessibility contrast and landmarks","impact":"WCAG 1.4.3, 2.4.1","problem":"axe-core reports 1 serious color-contrast violation (#cookiescript_accept) and missing skip-to-content link.","solution":"- Increase contrast on `.lead-text` and cookie button to ≥4.5:1.\n- Add a skip link at the top of the DOM:\n```html\nOtse sisule\n```"},{"priority":2,"title":"Strengthen HSTS configuration","impact":"Security Headers Grade","problem":"HSTS is present but missing the `preload` directive, preventing inclusion in browser preload lists.","solution":"Update the `Strict-Transport-Security` header to include preload:\n```apache\nHeader always set Strict-Transport-Security \"max-age=63072000; includeSubDomains; preload\"\n```"},{"priority":2,"title":"Implement Content Security Policy (CSP)","impact":"XSS Defense, Security Headers","problem":"CSP is missing (Security Headers grade 40/100). While site signals show no auth/payments, CSP mitigates XSS risks from third-party scripts (e.g., GTM).","solution":"Deploy a strict CSP with nonce/hash for scripts:\n```apache\nHeader set Content-Security-Policy \"default-src 'self'; script-src 'nonce-{random}' 'strict-dynamic'; style-src 'self' 'unsafe-inline';\"\n```"},{"priority":2,"title":"Fix Color Contrast and Landmarks","impact":"Accessibility (WCAG 1.4.3, 1.3.1)","problem":"axe-core found 1 serious color-contrast violation (#cookiescript_accept) and 3 moderate landmark issues (duplicate main).","solution":"- Increase contrast on `#cookiescript_accept` to ≥4.5:1.\n- Ensure only one `` element exists; remove duplicate `role=\"main\"`.\n- Add `aria-label` to landmarks if roles are duplicated."},{"priority":3,"title":"Fix color contrast on cookie banner","impact":"WCAG 1.4.3","problem":"axe-core reports serious contrast violation on `#cookiescript_accept`.","solution":"Increase text color contrast ratio to ≥4.5:1 against the background. Verify with a contrast checker tool."},{"priority":3,"title":"Replace CSS Background Hero with Real Image","impact":"LCP, Image Optimization","problem":"Hero uses CSS background-image, preventing srcset usage and browser optimization; LCP element is heavy.","solution":"Move the hero image into an `` tag with `fetchpriority=\"high\"` and `srcset`:\n```html\n\n```"},{"priority":3,"title":"Add Content Security Policy (CSP)","impact":"XSS Defense-in-Depth","problem":"CSP is missing. Site signals indicate no auth/payments/UGC, so risk is lower than P1, but still recommended for defense.","solution":"Implement a strict CSP with nonce/hash for scripts:\n```apache\nHeader set Content-Security-Policy \"default-src 'self'; script-src 'nonce-{random}' 'strict-dynamic';\"\n```\nEnsure all inline scripts use the nonce."},{"priority":3,"title":"Implement Content Security Policy (CSP)","impact":"XSS Defense-in-Depth","problem":"CSP is missing. Site signals indicate no auth/payments, so this is a best practice rather than critical, but recommended for hardening.","solution":"Deploy a strict CSP with nonces for scripts. Since this is a brochure/blog page, a strict allowlist is feasible.\n\n**Header:**\n```http\nContent-Security-Policy: default-src 'self'; script-src 'nonce-{random}' 'strict-dynamic';\n```"},{"priority":3,"title":"Resolve W3C Validation Errors","impact":"SEO, Rendering Consistency","problem":"2 errors found: `\n\n```"},{"priority":3,"title":"Implement Content Security Policy (CSP)","impact":"XSS Defense-in-Depth","problem":"CSP is missing. Site signals indicate no auth/payments, so this is a best practice rather than critical, but recommended for hardening.","solution":"Deploy a strict CSP with nonces for scripts. Since this is a brochure/blog page, a strict allowlist is feasible.\n\n**Header:**\n```http\nContent-Security-Policy: default-src 'self'; script-src 'nonce-{random}' 'strict-dynamic';\n```"}]},{"url":"https://kawiare.ee/kuidas-ara-tunda-toeliselt-head-kaheksajalga","overall":55,"reasoning":"Mobile performance (60) severely drags the score due to LCP 9.0s, despite desktop scoring 91. A critical security configuration failure exists where HTTP does not redirect to HTTPS, lowering the security budget. Accessibility is strong (97) but contains one serious color-contrast violation. W3C validation shows minor errors, and SEO is missing a meta description. The site is functional on desktop but fails mobile core web vitals and basic security hardening.","confidence":"high","fixes":[{"priority":1,"title":"Enforce HTTPS Redirect","impact":"Security, Transport Layer","problem":"Security Headers audit reports 'HTTPS redirect: ✗ http://kawiare.ee... does not redirect to HTTPS'.","solution":"Configure the web server (Apache/Nginx) to return a 301 redirect for all HTTP requests to HTTPS.\n\n**Apache (.htaccess):**\n```apache\nRewriteEngine On\nRewriteCond %{HTTPS} off\nRewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]\n```"},{"priority":1,"title":"Optimize Mobile Largest Contentful Paint (LCP)","impact":"Performance, Mobile UX","problem":"Mobile LCP is 9.0s (threshold is 2.5s), driven by render-blocking scripts and heavy assets.","solution":"- Defer non-critical JavaScript (11 render-blocking scripts found).\n- Preload the LCP image (hero) with `fetchpriority=\"high\"`.\n- Compress images to WebP/AVIF.\n- Remove unused JavaScript (224KB wasted in `main.js`)."},{"priority":2,"title":"Defer Render-Blocking Scripts","impact":"FCP, TBT, Performance","problem":"11 render-blocking scripts in delay First Contentful Paint (4.58s).","solution":"Add `defer` or `async` attributes to non-critical scripts in ``.\n\n**Example:**\n```html\n\n```"},{"priority":2,"title":"Fix Color Contrast Violation","impact":"Accessibility (WCAG 1.4.3)","problem":"axe-core reports 1 serious violation on `#cookiescript_accept` element.","solution":"Increase text contrast ratio to at least 4.5:1 for the cookie consent button text. Adjust CSS color values or background opacity."},{"priority":3,"title":"Add Content Security Policy (CSP)","impact":"Security (XSS Defense)","problem":"CSP is missing. Site signals indicate no auth/payments, but WooCommerce scripts are present.","solution":"Implement a strict CSP with nonce/hash for scripts.\n\n**Header:**\n`Content-Security-Policy: default-src 'self'; script-src 'nonce-{random}' 'strict-dynamic';`\n\n**HTML:**\n``"}]},{"url":"https://kawiare.ee/kuidas-eristada-kvaliteetset-kaaviari","overall":62,"reasoning":"Mobile performance is 60 with a critical LCP of 8.6 s, driven by 11 render-blocking scripts and unused JavaScript. Security headers grade is 40/100, notably missing an HTTP-to-HTTPS redirect which is a critical vulnerability. Accessibility has one serious color-contrast violation and a missing skip-to-content link. Desktop performance is excellent (94) but mobile-first indexing penalizes the site heavily. Confidence is high as all audit tools returned complete data.","confidence":"high","fixes":[{"priority":1,"title":"Enforce HTTP to HTTPS redirect","impact":"Security, Transport Layer","problem":"Security Headers audit shows http://kawiare.ee... does not redirect to HTTPS, leaving users vulnerable on unencrypted connections.","solution":"Configure the web server (Apache/Nginx) to return a 301 redirect for all HTTP requests to HTTPS:\n```apache\nRewriteEngine On\nRewriteCond %{HTTPS} off\nRewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]\n```"},{"priority":1,"title":"Eliminate render-blocking JavaScript","impact":"LCP, FCP, Performance Score","problem":"PSI mobile LCP is 8.6 s; HTML Inventory shows 11 render-blocking scripts including main.js and jQuery.","solution":"Add `defer` or `async` to non-critical scripts in ``. Critical CSS should be inlined, and JS moved to footer or deferred:\n```html\n\n```"},{"priority":2,"title":"Fix accessibility contrast and landmarks","impact":"WCAG 1.4.3, 2.4.1","problem":"axe-core reports 1 serious color-contrast violation (#cookiescript_accept) and missing skip-to-content link.","solution":"- Increase contrast on `.lead-text` and cookie button to ≥4.5:1.\n- Add a skip link at the top of the DOM:\n```html\nOtse sisule\n```"},{"priority":2,"title":"Strengthen HSTS configuration","impact":"Security Headers Grade","problem":"HSTS is present but missing the `preload` directive, preventing inclusion in browser preload lists.","solution":"Update the `Strict-Transport-Security` header to include preload:\n```apache\nHeader always set Strict-Transport-Security \"max-age=63072000; includeSubDomains; preload\"\n```"},{"priority":3,"title":"Implement Content Security Policy (CSP)","impact":"XSS Defense-in-Depth","problem":"CSP is missing. Site signals indicate no auth/payments/UGC, so risk is lower but still recommended for hardening.","solution":"Deploy a strict CSP with nonce/hash for scripts:\n```apache\nHeader always set Content-Security-Policy \"default-src 'self'; script-src 'nonce-{random}' 'strict-dynamic';\"\n```"}]},{"url":"https://kawiare.ee/kammkarp","overall":62,"reasoning":"Mobile performance is the primary drag with an LCP of 8.5 s and FCP of 4.58 s, driven by 11 render-blocking scripts and unused JavaScript. Security posture is critically weakened because HTTP requests do not redirect to HTTPS, exposing users to potential MITM attacks despite the HTTPS grade of 40/100. Accessibility is mostly solid (PSI 97) but contains one serious contrast violation and missing skip-link. Desktop performance is excellent (98), highlighting a severe mobile/desktop disparity. W3C validation errors and missing meta descriptions further reduce SEO confidence.","confidence":"high","fixes":[{"priority":1,"title":"Enforce HTTPS Redirect","impact":"Security, Data Integrity","problem":"HTTP requests do not redirect to HTTPS (http://kawiare.ee/kammkarp does not redirect), leaving traffic vulnerable to interception.","solution":"Configure the web server (Apache/Nginx) to return a 301 redirect for all HTTP traffic to HTTPS:\n```apache\nRewriteEngine On\nRewriteCond %{HTTPS} off\nRewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]\n```"},{"priority":1,"title":"Eliminate Render-Blocking JavaScript","impact":"LCP, FCP, Mobile Performance","problem":"11 render-blocking scripts delay FCP to 4.58 s and LCP to 8.5 s on mobile; 224 KB of unused JS identified.","solution":"Add `defer` or `async` to non-critical scripts in ``. Inline critical CSS and move non-critical JS to the footer. Use `preload` for the LCP image resource."},{"priority":2,"title":"Fix Accessibility Violations","impact":"WCAG Compliance, Usability","problem":"1 serious color-contrast violation (#cookiescript_accept) and 3 moderate landmark issues; skip-to-content link is missing.","solution":"- Increase contrast ratio for `.cookiescript_accept` to ≥4.5:1.\n- Add `Skip to content` before the header.\n- Ensure only one `` element exists and it is not nested inside another landmark."},{"priority":2,"title":"Implement Content Security Policy (CSP)","impact":"XSS Defense, Security Headers","problem":"CSP is missing (Security Headers grade 40/100). While site signals show no auth/payments, CSP mitigates XSS risks from third-party scripts (e.g., GTM).","solution":"Deploy a strict CSP with nonce/hash for scripts:\n```apache\nHeader set Content-Security-Policy \"default-src 'self'; script-src 'nonce-{random}' 'strict-dynamic'; style-src 'self' 'unsafe-inline';\"\n```"},{"priority":3,"title":"Resolve W3C Validation Errors","impact":"SEO, Rendering Consistency","problem":"2 errors found: `
![\"...\"](\"image.webp\")
\n```"},{"priority":1,"title":"Defer non-critical JavaScript","impact":"LCP, TBT, FCP","problem":"11 render-blocking scripts identified; main.js (163 KB) and GTM (64 KB) cause long tasks and delay rendering.","solution":"Add `defer` or `async` to all non-critical scripts in ``. Move WooCommerce/Contact Form scripts to footer if not needed for initial paint.\n```html\n\n```"},{"priority":1,"title":"Enforce HTTPS redirect for all HTTP traffic","impact":"Security, Data Integrity","problem":"Audit shows http://kawiare.ee/artiklid does not redirect to HTTPS, leaving users vulnerable to interception on unencrypted connections.","solution":"Configure the web server (Apache/Nginx) to return a 301 redirect for all HTTP requests to the HTTPS equivalent:\n```apache\nRewriteEngine On\nRewriteCond %{HTTPS} off\nRewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]\n```"},{"priority":1,"title":"Defer or async non-critical JavaScript to fix LCP","impact":"LCP, FCP, TBT","problem":"16 render-blocking scripts and 224 KB unused JS delay first paint; LCP is 7.8 s on mobile.","solution":"Add `defer` or `async` to all non-critical scripts in ``. For WordPress, use a plugin like 'WP Rocket' or 'Autoptimize' to defer JS, or manually update theme files:\n```html\n\n```"},{"priority":1,"title":"Force HTTPS Redirect","impact":"Security, Transport Layer","problem":"HTTP traffic (http://kawiare.ee/...) does not redirect to HTTPS, leaving users vulnerable to downgrade attacks and mixed content warnings.","solution":"Configure the web server (Apache/Nginx) to redirect all HTTP requests to HTTPS:\n```apache\nRewriteEngine On\nRewriteCond %{HTTPS} off\nRewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]\n```"},{"priority":1,"title":"Optimize Largest Contentful Paint (LCP)","impact":"Mobile Performance, LCP (8.6 s)","problem":"Mobile LCP is 8.6 s (threshold 2.5 s), driven by render-blocking scripts and heavy resource loading.","solution":"- Defer non-critical JavaScript (11 render-blocking scripts found).\n- Preload the LCP image (hero) with ``.\n- Optimize server response time (TTFB is 4 ms, so focus on resource delivery)."},{"priority":1,"title":"Force HTTP to HTTPS Redirect","impact":"Security, Data Integrity","problem":"Security Headers audit confirms http://kawiare.ee/... does not redirect to HTTPS, allowing unencrypted traffic.","solution":"Configure the web server (Apache/Nginx) to return a 301/302 redirect for all HTTP requests to the HTTPS equivalent.\n\n**Apache Example:**\n```apache\nRewriteEngine On\nRewriteCond %{HTTPS} off\nRewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]\n```"},{"priority":1,"title":"Defer Render-Blocking JavaScript","impact":"LCP, FCP, Performance","problem":"11 render-blocking scripts in cause LCP to reach 8.5s and FCP 4.6s on mobile.","solution":"Add `defer` or `async` attributes to non-critical scripts in the ``. Move critical CSS inline and defer the rest.\n\n**Example:**\n```html\n\n```"},{"priority":1,"title":"Enforce HTTPS Redirect","impact":"Security, Transport Layer","problem":"Security Headers audit reports 'HTTPS redirect: ✗ http://kawiare.ee... does not redirect to HTTPS'.","solution":"Configure the web server (Apache/Nginx) to return a 301 redirect for all HTTP requests to HTTPS.\n\n**Apache (.htaccess):**\n```apache\nRewriteEngine On\nRewriteCond %{HTTPS} off\nRewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]\n```"},{"priority":1,"title":"Optimize Mobile Largest Contentful Paint (LCP)","impact":"Performance, Mobile UX","problem":"Mobile LCP is 9.0s (threshold is 2.5s), driven by render-blocking scripts and heavy assets.","solution":"- Defer non-critical JavaScript (11 render-blocking scripts found).\n- Preload the LCP image (hero) with `fetchpriority=\"high\"`.\n- Compress images to WebP/AVIF.\n- Remove unused JavaScript (224KB wasted in `main.js`)."},{"priority":1,"title":"Enforce HTTP to HTTPS redirect","impact":"Security, Transport Layer","problem":"Security Headers audit shows http://kawiare.ee... does not redirect to HTTPS, leaving users vulnerable on unencrypted connections.","solution":"Configure the web server (Apache/Nginx) to return a 301 redirect for all HTTP requests to HTTPS:\n```apache\nRewriteEngine On\nRewriteCond %{HTTPS} off\nRewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]\n```"},{"priority":1,"title":"Eliminate render-blocking JavaScript","impact":"LCP, FCP, Performance Score","problem":"PSI mobile LCP is 8.6 s; HTML Inventory shows 11 render-blocking scripts including main.js and jQuery.","solution":"Add `defer` or `async` to non-critical scripts in ``. Critical CSS should be inlined, and JS moved to footer or deferred:\n```html\n\n```"},{"priority":2,"title":"Strengthen security headers","impact":"Security Grade, XSS/Clickjacking Defense","problem":"Security Headers grade 40/100; missing CSP, COOP, CORP. HSTS lacks preload directive.","solution":"Add missing headers via server config (Apache example):\n```apache\nHeader set Content-Security-Policy \"default-src 'self'; script-src 'self' 'unsafe-inline' https://www.googletagmanager.com\"\nHeader set Cross-Origin-Opener-Policy \"same-origin\"\nHeader set Cross-Origin-Resource-Policy \"same-origin\"\n```"},{"priority":2,"title":"Fix HTML structure and navigation","impact":"SEO, Accessibility","problem":"Page contains 3 `![\"...\"](\"hero-800.jpg\")
\n```"},{"priority":3,"title":"Add Content Security Policy (CSP)","impact":"XSS Defense-in-Depth","problem":"CSP is missing. Site signals indicate no auth/payments/UGC, so risk is lower than P1, but still recommended for defense.","solution":"Implement a strict CSP with nonce/hash for scripts:\n```apache\nHeader set Content-Security-Policy \"default-src 'self'; script-src 'nonce-{random}' 'strict-dynamic';\"\n```\nEnsure all inline scripts use the nonce."},{"priority":3,"title":"Implement Content Security Policy (CSP)","impact":"XSS Defense-in-Depth","problem":"CSP is missing. Site signals indicate no auth/payments, so this is a best practice rather than critical, but recommended for hardening.","solution":"Deploy a strict CSP with nonces for scripts. Since this is a brochure/blog page, a strict allowlist is feasible.\n\n**Header:**\n```http\nContent-Security-Policy: default-src 'self'; script-src 'nonce-{random}' 'strict-dynamic';\n```"},{"priority":3,"title":"Resolve W3C Validation Errors","impact":"SEO, Rendering Consistency","problem":"2 errors found: `\n\n```"},{"priority":3,"title":"Implement Content Security Policy (CSP)","impact":"XSS Defense-in-Depth","problem":"CSP is missing. Site signals indicate no auth/payments, so this is a best practice rather than critical, but recommended for hardening.","solution":"Deploy a strict CSP with nonces for scripts. Since this is a brochure/blog page, a strict allowlist is feasible.\n\n**Header:**\n```http\nContent-Security-Policy: default-src 'self'; script-src 'nonce-{random}' 'strict-dynamic';\n```"}]},{"url":"https://kawiare.ee/kuidas-ara-tunda-toeliselt-head-kaheksajalga","overall":55,"reasoning":"Mobile performance (60) severely drags the score due to LCP 9.0s, despite desktop scoring 91. A critical security configuration failure exists where HTTP does not redirect to HTTPS, lowering the security budget. Accessibility is strong (97) but contains one serious color-contrast violation. W3C validation shows minor errors, and SEO is missing a meta description. The site is functional on desktop but fails mobile core web vitals and basic security hardening.","confidence":"high","fixes":[{"priority":1,"title":"Enforce HTTPS Redirect","impact":"Security, Transport Layer","problem":"Security Headers audit reports 'HTTPS redirect: ✗ http://kawiare.ee... does not redirect to HTTPS'.","solution":"Configure the web server (Apache/Nginx) to return a 301 redirect for all HTTP requests to HTTPS.\n\n**Apache (.htaccess):**\n```apache\nRewriteEngine On\nRewriteCond %{HTTPS} off\nRewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]\n```"},{"priority":1,"title":"Optimize Mobile Largest Contentful Paint (LCP)","impact":"Performance, Mobile UX","problem":"Mobile LCP is 9.0s (threshold is 2.5s), driven by render-blocking scripts and heavy assets.","solution":"- Defer non-critical JavaScript (11 render-blocking scripts found).\n- Preload the LCP image (hero) with `fetchpriority=\"high\"`.\n- Compress images to WebP/AVIF.\n- Remove unused JavaScript (224KB wasted in `main.js`)."},{"priority":2,"title":"Defer Render-Blocking Scripts","impact":"FCP, TBT, Performance","problem":"11 render-blocking scripts in delay First Contentful Paint (4.58s).","solution":"Add `defer` or `async` attributes to non-critical scripts in ``.\n\n**Example:**\n```html\n\n```"},{"priority":2,"title":"Fix Color Contrast Violation","impact":"Accessibility (WCAG 1.4.3)","problem":"axe-core reports 1 serious violation on `#cookiescript_accept` element.","solution":"Increase text contrast ratio to at least 4.5:1 for the cookie consent button text. Adjust CSS color values or background opacity."},{"priority":3,"title":"Add Content Security Policy (CSP)","impact":"Security (XSS Defense)","problem":"CSP is missing. Site signals indicate no auth/payments, but WooCommerce scripts are present.","solution":"Implement a strict CSP with nonce/hash for scripts.\n\n**Header:**\n`Content-Security-Policy: default-src 'self'; script-src 'nonce-{random}' 'strict-dynamic';`\n\n**HTML:**\n``"}]},{"url":"https://kawiare.ee/kuidas-eristada-kvaliteetset-kaaviari","overall":62,"reasoning":"Mobile performance is 60 with a critical LCP of 8.6 s, driven by 11 render-blocking scripts and unused JavaScript. Security headers grade is 40/100, notably missing an HTTP-to-HTTPS redirect which is a critical vulnerability. Accessibility has one serious color-contrast violation and a missing skip-to-content link. Desktop performance is excellent (94) but mobile-first indexing penalizes the site heavily. Confidence is high as all audit tools returned complete data.","confidence":"high","fixes":[{"priority":1,"title":"Enforce HTTP to HTTPS redirect","impact":"Security, Transport Layer","problem":"Security Headers audit shows http://kawiare.ee... does not redirect to HTTPS, leaving users vulnerable on unencrypted connections.","solution":"Configure the web server (Apache/Nginx) to return a 301 redirect for all HTTP requests to HTTPS:\n```apache\nRewriteEngine On\nRewriteCond %{HTTPS} off\nRewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]\n```"},{"priority":1,"title":"Eliminate render-blocking JavaScript","impact":"LCP, FCP, Performance Score","problem":"PSI mobile LCP is 8.6 s; HTML Inventory shows 11 render-blocking scripts including main.js and jQuery.","solution":"Add `defer` or `async` to non-critical scripts in ``. Critical CSS should be inlined, and JS moved to footer or deferred:\n```html\n\n```"},{"priority":2,"title":"Fix accessibility contrast and landmarks","impact":"WCAG 1.4.3, 2.4.1","problem":"axe-core reports 1 serious color-contrast violation (#cookiescript_accept) and missing skip-to-content link.","solution":"- Increase contrast on `.lead-text` and cookie button to ≥4.5:1.\n- Add a skip link at the top of the DOM:\n```html\nOtse sisule\n```"},{"priority":2,"title":"Strengthen HSTS configuration","impact":"Security Headers Grade","problem":"HSTS is present but missing the `preload` directive, preventing inclusion in browser preload lists.","solution":"Update the `Strict-Transport-Security` header to include preload:\n```apache\nHeader always set Strict-Transport-Security \"max-age=63072000; includeSubDomains; preload\"\n```"},{"priority":3,"title":"Implement Content Security Policy (CSP)","impact":"XSS Defense-in-Depth","problem":"CSP is missing. Site signals indicate no auth/payments/UGC, so risk is lower but still recommended for hardening.","solution":"Deploy a strict CSP with nonce/hash for scripts:\n```apache\nHeader always set Content-Security-Policy \"default-src 'self'; script-src 'nonce-{random}' 'strict-dynamic';\"\n```"}]},{"url":"https://kawiare.ee/kammkarp","overall":62,"reasoning":"Mobile performance is the primary drag with an LCP of 8.5 s and FCP of 4.58 s, driven by 11 render-blocking scripts and unused JavaScript. Security posture is critically weakened because HTTP requests do not redirect to HTTPS, exposing users to potential MITM attacks despite the HTTPS grade of 40/100. Accessibility is mostly solid (PSI 97) but contains one serious contrast violation and missing skip-link. Desktop performance is excellent (98), highlighting a severe mobile/desktop disparity. W3C validation errors and missing meta descriptions further reduce SEO confidence.","confidence":"high","fixes":[{"priority":1,"title":"Enforce HTTPS Redirect","impact":"Security, Data Integrity","problem":"HTTP requests do not redirect to HTTPS (http://kawiare.ee/kammkarp does not redirect), leaving traffic vulnerable to interception.","solution":"Configure the web server (Apache/Nginx) to return a 301 redirect for all HTTP traffic to HTTPS:\n```apache\nRewriteEngine On\nRewriteCond %{HTTPS} off\nRewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]\n```"},{"priority":1,"title":"Eliminate Render-Blocking JavaScript","impact":"LCP, FCP, Mobile Performance","problem":"11 render-blocking scripts delay FCP to 4.58 s and LCP to 8.5 s on mobile; 224 KB of unused JS identified.","solution":"Add `defer` or `async` to non-critical scripts in ``. Inline critical CSS and move non-critical JS to the footer. Use `preload` for the LCP image resource."},{"priority":2,"title":"Fix Accessibility Violations","impact":"WCAG Compliance, Usability","problem":"1 serious color-contrast violation (#cookiescript_accept) and 3 moderate landmark issues; skip-to-content link is missing.","solution":"- Increase contrast ratio for `.cookiescript_accept` to ≥4.5:1.\n- Add `Skip to content` before the header.\n- Ensure only one `