Guides

How real-user Core Web Vitals from the Chrome UX Report work, why they differ from lab scores, why some sites have no data, and how to improve them.

What Cumulative Layout Shift measures, the 0.1 target, the usual causes of layout shifts, and how to reserve space for images, ads, embeds and fonts.

What First Contentful Paint measures, the 1.8 second target, and how to show content sooner by fixing server speed, render-blocking CSS and fonts.

How HTTP/2 and HTTP/3 speed up pages with many files, how we detect them, and how to enable them on Nginx, Apache and CDNs.

What Interaction to Next Paint measures, the 200 ms target, why it only comes from real-user data, and how to make clicks and taps respond faster.

What Largest Contentful Paint measures, the 2.5 second target, the four parts of LCP time, and practical fixes for slow hero images and text.

What the Lighthouse performance score measures, how it is calculated from five lab metrics, why it varies between runs, and how to raise it.

What total page weight measures, why heavy pages hurt mobile visitors, our 1.6 MB and 4 MB thresholds, and where the bytes usually hide.

What server response time and Time to First Byte measure, the 800 ms target, and how caching, CDNs and backend tuning bring it down.

What the Speed Index metric measures, the 3.4 second target, how it differs from FCP and LCP, and how to make the first screen fill in faster.

Why compressing HTML, CSS and JavaScript cuts load time, how to check what your server sends, and how to turn on Brotli or gzip on common servers and CDNs.

What Total Blocking Time measures, the 200 ms target, how long tasks block input, and how to cut JavaScript and third-party script cost.

How DNS CAA records limit which certificate authorities may issue certificates for your domain, with record examples for common CAs and CDNs.

How clickjacking works and how to stop other sites from framing your pages with CSP frame-ancestors or X-Frame-Options.

How a strict, nonce-based Content Security Policy limits cross-site scripting, what weakens a policy, and how to roll one out safely.

What the Secure, HttpOnly and SameSite cookie attributes protect against, which values to use, and how to set them in common stacks.

Why plain-text and mailto email addresses attract spam, what our check counts (masked in the report), and better ways to let people contact you.

How SPF and DMARC stop others from sending email as your domain, how to write both DNS records, and how to move safely from p=none to p=reject.

What it means when Google flags your URL for malware, phishing or unwanted software, how to clean the site and how to request a review.

Why Server, X-Powered-By and generator tags that reveal version numbers help attackers, and how to remove them on common servers and CMSs.

What HSTS does, which max-age to use, when to add includeSubDomains and preload, and how to enable it on common servers and CDNs.

How outdated JavaScript libraries expose your visitors, how we detect them from script URLs, and how to upgrade and keep dependencies current.

What mixed content is, why browsers block insecure scripts and frames on HTTPS pages, and how to find and fix every http:// resource.

Why every http:// request should redirect to https:// with a 301, and how to set it up on Nginx, Apache and Cloudflare.

What X-Content-Type-Options, Referrer-Policy and Permissions-Policy do, which values to send, and how to add them on common servers.

How to publish a valid RFC 9116 security.txt file with Contact and Expires fields so people can report vulnerabilities to the right place.

Why every site needs HTTPS, how to get a free TLS certificate, and how to move an existing site from HTTP to HTTPS without breaking it.

Why browsers reject a TLS certificate, how to serve the full chain, cover every hostname and automate renewal so it never expires.

Why TLS 1.0 and 1.1 are deprecated, how to enable TLS 1.3, and the server and CDN settings that set a safe minimum version.

What the Lighthouse accessibility score covers, our thresholds, and the most common fixes: contrast, labels, alt text, button names and heading order.

How the canonical link tells search engines which URL is the main version of a page, and how to set it correctly in HTML or headers.

Why every page should set a lang attribute on the html element, what value to use, and how it helps screen readers, browsers and translation.

Why a missing doctype puts browsers in quirks mode, why UTF-8 should be declared explicitly, and how to set both correctly in HTML and HTTP headers.

Why Google needs a declared favicon to show your icon in results, the size and URL rules it follows, and the markup to add to your pages.

Why a page should have one clear H1, how to structure H2 to H6 below it, and how to fix missing or duplicate main headings.

Why a page must return a 2xx status to be indexed, what common 3xx, 4xx and 5xx codes mean for search engines, and how to fix the wrong status.

How to write useful alt text for images, when to use an empty alt for decorative images, and why missing alt attributes hurt users and search.

Flash, Java applets and other plugins no longer run in browsers. How we detect legacy plugin tags and what to replace them with.

What the meta description does in search results, the 50 to 160 character range we check, and how to write descriptions that earn the click.

How the noindex directive in meta robots or X-Robots-Tag removes a page from search results, and how to find and remove it when it is a mistake.

How og:title, og:description and og:image control link previews on social networks and chat apps, with a copy-paste example.

Why short, lower-case URLs with hyphens are easier for people and search engines, what we count on your page, and how to clean up URL patterns safely.

Why a missing page must answer with status 404 or 410, how we test it with one random URL, and how to fix soft 404s in common servers and CMSs.

Why chains of redirects slow pages down and waste crawl budget, how we count redirect hops, and how to send every old URL to its final address in one hop.

How robots.txt controls crawling, why it does not keep pages out of search, how to point crawlers to your sitemap, and how to opt out of PerfoMetrixBot.

What JSON-LD structured data is, how it can make pages eligible for rich results, and how to add a valid schema.org block.

What the viewport meta tag does, the one value most sites need, and settings to avoid because they block zooming and hurt accessibility.

How the HTML title tag shapes search results and browser tabs, the 10 to 60 character range we check, and how to write titles that are clear and unique.

Why your site should answer on one host only, www or the bare domain, and how to redirect the other with a permanent redirect.

What an XML sitemap does, what to put in it, how to reference it from robots.txt, and how to fix a sitemap that search engines cannot read.

Which AI and search crawlers read your site, which ones decide whether you appear in AI answers, and how to allow search while opting out of training.

How AI search reads your pages: server-rendered content, schema, author and date, quotable structure and llms.txt, with what we check for each.