# Audit Report: Kawiare - Experience of Taste

**Website:** https://kawiare.ee/  
**Date:** 2026-07-14

**Overall Score:** 61 / 100  
**Status:** 🟡 **Needs Improvement**  
**Confidence:** high  
**Audit Coverage:** 100% — all sources returned data

**Pages Audited (10 of 10):**

- https://kawiare.ee/
- https://kawiare.ee/artiklid
- https://kawiare.ee/kuidas-eristada-kvaliteetset-punast-kalamarja
- https://kawiare.ee/kaaviar-kui-looduslik-toidulisand-ehk-kaaviar-ilma-muutideta
- https://kawiare.ee/kuidas-ara-tunda-toeliselt-head-kaheksajalga
- https://kawiare.ee/kuidas-eristada-kvaliteetset-kaaviari
- https://kawiare.ee/kammkarp
- https://kawiare.ee/ahven-ja-koha
- https://kawiare.ee/lumekrabi
- https://kawiare.ee/kaaviar-tanapaeval

## Summary

Site overall 61 is the mean of 10 pages. Scores range 52 (https://kawiare.ee/kaaviar-kui-looduslik-toidulisand-ehk-kaaviar-ilma-muutideta) → 71 (https://kawiare.ee/lumekrabi). Weakest page: Mobile performance is critically low (58) with an LCP of 8.5 s, driven by 11 render-blocking scripts and unused JavaScript. Security posture is weak due to missing HTTP-to-HTTPS redirects and absent CSP, despite the primary URL using HTTPS. Accessibility has a serious contrast violation and missing skip link, though core structure is mostly intact. Desktop performance is excellent (96), highlighting a severe mobile-specific bottleneck. Confidence is high as all audit tools returned complete data.

## Per-Page Scores

| Page | Score | Status | Confidence |
| --- | --- | --- | --- |
| https://kawiare.ee/ | 62 | 🟡 **Needs Improvement** | high |
| https://kawiare.ee/artiklid | 58 | 🟠 **Poor** | high |
| https://kawiare.ee/kuidas-eristada-kvaliteetset-punast-kalamarja | 66 | 🟡 **Needs Improvement** | high |
| https://kawiare.ee/kaaviar-kui-looduslik-toidulisand-ehk-kaaviar-ilma-muutideta | 52 | 🟠 **Poor** | high |
| https://kawiare.ee/kuidas-ara-tunda-toeliselt-head-kaheksajalga | 55 | 🟠 **Poor** | high |
| https://kawiare.ee/kuidas-eristada-kvaliteetset-kaaviari | 65 | 🟡 **Needs Improvement** | high |
| https://kawiare.ee/kammkarp | 65 | 🟡 **Needs Improvement** | high |
| https://kawiare.ee/ahven-ja-koha | 55 | 🟠 **Poor** | high |
| https://kawiare.ee/lumekrabi | 71 | 🟡 **Needs Improvement** | high |
| https://kawiare.ee/kaaviar-tanapaeval | 62 | 🟡 **Needs Improvement** | high |

## PageSpeed Insights — Mobile vs Desktop

_Lower is worse for Performance; higher is worse for LCP and CLS. Worse value is **bolded**._

| URL | Performance (M / D) | LCP (M / D) | CLS (M / D) |
| --- | --- | --- | --- |
| https://kawiare.ee/ | **56** / 69 | **10.08 s** / 1.83 s | 0.000 / **0.637** |
| https://kawiare.ee/artiklid | **68** / 89 | **9.35 s** / 1.87 s | 0.001 / **0.001** |
| https://kawiare.ee/kuidas-eristada-kvaliteetset-punast-kalamarja | **58** / 92 | **8.53 s** / 1.79 s | 0.000 / **0.000** |
| https://kawiare.ee/kaaviar-kui-looduslik-toidulisand-ehk-kaaviar-ilma-muutideta | **58** / 96 | **8.52 s** / 1.41 s | 0.000 / **0.000** |
| https://kawiare.ee/kuidas-ara-tunda-toeliselt-head-kaheksajalga | **69** / 87 | **8.91 s** / 1.86 s | 0.000 / **0.000** |
| https://kawiare.ee/kuidas-eristada-kvaliteetset-kaaviari | **74** / 96 | **5.39 s** / 1.18 s | 0.000 / **0.000** |
| https://kawiare.ee/kammkarp | **61** / 95 | **8.50 s** / 1.48 s | 0.000 / **0.000** |
| https://kawiare.ee/ahven-ja-koha | **41** / 96 | **9.18 s** / 1.33 s | 0.000 / **0.000** |
| https://kawiare.ee/lumekrabi | **74** / 97 | **5.28 s** / 1.19 s | 0.000 / **0.000** |
| https://kawiare.ee/kaaviar-tanapaeval | **67** / 93 | **8.36 s** / 1.53 s | 0.000 / **0.000** |

## Optimization Checklist

**4 of 7 passing** — 4 pass · 2 warn · 1 fail

| Item | Status | Detail |
| --- | --- | --- |
| Page caching plugin / CDN active | **Pass** | Caching plugin detected (WP Rocket) |
| Images lazy-loaded | **Pass** | All raster images use loading="lazy". |
| Hero image eagerly loaded | **Pass** | Hero image is eagerly loaded (inferred from DOM order/size — Lighthouse LCP element unavailable). |
| Hero is a real <img> (not a CSS background-image) | **Warn** | Hero element uses a CSS background-image (no image-set() variants), so the browser always loads the original asset regardless of viewport — there is no srcset equivalent. Move the hero to a real <img> with srcset/sizes (or <picture>) so smaller viewports can fetch a smaller file. |
| Responsive images (srcset / <picture>) | **Warn** | Only 15/22 raster images use srcset or <picture> (68%). |
| Reasonable number of image sizes | **Pass** | 17 distinct srcset widths. |
| JS scripts not blocking in <head> | **Fail** | 5 render-blocking scripts in <head>. Move to footer or add defer/async. |

## Fixes

### Priority 1: Critical
*Immediate action — impacts user experience, search rankings, or site safety.*

**1A. Eliminate render-blocking JavaScript**
- **Impact:** LCP, FCP, Performance Score
- **Problem:** 11 render-blocking scripts (including jQuery and WooCommerce) delay first paint; LCP is 10.1s on mobile.
- **Solution:**
  Add `defer` or `async` to non-critical scripts in `<head>`. Move WooCommerce and theme JS to footer or use `type="module"`.
  ```html
  <script src="..." defer></script>
  ```

**1B. Optimize hero and above-fold images**
- **Impact:** LCP, Page Weight
- **Problem:** Images total 1.45 MB; 6 images lack `loading="lazy"`; hero image is eagerly loaded but heavy.
- **Solution:**
  Convert PNG/JPEG to WebP/AVIF. Add `fetchpriority="high"` to LCP image. Ensure `loading="lazy"` on below-fold images.
  ```html
  <img src="hero.webp" fetchpriority="high" alt="...">
  ```

**1C. Force HTTPS redirect**
- **Impact:** Security, Transport encryption
- **Problem:** http://kawiare.ee/artiklid does not redirect to HTTPS, leaving users on unencrypted connections.
- **Solution:**
  Configure the web server (Apache/Nginx) to return a 301 redirect for all HTTP requests to HTTPS:
  ```apache
  RewriteEngine On
  RewriteCond %{HTTPS} off
  RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
  ```

**1D. Fix LCP by optimizing hero image and scripts**
- **Impact:** LCP, FCP, Performance Score
- **Problem:** LCP is 9.4 s on mobile; hero uses CSS background-image (no srcset) and 16 scripts are render-blocking.
- **Solution:**
  1. Replace CSS background hero with a real `<img>` or `<picture>` element with `fetchpriority="high"`.
  2. Add `defer` or `async` to non-critical scripts in `<head>`.
  3. Inline critical CSS and remove unused JS (224 KB wasted).

**1E. Enforce HTTPS redirect for all HTTP traffic**
- **Impact:** Security, Transport encryption
- **Problem:** Security Headers audit reports: 'http://kawiare.ee... does not redirect to HTTPS'. This exposes users to MITM attacks on initial connection.
- **Solution:**
  Configure the web server (Apache/Nginx) to return a 301 redirect from HTTP to HTTPS for all requests.
  ```apache
  RewriteEngine On
  RewriteCond %{HTTPS} off
  RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
  ```

**1F. Eliminate render-blocking JavaScript to fix LCP**
- **Impact:** LCP (8.5 s), FCP (4.7 s), Mobile Performance (58)
- **Problem:** 11 render-blocking scripts found in HTML Inventory; PSI identifies 224 KB unused JS and long tasks delaying main thread.
- **Solution:**
  Add `defer` or `async` to non-critical scripts in `<head>`. Inline critical CSS and move non-critical JS to the footer.
  ```html
  <!-- Change this -->
  <script src="main.js"></script>
  <!-- To this -->
  <script src="main.js" defer></script>
  ```

**1G. Force HTTPS redirect for all HTTP traffic**
- **Impact:** Security, Data Integrity
- **Problem:** Security Headers audit found 'http://kawiare.ee... does not redirect to HTTPS', leaving users vulnerable to downgrade attacks.
- **Solution:**
  Configure the web server (Apache/Nginx) to return a 301 redirect from HTTP to HTTPS for all requests.
  ```apache
  RewriteEngine On
  RewriteCond %{HTTPS} off
  RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
  ```

**1H. Enforce HTTPS Redirect**
- **Impact:** Security, Trust
- **Problem:** http://kawiare.ee/kuidas-eristada-kvaliteetset-kaaviari does not redirect to HTTPS, leaving HTTP traffic unencrypted.
- **Solution:**
  Configure server (Apache/Nginx) to return a 301 redirect from HTTP to HTTPS for all requests.
  ```apache
  RewriteEngine On
  RewriteCond %{HTTPS} off
  RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
  ```

**1I. Defer Render-Blocking JavaScript**
- **Impact:** LCP, FCP, Performance
- **Problem:** 11 render-blocking scripts contribute to a 5.4s LCP on mobile; 224 KB of unused JS identified.
- **Solution:**
  Add `defer` or `async` to non-critical scripts in `<head>`.
  ```html
  <script src="main.js" defer></script>
  ```
  Move critical CSS inline and defer non-critical CSS.

**1J. Optimize Largest Contentful Paint (LCP)**
- **Impact:** Performance, Mobile UX
- **Problem:** Mobile LCP is 8.5 s (target ≤2.5 s) caused by render-blocking scripts and unoptimized hero image.
- **Solution:**
  - Defer non-critical JavaScript (11 render-blocking scripts found).
  - Preload the hero image (`<link rel="preload" as="image" href="...">`).
  - Convert hero image to WebP/AVIF and serve responsive sizes.

### Priority 2: Important
*Essential for compliance, user reach, and search visibility.*

**2A. Strengthen security headers**
- **Impact:** Security Headers Score, XSS/Clickjacking Defense
- **Problem:** Security Headers grade 40/100; CSP missing, HSTS lacks preload directive.
- **Solution:**
  Add CSP with nonce/hash (not just allowlist). Update HSTS to include `preload`.
  ```apache
  Header set Content-Security-Policy "default-src 'self'; script-src 'nonce-{random}' 'strict-dynamic'"
  Header set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
  ```

**2B. Fix color contrast on cookie banner**
- **Impact:** Accessibility (WCAG 1.4.3)
- **Problem:** axe-core reports 1 serious violation on `#cookiescript_accept` button.
- **Solution:**
  Increase contrast ratio to ≥4.5:1 for text on the cookie accept button. Test with a contrast checker tool.

**2C. Fix accessibility violations and landmarks**
- **Impact:** WCAG 1.4.3, 2.4.1, 2.4.6
- **Problem:** Serious color-contrast on `#cookiescript_accept`; heading order skips H2; missing skip-to-content link; form inputs lack labels.
- **Solution:**
  - Increase contrast on `#cookiescript_accept` to ≥4.5:1.
  - Insert `<h2>` between `h1` and `h3` or change `h3` to `h2`.
  - Add `<a href="#main" class="skip-link">Skip to content</a>`.
  - Add `<label>` or `aria-label` to all form inputs.

**2D. Fix accessibility violations (contrast and landmarks)**
- **Impact:** WCAG 1.4.3, 1.3.1, Screen Reader usability
- **Problem:** axe-core reports 1 serious color-contrast violation (#cookiescript_accept) and 3 moderate landmark issues (duplicate main, missing skip link).
- **Solution:**
  - Increase contrast on `.cookiescript_accept` to ≥4.5:1.
  - Add `<a href="#main" class="skip-link">Skip to content</a>` before the header.
  - Ensure only one `<main>` element exists and it is not nested inside another landmark.

**2E. Fix serious accessibility violations and landmarks**
- **Impact:** WCAG Compliance, Usability
- **Problem:** axe-core found 1 serious color-contrast violation (#cookiescript_accept) and 3 moderate landmark issues (duplicate main, missing skip link).
- **Solution:**
  - Increase contrast on `#cookiescript_accept` to ≥4.5:1.
  - Add a skip link: `<a href="#main" class="skip-link">Skip to content</a>`.
  - Ensure only one `<main>` element exists and it is not nested inside another landmark.

**2F. Fix color contrast and add skip-to-content link**
- **Impact:** Accessibility (WCAG 1.4.3, 2.4.1)
- **Problem:** axe-core found 1 serious contrast violation on `#cookiescript_accept` and HTML Inventory notes missing skip-to-content link.
- **Solution:**
  - Increase contrast on the cookie accept button to ≥4.5:1.
  - Add a visible skip link at the top of the DOM:
  ```html
  <a href="#main" class="skip-link">Otse sisule</a>
  ```

**2G. Implement Content Security Policy (CSP)**
- **Impact:** XSS Defense, Security Headers Grade
- **Problem:** CSP is missing. WooCommerce scripts are present, indicating potential cart functionality despite 'no ecommerce' signals.
- **Solution:**
  Deploy a strict CSP with nonces for scripts:
  ```apache
  Header set Content-Security-Policy "default-src 'self'; script-src 'nonce-{random}' 'strict-dynamic';"
  ```

**2H. Fix Cookie Banner Contrast**
- **Impact:** WCAG 1.4.3 (Contrast)
- **Problem:** axe-core reports a serious color-contrast violation on `#cookiescript_accept`.
- **Solution:**
  Increase contrast ratio to at least 4.5:1 for text on the cookie banner.
  ```css
  #cookiescript_accept { color: #333333; background: #ffffff; }
  ```

**2I. Add Meta Description**
- **Impact:** SEO
- **Problem:** HTML Inventory and PSI SEO audit show `Description: not set`.
- **Solution:**
  Add a unique meta description tag in the `<head>`.
  ```html
  <meta name="description" content="20 punkti, kuidas eristada kvaliteetset kaaviari...">
  ```

**2J. Fix Accessibility Violations**
- **Impact:** WCAG Compliance, Usability
- **Problem:** 1 serious color-contrast violation (#cookiescript_accept) and 3 moderate landmark issues (duplicate main, missing skip link).
- **Solution:**
  - Increase contrast on `#cookiescript_accept` to ≥4.5:1.
  - Add `<a class="skip-link" href="#main">Skip to content</a>`.
  - Ensure only one `<main>` element exists and remove duplicate `role="main"`.

**2K. Fix Color Contrast Violation**
- **Impact:** Accessibility (WCAG 1.4.3)
- **Problem:** axe-core reports 1 serious violation on `#cookiescript_accept` where foreground/background contrast is insufficient.
- **Solution:**
  Increase contrast ratio to at least 4.5:1 for normal text. Adjust CSS for the cookie accept button:
  ```css
  #cookiescript_accept { color: #333; background: #fff; }
  ```

**2L. Resolve Landmark Duplication**
- **Impact:** Accessibility (WCAG 1.3.1)
- **Problem:** axe-core reports duplicate `main` landmarks (`#main` and `#primary`) and `main` nested inside another landmark.
- **Solution:**
  Ensure only one `<main>` element exists per page. Remove `role="main"` from `<div id="primary">` if it wraps the main content, or change it to `<section>`.

**2M. Fix accessibility contrast and landmarks**
- **Impact:** WCAG 1.4.3, 1.3.1, Screen Reader Navigation
- **Problem:** 1 serious color-contrast violation on #cookiescript_accept and 3 moderate landmark issues (duplicate main, nested main).
- **Solution:**
  - Increase contrast on the cookie accept button to ≥4.5:1.
  - Remove duplicate `role="main"` attributes; ensure only one `<main>` element exists.
  - Add a skip-to-content link at the top of the page for keyboard users.

**2N. Add Content Security Policy (CSP)**
- **Impact:** XSS Defense-in-Depth
- **Problem:** CSP is missing. While signals indicate no auth/payments on this page, WooCommerce plugins are present, increasing potential attack surface.
- **Solution:**
  Implement a strict CSP with nonce/hash for scripts:
  ```apache
  Header set Content-Security-Policy "default-src 'self'; script-src 'nonce-{random}' 'strict-dynamic'; object-src 'none'; base-uri 'none';"
  ```
  Ensure all inline scripts use the nonce.

### Priority 3: Best Practice
*Recommended for long-term maintainability.*

**3A. Correct HTML structure and H1 usage**
- **Impact:** SEO, Accessibility
- **Problem:** W3C reports 1 error (style in div); HTML Inventory shows 3 `<h1>` elements.
- **Solution:**
  Ensure only one `<h1>` per page. Move inline `<style>` blocks to external CSS or `<head>`. Add a skip-to-content link.

**3B. Add Content Security Policy and Meta Description**
- **Impact:** XSS defense, SEO snippet
- **Problem:** CSP is missing (low risk per signals); SEO meta description not set.
- **Solution:**
  1. Add a nonce-based CSP: `Content-Security-Policy: script-src 'nonce-{random}' 'strict-dynamic';`
  2. Add `<meta name="description" content="...">` summarizing the article content.

**3C. Add Content-Security-Policy (CSP)**
- **Impact:** XSS defense-in-depth
- **Problem:** CSP is missing. Site signals indicate no auth/payments/UGC, so risk is lower than P1, but still recommended for defense-in-depth.
- **Solution:**
  Implement a strict CSP with nonce/hash for scripts.
  ```apache
  Header set Content-Security-Policy "default-src 'self'; script-src 'nonce-{random}' 'strict-dynamic';"
  ```

**3D. Add meta description for SEO**
- **Impact:** Search snippet quality, CTR
- **Problem:** W3C/SEO audit notes: 'Document does not have a meta description'.
- **Solution:**
  Add a unique description tag (150-160 chars) in `<head>`.
  ```html
  <meta name="description" content="Learn how to identify quality red fish roe with our expert guide on taste, smell, and texture.">
  ```

**3E. Implement Content-Security-Policy (CSP)**
- **Impact:** XSS Defense-in-Depth
- **Problem:** CSP is missing. Site signals indicate no auth/payments/UGC, so risk is lower than P1, but still recommended for defense-in-depth.
- **Solution:**
  Start with a report-only policy to identify violations, then enforce:
  ```apache
  Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://www.googletagmanager.com;"
  ```

**3F. Add meta description and fix W3C errors**
- **Impact:** SEO, Code Quality
- **Problem:** SEO audit flagged missing meta description; W3C validator reported 2 errors (invalid style in div, unescaped character).
- **Solution:**
  - Add `<meta name="description" content="...">` summarizing the article.
  - Move inline `<style>` blocks out of `<div>` tags and escape `<` characters in text content.

**3G. Add meta description and optimize hero image**
- **Impact:** SEO, LCP
- **Problem:** HTML Inventory shows 'Description: not set' and hero image is a 2000×560 PNG without srcset.
- **Solution:**
  - Add `<meta name="description" content="...">`.
  - Convert hero PNG to WebP/AVIF and add `srcset` for responsive loading.

**3H. Implement Content Security Policy**
- **Impact:** XSS Defense-in-Depth
- **Problem:** CSP is missing; site signals indicate no auth/payments on this page, lowering priority to P3.
- **Solution:**
  Deploy a nonce-based CSP to mitigate XSS risks.
  ```apache
  Header set Content-Security-Policy "default-src 'self'; script-src 'nonce-{random}' 'strict-dynamic'"
  ```

**3I. Implement Content Security Policy (CSP)**
- **Impact:** XSS Protection
- **Problem:** CSP is missing. Site signals show no auth/payments/UGC, so risk is lower but still recommended for defense-in-depth.
- **Solution:**
  Deploy a strict CSP with nonces for scripts:
  ```apache
  Header always set Content-Security-Policy "default-src 'self'; script-src 'nonce-{RANDOM}' 'strict-dynamic';"
  ```
  Ensure all inline scripts use the nonce.

**3J. Add Content Security Policy**
- **Impact:** Security (XSS Defense)
- **Problem:** CSP is missing. While site signals indicate no auth/payments, a CSP provides defense-in-depth against injected scripts.
- **Solution:**
  Implement a strict CSP with nonce/hash for scripts:
  ```apache
  Header set Content-Security-Policy "default-src 'self'; script-src 'nonce-{random}' 'strict-dynamic';"
  ```

**3K. Add Meta Description**
- **Impact:** SEO
- **Problem:** W3C and PSI report missing meta description, reducing click-through potential in search results.
- **Solution:**
  Add a unique description tag in `<head>`:
  ```html
  <meta name="description" content="Lumekrabi on tervislik ja jätkusuutlik delikatess. Loe, kuidas eristada kvaliteetset kaaviari.">
  ```

**3L. Add meta description and lazy load below-fold images**
- **Impact:** SEO, Page Weight
- **Problem:** Meta description is missing (SEO audit fail); 2 images below the fold lack loading="lazy".
- **Solution:**
  - Add a unique meta description tag in `<head>`.
  - Ensure all images below the fold have `loading="lazy"` attribute:
  ```html
  <img src="..." alt="..." loading="lazy" width="..." height="...">
  ```