Low impact · weight 4 · worth up to 1.1 points of the total score
A missing or legacy doctype drops the browser into quirks mode, where box sizing and layout follow rules from the 1990s. The page then differs from every modern stylesheet assumption.
Make the very first line <!DOCTYPE html>.
Check a page for this, and the other 75 checks at once
Response sends the standard security headers
A handful of response headers switch on protections the browser already has: HSTS keeps visitors on HTTPS, a Content-Security-Policy limits where scripts may come from, nosniff stops files being run as the wrong type, frame protection stops the page being embedded to trick clicks, and Referrer-Policy and Permissions-Policy limit what leaks and what the page may ask for. Security scanners and clients' IT teams grade sites on exactly this list.
No JavaScript errors in the console
An error logged while the page loads usually means a script stopped halfway: a menu that does not open, a form that does not submit, an analytics tag that records nothing. Visitors never see the message, only the broken behaviour.
No deprecated presentational tags
Tags like <center> and <font> were removed from the standard. Browsers still honour them today, but they mix styling into the markup and no longer respond to CSS the way the rest of the page does.
Page declares a favicon
The favicon is how a user finds this tab among twenty others and how the site appears in bookmarks and history. Without a declared one the browser requests /favicon.ico and usually gets a 404.
