Intentional for dynamic content, but increases server load for every page view.
Got: no-cache, no-store, must-revalidate
Info::
i
No ETag or Last-Modified header
Conditional requests (304 Not Modified) are not possible without validators.
Cache-Control
no-cache, no-store, must-revalidate
Directive
Value
Meaning
no-cache
—
Cache but always revalidate first
no-store
—
Never cache this response
must-revalidate
—
Must recheck with server after expiry
C
Image Optimization
Action
43 images, 0 KB saveable
REVIEW
43 images, 0 KB saveable
Warning::
!
https://iol-website.italiaonline.it/site-resources... is missing width/height — may cause layout shift
Set explicit width and height to prevent CLS.
Warning::
!
https://iol-website.italiaonline.it/site-resources... is missing width/height — may cause layout shift
Set explicit width and height to prevent CLS.
Warning::
!
https://iol-website.italiaonline.it/site-resources... is missing width/height — may cause layout shift
Set explicit width and height to prevent CLS.
43images2.0 MB
0oversized-0 KB
8legacy format
3missing dimensionsCLS risk
Set explicit width and height to prevent CLS.
Why this matters
Image without explicit width/height — browser can't reserve space; CLS jumps when image loads.
Source: web.dev / Core Web Vitals
Set explicit width and height to prevent CLS.
Why this matters
Image without explicit width/height — browser can't reserve space; CLS jumps when image loads.
Source: web.dev / Core Web Vitals
Set explicit width and height to prevent CLS.
Why this matters
Image without explicit width/height — browser can't reserve space; CLS jumps when image loads.
Source: web.dev / Core Web Vitals
B
HTTP/3 (QUIC)
HTTP/3 not advertised
REVIEW
HTTP/3 not advertised
Info::
i
HTTP/3 (QUIC) is not advertised
HTTP/3 isn't advertised via Alt-Svc and the worker didn't negotiate h3. HTTP/3 reduces handshake latency (1-RTT instead of 2-3 RTTs) and is more resilient on lossy connections. Most modern CDNs (Cloudflare, Fastly, AWS CloudFront, Google Cloud CDN) support HTTP/3 with a single config switch -- consider enabling for mobile-heavy workloads.
C
Document Compression
Action
Document response served uncompressed
REVIEW
Document response served uncompressed
Info::
i
Main HTML response has no Content-Encoding (uncompressed)
The main HTML document is served without compression. The Text Compression section above lists the broader picture; for the main response specifically, even gzip would shave ~70-80% off most text payloads.
B
Asset Compression
2 of 3 asset hosts still on gzip
REVIEW
2 of 3 asset hosts still on gzip
Info::
✓
irp.cdn-website.com serves assets with brotli (assets: 17)
Got: irp.cdn-website.com (text/css)
Info::
i
iol-website.italiaonline.it serves assets with gzip; brotli would be ~20% smaller (assets: 10)
Every current browser accepts brotli. On a CDN this is a per-pull-zone toggle (Cloudflare, Fastly, CloudFront, CDN77, Bunny all expose it); on an origin it needs the brotli module (nginx-brotli, Apache mod_brotli). The saving lands on the assets this host serves, not on the HTML document -- the document's own encoding is reported separately.
static.cdn-website.com serves assets with gzip; brotli would be ~20% smaller (assets: 3)
Every current browser accepts brotli. On a CDN this is a per-pull-zone toggle (Cloudflare, Fastly, CloudFront, CDN77, Bunny all expose it); on an origin it needs the brotli module (nginx-brotli, Apache mod_brotli). The saving lands on the assets this host serves, not on the HTML document -- the document's own encoding is reported separately.
Got: static.cdn-website.com (text/css)
B
Server-Timing Observability
No Server-Timing header found
REVIEW
No Server-Timing header found
Info::
i
No Server-Timing header found
Server-Timing exposes backend timing breakdowns to browser DevTools (e.g., `db: 45ms; render: 120ms; cache: 2ms`). Useful for diagnosing slow pages without backend log access. Most modern frameworks (Next.js, Cloudflare Workers, Fastly) emit it automatically; absence on a managed platform usually means telemetry headers are stripped at the edge.
B
JavaScript Blocking
1 JS blocking issue(s) detected
REVIEW
1 JS blocking issue(s) detected
Warning::
!
6 render-blocking <script src> tag(s) without async/defer
Each `<script src=...>` without `async`, `defer`, or `type="module"` blocks HTML parsing while the browser fetches and executes it. The block lasts the entire round-trip + execution time -- on slow networks this translates directly into LCP delay. Add `defer` (executes after parse, in source order) for scripts that interact with the DOM, or `async` (executes whenever ready) for analytics / independent scripts. Module scripts (`type="module"`) are deferred by default.
Each `<link rel="stylesheet">` without a non-blocking `media` attribute holds up the first paint. Browsers download all of them before painting any content. Consolidate into 1-2 critical-path stylesheets; defer non-critical CSS via `<link rel="stylesheet" media="print" onload="this.media='all'">` or via the loadCSS pattern; inline above-the-fold CSS in `<style>` to short-circuit the request entirely.
Warning::
!
2 `@font-face` rule(s) without `font-display` -- causes FOIT
An `@font-face` rule without `font-display` causes Flash of Invisible Text (FOIT): the browser hides the styled text for up to 3 seconds while the custom font downloads, then either swaps to fallback (Chrome / Firefox) or stays invisible (older Safari). Add `font-display: swap` (shows fallback immediately, swaps in the custom font when ready) or `font-display: optional` (uses fallback if the font isn't ready in 100ms; never causes visible swap). Either eliminates FOIT outright.
C
Green Hosting
Action
Whether the site is served from green-energy infrastructure
REVIEW
Green Hosting
No green hosting detected
A+
Text Compression
All text resources are compressed
PASS
All text resources are compressed
Info::
✓
All text resources are compressed
All text resources are properly compressed.
A+
Font Loading
5 fonts (41 KB)
PASS
5 fonts (41 KB)
Info::
i
5 font(s) use font-display: swap (FOUT risk but functional)
Web fonts
5
41 KB total
Render-blocking
0
of 5
Dominant font-display
swap
Most common across fonts
Font loading timeline
TransferFOIT (block)FOUT (swap)
pxiEyp8kv8JHgFVrJJfecg....woff2swap
Size8 KB
Load time49 ms
Start507 ms
RiskFOUT — text flashes from fallback to web font
pxiByp8kv8JHgFVrLCz7Z1x...woff2swap
Size8 KB
Load time51 ms
Start507 ms
RiskFOUT — text flashes from fallback to web font
pxiByp8kv8JHgFVrLEj6Z1x...woff2swap
Size8 KB
Load time53 ms
Start508 ms
RiskFOUT — text flashes from fallback to web font
pxiByp8kv8JHgFVrLDz8Z1x...woff2swap
Size8 KB
Load time56 ms
Start508 ms
RiskFOUT — text flashes from fallback to web font
pxiGyp8kv8JHgFVrJJLucHt...woff2swap
Size9 KB
Load time67 ms
Start509 ms
RiskFOUT — text flashes from fallback to web font
Optimization checklist
Preload critical fonts (priority=high)
Use woff2 format for all fonts
Set font-display to swap, optional, or fallback
Subset large fonts (≤100 KB each)
A+
Resource Caching
All resources properly cached
PASS
All resources properly cached
Info::
✓
No caching issues found
All static resources have appropriate caching headers.
A+
Critical Rendering Path
No render-blocking resources
PASS
No render-blocking resources
Info::
✓
No render-blocking resources detected
A+
Resource Hints
3 hints, 0 missing preconnects
PASS
3 hints, 0 missing preconnects
Info::
i
1 URL(s) appear in multiple hints
The same href shouldn't appear in multiple hint rels -- one wins, the others are wasted markup and may confuse cache behavior. Sample: https://irp.cdn-website.com (preconnect+preconnect).
Info::
✓
Page uses 3 resource hint(s)
Current Resource Hints
preconnect
3
preload—
dns-prefetch—
prefetch—
3 resource hints configured
The same href shouldn't appear in multiple hint rels -- one wins, the others are wasted markup and may confuse cache behavior. Sample: https://irp.cdn-website.com (preconnect+preconnect).
Why this matters
Performance issues directly impact user engagement and conversion rates.
A+
LCP Image Preload
LCP preload audit not available
PASS
LCP preload audit not available
Info::
✓
LCP image preload audit not available for this scan
A+
Main HTML Cache-Control
Main HTML uses no-store -- correct for sensitive/dynamic content
PASS
Main HTML uses no-store -- correct for sensitive/dynamic content
Info::
✓
Main HTML uses no-store -- correct for sensitive/dynamic content
Got: no-cache, no-store, must-revalidate
A+
Server Response Intelligence
1 server-response signal(s) detected
PASS
1 server-response signal(s) detected
Info::
i
No `ETag` or `Last-Modified` -- conditional GET not supported
Without either header, browsers can't issue conditional GETs and refresh always re-downloads the full response body even when nothing changed. Add `ETag: "<hash>"` (or `Last-Modified: <date>`) on cacheable responses; the server returns 304 Not Modified when the client's cached copy is still valid, saving bandwidth.
A+
Render-Blocking Resources
No render-blocking resources detected
PASS
No render-blocking resources detected
Info::
✓
No render-blocking resources detected in <head>
A+
Third-Party Resources
No third-party resources detected
PASS
No third-party resources detected
Network Waterfall
110 requests over 3443ms
INFO
HTML JavaScript CSS Images Fonts XHR/Fetch Other
Third-Party Script Cost
Per-script blocking time, transfer cost, and cache headers
INFO
83%of JavaScript execution is third-party
First-party Third-party2687ms · 532KB · €26/mo
Script
Category
Execution
Transfer
Unused
Monthly Cost
Verdict
www.farmaciamarotta.com
www.farmaciamarotta.com
Other
996ms
37 KB
—
€10/mo
Costly
iol-website.italiaonline.it
iol-website.italiaonline.it
Other
324ms
13 KB
—
€3/mo
Costly
consent.cookiebot.com
consent.cookiebot.com
Other
286ms
116 KB
23%
€3/mo
Costly
Google Tag Manager
www.googletagmanager.com
Tag Manager
266ms
188 KB
40%
€3/mo
Costly
static.cdn-website.com
static.cdn-website.com
Other
266ms
101 KB
62%
€3/mo
Costly
consent.cookiebot.com
consent.cookiebot.com
Other
204ms
37 KB
—
€2/mo
Costly
static.cdn-website.com
static.cdn-website.com
Other
167ms
15 KB
—
€2/mo
Optional
static.cdn-website.com
static.cdn-website.com
Other
71ms
4 KB
—
€1/mo
Optional
static.cdn-website.com
static.cdn-website.com
Other
56ms
2 KB
—
€1/mo
Optional
static.cdn-website.com
static.cdn-website.com
Other
50ms
20 KB
—
€0/mo
Optional
www.farmaciamarotta.com
Other
Costly
Execution996ms
Transfer37 KB
Monthly Cost€10/mo
iol-website.italiaonline.it
Other
Costly
Execution324ms
Transfer13 KB
Monthly Cost€3/mo
consent.cookiebot.com
Other
Costly
Execution286ms
Transfer116 KB
Unused23%
Monthly Cost€3/mo
Google Tag Manager
Tag Manager
Costly
Execution266ms
Transfer188 KB
Unused40%
Monthly Cost€3/mo
static.cdn-website.com
Other
Costly
Execution266ms
Transfer101 KB
Unused62%
Monthly Cost€3/mo
consent.cookiebot.com
Other
Costly
Execution204ms
Transfer37 KB
Monthly Cost€2/mo
static.cdn-website.com
Other
Optional
Execution167ms
Transfer15 KB
Monthly Cost€2/mo
static.cdn-website.com
Other
Optional
Execution71ms
Transfer4 KB
Monthly Cost€1/mo
static.cdn-website.com
Other
Optional
Execution56ms
Transfer2 KB
Monthly Cost€1/mo
static.cdn-website.com
Other
Optional
Execution50ms
Transfer20 KB
Monthly Cost€0/mo
These scripts may cost more than they're worth
www.farmaciamarotta.com adds 996ms and costs ~€10/month
iol-website.italiaonline.it adds 324ms and costs ~€3/month
consent.cookiebot.com adds 286ms and costs ~€3/month
Google Tag Manager adds 266ms and costs ~€3/month
static.cdn-website.com adds 266ms and costs ~€3/month
consent.cookiebot.com adds 204ms and costs ~€2/month
83% of JavaScript execution time is spent on third-party scripts. Consider auditing which scripts are essential.
Why this matters
When third-party JS execution time exceeds your own, performance gains from frontend work are capped by code you don't own.
Learn more ▾▴
Every millisecond of third-party JS competes with your own for main-thread time. If their share is bigger than yours, optimization on your code base barely moves the needle. Audit, defer, or remove third-parties before further frontend optimization. Use Lighthouse's third-party audit to identify the worst offenders.
Source: web.dev
www.farmaciamarotta.com takes 996ms of CPU time. Consider loading it asynchronously or replacing it with a lighter alternative.
Why this matters
This script has high main-thread execution time — optimize hot paths or defer.
Source: web.dev
iol-website.italiaonline.it takes 324ms of CPU time. Consider loading it asynchronously or replacing it with a lighter alternative.
Why this matters
This script has high main-thread execution time — optimize hot paths or defer.
Source: web.dev
consent.cookiebot.com takes 286ms of CPU time. Consider loading it asynchronously or replacing it with a lighter alternative.
Why this matters
This script has high main-thread execution time — optimize hot paths or defer.
Source: web.dev
Google Tag Manager takes 266ms of CPU time. Consider loading it asynchronously or replacing it with a lighter alternative.
Why this matters
This script has high main-thread execution time — optimize hot paths or defer.
Source: web.dev
static.cdn-website.com takes 266ms of CPU time. Consider loading it asynchronously or replacing it with a lighter alternative.
Why this matters
This script has high main-thread execution time — optimize hot paths or defer.
Source: web.dev
62% of static.cdn-website.com's code is unused. The script may be loading features you don't use.
Why this matters
Bundle has high unused-code ratio — tree-shaking and route-splitting recover the wasted bytes.
Source: web.dev
consent.cookiebot.com takes 204ms of CPU time. Consider loading it asynchronously or replacing it with a lighter alternative.
Why this matters
This script has high main-thread execution time — optimize hot paths or defer.