CrUX field data vs lab data
Whether these figures come from real Chrome users on this site over the last 28 days, or from a single lab run standing in when there is too little traffic to report on.
Every Core Web Vitals figure comes from one of two very different places, and it matters which one you are reading.
Field data (CrUX)
The Chrome UX Report collects timings from real Chrome users who opted in to share usage statistics. PageSpeed Insights publishes its 75th percentile over a rolling 28-day window — the value three quarters of visits beat. This is the data Google uses for search, and the only source of INP. SiteScan shows it under "Real users, last 28 days (CrUX)". When the home page itself has too few visits, it falls back to figures for the whole origin, and the heading says "whole site".
Lab data (Lighthouse)
A single synthetic run of the home page from Google's servers, with a simulated device and connection. It is repeatable and available for any site, but it does not know your audience's devices, networks or interactions, and it varies a little between runs. These are the rows at the top of the panel, including the performance score.
No field data? Small and new sites often have too little Chrome traffic for the report. SiteScan then says so, and the lab rows are all there is. That is not a fault; it just means the numbers are an estimate. Field data catches up within 28 days of traffic growing. Read more in Core Web Vitals.
See this check on your own site
Run a free scan: the report shows this row for your domain along with the other checks of the site audit.
More in “Core Web Vitals”
What SiteScan checks
TLS certificate
- TLS certificate expiry
- Outdated TLS versions (TLS 1.0/1.1)
- TLS certificate chain
- TLS certificate issuer
- Certificate signature algorithm
Domain registration
- Domain registration expiry
- Registered domain name
- Domain registrar
- Domain registration date
- Domain last updated date
- Domain status codes (EPP)
- Domain transfer lock
- Registrar abuse contact
- RDAP and WHOIS data source
Indexing
- robots.txt file
- CSS and JS blocked in robots.txt
- XML sitemap
- Sitemap index file
- Off-domain URLs in the sitemap
- Sitemap lastmod dates
- Broken URLs in the sitemap
- RSS and Atom feed
Addresses & redirects
Security headers
- HTTP security headers and grade
- Strict-Transport-Security (HSTS) header
- Content-Security-Policy (CSP) header
- X-Content-Type-Options: nosniff
- X-Frame-Options and clickjacking
- Referrer-Policy header
- Permissions-Policy header
- HSTS preload list
- CORS and cross-origin reads
- HTTP TRACE method
Delivery & reputation
- Cache-Control header for HTML
- ETag and Last-Modified revalidation
- HTTP/3 and QUIC support
- Server version disclosure in headers
- DNS blocklist (DNSBL) check
Internal links
Exposure
- Exposed sensitive files (.env, .git, backups)
- Directory listing enabled
- Public JavaScript source maps
- Exposed WordPress endpoints
Well-known files
- security.txt file
- llms.txt for AI assistants
- llms-full.txt file
- ads.txt authorized sellers file
- humans.txt file
- Well-known change-password URL
DNS & email
- MX records (mail servers)
- SPF record
- DMARC record and policy
- DNSSEC signing
- CAA record
- Nameserver redundancy
- IPv6 support (AAAA record)
- MTA-STS policy
- TLS-RPT reporting record
- BIMI record (brand logo in email)
- Wildcard DNS record
- Dangling CNAME and subdomain takeover
Privacy & consent
- Analytics and tracking scripts
- Cookie consent banner
- Privacy policy link
- Terms of service link
- Imprint (Impressum)
- Accessibility statement
Core Web Vitals
- Lighthouse performance score
- Largest Contentful Paint (LCP)
- Cumulative Layout Shift (CLS)
- Interaction to Next Paint (INP)
- CrUX field data vs lab data