Lighthouse Best Practices score: HTTPS, vulnerable libraries, errors
Thresholds — reads formFactor, warningBelowScore and failBelowScore. When failBelowScore is not lower than warningBelowScore the audit fails with a single check (401) and Lighthouse does not run.
Lighthouse run — runs the Lighthouse CLI (version pinned in the image, reported in the 100 check) with the best-practices category only, the desktop preset or the mobile form factor, and the 37AuditsBot user agent. The run has a time budget derived from the audit's remaining time; a page that does not finish loading inside it is an ERROR (500).
Blocked or unloadable page — an HTTP 403, 429 or Cloudflare challenge on the document is the platform's blocked response (590). Any other Lighthouse runtime error (NO_FCP, PAGE_HUNG, DNS_FAILURE, ERRORED_DOCUMENT_REQUEST, …) is an ERROR (500) that names the error.
Score — the Best Practices score (0–100) is compared with the thresholds: below failBelowScore is FAIL (400), from failBelowScore up to but excluding warningBelowScore is WARNING (300). A category Lighthouse could not score is an ERROR (501). At or above warningBelowScore the audit succeeds (200).
Audits — every audit Lighthouse lists under the Best Practices score becomes a check: a scored audit below Lighthouse's pass mark (0.9) is a FAIL whose code is 400 plus the audit's fixed number in this auditor's catalog (16 audits, 410–431); an audit Lighthouse reports without a score or leaves to a manual check is an INFORMATION with 100 plus that number. An audit a newer Lighthouse adds gets 490 or 190 until the catalog is updated. Hidden Lighthouse audits and audits that do not apply to the page are not reported. These checks keep their own status but never change the result: the score alone decides it.
Report pin — every result carries an INFORMATION check (100) with the Lighthouse and Chrome versions, the device profile, the run duration and Lighthouse's benchmark index, because scores are only comparable between runs of the same Lighthouse version.
The Lighthouse navigation is not signed with Web Bot Auth: Lighthouse opens its own browser target and its only header hook adds headers to every request of the page, which breaks cross-origin fetches. Allowlist the 37AuditsBot user agent if the site challenges unsigned bots. With Basic auth the Authorization header is sent on every request the page makes, third-party origins included, so prefer allowlisting over credentials for a staging site that loads third-party scripts.
| Key | Type | Default | Description |
|---|---|---|---|
formFactor | string | desktop | desktop (Lighthouse desktop preset: no CPU slowdown, fast network) or mobile (Moto G Power emulation, simulated 4G and 4x CPU slowdown, the PageSpeed Insights default). Any other value falls back to desktop. |
warningBelowScore | integer (1–100) | 90 | A Best Practices score below this value produces a WARNING (300). |
failBelowScore | integer (0–99) | 50 | A Best Practices score below this value produces a FAIL (400). Must be lower than warningBelowScore. |
An invalid value (missing, fractional, outside 0–100) makes the auditor fall back to that preference's default and log a warning. A fail threshold equal to or above the warning threshold is not an invalid value: it makes the audit fail (401) until the thresholds are fixed.
Every row maps to one checkRule* method and one CheckCode.
| CheckCode | Status | When it fires | Recommendation | Why it matters |
|---|---|---|---|---|
37A-LighthouseBestPracticesAuditor-100 | INFORMATION | Always. Records the Lighthouse and Chrome versions, the device profile, the run duration and the benchmark index: Lighthouse 12.8.2 on Chrome 138.0.7204.0 audited the page as desktop in 18 s (benchmark index 2186). | — (recommendation is null; nothing for the site to change) | — |
37A-LighthouseBestPracticesAuditor-114 | INFORMATION | Lighthouse reports audit csp-xss without a score: Ensure CSP is effective against XSS attacks. Message: Ensure CSP is effective against XSS attacks: {display value or item count} (Lighthouse Best Practices audit csp-xss, desktop; reported without a score). | A strong Content Security Policy (CSP) significantly reduces the risk of cross-site scripting (XSS) attacks. Learn how to use a CSP to prevent XSS (https://developer.chrome.com/docs/lighthouse/best-practices/csp-xss/) Found: {up to three items}. | — |
37A-LighthouseBestPracticesAuditor-115 | INFORMATION | Lighthouse reports audit has-hsts without a score: Use a strong HSTS policy. Message: Use a strong HSTS policy: {display value or item count} (Lighthouse Best Practices audit has-hsts, desktop; reported without a score). | Deployment of the HSTS header significantly reduces the risk of downgrading HTTP connections and eavesdropping attacks. A rollout in stages, starting with a low max-age is recommended. Learn more about using a strong HSTS policy. (https://developer.chrome.com/docs/lighthouse/best-practices/has-hsts) Found: {up to three items}. | — |
37A-LighthouseBestPracticesAuditor-116 | INFORMATION | Lighthouse reports audit origin-isolation without a score: Ensure proper origin isolation with COOP. Message: Ensure proper origin isolation with COOP: {display value or item count} (Lighthouse Best Practices audit origin-isolation, desktop; reported without a score). | The Cross-Origin-Opener-Policy (COOP) can be used to isolate the top-level window from other documents such as pop-ups. Learn more about deploying the COOP header. (https://web.dev/articles/why-coop-coep#coop) Found: {up to three items}. | — |
37A-LighthouseBestPracticesAuditor-117 | INFORMATION | Lighthouse reports audit clickjacking-mitigation without a score: Mitigate clickjacking with XFO or CSP. Message: Mitigate clickjacking with XFO or CSP: {display value or item count} (Lighthouse Best Practices audit clickjacking-mitigation, desktop; reported without a score). | The X-Frame-Options (XFO) header or the frame-ancestors directive in the Content-Security-Policy (CSP) header control where a page can be embedded. These can mitigate clickjacking attacks by blocking some or all sites from embedding the page. Learn more about mitigating clickjacking (https://developer.chrome.com/docs/lighthouse/best-practices/clickjacking-mitigation). Found: {up to three items}. | — |
37A-LighthouseBestPracticesAuditor-118 | INFORMATION | Lighthouse reports audit trusted-types-xss without a score: Mitigate DOM-based XSS with Trusted Types. Message: Mitigate DOM-based XSS with Trusted Types: {display value or item count} (Lighthouse Best Practices audit trusted-types-xss, desktop; reported without a score). | The require-trusted-types-for directive in the Content-Security-Policy (CSP) header instructs user agents to control the data passed to DOM XSS sink functions. Learn more about mitigating DOM-based XSS with Trusted Types (https://developer.chrome.com/docs/lighthouse/best-practices/trusted-types-xss). Found: {up to three items}. | — |
37A-LighthouseBestPracticesAuditor-126 | INFORMATION | Lighthouse reports audit js-libraries without a score: Detected JavaScript libraries. Message: Detected JavaScript libraries: {display value or item count} (Lighthouse Best Practices audit js-libraries, desktop; reported without a score). | All front-end JavaScript libraries detected on the page. Learn more about this JavaScript library detection diagnostic audit (https://developer.chrome.com/docs/lighthouse/best-practices/js-libraries/). Found: {up to three items}. | — |
37A-LighthouseBestPracticesAuditor-190 | INFORMATION | An audit this catalog does not list (added by a newer Lighthouse) is reported without a score or left to a manual check. Message as above, with the audit's own title and id; inCatalog is false in the data. | Lighthouse's description of the audit, then the first items it found. | — |
37A-LighthouseBestPracticesAuditor-501 | ERROR | Lighthouse ran but gave the Best Practices category no score (score: null). | Re-run the audit; if the Best Practices score stays empty, check the page for errors during load in Lighthouse's report. | — |
37A-LighthouseBestPracticesAuditor-400 | FAIL | The Best Practices score is below failBelowScore. Message: Lighthouse Best Practices score is 42/100 (desktop); the fail threshold is 50. | Raise the Best Practices score ({score}) by fixing its lowest-scoring audits first: {audit title} ({display value}); … | Outdated libraries, console errors and insecure requests are the defects attackers and browser updates exploit first, so the page breaks or gets compromised without warning. |
37A-LighthouseBestPracticesAuditor-410 | FAIL | Lighthouse audit is-on-https scores below 0.9: Does not use HTTPS. Message: Does not use HTTPS: {display value or item count} (Lighthouse Best Practices audit is-on-https, desktop). | All sites should be protected with HTTPS, even ones that don't handle sensitive data. This includes avoiding mixed content (https://developers.google.com/web/fundamentals/security/prevent-mixed-content/what-is-mixed-content), where some resources are loaded over HTTP despite the initial request being served over HTTPS. HTTPS prevents intruders from tampering with or passively listening in on the communications between your app and your users, and is a prerequisite for HTTP/2 and many new web platform APIs. Learn more about HTTPS (https://developer.chrome.com/docs/lighthouse/pwa/is-on-https/). Found: {up to three offending items}. | All sites should be protected with HTTPS, even ones that don't handle sensitive data. This includes avoiding mixed content, where some resources are loaded over HTTP despite the initial request being served over HTTPS. HTTPS prevents intruders from tampering with or passively listening in on the communications between your app and your users, and is a prerequisite for HTTP/2 and many new web platform APIs. |
37A-LighthouseBestPracticesAuditor-411 | FAIL | Lighthouse audit redirects-http scores below 0.9: Does not redirect HTTP traffic to HTTPS. Message: Does not redirect HTTP traffic to HTTPS: {display value or item count} (Lighthouse Best Practices audit redirects-http, desktop). | Make sure that you redirect all HTTP traffic to HTTPS in order to enable secure web features for all your users. Learn more (https://developer.chrome.com/docs/lighthouse/pwa/redirects-http/). Found: {up to three offending items}. | Make sure that you redirect all HTTP traffic to HTTPS in order to enable secure web features for all your users. |
37A-LighthouseBestPracticesAuditor-412 | FAIL | Lighthouse audit geolocation-on-start scores below 0.9: Requests the geolocation permission on page load. Message: Requests the geolocation permission on page load: {display value or item count} (Lighthouse Best Practices audit geolocation-on-start, desktop). | Users are mistrustful of or confused by sites that request their location without context. Consider tying the request to a user action instead. Learn more about the geolocation permission (https://developer.chrome.com/docs/lighthouse/best-practices/geolocation-on-start/). Found: {up to three offending items}. | Users are mistrustful of or confused by sites that request their location without context. Consider tying the request to a user action instead. |
37A-LighthouseBestPracticesAuditor-413 | FAIL | Lighthouse audit notification-on-start scores below 0.9: Requests the notification permission on page load. Message: Requests the notification permission on page load: {display value or item count} (Lighthouse Best Practices audit notification-on-start, desktop). | Users are mistrustful of or confused by sites that request to send notifications without context. Consider tying the request to user gestures instead. Learn more about responsibly getting permission for notifications (https://developer.chrome.com/docs/lighthouse/best-practices/notification-on-start/). Found: {up to three offending items}. | Users are mistrustful of or confused by sites that request to send notifications without context. Consider tying the request to user gestures instead. |
37A-LighthouseBestPracticesAuditor-419 | FAIL | Lighthouse audit paste-preventing-inputs scores below 0.9: Prevents users from pasting into input fields. Message: Prevents users from pasting into input fields: {display value or item count} (Lighthouse Best Practices audit paste-preventing-inputs, desktop). | Preventing input pasting is a bad practice for the UX, and weakens security by blocking password managers.Learn more about user-friendly input fields (https://developer.chrome.com/docs/lighthouse/best-practices/paste-preventing-inputs/). Found: {up to three offending items}. | Preventing input pasting is a bad practice for the UX, and weakens security by blocking password managers. |
37A-LighthouseBestPracticesAuditor-420 | FAIL | Lighthouse audit image-aspect-ratio scores below 0.9: Displays images with incorrect aspect ratio. Message: Displays images with incorrect aspect ratio: {display value or item count} (Lighthouse Best Practices audit image-aspect-ratio, desktop). | Image display dimensions should match natural aspect ratio. Learn more about image aspect ratio (https://developer.chrome.com/docs/lighthouse/best-practices/image-aspect-ratio/). Found: {up to three offending items}. | Image display dimensions should match natural aspect ratio. |
37A-LighthouseBestPracticesAuditor-421 | FAIL | Lighthouse audit image-size-responsive scores below 0.9: Serves images with low resolution. Message: Serves images with low resolution: {display value or item count} (Lighthouse Best Practices audit image-size-responsive, desktop). | Image natural dimensions should be proportional to the display size and the pixel ratio to maximize image clarity. Learn how to provide responsive images (https://web.dev/articles/serve-responsive-images). Found: {up to three offending items}. | Image natural dimensions should be proportional to the display size and the pixel ratio to maximize image clarity. |
37A-LighthouseBestPracticesAuditor-422 | FAIL | Lighthouse audit viewport scores below 0.9: Does not have a <meta name="viewport"> tag with width or initial-scale. Message: Does not have a <meta name="viewport"> tag with width or initial-scale: {display value or item count} (Lighthouse Best Practices audit viewport, desktop). | A <meta name="viewport"> not only optimizes your app for mobile screen sizes, but also prevents a 300 millisecond delay to user input (https://developer.chrome.com/blog/300ms-tap-delay-gone-away/). Learn more about using the viewport meta tag (https://developer.chrome.com/docs/lighthouse/pwa/viewport/). Found: {up to three offending items}. | A <meta name="viewport"> not only optimizes your app for mobile screen sizes, but also prevents a 300 millisecond delay to user input. |
37A-LighthouseBestPracticesAuditor-423 | FAIL | Lighthouse audit font-size scores below 0.9: Document doesn't use legible font sizes. Message: Document doesn't use legible font sizes: {display value or item count} (Lighthouse Best Practices audit font-size, desktop). | Font sizes less than 12px are too small to be legible and require mobile visitors to “pinch to zoom” in order to read. Strive to have >60% of page text ≥12px. Learn more about legible font sizes (https://developer.chrome.com/docs/lighthouse/seo/font-size/). Found: {up to three offending items}. | Font sizes less than 12px are too small to be legible and require mobile visitors to “pinch to zoom” in order to read. Strive to have >60% of page text ≥12px. |
37A-LighthouseBestPracticesAuditor-424 | FAIL | Lighthouse audit doctype scores below 0.9: Page lacks the HTML doctype, thus triggering quirks-mode. Message: Page lacks the HTML doctype, thus triggering quirks-mode: {display value or item count} (Lighthouse Best Practices audit doctype, desktop). | Specifying a doctype prevents the browser from switching to quirks-mode. Learn more about the doctype declaration (https://developer.chrome.com/docs/lighthouse/best-practices/doctype/). Found: {up to three offending items}. | Specifying a doctype prevents the browser from switching to quirks-mode. |
37A-LighthouseBestPracticesAuditor-425 | FAIL | Lighthouse audit charset scores below 0.9: Charset declaration is missing or occurs too late in the HTML. Message: Charset declaration is missing or occurs too late in the HTML: {display value or item count} (Lighthouse Best Practices audit charset, desktop). | A character encoding declaration is required. It can be done with a <meta> tag in the first 1024 bytes of the HTML or in the Content-Type HTTP response header. Learn more about declaring the character encoding (https://developer.chrome.com/docs/lighthouse/best-practices/charset/). Found: {up to three offending items}. | A character encoding declaration is required. It can be done with a <meta> tag in the first 1024 bytes of the HTML or in the Content-Type HTTP response header. |
37A-LighthouseBestPracticesAuditor-427 | FAIL | Lighthouse audit deprecations scores below 0.9: Uses deprecated APIs. Message: Uses deprecated APIs: {display value or item count} (Lighthouse Best Practices audit deprecations, desktop). | Deprecated APIs will eventually be removed from the browser. Learn more about deprecated APIs (https://developer.chrome.com/docs/lighthouse/best-practices/deprecations/). Found: {up to three offending items}. | Deprecated APIs will eventually be removed from the browser. |
37A-LighthouseBestPracticesAuditor-428 | FAIL | Lighthouse audit third-party-cookies scores below 0.9: Uses third-party cookies. Message: Uses third-party cookies: {display value or item count} (Lighthouse Best Practices audit third-party-cookies, desktop). | Third-party cookies may be blocked in some contexts. Learn more about preparing for third-party cookie restrictions (https://privacysandbox.google.com/cookies/prepare/overview). Found: {up to three offending items}. | Third-party cookies may be blocked in some contexts. |
37A-LighthouseBestPracticesAuditor-429 | FAIL | Lighthouse audit errors-in-console scores below 0.9: Browser errors were logged to the console. Message: Browser errors were logged to the console: {display value or item count} (Lighthouse Best Practices audit errors-in-console, desktop). | Errors logged to the console indicate unresolved problems. They can come from network request failures and other browser concerns. Learn more about this errors in console diagnostic audit (https://developer.chrome.com/docs/lighthouse/best-practices/errors-in-console/) Found: {up to three offending items}. | Errors logged to the console indicate unresolved problems. They can come from network request failures and other browser concerns. |
37A-LighthouseBestPracticesAuditor-430 | FAIL | Lighthouse audit valid-source-maps scores below 0.9: Missing source maps for large first-party JavaScript. Message: Missing source maps for large first-party JavaScript: {display value or item count} (Lighthouse Best Practices audit valid-source-maps, desktop). | Source maps translate minified code to the original source code. This helps developers debug in production. In addition, Lighthouse is able to provide further insights. Consider deploying source maps to take advantage of these benefits. Learn more about source maps (https://developer.chrome.com/docs/devtools/javascript/source-maps/). Found: {up to three offending items}. | Source maps translate minified code to the original source code. This helps developers debug in production. In addition, Lighthouse is able to provide further insights. Consider deploying source maps to take advantage of these benefits. |
37A-LighthouseBestPracticesAuditor-431 | FAIL | Lighthouse audit inspector-issues scores below 0.9: Issues were logged in the Issues panel in Chrome Devtools. Message: Issues were logged in the Issues panel in Chrome Devtools: {display value or item count} (Lighthouse Best Practices audit inspector-issues, desktop). | Issues logged to the Issues panel in Chrome Devtools indicate unresolved problems. They can come from network request failures, insufficient security controls, and other browser concerns. Open up the Issues panel in Chrome DevTools for more details on each issue. Found: {up to three offending items}. | Issues logged to the Issues panel in Chrome Devtools indicate unresolved problems. They can come from network request failures, insufficient security controls, and other browser concerns. Open up the Issues panel in Chrome DevTools for more details on each issue. |
37A-LighthouseBestPracticesAuditor-490 | FAIL | A scored audit this catalog does not list (added by a newer Lighthouse) scores below 0.9. Message: {Lighthouse title}: {display value or item count} (Lighthouse Best Practices audit {id}, desktop). | Lighthouse's description of the audit, then the first offending items. | Lighthouse's description of the audit without its learn-more link. |
37A-LighthouseBestPracticesAuditor-300 | WARNING | The Best Practices score is below warningBelowScore and not below failBelowScore. Message: Lighthouse Best Practices score is 75/100 (desktop); the warning threshold is 90. | Raise the Best Practices score ({score}) by fixing its lowest-scoring audits first: {audit title} ({display value}); … | Outdated libraries, console errors and insecure requests are the defects attackers and browser updates exploit first, so the page breaks or gets compromised without warning. |
37A-LighthouseBestPracticesAuditor-401 | FAIL | failBelowScore is equal to or above warningBelowScore; Lighthouse does not run. Message: failBelowScore (90) must be lower than warningBelowScore (50). | Set failBelowScore below warningBelowScore on the auditor's Configuration tab; the defaults are 50 and 90. | With the thresholds inverted no score can be a warning, so the audit would hide regressions until they are already failures. |
37A-LighthouseBestPracticesAuditor-500 | ERROR | Lighthouse could not load the page: the run exceeded its time budget, or Lighthouse reported a runtime error (NO_FCP, PAGE_HUNG, DNS_FAILURE, ERRORED_DOCUMENT_REQUEST, …). Message: Lighthouse could not audit {url}: NO_FCP: The page did not paint any content. | Make {url} load in a browser within the audit's time limit and re-run the audit. Last error was "{error}". | — |
37A-LighthouseBestPracticesAuditor-200 | SUCCESS | The Best Practices score is at or above warningBelowScore. Message: Lighthouse Best Practices score is 95/100 (desktop). At or above the warning threshold of 90. | — | — |
37A-LighthouseBestPracticesAuditor-590 | ERROR | The audited page answered HTTP 403, HTTP 429 or a Cloudflare challenge, so 37AuditsBot was blocked before it could read the page. | Allow 37AuditsBot in your firewall or bot protection: allowlist its user agent, or verify its Web Bot Auth signature. See https://www.37audits.com/bot. | While 37AuditsBot is blocked this audit cannot look at the site, so problems on it go unreported. |
The score check carries in data: category, score, formFactor, both thresholds, failingAudits (up to ten audits of the category below Lighthouse's pass mark, lowest score first, each with id, title, score, displayValue), lighthouseVersion, chromeVersion, benchmarkIndex, elapsedSeconds and runWarnings. Each audit check (1NN, 4NN) adds auditId, auditTitle, auditScore (0–100 or null), scoreDisplayMode, displayValue, weight, group, numericValue, numericUnit, learnMore (Lighthouse's documentation link), inCatalog, itemCount and items (up to ten rows of Lighthouse's details table: DOM nodes reduced to selector, snippet, label and explanation; source locations to url:line:column).
| Status | Description | Test logic |
|---|---|---|
| INFORMATION | Report pin, manual checks and unscored audits | Always one 100 check with the Lighthouse and Chrome versions, device profile, duration and benchmark index; plus one 1NN check per audit Lighthouse leaves to a manual check or reports without a score. |
| SUCCESS | The Best Practices score is at or above the warning threshold | The score is >= warningBelowScore; the message states the score and counts the failing audits. Every result, whatever its status, also carries one 4NN check per scored audit below 0.9; it never changes the status. |
| WARNING | The Best Practices score is below the warning threshold and not below the fail threshold | One 300 check; the summary states the score. |
| FAIL | The Best Practices score is below the fail threshold, or the thresholds are inverted | One 400 check, or a single 401 check when failBelowScore >= warningBelowScore. |
| ERROR | Lighthouse could not audit the page or score the category | 500 when the page did not load inside the budget or Lighthouse reported a runtime error; 501 when the category has no score; 590 when the page blocked 37AuditsBot. |
Lighthouse automates the Best Practices checks a machine can run on one page load (HTTPS, front-end libraries with known vulnerabilities, browser console errors, deprecated APIs, third-party cookies, image aspect ratios and resolution, source maps and the document's doctype and charset). A perfect score means no automated check failed, not that the page is flawless; manual review still finds problems automation cannot.
The two device profiles render the page at different sizes, so the audits that depend on layout can give different results. Pick the profile that matches the audience and keep it, because the scores of the two profiles are not strictly comparable.
The Lighthouse navigation carries the 37AuditsBot user agent but no Web Bot Auth signature. A site that only admits signed bots answers with a challenge, which this audit reports as blocked (590).
Lighthouse weighs its audits into the score, so a page can score 90 with one audit failing. The result follows the score, as Lighthouse's gauge does: that page is a SUCCESS. The failing audit is still listed as a FAIL check, because the item is what the owner has to fix, but it never changes the status of the result. The check order follows Lighthouse's report: heavier audits first, then the lowest scores.
Each audit keeps its number across Lighthouse upgrades, so a deep link to a code stays valid. An audit a newer Lighthouse adds is reported with 490 (failing) or 190 (informative or manual) and inCatalog: false in its data until the catalog in this auditor is extended; an audit Lighthouse removes keeps its number unused.
This documentation is built and hosted on Mintlify, a developer documentation platform.
Add this auditor to your monitoring setup and start identifying issues on your websites today.