Browsers will use heuristic caching, which can be unpredictable. Set explicit cache headers.
No Cache-Control header
Adding a Cache-Control header can significantly improve repeat-visit performance.
B
Page Weight Budget
1.2 MB transferred, 45 requests
REVIEW
1.2 MB transferred, 45 requests
Info::
✓
Page weighs 4.4 MB (1.2 MB transferred)
Warning::
!
JavaScript is 861 KB — consider code splitting or lazy loading
Large JavaScript bundles delay interactivity. Split code by route or defer non-critical scripts.
Got: 861 KB
Info::
✓
45 HTTP requests
Info::
i
Estimated 0.25 g CO2 per page load
1.2 MBtransferred
45 requests
0.25 g CO2 per page load
JavaScript861.0 KiB70%
Images218.1 KiB18%
CSS67.0 KiB5%
HTML43.4 KiB4%
Fonts34.7 KiB3%
Other1.6 KiB0%
Other1012 B0%
02.4 MB4.9 MB
Under budget
Large JavaScript bundles delay interactivity. Split code by route or defer non-critical scripts.
Why this matters
JavaScript bundle is large — code-split routes and lazy-load off-screen components to defer.
Source: web.dev
B
Image Optimization
10 images, 0 KB saveable
REVIEW
10 images, 0 KB saveable
Warning::
!
https://bankofkhartoum.com/umoajupt/assets/images/... is missing width/height — may cause layout shift
Set explicit width and height to prevent CLS.
10images218 KB
0oversized-0 KB
10legacy format
1missing dimensionsCLS risk
Set explicit width and height to prevent CLS.
Why this matters
Image without explicit width/height — browser can't reserve space; CLS jumps when image loads.
Source: web.dev / Core Web Vitals
B
HTTP/3 (QUIC)
HTTP/3 not advertised
REVIEW
HTTP/3 not advertised
Info::
i
HTTP/3 (QUIC) is not advertised
HTTP/3 isn't advertised via Alt-Svc and the worker didn't negotiate h3. HTTP/3 reduces handshake latency (1-RTT instead of 2-3 RTTs) and is more resilient on lossy connections. Most modern CDNs (Cloudflare, Fastly, AWS CloudFront, Google Cloud CDN) support HTTP/3 with a single config switch -- consider enabling for mobile-heavy workloads.
B
Compression Algorithm
Main response uses gzip; brotli would be ~20% smaller
REVIEW
Main response uses gzip; brotli would be ~20% smaller
Info::
i
Main HTML response uses gzip (brotli would be ~20% smaller)
All current browsers support brotli. Most CDNs (Cloudflare, Fastly, AWS CloudFront, Vercel, Netlify) can switch from gzip to brotli with a single config flag. Origin servers (nginx, Apache) need a brotli module compiled in -- nginx-brotli or Apache mod_brotli.
B
Main HTML Cache-Control
No Cache-Control header on main HTML response
REVIEW
No Cache-Control header on main HTML response
Info::
i
Main HTML response has no Cache-Control header
Without an explicit Cache-Control, browsers fall back to heuristic caching (~10% of Last-Modified age). Set `Cache-Control: no-cache` or `max-age=300` for HTML to control freshness explicitly -- prevents stale auth state and SPA shell drift.
B
Server-Timing Observability
No Server-Timing header found
REVIEW
No Server-Timing header found
Info::
i
No Server-Timing header found
Server-Timing exposes backend timing breakdowns to browser DevTools (e.g., `db: 45ms; render: 120ms; cache: 2ms`). Useful for diagnosing slow pages without backend log access. Most modern frameworks (Next.js, Cloudflare Workers, Fastly) emit it automatically; absence on a managed platform usually means telemetry headers are stripped at the edge.
C
Green Hosting
Action
Whether the site is served from green-energy infrastructure
REVIEW
Green Hosting
No green hosting detected
A+
Text Compression
All text resources are compressed
PASS
All text resources are compressed
Info::
✓
All text resources are compressed
All text resources are properly compressed.
A+
JS Execution Cost
385ms total JS execution
PASS
385ms total JS execution
Info::
i
https://www.gstatic.com/recaptcha/releases/Br0hYqp...: 185ms CPU time
Info::
i
https://bankofkhartoum.com/: 69ms CPU time
Info::
i
https://bankofkhartoum.com/umoajupt/assets/js/jque...: 66ms CPU time
1 font(s) use font-display: swap (FOUT risk but functional)
Web fonts
1
35 KB total
Render-blocking
0
of 1
Dominant font-display
swap
Most common across fonts
Font loading timeline
TransferFOIT (block)FOUT (swap)
JTUSjIg1_i6t8kCHKm459Wl...woff2swap
Size35 KB
Load time81 ms
Start392 ms
RiskFOUT — text flashes from fallback to web font
Optimization checklist
Preload critical fonts (priority=high)
Use woff2 format for all fonts
Set font-display to swap, optional, or fallback
Subset large fonts (≤100 KB each)
A+
Resource Caching
All resources properly cached
PASS
All resources properly cached
Info::
✓
No caching issues found
All static resources have appropriate caching headers.
A+
Critical Rendering Path
No render-blocking resources
PASS
No render-blocking resources
Info::
✓
No render-blocking resources detected
A+
Resource Hints
No optimization needed
PASS
No optimization needed
Info::
✓
No resource hint issues
A+
LCP Image Preload
LCP preload audit not available
PASS
LCP preload audit not available
Info::
✓
LCP image preload audit not available for this scan
A+
Server Response Intelligence
2 server-response signal(s) detected
PASS
2 server-response signal(s) detected
Info::
✓
`Vary` header declared: Accept-Encoding
The page declares a `Vary` header, telling downstream caches which request headers the response varies on. Critical for content-negotiated responses (compression, language, cookies, device class).
Info::
i
No `ETag` or `Last-Modified` -- conditional GET not supported
Without either header, browsers can't issue conditional GETs and refresh always re-downloads the full response body even when nothing changed. Add `ETag: "<hash>"` (or `Last-Modified: <date>`) on cacheable responses; the server returns 304 Not Modified when the client's cached copy is still valid, saving bandwidth.
Network Waterfall
45 requests over 1776ms
INFO
HTML JavaScript CSS Images Fonts XHR/Fetch Other
Third-Party Script Cost
Per-script blocking time, transfer cost, and cache headers
INFO
48%of JavaScript execution is third-party
First-party Third-party185ms · 0KB · €2/mo
Script
Category
Execution
Transfer
Unused
Monthly Cost
Verdict
www.gstatic.com
www.gstatic.com
Other
185ms
0 KB
48%
€2/mo
Optional
www.gstatic.com
Other
Optional
Execution185ms
Transfer0 KB
Unused48%
Monthly Cost€2/mo
48% of JavaScript execution time comes from third-party scripts.
Why this matters
Third-party scripts (analytics, ads, social, A/B testing) often dominate execution time — every one is a perf-and-privacy tax.
Learn more ▾▴
Each third-party script is a black box: you don't control when it loads, what it executes, or how much it grows. They often account for a major share of total blocking time on average sites (HTTP Archive's Web Almanac documents the trend). Audit which ones you actually need, defer the rest, and use facade patterns (lite-youtube, lite-vimeo) for embedded media.
375 ms
750 ms
1.1 s
1.5 s