# Audit Report: Advokaadibüroo Sorainen

**Website:** https://www.sorainen.com/et/  
**Date:** 12.08.2026  
**Audit Coverage:** 100% — all sources returned data  
**Confidence:** high

**Pages Audited (10 of 10):**

- https://www.sorainen.com/et
- https://www.sorainen.com/newsroom
- https://www.sorainen.com/et/uudised
- https://www.sorainen.com/lv/zinas
- https://www.sorainen.com/lt/naujienos
- https://www.sorainen.com/law-firm-ratings-in-mergermarket-place-sorainen-as-a-leader-in-the-baltics-and-belarus
- https://www.sorainen.com/darius-rauludaitis-former-prosecutor-general-joins-law-firm-sorainen
- https://www.sorainen.com/sorainen-named-european-law-firm-of-the-year-at-the-lawyer-european-awards
- https://www.sorainen.com/lithuanian-private-equity-and-venture-capital-association-awards-sorainen-lawyers-as-bees-of-the-year
- https://www.sorainen.com/edvins-draba-joins-the-latvian-association-of-patent-attorneys

## Summary of results

**Overall Score:** 54 / 100  
**Status:** 🟠 **Poor**

Site overall 54 is the mean of 10 pages. Scores range 38 (https://www.sorainen.com/darius-rauludaitis-former-prosecutor-general-joins-law-firm-sorainen) → 68 (https://www.sorainen.com/et/uudised). Weakest page: Mobile performance is critically low (42/100) with an LCP of 9.3 s and 15.6 MB of media weight, dragging the score into the 'Poor' band. Accessibility is broken with 7 violations including 2 critical issues (missing alt text, button names) that block WCAG compliance. Security headers are weak (40/100) with a CSP allowing unsafe-inline, which is high risk given the inferred user-generated content signal. Desktop performance (97) contrasts sharply with mobile (42), indicating mobile-specific bottlenecks like render-blocking scripts and unoptimized media.

### Per-page scores

🟠 **Poor** · https://www.sorainen.com/et

| Score | Performance | Accessibility | Best Practices | SEO | Security |
| --- | --- | --- | --- | --- | --- |
| 58 | 57 | 77 | 92 | 92 | 40 |

🟠 **Poor** · https://www.sorainen.com/newsroom

| Score | Performance | Accessibility | Best Practices | SEO | Security |
| --- | --- | --- | --- | --- | --- |
| 48 | 52 | 85 | 92 | 85 | 40 |

🟡 **Needs Improvement** · https://www.sorainen.com/et/uudised

| Score | Performance | Accessibility | Best Practices | SEO | Security |
| --- | --- | --- | --- | --- | --- |
| 68 | 59 | 85 | 92 | 92 | 40 |

🟠 **Poor** · https://www.sorainen.com/lv/zinas

| Score | Performance | Accessibility | Best Practices | SEO | Security |
| --- | --- | --- | --- | --- | --- |
| 58 | 60 | 85 | 92 | 92 | 40 |

🟠 **Poor** · https://www.sorainen.com/lt/naujienos

| Score | Performance | Accessibility | Best Practices | SEO | Security |
| --- | --- | --- | --- | --- | --- |
| 58 | 65 | 85 | 92 | 92 | 40 |

🟠 **Poor** · https://www.sorainen.com/law-firm-ratings-in-mergermarket-place-sorainen-as-a-leader-in-the-baltics-and-belarus

| Score | Performance | Accessibility | Best Practices | SEO | Security |
| --- | --- | --- | --- | --- | --- |
| 56 | 67 | 81 | 92 | 77 | 40 |

🟠 **Poor** · https://www.sorainen.com/darius-rauludaitis-former-prosecutor-general-joins-law-firm-sorainen

| Score | Performance | Accessibility | Best Practices | SEO | Security |
| --- | --- | --- | --- | --- | --- |
| 38 | 42 | 81 | 69 | 77 | 40 |

🟠 **Poor** · https://www.sorainen.com/sorainen-named-european-law-firm-of-the-year-at-the-lawyer-european-awards

| Score | Performance | Accessibility | Best Practices | SEO | Security |
| --- | --- | --- | --- | --- | --- |
| 52 | 61 | 78 | 88 | 77 | 40 |

🟠 **Poor** · https://www.sorainen.com/lithuanian-private-equity-and-venture-capital-association-awards-sorainen-lawyers-as-bees-of-the-year

| Score | Performance | Accessibility | Best Practices | SEO | Security |
| --- | --- | --- | --- | --- | --- |
| 48 | 46 | 81 | 88 | 77 | 40 |

🟠 **Poor** · https://www.sorainen.com/edvins-draba-joins-the-latvian-association-of-patent-attorneys

| Score | Performance | Accessibility | Best Practices | SEO | Security |
| --- | --- | --- | --- | --- | --- |
| 55 | 53 | 81 | 92 | 77 | 40 |

## PageSpeed Insights — Mobile vs Desktop

_Lower is worse for Performance; higher is worse for LCP and CLS. Worse value is **bolded**._

| URL | Performance (M / D) | LCP (M / D) | CLS (M / D) |
| --- | --- | --- | --- |
| https://www.sorainen.com/et | **57** / 78 | **10.47 s** / 1.96 s | 0.000 / **0.007** |
| https://www.sorainen.com/newsroom | **52** / 82 | **11.56 s** / 1.03 s | 0.000 / **0.000** |
| https://www.sorainen.com/et/uudised | **59** / 68 | **4.88 s** / 1.17 s | 0.000 / **0.000** |
| https://www.sorainen.com/lv/zinas | **60** / 91 | **3.94 s** / 1.07 s | 0.000 / **0.001** |
| https://www.sorainen.com/lt/naujienos | **65** / 75 | **3.97 s** / 1.03 s | 0.000 / **0.004** |
| https://www.sorainen.com/law-firm-ratings-in-mergermarket-place-sorainen-as-a-leader-in-the-baltics-and-belarus | **67** / 98 | **12.06 s** / 872 ms | **0.004** / 0.003 |
| https://www.sorainen.com/darius-rauludaitis-former-prosecutor-general-joins-law-firm-sorainen | **42** / 97 | **9.31 s** / 921 ms | 0.000 / **0.001** |
| https://www.sorainen.com/sorainen-named-european-law-firm-of-the-year-at-the-lawyer-european-awards | 61 / **60** | **12.15 s** / 1.78 s | 0.001 / **0.003** |
| https://www.sorainen.com/lithuanian-private-equity-and-venture-capital-association-awards-sorainen-lawyers-as-bees-of-the-year | **46** / 89 | **10.03 s** / 1.19 s | **0.036** / 0.002 |
| https://www.sorainen.com/edvins-draba-joins-the-latvian-association-of-patent-attorneys | **53** / 58 | **10.93 s** / 2.17 s | 0.000 / **0.000** |

## Optimization Checklist

**1 of 4 passing** — 1 pass · 2 warn · 1 fail · 3 n/a

| Item | Status | Detail |
| --- | --- | --- |
| Page caching plugin / CDN active | **Pass** | Caching plugin detected (WP Rocket) |
| Images lazy-loaded | N/A | No raster <img> elements found (4 SVGs excluded). |
| Hero image eagerly loaded | **Warn** | Hero image has no explicit loading or fetchpriority (inferred from DOM order/size — Lighthouse LCP element unavailable). Browser default is eager but adding fetchpriority="high" helps LCP. |
| Hero is a real <img> (not a CSS background-image) | **Warn** | Hero element uses a CSS background-image (no image-set() variants), so the browser always loads the original asset regardless of viewport — there is no srcset equivalent. Move the hero to a real <img> with srcset/sizes (or <picture>) so smaller viewports can fetch a smaller file. |
| Responsive images (srcset / <picture>) | N/A | Only 0 raster images on the page (4 SVGs excluded) — responsive-image rule does not apply. |
| Reasonable number of image sizes | N/A | Too few raster images to evaluate srcset width variety. |
| JS scripts not blocking in <head> | **Fail** | 4 render-blocking scripts in <head>. Move to footer or add defer/async. |

## Fixes

### Priority 1: Critical
*Immediate action — impacts user experience, search rankings, or site safety.*

**1A. Reduce media weight and optimize LCP** `Performance`
- **Impact:** LCP, FCP, Page Weight
- **Problem:** LCP is 10.5 s on mobile; total page weight is 18.45 MB with 15.61 MB in media (likely video).
- **Solution:**
  - Replace the 15.6 MB video asset with a lightweight poster image or compressed WebM.
  - Implement lazy loading for all non-critical media.
  - Use `fetchpriority="high"` only on the actual LCP element.

**1B. Add alt text to all images and label buttons** `Accessibility`
- **Impact:** WCAG 1.1.1, 4.1.2
- **Problem:** 12 images lack `alt` attributes; 4 buttons (search, close) lack discernible text (axe critical violations).
- **Solution:**
  - Add descriptive `alt` text to content images; use `alt=""` for decorative SVGs.
  - Add `aria-label` or visible text to `.search-submit`, `.close`, and `.submit` buttons.

**1C. Harden Content Security Policy (CSP)** `Security`
- **Impact:** XSS Defense
- **Problem:** CSP allows `unsafe-inline` and `unsafe-eval` scripts; UGC signal is yes, increasing XSS risk.
- **Solution:**
  - Remove `'unsafe-inline'` and `'unsafe-eval'` from `script-src`.
  - Implement nonce-based CSP for third-party scripts (GTM, Recaptcha).
  - Ensure `connect-src` allows font counting endpoints (hello.myfonts.net).

**1D. Reduce Page Weight and Fix LCP** `Performance`
- **Impact:** LCP, FCP, Speed Index, Mobile Score
- **Problem:** LCP is 11.6 s on mobile; total page weight is 17.42 MB (15.61 MB media). Video splash asset failed to load (ERR_ABORTED).
- **Solution:**
  - Compress or lazy-load the hero video; ensure fallback image loads first.
  - Implement responsive images (`srcset`) for raster assets.
  - Preload critical LCP image if it is an `<img>`.
  - Audit third-party scripts (recaptcha, gtag) for necessity.

**1E. Fix Critical Button and Label Violations** `Accessibility`
- **Impact:** WCAG 2.1 Level A Compliance
- **Problem:** 3 critical axe violations: 5 buttons lack discernible text, search/select forms lack labels.
- **Solution:**
  - Add `aria-label` or visible text to all buttons (e.g., `.search-submit`).
  - Associate `<label>` elements with all form inputs (`for`/`id` matching).
  - Ensure all interactive elements have accessible names.

**1F. Add a Single H1 Element** `SEO`
- **Impact:** Document Outline, Search Ranking
- **Problem:** HTML Inventory shows 0 h1 elements; page starts with h2. W3C warns no h1.
- **Solution:**
  - Ensure exactly one `<h1>` exists per page, typically matching the `<title>` or main heading.
  - Example: `<h1>Newsroom</h1>` at the top of the main content area.

**1G. Reduce LCP and render-blocking resources** `Performance`
- **Impact:** LCP, FCP, TBT
- **Problem:** LCP is 4.9 s (threshold 2.5 s) with 15.6 MB media weight and 18 render-blocking scripts in the head.
- **Solution:**
  - Optimize the 15.6 MB video asset (compress, use modern codecs, lazy load if not above fold).
  - Add `defer` or `async` to non-critical scripts (e.g., GTM, Facebook Pixel).
  - Inline critical CSS and move non-critical stylesheets to the footer.

**1H. Fix critical form and button accessibility issues** `Accessibility`
- **Impact:** WCAG 2.1 A/AA compliance
- **Problem:** 3 critical violations: buttons lack discernible text, search form lacks labels, select elements lack names.
- **Solution:**
  - Add `aria-label` or visible text to all icon buttons (e.g., search submit).
  - Associate `<label>` elements with all form inputs using `for` and `id`.
  - Ensure all `<select>` elements have an associated label or `aria-label`.

**1I. Defer non-critical JavaScript to reduce TBT** `Performance`
- **Impact:** TBT, FCP, LCP
- **Problem:** TBT is 728 ms (>600 ms heavy penalty) and LCP is 3.9 s due to 18 render-blocking scripts and unused JS (recaptcha, gtag).
- **Solution:**
  Add `defer` or `async` to non-critical scripts in `<head>`. Specifically target:
  - `gtag.js`
  - `gtm.js`
  - `recaptcha__en.js`
  - `facebook_signal.js`

  Example:
  ```html
  <script src="/js/main.js" defer></script>
  ```

**1J. Defer non-critical third-party scripts** `Performance`
- **Impact:** LCP, FCP, TBT (590 ms)
- **Problem:** 18 render-blocking scripts and heavy JS (recaptcha, gtag, facebook-pixel) cause LCP 4.0 s and FCP 3.07 s on mobile.
- **Solution:**
  - Move non-critical scripts to footer or add `defer`/`async` attributes.
  - Load recaptcha only on interaction (e.g., form focus).
  - Use `preconnect` for third-party domains (googleapis, gstatic).
  - Example: `<script src="..." defer></script>`

**1K. Fix Largest Contentful Paint (LCP) of 12.1 s** `Performance`
- **Impact:** Core Web Vitals, Mobile Performance Score
- **Problem:** LCP is 12.1 s on mobile (threshold is 2.5 s), caused by heavy media (15.6 MB video) and render-blocking resources.
- **Solution:**
  - Preload the LCP image/video resource.
  - Convert video to adaptive streaming (HLS/DASH) or lazy-load below the fold.
  - Defer non-critical JavaScript to reduce main thread blocking.

**1L. Resolve Critical Accessibility Violations** `Accessibility`
- **Impact:** WCAG Compliance, Screen Reader Usability
- **Problem:** axe-core found 2 critical violations: buttons without discernible text (`.search-submit`) and images missing alt attributes (`.newsIntro__line--2`).
- **Solution:**
  - Add `aria-label` or visible text to all buttons.
  - Ensure every `<img>` has a descriptive `alt` attribute.
  - Fix color contrast issues on menu links (`#menu-item-5479 > a`).

**1M. Harden Content Security Policy (CSP) and HSTS** `Security`
- **Impact:** XSS Protection, Transport Security
- **Problem:** CSP allows `unsafe-inline` and `unsafe-eval` (high risk for UGC sites); HSTS missing `includeSubDomains` and `preload`. Site signals indicate User-Generated Content.
- **Solution:**
  - Remove `unsafe-inline` and `unsafe-eval` from CSP; use nonces/hashes for scripts.
  - Update HSTS: `Strict-Transport-Security: max-age=63072000; includeSubDomains; preload`.
  - Add `Referrer-Policy: strict-origin-when-cross-origin`.

**1N. Reduce media weight and fix LCP** `Performance`
- **Impact:** LCP, Page Weight, Mobile Performance
- **Problem:** Mobile LCP is 9.3 s and total page weight is 17.4 MB (15.6 MB media), causing severe load delays on mobile networks.
- **Solution:**
  - Compress or lazy-load the 15.6 MB media assets (likely video splash).
  - Use `fetchpriority="high"` on the LCP image.
  - Serve WebP/AVIF formats and implement responsive `srcset`.

**1O. Fix critical axe-core violations** `Accessibility`
- **Impact:** WCAG 2.1 Compliance, Screen Reader Usability
- **Problem:** 2 critical violations found: missing `alt` attributes on images and buttons without discernible text (`.search-submit`, `.col-tp-none`).
- **Solution:**
  - Add descriptive `alt` text to all content images.
  - Add `aria-label` or visible text to icon buttons.
  - Ensure form inputs have associated `<label>` elements.

**1P. Fix critical axe violations** `Accessibility`
- **Impact:** WCAG 2.1 A/AA Compliance
- **Problem:** 2 critical violations: `button-name` (search-submit, col-tp-none) and `image-alt` (2 images missing alt).
- **Solution:**
  - Add `aria-label` or visible text to `.search-submit` and `.col-tp-none` buttons.
  - Add descriptive `alt` text to all content images; use `alt=""` for decorative SVGs.
  - Ensure form inputs have associated `<label>` elements.

**1Q. Harden CSP and HSTS headers** `Security`
- **Impact:** XSS Defense, Transport Security
- **Problem:** CSP allows `unsafe-inline` and `unsafe-eval` (high risk with UGC signal); HSTS missing `includeSubDomains` and `preload`.
- **Solution:**
  - Remove `'unsafe-inline'` and `'unsafe-eval'` from CSP; use nonces/hashes for scripts.
  - Update HSTS: `Strict-Transport-Security: max-age=63072000; includeSubDomains; preload`.
  - Add `X-Content-Type-Options: nosniff` (present) and `Referrer-Policy: strict-origin-when-cross-origin`.

**1R. Reduce Largest Contentful Paint (LCP) from 10.0 s** `Performance`
- **Impact:** LCP, FCP, Mobile Performance Score
- **Problem:** LCP is 10.0 s on mobile (target ≤2.5 s) due to 15.6 MB media weight and render-blocking scripts.
- **Solution:**
  - Compress or lazy-load the 15.6 MB video asset; use a poster image for the hero.
  - Add `fetchpriority="high"` to the LCP image.
  - Defer non-critical JavaScript to reduce main thread blocking.

**1S. Harden Content Security Policy (CSP) for User-Generated Content** `Security`
- **Impact:** XSS Protection, Security Headers Grade
- **Problem:** CSP allows `unsafe-inline` and `unsafe-eval`, negating XSS protection. Site signals indicate user-generated content exists.
- **Solution:**
  - Remove `'unsafe-inline'` and `'unsafe-eval'` from `script-src`.
  - Implement nonce-based CSP for inline scripts.
  - Ensure `connect-src` allows only necessary third-party domains (currently blocking `hello.myfonts.net`).

**1T. Fix Critical Axe Violations (Buttons & Images)** `Accessibility`
- **Impact:** WCAG 2.1 A Compliance, Screen Reader Support
- **Problem:** 2 critical violations: buttons lack accessible names (`.search-submit`) and images lack `alt` attributes.
- **Solution:**
  - Add `aria-label` or visible text to `.search-submit` button.
  - Add descriptive `alt` text to all content images; use `alt=""` for decorative SVGs.
  - Ensure form inputs have associated `<label>` elements.

**1U. Reduce media asset weight (15.6 MB)** `Performance`
- **Impact:** LCP, FCP, Page Weight
- **Problem:** Browser Runtime shows 15.61 MB of media (likely a background video) causing LCP to hit 10.9 s on mobile.
- **Solution:**
  Replace the heavy video with a compressed WebM/MP4 (<5 MB) or a static poster image. If video is essential, use `preload="none"` and lazy-load it after interaction.

**1V. Fix critical axe violations (buttons, images)** `Accessibility`
- **Impact:** WCAG 2.1 A Compliance
- **Problem:** axe-core reports 2 critical violations: buttons lack discernible text (`.search-submit`) and images lack alt text (`.newsIntro__line--2`).
- **Solution:**
  - Add `aria-label` or visible text to `.search-submit`.
  - Add descriptive `alt` text to all content images. Decorative images should use `alt=""`.

### Priority 2: Important
*Essential for compliance, user reach, and search visibility.*

**2A. Defer render-blocking scripts** `Performance`
- **Impact:** FCP, TBT
- **Problem:** 11 render-blocking scripts in `<head>` contribute to FCP 3.07 s and TBT 318 ms.
- **Solution:**
  - Add `defer` or `async` to non-critical scripts (analytics, GTM, cookie consent).
  - Move jQuery and theme JS to the footer or load after LCP.

**2B. Strengthen HSTS and add missing headers** `Security`
- **Impact:** Transport Security, Clickjacking
- **Problem:** HSTS missing `includeSubDomains` and `preload`; Referrer-Policy and COOP missing.
- **Solution:**
  - Update HSTS: `max-age=31536000; includeSubDomains; preload`.
  - Add `Referrer-Policy: strict-origin-when-cross-origin`.
  - Add `Permissions-Policy` to disable unused features.

**2C. Defer Render-Blocking JavaScript** `Performance`
- **Impact:** TBT, FCP, Main Thread Blocking
- **Problem:** 18 render-blocking scripts found; 4 in `<head>` flagged by checklist. TBT is 570 ms.
- **Solution:**
  - Add `defer` or `async` to non-critical scripts.
  - Move analytics and tracking scripts to the footer.
  - Inline critical CSS and defer non-critical CSS.

**2D. Harden CSP and complete security headers** `Security`
- **Impact:** XSS protection, transport security
- **Problem:** CSP allows `unsafe-inline` and `unsafe-eval`; HSTS missing `includeSubDomains` and `preload`.
- **Solution:**
  - Remove `'unsafe-inline'` and `'unsafe-eval'` from CSP; use nonces for scripts.
  - Update HSTS to: `max-age=31536000; includeSubDomains; preload`.
  - Add `Referrer-Policy: strict-origin-when-cross-origin`.

**2E. Add H1 and fix HTML validation errors** `SEO`
- **Impact:** Document outline, search ranking
- **Problem:** Page has 0 `<h1>` elements and 8 W3C errors (duplicate IDs, bad attributes).
- **Solution:**
  - Add a single `<h1>` describing the page content (e.g., 'Uudised').
  - Fix duplicate ID `select-kapitaliturud`.
  - Correct invalid attributes (e.g., `stylr` -> `style`, `pause` on video).

**2F. Strengthen HSTS and fix CSP console errors** `Security`
- **Impact:** Transport security, XSS defense
- **Problem:** HSTS missing `includeSubDomains` and `preload`; CSP blocks `hello.myfonts.net` causing console errors.
- **Solution:**
  - Update HSTS header: `Strict-Transport-Security: max-age=31536000; includeSubDomains; preload`
  - Add `https://hello.myfonts.net` to `connect-src` in CSP if required, or remove the font counting script.

**2G. Add H1 tag and main landmark** `SEO`
- **Impact:** SEO ranking, Screen Reader navigation
- **Problem:** W3C reports 0 h1 elements; HTML Inventory shows missing `<main>` landmark.
- **Solution:**
  - Ensure exactly one `<h1>` exists per page (e.g., `<h1>Ziņas</h1>`).
  - Wrap primary content in `<main role="main">`.
  - Add a skip-link at the top: `<a href="#main" class="skip-link">Iet uz saturu</a>`.

**2H. Strengthen HSTS and baseline headers** `Security`
- **Impact:** Transport security, clickjacking protection
- **Problem:** HSTS is missing `includeSubDomains` and `preload` directives; X-Frame-Options and X-Content-Type-Options are present but HSTS is weak.
- **Solution:**
  - Update HSTS header: `Strict-Transport-Security: max-age=63072000; includeSubDomains; preload`
  - Ensure `X-Frame-Options: SAMEORIGIN` remains active.
  - Remove `Server` header disclosure (Apache/ZoneOS).

**2I. Eliminate Render-Blocking JavaScript** `Performance`
- **Impact:** FCP, TBT, Time to Interactive
- **Problem:** 16 render-blocking scripts detected in `<head>`, including jQuery and analytics trackers, delaying first paint.
- **Solution:**
  - Add `defer` or `async` to all non-critical scripts.
  - Move scripts to the end of `<body>` where possible.
  - Inline critical CSS and defer non-critical stylesheets.

**2J. Complete HSTS configuration** `Security`
- **Impact:** Transport Security, Man-in-the-Middle Protection
- **Problem:** HSTS header is present but missing `includeSubDomains` and `preload` directives, reducing protection scope.
- **Solution:**
  - Update header to: `Strict-Transport-Security: max-age=31536000; includeSubDomains; preload`.
  - Submit domain to hstspreload.org after testing.

**2K. Fix HTML validation errors and meta data** `SEO`
- **Impact:** Search Indexing, Rendering Reliability
- **Problem:** W3C reports 20 errors including unknown `o_p` elements and nesting issues; missing meta description.
- **Solution:**
  - Remove or fix the `o_p` custom element (likely plugin artifact).
  - Add `<meta name="description" content="...">`.
  - Ensure `<main>` landmark exists and heading hierarchy is logical.

**2L. Add Meta Description and Fix W3C Errors** `SEO`
- **Impact:** Search Snippets, HTML Validity
- **Problem:** Missing meta description; 6 W3C errors including nesting violations and illegal characters in URLs.
- **Solution:**
  - Add `<meta name="description" content="...">` summarizing the article.
  - Fix `<a>` href spaces (encode as `%20`).
  - Close unclosed `<a>` tags to resolve nesting errors.

### Priority 3: Best Practice
*Recommended for long-term maintainability.*

**3A. Fix HTML validation errors** `SEO`
- **Impact:** Crawlability, Rendering
- **Problem:** W3C reports 16 errors including parser recovery failure at line 407 and empty `href` attributes.
- **Solution:**
  - Fix nested `<a>` tags causing parser recovery failure.
  - Remove empty `href` attributes on `<link>` elements.
  - Ensure all `<section>` elements have headings.

**3B. Resolve failed resource requests** `Performance`
- **Impact:** Page load stability
- **Problem:** Console shows failed requests for `splash.webm`, recaptcha, and analytics.
- **Solution:**
  - Verify `splash.webm` path and availability.
  - Ensure recaptcha keys are valid and not blocked by CSP.
  - Check analytics endpoints for CORS or network issues.

**3C. Harden Content Security Policy (CSP)** `Security`
- **Impact:** XSS mitigation
- **Problem:** CSP allows `unsafe-inline` and `unsafe-eval`, which bypasses XSS protection.
- **Solution:**
  Since this is a brochure site (no auth/payments), prioritize P1/P2 first. When ready, migrate to nonce-based CSP:
  ```http
  Content-Security-Policy: script-src 'nonce-{random}' 'strict-dynamic';
  ```
  Remove `unsafe-inline` from `script-src`.

**3D. Add Meta Description and Fix HTML Validation** `SEO`
- **Impact:** Search Snippets, Code Quality
- **Problem:** Meta description is missing; W3C validator reports 5 errors including illegal characters in href and nesting violations.
- **Solution:**
  - Add a unique `<meta name="description">` tag (150–160 chars).
  - Fix W3C errors: remove spaces in query strings, ensure proper `<a>` nesting, and add missing `alt` attributes.

**3E. Add meta description and fix HTML errors** `SEO`
- **Impact:** Search Snippets, Validation
- **Problem:** Meta description is missing; W3C validator reports 5 errors including illegal characters in href and nesting violations.
- **Solution:**
  - Write a unique meta description (150–160 chars) for the press release.
  - Fix W3C errors: remove spaces in query strings, close tags properly, and ensure `alt` attributes are present.