Skip to content

Changes

https://www.mossandmolt.com
Compared to previous audit · 5 hours ago View previous audit
21
New issues
29
Resolved
17
score changes
CategoryPreviousCurrentChange
CompositeB (83)B (84) +1.000
PerformanceB (89)B (87) -2.000
SecurityC (78)B (82) +4.000
AccessibilityC (79)C (79)—
SEOA (91)A (91)—
InfrastructureB (86)B (86)—
ComplianceC (74)B (83) +9.000
ContentB (86)B (85) -1.000
SustainabilityB (85)B (85)—
MetricPreviousCurrentChange
Performance 32003100 -100
Accessibility 1000010000—
Best Practices 1000010000—
SEO 92009200—
PWA 00—
Desktop Performance 85008800 +300
Desktop Accessibility 97009700—
Desktop Best Practices 1000010000—
Desktop SEO 92009200—
FCP 5.01 s5.07 s +63 ms
LCP 11.50 s12.40 s +899 ms
TBT 336 ms350 ms +14 ms
CLS 0.3520.352—
Desktop FCP 698 ms748 ms +50 ms
Desktop LCP 1.59 s1.19 s -395 ms
Desktop TBT 0 ms0 ms—
Desktop CLS 0.0780.078—
TTFB †524 ms139 ms -385 ms
DNS †1 ms74 ms +74 ms
TLS †25 ms24 ms -1 ms
Connect †17 ms17 ms -0 ms
Total †560 ms139 ms -421 ms

† Timing metrics may vary by worker location and do not necessarily indicate site changes.

CRITICAL Content-Security-Policy header is missing security
CRITICAL Canonical target returns 403 seo
CRITICAL 196 of 200 links are healthy content
CRITICAL HSTS header is missing security
WARNING Page weight 3.2 MB exceeds 1 MB target by 2.2 MB performance
WARNING JavaScript is 645 KB — consider code splitting or lazy loading performance
WARNING https://www.mossandmolt.com/cdn/shop/t/18/assets/m...: 517ms CPU time performance
WARNING Page weighs 5.2 MB (3.2 MB transferred) performance
WARNING 449 HTTP requests — consider bundling or reducing performance
WARNING https://www.mossandmolt.com/: 5027ms CPU time performance
WARNING https://www.mossandmolt.com/cdn/wpm/b610a19cewf693...: 800ms CPU time performance
WARNING https://cdn.shopify.com/extensions/01a19ad6-3b93-7...: 625ms CPU time performance
WARNING Total JS execution time is 9.2 s -- over the 3.5s budget performance
WARNING Unexpected status code: HTTP 403 accessibility
WARNING 22 render-blocking stylesheet(s) -- recommended: <=3 performance
WARNING 1 `@font-face` rule(s) without `font-display` -- causes FOIT performance
WARNING 0.75g CO2 — above the median website (0.60g) sustainability
WARNING Compressed response missing `Vary` header performance
WARNING Broken link: https://www.mossandmolt.com/.well-known/ucp content
WARNING Unattributable: 1362ms CPU time performance
WARNING Broken link: https://www.mossandmolt.com/checkouts/internal/preloads.j... content
CRITICAL Canonical target returns 429 seo
CRITICAL Cookie 'localization' is missing the Secure flag security
CRITICAL Cookie 'cart_currency' is missing the Secure flag security
WARNING Referrer-Policy header is missing security
WARNING https://www.mossandmolt.com/cdn/shop/t/18/assets/m...: 495ms CPU time performance
WARNING default-src directive is missing security
WARNING base-uri directive is missing security
WARNING 249 inline style attribute(s) detected security
WARNING Page weighs 5.2 MB (3.0 MB transferred) performance
WARNING 5 unclassified cookie(s) set before any consent step compliance
WARNING Page weight 3.0 MB exceeds 1 MB target by 2.0 MB performance
WARNING 198 of 200 links are healthy content
WARNING No Permissions-Policy header security
WARNING 435 HTTP requests — consider bundling or reducing performance
WARNING https://www.mossandmolt.com/cdn/wpm/b610a19cewf693...: 625ms CPU time performance
WARNING 0.72g CO2 — above the median website (0.60g) sustainability
WARNING Cross-Origin-Embedder-Policy header is missing security
WARNING Unexpected status code: HTTP 429 accessibility
WARNING https://www.mossandmolt.com/: 4499ms CPU time performance
WARNING https://cdn.shopify.com/extensions/01a18d57-d208-7...: 585ms CPU time performance
WARNING GDPR Article 13 disclosure coverage: 0 / 8 categories compliance
WARNING form-action directive is missing security
WARNING Cookie 'localization' is missing the HttpOnly flag security
WARNING JavaScript is 587 KB — consider code splitting or lazy loading performance
WARNING Unattributable: 1251ms CPU time performance
WARNING HSTS is enabled but max-age is short (7889238s, should be >= 31536000s) security
WARNING Permissions-Policy header is missing security
WARNING Cross-Origin-Opener-Policy header is missing security
WARNING Cookie 'cart_currency' is missing the HttpOnly flag security
CRITICAL 2 link(s) with no accessible text accessibility
CRITICAL 10 publicly-accessible JavaScript source map(s) security
WARNING External script from cdn.shopify.com lacks integrity attribute security
WARNING External link from cdn.shopify.com lacks integrity attribute security
WARNING Registrar lock is NOT enabled infrastructure
WARNING No accessibility statement detected compliance
WARNING 3 link(s) with generic text accessibility
WARNING 24 link(s) open in new tab without warning accessibility
WARNING Images are 1.1 MB — compress or use modern formats performance
WARNING 1 link(s) open in a new tab without rel=noopener security
WARNING GraphQL introspection enabled at /api/graphql security
WARNING <iframe> missing title attribute (src="https://www.mossandmolt.com/web-pixels@610a19cewf693d529pf324840bm6169d9b4/cust…") accessibility
WARNING No favicon.ico at site root accessibility
WARNING Missing og:image content
WARNING 2 Organization blocks on the page -- only one should describe the publishing entity content
WARNING 24 images missing explicit width/height content
WARNING 2 above-fold image(s) marked loading="lazy" (LCP anti-pattern) content
WARNING Broken link: https://www.mossandmolt.com/ content
WARNING Broken link: https://monorail-edge.shopifysvc.com content
WARNING No DMARC record found security
WARNING https://www.mossandmolt.com/cdn/wpm/b610a19cewf693...: 35 KB unused (42%) performance
WARNING CNAME record at zone apex infrastructure
WARNING SRI adoption: 1/26 third-party resources protected (3%) security
WARNING Missing required property "name" for Organization content
WARNING Total image weight: 1196 KB (1.2 MB) content
WARNING Heading level skipped: H2 → H4 (missing H3) accessibility
+ permissions-policy accelerometer=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(...
+ critical-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, ...
+ cross-origin-opener-policy same-origin
+ cf-mitigated challenge
+ origin-agent-cluster ?1
+ cross-origin-resource-policy same-origin
+ referrer-policy same-origin
+ cross-origin-embedder-policy require-corp
− cache-control private, max-age=0, must-revalidate
− x-dc gcp-europe-west1,gcp-europe-west1,gcp-europe-west1
− shopify-complexity-score 4100
− strict-transport-security max-age=7889238
− shopify-complexity-score-v2 410
− link <https://cdn.shopify.com>; rel="preconnect", <https://cdn.shopify.com>; rel="...
− powered-by Shopify
− etag "page_cache:85653029085:IndexController:aa566edf63bf4804bcb54246c06af39d:895c...
− cdn-cache-control no-cache, no-store
− content-language en-US
− cf-cache-status DYNAMIC
− content-security-policy block-all-mixed-content; frame-ancestors 'none'; upgrade-insecure-requests;
− set-cookie localization=US; path=/; expires=Tue, 02 Nov 2027 01:45:07 GMT; SameSite=Lax,...
− content-length 201182
− product-filtering-backend bitset_roaring
− vary accept-encoding
x-frame-options
DENY → SAMEORIGIN
content-type
text/html; charset=utf-8 → text/html; charset=UTF-8
accept-ch
Sec-CH-Viewport-Width → Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, ...

7 headers unchanged

− HSTS Security

14 technologies unchanged

Looking ahead

+14 pts
B (84) Could reach A+ (98)
Accessibility +20Security +18Content +15Performance +13SEO +9Infrastructure +8Compliance +4Sustainability +4

Estimate — actual results may vary (47 issues to fix)

Website improvement report — Mossandmolt

November 2, 2026 → November 2, 2026

B B 83 → 84 +1 pts

29

Resolved

21

New issues

26

Still remaining

Financial summary

Investment delivered

€2,699 in development time

Investment remaining

€4,597 to complete the remaining items

Ongoing risk

€1/month in ongoing exposure

Figures are estimates based on local developer hourly rate, industry CPC, and regulatory fine ranges.

Performance by category

MetricBeforeAfterChange
Overall score83 (B)84 (B)+1
Performance89 (B)87 (B)-2
Security78 (C)82 (B)+4
Accessibility79 (C)79 (C)0
SEO91 (A)91 (A)0
Infrastructure86 (B)86 (B)0
Compliance74 (C)83 (B)+9
Content86 (B)85 (B)-1
Sustainability85 (B)85 (B)0

Resolved (29)

  • Referrer-Policy header is missing (Security)

    → Reduced attack surface for visitors

  • https://www.mossandmolt.com/cdn/shop/t/18/assets/m...: 495ms CPU time (Performance)

    → Page loads faster for users

  • Canonical target returns 429 (SEO)

    → Better search engine visibility

  • default-src directive is missing (Security)

    → Reduced attack surface for visitors

  • base-uri directive is missing (Security)

    → Reduced attack surface for visitors

  • 249 inline style attribute(s) detected (Security)

    → Reduced attack surface for visitors

  • Page weighs 5.2 MB (3.0 MB transferred) (Performance)

    → Page loads faster for users

  • 5 unclassified cookie(s) set before any consent step (Compliance)

    → Reduced regulatory exposure

  • Page weight 3.0 MB exceeds 1 MB target by 2.0 MB (Performance)

    → Page loads faster for users

  • 198 of 200 links are healthy (Content)

    → Stronger social sharing and on-page quality

  • No Permissions-Policy header (Security)

    → Reduced attack surface for visitors

  • 435 HTTP requests — consider bundling or reducing (Performance)

    → Page loads faster for users

  • https://www.mossandmolt.com/cdn/wpm/b610a19cewf693...: 625ms CPU time (Performance)

    → Page loads faster for users

  • 0.72g CO2 — above the median website (0.60g) (Sustainability)

    → Lower carbon footprint per page view

  • Cross-Origin-Embedder-Policy header is missing (Security)

    → Reduced attack surface for visitors

…and 14 more resolved issue(s)

Recommended next steps (47)

  • Sprint 2

    Content-Security-Policy header is missing (Security)

  • Sprint 1

    Canonical target returns 403 (SEO)

  • Sprint 1

    196 of 200 links are healthy (Content)

  • Sprint 1

    HSTS header is missing (Security)

  • Sprint 1

    2 link(s) with no accessible text (Accessibility)

  • Sprint 1

    10 publicly-accessible JavaScript source map(s) (Security)

  • Sprint 2

    Page weight 3.2 MB exceeds 1 MB target by 2.2 MB (Performance)

  • Sprint 3

    JavaScript is 645 KB — consider code splitting or lazy loading (Performance)

  • Sprint 1

    https://www.mossandmolt.com/cdn/shop/t/18/assets/m...: 517ms CPU time (Performance)

  • Sprint 1

    Page weighs 5.2 MB (3.2 MB transferred) (Performance)

  • Sprint 2

    449 HTTP requests — consider bundling or reducing (Performance)

  • Sprint 1

    https://www.mossandmolt.com/: 5027ms CPU time (Performance)

  • Sprint 1

    https://www.mossandmolt.com/cdn/wpm/b610a19cewf693...: 800ms CPU time (Performance)

  • Sprint 1

    https://cdn.shopify.com/extensions/01a19ad6-3b93-7...: 625ms CPU time (Performance)

  • Sprint 2

    Total JS execution time is 9.2 s -- over the 3.5s budget (Performance)

…and 32 more recommended item(s)

Send Feedback