惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

S
SegmentFault 最新的问题
博客园 - 三生石上(FineUI控件)
WordPress大学
WordPress大学
博客园 - 【当耐特】
月光博客
月光博客
Vercel News
Vercel News
D
Docker
I
InfoQ
Apple Machine Learning Research
Apple Machine Learning Research
博客园 - 叶小钗
MongoDB | Blog
MongoDB | Blog
GbyAI
GbyAI
有赞技术团队
有赞技术团队
雷峰网
雷峰网
博客园 - 聂微东
小众软件
小众软件
Y
Y Combinator Blog
腾讯CDC
L
LangChain Blog
The GitHub Blog
The GitHub Blog
宝玉的分享
宝玉的分享
Stack Overflow Blog
Stack Overflow Blog
大猫的无限游戏
大猫的无限游戏
T
The Blog of Author Tim Ferriss

DEV Community

Authentication Security Deep Dive: From Brute Force to Salted Hashing (With Java Examples) Why AI Systems Don’t Fail — They Drift Spilling beans for how i learn for exam😁"Reinforcement Learning Cheat Sheet" I Replaced Chrome with Safari for AI Browser Automation. Here's What Broke (and What Finally Worked) How Python Borrows Other People's Work The $40 Architecture: Processing 1 Billion API Requests with 99.99% Uptime Vibe Coding: A Workflow Guide (From Zero to SaaS) Most webhook security guides protect the wrong side. The scary part is delivery. Headless CMS for TanStack Start: Build a Blog with Cosmic EU Age Verification App "Hacked in 2 Minutes" — What Actually Happened Comfy Cloud’s delete function does not actually remove files Running AI Models on GPU Cloud Servers: A Beginner Guide Event-driven media intelligence with AWS Step Functions and Bedrock I scored 500 AI prompts across 8 quality dimensions — here's what broke How to Call Google Gemini API from Next.js (Free Tier, No Backend Needed) The Portal Protocol: Reclaiming Human Connection in the Age of AI How to Fix Your Team's Scattered Knowledge Problem With a Self-Hosted Forum Intro to tc Cloud Functors: A Graph-First Mental Model for the Modern Cloud Designing Multi-Tenant Backends With Both Ownership and Team Access I Built a Neumorphic CSS Library with 77+ Components — Here's What I Learned PostgreSQL Performance Optimization: Why Connection Pooling Is Critical at Scale Cómo construí un SaaS multi-rubro para gestionar expensas en Argentina con FastAPI + Vue 3 🚀 I Built an Ethical Hacking Scanner Tool – Open Source Project I Replaced /usage and /context in Claude Code With a Single Statusline A Pythonic Way to Handle Emails (IMAP/SMTP) with Auto-Discovery and AI-Ready Design I Collected 8.9 Million Polymarket Price Points — Here's What I Found About How Markets Really Move EcoTrack AI — Carbon Footprint Tracker & Dashboard Everyone's Using AI. No One Agrees How. 5 self-hosted ebook managers worth trying in 2026 Building Your First AI Agent with LangChain: From Chatbot to Autonomous Assistant
I Ran 200+ Website Audits — Here's What's Actually Broken...
Performance Dev · 2026-05-30 · via DEV Community

Over the last few weeks I built a website audit tool and ran it on 200+ small business and service websites — dental practices, plumbing companies, landscapers, law firms, real estate agents. Not Fortune 500 pages optimized by dedicated teams. The sites that actually serve local customers.

I expected some issues. I did not expect this.

Here's the raw data, the patterns I found, and what you can actually do about it.


The Scorecard

I grade sites across five dimensions on a 0–100 scale. Here are the averages from 200+ audits:

Dimension Average Score Worst Score
Speed 56 11
SEO 68 29
Mobile usability 61 18
Accessibility 52 8
Security 70 17

SEO and security tend to be passable (automated checks from Google Search Console and automatic SSL help). Speed and accessibility are consistently neglected — probably because the feedback loop is invisible. A slow or inaccessible site loses visitors silently, and the owner never knows why.


Finding #1: 67% of Sites Ship >50% Unused CSS

This was the single most surprising data point by far.

When a browser loads a page, it downloads every byte of CSS, parses it, builds style rules for every selector, and only then paints. If 60% of those rules never get applied (because they target a contact form behind a click, or a mobile menu at 768px+), the browser still processed them.

Worst case: a dental practice shipped 287 KB of CSS. Only 31 KB was used on first paint. That's 256 KB of unnecessary render-blocking weight that delayed First Contentful Paint by roughly 1.4 seconds.

The fix: If you're using Tailwind, make sure tree-shaking is enabled. If you're writing vanilla CSS, open DevTools > Coverage tab > Reload. Anything over 40% unused is worth addressing. Most bundlers handle this — you just need to turn it on.


Finding #2: Average Image Payload Is 1.8 MB — Way Too High

Average image payload across all scanned sites: 1.8 MB per page. Only 34% serve WebP or AVIF (modern formats that cut file size by 30-50%). Only 28% serve responsive sizes.

The correlation was direct: every 100 KB of unnecessary image weight added ~0.6 seconds to Largest Contentful Paint. One landscaping site served a 4 MB hero photo at 2400×1800px — displayed at 800×600 in a 50% viewport. That single image was costing them ~3 seconds of load time.

The fix: Serve WebP at responsive sizes. Tools like sharp, Squoosh, or built-in Next.js image optimization handle this. If you're on shared hosting, ShortPixel or Imagify plugins do it automatically.


Finding #3: 82% Have Render-Blocking Scripts

Render-blocking JS/CSS adds an average of 1.8 seconds to First Contentful Paint.

Most common offenders:

  1. Google Tag Manager loading synchronously in <head> — alone adds ~1.2s. Add async or defer by 3 seconds.
  2. Web font files blocking render — the browser downloads the font before it paints any text. Preload or use font-display: swap.
  3. Analytics scripts without defer or async — your analytics provider is valuable, but not more valuable than the first impression.

The fix: This is a one-line change for most sites — add async or defer to script tags that aren't critical for first paint. It's free and takes minutes.


Finding #4: 83% Can't Reliably Receive Email

This one surprised me most because it directly affects revenue.

I checked every domain for SPF records (authorized senders), DKIM signatures (cryptographic verification), and DMARC policies (what to do with failures). 83% failed at least one check.

Most common failure: no SPF record at all. That means your emails go to spam (or bounce silently) for anyone with strict DMARC policies — which includes Gmail and Microsoft 365 recipients.

The fix: A single TXT DNS record. Google provides the exact record to add. Costs nothing. Takes 10 minutes.


Finding #5: 44% Fail Basic Color Contrast Checks

Nearly half the sites had text that was genuinely hard to read for people with low vision (or anyone in direct sunlight). The broader accessibility picture: 28% had missing image alt text (which also hurts SEO), 16% had keyboard focus traps, and poorly-marked-up sites averaged 1,400+ DOM nodes (Google recommends under 1,500 for performance).

The fix: Run axe DevTools or Lighthouse's accessibility audit. The recommendations are concrete and actionable.


Finding #6: "Looks Good, Runs Bad" Is the Most Common Pattern

Sites with fresh designs (hero image, smooth scroll, animations, template framework at full weight) consistently scored WORSE on performance than older, simpler sites. The reason is straightforward: a modern design loads a template framework, a hero image, custom fonts, and multiple JS libraries. An older site built with plain HTML loads in under a second but looks dated.

The takeaway: If you paid for a redesign in the last two years and didn't check the PageSpeed score before and after, there's a real chance your new site is slower than your old one.


What Actually Moves the Needle

If I had to pick the changes that help the most sites in the least time:

  1. Defer non-critical JavaScript (30 min, free) — improves FCP ~35% on average
  2. Serve WebP images at responsive sizes (1 hour, free-$30/mo)
  3. Set up SPF/DKIM/DMARC (10 min, free) — prevents business email from going to spam
  4. Audit unused CSS (2 hours, free)
  5. Move email capture to post-value, not pre-value — don't ask for an email before someone has seen why your tool is useful

How I Got This Data

I built the audit tool because I couldn't find anything that checked performance, SEO, accessibility, mobile, security, AND email auth in one pass without requiring an account or credit card.

If you want to run your own URL through it: outboundautonomy.com — enter any URL, get your scores in about 30 seconds. Free, no email, no account.

I'd love honest feedback on what else I should measure. A few things I'm considering: cumulative third-party script weight per page, CLS from web fonts, and HTTPS redirect chains. If you run your own site through the tool and find something it misses, let me know — I'm still iterating.


Drop your URL in the comments if you want me to run an audit and post your scores.