Skip to content

Changes

https://www.mossandmolt.com
Compared to previous audit · 5 hours ago View previous audit
20
New issues
29
Resolved
17
score changes
CategoryPreviousCurrentChange
CompositeB (83)B (85) +2.000
PerformanceB (87)B (87)—
SecurityC (78)B (82) +4.000
AccessibilityC (79)C (79)—
SEOA (93)A (91) -2.000
InfrastructureB (89)B (86) -3.000
ComplianceC (74)B (83) +9.000
ContentA (91)A (90) -1.000
SustainabilityB (81)B (81)—
MetricPreviousCurrentChange
Performance 52005300 +100
Accessibility 1000010000—
Best Practices 1000010000—
SEO 1000010000—
PWA 00—
Desktop Performance 96009600—
Desktop Accessibility 97009700—
Desktop Best Practices 92009200—
Desktop SEO 1000010000—
FCP 4.44 s4.03 s -411 ms
LCP 14.21 s13.53 s -676 ms
TBT 306 ms318 ms +12 ms
CLS 0.0000.000—
Desktop FCP 657 ms595 ms -62 ms
Desktop LCP 1.13 s930 ms -200 ms
Desktop TBT 0 ms1 ms +1 ms
Desktop CLS 0.0260.026—
TTFB †1.24 s137 ms -1.10 s
DNS †78 ms76 ms -3 ms
TLS †25 ms23 ms -2 ms
Connect 17 ms17 ms—
Total †1.26 s138 ms -1.12 s

† Timing metrics may vary by worker location and do not necessarily indicate site changes.

CRITICAL HSTS header is missing security
CRITICAL 196 of 200 links are healthy content
CRITICAL Canonical target returns 403 seo
CRITICAL Content-Security-Policy header is missing security
WARNING https://www.mossandmolt.com/cdn/wpm/bfe0cff12w3ebd...: 39 KB unused (46%) performance
WARNING <iframe> missing title attribute (src="https://www.mossandmolt.com/web-pixels@fe0cff12w3ebd43eapaab70107m6f8ccd4d/cust…") accessibility
WARNING JavaScript is 573 KB — consider code splitting or lazy loading performance
WARNING 1 `@font-face` rule(s) without `font-display` -- causes FOIT performance
WARNING Unattributable: 1387ms CPU time performance
WARNING https://cdn.shopify.com/extensions/01a1c05e-97bc-7...: 547ms CPU time performance
WARNING Compressed response missing `Vary` header performance
WARNING 22 render-blocking stylesheet(s) -- recommended: <=3 performance
WARNING Broken link: https://www.mossandmolt.com/checkouts/internal/preloads.j... content
WARNING https://www.mossandmolt.com/cdn/shop/t/18/assets/m...: 555ms CPU time performance
WARNING 452 HTTP requests — consider bundling or reducing performance
WARNING https://www.mossandmolt.com/: 4116ms CPU time performance
WARNING https://www.mossandmolt.com/cdn/wpm/bfe0cff12w3ebd...: 575ms CPU time performance
WARNING Unexpected status code: HTTP 403 accessibility
WARNING Broken link: https://www.mossandmolt.com/.well-known/ucp content
WARNING Total JS execution time is 8.2 s -- over the 3.5s budget performance
CRITICAL Cookie 'localization' is missing the Secure flag security
CRITICAL Cookie 'cart_currency' is missing the Secure flag security
CRITICAL Canonical target returns 429 seo
WARNING Cookie '_shopify_cmp' is missing the HttpOnly flag security
WARNING https://www.mossandmolt.com/: 3804ms CPU time performance
WARNING https://www.mossandmolt.com/cdn/wpm/bf882002ew93f4...: 39 KB unused (46%) performance
WARNING 198 of 200 links are healthy content
WARNING default-src directive is missing security
WARNING Unexpected status code: HTTP 429 accessibility
WARNING Permissions-Policy header is missing security
WARNING base-uri directive is missing security
WARNING 414 HTTP requests — consider bundling or reducing performance
WARNING 6 unclassified cookie(s) set before any consent step compliance
WARNING Cookie 'localization' is missing the HttpOnly flag security
WARNING <iframe> missing title attribute (src="https://www.mossandmolt.com/web-pixels@f882002ew93f4c027p0c16e2cama50b1ec1/cust…") accessibility
WARNING JavaScript is 630 KB — consider code splitting or lazy loading performance
WARNING https://cdn.shopify.com/extensions/01a1c05e-97bc-7...: 506ms CPU time performance
WARNING Cross-Origin-Opener-Policy header is missing security
WARNING Cross-Origin-Embedder-Policy header is missing security
WARNING form-action directive is missing security
WARNING Cookie 'cart_currency' is missing the HttpOnly flag security
WARNING Unattributable: 1250ms CPU time performance
WARNING No Permissions-Policy header security
WARNING GDPR Article 13 disclosure coverage: 0 / 8 categories compliance
WARNING 155 inline style attribute(s) detected security
WARNING https://www.mossandmolt.com/cdn/wpm/bf882002ew93f4...: 620ms CPU time performance
WARNING https://www.mossandmolt.com/cdn/shop/t/18/assets/m...: 421ms CPU time performance
WARNING HSTS is enabled but max-age is short (7889238s, should be >= 31536000s) security
WARNING Referrer-Policy header is missing security
CRITICAL 5 publicly-accessible JavaScript source map(s) security
CRITICAL 2 link(s) with no accessible text accessibility
WARNING CNAME record at zone apex infrastructure
WARNING External script from cdn.shopify.com lacks integrity attribute security
WARNING Multiple H1 headings (2 found) accessibility
WARNING Heading level skipped: H2 → H4 (missing H3) accessibility
WARNING Registrar lock is NOT enabled infrastructure
WARNING No accessibility statement detected compliance
WARNING 30 link(s) open in new tab without warning accessibility
WARNING 26 images missing explicit width/height content
WARNING GraphQL introspection enabled at /api/graphql security
WARNING Missing required property "name" for Organization content
WARNING 0.90g CO2 — above the median website (0.60g) sustainability
WARNING Broken link: https://www.mossandmolt.com/ content
WARNING Images are 1.8 MB — compress or use modern formats performance
WARNING Missing og:image content
WARNING No DMARC record found security
WARNING Broken link: https://monorail-edge.shopifysvc.com content
WARNING SRI adoption: 1/26 third-party resources protected (3%) security
WARNING Page weight 3.8 MB exceeds 1 MB target by 2.8 MB performance
WARNING 1 link(s) open in a new tab without rel=noopener security
WARNING External link from cdn.shopify.com lacks integrity attribute security
WARNING No favicon.ico at site root accessibility
WARNING Page weighs 5.8 MB (3.8 MB transferred) performance
+ critical-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, ...
+ cf-mitigated challenge
+ permissions-policy accelerometer=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(...
+ cross-origin-embedder-policy require-corp
+ referrer-policy same-origin
+ cross-origin-opener-policy same-origin
+ cross-origin-resource-policy same-origin
+ origin-agent-cluster ?1
− content-language en-US
− cdn-cache-control no-cache, no-store
− strict-transport-security max-age=7889238
− x-dc gcp-europe-west1,gcp-europe-west1,gcp-europe-west1
− shopify-complexity-score 10610
− content-security-policy block-all-mixed-content; frame-ancestors 'none'; upgrade-insecure-requests;
− link <https://cdn.shopify.com>; rel="preconnect", <https://cdn.shopify.com>; rel="...
− set-cookie _shopify_essential=:AaHCpgRZAAEAc7eJRh-KldSpLmmEwgPYLR76lsyKCMe9rnyKnmHxdRRQC...
− cf-cache-status DYNAMIC
− powered-by Shopify
− cache-control private, max-age=0, must-revalidate
− etag "sfr:computation:v2:a2eba1e0f51b31a327864e5ad240d29cf64f9c9e60b816866316ce395...
− content-length 123873
− product-filtering-backend bitset_roaring
− vary accept-encoding
− shopify-complexity-score-v2 1061
accept-ch
Sec-CH-Viewport-Width → Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, ...
content-type
text/html; charset=utf-8 → text/html; charset=UTF-8
x-frame-options
DENY → SAMEORIGIN

7 headers unchanged

− HSTS Security

13 technologies unchanged

Looking ahead

+13 pts
B (85) Could reach A+ (98)
Accessibility +20Security +18Performance +13Content +10SEO +9Infrastructure +8Compliance +4Sustainability +4

Estimate — actual results may vary (44 issues to fix)

Website improvement report — Mossandmolt

November 9, 2026 → November 10, 2026

B B 83 → 85 +2 pts

29

Resolved

20

New issues

24

Still remaining

Financial summary

Investment delivered

€2,727 in development time

Investment remaining

€4,385 to complete the remaining items

Ongoing risk

€1/month in ongoing exposure

Figures are estimates based on local developer hourly rate, industry CPC, and regulatory fine ranges.

Performance by category

MetricBeforeAfterChange
Overall score83 (B)85 (B)+2
Performance87 (B)87 (B)0
Security78 (C)82 (B)+4
Accessibility79 (C)79 (C)0
SEO93 (A)91 (A)-2
Infrastructure89 (B)86 (B)-3
Compliance74 (C)83 (B)+9
Content91 (A)90 (A)-1
Sustainability81 (B)81 (B)0

Resolved (29)

  • Cookie '_shopify_cmp' is missing the HttpOnly flag (Security)

    → Reduced attack surface for visitors

  • https://www.mossandmolt.com/: 3804ms CPU time (Performance)

    → Page loads faster for users

  • https://www.mossandmolt.com/cdn/wpm/bf882002ew93f4...: 39 KB unused (46%) (Performance)

    → Page loads faster for users

  • 198 of 200 links are healthy (Content)

    → Stronger social sharing and on-page quality

  • default-src directive is missing (Security)

    → Reduced attack surface for visitors

  • Unexpected status code: HTTP 429 (Accessibility)

    → Improved usability for assistive technology users

  • Permissions-Policy header is missing (Security)

    → Reduced attack surface for visitors

  • base-uri directive is missing (Security)

    → Reduced attack surface for visitors

  • Cookie 'localization' is missing the Secure flag (Security)

    → Reduced attack surface for visitors

  • 414 HTTP requests — consider bundling or reducing (Performance)

    → Page loads faster for users

  • 6 unclassified cookie(s) set before any consent step (Compliance)

    → Reduced regulatory exposure

  • Cookie 'localization' is missing the HttpOnly flag (Security)

    → Reduced attack surface for visitors

  • <iframe> missing title attribute (src="https://www.mossandmolt.com/web-pixels@f882002ew93f4c027p0c16e2cama50b1ec1/cust…") (Accessibility)

    → Improved usability for assistive technology users

  • JavaScript is 630 KB — consider code splitting or lazy loading (Performance)

    → Page loads faster for users

  • https://cdn.shopify.com/extensions/01a1c05e-97bc-7...: 506ms CPU time (Performance)

    → Page loads faster for users

…and 14 more resolved issue(s)

Recommended next steps (44)

  • Sprint 1

    HSTS header is missing (Security)

  • Sprint 1

    196 of 200 links are healthy (Content)

  • Sprint 1

    Canonical target returns 403 (SEO)

  • Sprint 2

    Content-Security-Policy header is missing (Security)

  • Sprint 1

    5 publicly-accessible JavaScript source map(s) (Security)

  • Sprint 1

    2 link(s) with no accessible text (Accessibility)

  • Sprint 3

    https://www.mossandmolt.com/cdn/wpm/bfe0cff12w3ebd...: 39 KB unused (46%) (Performance)

  • Sprint 1

    <iframe> missing title attribute (src="https://www.mossandmolt.com/web-pixels@fe0cff12w3ebd43eapaab70107m6f8ccd4d/cust…") (Accessibility)

  • Sprint 3

    JavaScript is 573 KB — consider code splitting or lazy loading (Performance)

  • Sprint 2

    1 `@font-face` rule(s) without `font-display` -- causes FOIT (Performance)

  • Sprint 1

    Unattributable: 1387ms CPU time (Performance)

  • Sprint 1

    https://cdn.shopify.com/extensions/01a1c05e-97bc-7...: 547ms CPU time (Performance)

  • Sprint 2

    Compressed response missing `Vary` header (Performance)

  • Sprint 1

    22 render-blocking stylesheet(s) -- recommended: <=3 (Performance)

  • Sprint 1

    Broken link: https://www.mossandmolt.com/checkouts/internal/preloads.j... (Content)

…and 29 more recommended item(s)

Send Feedback