37 Audits
🛡️

Lighthouse Best Practices

Security Auditor

Lighthouse Best Practices score: HTTPS, vulnerable libraries, errors

SecurityJavaScript
100 credits
Per check
~30 seconds
Average runtime
Active
Status

How it works

  1. Thresholds — reads formFactor, warningBelowScore and failBelowScore. When failBelowScore is not lower than warningBelowScore the audit fails with a single check (401) and Lighthouse does not run.

  2. Lighthouse run — runs the Lighthouse CLI (version pinned in the image, reported in the 100 check) with the best-practices category only, the desktop preset or the mobile form factor, and the 37AuditsBot user agent. The run has a time budget derived from the audit's remaining time; a page that does not finish loading inside it is an ERROR (500).

  3. Blocked or unloadable page — an HTTP 403, 429 or Cloudflare challenge on the document is the platform's blocked response (590). Any other Lighthouse runtime error (NO_FCP, PAGE_HUNG, DNS_FAILURE, ERRORED_DOCUMENT_REQUEST, …) is an ERROR (500) that names the error.

  4. Score — the Best Practices score (0–100) is compared with the thresholds: below failBelowScore is FAIL (400), from failBelowScore up to but excluding warningBelowScore is WARNING (300). A category Lighthouse could not score is an ERROR (501). At or above warningBelowScore the audit succeeds (200).

  5. Audits — every audit Lighthouse lists under the Best Practices score becomes a check: a scored audit below Lighthouse's pass mark (0.9) is a FAIL whose code is 400 plus the audit's fixed number in this auditor's catalog (16 audits, 410–431); an audit Lighthouse reports without a score or leaves to a manual check is an INFORMATION with 100 plus that number. An audit a newer Lighthouse adds gets 490 or 190 until the catalog is updated. Hidden Lighthouse audits and audits that do not apply to the page are not reported. These checks keep their own status but never change the result: the score alone decides it.

  6. Report pin — every result carries an INFORMATION check (100) with the Lighthouse and Chrome versions, the device profile, the run duration and Lighthouse's benchmark index, because scores are only comparable between runs of the same Lighthouse version.

The Lighthouse navigation is not signed with Web Bot Auth: Lighthouse opens its own browser target and its only header hook adds headers to every request of the page, which breaks cross-origin fetches. Allowlist the 37AuditsBot user agent if the site challenges unsigned bots. With Basic auth the Authorization header is sent on every request the page makes, third-party origins included, so prefer allowlisting over credentials for a staging site that loads third-party scripts.

Preferences

KeyTypeDefaultDescription
formFactorstringdesktopdesktop (Lighthouse desktop preset: no CPU slowdown, fast network) or mobile (Moto G Power emulation, simulated 4G and 4x CPU slowdown, the PageSpeed Insights default). Any other value falls back to desktop.
warningBelowScoreinteger (1–100)90A Best Practices score below this value produces a WARNING (300).
failBelowScoreinteger (0–99)50A Best Practices score below this value produces a FAIL (400). Must be lower than warningBelowScore.

An invalid value (missing, fractional, outside 0–100) makes the auditor fall back to that preference's default and log a warning. A fail threshold equal to or above the warning threshold is not an invalid value: it makes the audit fail (401) until the thresholds are fixed.

What this auditor validates

Every row maps to one checkRule* method and one CheckCode.

CheckCodeStatusWhen it firesRecommendationWhy it matters
37A-LighthouseBestPracticesAuditor-100INFORMATIONAlways. Records the Lighthouse and Chrome versions, the device profile, the run duration and the benchmark index: Lighthouse 12.8.2 on Chrome 138.0.7204.0 audited the page as desktop in 18 s (benchmark index 2186).— (recommendation is null; nothing for the site to change)—
37A-LighthouseBestPracticesAuditor-114INFORMATIONLighthouse reports audit csp-xss without a score: Ensure CSP is effective against XSS attacks. Message: Ensure CSP is effective against XSS attacks: {display value or item count} (Lighthouse Best Practices audit csp-xss, desktop; reported without a score).A strong Content Security Policy (CSP) significantly reduces the risk of cross-site scripting (XSS) attacks. Learn how to use a CSP to prevent XSS (https://developer.chrome.com/docs/lighthouse/best-practices/csp-xss/) Found: {up to three items}.—
37A-LighthouseBestPracticesAuditor-115INFORMATIONLighthouse reports audit has-hsts without a score: Use a strong HSTS policy. Message: Use a strong HSTS policy: {display value or item count} (Lighthouse Best Practices audit has-hsts, desktop; reported without a score).Deployment of the HSTS header significantly reduces the risk of downgrading HTTP connections and eavesdropping attacks. A rollout in stages, starting with a low max-age is recommended. Learn more about using a strong HSTS policy. (https://developer.chrome.com/docs/lighthouse/best-practices/has-hsts) Found: {up to three items}.—
37A-LighthouseBestPracticesAuditor-116INFORMATIONLighthouse reports audit origin-isolation without a score: Ensure proper origin isolation with COOP. Message: Ensure proper origin isolation with COOP: {display value or item count} (Lighthouse Best Practices audit origin-isolation, desktop; reported without a score).The Cross-Origin-Opener-Policy (COOP) can be used to isolate the top-level window from other documents such as pop-ups. Learn more about deploying the COOP header. (https://web.dev/articles/why-coop-coep#coop) Found: {up to three items}.—
37A-LighthouseBestPracticesAuditor-117INFORMATIONLighthouse reports audit clickjacking-mitigation without a score: Mitigate clickjacking with XFO or CSP. Message: Mitigate clickjacking with XFO or CSP: {display value or item count} (Lighthouse Best Practices audit clickjacking-mitigation, desktop; reported without a score).The X-Frame-Options (XFO) header or the frame-ancestors directive in the Content-Security-Policy (CSP) header control where a page can be embedded. These can mitigate clickjacking attacks by blocking some or all sites from embedding the page. Learn more about mitigating clickjacking (https://developer.chrome.com/docs/lighthouse/best-practices/clickjacking-mitigation). Found: {up to three items}.—
37A-LighthouseBestPracticesAuditor-118INFORMATIONLighthouse reports audit trusted-types-xss without a score: Mitigate DOM-based XSS with Trusted Types. Message: Mitigate DOM-based XSS with Trusted Types: {display value or item count} (Lighthouse Best Practices audit trusted-types-xss, desktop; reported without a score).The require-trusted-types-for directive in the Content-Security-Policy (CSP) header instructs user agents to control the data passed to DOM XSS sink functions. Learn more about mitigating DOM-based XSS with Trusted Types (https://developer.chrome.com/docs/lighthouse/best-practices/trusted-types-xss). Found: {up to three items}.—
37A-LighthouseBestPracticesAuditor-126INFORMATIONLighthouse reports audit js-libraries without a score: Detected JavaScript libraries. Message: Detected JavaScript libraries: {display value or item count} (Lighthouse Best Practices audit js-libraries, desktop; reported without a score).All front-end JavaScript libraries detected on the page. Learn more about this JavaScript library detection diagnostic audit (https://developer.chrome.com/docs/lighthouse/best-practices/js-libraries/). Found: {up to three items}.—
37A-LighthouseBestPracticesAuditor-190INFORMATIONAn audit this catalog does not list (added by a newer Lighthouse) is reported without a score or left to a manual check. Message as above, with the audit's own title and id; inCatalog is false in the data.Lighthouse's description of the audit, then the first items it found.—
37A-LighthouseBestPracticesAuditor-501ERRORLighthouse ran but gave the Best Practices category no score (score: null).Re-run the audit; if the Best Practices score stays empty, check the page for errors during load in Lighthouse's report.—
37A-LighthouseBestPracticesAuditor-400FAILThe Best Practices score is below failBelowScore. Message: Lighthouse Best Practices score is 42/100 (desktop); the fail threshold is 50.Raise the Best Practices score ({score}) by fixing its lowest-scoring audits first: {audit title} ({display value}); …Outdated libraries, console errors and insecure requests are the defects attackers and browser updates exploit first, so the page breaks or gets compromised without warning.
37A-LighthouseBestPracticesAuditor-410FAILLighthouse audit is-on-https scores below 0.9: Does not use HTTPS. Message: Does not use HTTPS: {display value or item count} (Lighthouse Best Practices audit is-on-https, desktop).All sites should be protected with HTTPS, even ones that don't handle sensitive data. This includes avoiding mixed content (https://developers.google.com/web/fundamentals/security/prevent-mixed-content/what-is-mixed-content), where some resources are loaded over HTTP despite the initial request being served over HTTPS. HTTPS prevents intruders from tampering with or passively listening in on the communications between your app and your users, and is a prerequisite for HTTP/2 and many new web platform APIs. Learn more about HTTPS (https://developer.chrome.com/docs/lighthouse/pwa/is-on-https/). Found: {up to three offending items}.All sites should be protected with HTTPS, even ones that don't handle sensitive data. This includes avoiding mixed content, where some resources are loaded over HTTP despite the initial request being served over HTTPS. HTTPS prevents intruders from tampering with or passively listening in on the communications between your app and your users, and is a prerequisite for HTTP/2 and many new web platform APIs.
37A-LighthouseBestPracticesAuditor-411FAILLighthouse audit redirects-http scores below 0.9: Does not redirect HTTP traffic to HTTPS. Message: Does not redirect HTTP traffic to HTTPS: {display value or item count} (Lighthouse Best Practices audit redirects-http, desktop).Make sure that you redirect all HTTP traffic to HTTPS in order to enable secure web features for all your users. Learn more (https://developer.chrome.com/docs/lighthouse/pwa/redirects-http/). Found: {up to three offending items}.Make sure that you redirect all HTTP traffic to HTTPS in order to enable secure web features for all your users.
37A-LighthouseBestPracticesAuditor-412FAILLighthouse audit geolocation-on-start scores below 0.9: Requests the geolocation permission on page load. Message: Requests the geolocation permission on page load: {display value or item count} (Lighthouse Best Practices audit geolocation-on-start, desktop).Users are mistrustful of or confused by sites that request their location without context. Consider tying the request to a user action instead. Learn more about the geolocation permission (https://developer.chrome.com/docs/lighthouse/best-practices/geolocation-on-start/). Found: {up to three offending items}.Users are mistrustful of or confused by sites that request their location without context. Consider tying the request to a user action instead.
37A-LighthouseBestPracticesAuditor-413FAILLighthouse audit notification-on-start scores below 0.9: Requests the notification permission on page load. Message: Requests the notification permission on page load: {display value or item count} (Lighthouse Best Practices audit notification-on-start, desktop).Users are mistrustful of or confused by sites that request to send notifications without context. Consider tying the request to user gestures instead. Learn more about responsibly getting permission for notifications (https://developer.chrome.com/docs/lighthouse/best-practices/notification-on-start/). Found: {up to three offending items}.Users are mistrustful of or confused by sites that request to send notifications without context. Consider tying the request to user gestures instead.
37A-LighthouseBestPracticesAuditor-419FAILLighthouse audit paste-preventing-inputs scores below 0.9: Prevents users from pasting into input fields. Message: Prevents users from pasting into input fields: {display value or item count} (Lighthouse Best Practices audit paste-preventing-inputs, desktop).Preventing input pasting is a bad practice for the UX, and weakens security by blocking password managers.Learn more about user-friendly input fields (https://developer.chrome.com/docs/lighthouse/best-practices/paste-preventing-inputs/). Found: {up to three offending items}.Preventing input pasting is a bad practice for the UX, and weakens security by blocking password managers.
37A-LighthouseBestPracticesAuditor-420FAILLighthouse audit image-aspect-ratio scores below 0.9: Displays images with incorrect aspect ratio. Message: Displays images with incorrect aspect ratio: {display value or item count} (Lighthouse Best Practices audit image-aspect-ratio, desktop).Image display dimensions should match natural aspect ratio. Learn more about image aspect ratio (https://developer.chrome.com/docs/lighthouse/best-practices/image-aspect-ratio/). Found: {up to three offending items}.Image display dimensions should match natural aspect ratio.
37A-LighthouseBestPracticesAuditor-421FAILLighthouse audit image-size-responsive scores below 0.9: Serves images with low resolution. Message: Serves images with low resolution: {display value or item count} (Lighthouse Best Practices audit image-size-responsive, desktop).Image natural dimensions should be proportional to the display size and the pixel ratio to maximize image clarity. Learn how to provide responsive images (https://web.dev/articles/serve-responsive-images). Found: {up to three offending items}.Image natural dimensions should be proportional to the display size and the pixel ratio to maximize image clarity.
37A-LighthouseBestPracticesAuditor-422FAILLighthouse audit viewport scores below 0.9: Does not have a <meta name="viewport"> tag with width or initial-scale. Message: Does not have a <meta name="viewport"> tag with width or initial-scale: {display value or item count} (Lighthouse Best Practices audit viewport, desktop).A <meta name="viewport"> not only optimizes your app for mobile screen sizes, but also prevents a 300 millisecond delay to user input (https://developer.chrome.com/blog/300ms-tap-delay-gone-away/). Learn more about using the viewport meta tag (https://developer.chrome.com/docs/lighthouse/pwa/viewport/). Found: {up to three offending items}.A <meta name="viewport"> not only optimizes your app for mobile screen sizes, but also prevents a 300 millisecond delay to user input.
37A-LighthouseBestPracticesAuditor-423FAILLighthouse audit font-size scores below 0.9: Document doesn't use legible font sizes. Message: Document doesn't use legible font sizes: {display value or item count} (Lighthouse Best Practices audit font-size, desktop).Font sizes less than 12px are too small to be legible and require mobile visitors to “pinch to zoom” in order to read. Strive to have >60% of page text ≥12px. Learn more about legible font sizes (https://developer.chrome.com/docs/lighthouse/seo/font-size/). Found: {up to three offending items}.Font sizes less than 12px are too small to be legible and require mobile visitors to “pinch to zoom” in order to read. Strive to have >60% of page text ≥12px.
37A-LighthouseBestPracticesAuditor-424FAILLighthouse audit doctype scores below 0.9: Page lacks the HTML doctype, thus triggering quirks-mode. Message: Page lacks the HTML doctype, thus triggering quirks-mode: {display value or item count} (Lighthouse Best Practices audit doctype, desktop).Specifying a doctype prevents the browser from switching to quirks-mode. Learn more about the doctype declaration (https://developer.chrome.com/docs/lighthouse/best-practices/doctype/). Found: {up to three offending items}.Specifying a doctype prevents the browser from switching to quirks-mode.
37A-LighthouseBestPracticesAuditor-425FAILLighthouse audit charset scores below 0.9: Charset declaration is missing or occurs too late in the HTML. Message: Charset declaration is missing or occurs too late in the HTML: {display value or item count} (Lighthouse Best Practices audit charset, desktop).A character encoding declaration is required. It can be done with a <meta> tag in the first 1024 bytes of the HTML or in the Content-Type HTTP response header. Learn more about declaring the character encoding (https://developer.chrome.com/docs/lighthouse/best-practices/charset/). Found: {up to three offending items}.A character encoding declaration is required. It can be done with a <meta> tag in the first 1024 bytes of the HTML or in the Content-Type HTTP response header.
37A-LighthouseBestPracticesAuditor-427FAILLighthouse audit deprecations scores below 0.9: Uses deprecated APIs. Message: Uses deprecated APIs: {display value or item count} (Lighthouse Best Practices audit deprecations, desktop).Deprecated APIs will eventually be removed from the browser. Learn more about deprecated APIs (https://developer.chrome.com/docs/lighthouse/best-practices/deprecations/). Found: {up to three offending items}.Deprecated APIs will eventually be removed from the browser.
37A-LighthouseBestPracticesAuditor-428FAILLighthouse audit third-party-cookies scores below 0.9: Uses third-party cookies. Message: Uses third-party cookies: {display value or item count} (Lighthouse Best Practices audit third-party-cookies, desktop).Third-party cookies may be blocked in some contexts. Learn more about preparing for third-party cookie restrictions (https://privacysandbox.google.com/cookies/prepare/overview). Found: {up to three offending items}.Third-party cookies may be blocked in some contexts.
37A-LighthouseBestPracticesAuditor-429FAILLighthouse audit errors-in-console scores below 0.9: Browser errors were logged to the console. Message: Browser errors were logged to the console: {display value or item count} (Lighthouse Best Practices audit errors-in-console, desktop).Errors logged to the console indicate unresolved problems. They can come from network request failures and other browser concerns. Learn more about this errors in console diagnostic audit (https://developer.chrome.com/docs/lighthouse/best-practices/errors-in-console/) Found: {up to three offending items}.Errors logged to the console indicate unresolved problems. They can come from network request failures and other browser concerns.
37A-LighthouseBestPracticesAuditor-430FAILLighthouse audit valid-source-maps scores below 0.9: Missing source maps for large first-party JavaScript. Message: Missing source maps for large first-party JavaScript: {display value or item count} (Lighthouse Best Practices audit valid-source-maps, desktop).Source maps translate minified code to the original source code. This helps developers debug in production. In addition, Lighthouse is able to provide further insights. Consider deploying source maps to take advantage of these benefits. Learn more about source maps (https://developer.chrome.com/docs/devtools/javascript/source-maps/). Found: {up to three offending items}.Source maps translate minified code to the original source code. This helps developers debug in production. In addition, Lighthouse is able to provide further insights. Consider deploying source maps to take advantage of these benefits.
37A-LighthouseBestPracticesAuditor-431FAILLighthouse audit inspector-issues scores below 0.9: Issues were logged in the Issues panel in Chrome Devtools. Message: Issues were logged in the Issues panel in Chrome Devtools: {display value or item count} (Lighthouse Best Practices audit inspector-issues, desktop).Issues logged to the Issues panel in Chrome Devtools indicate unresolved problems. They can come from network request failures, insufficient security controls, and other browser concerns. Open up the Issues panel in Chrome DevTools for more details on each issue. Found: {up to three offending items}.Issues logged to the Issues panel in Chrome Devtools indicate unresolved problems. They can come from network request failures, insufficient security controls, and other browser concerns. Open up the Issues panel in Chrome DevTools for more details on each issue.
37A-LighthouseBestPracticesAuditor-490FAILA scored audit this catalog does not list (added by a newer Lighthouse) scores below 0.9. Message: {Lighthouse title}: {display value or item count} (Lighthouse Best Practices audit {id}, desktop).Lighthouse's description of the audit, then the first offending items.Lighthouse's description of the audit without its learn-more link.
37A-LighthouseBestPracticesAuditor-300WARNINGThe Best Practices score is below warningBelowScore and not below failBelowScore. Message: Lighthouse Best Practices score is 75/100 (desktop); the warning threshold is 90.Raise the Best Practices score ({score}) by fixing its lowest-scoring audits first: {audit title} ({display value}); …Outdated libraries, console errors and insecure requests are the defects attackers and browser updates exploit first, so the page breaks or gets compromised without warning.
37A-LighthouseBestPracticesAuditor-401FAILfailBelowScore is equal to or above warningBelowScore; Lighthouse does not run. Message: failBelowScore (90) must be lower than warningBelowScore (50).Set failBelowScore below warningBelowScore on the auditor's Configuration tab; the defaults are 50 and 90.With the thresholds inverted no score can be a warning, so the audit would hide regressions until they are already failures.
37A-LighthouseBestPracticesAuditor-500ERRORLighthouse could not load the page: the run exceeded its time budget, or Lighthouse reported a runtime error (NO_FCP, PAGE_HUNG, DNS_FAILURE, ERRORED_DOCUMENT_REQUEST, …). Message: Lighthouse could not audit {url}: NO_FCP: The page did not paint any content.Make {url} load in a browser within the audit's time limit and re-run the audit. Last error was "{error}".—
37A-LighthouseBestPracticesAuditor-200SUCCESSThe Best Practices score is at or above warningBelowScore. Message: Lighthouse Best Practices score is 95/100 (desktop). At or above the warning threshold of 90.——
37A-LighthouseBestPracticesAuditor-590ERRORThe audited page answered HTTP 403, HTTP 429 or a Cloudflare challenge, so 37AuditsBot was blocked before it could read the page.Allow 37AuditsBot in your firewall or bot protection: allowlist its user agent, or verify its Web Bot Auth signature. See https://www.37audits.com/bot.While 37AuditsBot is blocked this audit cannot look at the site, so problems on it go unreported.

The score check carries in data: category, score, formFactor, both thresholds, failingAudits (up to ten audits of the category below Lighthouse's pass mark, lowest score first, each with id, title, score, displayValue), lighthouseVersion, chromeVersion, benchmarkIndex, elapsedSeconds and runWarnings. Each audit check (1NN, 4NN) adds auditId, auditTitle, auditScore (0–100 or null), scoreDisplayMode, displayValue, weight, group, numericValue, numericUnit, learnMore (Lighthouse's documentation link), inCatalog, itemCount and items (up to ten rows of Lighthouse's details table: DOM nodes reduced to selector, snippet, label and explanation; source locations to url:line:column).

Output Documentation

StatusDescriptionTest logic
INFORMATIONReport pin, manual checks and unscored auditsAlways one 100 check with the Lighthouse and Chrome versions, device profile, duration and benchmark index; plus one 1NN check per audit Lighthouse leaves to a manual check or reports without a score.
SUCCESSThe Best Practices score is at or above the warning thresholdThe score is >= warningBelowScore; the message states the score and counts the failing audits. Every result, whatever its status, also carries one 4NN check per scored audit below 0.9; it never changes the status.
WARNINGThe Best Practices score is below the warning threshold and not below the fail thresholdOne 300 check; the summary states the score.
FAILThe Best Practices score is below the fail threshold, or the thresholds are invertedOne 400 check, or a single 401 check when failBelowScore >= warningBelowScore.
ERRORLighthouse could not audit the page or score the category500 when the page did not load inside the budget or Lighthouse reported a runtime error; 501 when the category has no score; 590 when the page blocked 37AuditsBot.

Risks and Considerations

A score is not a certification

Lighthouse automates the Best Practices checks a machine can run on one page load (HTTPS, front-end libraries with known vulnerabilities, browser console errors, deprecated APIs, third-party cookies, image aspect ratios and resolution, source maps and the document's doctype and charset). A perfect score means no automated check failed, not that the page is flawless; manual review still finds problems automation cannot.

Desktop and mobile differ

The two device profiles render the page at different sizes, so the audits that depend on layout can give different results. Pick the profile that matches the audience and keep it, because the scores of the two profiles are not strictly comparable.

The run is unsigned

The Lighthouse navigation carries the 37AuditsBot user agent but no Web Bot Auth signature. A site that only admits signed bots answers with a challenge, which this audit reports as blocked (590).

The score alone decides the result

Lighthouse weighs its audits into the score, so a page can score 90 with one audit failing. The result follows the score, as Lighthouse's gauge does: that page is a SUCCESS. The failing audit is still listed as a FAIL check, because the item is what the owner has to fix, but it never changes the status of the result. The check order follows Lighthouse's report: heavier audits first, then the lowest scores.

Codes are fixed per audit

Each audit keeps its number across Lighthouse upgrades, so a deep link to a code stays valid. An audit a newer Lighthouse adds is reported with 490 (failing) or 190 (informative or manual) and inCatalog: false in its data until the catalog in this auditor is extended; an audit Lighthouse removes keeps its number unused.

This documentation is built and hosted on Mintlify, a developer documentation platform.

Source: docs.37audits.com

Ready to start auditing?

Add this auditor to your monitoring setup and start identifying issues on your websites today.

© 2026 37 Audits. All rights reserved. Audit your websites with confidence.

Supported by

Made with ❤️ in Floripa