Skip to content

Changes

https://www.mossandmolt.com
Compared to previous audit · 11 hours ago View previous audit
20
New issues
27
Resolved
19
score changes
CategoryPreviousCurrentChange
CompositeB (84)B (84)—
PerformanceB (88)B (87) -1.000
SecurityC (78)B (82) +4.000
AccessibilityB (80)C (78) -2.000
SEOA (93)A (91) -2.000
InfrastructureB (89)B (86) -3.000
ComplianceC (74)B (83) +9.000
ContentB (86)B (85) -1.000
SustainabilityB (81)B (81)—
MetricPreviousCurrentChange
Performance 54005200 -200
Accessibility 1000010000—
Best Practices 1000010000—
SEO 92009200—
PWA 00—
Desktop Performance 92009500 +300
Desktop Accessibility 97009700—
Desktop Best Practices 1000010000—
Desktop SEO 92009200—
FCP 5.17 s5.10 s -64 ms
LCP 13.83 s13.78 s—
TBT 234 ms302 ms +68 ms
CLS 0.0000.000—
Desktop FCP 726 ms728 ms—
Desktop LCP 1.65 s1.30 s -353 ms
Desktop TBT 4 ms7 ms +4 ms
Desktop CLS 0.0300.040 +0.011
TTFB †971 ms82 ms -888 ms
DNS †77 ms1 ms -76 ms
TLS †23 ms29 ms +6 ms
Connect †17 ms17 ms -0 ms
Total †1.01 s83 ms -925 ms

† Timing metrics may vary by worker location and do not necessarily indicate site changes.

CRITICAL Canonical target returns 403 seo
CRITICAL 196 of 200 links are healthy content
CRITICAL Content-Security-Policy header is missing security
CRITICAL HSTS header is missing security
WARNING <iframe> missing title attribute (src="https://www.mossandmolt.com/web-pixels@02d13049w588a3a08pb529f9b2m27ddd415/cust…") accessibility
WARNING https://www.mossandmolt.com/: 4554ms CPU time performance
WARNING Broken link: https://www.mossandmolt.com/checkouts/internal/preloads.j... content
WARNING Unattributable: 1609ms CPU time performance
WARNING JavaScript is 595 KB — consider code splitting or lazy loading performance
WARNING 438 HTTP requests — consider bundling or reducing performance
WARNING https://www.mossandmolt.com/cdn/wpm/b02d13049w588a...: 1071ms CPU time performance
WARNING 1 `@font-face` rule(s) without `font-display` -- causes FOIT performance
WARNING Unexpected status code: HTTP 403 accessibility
WARNING https://cdn.shopify.com/extensions/01a19f7d-4422-7...: 673ms CPU time performance
WARNING Broken link: https://www.mossandmolt.com/.well-known/ucp content
WARNING https://www.mossandmolt.com/cdn/shop/t/18/assets/m...: 439ms CPU time performance
WARNING Compressed response missing `Vary` header performance
WARNING https://www.mossandmolt.com/cdn/wpm/b02d13049w588a...: 38 KB unused (45%) performance
WARNING Total JS execution time is 9.4 s -- over the 3.5s budget performance
WARNING 22 render-blocking stylesheet(s) -- recommended: <=3 performance
CRITICAL Canonical target returns 429 seo
CRITICAL Cookie 'localization' is missing the Secure flag security
CRITICAL Cookie 'cart_currency' is missing the Secure flag security
WARNING <iframe> missing title attribute (src="https://www.mossandmolt.com/web-pixels@610a19cewf693d529pf324840bm6169d9b4/cust…") accessibility
WARNING 421 HTTP requests — consider bundling or reducing performance
WARNING https://cdn.shopify.com/extensions/01a19f7d-4422-7...: 610ms CPU time performance
WARNING https://www.mossandmolt.com/cdn/shop/t/18/assets/m...: 386ms CPU time performance
WARNING 5 unclassified cookie(s) set before any consent step compliance
WARNING HSTS is enabled but max-age is short (7889238s, should be >= 31536000s) security
WARNING Cookie 'localization' is missing the HttpOnly flag security
WARNING 156 inline style attribute(s) detected security
WARNING Cross-Origin-Opener-Policy header is missing security
WARNING base-uri directive is missing security
WARNING Cookie 'cart_currency' is missing the HttpOnly flag security
WARNING Cross-Origin-Embedder-Policy header is missing security
WARNING https://www.mossandmolt.com/cdn/wpm/b610a19cewf693...: 663ms CPU time performance
WARNING https://www.mossandmolt.com/cdn/wpm/b610a19cewf693...: 38 KB unused (45%) performance
WARNING GDPR Article 13 disclosure coverage: 0 / 8 categories compliance
WARNING default-src directive is missing security
WARNING form-action directive is missing security
WARNING Referrer-Policy header is missing security
WARNING No Permissions-Policy header security
WARNING 198 of 200 links are healthy content
WARNING Permissions-Policy header is missing security
WARNING JavaScript is 653 KB — consider code splitting or lazy loading performance
WARNING https://www.mossandmolt.com/: 4018ms CPU time performance
WARNING Unattributable: 1340ms CPU time performance
CRITICAL 2 link(s) with no accessible text accessibility
CRITICAL 10 publicly-accessible JavaScript source map(s) security
WARNING Missing og:image content
WARNING 21 images missing explicit width/height content
WARNING External script from cdn.shopify.com lacks integrity attribute security
WARNING Registrar lock is NOT enabled infrastructure
WARNING Broken link: https://www.mossandmolt.com/ content
WARNING 2 Organization blocks on the page -- only one should describe the publishing entity content
WARNING 4 images significantly larger than display size content
WARNING Total image weight: 1444 KB (1.4 MB) content
WARNING 1 link(s) open in a new tab without rel=noopener security
WARNING SRI adoption: 1/26 third-party resources protected (3%) security
WARNING GraphQL introspection enabled at /api/graphql security
WARNING No DMARC record found security
WARNING Heading level skipped: H2 → H4 (missing H3) accessibility
WARNING No favicon.ico at site root accessibility
WARNING No accessibility statement detected compliance
WARNING 24 link(s) open in new tab without warning accessibility
WARNING Page weighs 5.8 MB (3.7 MB transferred) performance
WARNING Page weight 3.7 MB exceeds 1 MB target by 2.7 MB performance
WARNING Broken link: https://monorail-edge.shopifysvc.com content
WARNING Missing required property "name" for Organization content
WARNING Images are 1.8 MB — compress or use modern formats performance
WARNING 0.88g CO2 — above the median website (0.60g) sustainability
WARNING 3 link(s) with generic text accessibility
WARNING External link from cdn.shopify.com lacks integrity attribute security
WARNING Multiple H1 headings (2 found) accessibility
WARNING CNAME record at zone apex infrastructure
+ cross-origin-resource-policy same-origin
+ cross-origin-embedder-policy require-corp
+ referrer-policy same-origin
+ cross-origin-opener-policy same-origin
+ permissions-policy accelerometer=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(...
+ cf-mitigated challenge
+ critical-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, ...
+ origin-agent-cluster ?1
− cache-control private, max-age=0, must-revalidate
− shopify-complexity-score-v2 797
− vary accept-encoding
− cdn-cache-control no-cache, no-store
− content-security-policy block-all-mixed-content; frame-ancestors 'none'; upgrade-insecure-requests;
− cf-cache-status DYNAMIC
− strict-transport-security max-age=7889238
− etag "sfr:computation:v2:ff158fbc0e47fae5fcbfa2348c5e8fafe70d77afb485aa89b14daf65d...
− set-cookie _shopify_essential=:AaGgSaFUAAEAV-_kJCzN9RARSlT9ogw69jFn9O8p35yVAOoUj9lhsC_6l...
− content-language en-US
− link <https://cdn.shopify.com>; rel="preconnect", <https://cdn.shopify.com>; rel="...
− product-filtering-backend bitset_roaring
− powered-by Shopify
− shopify-complexity-score 7970
− x-dc gcp-europe-west1,gcp-europe-west1,gcp-europe-west1
− content-length 202129
x-frame-options
DENY → SAMEORIGIN
content-type
text/html; charset=utf-8 → text/html; charset=UTF-8
accept-ch
Sec-CH-Viewport-Width → Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, ...

7 headers unchanged

− HSTS Security

14 technologies unchanged

Looking ahead

+14 pts
B (84) Could reach A+ (98)
Accessibility +22Security +18Content +15Performance +13SEO +9Infrastructure +8Compliance +4Sustainability +4

Estimate — actual results may vary (48 issues to fix)

Website improvement report — Mossandmolt

November 3, 2026 → November 3, 2026

B B 84 → 84 0 pts

27

Resolved

20

New issues

28

Still remaining

Financial summary

Investment delivered

€2,621 in development time

Investment remaining

€4,767 to complete the remaining items

Ongoing risk

€1/month in ongoing exposure

Figures are estimates based on local developer hourly rate, industry CPC, and regulatory fine ranges.

Performance by category

MetricBeforeAfterChange
Overall score84 (B)84 (B)0
Performance88 (B)87 (B)-1
Security78 (C)82 (B)+4
Accessibility80 (B)78 (C)-2
SEO93 (A)91 (A)-2
Infrastructure89 (B)86 (B)-3
Compliance74 (C)83 (B)+9
Content86 (B)85 (B)-1
Sustainability81 (B)81 (B)0

Resolved (27)

  • <iframe> missing title attribute (src="https://www.mossandmolt.com/web-pixels@610a19cewf693d529pf324840bm6169d9b4/cust…") (Accessibility)

    → Improved usability for assistive technology users

  • 421 HTTP requests — consider bundling or reducing (Performance)

    → Page loads faster for users

  • https://cdn.shopify.com/extensions/01a19f7d-4422-7...: 610ms CPU time (Performance)

    → Page loads faster for users

  • https://www.mossandmolt.com/cdn/shop/t/18/assets/m...: 386ms CPU time (Performance)

    → Page loads faster for users

  • 5 unclassified cookie(s) set before any consent step (Compliance)

    → Reduced regulatory exposure

  • HSTS is enabled but max-age is short (7889238s, should be >= 31536000s) (Security)

    → Reduced attack surface for visitors

  • Cookie 'localization' is missing the HttpOnly flag (Security)

    → Reduced attack surface for visitors

  • 156 inline style attribute(s) detected (Security)

    → Reduced attack surface for visitors

  • Cross-Origin-Opener-Policy header is missing (Security)

    → Reduced attack surface for visitors

  • base-uri directive is missing (Security)

    → Reduced attack surface for visitors

  • Cookie 'cart_currency' is missing the HttpOnly flag (Security)

    → Reduced attack surface for visitors

  • Cross-Origin-Embedder-Policy header is missing (Security)

    → Reduced attack surface for visitors

  • https://www.mossandmolt.com/cdn/wpm/b610a19cewf693...: 663ms CPU time (Performance)

    → Page loads faster for users

  • https://www.mossandmolt.com/cdn/wpm/b610a19cewf693...: 38 KB unused (45%) (Performance)

    → Page loads faster for users

  • GDPR Article 13 disclosure coverage: 0 / 8 categories (Compliance)

    → Reduced regulatory exposure

…and 12 more resolved issue(s)

Recommended next steps (48)

  • Sprint 1

    Canonical target returns 403 (SEO)

  • Sprint 1

    196 of 200 links are healthy (Content)

  • Sprint 2

    Content-Security-Policy header is missing (Security)

  • Sprint 1

    HSTS header is missing (Security)

  • Sprint 1

    2 link(s) with no accessible text (Accessibility)

  • Sprint 1

    10 publicly-accessible JavaScript source map(s) (Security)

  • Sprint 1

    <iframe> missing title attribute (src="https://www.mossandmolt.com/web-pixels@02d13049w588a3a08pb529f9b2m27ddd415/cust…") (Accessibility)

  • Sprint 1

    https://www.mossandmolt.com/: 4554ms CPU time (Performance)

  • Sprint 1

    Broken link: https://www.mossandmolt.com/checkouts/internal/preloads.j... (Content)

  • Sprint 1

    Unattributable: 1609ms CPU time (Performance)

  • Sprint 3

    JavaScript is 595 KB — consider code splitting or lazy loading (Performance)

  • Sprint 2

    438 HTTP requests — consider bundling or reducing (Performance)

  • Sprint 1

    https://www.mossandmolt.com/cdn/wpm/b02d13049w588a...: 1071ms CPU time (Performance)

  • Sprint 2

    1 `@font-face` rule(s) without `font-display` -- causes FOIT (Performance)

  • Sprint 2

    Unexpected status code: HTTP 403 (Accessibility)

…and 33 more recommended item(s)

Send Feedback