landmark found — Accessibility > Landmark Structure 3. **[WARNING]** is missing width/height — may cause layout shift — Performance > Image Optimization 4. **[WARNING]** 22 third-party resources (50% of weight) — Performance > Page Weight Inventory 5. **[WARNING]** 47 inline style attribute(s) detected — Security > CSP Inline-Style Readiness --- ## Lighthouse Scores | Category | Score | |----------|-------| | Performance | 46 | | Accessibility | 100 | | Best Practices | 77 | | SEO | 100 | --- ## Security ### Security Headers (B — 80/100) *7 of 10 headers properly configured* - **[WARNING]** HSTS is missing includeSubDomains — Without includeSubDomains, subdomains can still be accessed over HTTP. - **[PASS]** X-Content-Type-Options is properly configured - **[PASS]** X-Frame-Options is properly configured - **[PASS]** Referrer-Policy is properly configured - **[PASS]** Permissions-Policy is set - **[PASS]** Content-Security-Policy is present - **[WARNING]** Cross-Origin-Opener-Policy header is missing — COOP isolates your browsing context, preventing cross-origin side-channel attacks. Set to 'same-origin'. - **[WARNING]** Cross-Origin-Embedder-Policy header is missing — COEP prevents loading cross-origin resources without explicit permission. Required for SharedArrayBuffer and high-resolution timers. - **[PASS]** X-Powered-By header is not present - **[PASS]** Server header is present without version info - **[INFO]** Domain is not in the Chrome HSTS preload list (status: unknown) — Submit your domain to hstspreload.org to close the trust-on-first-use gap. Requires a preload-ready HSTS header (max-age=31536000+, includeSubDomains, preload). ### Content Security Policy (C — 65/100) *2 of 11 CSP checks passed* - **[INFO]** Raw CSP policy - **[WARNING]** default-src directive is missing — default-src provides a fallback for other directives. Set it to restrict default resource loading. - **[INFO]** No script-src or default-src to check for 'unsafe-inline' - **[INFO]** No script-src or default-src to check for 'unsafe-eval' - **[INFO]** No script-src or default-src to check for wildcard - **[PASS]** object-src falls back to default-src - **[WARNING]** base-uri directive is missing — Without base-uri, attackers can inject a tag to hijack relative URLs. Set it to 'self' or 'none'. - **[WARNING]** frame-ancestors directive is missing — frame-ancestors controls who can embed your page, preventing clickjacking. Set it to 'self' or 'none'. - **[WARNING]** form-action directive is missing — form-action restricts where forms can submit data, preventing form hijacking. - **[PASS]** upgrade-insecure-requests is enabled - **[INFO]** Content-Security-Policy-Report-Only is also set — A report-only policy is active alongside the enforcing policy for monitoring. ### TLS & Certificates (A+ — 100/100) *TLS 1.3, 7 checks passed* - **[PASS]** TLS 1.3 is used - **[PASS]** Strong cipher suite is used - **[INFO]** HTTP/2 is not negotiated — HTTP/2 provides multiplexing and header compression for better performance. - **[INFO]** OCSP stapling not enabled — Without stapling, the browser performs a separate OCSP roundtrip on first connection -- adding latency and leaking the visited host to the CA. Enable OCSP stapling on your TLS server. - **[PASS]** Certificate is valid (expires in 59 days) - **[PASS]** Certificate chain has 2 certificates - **[PASS]** Certificate uses modern signature algorithm - **[PASS]** Certificate covers 1 domain(s) - **[PASS]** Certificate is issued by a trusted CA ### Cookie Security (A+ — 100/100) *1 cookies analyzed, 3 checks passed* - **[PASS]** Cookie 'PHPSESSID' has the Secure flag - **[PASS]** Cookie 'PHPSESSID' has the HttpOnly flag - **[PASS]** Cookie 'PHPSESSID' has SameSite=Lax ### Cookie Hygiene (A+ — 100/100) *All 1 cookie(s) pass hygiene checks* - **[PASS]** All 1 cookie(s) pass hygiene checks ### WAF / Bot Protection (B — 75/100) *No WAF detected via response headers* - **[INFO]** No WAF detected — Response headers don't match any known WAF or bot-management product. Sites exposed to abuse (login, signup, payment) typically benefit from a WAF such as Cloudflare, Akamai, AWS WAF, or Imperva. ### security.txt (C — 60/100) *No security.txt file found* - **[INFO]** No security.txt file found — security.txt (RFC 9116) provides a standardized way for security researchers to report vulnerabilities. Create one at /.well-known/security.txt with at least a Contact field. ### Cross-Origin Tab Safety (A+ — 100/100) *No new-tab links found -- no tabnabbing surface* - **[PASS]** No new-tab links present ### CSP Inline-Style Readiness (C — 75/100) *47 inline style attribute(s) detected* - **[WARNING]** 47 inline style attribute(s) detected — Each `style=""` attribute forces `style-src 'unsafe-inline'` in any Content-Security-Policy, which negates most of CSP's XSS-mitigation value. 47 inline style(s) is moderate. Affected element types include: h2, p, div, svg, clippath. Move styles to a stylesheet; use CSS custom properties for runtime-dynamic values; or adopt a nonce/hash CSP policy. Most teams take the stylesheet path because it's also a maintainability win. ### Trusted Types (XSS Sink Hardening) (B — 95/100) *Trusted Types not enabled* - **[INFO]** Trusted Types not enabled — Trusted Types (CSP3) is a Chrome 83+ defense that requires DOM-XSS sinks (innerHTML, document.write, eval, ...) to receive a typed-and-sanitized value rather than a raw string. Adding `Content-Security-Policy: require-trusted-types-for 'script'; trusted-types default` neutralizes most DOM-XSS even when a payload reaches a sink. Adoption is currently ~0.1% of pages so this is informational; a roll-out usually starts in report-only mode. ### Bot Challenge Detection (A+ — 100/100) *Scan reached real page content (no bot-protection interstitial)* - **[PASS]** No bot-protection interstitial detected -- the rest of the report reflects the real page ### Soft-404 Detection (A+ — 100/100) *No soft-404 patterns detected in page title or headings* - **[PASS]** No soft-404 patterns detected in page title or headings ### Empty Page Detection (A+ — 100/100) *Page has substantive body text and no placeholder / template-leak signals* - **[PASS]** Page has substantive body text and no placeholder / template-leak signals ### Geo-Restriction Detection (A+ — 100/100) *No geo-restriction signals detected -- scan reached the page from an allowed region* - **[PASS]** No geo-restriction detected ### Maintenance Mode Detection (A+ — 100/100) *No maintenance-mode signals detected -- scan reached a normal page* - **[PASS]** No maintenance-mode signals detected ### Subresource Integrity Adoption (A+ — 100/100) *Page has no third-party scripts or stylesheets -- SRI not applicable* - **[PASS]** No third-party scripts or stylesheets to protect with SRI ### CORS Depth (A+ — 100/100) *No CORS response headers -- the resource is same-origin-only by browser default* - **[PASS]** No CORS response headers -- the resource is same-origin-only by browser default ### Permissions-Policy Granularity (A — 85/100) *90% high-risk feature coverage (9/10)* - **[PASS]** Permissions-Policy covers 9/10 high-risk features (90%) — The Permissions-Policy header explicitly declares policies for 9/10 high-risk features. Covered: camera, microphone, geolocation, payment, usb, midi, accelerometer, gyroscope, magnetometer Not declared (default-allow): serial The non-declared features fall back to their spec-default policy (usually `self`), which means an XSS-injected or compromised iframe could request them. For features the page genuinely doesn't use, declare `feature=()` to fully close them. ### Referrer-Policy Strictness (A+ — 100/100) *Referrer-Policy is `strict-origin-when-cross-origin` (modern default -- full URL same-origin, origin-only cross-origin)* - **[PASS]** Referrer-Policy: `strict-origin-when-cross-origin` -- modern default -- full URL same-origin, origin-only cross-origin — The modern browser default (Chrome 85+, Firefox 87+, Safari 15+). Full URL Referer on same-origin; origin only on cross-origin; no Referer on HTTPS-to-HTTP downgrade. Privacy-safe and breaks no analytics. The recommended explicit value. ### Source Map Exposure (A+ — 100/100) *Source-map probe didn't run on this scan* - **[PASS]** Source-map probe didn't run on this scan ### HTML Version Disclosure (A+ — 100/100) *No software-version disclosures in HTML* - **[PASS]** No software-version disclosures in HTML ### Open Redirect Surface (A+ — 100/100) *No redirect-shaped query parameters in DOM links* - **[PASS]** No redirect-shaped query parameters in DOM links ### Auth Security (A+ — 100/100) *Page is not a login form -- auth-security checks are N/A* - **[PASS]** Page does not appear to be a login form ### Subdomain Inventory Exposure (A+ — 100/100) *No risky subdomain names in certificate SANs* - **[PASS]** No risky subdomain names in certificate SANs --- ## Advanced Security ### Subresource Integrity (A+ — 100/100) *No external resources* - **[PASS]** No external resources to protect ### JS Library Vulnerabilities (A+ — 100/100) *No known vulnerabilities* - **[PASS]** No known JavaScript library vulnerabilities detected ### Information Leakage (A+ — 100/100) *No exposures* - **[INFO]** No security.txt found — Consider adding a security.txt at /.well-known/security.txt. - **[PASS]** No sensitive files exposed ### Email Security (F — 20/100) *no DMARC, no SPF, DKIM* - **[WARNING]** No DMARC record found — Without DMARC, email receivers have no policy for handling authentication failures. Add a TXT record at _dmarc. starting with v=DMARC1. - **[WARNING]** No SPF record found — Without SPF (Sender Policy Framework), receivers can't tell which servers are authorized to send mail for your domain. Add a TXT record at the apex starting with v=spf1, ending in -all. - **[PASS]** DKIM configured (selectors: default) - **[INFO]** MTA-STS not configured — MTA-STS forces inbound mail to use TLS, preventing downgrade attacks. Requires both a TXT record at _mta-sts. and a policy file at https://mta-sts./.well-known/mta-sts.txt. - **[INFO]** TLS-RPT not configured — TLS-RPT (RFC 8460) lets MTAs report TLS-handshake failures, so you can detect and fix MTA-STS misconfigurations. Add a TXT record at _smtp._tls.. - **[INFO]** BIMI not configured — BIMI (Brand Indicators for Message Identification) lets supporting clients (Gmail, Apple Mail, Yahoo) display your verified logo next to your messages. Optional but raises trust signals. Requires DMARC at p=quarantine or p=reject to be honored. ### API Surface (A+ — 100/100) *No API specs or GraphQL introspection found (probed 11 candidate path(s))* - **[PASS]** No API specs or GraphQL introspection found (probed 11 path(s)) ### Permissions-Policy (A+ — 100/100) *11 directives, 0 missing* - **[PASS]** geolocation=() — blocked for all origins - **[PASS]** midi=() — blocked for all origins - **[PASS]** sync-xhr=() — blocked for all origins - **[PASS]** accelerometer=() — blocked for all origins - **[PASS]** gyroscope=() — blocked for all origins - **[PASS]** magnetometer=() — blocked for all origins - **[PASS]** payment=() — blocked for all origins - **[PASS]** camera=() — blocked for all origins - **[PASS]** microphone=() — blocked for all origins - **[PASS]** usb=() — blocked for all origins - **[INFO]** fullscreen=(self) ### CORS Configuration (B — 80/100) *No CORS headers* - **[PASS]** No CORS headers present — secure default --- ## Performance ### Page Weight Budget (C — 65/100) *1.7 MB transferred, 81 requests* - **[INFO]** Page weighs 3.9 MB (1.7 MB transferred) - **[WARNING]** JavaScript is 750 KB — consider code splitting or lazy loading — Large JavaScript bundles delay interactivity. Split code by route or defer non-critical scripts. - **[INFO]** 81 HTTP requests - **[INFO]** Estimated 0.36 g CO2 per page load ### Third-Party Impact (B — 70/100) *50% third-party, 0 ms blocking* - **[INFO]** Third-party code accounts for 50% of page weight (869.6 KiB of 1.7 MiB) - **[PASS]** Third-party blocking time is low (0 ms) ### Text Compression (A+ — 100/100) *All text resources are compressed* - **[PASS]** All text resources are compressed ### Image Optimization (C — 60/100) *59 images, 0 KB saveable* - **[WARNING]** https://okinawa.dearswedding-resort.jp/dears_ooweh... is missing width/height — may cause layout shift — Set explicit width and height to prevent CLS. - **[WARNING]** is missing width/height — may cause layout shift — Set explicit width and height to prevent CLS. - **[WARNING]** https://okinawa.dearswedding-resort.jp/dears_ooweh... is missing width/height — may cause layout shift — Set explicit width and height to prevent CLS. - **[WARNING]** https://okinawa.dearswedding-resort.jp/dears_ooweh... is missing width/height — may cause layout shift — Set explicit width and height to prevent CLS. - **[WARNING]** https://okinawa.dearswedding-resort.jp/dears_ooweh... is missing width/height — may cause layout shift — Set explicit width and height to prevent CLS. - **[WARNING]** https://okinawa.dearswedding-resort.jp/dears_ooweh... is missing width/height — may cause layout shift — Set explicit width and height to prevent CLS. ### JS Execution Cost (F — 20/100) *5981ms total JS execution* - **[WARNING]** https://okinawa.dearswedding-resort.jp/: 2471ms CPU time - **[WARNING]** https://okinawa.dearswedding-resort.jp/dears_ooweh...: 1834ms CPU time - **[WARNING]** Unattributable: 637ms CPU time - **[WARNING]** https://www.googletagmanager.com/gtag/js?id=G-FLKE...: 274ms CPU time - **[INFO]** https://connect.facebook.net/signals/config/228629...: 236ms CPU time - **[INFO]** Third-party scripts: 1039ms (17% of total) ### Font Loading (A+ — 100/100) *3 fonts (180 KB)* - **[INFO]** 3 font(s) use font-display: swap (FOUT risk but functional) ### JS Bundles (D — 40/100) *7 scripts, 301 KB unused* - **[WARNING]** https://www.googletagmanager.com/gtag/js?id=G-FLKE...: 66 KB unused (41%) — Consider code splitting or tree shaking to reduce unused code. - **[WARNING]** https://www.googletagmanager.com/gtm.js?id=GTM-K97...: 66 KB unused (43%) — Consider code splitting or tree shaking to reduce unused code. - **[WARNING]** https://www.googletagmanager.com/gtag/destination?...: 63 KB unused (43%) — Consider code splitting or tree shaking to reduce unused code. - **[WARNING]** https://okinawa.dearswedding-resort.jp/dears_ooweh...: 40 KB unused (59%) — Consider code splitting or tree shaking to reduce unused code. - **[WARNING]** https://connect.facebook.net/signals/config/228629...: 34 KB unused (27%) — Consider code splitting or tree shaking to reduce unused code. - **[INFO]** Total unused JavaScript: 301 KB ### Resource Caching (A+ — 100/100) *All resources properly cached* - **[PASS]** No caching issues found ### Critical Rendering Path (A+ — 100/100) *No render-blocking resources* - **[PASS]** No render-blocking resources detected ### Resource Hints (A+ — 100/100) *No optimization needed* - **[PASS]** No resource hint issues ### HTTP/3 (QUIC) (B — 75/100) *HTTP/3 not advertised* - **[INFO]** HTTP/3 (QUIC) is not advertised — HTTP/3 isn't advertised via Alt-Svc and the worker didn't negotiate h3. HTTP/3 reduces handshake latency (1-RTT instead of 2-3 RTTs) and is more resilient on lossy connections. Most modern CDNs (Cloudflare, Fastly, AWS CloudFront, Google Cloud CDN) support HTTP/3 with a single config switch -- consider enabling for mobile-heavy workloads. ### Compression Algorithm (A+ — 100/100) *Main response uses brotli* - **[PASS]** Main HTML response uses brotli (Content-Encoding: br) — Brotli is the best text-compression algorithm for general use, ~20% smaller than gzip on average (40% on smaller files). Modern browsers all support it. ### LCP Image Preload (A+ — 100/100) *LCP preload audit not available* - **[PASS]** LCP image preload audit not available for this scan ### Main HTML Cache-Control (C — 70/100) *Main HTML max-age=10800 (~180min) is aggressive* - **[WARNING]** Main HTML cached for 180 minutes -- risks stale auth / SPA state — Long max-age on the main HTML document means users may see outdated auth state, SPA shells, or A/B variants until the cache expires. Consider Cache-Control: no-cache (or max-age=300) for HTML and let your hashed assets (JS/CSS/images) carry the long cache instead. ### Server-Timing Observability (B — 85/100) *No Server-Timing header found* - **[INFO]** No Server-Timing header found — Server-Timing exposes backend timing breakdowns to browser DevTools (e.g., `db: 45ms; render: 120ms; cache: 2ms`). Useful for diagnosing slow pages without backend log access. Most modern frameworks (Next.js, Cloudflare Workers, Fastly) emit it automatically; absence on a managed platform usually means telemetry headers are stripped at the edge. ### Server Response Intelligence (A+ — 100/100) *2 server-response signal(s) detected* - **[PASS]** `Vary` header declared: Accept-Encoding — The page declares a `Vary` header, telling downstream caches which request headers the response varies on. Critical for content-negotiated responses (compression, language, cookies, device class). - **[PASS]** `Last-Modified` present -- timestamp-based conditional GET supported — Consider also setting `ETag` for stronger revalidation -- ETags are content hashes that don't suffer from clock-skew or DST issues. Last-Modified alone is functional for conditional GETs and not a bug. ### Page Weight Inventory (D — 40/100) *81 resources · 1.7 MB · 301 KB savings available* - **[WARNING]** Page weight 1.7 MB exceeds 1 MB target by 728 KB - **[INFO]** ~301 KB of savings available - **[WARNING]** 22 third-party resources (50% of weight) ### Render-Blocking Resources (A+ — 100/100) *No render-blocking resources detected* - **[PASS]** No render-blocking resources detected in ### Third-Party Resources (A+ — 100/100) *No third-party resources detected* ### JavaScript Blocking (A — 90/100) *1 JS blocking issue(s) detected* - **[WARNING]** Total JS execution time is 6.0 s -- over the 3.5s budget — Total JavaScript execution (parse + compile + run) across all scripts exceeds 3.5 seconds. On low-end devices that becomes 7-15+ seconds and shows up directly in TBT and INP. Reduce by: tree-shaking unused dependencies, code-splitting (dynamic `import()`), removing or deferring third-party tracking, and replacing heavy frameworks where they're not needed. ### CSS Performance Depth (A+ — 100/100) *No CSS performance depth issues detected* - **[PASS]** No CSS performance depth issues detected --- ## Content Quality ### Links (A+ — 100/100) *1 links checked, 1 healthy, 0 broken* - **[PASS]** 1 of 1 links are healthy ### Mixed Content (A+ — 100/100) *No mixed content detected — all resources use HTTPS.* - **[PASS]** No mixed content detected — all resources use HTTPS ### Open Graph (F — 0/100) *No Open Graph tags found — social sharing previews will be generic.* - **[WARNING]** No Open Graph meta tags found — Without og:title, og:description, and og:image, social media platforms will generate a generic preview when your page is shared. ### Open Graph / Twitter Card Depth (A+ — 100/100) *No OG image or Twitter card set -- depth check is N/A (presence covered by Open Graph section)* - **[PASS]** No OG image / Twitter card to evaluate ### Structured Data (C — 40/100) *No structured data (JSON-LD) found.* - **[INFO]** No structured data (JSON-LD) found — Adding structured data helps search engines understand your content and can enable rich results. ### Rich Results Eligibility (C — 75/100) *No JSON-LD found -- no rich-result eligibility* - **[INFO]** No JSON-LD structured data on the page — No `