How we check a website

Why. Kazakhstan’s Personal Data Law (Art. 12(2)) requires databases with Kazakh citizens’ personal data to be stored in Kazakhstan. Leads, orders and accounts on a server in Germany or Russia breach it.

How to fix. Move the site, or at least the database with leads and orders, to a Kazakh host (PS.kz, Hoster.kz, QazCloud and others), or keep a copy of the database in Kazakhstan. If the site is behind Cloudflare, confirm the server country with your host.

countries: KZ · kz.data-localization

Sources: Our guide on this · Kazakhstan personal data law

Why. Without HTTPS browsers flag the site as not secure and everything visitors type travels unencrypted.

How to fix. Issue a certificate (Let’s Encrypt is free) and enable HTTPS on the server.

all countries · security.https

Sources: Our guide on this · MDN: Strict-Transport-Security

Why. Old links and typed addresses open the http version. It should send people to the secure one right away.

How to fix. Set up a permanent (301) redirect from every http address to https.

all countries · security.http-redirect

Sources: Our guide on this · MDN: Strict-Transport-Security

Why. With an expired or mismatched certificate browsers show a full-page warning and almost everyone leaves.

How to fix. Set up automatic renewal and make sure the certificate covers this domain.

all countries · security.certificate

Sources: Our guide on this

Why. The header tells browsers to always use HTTPS, even when someone types http://.

How to fix. Add the header in the server settings.

all countries · security.hsts

Sources: Our guide on this · MDN: Strict-Transport-Security

Why. Three headers block common attacks: MIME sniffing, framing the site inside another page, and leaking page URLs.

How to fix. Add the missing headers in the server settings.

all countries · security.headers

Sources: Our guide on this · MDN: Content-Security-Policy · OWASP: secure headers

Why. Images and scripts over http on an https page get blocked or make the browser flag the site.

How to fix. Replace http:// with https:// in every image, script and style link.

all countries · security.mixed-content

Sources: Our guide on this · MDN: mixed content

Why. A version number in headers tells attackers which known vulnerabilities to try.

How to fix. Turn off version output: server_tokens off in nginx, expose_php = Off in PHP.

all countries · security.server-version

Sources: Our guide on this · OWASP: secure headers

Why. Chrome, Firefox and Safari use Google Safe Browsing to show a red “Dangerous site” screen, and Search flags the link. Visitors leave before the page loads. Sites usually land there after a hack, and the owner learns last.

How to fix. Open Google Search Console → Security & Manual Actions → Security issues to see infected pages. Remove the malicious code, rotate passwords and keys, update the CMS and plugins, then press Request review.

all countries · security.safe-browsing

Sources: Our guide on this · Google: Safe Browsing site status · Google: hacked sites

Why. Mail providers, antivirus tools and office filters check Spamhaus and SURBL blocklists. A listed domain means the site’s emails do not arrive and links to it get blocked in mail and messengers.

How to fix. Open the list’s lookup page (check.spamhaus.org, surbl.org/surbl-analysis), read the reason and request removal. Fix the cause first: a hacked form, unsolicited mailing, infected pages.

all countries · security.blocklists

Sources: Spamhaus: check a domain or IP

Why. Hacked sites are rarely broken; attackers quietly add links to casinos, betting, pills and loans. The owner does not see them (they are hidden), Google does and demotes the site for hacked content.

How to fix. Find these links in the theme, widgets and the CMS database and remove them. Change admin and FTP passwords, update the CMS and plugins, scan server files. If you placed them on purpose, mark them rel="sponsored".

all countries · security.spam-links

Sources: Google: hacked sites

Why. CSP tells the browser where scripts may load from. If foreign code reaches the site (a hacked library, an injected comment), without CSP it runs for every visitor.

How to fix. Start in report-only mode, collect the sources you need, then enforce the policy. Avoid unsafe-inline and unsafe-eval.

all countries · security.csp

Sources: Our guide on this · MDN: Content-Security-Policy · OWASP: secure headers

Why. The header denies the page and embedded third-party widgets the camera, microphone, geolocation and payments when you do not need them.

How to fix. Add the header and deny everything the site does not use.

all countries · security.permissions-policy

Sources: Our guide on this · OWASP: secure headers

Why. If the CDN hosting a library is compromised, the forged file runs for your visitors. The integrity attribute makes the browser reject a file that does not match the reference.

How to fix. Add integrity and crossorigin to CDN scripts and styles, or host the libraries yourself.

all countries · security.sri

Sources: Our guide on this · MDN: Subresource Integrity

Why. An open .git hands out the full source with history, .env and config copies hold database passwords and keys, and a dump holds customer data. Scanner bots find such files within hours.

How to fix. Remove the file from the public path, block dotfiles in the server config and rotate every password and key it held: treat them as leaked.

all countries · security.exposed-secrets

Sources: Our guide on this · OWASP: secure headers

Why. phpinfo, server status, the WordPress user list, open xmlrpc and phpMyAdmin give attackers versions, logins and entry points for password guessing.

How to fix. Disable them or protect with a password and an IP allowlist. On WordPress hide /wp-json/wp/v2/users from guests.

all countries · security.exposed-info

Sources: Our guide on this · OWASP: secure headers

Why. A researcher who finds a hole needs to know whom to tell. Without a contact they stay silent or publish openly.

How to fix. Create /.well-known/security.txt with a contact and an expiry date (RFC 9116).

all countries · security.security-txt

Sources: RFC 9116: security.txt

Why. CAA names the certificate authorities allowed to issue for your domain. Without it any authority could issue a rogue certificate.

How to fix. Add a CAA record for your certificate authority to DNS.

all countries · domain.caa

Sources: Let’s Encrypt: CAA records

Why. MTA-STS stops mail servers from delivering to your domain unencrypted, so customer emails cannot be intercepted in transit.

How to fix. Add a _mta-sts TXT record and publish the policy at mta-sts.your-domain/.well-known/mta-sts.txt.

all countries · domain.mta-sts

Sources: Our guide on this

Why. Russia’s Personal Data Law (152-FZ, Art. 18(5)) requires recording, storing and updating Russian citizens’ personal data in databases located in Russia. Leads and orders in a database abroad are a breach.

How to fix. Keep the database with leads, orders and accounts on a Russian host. If the site sits behind a CDN, ask your host where the database physically lives.

countries: RU · ru.data-localization

Sources: Russian Personal Data Law 152-FZ

Why. Without SPF anyone can send email as your domain: scammers send fake invoices to your customers, and your real emails land in spam more often.

How to fix. Add an SPF TXT record listing the servers that send your email. If the domain sends no email, forbid sending entirely.

all countries · domain.spf

Sources: Our guide on this · Google: set up SPF

Why. DMARC tells mail providers what to do with forged emails in your name. Since 2024 Gmail and Yahoo reject bulk mail without it.

How to fix. If there is no _dmarc record, add one: start with p=none and reports to your inbox. If p=none is already set and the reports show your own mail passes, switch to p=quarantine, later to p=reject.

all countries · domain.dmarc

Sources: Our guide on this · Google: set up DMARC

Why. If the domain is not renewed in time, the site and email stop working the same day, and someone can buy the freed name.

How to fix. Turn on auto-renewal at your registrar and make sure the card on file is valid.

all countries · domain.expiry

Why. A cookie without Secure also travels over unencrypted connections and one without SameSite is easier to abuse from another site. A session cookie without HttpOnly can be read by a malicious script.

How to fix. Add the Secure, HttpOnly (for sessions) and SameSite=Lax flags to the cookie.

all countries · security.cookie-flags

Sources: Our guide on this · MDN: Set-Cookie

Why. A noindex tag on the homepage removes the site from search.

How to fix. Remove noindex from the meta robots tag and the X-Robots-Tag header.

all countries · seo.home-indexable

Sources: Google: robots.txt

Why. Search engines show the page title as the result link. Long ones get cut, identical ones confuse.

How to fix. Give every page its own title under 60 characters, key word first.

all countries · seo.title

Sources: Google: title links

Why. The meta description often becomes the text under the search result and decides whether people click.

How to fix. Write a unique 70–160 character description for every page.

all countries · seo.description

Sources: Google: snippets

Why. The H1 tells search engines and screen readers what the page is about.

How to fix. Keep exactly one H1 per page and make other headings H2 or lower.

all countries · seo.h1

Sources: Google: helpful content · WCAG 1.3.1: info and relationships

Why. Canonical tells search engines which of several similar URLs is the main one so duplicates do not split rankings.

How to fix. Add a <link rel="canonical"> with the full page URL.

all countries · seo.canonical

Sources: Google: canonical URLs

Why. robots.txt tells search engines what to crawl and where the sitemap is.

How to fix. Put a robots.txt in the site root with a Sitemap line.

all countries · seo.robots-txt

Sources: Google: robots.txt

Why. A sitemap helps search engines find every page, especially new ones.

How to fix. Generate sitemap.xml (most CMSs have a setting) and reference it in robots.txt.

all countries · seo.sitemap

Sources: Google: sitemaps

Why. If the server answers “OK” (200) for a made-up address, search engines index empty pages.

How to fix. Return 404 for addresses that do not exist.

all countries · seo.not-found

Sources: Google: redirects

Why. Links to nowhere annoy people and waste the search engine’s crawl time.

How to fix. Fix or remove the links listed.

all countries · seo.broken-links

Sources: Google: crawlable links

Why. schema.org markup explains what a page is: article, product, organisation. Rich results are built from it.

How to fix. Add JSON-LD with at least Organization and WebSite on the homepage.

all countries · seo.structured-data

Sources: Our guide on this · Google: structured data

Why. og:title and og:image set the title and image when the link is shared in messengers and social networks.

How to fix. Add og:title, og:description and a 1200×630 og:image.

all countries · seo.social-preview

Sources: Google: structured data

Why. Google ranks by the mobile version. Without adaptation text is tiny and pages scroll sideways.

How to fix. Add a meta viewport and remove elements wider than the screen.

all countries · seo.mobile

Sources: Our guide on this · Google: mobile-first indexing · MDN: viewport meta tag

Why. The lang attribute helps search engines target the right audience and screen readers pronounce text correctly.

How to fix. Add the language to the html tag.

all countries · seo.language

Sources: MDN: lang attribute

Why. hreflang tells search engines which page version to show people in each language.

How to fix. Check the language codes and add an x-default version.

all countries · seo.hreflang

Sources: Google: localized versions

Why. Every extra hop adds delay and loses some link value.

How to fix. Collapse redirects into one hop straight to the final address.

all countries · seo.redirect-chain

Sources: Google: redirects

Why. Rating stars, price and availability, FAQs, breadcrumbs and the logo in results come from schema.org markup. If a required field is missing, Google silently shows a plain blue link, which gets fewer clicks.

How to fix. Add the fields named in the report and test the page in Google’s Rich Results Test (search.google.com/test/rich-results). Shops need Product with offers (price, currency, availability); every site benefits from Organization with logo and BreadcrumbList.

all countries · seo.rich-results

Sources: Our guide on this · Google: Rich Results Test · Google: search gallery

Why. Google picks URLs to crawl from the sitemap. Broken pages and redirects in it waste crawl time and make Google trust the file less, so new pages get indexed later.

How to fix. Keep only URLs that return 200 and match their canonical. Remove deleted pages and old redirected URLs, add lastmod with the edit date. In WordPress or Bitrix the SEO plugin usually rebuilds it.

all countries · seo.sitemap-health

Sources: Google: sitemaps

Why. Google weighs experience and trust (E-E-A-T) partly by whether you can see who wrote a page and when it was updated. AI assistants are more likely to cite pages with an author and a recent date.

How to fix. Sign articles with the author’s name linked to an author page and show the published and updated dates. Add author, datePublished and dateModified to the Article markup.

all countries · seo.author-dates

Sources: Our guide on this · Google: who, how and why (E-E-A-T)

Why. Search engines and AI assistants need text to understand what you do. A homepage of images and a few phrases loses to competitors and never makes it into ChatGPT answers.

How to fix. Add 2–3 paragraphs to the homepage: who you are, what you offer, for whom and where, and what makes you different. Use the words customers search with.

all countries · seo.thin-content

Sources: Google: helpful content

Why. The icon shows in the browser tab and next to the site in Google results. Without it the site looks abandoned and is harder to remember.

How to fix. Add an icon and link it in the <head>.

all countries · seo.favicon

Sources: Google: favicon in search

Why. Without <!DOCTYPE html> the browser switches to legacy quirks mode, and without a declared encoding non-Latin text can turn into garbage.

How to fix. Start the document with <!DOCTYPE html> and put <meta charset="utf-8"> at the very top of <head>.

all countries · seo.html-basics

Sources: MDN: doctype

Why. ChatGPT, Perplexity and Google AI Overviews quote the short paragraph right under a question heading such as “How much does… cost”. Pages without such headings get cited less, even with good text.

How to fix. Turn some h2 and h3 headings into the questions customers ask and answer each one in the first one or two sentences below it. Add an FAQ block at the end.

all countries · ai.answer-headings

Sources: Our guide on this · Google: AI features and your website

Why. For prices, laws and deadlines, AI search and Google prefer pages with a recent update date. A page with no date or a two-year-old one loses to a competitor’s fresh page.

How to fix. Show the update date and change it only when the text really changes. Set dateModified in the markup.

all countries · ai.freshness

Sources: Our guide on this · Google: AI features and your website

Why. ChatGPT, Claude and Perplexity answer with links to sources. If their search bots are blocked in robots.txt, the site will not be cited.

How to fix. Remove the Disallow rules for these bots in robots.txt.

all countries · ai.search-bots

Sources: Our guide on this · OpenAI: crawlers · Google: crawlers

Why. These bots collect text to train models. Blocking them is fine and does not affect search visibility.

How to fix. Decide for yourself whether to allow them in robots.txt.

all countries · ai.training-bots

Sources: Our guide on this · OpenAI: crawlers · Google: crawlers

Why. Most AI bots do not run JavaScript. If text only appears after scripts run, the page looks empty to them.

How to fix. Serve the main text in the initial HTML: server-side rendering or static generation.

all countries · ai.content-without-js

Sources: Our guide on this · Google: helpful content

Why. Organization markup (name, logo, social profiles) helps search engines and AI link the site to the company.

How to fix. Add Organization JSON-LD to the homepage with official profiles in sameAs.

all countries · ai.entity

Sources: Our guide on this · Google: structured data

Why. An optional short guide to the site for AI assistants. Google ignores it, the benefit is small.

How to fix. If you like, add llms.txt to the root with a site summary and key links.

all countries · ai.llms-txt

Sources: Our guide on this · The llms.txt format

Why. The policy explains what data the site collects, why, and how to delete it. Without one, collecting data breaks the law almost everywhere.

How to fix. Publish the policy on its own page and link to it from the footer of every page.

countries: EU, KZ, RU, BY, US · docs.privacy-policy

Sources: Our guide on this · GDPR text (EU 2016/679) · Kazakhstan personal data law

Why. People look for the policy in the footer. If only the homepage links to it, visitors on other pages cannot find it.

How to fix. Add the link to the shared site footer.

all countries · docs.policy-everywhere

Sources: Our guide on this

Why. A good policy says what data is collected, why, for how long, who receives it, how to delete it and whom to contact.

How to fix. Add the missing sections. Be specific and use plain words.

countries: EU, KZ, RU, BY · docs.policy-content

Sources: Our guide on this · GDPR text (EU 2016/679)

Why. The banner mentions cookies briefly; the details (which, why, how long) belong in a document.

How to fix. Add a cookies section to the policy or a separate page listing them.

countries: EU, KZ, RU, BY · docs.cookies-described

Sources: Our guide on this

Why. Email is how people withdraw consent, ask to delete data and send complaints.

How to fix. Put an email address on the contact page and in the policy.

all countries · docs.contact-email

Sources: Our guide on this

Why. If the site sells, buyers must see the terms up front: payment, delivery, returns.

How to fix. Publish the terms of sale and link them from the footer and the cart.

countries: EU, KZ, RU, BY · docs.terms

Sources: Our guide on this

Why. Buyers must know who they contract with: company name, registration number, address.

How to fix. Put the company name, registration number and address in the footer.

countries: EU, KZ, RU, BY · docs.seller-details

Sources: Our guide on this

Why. Selling goods without a price in tenge, or above the stated price, breaches Kazakhstan’s trade regulation law. A price in dollars or “units” is fine only as an extra.

How to fix. Show the main price in tenge on product pages and in the cart; put other currencies in brackets if needed.

countries: KZ · kz.price-tenge

Sources: Our guide on this

Why. Seller contacts and details for customers in Kazakhstan must be in Kazakh and Russian. A Russian-only site invites complaints and fines.

How to fix. Add a /kk version at least for contacts, sale terms, payment, delivery and returns, and link the languages with hreflang.

countries: KZ · kz.kazakh-version

Sources: Our guide on this

Why. Phrases like “best”, “No. 1” or “guaranteed results” without proof count as misleading advertising (Article 455 of the Administrative Code).

How to fix. Replace vague words with specifics: numbers, dates, named rankings with a source and year.

countries: KZ · kz.ad-claims

Sources: Our guide on this

Why. Buyers check the number in the registry. A mistyped number cannot be found and looks fake.

How to fix. Compare the BIN/IIN digits with the registration certificate and fix the typo.

countries: KZ · kz.bin-valid

Sources: Our guide on this

Why. Visitors and reputation services distrust domains under six months old: that is how scam shops look. A fresh domain is no violation, but a shop must offset it with other trust signs.

How to fix. Show company details and an address, add reviews, return terms and contacts, and renew the domain for several years.

all countries · trust.domain-age

Sources: Our guide on this

Why. An online buyer may withdraw from a purchase and must see up front when, on what terms and at whose cost. Missing terms are the top sign of a scam shop and a common cause of complaints.

How to fix. Publish a Returns and delivery page: the return window, item condition, who pays shipping, refund timing, delivery methods and prices. Link it in the footer and the cart.

countries: EU, KZ, RU, BY · docs.returns

Sources: Our guide on this

Why. Buyers and search engines read contacts as the mark of a real business. A bare contact form with no phone or email looks like hiding.

How to fix. Make a Contacts page with email, phone and address and link it from the header or footer.

all countries · docs.contacts

Sources: Our guide on this

Why. The About page explains who stands behind the site. Search engines and AI assistants use it to judge whether the source is trustworthy.

How to fix. Say who you are, what you do, where you are and how to reach you.

all countries · docs.about

Sources: Google: helpful content

Why. Google and AI assistants decide whether to trust a site by matching it with independent profiles: social networks, map listings, Wikipedia, business directories. A site that is nowhere else mentioned under its own name looks anonymous.

How to fix. Create a map listing (Google, 2GIS, Yandex) and social pages and link them in the footer. Add a sameAs field with these URLs to the Organization markup.

all countries · trust.profiles

Sources: Our guide on this · Google: Organization markup (sameAs)

Why. Buyers and search engines check whether people other than the shop write about it. A link to a reviews listing on maps or a review platform removes the main doubt: are there real customers.

How to fix. Link to your reviews listing (Google Maps, 2GIS, Yandex, Trustpilot) and ask customers to leave reviews there. If reviews live on the site itself, mark them up with Review and AggregateRating.

all countries · trust.reviews

Sources: Google: review snippets

Why. Texts that cite laws, studies and official data read as verifiable to Google, and AI assistants quote them more often. An article with no outbound link looks like opinion, not a source.

How to fix. In key articles link to the law, study or official statistics where you state a fact or number. Link to the document itself, not to someone’s retelling.

all countries · trust.citations

Sources: Our guide on this · Google: who, how and why (E-E-A-T)

Why. Analytics and ad pixels set cookies that recognise a person on later visits. Data protection laws require asking first.

How to fix. Load Google Analytics, Yandex Metrica, pixels and ads only after the visitor clicks “Accept”. Google Tag Manager supports this through Consent Mode.

countries: EU, KZ, RU, BY · cookies.trackers-before-consent

Sources: Our guide on this · GDPR text (EU 2016/679)

Why. People have to learn about cookies and make a choice before the cookies start working.

How to fix. Show a banner on the first visit: what you collect, why, and “Accept” and “Reject” buttons.

countries: EU, KZ, RU, BY · cookies.banner

Sources: Our guide on this · GDPR text (EU 2016/679)

Why. A banner with only “Accept” offers no choice. EU regulators require a reject option on the first layer.

How to fix. Put a “Reject” button next to “Accept”, the same size and just as visible.

countries: EU, KZ, RU, BY · cookies.reject-button

Sources: Our guide on this · GDPR text (EU 2016/679)

Why. Sometimes the banner exists but trackers still load after a refusal. For regulators that is the same as no banner.

How to fix. After a refusal, do not load analytics or ads, including on later pages. Check the browser Network tab after clicking “Reject”.

countries: EU, KZ, RU, BY · cookies.reject-works

Sources: Our guide on this · GDPR text (EU 2016/679)

Why. Every external service receives the visitor’s IP address. Data laws ask which countries the data goes to and whether people are told.

How to fix. List these services in your privacy policy: what they are, why you use them and which country they are in.

countries: EU, KZ, RU, BY · cookies.third-parties

Sources: Our guide on this · GDPR text (EU 2016/679)

Why. Fonts from fonts.googleapis.com load from Google servers and send them the visitor’s IP. A Munich court ruled this a GDPR violation without consent in 2022.

How to fix. Download the fonts and serve them from your own server.

countries: EU · cookies.google-fonts

Sources: Our guide on this · GDPR text (EU 2016/679)

Why. The US does not require prior consent, but California residents may opt out of the sale and sharing of their data for ads. With ad pixels on the site, an opt-out link is mandatory.

How to fix. Add a “Do Not Sell or Share My Personal Information” (or “Your Privacy Choices”) footer link to an opt-out page and honor the Global Privacy Control browser signal.

countries: US · us.privacy-choices

Sources: Our guide on this · CPPA: CCPA rules and regulator (California)

Why. Since 1 March 2023 (152-FZ, Art. 12) sending personal data abroad, including foreign counters and widgets, requires notifying Roskomnadzor before the transfer starts. Roskomnadzor counts Google Analytics as such a transfer.

How to fix. List the foreign services that receive visitor data, file the notification with Roskomnadzor and name these services and countries in the policy. Or switch to Russian alternatives.

countries: RU · ru.cross-border

Sources: Russian Personal Data Law 152-FZ

Why. People should see what happens to their data right where they type it in.

How to fix. Under every form that asks for a name, phone or email, add a line linking to the privacy policy.

countries: EU, KZ, RU, BY · forms.policy-link

Sources: Our guide on this · GDPR text (EU 2016/679)

Why. In Russia and Kazakhstan personal data is collected with the person’s consent, and you need to be able to prove it.

How to fix. Add an unticked consent checkbox with a link to the policy and block sending without it. Store the date, time and consent text version on the server.

countries: KZ, RU, BY · forms.consent

Sources: Our guide on this · GDPR text (EU 2016/679) · Kazakhstan personal data law

Why. A box ticked on the person’s behalf is not consent: they never gave it.

How to fix. Remove the checked attribute from consent boxes, let people tick them.

countries: EU, KZ, RU, BY · forms.prechecked-consent

Sources: Our guide on this · GDPR text (EU 2016/679)

Why. Over plain http the data travels unencrypted and can be intercepted, for example on public Wi-Fi.

How to fix. Submit forms only to https:// addresses.

all countries · forms.https

Sources: MDN: mixed content

Why. A GET form puts the email and phone into the URL, which ends up in browser history, server logs and analytics.

How to fix. Use method="post" for forms with personal data.

all countries · forms.data-in-url

Sources: GDPR text (EU 2016/679)

Why. A keyboard or screen-reader user would otherwise walk through the whole menu on every page. A main landmark and a skip link get them straight to the content.

How to fix. Wrap the primary content in <main> and make “Skip to content” the first link, anchored to it.

all countries · a11y.landmarks

Sources: WCAG 2.4.1: bypass blocks

Why. A tabindex above zero makes the focus jump around in an order different from what is visible and keyboard users get lost.

How to fix. Remove positive tabindex values and set the order by the placement of elements in the markup.

all countries · a11y.tabindex

Sources: WCAG 2.4.3: focus order

Why. Field labels and screen-reader relations find an element by id. With duplicates the label points at the wrong field and scripts act on the first match.

How to fix. Make ids unique within the page.

all countries · a11y.duplicate-ids

Sources: WCAG 4.1.2: name, role, value (unique ids)

Why. Unexpected sound drowns out a screen reader and startles visitors. Browsers also block autoplay with sound.

How to fix. Remove autoplay or start video muted with a pause button.

all countries · a11y.autoplay

Sources: WCAG 1.4.2: audio control

Why. Without header cells (th) a screen reader reads numbers without saying what they belong to.

How to fix. Make the header row <th> cells and add scope for row headers.

all countries · a11y.table-headers

Sources: WCAG 1.3.1: info and relationships

Why. The autocomplete attribute fills in name, email and phone with one tap. It helps people with motor or memory impairments and more checkouts finish.

How to fix. Add autocomplete="name", "email", "tel" and similar values to form fields.

all countries · a11y.autocomplete

Sources: WCAG 1.3.5: identify input purpose

Why. Alt text is read to blind people and search engines. Without it the image is a blank to them.

How to fix. Add alt text describing the image. Use alt="" for purely decorative ones.

all countries · a11y.image-alt

Sources: WCAG 1.1.1: non-text content

Why. Placeholder text disappears while typing, and screen readers cannot say what a field is without a label.

How to fix. Tie every field to a <label for> or add aria-label.

all countries · a11y.form-labels

Sources: WCAG 3.3.2: labels or instructions

Why. People with low vision need to enlarge text. If the viewport tag blocks zooming they cannot read the page on a phone.

How to fix. Remove user-scalable=no and maximum-scale=1 from the viewport tag.

all countries · a11y.viewport-zoom

Sources: WCAG 1.4.4: resize text · MDN: viewport meta tag

Why. A link with no text, or just "here" or "read more", tells neither screen readers nor search engines where it leads.

How to fix. Say where the link goes ("Delivery terms") and add aria-label to icon-only links.

all countries · a11y.link-text

Sources: WCAG 2.4.4: link purpose

Why. Headings form the outline of the page. Skipping a level (H4 right after H2) confuses people who navigate by headings, and search engines.

How to fix. Go without gaps: H1, then H2, then H3 inside it, and so on.

all countries · a11y.heading-order

Sources: WCAG 1.3.1: info and relationships

Why. An icon-only button without a label is just "button" to a blind user, who cannot tell what it does.

How to fix. Give the button visible text or an aria-label.

all countries · a11y.button-name

Sources: WCAG 4.1.2: name, role, value

Why. A map, video or widget in a frame with no title is not identified by a screen reader.

How to fix. Add a title attribute to the frame that says what is inside.

all countries · a11y.iframe-title

Sources: WCAG 4.1.2: name, role, value

Why. Mobile speed is a Google ranking factor. A slow site loses rankings and visitors, especially on mobile data.

How to fix. Compress images (AVIF/WebP), defer third-party scripts, cut JavaScript from the first screen, enable caching and a CDN.

all countries · perf.google-speed

Sources: Our guide on this · web.dev: Core Web Vitals

Why. A heavy page loads slowly on mobile data and some people leave before it appears.

How to fix. Compress images (WebP or AVIF), drop unused scripts, lazy-load heavy parts.

all countries · perf.weight

Sources: Our guide on this · web.dev: Core Web Vitals

Why. While the server thinks, people stare at a blank screen. It is the first factor in page speed.

How to fix. Enable page caching and a CDN, look for slow database queries.

all countries · perf.server-response

Sources: Our guide on this · web.dev: TTFB

Why. LCP is the time until the largest first-screen element appears. It is one of the three Core Web Vitals Google uses for ranking. Google’s target is 2.5 seconds.

How to fix. Compress the first-screen image (AVIF/WebP) and load it eagerly (fetchpriority="high"), remove render-blocking scripts and styles, enable caching and a CDN.

all countries · perf.lcp

Sources: Our guide on this · web.dev: LCP

Why. CLS measures how much the layout shifts while loading: people aim for a button and hit an ad. A Core Web Vital; Google’s target is 0.1.

How to fix. Set width and height on images and video, reserve space for banners and ads, and do not insert content above text that is already shown.

all countries · perf.cls

Sources: Our guide on this · web.dev: CLS

Why. INP is the delay between a tap and the page reacting. Anything over 0.2 seconds feels frozen. A Core Web Vital.

How to fix. Split heavy scripts, defer third-party widgets and trackers, and remove unused JavaScript.

all countries · perf.inp

Sources: Our guide on this · web.dev: INP

Why. Without sizes the browser does not know how much room to leave and text jumps when the image loads. Google counts that against the page (CLS).

How to fix. Set width and height on every image (or aspect-ratio in CSS).

all countries · perf.image-size

Sources: Our guide on this · web.dev: optimize CLS

Why. Compression (gzip or brotli) shrinks a page 3 to 5 times, so it loads faster, especially on mobile networks.

How to fix. Turn on gzip or brotli on the server or CDN for HTML, CSS and JavaScript.

all countries · perf.compression

Sources: Chrome: enable text compression