Website problems

A maintenance notice served with a success status tells crawlers it is the page. What 503 with Retry-After does instead, and why it matters for short windows too.

When both hostnames serve the site without redirecting, every page exists twice. What that splits, and the same problem in trailing slashes and letter case.

An image served far larger than the space it fills wastes most of its bytes. How to measure the waste, and the difference between resizing, compressing and serving variants.

An image with no declared dimensions has no reserved space, so the layout shifts when it arrives. How aspect-ratio reservation works and why the attributes came back.

WebP and AVIF encode the same image in substantially fewer bytes. How to adopt them without breaking older clients, and when the old formats are still right.

An image whose file does not load leaves a gap, an icon, or its alt text. Why it differs from a broken link, where the causes cluster, and how to find them.

Marking the image a visitor sees first as lazy removes it from early discovery and delays the largest paint. A blanket attribute from a plugin is the usual cause.

Width candidates with no sizes attribute make the browser assume the image spans the viewport, so it picks the largest file on almost every screen.

Body text below a comfortable reading size on a phone forces every visitor to zoom. What the size interacts with, and why it is rarely a deliberate choice.

Time to first byte measures the server, not the page. How to separate a slow server from a slow page, and the four causes that account for most of it.

A stylesheet or synchronous script in the head stops the browser painting until it is fetched and run. What blocks, what does not, and how to unblock without breaking the page.

Gzip and Brotli reduce HTML, CSS and JavaScript by roughly two thirds. Why it is a server setting rather than a code change, and the files that should not be compressed.

Without Cache-Control, every visit refetches assets that have not changed. How max-age, immutable and revalidation work, and the fingerprinting that makes long caching safe.

JavaScript is downloaded, parsed, compiled and executed, so a megabyte of script costs far more than a megabyte of image. Where bundles grow, and how to shrink one.

Every third-party tag is a connection, a download and main-thread work on someone else's schedule. How to measure their real cost and decide which to remove.

Total transferred bytes is a blunt measure that still predicts a lot. What contributes, why the median page keeps growing, and where the weight is worth cutting first.

A referenced resource answering with an error breaks layout or functionality for every visitor, transfers almost nothing, and produces no visible error.

An edge network reporting a miss on every request is forwarding everything to the origin. The usual cause is a directive the origin sends and the edge obeys.

The default font-display behaviour hides text until the web font arrives. On a slow connection that is a blank page for seconds, with nothing broken.

A page with tens of thousands of elements makes layout, styling and memory expensive. Where the size comes from and how to reduce it without removing content.

Which response headers actually reduce risk, which are obsolete, and the order to add them in without breaking the site.

A source map can contain the complete original source of a bundle. What that exposes, why the file is usually there by accident, and how to keep debugging without publishing it.

API keys and tokens committed into front-end code or left in a public file. Which keys are public by design, which are not, and why rotation is the only real remedy.

Response headers and generator tags that name the software and its version. What that actually costs, why it is not a vulnerability, and how to remove it properly.

A researcher who finds a flaw needs somewhere to send it. What RFC 9116 specifies, why the Expires field matters, and what the file must not contain.

A Content-Security-Policy permitting inline scripts permits exactly what an injection produces. Why the directive gets added and how to remove it with nonces.

Attributes carrying JavaScript are inline execution by another name. Why a nonce cannot cover them, and how to move them without rewriting a site.

A form on an HTTPS page whose action is an HTTP URL sends everything in clear. Browsers warn on it, and the page looks secure until submission.

A directory with no index file that lists its contents instead publishes every file in it, including the ones nothing links to.

Internal hostnames, staging addresses and administrative paths left in served bundles describe an infrastructure. None is a way in; together they are reconnaissance.

A security.txt whose Expires date has passed tells a reader the contact is no longer maintained. Why the field exists and how to keep the file current.

A site still answering on plain HTTP, or answering on both without redirecting. What browsers now do, and the order in which to fix it.

An HTTPS page loading resources over HTTP. What browsers block outright, what they upgrade silently, and how to find the remaining references.

An expired certificate makes a site unusable, not degraded. Why automated renewal fails silently, the six causes, and the external check that warns before the date.

A certificate valid for one name and not another produces a security interstitial on the hostnames it omits. How coverage works, and why wildcards do not cover everything.

TLS 1.0 and 1.1 were formally deprecated in 2021 and are refused by current browsers. What still offering them means, and how to disable them without breaking old clients.

A redirect to HTTPS happens after an insecure request has already been sent. What HSTS prevents, why max-age is hard to undo, and how to deploy it in stages.

A site with a valid certificate that still answers over plain HTTP serves two versions of itself. What that costs and how to redirect correctly.

A server still offering obsolete cipher suites weakens connections for clients that accept them. Which ones matter, and why the protocol version decides most of it.

A server that omits its intermediate certificate relies on the client already having it. Why desktop browsers cope and other clients do not.