Lighthouse performance score
Lighthouse performance score for the page, out of 100. A lab measurement on a simulated mobile connection — a useful comparison, not a report of what your visitors saw.
The performance score is the headline number of a Lighthouse audit: a weighted blend of lab metrics — First Contentful Paint, Largest Contentful Paint, Total Blocking Time, Cumulative Layout Shift and Speed Index — mapped onto a scale from 0 to 100. It is a quick way to compare two versions of a page, or your page with a competitor's.
How SiteScan measures it
The report asks Google's PageSpeed Insights API to audit the home page twice, once with the mobile profile (a mid-range phone on a throttled connection) and once with the desktop one, and shows both columns side by side. One run takes 15–25 seconds, so the figures arrive after the rest of the report; a result for the same address is reused for six hours.
- Green — 90 or above.
- Amber — 50 to 89.
- Red — below 50.
The score moves a few points between runs, and it is not what Google ranks on: search uses the field data from real Chrome users, described under data source. Treat a low lab score as a pointer to the metrics below it. The usual levers are a lighter, earlier-loading hero image, less render-blocking CSS and JavaScript, fewer third-party scripts, and long cache lifetimes for static files.
See this check on your own site
Run a free scan: the report shows this row for your domain along with the other checks of the site audit.
More in “Core Web Vitals”
What SiteScan checks
TLS certificate
- TLS certificate expiry
- Outdated TLS versions (TLS 1.0/1.1)
- TLS certificate chain
- TLS certificate issuer
- Certificate signature algorithm
Domain registration
- Domain registration expiry
- Registered domain name
- Domain registrar
- Domain registration date
- Domain last updated date
- Domain status codes (EPP)
- Domain transfer lock
- Registrar abuse contact
- RDAP and WHOIS data source
Indexing
- robots.txt file
- CSS and JS blocked in robots.txt
- XML sitemap
- Sitemap index file
- Off-domain URLs in the sitemap
- Sitemap lastmod dates
- Broken URLs in the sitemap
- RSS and Atom feed
Addresses & redirects
Security headers
- HTTP security headers and grade
- Strict-Transport-Security (HSTS) header
- Content-Security-Policy (CSP) header
- X-Content-Type-Options: nosniff
- X-Frame-Options and clickjacking
- Referrer-Policy header
- Permissions-Policy header
- HSTS preload list
- CORS and cross-origin reads
- HTTP TRACE method
Delivery & reputation
- Cache-Control header for HTML
- ETag and Last-Modified revalidation
- HTTP/3 and QUIC support
- Server version disclosure in headers
- DNS blocklist (DNSBL) check
Internal links
Exposure
- Exposed sensitive files (.env, .git, backups)
- Directory listing enabled
- Public JavaScript source maps
- Exposed WordPress endpoints
Well-known files
- security.txt file
- llms.txt for AI assistants
- llms-full.txt file
- ads.txt authorized sellers file
- humans.txt file
- Well-known change-password URL
DNS & email
- MX records (mail servers)
- SPF record
- DMARC record and policy
- DNSSEC signing
- CAA record
- Nameserver redundancy
- IPv6 support (AAAA record)
- MTA-STS policy
- TLS-RPT reporting record
- BIMI record (brand logo in email)
- Wildcard DNS record
- Dangling CNAME and subdomain takeover
Privacy & consent
- Analytics and tracking scripts
- Cookie consent banner
- Privacy policy link
- Terms of service link
- Imprint (Impressum)
- Accessibility statement
Core Web Vitals
- Lighthouse performance score
- Largest Contentful Paint (LCP)
- Cumulative Layout Shift (CLS)
- Interaction to Next Paint (INP)
- CrUX field data vs lab data