Performance

Consider code splitting or tree shaking to reduce unused code.

Long max-age on the main HTML document means users may see outdated auth state, SPA shells, or A/B variants until the cache expires. Consider Cache-Control: no-cache (or max-age=300) for HTML and let your hashed assets (JS/CSS/images) carry the long cache instead.

Each `<script src=...>` without `async`, `defer`, or `type="module"` blocks HTML parsing while the browser fetches and executes it. The block lasts the entire round-trip + execution time -- on slow networks this translates directly into LCP delay. Add `defer` (executes after parse, in source order) for scripts that interact with the DOM, or `async` (executes whenever ready) for analytics / independent scripts. Module scripts (`type="module"`) are deferred by default.

First-load mobile users on cellular networks see meaningful latency improvements with HTTP/3. The QUIC transport collapses TLS + TCP handshakes into one and recovers faster from packet loss.

Brotli is the best text-compression algorithm for general use, ~20% smaller than gzip on average (40% on smaller files). Modern browsers all support it.

The page declares a `Vary` header, telling downstream caches which request headers the response varies on. Critical for content-negotiated responses (compression, language, cookies, device class).

Each `<link rel="stylesheet">` without a non-blocking `media` attribute holds up the first paint. Browsers download all of them before painting any content. Consolidate into 1-2 critical-path stylesheets; defer non-critical CSS via `<link rel="stylesheet" media="print" onload="this.media='all'">` or via the loadCSS pattern; inline above-the-fold CSS in `<style>` to short-circuit the request entirely.

Asset compression is measured per host, from one HEAD request against a sampled resource. Pages that serve all their JS and CSS from the document's own origin are covered by the document compression check instead.