sheets.market — Website Report

Enable HTTP Strict Transport Security to force HTTPS connections.

# Nginx:
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

# Apache (.htaccess):
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

# Next.js (next.config.js headers):
{ key: 'Strict-Transport-Security', value: 'max-age=31536000; includeSubDomains' }

Add a Content-Security-Policy header to prevent XSS and injection attacks.

# Nginx:
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';" always;

# Apache (.htaccess):
Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';"

# Next.js (next.config.js headers):
{ key: 'Content-Security-Policy', value: "default-src 'self'; script-src 'self' 'unsafe-inline'" }

Found 7 of 72 images without alt attributes. Alt text is critical for accessibility (screen readers) and SEO (image search).

Your page loads 37 scripts from external domains. Each requires a separate connection. Audit analytics, chat widgets, and trackers; remove or defer non-essential ones.

Set X-Content-Type-Options: nosniff to prevent MIME-type sniffing.

# Nginx:
add_header X-Content-Type-Options "nosniff" always;

# Next.js (next.config.js headers):
{ key: 'X-Content-Type-Options', value: 'nosniff' }

Set X-Frame-Options to prevent clickjacking attacks.

# Nginx:
add_header X-Frame-Options "SAMEORIGIN" always;

# Next.js (next.config.js headers):
{ key: 'X-Frame-Options', value: 'SAMEORIGIN' }

Add a Referrer-Policy header to control information leakage.

# Nginx:
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

# Next.js (next.config.js headers):
{ key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' }

Add a Permissions-Policy header to control browser feature access.

# Nginx:
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

# Next.js (next.config.js headers):
{ key: 'Permissions-Policy', value: 'camera=(), microphone=(), geolocation=()' }

Your title is 70 characters. Keep it under 60 for best display in search results.

Missing og:image. Add these for better social media sharing previews on Facebook, LinkedIn, and Twitter.

<meta property="og:title" content="Your Page Title">
<meta property="og:description" content="Description for social sharing">
<meta property="og:image" content="https://yoursite.com/og-image.jpg">
<meta property="og:url" content="https://yoursite.com/page">
<meta property="og:type" content="website">

7 of 72 images have no alt attribute. Screen readers cannot describe these images to visually impaired users.

Heading hierarchy jumps from H2 to H4. Don't skip heading levels — this confuses screen readers and assistive technology.

Some text appears to use light colors that may not have sufficient contrast against the background. WCAG requires a minimum 4.5:1 contrast ratio.

1 script without async or defer attributes. These block page rendering. Add defer or async to non-critical scripts.

Loading 21 CSS files. Each blocks rendering. Consider combining stylesheets or inlining critical CSS.

66 images don't use loading="lazy". Add lazy loading to below-the-fold images to improve initial page load.

Add more internal links to help search engines discover and index your other pages. Internal linking also helps distribute page authority.

Found 23 HTML comments. Remove unnecessary comments in production to reduce file size.