The fix, in one snippet
<script src="app.js" defer></script>Illustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
Scan.now records server response time, bounded HTML bytes and scripts in the head without async or defer. It does not emulate a browser, so this complements rather than replaces field Core Web Vitals.
Why it matters
Slow delivery increases abandonment and delays every later render and interaction milestone.
How to fix it
Cache generated pages, compress and trim HTML, defer non-critical JavaScript, remove unused tags and measure real-user LCP, INP and CLS separately.
Where this fits
Web performance baseline is check 11 of 19 that the website performance scanner runs under page content and javascript, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
Fix this one first
Above it in the same category sits Structural accessibility basics (medium), where structural HTML checks found missing accessible names, image alternatives, document language or skipped heading levels. An attacker who has that does not need this, so it is the better use of the same hour.
What fixing this still leaves open
Web performance baseline closes one route in. Immediately below it: Advertising and tracking endpoints, where which of the page's third-party hosts exist to advertise to the visitor or to follow them, matched against the EasyList and EasyPrivacy blocklists that also power our <a href="/ad-blocker">ad blocker</a>; CMS / generator version disclosure, where the page announces the CMS or static-site generator it was built with, usually including the version, in a meta tag, header or comment banner; Sensitive information in HTML comments, where hTML comments in the page source contain material that looks internal: Credentials, TODO notes, internal hostnames or IP addresses, file paths, or links to unpublished areas of the site.
Found in the same scan
The website performance scanner reports this alongside checks from other categories that are at least as serious, including Path traversal / local file inclusion, where a path-like parameter returned a known local operating-system file signature, and Session token exposed in URL, where a session-like token name appears in a discovered URL. A single run of website performance scanner answers all of them at once.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: Web performance baseline (medium severity)
Scanner check id: web-performance-baselineThe rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
