Technology and structure (68 rules)
This check area shows how reachable a website is and how it is built. Checks include redirects, HTTP connections, caching and browser output. The report may also show broken links and unusual files. Results are sorted by severity and linked to the affected address. Operators can pass the technical issue to the right host or developer.
| ID | Finding when … | Target state | Severity | Fix |
|---|---|---|---|---|
PERF-01 | No compression | Text resources delivered compressed | Medium | approx. 45 min |
PERF-02 | No cache for static files | Static resources with a long cache lifetime | Minor | approx. 45 min |
PERF-03 | Large images | Large raster images (JPEG/PNG above 100 KB) | Note | approx. 45 min |
HTTP-01 | Page not reachable | Content page directly reachable | Severe | approx. 15 min |
HTTP-02 | HTTPS missing | Valid HTTPS | Severe | approx. 15 min |
HTTP-03 | Several address variants | Variants permanently redirected to the preferred target | Medium | approx. 15 min |
HTTP-04 | No real 404 | Random path returns 404/410 | Medium | approx. 15 min |
SSR-01 | Content only via JavaScript | Title/H1/main text without JavaScript | Medium | after review |
SSR-02 | Template leftovers visible | No visible template leftovers | Medium | after review |
UX-01 | Zoom blocked | Viewport without zoom block | Medium | approx. 15 min |
UX-02 | Horizontal scrolling at 320 px | Reflow at 320px | Medium | approx. 120 min |
UX-03 | History manipulation (back button) | No history entries on load (back-button hijacking, spam policy since 15 June 2026; pushState = medium) | Note | approx. 45 min |
HTML-01 | HTML errors | Nu without errors | Medium | approx. 120 min |
TECH-04 | Server reveals versions | Server/X-Powered-By without version | Minor | approx. 15 min |
TECH-05 | Directory listing open | No directory listing reachable | Severe | approx. 15 min |
TECH-06 | Admin or diagnostics page public | Admin/diagnostic paths not public | Severe | approx. 15 min |
TECH-07 | No HTTP/2 or HTTP/3 | HTTP/2 or HTTP/3 for the home page | Minor | approx. 45 min |
TECH-08 | Only gzip instead of Brotli | HTML compressed with Brotli or zstd | Minor | approx. 15 min |
TECH-09 | Redirect chain | No redirect chains beyond one hop, no meta refresh | Medium | approx. 45 min |
TECH-10 | http does not redirect directly to https | http:// redirects in one hop to the https target | Medium | approx. 15 min |
TECH-11 | Path variant delivers a second version | Path variants (case, slash) do not deliver a second 200 version | Medium | approx. 15 min |
TECH-12 | Internal links to redirects | Internal links do not point to redirects | Minor | approx. 45 min |
TECH-13 | Broken links or resources | Internal links and resources without 4xx/5xx | Severe | approx. 45 min |
TECH-14 | Soft 404 | No soft 404 (error text with status 200) | Medium | approx. 120 min |
TECH-15 | 404 page without help | Custom 404 page with navigation | Minor | approx. 45 min |
TECH-16 | Mixed content or insecure forms | No mixed content, no http forms, no protocol-relative resources | Severe | approx. 120 min |
TECH-17 | Page too large or too many elements | HTML below 1 MB and below 1,500 DOM nodes | Medium | approx. 120 min |
TECH-18 | Blocking or unused CSS/JS | No render-blocking, unused or duplicate CSS/JS | Minor | approx. 120 min |
TECH-19 | Images not optimized | Images in modern formats and suitable size | Medium | approx. 120 min |
TECH-20 | Web fonts block text | Fonts with font-display, no blocking web fonts | Minor | approx. 45 min |
TECH-21 | Third parties slow the page | Third-party scripts do not block the main thread | Medium | approx. 120 min |
TECH-22 | JavaScript errors or deprecated APIs | No JavaScript console errors or deprecated APIs | Medium | approx. 45 min |
TECH-23 | HTML caching misconfigured | HTML not cached as immutable, validators (ETag/Last-Modified) present | Minor | approx. 45 min |
TECH-24 | Doctype, charset or language missing | Doctype, charset and valid lang attribute | Medium | approx. 15 min |
TECH-25 | Outdated plugins or frames | No plugins (Flash/Java/Silverlight), no framesets | Medium | after review |
TECH-26 | Unclean address | URL hygiene: no upper case, spaces, underscores, double slashes, over 115 characters | Minor | approx. 45 min |
TECH-27 | Search or tracking parameters linked | No search/tracking parameters in internal links | Minor | approx. 45 min |
TECH-30 | Hard to use on mobile | Mobile: tap targets and viewport per Lighthouse | Medium | approx. 45 min |
TECH-31 | Icons or theme color missing | Favicon, Apple touch icon, theme-color | Minor | approx. 45 min |
TECH-33 | Server responds slowly | Server response time (TTFB) below 800 ms | Medium | after review |
TECH-34 | No HTTP/3 | HTTP/3 offered via Alt-Svc | Minor | approx. 15 min |
TECH-36 | Raw HTML and rendered page differ | Word and link counts in the raw HTML match the rendered DOM | Medium | after review |
TECH-37 | Canonical changed by JavaScript | Canonical in the DOM equals the raw HTML | Medium | approx. 45 min |
TECH-38 | head closed prematurely | head not closed prematurely by invalid elements | Severe | approx. 45 min |
TECH-39 | TRACE/TRACK active | TRACE/TRACK disabled | Medium | approx. 15 min |
TECH-43 | Error messages with internals | No stack traces, SQL or PHP errors in responses | Severe | approx. 45 min |
TECH-45 | HTML comments with internals | No HTML comments with credentials, internal hosts or developer notes | Medium | approx. 45 min |
TECH-46 | CMS version recognizable | Framework/CMS fingerprint without version | Minor | approx. 45 min |
TECH-47 | WordPress exposes internals | WordPress: readme, xmlrpc, user list, debug.log, uploads listing not public | Severe | approx. 120 min |
TECH-50 | Login insecure or indexable | Login forms only over HTTPS, login pages not indexable | Severe | approx. 120 min |
TECH-51 | Session cookie unprotected | Session cookies with HttpOnly and Secure, lifetime below 24 h | Medium | approx. 45 min |
TECH-52 | Sensitive data in browser storage | No tokens or personal data in browser storage | Medium | approx. 45 min |
TECH-56 | Host header is adopted | Foreign Host header does not land in links or canonical | Medium | approx. 45 min |
TECH-58 | Account or checkout pages cacheable | Account, cart and checkout pages with Cache-Control: no-store | Medium | approx. 15 min |
TECH-59 | Staging or internal addresses published | No staging/internal hosts in robots.txt and sitemap | Medium | approx. 15 min |
TECH-60 | No valid feed | RSS/Atom feed linked and valid | Minor | approx. 45 min |
TECH-63 | Caching chain documented | Caching chain (CDN, Vary, Age) documented | Note | approx. 15 min |
TECH-66 | Web app manifest incomplete | Web app manifest valid (if linked) | Note | approx. 45 min |
TECH-67 | AMP or prerender service | No AMP, dynamic rendering or prerender service | Note | after review |
TECH-68 | Home page too heavy | Total weight of the home page below 3 MB | Medium | approx. 120 min |
TECH-69 | Debug tool public | Debug, profiler and GraphQL tools not public | Severe | approx. 15 min |
TECH-71 | Page with cookie publicly cacheable | Pages with Set-Cookie not publicly cacheable | Minor | approx. 15 min |
TECH-72 | Third-party script without fixed version | Third-party scripts with fixed version (no @latest) | Minor | approx. 15 min |
TECH-73 | Hydration errors | No hydration errors between server and browser HTML | Minor | approx. 120 min |
PERF-04 | Back/forward cache blocked | Back/forward cache not blocked | Minor | approx. 45 min |
TECH-35 | Not reachable over IPv6 | IPv6 address (AAAA) present and reachable | Minor | approx. 45 min |
TECH-64 | Only one name server | At least two name servers | Note | approx. 15 min |
TECH-02 | CMS core outdated | CMS core current (WordPress against api.wordpress.org) | Severe | approx. 120 min |