Website quality, measured.

Performance

Lighthouse measures page loading in a controlled Chrome lab test. Each homepage result is the median of three runs. Other page types have one run per device profile. A higher score is better; load times vary with device, network, server cache and location.

LCP measures when the largest visible element appears; CLS measures unexpected layout movement; TBT measures main-thread blocking in the lab. Reference targets are LCP ≤ 2.5 s and CLS ≤ 0.1. Real-user INP is not available from this test, so this report does not claim a Core Web Vitals pass.

Accessibility

The axe scans found 4 distinct failing rules across 12 page/profile observations. Counts below are rule types, not a count of people affected or every WCAG criterion. Incomplete rules require human review.

Baseline findings

Reflow: 6 of 6 desktop-browser observations overflowed at 320 or 720 CSS pixels. Keyboard: 6 unnamed control stops were observed in the first 12 Tab stops per sample. These are limited checks; absence of these symptoms is not a full keyboard or zoom pass.

Still needed: VoiceOver/NVDA testing, complete keyboard journeys including dialogs and forms, text-only enlargement and 200–400% browser zoom, dark-mode contrast, and a review of content alternatives. The browser recognized the reduced-motion preference; animation behavior needs a separate manual check.

Security

The checks below observe the transport and browser protections visible on public pages. They do not evaluate account permissions, private data access, backups, incident response or application vulnerabilities.

• TLS certificate: verified by Node’s trust store · TLSv1.3 · expires Dec 9 20:32:32 2026 GMT.
• HTTP → HTTPS: 308 · https://next.wifi.ee/.
• HTTP resources observed in HTTPS pages: 0.

Documents can also set a referrer policy in HTML. Observed meta policies: origin-when-cross-origin.

Production dependency advisory check (2026-10-23, f8a53593): info: 0, low: 0, moderate: 0, high: 0, critical: 1. This checks the committed lockfile against npm advisories, not the exact deployed dependency tree or undisclosed vulnerabilities.

Next steps: introduce and test a restrictive CSP, set missing defensive headers, and verify that authentication, embeds and browser permissions still work. Any header change needs functional testing before deployment.

Privacy on a first visit

Fresh browser contexts were observed before any consent choice. Cookies are listed by name and domain only; their values are not published. Cross-origin requests may provide authentication or other functionality and are not automatically evidence of tracking.

A consent accept/reject journey, persistence across visits, and legal classification of cookies have not been assessed. The language preference cookie is readable by JavaScript and was observed without a Secure flag; it does not contain an authentication credential.

Data transfer and environmental impact

Smaller pages cost visitors less data and can reduce the work done by networks and devices. These are observed transfers during an unthrottled fresh visit, not an energy or emissions measurement. Lazy-loaded content below the viewport is outside the capture window.

KiB = 1,024 bytes. Failed and unfinished requests, browser timing, and third-party services can change the result. No green-hosting verification or carbon grade is claimed. Compare future snapshots with the same routes, viewport, tools and capture window.

Method and evidence

Standards and guidance: Lighthouse, WCAG conformance, OWASP HTTP headers, Core Web Vitals.