Largest Contentful Paint (LCP)
Largest Contentful Paint: how long until the biggest thing in the viewport has drawn. Google calls under 2.5 s good and over 4 s poor.
Largest Contentful Paint marks the moment the biggest image or text block in the first screen finishes rendering. For a visitor, it is the point where the page looks loaded. It is one of Google's three Core Web Vitals and part of the page experience signals used in search.
Thresholds
SiteScan colours LCP by Google's own limits: 2.5 s or less is good, up to 4 s needs improvement, and anything slower is poor. The value appears twice: in the lab rows from the Lighthouse run on the home page, and — when the site has enough traffic — in the real-user rows, where it is the 75th percentile of visits over the last 28 days.
The usual culprits:
- A slow server response (see TTFB in the same table) — everything else waits for it.
- A hero image that is too large, in an old format, or discovered late because it is set in CSS or lazy-loaded.
- Render-blocking stylesheets and scripts in the
<head>, and web fonts that hold back text.
How to improve it
Serve the hero image in AVIF or WebP at the size it is displayed, never put loading="lazy" on it, and give it fetchpriority="high" or a <link rel="preload">. Inline the critical CSS, defer the rest of the scripts, and cache static files at the edge. More in Core Web Vitals and image optimisation.
See this check on your own site
Run a free scan: the report shows this row for your domain along with the other checks of the site audit.
More in “Core Web Vitals”
What SiteScan checks
TLS certificate
- TLS certificate expiry
- Outdated TLS versions (TLS 1.0/1.1)
- TLS certificate chain
- TLS certificate issuer
- Certificate signature algorithm
Domain registration
- Domain registration expiry
- Registered domain name
- Domain registrar
- Domain registration date
- Domain last updated date
- Domain status codes (EPP)
- Domain transfer lock
- Registrar abuse contact
- RDAP and WHOIS data source
Indexing
- robots.txt file
- CSS and JS blocked in robots.txt
- XML sitemap
- Sitemap index file
- Off-domain URLs in the sitemap
- Sitemap lastmod dates
- Broken URLs in the sitemap
- RSS and Atom feed
Addresses & redirects
Security headers
- HTTP security headers and grade
- Strict-Transport-Security (HSTS) header
- Content-Security-Policy (CSP) header
- X-Content-Type-Options: nosniff
- X-Frame-Options and clickjacking
- Referrer-Policy header
- Permissions-Policy header
- HSTS preload list
- CORS and cross-origin reads
- HTTP TRACE method
Delivery & reputation
- Cache-Control header for HTML
- ETag and Last-Modified revalidation
- HTTP/3 and QUIC support
- Server version disclosure in headers
- DNS blocklist (DNSBL) check
Internal links
Exposure
- Exposed sensitive files (.env, .git, backups)
- Directory listing enabled
- Public JavaScript source maps
- Exposed WordPress endpoints
Well-known files
- security.txt file
- llms.txt for AI assistants
- llms-full.txt file
- ads.txt authorized sellers file
- humans.txt file
- Well-known change-password URL
DNS & email
- MX records (mail servers)
- SPF record
- DMARC record and policy
- DNSSEC signing
- CAA record
- Nameserver redundancy
- IPv6 support (AAAA record)
- MTA-STS policy
- TLS-RPT reporting record
- BIMI record (brand logo in email)
- Wildcard DNS record
- Dangling CNAME and subdomain takeover
Privacy & consent
- Analytics and tracking scripts
- Cookie consent banner
- Privacy policy link
- Terms of service link
- Imprint (Impressum)
- Accessibility statement
Core Web Vitals
- Lighthouse performance score
- Largest Contentful Paint (LCP)
- Cumulative Layout Shift (CLS)
- Interaction to Next Paint (INP)
- CrUX field data vs lab data