gravuro.at — Website Report

Enable HTTP Strict Transport Security to force HTTPS connections.

# Nginx:
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

# Apache (.htaccess):
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

# Next.js (next.config.js headers):
{ key: 'Strict-Transport-Security', value: 'max-age=31536000; includeSubDomains' }

Add a Content-Security-Policy header to prevent XSS and injection attacks.

# Nginx:
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';" always;

# Apache (.htaccess):
Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';"

# Next.js (next.config.js headers):
{ key: 'Content-Security-Policy', value: "default-src 'self'; script-src 'self' 'unsafe-inline'" }

Every page should have exactly one H1 heading that describes the main topic. This is important for SEO and accessibility.

<h1>Your Main Page Heading</h1>
<!-- Only use one H1 per page. Make it descriptive and include your target keyword. -->

Your page loads 40 scripts from external domains. Each requires a separate connection. Audit analytics, chat widgets, and trackers; remove or defer non-essential ones.

30 scripts without async or defer attributes. These block page rendering. Add defer or async to non-critical scripts.

Set X-Content-Type-Options: nosniff to prevent MIME-type sniffing.

# Nginx:
add_header X-Content-Type-Options "nosniff" always;

# Next.js (next.config.js headers):
{ key: 'X-Content-Type-Options', value: 'nosniff' }

Set X-Frame-Options to prevent clickjacking attacks.

# Nginx:
add_header X-Frame-Options "SAMEORIGIN" always;

# Next.js (next.config.js headers):
{ key: 'X-Frame-Options', value: 'SAMEORIGIN' }

Add a Referrer-Policy header to control information leakage.

# Nginx:
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

# Next.js (next.config.js headers):
{ key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' }

Add a Permissions-Policy header to control browser feature access.

# Nginx:
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

# Next.js (next.config.js headers):
{ key: 'Permissions-Policy', value: 'camera=(), microphone=(), geolocation=()' }

Your description is 254 characters. Keep it under 160 for best display.

Heading hierarchy jumps from H2 to H5. Don't skip heading levels — this confuses screen readers and assistive technology.

Some text appears to use light colors that may not have sufficient contrast against the background. WCAG requires a minimum 4.5:1 contrast ratio.

Server responded in 1.2s. Aim for under 200ms TTFB. Consider caching, CDN, or server-side optimizations.

Your HTML is 773KB. Large HTML documents take longer to parse. Consider lazy loading content or splitting into multiple pages.

105 images don't use loading="lazy". Add lazy loading to below-the-fold images to improve initial page load.

Found 13 HTML comments. Remove unnecessary comments in production to reduce file size.