Low impact · weight 4 · worth up to 1.1 points of the total score
Lighthouse's best practices audit covers what makes a page trustworthy to a browser: HTTPS everywhere, no deprecated APIs, no errors in the console, images shown at their real aspect ratio, a valid doctype and charset.
Work through the failing audits listed. Most are a single fix each, such as replacing a deprecated API or serving an image at the size it is shown.
Check a page for this, and the other 70 checks at once
Page uses the HTML5 doctype
A missing or legacy doctype drops the browser into quirks mode, where box sizing and layout follow rules from the 1990s. The page then differs from every modern stylesheet assumption.
Response sends the standard security headers
A handful of response headers switch on protections the browser already has: HSTS keeps visitors on HTTPS, a Content-Security-Policy limits where scripts may come from, nosniff stops files being run as the wrong type, frame protection stops the page being embedded to trick clicks, and Referrer-Policy and Permissions-Policy limit what leaks and what the page may ask for. Security scanners and clients' IT teams grade sites on exactly this list.
No JavaScript errors in the console
An error logged while the page loads usually means a script stopped halfway: a menu that does not open, a form that does not submit, an analytics tag that records nothing. Visitors never see the message, only the broken behaviour.
No deprecated presentational tags
Tags like <center> and <font> were removed from the standard. Browsers still honour them today, but they mix styling into the markup and no longer respond to CSS the way the rest of the page does.
