Mr B & Friends

What Dr Urls found on mrbandfriends.co.uk

From the audit of their public home page on 22/10/2026, worst first. Each links to what it means and how it is fixed.

• high
  Cacheable response sets a cookie, so no CDN will cache it

  The two headers contradict each other, and the contradiction is silent: the page looks cached, the CDN is configured, and every request still pays full origin latency.

• high
  Time to First Byte (TTFB) is slow

  TTFB directly impacts all subsequent loading metrics.

• medium
  Duplicate ID attributes found

  Duplicate IDs cause label elements, aria-labelledby, aria-describedby, and fragment link targets to associate with the wrong element.

• medium
  Icon-only button missing aria-label

  Icon-only buttons are extremely common in modern UIs (hamburger menus, close buttons, search icons), but without aria-labels, they are completely opaque to screen reader users.

• medium
  Images missing width and height attributes

  Missing image dimensions are the leading cause of Cumulative Layout Shift (CLS), a Core Web Vital and ranking factor.

• medium
  Render-blocking CSS or JavaScript

  Render-blocking resources directly impact First Contentful Paint (FCP) and Largest Contentful Paint (LCP), both Core Web Vitals metrics.

• low
  Below-the-fold images not lazy loaded

  Loading all images immediately increases initial page weight and competes with critical resources for bandwidth.

• low
  Broken heading hierarchy

  Heading hierarchy provides a semantic outline of the page content.

• low
  CSS files are not minified

  Unminified CSS files are larger than necessary, increasing download time and delaying rendering.

• low
  ETag header missing on resources

  Without ETags, browsers cannot efficiently validate whether cached resources have changed.

• low
  Excessive inline CSS

  Inline CSS cannot be cached separately by the browser, so it is re-downloaded with every page load.

• low
  Excessive inline JavaScript

  Inline JavaScript cannot be cached by the browser and must be parsed and executed every time the page loads.

And 8 more. 7 security findings are not listed on this public page; the site's owner sees them in a full audit after claiming it.