https://huggingface.co

Largest Contentful Paint is too slow

Your page's main image or headline takes more than 2.5 seconds to show up. Visitors see a blank or half-loaded page, and most will leave before it finishes loading.

First Contentful Paint is slow

Your page takes more than 1.8 seconds before showing any content at all. Visitors stare at a blank screen and may leave before your site even starts to appear.

OG image missing width and height

Twitter/X, LinkedIn, Telegram, and Discord need the image dimensions declared in your HTML to display the preview correctly. Without them, the preview may be skipped entirely or shown at the wrong size — reducing click-through rate when your link is shared.

Images are missing dimensions

Images without dimensions can cause layout shifts while the page loads. That hurts Core Web Vitals and makes the page feel unstable.

Images with empty or missing alt text

Some images have no meaningful alt text. Screen readers read these as "image" with no context, hurting accessibility and image search visibility.

No structured data (JSON-LD) found

No Schema.org JSON-LD blocks were found on this page. Structured data helps Google understand your content and display rich results. It also improves AI search visibility.

No analytics tracking detected

You can't improve what you don't measure. Without analytics you have no visibility into traffic, user behavior, or conversion goals.

sitemap.xml exists but contains no URLs

Your sitemap.xml is empty. Search engines and AI crawlers use sitemaps to discover pages — an empty sitemap provides no benefit.

HSTS header missing

Your site allows browsers to connect over HTTP even though you have HTTPS. Attackers can intercept the first request and downgrade visitors to unencrypted HTTP. HSTS prevents this.

X-Content-Type-Options header missing

Browsers can "sniff" your files and treat them as a different file type than intended. This can allow attackers to upload files that get executed as scripts. This header prevents that.

Content Security Policy missing

There's no policy controlling what scripts and resources your page can load. Without this, an attacker who injects any code into your page can do anything — steal cookies, redirect users, exfiltrate data.

API key found in page HTML

A secret API key is visible in your page's HTML source code. Anyone can view-source your page and steal it — this is actively exploited by bots that scrape the web looking for this.

Missing Permissions-Policy header

Without a Permissions-Policy header, any script on your page can access the camera, microphone, geolocation, and other sensitive browser features. This is a defence-in-depth security header that limits exposure if you get XSS.

DMARC policy is set to none (monitoring only)

Your DMARC record only monitors, it does not protect. Emails that fail DMARC (including spoofed phishing from your domain) are still delivered to inboxes.

No CAA DNS record

Without a CAA record, any certificate authority in the world can issue an SSL certificate for your domain. A CAA record restricts which CAs are allowed.

Viewport blocks user scaling

Your site prevents users from zooming in on mobile. This is a serious accessibility issue — many people with visual impairments rely on zoom. Apple and Google also penalise this in their quality guidelines.

Favicon is missing

Your site has no favicon — the small icon that appears in browser tabs and bookmarks. It makes your site look unfinished and makes it harder for users to find your tab when they have many tabs open.

No web app manifest found

Your site has no web app manifest. Without it, users who add your site to their home screen on Android get a generic browser icon and no app-like experience. It also helps Chrome show the "Add to Home Screen" prompt.

No structured data (Schema.org)

AI assistants and search engines use structured data to understand what your product is. Without it, they have less reliable context.

Heading hierarchy is broken

The page outline skips heading levels. That makes machine parsing and assistive reading less reliable.

No llms.txt file

An llms.txt file can help AI systems understand which product pages and context to prefer.

Weak brand or author entity signals

The site does not expose many signals that identify the people or organization behind it.

No question-format headings found

ChatGPT, Claude, and Perplexity extract headings as Q&A pairs and include them in answers with a link to your page. Pages with question-format headings are cited more often in AI responses.

First paragraph too short for AI citation

AI systems like ChatGPT, Claude, and Perplexity extract the beginning of your page as citation passages. A short or absent opening paragraph means they have little useful content to cite, reducing how often your page appears in AI answers.

Form inputs missing labels

Some form fields have no label. Screen reader users cannot tell what the field is for. Placeholder text is not a substitute — it disappears when you start typing.

Buttons without accessible label

Some buttons (icon buttons, hamburger menus, close buttons) have no accessible name. Screen readers will say "button" with no context — users cannot tell what clicking the button does.

Missing lang attribute on html element

Your page has no language declaration. Screen readers need this to choose the right pronunciation engine. Without it, content may be read in the wrong language, making it incomprehensible for visually impaired users.

No skip navigation link

Keyboard and screen reader users have to tab through every navigation item on every page to reach the main content. A "skip to content" link at the top of the page lets them jump directly to the main area.

Low Lighthouse accessibility score

Your site scores poorly on automated accessibility tests. This means real users — people using screen readers, keyboard navigation, or who need high contrast — likely struggle to use your site.