{"url":"https://larsen.ee/","date":"2026-06-10","siteName":"Larsen - The Coolest Accommodation in Tallinn","overall":47,"reasoning":"Site overall 47 is the mean of 5 pages. Scores range 42 (https://larsen.ee/) → 52 (https://larsen.ee/terms-of-service). Weakest page: Mobile PSI performance is critically low at 35 with an 18.9 s LCP, despite decent field data, indicating severe lab bottlenecks. The 69 MB total page weight (55 MB media) is unsustainable for mobile users and directly drives the TBT and LCP failures. Accessibility is blocked by 2 critical axe violations and 11 W3C errors including buttons inside anchors. Security headers are weak (HSTS/CSP) though no auth/payments exist, and image optimization is missing entirely (no srcset).","confidence":"high","fixes":[{"priority":1,"title":"Reduce page weight from 69 MB to under 5 MB","impact":"LCP, TBT, Mobile Performance","problem":"Total page weight is 69 MB with 55 MB media and 1.3 MB unused JS (app-8897...), causing 18.9 s LCP and 1.03 s TBT on mobile.","solution":"- Remove unused JavaScript bundles (1.3 MB).\n- Compress and resize media assets (55 MB) to WebP/AVIF.\n- Implement lazy loading for off-screen media.\n- Use a CDN with edge caching to reduce TTFB."},{"priority":1,"title":"Fix critical accessibility violations","impact":"WCAG Compliance, SEO","problem":"axe-core reports 2 critical violations: `button-name` (slider dots) and `image-alt` (Co-Liv image). W3C reports 5 errors of `button` inside `a`.","solution":"- Add `aria-label` to slider dot buttons.\n- Add descriptive `alt` text to the Co-Liv image.\n- Refactor HTML to remove `button` elements nested inside `a` tags (use `button` alone or `a` alone)."},{"priority":1,"title":"Optimize images to reduce page weight and LCP","impact":"LCP, Page Weight, CLS","problem":"Images consume 3.75 MB (82% of 4.6 MB total weight); LCP is 6.9 s on mobile. 8 images lack srcset/width/height, and 5 are not lazy-loaded.","solution":"1. Convert all raster images to WebP/AVIF.\n2. Add `srcset` and `sizes` attributes for responsive loading.\n3. Add `width` and `height` attributes to prevent CLS.\n4. Add `loading=\"lazy\"` to non-hero images.\n5. Use `fetchpriority=\"high\"` on the LCP hero image."},{"priority":1,"title":"Strengthen Security Headers (CSP & HSTS)","impact":"XSS Defense, Transport Security","problem":"Security grade is 40/100. HSTS max-age is too short (15552000s) and missing `includeSubDomains`. CSP only sets `frame-ancestors` (missing `default-src`). Site signals indicate User-Generated Content is present, elevating XSS risk.","solution":"1. Update HSTS: `max-age=31536000; includeSubDomains; preload`.\n2. Implement strict CSP with nonce/hash: `Content-Security-Policy: default-src 'self'; script-src 'nonce-{random}' 'strict-dynamic'; object-src 'none'; base-uri 'none';`.\n3. Add `X-Frame-Options: SAMEORIGIN` as fallback."},{"priority":1,"title":"Fix Core Web Vitals (LCP/FCP) and Reduce JavaScript","impact":"Performance, LCP, FCP, TBT","problem":"Mobile LCP is 20.6 s and FCP is 10.65 s; 1.4 MB of unused JavaScript identified (e.g., app-889782a39d4314ef1bf6.js).","solution":"1. **Defer/Remove Unused JS:** Audit and remove the 1.4 MB `app-*.js` bundle or split it. Use `defer` for non-critical scripts.\n2. **Fix Hero Image:** Ensure the LCP image (likely the hero) uses `loading=\"eager\"` (or omit) and `fetchpriority=\"high\"`.\n3. **Preload Critical Resources:** Add `` for the hero image and critical CSS."},{"priority":1,"title":"Resolve Critical Accessibility Violations","impact":"WCAG 2.1, Screen Reader Usability","problem":"axe-core reports 1 critical (`image-alt`) and 3 serious violations (`html-has-lang`, `color-contrast`, `link-name`).","solution":"1. **Add `lang` attribute:** ``.\n2. **Fix Image Alt:** Add descriptive `alt` text to all content images (e.g., `Co-Liv.png`).\n3. **Fix Contrast:** Ensure text/background contrast ratio ≥ 4.5:1.\n4. **Label Links:** Add `aria-label` to icon links (e.g., Facebook, Instagram) that lack visible text."},{"priority":1,"title":"Reduce JavaScript bundle size and eliminate unused code","impact":"LCP, TBT, FCP, Performance Score","problem":"1398 KB wasted JavaScript (app-889782a39d4314ef1bf6.js) contributes to 756 ms TBT and 4.2 s LCP on mobile.","solution":"- Implement code splitting to load only necessary JS for the Terms page.\n- Tree-shake unused dependencies.\n- Defer non-critical third-party scripts (GTM, PostHog) until after interaction."},{"priority":1,"title":"Fix critical accessibility violations and document structure","impact":"WCAG 2.1 A/AA Compliance, Screen Reader Usability","problem":"1 critical `image-alt` violation, 2 serious violations (`html-has-lang`, `link-name`), and missing `
` heading.","solution":"- Add `lang=\"en\"` to `` tag.\n- Add descriptive `alt` text to all images (e.g., `alt=\"Larsen Hotel Logo\"`).\n- Add a single `
` element describing the page (e.g., `
Terms of Service
`).\n- Ensure all links have discernible text or `aria-label`."},{"priority":1,"title":"Strengthen Security Headers (HSTS and CSP)","impact":"Transport Security, XSS Defense","problem":"HSTS max-age is too short (15552000s) and missing directives; CSP lacks `default-src` despite UGC signals.","solution":"- Update HSTS: `max-age=31536000; includeSubDomains; preload`.\n- Implement strict CSP with nonce/hash: `default-src 'self'; script-src 'nonce-{random}' 'strict-dynamic'; object-src 'none';`.\n- Add `X-Frame-Options: SAMEORIGIN` as fallback."},{"priority":1,"title":"Reduce page weight and fix LCP","impact":"Performance, LCP, FCP, TBT","problem":"Mobile Performance is 43/100; LCP is 18.9s; total page weight is 69MB (56MB media, 12MB images).","solution":"- Compress and resize media assets (videos/images) aggressively.\n- Implement lazy loading for below-fold content.\n- Remove unused JavaScript (1.37MB wasted in `app-889782a39d4314ef1bf6.js`).\n- Enable HTTP/2 or HTTP/3 server push for critical resources."},{"priority":1,"title":"Strengthen Content Security Policy (CSP)","impact":"XSS protection, Data integrity","problem":"CSP is present but weak (only `frame-ancestors` set); site has user-generated content (reviews), elevating XSS risk per the rubric.","solution":"- Implement a strict CSP with `default-src 'self'`.\n- Use nonces or hashes for inline scripts.\n- Add `object-src 'none'` and `base-uri 'none'`.\n- Example: `Content-Security-Policy: default-src 'self'; script-src 'nonce-{random}' 'strict-dynamic'; object-src 'none';`"},{"priority":2,"title":"Strengthen security headers (HSTS, CSP)","impact":"Transport security, XSS defense","problem":"HSTS max-age is too short (15552000s) and missing directives; CSP lacks `default-src`. UGC signal is present but no auth/payments.","solution":"```\nStrict-Transport-Security: max-age=31536000; includeSubDomains; preload\nContent-Security-Policy: default-src 'self'; script-src 'self' 'nonce-{random}' 'strict-dynamic';\n```"},{"priority":2,"title":"Implement responsive images (srcset)","impact":"Page weight, CLS, Mobile Performance","problem":"16/16 raster images lack `srcset` and `width/height` attributes, preventing browser optimization and risking layout shifts.","solution":"- Generate multiple image sizes (e.g., 400w, 800w, 1200w).\n- Add `srcset` and `sizes` attributes to `` tags.\n- Add explicit `width` and `height` to reserve space."},{"priority":2,"title":"Reduce JavaScript Bundle Size and Unused Code","impact":"TBT, FCP, TTI","problem":"1397 KB of unused JavaScript detected in `app-889782a39d4314ef1bf6.js`. Multiple third-party scripts (GTM, GA, PostHog) contribute to long tasks (179 ms, 114 ms).","solution":"1. Code-split the main bundle to defer non-critical JS.\n2. Audit third-party scripts; remove unused tracking pixels (e.g., duplicate GTM/GA instances).\n3. Load non-critical scripts with `defer` or `async`.\n4. Implement resource hints (`preconnect`) for critical third-party origins."},{"priority":2,"title":"Implement Proper Caching Policy","impact":"Repeat Visit Performance, TTFB","problem":"Security Headers report shows `cache-control: not set`. Caching behavior is unpredictable, forcing re-downloads on repeat visits.","solution":"1. Set `Cache-Control: public, max-age=31536000, immutable` for static assets (images, CSS, JS).\n2. Set `Cache-Control: no-cache, must-revalidate` for HTML documents to ensure freshness.\n3. Ensure Vary header is set correctly for content negotiation."},{"priority":2,"title":"Fix W3C HTML Validation Errors","impact":"SEO, Rendering Consistency","problem":"18 W3C errors including obsolete `` tags, duplicate IDs, and `