` and add a skip link at the top of the ``: ```html ...

``` **2D. Fix color contrast and add main landmark** `Accessibility` - **Impact:** WCAG 1.4.3, 1.3.1 - **Problem:** axe-core reports 1 serious violation (color-contrast on .heading__main etc.) and missing `main` landmark. - **Solution:** - Increase contrast ratio to ≥4.5:1 for text elements. - Wrap primary content in `

` tag. - Add skip link: ``. **2E. Add main landmark and fix contrast** `Accessibility` - **Impact:** Screen reader navigation, WCAG 1.4.3 - **Problem:** PSI `landmark-one-main` failed; axe reports 1 serious color-contrast violation on h1/span. - **Solution:** - Wrap primary content in `

` tag. - Increase contrast ratio for `.heading__main` and `p > span` to ≥4.5:1. - Add skip-to-content link at top of page. **2F. Fix HTML validation errors** `Best Practices` - **Impact:** Rendering stability, SEO - **Problem:** W3C Validator reports 7 errors including malformed `

` in `<head>` and parser recovery failure. - **Solution:** Move `<noscript>` containing GTM iframe outside `<head>` or ensure valid nesting. Remove invalid `name` attribute on `<meta>` tags. Validate full document after fixes. **2G. Fix color contrast and link names** `Accessibility` - **Impact:** WCAG 1.4.3, 2.4.4 compliance - **Problem:** axe-core reports 2 serious violations: color-contrast on multiple nodes and link-name on logo grid links. - **Solution:** - Increase contrast ratio on `.button--tertiary` and `.heading__small` elements to ≥4.5:1. - Add `aria-label` or visible text to logo grid links (e.g., `<a href="" aria-label="Partner Logo">`). **2H. Resolve W3C validation errors and H1 structure** `SEO` - **Impact:** Document outline, SEO indexing - **Problem:** W3C validator found 7 errors including parser recovery failure; HTML inventory shows 2 `<h1>` elements. - **Solution:** - Ensure only one `<h1>` exists per page. - Fix `<noscript><iframe>` nesting in `<head>` (move to `<body>`). - Remove invalid `name` attribute on `<meta>` tags. **2I. Add HSTS and X-Content-Type-Options headers** `Security` - **Impact:** Clickjacking, MIME sniffing, downgrade attacks - **Problem:** HSTS and X-Content-Type-Options are missing; grade is 20/100. These are baseline headers required regardless of site signals. - **Solution:** Add the following headers to the server configuration: ```apache Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" Header always set X-Content-Type-Options "nosniff" ``` **2J. Resolve W3C HTML validation errors** `Best Practices` - **Impact:** Parser reliability, SEO crawling - **Problem:** 7 errors found, including parser recovery failure at line 101 and invalid `<iframe>` inside `<noscript>` within `<head>`. - **Solution:** - Move `<noscript><iframe>...

` out of the `` (Google Tag Manager snippet should be in `` or properly placed). - Ensure `` tags are valid and do not use forbidden attributes like `name` in contexts requiring `property`. ### Priority 3: Best Practice *Recommended for long-term maintainability.* **3A. Add Explicit Width and Height to Images** `Performance` - **Impact:** CLS, layout stability - **Problem:** HTML Inventory shows 52 images without width/height attributes, which risks layout shifts despite current low CLS. - **Solution:** Ensure all `` tags include `width` and `height` attributes matching the intrinsic dimensions: ```html

``` **3B. Add explicit width/height to images** `Performance` - **Impact:** CLS, Layout stability - **Problem:** HTML Inventory shows 56 images without width/height attributes, risking layout shifts despite current CLS 0.000. - **Solution:** Add `width` and `height` attributes to all `` tags matching the intrinsic aspect ratio. ```html

``` **3C. Implement Content Security Policy** `Security` - **Impact:** XSS defense-in-depth - **Problem:** CSP is missing (only frame-ancestors set). Site signals show no auth/payments, so risk is lower but defense is recommended. - **Solution:** Deploy a strict CSP with nonce/hash approach when ready. ```apache Header always set Content-Security-Policy "default-src 'self'; script-src 'nonce-{random}' 'strict-dynamic';" ``` **3D. Implement Content-Security-Policy (CSP)** `Security` - **Impact:** XSS defense-in-depth - **Problem:** CSP is missing or weak (only `frame-ancestors`); site signals indicate no auth/payments, lowering immediate risk. - **Solution:** Deploy a strict CSP with nonce/hash for scripts: ```apache Header set Content-Security-Policy "default-src 'self'; script-src 'nonce-{random}' 'strict-dynamic'; object-src 'none';" ``` **3E. Remove unused CSS and JavaScript** `Performance` - **Impact:** FCP, TBT, Page weight - **Problem:** PSI findings indicate 31 KiB unused CSS and 23 KiB unused JS, contributing to FCP warning (1.96 s on mobile). - **Solution:** - Use PurgeCSS or similar tooling to remove unused CSS rules. - Code-split JavaScript bundles and defer non-critical scripts. - Verify WP Rocket configuration to ensure unused CSS is purged.