# Audit Report: lootsa
**Website:** https://lootsa.ee/
**Date:** 14.08.2026
**Audit Coverage:** 100% — all sources returned data
**Confidence:** high
**Pages Audited (1 of 1):**
- https://lootsa.ee/
## Summary of results
**Overall Score:** 55 / 100
**Status:** 🟠 **Poor**
PSI mobile performance is 72, but LCP 5.1 s and FCP 4.05 s indicate critical rendering delays that heavily penalize user experience. Security Headers score is 0/100; with User-Generated Content present, missing CSP and HSTS create significant vulnerability. Accessibility has 3 serious axe violations (aria-hidden-focus, link-name, contrast) despite a 93 category score. Image payload is 1.77 MB with the hero image incorrectly lazy-loaded, driving the performance debt. Confidence is high as all audit tools returned complete data.
### Per-page scores
🟠 **Poor** · https://lootsa.ee/
| Score | Performance | Accessibility | Best Practices | SEO | Security |
| --- | --- | --- | --- | --- | --- |
| 55 | 72 | 93 | 100 | 92 | 0 |
## PageSpeed Insights — Mobile vs Desktop
_Lower is worse for Performance; higher is worse for LCP and CLS. Worse value is **bolded**._
| Strategy | Performance (M / D) | LCP (M / D) | CLS (M / D) |
| --- | --- | --- | --- |
| Mobile vs Desktop | **72** / 98 | **5.06 s** / 1.03 s | **0.011** / 0.000 |
## Optimization Checklist
**3 of 6 passing** — 3 pass · 1 warn · 2 fail · 1 n/a
| Item | Status | Detail |
| --- | --- | --- |
| Page caching plugin / CDN active | **Pass** | Caching plugin detected (WP Rocket) |
| Images lazy-loaded | **Fail** | 66 of 73 non-hero raster images are not lazy-loaded (threshold: 14) (3 SVGs excluded). |
| Hero image eagerly loaded | **Fail** | Hero image has loading="lazy", which delays LCP (inferred from DOM order/size — Lighthouse LCP element unavailable). Use loading="eager" (or omit loading) and add fetchpriority="high". |
| Hero is a real ![]()
(not a CSS background-image) | N/A | No CSS background-images detected on raster-image-eligible elements. |
| Responsive images (srcset / ) | **Pass** | 67/74 raster images use srcset or (91%) (3 SVGs excluded). |
| Reasonable number of image sizes | **Pass** | 25 distinct srcset widths. |
| JS scripts not blocking in | **Warn** | 1 render-blocking script in . Move to footer or add defer/async. |
## Fixes
### Priority 1: Critical
*Immediate action — impacts user experience, search rankings, or site safety.*
**1A. Fix Hero Image Loading Strategy** `Performance`
- **Impact:** LCP, FCP, Speed Index
- **Problem:** LCP is 5.1 s; the hero image (lootsa_hero-320x180.jpg) has loading="lazy" which delays rendering.
- **Solution:**
Remove `loading="lazy"` from the hero image and add `fetchpriority="high"`:
```html
```
**1B. Implement HSTS and CSP** `Security`
- **Impact:** Transport security, XSS protection
- **Problem:** Security Headers grade 0/100; HSTS and CSP are missing. Site has User-Generated Content (textarea/upload), elevating CSP to Priority 1.
- **Solution:**
Add HSTS and a strict CSP via server config (Apache example):
```apache
Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'nonce-{random}' 'strict-dynamic'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; form-action 'self';"
```
**1C. Fix Serious Axe Violations** `Accessibility`
- **Impact:** WCAG 2.1 AA compliance, Screen Reader usability
- **Problem:** 3 serious violations: `aria-hidden-focus` (FAQ slides), `link-name` (gallery images), `color-contrast` (.tag--brand).
- **Solution:**
- Remove `aria-hidden="true"` from elements containing focusable children or ensure focus is managed.
- Add `aria-label` or visible text to gallery image links.
- Increase contrast ratio for `.tag--brand` to ≥4.5:1.
### Priority 2: Important
*Essential for compliance, user reach, and search visibility.*
**2A. Lazy Load Below-Fold Images** `Performance`
- **Impact:** Page Weight, Initial Load Time
- **Problem:** 69 of 77 images lack `loading="lazy"`; total image weight is 1.77 MB.
- **Solution:**
Add `loading="lazy"` to all images below the fold. Ensure hero image remains eager.
```html
```
**2B. Add Meta Description and Correct Language** `SEO`
- **Impact:** Search snippet, Accessibility
- **Problem:** Missing meta description; HTML lang is "en" but content is Estonian.
- **Solution:**
- Add ``.
- Change `` to ``.
**2C. Add X-Content-Type-Options and X-Frame-Options** `Security`
- **Impact:** MIME sniffing, Clickjacking
- **Problem:** Missing X-Content-Type-Options and X-Frame-Options headers.
- **Solution:**
Add headers via server config:
```apache
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "SAMEORIGIN"
```
### Priority 3: Best Practice
*Recommended for long-term maintainability.*
_No items._