www.kuuki.fi — Website Report

Add a Content-Security-Policy header to prevent XSS and injection attacks.

# Nginx:
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';" always;

# Apache (.htaccess):
Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';"

# Next.js (next.config.js headers):
{ key: 'Content-Security-Policy', value: "default-src 'self'; script-src 'self' 'unsafe-inline'" }

22 scripts without async or defer attributes. These block page rendering. Add defer or async to non-critical scripts.

Found 3 of 29 images without alt attributes. Alt text is critical for accessibility (screen readers) and SEO (image search).

3 of 29 images have no alt attribute. Screen readers cannot describe these images to visually impaired users.

Form inputs should have associated labels or aria-label attributes so screen readers can identify them.

Server responded in 2.1s. Aim for under 200ms TTFB. Consider caching, CDN, or server-side optimizations.

Loading 19 CSS files. Each blocks rendering. Consider combining stylesheets or inlining critical CSS.

14 images don't use loading="lazy". Add lazy loading to below-the-fold images to improve initial page load.

Add a 'Skip to main content' link at the top of the page so keyboard users can bypass repetitive navigation.

<!-- Add as the first element inside <body> -->
<a href="#main-content" class="sr-only focus:not-sr-only focus:absolute focus:top-2 focus:left-2 focus:z-50 focus:px-4 focus:py-2 focus:bg-blue-600 focus:text-white focus:rounded">
  Skip to main content
</a>

<!-- Add id to your main content area -->
<main id="main-content">
  ...
</main>

Found 22 HTML comments. Remove unnecessary comments in production to reduce file size.