https://wix.com

Largest Contentful Paint is too slow

Your page's main image or headline takes more than 2.5 seconds to show up. Visitors see a blank or half-loaded page, and most will leave before it finishes loading.

First Contentful Paint is slow

Your page takes more than 1.8 seconds before showing any content at all. Visitors stare at a blank screen and may leave before your site even starts to appear.

Performance score is below 70

Your site scores poorly on Google's performance test. Slow sites rank lower in search results and convert significantly fewer visitors into customers.

Images are missing dimensions

Images without dimensions can cause layout shifts while the page loads. That hurts Core Web Vitals and makes the page feel unstable.

Images with empty or missing alt text

Some images have no meaningful alt text. Screen readers read these as "image" with no context, hurting accessibility and image search visibility.

No analytics tracking detected

You can't improve what you don't measure. Without analytics you have no visibility into traffic, user behavior, or conversion goals.

X-Frame-Options header missing

Your site can be embedded in an invisible iframe on another website. Attackers use this technique (called "clickjacking") to trick your users into clicking things without realising it.

Content Security Policy missing

There's no policy controlling what scripts and resources your page can load. Without this, an attacker who injects any code into your page can do anything — steal cookies, redirect users, exfiltrate data.

Missing Permissions-Policy header

Without a Permissions-Policy header, any script on your page can access the camera, microphone, geolocation, and other sensitive browser features. This is a defence-in-depth security header that limits exposure if you get XSS.

No CAA DNS record

Without a CAA record, any certificate authority in the world can issue an SSL certificate for your domain. A CAA record restricts which CAs are allowed.

Cookie set without Secure flag

Without the Secure flag, cookies (including session tokens) can be sent over HTTP connections, making them visible to network attackers.

Cookie set without HttpOnly flag

Without HttpOnly, JavaScript on the page (including injected scripts from XSS attacks) can read your cookies, including session tokens.

Cookie set without SameSite attribute

Without SameSite, cookies may be sent with cross-site requests, enabling CSRF attacks. Modern browsers default to Lax, but explicit is better.

No cookie consent mechanism detected

Your site loads tracking scripts (Google Analytics, Meta Pixel, etc.) but no cookie consent banner was found. GDPR and similar laws require informed consent before tracking EU visitors — fines can reach €20M.

No web app manifest found

Your site has no web app manifest. Without it, users who add your site to their home screen on Android get a generic browser icon and no app-like experience. It also helps Chrome show the "Add to Home Screen" prompt.

FAQ schema present but no visible FAQ section

Your page has FAQ structured data but no actual FAQ accordion or Q&A section. Google may penalise this as misleading markup.

No llms.txt file

An llms.txt file can help AI systems understand which product pages and context to prefer.

No content date signal found

Perplexity and Google AI Overview weight fresh content significantly higher. Without a date signal, your page may be treated as potentially outdated — reducing how often AI systems cite it in answers.

First paragraph too short for AI citation

AI systems like ChatGPT, Claude, and Perplexity extract the beginning of your page as citation passages. A short or absent opening paragraph means they have little useful content to cite, reducing how often your page appears in AI answers.

Form inputs missing labels

Some form fields have no label. Screen reader users cannot tell what the field is for. Placeholder text is not a substitute — it disappears when you start typing.

Buttons without accessible label

Some buttons (icon buttons, hamburger menus, close buttons) have no accessible name. Screen readers will say "button" with no context — users cannot tell what clicking the button does.

No skip navigation link

Keyboard and screen reader users have to tab through every navigation item on every page to reach the main content. A "skip to content" link at the top of the page lets them jump directly to the main area.