{"url":"https://lootsa.ee/","date":"2026-08-24","siteName":"Lõõtsa Ärikvartal","overall":78,"reasoning":"Performance is excellent (PSI Mobile 94, LCP 2.3 s, TTFB 6 ms), which anchors the score high. However, Security Headers are completely missing (0/100) and the site has User-Generated Content (textarea/upload), creating a high-risk XSS surface that demands Priority 1 remediation. Accessibility has a critical axe violation (button-name) and serious issues (contrast, link-name) that lower the score despite a 91 PSI accessibility rating. W3C validation shows 15 errors, primarily invalid script types and hidden input attributes, indicating technical debt. Missing meta descriptions and Open Graph tags further reduce SEO readiness.","confidence":"high","fixes":[{"priority":1,"category":"Security","title":"Implement HSTS and Content Security Policy (CSP)","impact":"Transport security, XSS mitigation","problem":"Security Headers grade is 0/100; HSTS and CSP are missing. Site signals indicate User-Generated Content (textarea, upload link), making XSS a Priority 1 risk per the rubric.","solution":"Add the following headers to your server configuration (e.g., Apache/Nginx):\n```apache\nHeader always set Strict-Transport-Security \"max-age=63072000; includeSubDomains; preload\"\nHeader always set Content-Security-Policy \"default-src 'self'; script-src 'nonce-{random}' 'strict-dynamic'; object-src 'none'; base-uri 'none';\"\nHeader always set X-Content-Type-Options \"nosniff\"\nHeader always set X-Frame-Options \"SAMEORIGIN\"\n```"},{"priority":1,"category":"Accessibility","title":"Fix critical button and link accessibility issues","impact":"WCAG 2.1 A compliance, screen reader usability","problem":"axe-core reports 1 critical violation (button-name) and 2 serious violations (color-contrast, link-name). Buttons lack discernible text and links in the gallery slider are unnamed.","solution":"- Add `aria-label` or visible text to all buttons (e.g., `