Audit Result

Found 43 characters. Length is optimal.

Found 148 characters. Good snippet length.

Canonical found: https://www.lucebase.com/

Favicon found and reachable: /pwa-icon.svg (HTTP 200).

Viewport configured: width=device-width, initial-scale=1.0, viewport-fit=cover

Language declared as "es-MX".

No H1 heading found.

Fix: Use a single, descriptive <h1> that states the primary purpose of the page.

Valid heading flow across 17 headings.

All 6 images include alt text.

Page is served over HTTPS.

2 HTTPS hardening issues detected.

• • HSTS is missing includeSubDomains.
• • Could not probe the HTTP version of this page.
• • Strict-Transport-Security: max-age=63072000

Fix: Set Strict-Transport-Security with a long max-age, add includeSubDomains, and redirect all HTTP requests to HTTPS.

Core security headers were detected.

2 CSP hardening issues detected.

• • script-src/default-src permits 'unsafe-inline'.
• • CSP is missing frame-ancestors protection.
• • Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' https://js.stripe.com; style-src 'self' 'unsafe-inline'; connect-src 'self' https://*.supabase.co wss://*.supabase.co https://api.stripe.com https://api.conekta.io https://api.mercadopago.com https://*.wikipedia.org https://upload.wikimedia.org; img-src 'self' data: blob: https:; frame-src https://js.stripe.com; font-src 'self' https://fonts.gstatic.com; object-src 'none'; base-uri 'self';

Fix: Tighten Content-Security-Policy by removing unsafe directives and adding object-src, base-uri, and frame-ancestors restrictions.

No first-party cookies were set during the initial page load.

Server response headers do not expose version tokens.

Domain does not appear to be behind Cloudflare.

Loaded in 0.45s (perceived).

1 scripts and 1 styles may block rendering.

• • script: https://www.lucebase.com/registerSW.js
• • style: https://www.lucebase.com/assets/index-2_gHj2PF.css

Fix: Defer non-critical scripts and inline critical CSS to improve first paint speed.

4 text resources look uncompressed.

• • https://www.lucebase.com/registerSW.js (application/javascript; charset=utf-8)
• • https://www.lucebase.com/assets/lock-BfUyV4ct.js (application/javascript; charset=utf-8)
• • https://www.lucebase.com/assets/refresh-cw-DqS72hIj.js (application/javascript; charset=utf-8)
• • https://odtqsptglayxtwqvxxyr.supabase.co/rest/v1/profiles?select=id%2Cusername%2Ctotal_won%2Ctotal_bet%2Cavatar_color&total_won=gt.0&order=total_won.desc&limit=5 (application/json; charset=utf-8)

Fix: Enable Brotli or Gzip compression for HTML, CSS, JS, and JSON responses.

Found robots.txt (200).

Found sitemap (200) at https://www.lucebase.com/sitemap.xml.

Robots meta found: index, follow

2 of 2 controls are missing labels.

• • input[type="text"].w-full.bg-gray-100 (Buscar mercados...)
• • input[type="text"].w-full.bg-gray-100 (Buscar mercados...)

Fix: Associate each form control with a visible label, aria-label, or aria-labelledby.

Header, nav, main, and footer landmarks are present.

25 interactive elements appear smaller than 48px.

• • a.flex.items-center (LLucebase) - 111x28px
• • button.inline-flex.items-center (Entrar) - 104x38px
• • button.flex.items-center (Tendencia) - 111x32px
• • button.flex.items-center (Nuevo) - 86x32px
• • button.flex.items-center (Popular) - 95x32px
• • button.flex.items-center (Cierra pronto) - 132x32px
• • button.flex.items-center (Guardados) - 117x32px
• • button.px-3.py-1.5 (Morbo) - 64x32px
• • button.px-3.py-1.5 (Política) - 70x32px
• • button.px-3.py-1.5 (Deportes) - 81x32px
• • button.px-3.py-1.5 (Entretenimiento) - 122x32px
• • button.px-3.py-1.5 (Finanzas) - 81x32px
• • button.px-3.py-1.5 (Tech) - 54x32px
• • button.px-3.py-1.5 (Música) - 68x32px
• • button.px-3.py-1.5 (Negocios) - 82x32px
• • button.px-3.py-1.5 (Elecciones) - 92x32px
• • button.px-3.py-1.5 (Redes) - 64x32px
• • button.px-3.py-1.5 (Cultura) - 69x32px
• • button.flex.items-center (Más) - 65x32px
• • a.flex.items-center (Ayuda) - 82x32px
• • button (Sí) - 127x46px
• • button (No) - 127x46px
• • button (Copiar enlace) - 27x27px
• • button (Guardar) - 27x27px
• • button (Sí) - 127x46px

Fix: Increase target size to at least 48x48 CSS pixels for touch interactions.

Core Open Graph tags are present.

og:image is present and absolute.

twitter:card set to summary_large_image.

JSON-LD schema detected.

Manifest and Apple touch icon are configured.

1 social preview quality issues detected.

• • ISSUE: Could not determine preview image dimensions.
• • GUIDELINE: Optimal og:title length: 40-60 characters (acceptable: 10-70).
• • GUIDELINE: Optimal og:description length: 110-160 characters (acceptable: 50-200).
• • GUIDELINE: Optimal preview image size: 1200x630 pixels.
• • GUIDELINE: Optimal preview image aspect ratio: 1.91:1.
• • GUIDELINE: Optimal preview image file size: under 5 MB.
• • GUIDELINE: Recommended twitter:card: summary_large_image.
• • MEASURED: Image size: 0.00 MB

Fix: Use absolute OG/Twitter URLs, keep metadata lengths in recommended ranges, and provide a preview image near 1200x630 under 5MB.

Checked 23 links. No broken internal links found.

10 external links returned errors or timed out.

• • https://trends.google.com/trends/explore?q=k&geo=MX (HTTP 429)
• • https://trends.google.com/trends/explore?q=e&geo=MX (HTTP 429)
• • https://trends.google.com/trends/explore?q=fa%20cup&geo=MX (HTTP 429)
• • https://trends.google.com/trends/explore?q=getafe%20vs%20barcelona&geo=MX (HTTP 429)
• • https://trends.google.com/trends/explore?q=shohei%20ohtani&geo=MX (HTTP 429)
• • https://trends.google.com/trends/explore?q=palenque%20puebla%202026&geo=MX (HTTP 429)
• • https://trends.google.com/trends/explore?q=anne%20hathaway&geo=MX (HTTP 429)
• • https://trends.google.com/trends/explore?q=clima%20puebla&geo=MX (HTTP 429)
• • https://trends.google.com/trends/explore?q=adam%20sandler&geo=MX (HTTP 429)
• • https://trends.google.com/trends/explore?q=luke%20kornet&geo=MX (HTTP 429)

Fix: Replace dead external URLs or point to working alternatives.

2 links are empty, invalid, or placeholder-only.

• • href="#"
• • href="#"

Fix: Replace empty/#/javascript href values with real destinations or use buttons for non-navigation actions.

Largest Contentful Paint: 0.70s.

Cumulative Layout Shift: 0.022.

Total Blocking Time estimate: 0ms.

4 asset requests failed.

• • https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800;900&family=DM+Sans:ital,opsz,wght@0,9..40,300;0,9..40,400;0,9..40,500;0,9..40,600;0,9..40,700;1,9..40,400&family=Azeret+Mono:wght@400;500;600&display=swap (csp)
• • https://upload.wikimedia.org/wikipedia/commons/thumb/5/56/Donald_Trump_official_portrait.jpg/440px-Donald_Trump_official_portrait.jpg (net::ERR_BLOCKED_BY_ORB)
• • https://logo.clearbit.com/femsa.com (net::ERR_NAME_NOT_RESOLVED)
• • https://logo.clearbit.com/bmv.com.mx (net::ERR_NAME_NOT_RESOLVED)

Fix: Fix missing files, update asset URLs, and ensure static assets return HTTP 200.

8 JavaScript runtime issues detected.

• • X-Frame-Options may only be set via an HTTP header sent along with a document. It may not be set inside <meta>. [https://www.lucebase.com/:19]
• • Loading the stylesheet 'https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800;900&family=DM+Sans:ital,opsz,wght@0,9..40,300;0,9..40,400;0,9..40,500;0,9..40,600;0,9..40,700;1,9..40,400&family=Azeret+Mono:wght@400;500;600&display=swap' violates the following Content Security Policy directive: "style-src 'self' 'unsafe-inline'". Note that 'style-src-elem' was not explicitly set, so 'style-src' is used as a fallback. The action has been blocked. [https://www.lucebase.com/:1]
• • Connecting to 'https://api.kraken.com/0/public/OHLC?pair=XBTUSD,ETHUSD&interval=1440&since=1776415997' violates the following Content Security Policy directive: "connect-src 'self' https://*.supabase.co wss://*.supabase.co https://api.stripe.com https://api.conekta.io https://api.mercadopago.com https://*.wikipedia.org https://upload.wikimedia.org". The action has been blocked. [https://www.lucebase.com/assets/StatsSection-Bomci1Qp.js:11]
• • Fetch API cannot load https://api.kraken.com/0/public/OHLC?pair=XBTUSD,ETHUSD&interval=1440&since=1776415997. Refused to connect because it violates the document's Content Security Policy. [https://www.lucebase.com/assets/StatsSection-Bomci1Qp.js:11]
• • Connecting to 'https://open.er-api.com/v6/latest/USD' violates the following Content Security Policy directive: "connect-src 'self' https://*.supabase.co wss://*.supabase.co https://api.stripe.com https://api.conekta.io https://api.mercadopago.com https://*.wikipedia.org https://upload.wikimedia.org". The action has been blocked. [https://www.lucebase.com/assets/StatsSection-Bomci1Qp.js:11]
• • Fetch API cannot load https://open.er-api.com/v6/latest/USD. Refused to connect because it violates the document's Content Security Policy. [https://www.lucebase.com/assets/StatsSection-Bomci1Qp.js:11]
• • Failed to load resource: net::ERR_NAME_NOT_RESOLVED [https://logo.clearbit.com/femsa.com:1]
• • Failed to load resource: net::ERR_NAME_NOT_RESOLVED [https://logo.clearbit.com/bmv.com.mx:1]

Fix: Fix JS files returning 404/failed requests and resolve the listed runtime exceptions.