{"url":"https://kodud.embach.ee/","date":"2026-07-20","siteName":"Kodud","overall":74,"reasoning":"Site overall 74 is the mean of 5 pages. Scores range 72 (https://kodud.embach.ee/hello-world) → 78 (https://kodud.embach.ee/sample-page). Weakest page: Mobile performance (77) is dragged down by LCP 3.7 s and CLS 0.208, while desktop is excellent (99). Security headers are completely absent (0/100), which is critical given the inferred user-generated content signal. Accessibility is strong (94) but fails on the missing H1 heading structure. SEO metadata is missing (description, structured data). Confidence is high due to complete data coverage.","confidence":"high","fixes":[{"priority":1,"title":"Fix Cumulative Layout Shift (CLS) on Carousel","impact":"Core Web Vitals, User Experience","problem":"CLS is 0.287 (mobile) and 0.571 (desktop), exceeding the 0.25 threshold. The shift source is identified as 'div.projects-carousel__slider'.","solution":"Reserve space for the carousel container using `min-height` or `aspect-ratio` in CSS to prevent layout shifts during image loading.\n```css\n.projects-carousel__slider {\n min-height: 400px; /* Adjust to actual content height */\n aspect-ratio: 16 / 9;\n}\n```"},{"priority":1,"title":"Implement Missing Security Headers","impact":"Security, Transport Integrity","problem":"Security Headers grade is 0/100. HSTS, X-Frame-Options, X-Content-Type-Options, and CSP are all missing. UGC signal is 'yes', elevating CSP to Priority 1.","solution":"Add the following headers to the server response (Apache example):\n```apache\nHeader always set Strict-Transport-Security \"max-age=63072000; includeSubDomains; preload\"\nHeader always set X-Content-Type-Options \"nosniff\"\nHeader always set X-Frame-Options \"SAMEORIGIN\"\nHeader always set Content-Security-Policy \"default-src 'self'; script-src 'nonce-{random}' 'strict-dynamic';\"\n```"},{"priority":1,"title":"Optimize Largest Contentful Paint (LCP)","impact":"Performance, LCP Metric","problem":"LCP is 3.3 s on mobile, exceeding the 2.5 s good threshold. 6 render-blocking scripts and 109 KB unused JS contribute to delay.","solution":"1. Defer non-critical scripts (add `defer` or `async` to 6 render-blocking scripts).\n2. Preload the hero image resource.\n3. Remove or tree-shake the 109 KB unused JavaScript (`global.04cbabbf7670bc75.js`).\n```html\n\n\n```"},{"priority":1,"title":"Add a single H1 heading to the page","impact":"SEO, Accessibility (WCAG 1.3.1)","problem":"HTML Inventory reports 0 H1 elements; axe-core flags 'page-has-heading-one' as a moderate violation.","solution":"Ensure the main title of the post/page is wrapped in a single `
` tag.\n```html\n
Hello world!
\n```"},{"priority":1,"title":"Implement baseline security headers (HSTS, CSP, X-Frame-Options)","impact":"Transport security, XSS defense, Clickjacking","problem":"Security Headers grade is 0/100; HSTS and CSP are missing despite UGC signal (yes) increasing XSS risk.","solution":"Add to server config (Apache example):\n```apache\nHeader always set Strict-Transport-Security \"max-age=63072000; includeSubDomains; preload\"\nHeader always set X-Frame-Options \"SAMEORIGIN\"\nHeader always set X-Content-Type-Options \"nosniff\"\nHeader always set Content-Security-Policy \"default-src 'self'; script-src 'self' 'nonce-{random}' 'strict-dynamic';\"\n```"},{"priority":1,"title":"Implement Critical Security Headers (HSTS, CSP)","impact":"Security, XSS protection, Clickjacking","problem":"Security Headers grade is 0/100; HSTS and CSP are missing. Site signals indicate user-generated content (UGC), elevating XSS risk.","solution":"Add the following headers to your server configuration (e.g., Apache .htaccess or Nginx):\n```apache\nHeader always set Strict-Transport-Security \"max-age=63072000; includeSubDomains; preload\"\nHeader always set X-Content-Type-Options \"nosniff\"\nHeader always set X-Frame-Options \"SAMEORIGIN\"\nHeader always set Content-Security-Policy \"default-src 'self'; script-src 'self' 'nonce-{random}' 'strict-dynamic'; object-src 'none'; base-uri 'none';\"\n```\nEnsure CSP uses nonces/hashes for scripts rather than a permissive allowlist."},{"priority":1,"title":"Fix Hero Image Loading for LCP","impact":"LCP, FCP, Performance Score","problem":"LCP is 5.2 s on mobile; checklist confirms hero image has loading='lazy' which delays rendering.","solution":"Remove `loading=\"lazy\"` from the hero image and add `fetchpriority=\"high\"`:\n```html\n\n```"},{"priority":1,"title":"Implement HSTS and CSP Headers","impact":"Security Headers Grade, XSS/Clickjacking Defense","problem":"Security grade is 0/100; HSTS and CSP are missing. UGC signal is 'yes', raising CSP priority per rubric.","solution":"Add HSTS and a strict CSP (nonce-based) to server config:\n```apache\nHeader always set Strict-Transport-Security \"max-age=63072000; includeSubDomains; preload\"\nHeader always set Content-Security-Policy \"default-src 'self'; script-src 'nonce-{random}' 'strict-dynamic';\"\n```"},{"priority":1,"title":"Implement Baseline Security Headers","impact":"Security, Transport Integrity","problem":"Security Headers grade is 0/100; HSTS, X-Frame-Options, and X-Content-Type-Options are missing.","solution":"Add these headers via server config (Apache example):\n```apache\nHeader always set Strict-Transport-Security \"max-age=63072000; includeSubDomains\"\nHeader always set X-Frame-Options \"SAMEORIGIN\"\nHeader always set X-Content-Type-Options \"nosniff\"\n```"},{"priority":1,"title":"Add Content-Security-Policy (CSP)","impact":"XSS Defense","problem":"CSP is missing and Site Signals infer User-Generated Content (anchor href contains \"post\"), elevating XSS risk.","solution":"Deploy a strict CSP with nonces rather than a flat allowlist:\n```apache\nHeader always set Content-Security-Policy \"default-src 'self'; script-src 'nonce-{random}' 'strict-dynamic';\"\n```"},{"priority":2,"title":"Add Meta Description and Structured Data","impact":"SEO, Search Visibility","problem":"PSI SEO audit fails on `metaDescription` and `structuredData`. HTML inventory confirms no meta description or JSON-LD present.","solution":"Add a unique meta description (150-160 chars) and relevant JSON-LD (e.g., `RealEstateAgent` or `LocalBusiness`).\n```html\n\n\n```"},{"priority":2,"title":"Reduce Cumulative Layout Shift (CLS) caused by footer","impact":"Core Web Vitals (CLS), User Experience","problem":"CLS is 0.208 (warning zone); PSI identifies footer div as the primary shift source (0.197).","solution":"Reserve space for dynamic footer content or ensure footer elements have explicit dimensions.\n```css\nfooter.footer {\n min-height: 200px; /* Reserve space */\n}\n```"},{"priority":2,"title":"Defer non-critical render-blocking scripts","impact":"LCP, FCP, Performance Score","problem":"6 render-blocking scripts detected; 117 KB unused JS identified in global.js.","solution":"Add `defer` or `async` to script tags in `` unless they are critical for initial render.\n```html\n\n```"},{"priority":2,"title":"Defer Render-Blocking Scripts","impact":"LCP, FCP, Performance Score","problem":"6 render-blocking scripts identified in PSI and HTML Inventory; LCP is 3.7 s and FCP is 3.23 s on mobile.","solution":"Move non-critical scripts to the footer or add `defer`/`async` attributes. For WordPress, use a plugin like WP Rocket (already detected) to delay JS execution or minify/combine scripts.\n```html\n\n\n\n\n```"},{"priority":2,"title":"Remove Unused JavaScript","impact":"Page Weight, TBT, Performance Score","problem":"117 KB of unused JavaScript detected in `global.04cbabbf7670bc75.js`.","solution":"Audit `global.js` and `core.js` for unused functions. Use code splitting or tree-shaking in your build process. If using WordPress, disable unused theme/plugin scripts via a performance plugin."},{"priority":2,"title":"Add H1 Heading Element","impact":"Accessibility (Axe), SEO (W3C)","problem":"W3C warns no H1; Axe reports 'page-has-heading-one' violation. Page uses H2s for main titles.","solution":"Ensure the primary page title is wrapped in `
`:\n```html\n
Kõik arendused
\n```"},{"priority":2,"title":"Add Meta Description","impact":"SEO (PSI Score 0)","problem":"PSI SEO audit fails 'metaDescription'; HTML inventory confirms description is not set.","solution":"Add a unique description tag in ``:\n```html\n\n```"},{"priority":2,"title":"Fix Accessibility Violations","impact":"WCAG 2.4.4, 2.5.8","problem":"PSI flags `button-name` and `target-size` with 0.00 scores; touch targets are too small and buttons lack accessible names.","solution":"- Ensure all buttons have visible text or `aria-label`.\n- Increase touch target padding to at least 44×44 px per WCAG 2.5.8."},{"priority":2,"title":"Defer Render-Blocking JavaScript","impact":"FCP, TBT, Performance","problem":"6 render-blocking scripts detected; 117 KB unused JS contributes to long tasks.","solution":"Add `defer` or `async` to non-critical scripts in ``:\n```html\n\n```"},{"priority":3,"title":"Ensure Lazy Loading on All Below-Fold Images","impact":"Page Weight, Load Time","problem":"HTML inventory shows 1 image missing `loading=\"lazy\"` despite being below the fold. Total page weight is 795.5 KB.","solution":"Audit all images below the fold and add `loading=\"lazy\"` attribute. Ensure hero images remain `eager` or `fetchpriority=\"high\"`.\n```html\n\n```"},{"priority":3,"title":"Add meta description and structured data","impact":"SEO (Search Appearance)","problem":"PSI SEO audit fails on `metaDescription` and `structuredData`; HTML Inventory confirms 0 Open Graph/Twitter tags.","solution":"Add meta description and JSON-LD schema to the ``:\n```html\n\n\n```"},{"priority":3,"title":"Verify Button Accessibility Names","impact":"Accessibility, WCAG 2.4.4","problem":"PSI reports `button-name` failure (score 0.00) despite axe-core showing 0 violations; manual check needed.","solution":"Inspect all `
![\"...\"](\"hero.jpg\")
\n```"},{"priority":1,"title":"Implement HSTS and CSP Headers","impact":"Security Headers Grade, XSS/Clickjacking Defense","problem":"Security grade is 0/100; HSTS and CSP are missing. UGC signal is 'yes', raising CSP priority per rubric.","solution":"Add HSTS and a strict CSP (nonce-based) to server config:\n```apache\nHeader always set Strict-Transport-Security \"max-age=63072000; includeSubDomains; preload\"\nHeader always set Content-Security-Policy \"default-src 'self'; script-src 'nonce-{random}' 'strict-dynamic';\"\n```"},{"priority":1,"title":"Implement Baseline Security Headers","impact":"Security, Transport Integrity","problem":"Security Headers grade is 0/100; HSTS, X-Frame-Options, and X-Content-Type-Options are missing.","solution":"Add these headers via server config (Apache example):\n```apache\nHeader always set Strict-Transport-Security \"max-age=63072000; includeSubDomains\"\nHeader always set X-Frame-Options \"SAMEORIGIN\"\nHeader always set X-Content-Type-Options \"nosniff\"\n```"},{"priority":1,"title":"Add Content-Security-Policy (CSP)","impact":"XSS Defense","problem":"CSP is missing and Site Signals infer User-Generated Content (anchor href contains \"post\"), elevating XSS risk.","solution":"Deploy a strict CSP with nonces rather than a flat allowlist:\n```apache\nHeader always set Content-Security-Policy \"default-src 'self'; script-src 'nonce-{random}' 'strict-dynamic';\"\n```"},{"priority":2,"title":"Add Meta Description and Structured Data","impact":"SEO, Search Visibility","problem":"PSI SEO audit fails on `metaDescription` and `structuredData`. HTML inventory confirms no meta description or JSON-LD present.","solution":"Add a unique meta description (150-160 chars) and relevant JSON-LD (e.g., `RealEstateAgent` or `LocalBusiness`).\n```html\n\n\n```"},{"priority":2,"title":"Reduce Cumulative Layout Shift (CLS) caused by footer","impact":"Core Web Vitals (CLS), User Experience","problem":"CLS is 0.208 (warning zone); PSI identifies footer div as the primary shift source (0.197).","solution":"Reserve space for dynamic footer content or ensure footer elements have explicit dimensions.\n```css\nfooter.footer {\n min-height: 200px; /* Reserve space */\n}\n```"},{"priority":2,"title":"Defer non-critical render-blocking scripts","impact":"LCP, FCP, Performance Score","problem":"6 render-blocking scripts detected; 117 KB unused JS identified in global.js.","solution":"Add `defer` or `async` to script tags in `` unless they are critical for initial render.\n```html\n\n```"},{"priority":2,"title":"Defer Render-Blocking Scripts","impact":"LCP, FCP, Performance Score","problem":"6 render-blocking scripts identified in PSI and HTML Inventory; LCP is 3.7 s and FCP is 3.23 s on mobile.","solution":"Move non-critical scripts to the footer or add `defer`/`async` attributes. For WordPress, use a plugin like WP Rocket (already detected) to delay JS execution or minify/combine scripts.\n```html\n\n\n\n\n```"},{"priority":2,"title":"Remove Unused JavaScript","impact":"Page Weight, TBT, Performance Score","problem":"117 KB of unused JavaScript detected in `global.04cbabbf7670bc75.js`.","solution":"Audit `global.js` and `core.js` for unused functions. Use code splitting or tree-shaking in your build process. If using WordPress, disable unused theme/plugin scripts via a performance plugin."},{"priority":2,"title":"Add H1 Heading Element","impact":"Accessibility (Axe), SEO (W3C)","problem":"W3C warns no H1; Axe reports 'page-has-heading-one' violation. Page uses H2s for main titles.","solution":"Ensure the primary page title is wrapped in `![\"Description\"](\"image.jpg\")
\n```"},{"priority":3,"title":"Add meta description and structured data","impact":"SEO (Search Appearance)","problem":"PSI SEO audit fails on `metaDescription` and `structuredData`; HTML Inventory confirms 0 Open Graph/Twitter tags.","solution":"Add meta description and JSON-LD schema to the ``:\n```html\n\n\n```"},{"priority":3,"title":"Verify Button Accessibility Names","impact":"Accessibility, WCAG 2.4.4","problem":"PSI reports `button-name` failure (score 0.00) despite axe-core showing 0 violations; manual check needed.","solution":"Inspect all `