{"url":"https://play.ee/","date":"2026-09-24","siteName":"Perfectly formed web development team - gotoAndPlay","overall":76,"reasoning":"Site overall 76 is the mean of 4 pages. Scores range 73 (https://play.ee/team) → 78 (https://play.ee/privacy-policy). Weakest page: PSI mobile performance is strong at 94 with excellent TTFB and CLS, though LCP sits at 2.8 s in the warning range. However, the Security basics verdict is FAILED due to missing HTTP-to-HTTPS redirects and HSTS, which caps the overall score below 90 per the rubric. Accessibility has a serious color-contrast violation and missing landmarks despite a 94 score. W3C validation reports 7 errors including parser recovery failure, indicating broken HTML structure. Confidence is high as all audit tools returned complete data.","confidence":"low","fixes":[{"priority":1,"category":"Security","title":"Enforce HTTPS redirect and add HSTS","impact":"Transport security, trust, security basics score","problem":"Security basics verdict is FAILED; HTTP does not redirect to HTTPS and Strict-Transport-Security header is missing.","solution":"Configure the web server to redirect all HTTP traffic to HTTPS (301) and send the HSTS header:\n```apache\nHeader always set Strict-Transport-Security \"max-age=63072000; includeSubDomains; preload\"\nRewriteEngine On\nRewriteCond %{HTTPS} off\nRewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]\n```"},{"priority":1,"category":"Best Practices","title":"Fix W3C HTML validation errors","impact":"Rendering stability, SEO indexing","problem":"W3C validator reports 7 errors including parser recovery failure at line 101 (bad start tag in iframe/noscript in head).","solution":"Move the Google Tag Manager iframe snippet out of the `` or ensure it is properly closed within `

\n \n deny from all\n \nSkip to content`."},{"priority":2,"category":"Security","title":"Disable WordPress xmlrpc.php POST requests","impact":"Brute-force protection, server load","problem":"Security basics report indicates xmlrpc.php accepts POST requests, a known brute-force vector.","solution":"Block POST requests to xmlrpc.php in `.htaccess`:\n```apache\n\n \n deny from all\n \n\n```"},{"priority":2,"category":"Accessibility","title":"Fix color contrast and add main landmark","impact":"WCAG 1.4.3 contrast, 1.3.1 info and relationships","problem":"axe-core reports 1 serious violation on .heading__main contrast; document lacks a main landmark and skip-to-content link.","solution":"- Increase contrast on `.heading__main` to ≥4.5:1.\n- Add `

` wrapper around primary content.\n- Add skip link at top: ``."},{"priority":2,"category":"Best Practices","title":"Resolve W3C HTML validation errors","impact":"Parser compatibility, SEO rendering","problem":"W3C Validator reports 7 errors including parser recovery failure at line 105 and invalid iframe/noscript placement in head.","solution":"- Move `

` out of `` (likely GTM snippet).\n- Fix stray end tags and meta attributes.\n- Ensure `` opens correctly after ``."},{"priority":2,"category":"Accessibility","title":"Fix color contrast and heading hierarchy","impact":"WCAG 1.4.3 contrast, 1.3.1 heading order","problem":"axe-core found 1 serious color-contrast violation on h1 and .button, plus heading order skips (h1→h4).","solution":"- Adjust text colors to meet 4.5:1 contrast ratio.\n- Ensure headings follow sequential order (h1 → h2 → h3) without skipping levels."},{"priority":2,"category":"SEO","title":"Fix W3C HTML validation errors","impact":"Parser recovery, rendering consistency","problem":"W3C validator reported 7 errors including parser recovery failure at line 100 and invalid iframe/noscript placement in head.","solution":"- Move `` out of ``.\n- Ensure `` tags are placed correctly within ``.\n- Validate HTML structure to prevent parser recovery mode."},{"priority":2,"category":"SEO","title":"Fix HTML validation errors","impact":"Parsing, SEO, Accessibility","problem":"W3C Validator reported 8 errors including parser recovery failure at line 102 and bad href attributes.","solution":"- Remove empty `href` attributes on `` tags.\n- Fix `

\n Require all denied\n)","status":"n/a","detail":"Only 0 raster images on the page (37 SVGs, 13 placeholders excluded) — responsive-image rule does not apply.","evidence":[]},{"id":"imageSizes","title":"Reasonable number of image sizes","status":"n/a","detail":"Too few raster images to evaluate srcset width variety.","evidence":[]},{"id":"scriptsFooter","title":"JS scripts not blocking in ","status":"pass","detail":"No render-blocking scripts in .","evidence":[]}],"summary":{"passed":3,"warned":0,"failed":0,"notApplicable":5},"priorities":[]},"perPageOverall":[{"url":"https://play.ee/","overall":78,"reasoning":"PSI mobile performance is excellent at 96, and accessibility scores are high at 94, indicating strong core UX. However, the Security basics verdict is FAILED due to missing HTTP-to-HTTPS redirect and HSTS, which caps the overall score below 90 per the rubric. W3C validation shows 7 errors with parser recovery failure, risking rendering stability and SEO indexing. Additionally, 50 images lack explicit dimensions, creating a latent CLS risk despite current low CLS scores.","confidence":"high","fixes":[{"priority":1,"category":"Security","title":"Enforce HTTPS redirect and add HSTS","impact":"Transport security, trust, security basics score","problem":"Security basics verdict is FAILED; HTTP does not redirect to HTTPS and Strict-Transport-Security header is missing.","solution":"Configure the web server to redirect all HTTP traffic to HTTPS (301) and send the HSTS header:\n```apache\nHeader always set Strict-Transport-Security \"max-age=63072000; includeSubDomains; preload\"\nRewriteEngine On\nRewriteCond %{HTTPS} off\nRewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]\n```"},{"priority":1,"category":"Best Practices","title":"Fix W3C HTML validation errors","impact":"Rendering stability, SEO indexing","problem":"W3C validator reports 7 errors including parser recovery failure at line 101 (bad start tag in iframe/noscript in head).","solution":"Move the Google Tag Manager iframe snippet out of the `` or ensure it is properly closed within `

` out of `` (likely GTM snippet).\n- Fix stray end tags and meta attributes.\n- Ensure `` opens correctly after ``."},{"priority":3,"category":"Performance","title":"Add explicit width and height to images","impact":"CLS (Cumulative Layout Shift)","problem":"45 images lack width/height attributes, risking layout shifts despite current CLS of 0.037.","solution":"Add `width` and `height` attributes to all `` tags:\n```html\n $\"...\"$ \n```"},{"priority":3,"category":"Security","title":"Harden WordPress configuration","impact":"Brute-force protection, attack surface","problem":"xmlrpc.php accepts POST requests and /wp-admin/install.php is reachable.","solution":"- Disable xmlrpc.php in .htaccess or via plugin.\n- Block /wp-admin/install.php access after installation.\n- Consider changing default login path."}],"perfScore":94,"a11yScore":94,"bestPracticesScore":100,"seoScore":100,"securityScore":59,"securityVerdict":"FAILED"},{"url":"https://play.ee/privacy-policy","overall":78,"reasoning":"PSI mobile performance is strong at 93, but LCP (2.8 s) and FCP (2.33 s) sit in warning zones. The Security basics verdict is FAILED due to missing HTTP→HTTPS redirects and HSTS, which caps the overall score below 90 per the rubric. Accessibility has a serious color-contrast violation and missing main landmark. W3C validation shows 7 errors including parser recovery failure, indicating structural HTML issues. Confidence is medium because PSI desktop errored and W3C output was truncated.","confidence":"medium","fixes":[{"priority":1,"category":"Security","title":"Enforce HTTPS and add baseline security headers","impact":"Transport security, clickjacking, MIME sniffing","problem":"Security basics verdict is FAILED: HTTP does not redirect to HTTPS, HSTS is missing, and X-Content-Type-Options is missing.","solution":"Configure the web server to redirect all HTTP traffic to HTTPS and send these headers:\n```apache\nHeader always set Strict-Transport-Security \"max-age=63072000; includeSubDomains; preload\"\nHeader always set X-Content-Type-Options \"nosniff\"\n```"},{"priority":1,"category":"Security","title":"Disable WordPress xmlrpc.php POST requests","impact":"Brute-force protection, pingback vector","problem":"Security basics report shows xmlrpc.php accepts POST requests, a known brute-force vector.","solution":"Block POST requests to xmlrpc.php in .htaccess or via a security plugin:\n```apache\n\n \n deny from all\n \n\n```"},{"priority":2,"category":"Accessibility","title":"Fix color contrast and heading hierarchy","impact":"WCAG 1.4.3 contrast, 1.3.1 heading order","problem":"axe-core found 1 serious color-contrast violation on h1 and .button, plus heading order skips (h1→h4).","solution":"- Adjust text colors to meet 4.5:1 contrast ratio.\n- Ensure headings follow sequential order (h1 → h2 → h3) without skipping levels."},{"priority":2,"category":"SEO","title":"Fix W3C HTML validation errors","impact":"Parser recovery, rendering consistency","problem":"W3C validator reported 7 errors including parser recovery failure at line 100 and invalid iframe/noscript placement in head.","solution":"- Move `` out of ``.\n- Ensure `` tags are placed correctly within ``.\n- Validate HTML structure to prevent parser recovery mode."},{"priority":3,"category":"Performance","title":"Eliminate render-blocking JavaScript","impact":"FCP, LCP, TBT","problem":"PSI findings estimate 1,230 ms savings from render-blocking insights; unused JS detected (23 KB).","solution":"- Add `defer` or `async` to non-critical scripts.\n- Inline critical CSS and defer non-critical JS.\n- Remove or tree-shake the 23 KB of unused jQuery code."},{"priority":3,"category":"Security","title":"Harden Content-Security-Policy (CSP)","impact":"XSS defense-in-depth","problem":"Current CSP only sets `frame-ancestors 'self'`; missing `default-src` and `object-src 'none'`.","solution":"Since the site has no auth/payments (signals: no), a strict CSP is P3. If implemented later, use nonce-based CSP:\n```apache\nHeader always set Content-Security-Policy \"default-src 'self'; script-src 'nonce-{random}' 'strict-dynamic'; object-src 'none';\"\n```"}],"perfScore":93,"a11yScore":87,"bestPracticesScore":100,"seoScore":100,"securityScore":59,"securityVerdict":"FAILED"},{"url":"https://play.ee/et/meeskond","overall":74,"reasoning":"Performance scores appear excellent (100) but mobile data is unreliable due to PSI HTTP 429 error (desktop data duplicated), lowering confidence. Security Basics FAILED (missing HSTS, X-Content-Type-Options, HTTP redirect) caps the score below 90 per rubric. Accessibility has 1 serious violation (color-contrast) and missing main landmark. HTML validation shows 8 errors including parser recovery failure, indicating structural issues. Image assets lack dimensions (45 images) risking CLS despite low lab scores.","confidence":"medium","fixes":[{"priority":1,"category":"Security","title":"Fix HTTP to HTTPS redirect and add HSTS","impact":"Transport security, Security Basics verdict","problem":"Security Basics FAILED: HTTP does not redirect to HTTPS and Strict-Transport-Security header is missing.","solution":"Configure server to redirect all HTTP traffic to HTTPS immediately.\n\nAdd HSTS header:\n```apache\nHeader always set Strict-Transport-Security \"max-age=63072000; includeSubDomains; preload\"\n```"},{"priority":1,"category":"Security","title":"Add X-Content-Type-Options header","impact":"MIME sniffing protection","problem":"Security Basics FAILED: X-Content-Type-Options header is missing.","solution":"Add the following header to prevent MIME type sniffing:\n```apache\nHeader always set X-Content-Type-Options \"nosniff\"\n```"},{"priority":2,"category":"Accessibility","title":"Fix color contrast and add main landmark","impact":"WCAG 1.4.3, WCAG 1.3.1","problem":"axe-core found 1 serious violation (color-contrast on h1 headings) and missing main landmark.","solution":"- Increase contrast ratio for `.heading__main` text to ≥4.5:1.\n- Wrap primary content in `

` tag.\n- Add skip-to-content link at top of page."},{"priority":2,"category":"SEO","title":"Fix HTML validation errors","impact":"Parsing, SEO, Accessibility","problem":"W3C Validator reported 8 errors including parser recovery failure at line 102 and bad href attributes.","solution":"- Remove empty `href` attributes on `` tags.\n- Fix `

\n Require all denied\n