# Audit Report: Law firm Sorainen - helping clients succeed in business

**Website:** https://www.sorainen.com/  
**Date:** 12.08.2026  
**Audit Coverage:** 100% — all sources returned data  
**Confidence:** high

**Pages Audited (10 of 10):**

- https://www.sorainen.com/
- https://www.sorainen.com/newsroom
- https://www.sorainen.com/et/uudised
- https://www.sorainen.com/lv/zinas
- https://www.sorainen.com/lt/naujienos
- https://www.sorainen.com/law-firm-ratings-in-mergermarket-place-sorainen-as-a-leader-in-the-baltics-and-belarus
- https://www.sorainen.com/darius-rauludaitis-former-prosecutor-general-joins-law-firm-sorainen
- https://www.sorainen.com/sorainen-named-european-law-firm-of-the-year-at-the-lawyer-european-awards
- https://www.sorainen.com/lithuanian-private-equity-and-venture-capital-association-awards-sorainen-lawyers-as-bees-of-the-year
- https://www.sorainen.com/edvins-draba-joins-the-latvian-association-of-patent-attorneys

## Summary of results

**Overall Score:** 53 / 100  
**Status:** 🟠 **Poor**

Site overall 53 is the mean of 10 pages. Scores range 42 (https://www.sorainen.com/lithuanian-private-equity-and-venture-capital-association-awards-sorainen-lawyers-as-bees-of-the-year) → 66 (https://www.sorainen.com/lv/zinas). Weakest page: Mobile PSI performance is critically low at 48, driven by a catastrophic LCP of 11.7 s and 15.61 MB of media weight. Accessibility is compromised by 2 critical axe violations (image-alt, button-name) and 3 serious issues. Security headers score 40/100 with weak HSTS and CSP allowing unsafe-inline, which is elevated to Priority 1 due to the inferred user-generated content signal. W3C validation shows 6 errors including nesting violations and missing alt attributes. Desktop performance (77) is significantly better than mobile, but mobile-first indexing penalizes the overall score heavily.

### Per-page scores

🟠 **Poor** · https://www.sorainen.com/

| Score | Performance | Accessibility | Best Practices | SEO | Security |
| --- | --- | --- | --- | --- | --- |
| 53 | 55 | 77 | 92 | 92 | 40 |

🟠 **Poor** · https://www.sorainen.com/newsroom

| Score | Performance | Accessibility | Best Practices | SEO | Security |
| --- | --- | --- | --- | --- | --- |
| 53 | 55 | 85 | 92 | 85 | 40 |

🟠 **Poor** · https://www.sorainen.com/et/uudised

| Score | Performance | Accessibility | Best Practices | SEO | Security |
| --- | --- | --- | --- | --- | --- |
| 58 | 58 | 85 | 92 | 92 | 40 |

🟡 **Needs Improvement** · https://www.sorainen.com/lv/zinas

| Score | Performance | Accessibility | Best Practices | SEO | Security |
| --- | --- | --- | --- | --- | --- |
| 66 | 72 | 85 | 92 | 92 | 40 |

🟠 **Poor** · https://www.sorainen.com/lt/naujienos

| Score | Performance | Accessibility | Best Practices | SEO | Security |
| --- | --- | --- | --- | --- | --- |
| 58 | 61 | 85 | 92 | 92 | 40 |

🟠 **Poor** · https://www.sorainen.com/law-firm-ratings-in-mergermarket-place-sorainen-as-a-leader-in-the-baltics-and-belarus

| Score | Performance | Accessibility | Best Practices | SEO | Security |
| --- | --- | --- | --- | --- | --- |
| 48 | 45 | 81 | 92 | 77 | 40 |

🟠 **Poor** · https://www.sorainen.com/darius-rauludaitis-former-prosecutor-general-joins-law-firm-sorainen

| Score | Performance | Accessibility | Best Practices | SEO | Security |
| --- | --- | --- | --- | --- | --- |
| 48 | 56 | 81 | 69 | 77 | 40 |

🟠 **Poor** · https://www.sorainen.com/sorainen-named-european-law-firm-of-the-year-at-the-lawyer-european-awards

| Score | Performance | Accessibility | Best Practices | SEO | Security |
| --- | --- | --- | --- | --- | --- |
| 52 | 55 | 78 | 88 | 77 | 40 |

🟠 **Poor** · https://www.sorainen.com/lithuanian-private-equity-and-venture-capital-association-awards-sorainen-lawyers-as-bees-of-the-year

| Score | Performance | Accessibility | Best Practices | SEO | Security |
| --- | --- | --- | --- | --- | --- |
| 42 | 48 | 81 | 88 | 77 | 40 |

🟠 **Poor** · https://www.sorainen.com/edvins-draba-joins-the-latvian-association-of-patent-attorneys

| Score | Performance | Accessibility | Best Practices | SEO | Security |
| --- | --- | --- | --- | --- | --- |
| 48 | 55 | 81 | 92 | 77 | 40 |

## PageSpeed Insights — Mobile vs Desktop

_Lower is worse for Performance; higher is worse for LCP and CLS. Worse value is **bolded**._

| URL | Performance (M / D) | LCP (M / D) | CLS (M / D) |
| --- | --- | --- | --- |
| https://www.sorainen.com/ | **55** / 64 | **17.13 s** / 1.92 s | 0.000 / **0.000** |
| https://www.sorainen.com/newsroom | **55** / 72 | **11.61 s** / 1.04 s | 0.000 / **0.000** |
| https://www.sorainen.com/et/uudised | **58** / 97 | **3.83 s** / 873 ms | 0.000 / **0.000** |
| https://www.sorainen.com/lv/zinas | **72** / 79 | **4.11 s** / 1.12 s | 0.000 / **0.001** |
| https://www.sorainen.com/lt/naujienos | **61** / 81 | **3.96 s** / 1.24 s | 0.000 / **0.004** |
| https://www.sorainen.com/law-firm-ratings-in-mergermarket-place-sorainen-as-a-leader-in-the-baltics-and-belarus | **45** / 81 | **10.93 s** / 1.86 s | **0.004** / 0.003 |
| https://www.sorainen.com/darius-rauludaitis-former-prosecutor-general-joins-law-firm-sorainen | **56** / 71 | **11.03 s** / 929 ms | 0.000 / **0.001** |
| https://www.sorainen.com/sorainen-named-european-law-firm-of-the-year-at-the-lawyer-european-awards | **55** / 85 | **11.01 s** / 1.57 s | 0.001 / **0.005** |
| https://www.sorainen.com/lithuanian-private-equity-and-venture-capital-association-awards-sorainen-lawyers-as-bees-of-the-year | **48** / 77 | **11.74 s** / 974 ms | **0.036** / 0.001 |
| https://www.sorainen.com/edvins-draba-joins-the-latvian-association-of-patent-attorneys | **55** / 75 | **11.01 s** / 2.10 s | 0.000 / **0.000** |

## Optimization Checklist

**1 of 4 passing** — 1 pass · 2 warn · 1 fail · 3 n/a

| Item | Status | Detail |
| --- | --- | --- |
| Page caching plugin / CDN active | **Pass** | Caching plugin detected (WP Rocket) |
| Images lazy-loaded | N/A | No raster <img> elements found (4 SVGs excluded). |
| Hero image eagerly loaded | **Warn** | Hero image has no explicit loading or fetchpriority (inferred from DOM order/size — Lighthouse LCP element unavailable). Browser default is eager but adding fetchpriority="high" helps LCP. |
| Hero is a real <img> (not a CSS background-image) | **Warn** | Hero element uses a CSS background-image (no image-set() variants), so the browser always loads the original asset regardless of viewport — there is no srcset equivalent. Move the hero to a real <img> with srcset/sizes (or <picture>) so smaller viewports can fetch a smaller file. |
| Responsive images (srcset / <picture>) | N/A | Only 0 raster images on the page (4 SVGs excluded) — responsive-image rule does not apply. |
| Reasonable number of image sizes | N/A | Too few raster images to evaluate srcset width variety. |
| JS scripts not blocking in <head> | **Fail** | 4 render-blocking scripts in <head>. Move to footer or add defer/async. |

## Fixes

### Priority 1: Critical
*Immediate action — impacts user experience, search rankings, or site safety.*

**1A. Reduce page weight and optimize media** `Performance`
- **Impact:** LCP, FCP, Total Page Weight
- **Problem:** Total page weight is 18.34 MB with 15.61 MB in media; LCP is 17.1s on mobile (vs 1.9s desktop).
- **Solution:**
  - Compress video assets (splash.webm failed to load, likely oversized).
  - Convert images to WebP/AVIF.
  - Implement lazy loading for below-fold images (19 currently missing).
  - Use `fetchpriority="low"` for non-critical media.

**1B. Add alt text to all images** `Accessibility`
- **Impact:** WCAG 1.1.1, SEO
- **Problem:** 12 images missing `alt` attribute (W3C errors + axe critical violations).
- **Solution:**
  - Audit all `<img>` tags.
  - Add descriptive `alt` text for content images.
  - Use `alt=""` for decorative images (e.g., lines, icons).

**1C. Harden Content Security Policy (CSP)** `Security`
- **Impact:** XSS Protection
- **Problem:** CSP allows `unsafe-inline` and `unsafe-eval` despite UGC signal (anchor href contains 'post').
- **Solution:**
  - Remove `'unsafe-inline'` and `'unsafe-eval'` from `script-src`.
  - Implement nonce-based CSP for third-party scripts (GTM, Recaptcha).
  - Ensure `connect-src` allows font checks (hello.myfonts.net currently blocked).

**1D. Reduce Page Weight & Optimize Video** `Performance`
- **Impact:** LCP, FCP, Total Page Weight
- **Problem:** Mobile LCP is 11.6 s and total page weight is 17.42 MB, with a 15.61 MB video asset failing to load.
- **Solution:**
  - Compress or lazy-load the splash video (currently 15.61 MB).
  - Defer non-critical JavaScript (18 render-blocking scripts found).
  - Implement responsive images to reduce payload on mobile.

**1E. Fix Critical Form & Button Labels** `Accessibility`
- **Impact:** WCAG 2.1.1, 4.1.2
- **Problem:** 3 critical axe violations: buttons lack discernible text, and form elements (search, newsletter) lack labels.
- **Solution:**
  - Add `aria-label` to all icon buttons (e.g., `.search-submit`).
  - Associate `<label>` elements with all form inputs (e.g., `#search-text-1`).
  - Ensure `<select>` elements have visible labels.

**1F. Harden CSP and HSTS** `Security`
- **Impact:** XSS Defense, Transport Security
- **Problem:** CSP allows `unsafe-inline` and `unsafe-eval` despite UGC signals; HSTS missing `includeSubDomains` and `preload`.
- **Solution:**
  - Remove `'unsafe-inline'` and `'unsafe-eval'` from `script-src` in CSP.
  - Update HSTS header: `Strict-Transport-Security: max-age=31536000; includeSubDomains; preload`.

**1G. Fix critical form and button accessibility violations** `Accessibility`
- **Impact:** WCAG 2.1 A/AA compliance, screen reader usability
- **Problem:** 3 critical axe violations: buttons lack discernible text, form elements (search, selects) lack labels, and select elements have no accessible names.
- **Solution:**
  - Add `aria-label` or visible text to all buttons (e.g., `.search-submit`).
  - Associate `<label>` elements with all form inputs using `for`/`id`.
  - Ensure `<select>` elements have visible labels or `aria-label`.

**1H. Eliminate render-blocking JavaScript** `Performance`
- **Impact:** FCP, TBT, LCP
- **Problem:** 18 render-blocking scripts in <head> (including jQuery, GTM, Facebook Pixel) delay FCP to 3.06 s and contribute to 992 ms TBT.
- **Solution:**
  - Add `defer` or `async` to non-critical scripts in `<head>`.
  - Move analytics and third-party tags (GTM, Facebook) to the footer or load via `requestIdleCallback`.
  - Inline critical CSS and defer non-critical CSS.

**1I. Eliminate render-blocking JavaScript to improve LCP** `Performance`
- **Impact:** LCP, FCP, Speed Index
- **Problem:** LCP is 4.1 s on mobile; 18 render-blocking scripts identified including jQuery and analytics trackers.
- **Solution:**
  Move non-critical scripts to footer or add `defer`/`async` attributes. Prioritize deferring `gtag.js`, `recaptcha`, and `facebook_pixel`.
  ```html
  <script src="..." defer></script>
  ```

**1J. Add a single H1 heading element** `SEO`
- **Impact:** Document outline, Search ranking
- **Problem:** HTML Inventory shows 0 H1 elements; page starts with H2. This breaks document hierarchy.
- **Solution:**
  Ensure the main page title is wrapped in `<h1>`. Avoid multiple H1s.
  ```html
  <h1>Ziņas</h1>
  ```

**1K. Fix critical form and button accessibility issues** `Accessibility`
- **Impact:** WCAG 2.1 A/AA compliance, Screen Reader usability
- **Problem:** 3 critical axe violations: buttons lack discernible text, form elements lack labels, and select elements lack accessible names.
- **Solution:**
  - Add `aria-label` or visible text to all buttons (e.g., `.search-submit`).
  - Associate `<label>` elements with all form inputs (`#search-text-1`, `#taxonomy-select-2`).
  - Ensure all interactive elements have focusable, named targets.

**1L. Reduce media weight and optimize LCP** `Performance`
- **Impact:** LCP (10.9 s), Page Weight (17.39 MB), TBT (1.01 s)
- **Problem:** Browser runtime shows 15.61 MB of media (video) and LCP is 10.9 s on mobile; 16 render-blocking scripts contribute to TBT.
- **Solution:**
  - Replace the 15.61 MB video with a lightweight poster image and lazy-load the video.
  - Add `defer` or `async` to the 16 render-blocking scripts in `<head>`.
  - Preload critical LCP image if it is an `<img>`.

**1M. Fix critical axe violations** `Accessibility`
- **Impact:** WCAG 2.1 Level A (button-name, image-alt)
- **Problem:** axe-core found 2 critical violations: buttons without discernible text (`.search-submit`) and images without alt attributes (`.newsIntro__line--2`).
- **Solution:**
  - Add `aria-label` or visible text to `.search-submit` button.
  - Add descriptive `alt` text to all content images; use `alt=""` for decorative SVGs.
  - Ensure color contrast ratio is ≥4.5:1 for `.menu-item` links.

**1N. Harden Content Security Policy** `Security`
- **Impact:** XSS protection (CSP currently allows unsafe-inline/eval)
- **Problem:** CSP allows `'unsafe-inline'` and `'unsafe-eval'`, negating XSS protection; site signals indicate user-generated content exists.
- **Solution:**
  - Remove `'unsafe-inline'` and `'unsafe-eval'` from `script-src`.
  - Implement nonce-based CSP: `script-src 'nonce-{random}' 'strict-dynamic'`.
  - Whitelist only necessary third-party domains (e.g., Google Fonts, Analytics).

**1O. Fix critical axe-core violations** `Accessibility`
- **Impact:** WCAG 2.1 AA Compliance
- **Problem:** 2 critical violations: buttons lack discernible text (`.search-submit`), images lack alt text (`.newsIntro__line--2`).
- **Solution:**
  - Add `aria-label` or visible text to all buttons.
  - Ensure all `<img>` tags have descriptive `alt` attributes.
  - Fix color contrast issues on menu links (serious violation).

**1P. Harden Content Security Policy and HSTS** `Security`
- **Impact:** XSS Protection, Transport Security
- **Problem:** CSP allows `unsafe-inline` and `unsafe-eval` (high risk for UGC site). HSTS missing `includeSubDomains` and `preload`.
- **Solution:**
  - Remove `unsafe-inline` and `unsafe-eval` from CSP; use nonces/hashes for scripts.
  - Update HSTS: `max-age=31536000; includeSubDomains; preload`.
  - Add `Referrer-Policy: strict-origin-when-cross-origin`.

**1Q. Reduce media weight and fix failed video request** `Performance`
- **Impact:** LCP, FCP, Total Page Weight
- **Problem:** Total page weight is 17.4 MB with 15.6 MB from media; LCP is 11.0 s on mobile. A video splash.webm request failed (ERR_ABORTED).
- **Solution:**
  - Compress and convert video to modern formats (WebM/MP4) with lower bitrate.
  - Implement lazy loading for non-critical media.
  - Ensure the hero image is optimized (WebP/AVIF) and uses `fetchpriority="high"`.
  - Fix the broken video source path or remove the element if not essential.

**1R. Reduce media weight and fix broken video** `Performance`
- **Impact:** LCP, FCP, Page Weight
- **Problem:** Browser runtime shows 15.61 MB of media (15.61 MB total page weight), with a failed video request (splash.webm) and LCP at 11.7 s.
- **Solution:**
  - Compress or lazy-load the hero video; consider using a poster image instead of autoplaying video.
  - Convert large images to WebP/AVIF.
  - Implement `fetchpriority="high"` on the LCP image.
  - Fix the broken `splash.webm` request or remove the reference.

**1S. Fix critical image-alt and button-name violations** `Accessibility`
- **Impact:** WCAG 2.1 A Compliance, Screen Reader Usability
- **Problem:** axe-core reports 2 critical violations: images missing `[alt]` attributes and buttons (`.search-submit`, `.col-tp-none`) lacking discernible text.
- **Solution:**
  - Add descriptive `alt` text to all content images; use `alt=""` for decorative SVGs.
  - Add `aria-label` or visible text to search and close buttons, e.g., `<button aria-label="Close">`.

**1T. Harden HSTS and CSP (UGC Signal)** `Security`
- **Impact:** Transport Security, XSS Defense
- **Problem:** HSTS missing `includeSubDomains`/`preload`; CSP allows `unsafe-inline` and `unsafe-eval`. UGC signal elevates XSS risk to Priority 1 per rubric.
- **Solution:**
  - Update HSTS: `Strict-Transport-Security: max-age=63072000; includeSubDomains; preload`.
  - Remove `unsafe-inline` and `unsafe-eval` from CSP `script-src`. Use nonces or hashes for inline scripts.
  - Add `Referrer-Policy: strict-origin-when-cross-origin`.

**1U. Reduce media weight and fix LCP** `Performance`
- **Impact:** LCP, FCP, Page Weight
- **Problem:** LCP is 11.0 s on mobile; total page weight is 17.39 MB with 15.61 MB in media (video splash.webm failed to load).
- **Solution:**
  - Replace the 15.6 MB video splash with a lightweight poster image or compressed WebM.
  - Implement lazy loading for off-screen media.
  - Ensure the LCP element (likely hero image) is preloaded and sized correctly.

**1V. Fix critical axe violations (buttons, images)** `Accessibility`
- **Impact:** WCAG 2.1 A Compliance
- **Problem:** 2 critical violations: `button-name` (search-submit, col-tp-none) and `image-alt` (newsIntro__line--2).
- **Solution:**
  - Add `aria-label` or visible text to `.search-submit` and `.col-tp-none` buttons.
  - Add descriptive `alt` text to `.newsIntro__line--2` image.
  - Ensure all decorative images use `alt=""`.

### Priority 2: Important
*Essential for compliance, user reach, and search visibility.*

**2A. Defer render-blocking scripts** `Performance`
- **Impact:** FCP, TBT
- **Problem:** 11 render-blocking scripts detected; 4 in `<head>` blocking rendering.
- **Solution:**
  - Add `defer` or `async` to non-critical scripts (jQuery, GTM, Analytics).
  - Move scripts to footer where possible.
  - Inline critical CSS and defer non-critical CSS.

**2B. Complete HSTS configuration** `Security`
- **Impact:** Transport Security
- **Problem:** HSTS present but missing `includeSubDomains` and `preload` directives.
- **Solution:**
  - Update header to: `Strict-Transport-Security: max-age=63072000; includeSubDomains; preload`.
  - Submit domain to hstspreload.org after testing.

**2C. Resolve HTML Validation Errors** `Best Practices`
- **Impact:** DOM Stability, SEO
- **Problem:** 10 W3C errors including duplicate IDs (e.g., `select-50-8002b801-adc4a003`) and invalid attributes (`stylr`, `pause`).
- **Solution:**
  - Ensure all `id` attributes are unique across the document.
  - Remove invalid attributes like `stylr` on `<a>` and `pause` on `<video>`.
  - Add missing spaces between attributes.

**2D. Optimize media assets and video loading** `Performance`
- **Impact:** Page weight, LCP, bandwidth
- **Problem:** Total page weight is 17.4 MB, with media consuming 15.6 MB. A video resource failed to load (`splash.webm`), and images lack dimensions.
- **Solution:**
  - Compress video or use adaptive streaming (HLS/DASH) instead of direct `.webm`.
  - Add `width` and `height` attributes to all images to prevent layout shifts.
  - Implement lazy loading for off-screen media.

**2E. Fix heading hierarchy and landmarks** `Accessibility`
- **Impact:** Screen reader navigation, SEO structure
- **Problem:** Document has 0 `<h1>` elements, missing `<main>` landmark, and no skip-to-content link.
- **Solution:**
  - Add a single `<h1>` at the top of the content (e.g., 'Uudised').
  - Wrap main content in `<main>` tag.
  - Add a skip-link anchor at the top of the `<body>`.

**2F. Strengthen HSTS and add missing headers** `Security`
- **Impact:** Transport security, clickjacking protection
- **Problem:** HSTS is missing `includeSubDomains` and `preload`. Referrer-Policy and Permissions-Policy are absent.
- **Solution:**
  - Update HSTS to: `max-age=63072000; includeSubDomains; preload`.
  - Add `Referrer-Policy: strict-origin-when-cross-origin`.
  - Add `Permissions-Policy` to disable unused features (e.g., geolocation, camera).

**2G. Strengthen HSTS and resolve CSP blocking errors** `Security`
- **Impact:** Transport security, Resource loading stability
- **Problem:** HSTS missing `includeSubDomains`; CSP blocks `hello.myfonts.net` causing console errors and potential font load failures.
- **Solution:**
  Update HSTS header:
  ```http
  Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
  ```
  Update CSP `connect-src` to allow `hello.myfonts.net` if required, or remove the script causing the violation.

**2H. Defer unused third-party JavaScript** `Performance`
- **Impact:** TBT, Page Weight
- **Problem:** 164 KB wasted on recaptcha, 71 KB on gtag; long tasks detected from these scripts.
- **Solution:**
  Load analytics and marketing scripts only after user interaction or via `defer`. Consider removing unused tracking pixels.

**2I. Fix CSP blocking and harden HSTS** `Security`
- **Impact:** Resource loading, Transport security
- **Problem:** CSP blocks `hello.myfonts.net` causing console errors; HSTS missing `includeSubDomains` and `preload`.
- **Solution:**
  - Update CSP `connect-src` to allow `https://hello.myfonts.net`.
  - Update HSTS header: `Strict-Transport-Security: max-age=63072000; includeSubDomains; preload`.
  - Remove `unsafe-inline` from CSP `script-src` if possible, or use nonces.

**2J. Fix HTML validation and meta tags** `SEO`
- **Impact:** Search indexing, crawlability
- **Problem:** W3C reports 5 errors (nesting, illegal href characters); HTML Inventory shows missing meta description.
- **Solution:**
  - Add `<meta name="description" content="...">` summarizing the article.
  - Fix `<a>` hrefs to remove spaces (encode as `%20`).
  - Close `<a>` tags properly to fix nesting errors.

**2K. Add meta description and fix HTML validation** `SEO`
- **Impact:** Search Snippets, Crawlability
- **Problem:** Meta description is missing. W3C validator reports 5 errors including bad href characters and nesting violations.
- **Solution:**
  - Add a unique `<meta name="description">` tag (150-160 chars).
  - Fix W3C errors: remove spaces in URL query strings, close `<a>` tags properly.
  - Ensure `lang` attribute is set correctly on `<html>`.

**2L. Defer render-blocking JavaScript** `Performance`
- **Impact:** FCP, TBT, Time to Interactive
- **Problem:** 16 render-blocking scripts detected in HTML inventory; 4 in <head> per checklist. TBT is 504 ms.
- **Solution:**
  - Add `defer` or `async` attributes to non-critical scripts (analytics, widgets).
  - Move script tags to the end of `<body>` where possible.
  - Inline critical CSS and defer non-critical stylesheets.

**2M. Harden Security Headers (HSTS & CSP)** `Security`
- **Impact:** Transport Security, XSS Defense
- **Problem:** HSTS missing `includeSubDomains` and `preload`. CSP allows `unsafe-inline` and `unsafe-eval`, negating XSS protection.
- **Solution:**
  - Update HSTS: `max-age=31536000; includeSubDomains; preload`.
  - Refine CSP: Remove `unsafe-inline` and `unsafe-eval` from `script-src`. Use nonces or hashes for allowed scripts.
  - Add `Referrer-Policy: strict-origin-when-cross-origin`.

**2N. Resolve W3C HTML Validation Errors** `Best Practices`
- **Impact:** Render Consistency, SEO
- **Problem:** 20 validation errors including unknown element `o_p` (x7) and missing `alt` attributes. Parser recovery failed at line 311.
- **Solution:**
  - Identify and remove the plugin/theme generating the invalid `<o_p>` element.
  - Fix nesting errors (e.g., `<a>` inside `<a>`).
  - Ensure all `<img>` tags have `alt` attributes.

**2O. Add meta description and fix W3C errors** `SEO`
- **Impact:** Search Snippets, HTML Validity
- **Problem:** Missing meta description; W3C reports 6 errors including illegal href characters and nesting violations.
- **Solution:**
  - Add `<meta name="description" content="...">` summarizing the article.
  - Fix W3C errors: ensure `<a>` tags are not nested, fix illegal characters in `href` (spaces), and ensure proper nesting of `<img>` inside `<a>`.

**2P. Harden HSTS and CSP headers** `Security`
- **Impact:** Transport Security, XSS Defense
- **Problem:** HSTS missing `includeSubDomains` and `preload`; CSP allows `unsafe-inline` and `unsafe-eval` (Grade 40/100).
- **Solution:**
  - Update HSTS: `Strict-Transport-Security: max-age=63072000; includeSubDomains; preload`
  - Tighten CSP: Remove `unsafe-inline` and `unsafe-eval`; use nonces/hashes for scripts.
  - Add `Referrer-Policy: strict-origin-when-cross-origin`.

### Priority 3: Best Practice
*Recommended for long-term maintainability.*

**3A. Fix HTML nesting and validation errors** `Best Practices`
- **Impact:** Maintainability, SEO
- **Problem:** W3C reports 15 errors including 'Start tag seen but element already open' and 'End tag violates nesting rules'.
- **Solution:**
  - Fix anchor nesting (e.g., `<a>` inside `<a>`).
  - Ensure proper heading hierarchy (no empty `<h2>`).
  - Validate HTML after script changes.

**3B. Add Meta Description** `SEO`
- **Impact:** Search Snippets, CTR
- **Problem:** SEO audit failed `metaDescription`; document lacks a summary for search engines.
- **Solution:**
  - Add a `<meta name="description" content="...">` tag with 150–160 characters summarizing the newsroom content.

**3C. Add meta description and fix HTML errors** `SEO`
- **Impact:** Search snippet quality, validation
- **Problem:** Meta description is missing. W3C validator reports 8 errors (duplicate IDs, bad attributes, no space between attributes).
- **Solution:**
  - Write a unique meta description (150–160 chars).
  - Fix duplicate ID `select-kapitaliturud`.
  - Correct malformed attributes (e.g., `stylr` → `style`, `pause` on video).

**3D. Harden Content Security Policy (CSP)** `Security`
- **Impact:** XSS defense-in-depth
- **Problem:** CSP allows `unsafe-inline` and `unsafe-eval`, reducing XSS protection. Site signals show no auth/payments, so this is lower priority.
- **Solution:**
  Replace `unsafe-inline` with nonces or hashes for scripts/styles. Remove `unsafe-eval` where possible.

**3E. Fix HTML validation errors (Duplicate IDs)** `Best Practices`
- **Impact:** Maintainability, DOM stability
- **Problem:** W3C reports 11 errors including duplicate IDs (e.g., `select-50-8002b801-ae3c5c07`) and attribute syntax issues.
- **Solution:**
  Ensure all `id` attributes are unique within the document. Fix attribute spacing syntax (e.g., `value="" placeholder=""`).

**3F. Fix HTML structure and validation errors** `SEO`
- **Impact:** Document outline, Search indexing
- **Problem:** 12 W3C errors including missing H1, duplicate IDs, and invalid attributes (`stylr`, `pause` on video).
- **Solution:**
  - Add exactly one `<h1>` element describing the page topic.
  - Ensure unique IDs for all elements (fix `select-finansai-ir-draudimas` duplicates).
  - Remove invalid attributes and fix `</p>` tag nesting.