Lighthouse Best Practices Guide
Best Practices audits check whether your site follows established web standards for security, browser compatibility, and user experience. Most produce a pass or fail result, though the exact audit set and category scoring can change between Lighthouse versions.
A site can score 100 on Performance and still fail Best Practices because of a single console error or missing HTTPS. These audits catch the fundamentals that are easy to overlook but damage user trust.
What Best Practices measures
Treat the category score as a summary, then inspect each failed audit. A score alone cannot tell you whether the problem is a harmless deprecation in a third-party script or an insecure request that exposes user data.
These audits fall into three categories:
- Security - Protecting users from attacks and data theft.
- Browser Compatibility - Ensuring your site works across browsers and devices.
- User Experience - Respecting user expectations and avoiding dark patterns.
Security audits
Security audits verify your site protects users from common attack vectors.
| Audit | What It Checks | Why It Matters |
|---|---|---|
| Uses HTTPS | Page loaded over secure connection | Prevents man-in-the-middle attacks, required for modern APIs |
| Redirects HTTP to HTTPS | HTTP requests redirect to HTTPS | Ensures users always land on secure version |
Browsers treat HTTP pages as insecure, and many web platform APIs require a secure context. Redirect every HTTP request to HTTPS, then check for mixed content loaded by scripts, styles, images, and frames.
Browser compatibility audits
These audits check that your site works correctly across browsers and uses modern web platform features.
| Audit | What It Checks | Why It Matters |
|---|---|---|
| bfcache eligible | Page can use back/forward cache | Instant back navigation, better UX |
| Valid charset | Character encoding declared properly | Prevents garbled text, accessibility issues |
| Valid DOCTYPE | HTML5 doctype present | Standards mode rendering, predictable behavior |
| Avoids deprecated APIs | No deprecated browser APIs used | Future-proofing, avoiding breaking changes |
The bfcache audit is particularly impactful. When eligible, back/forward navigation is instant; the browser restores the page from memory rather than reloading. Users expect this behavior and notice when it's broken.
User experience audits
UX audits catch patterns that frustrate users or violate their expectations.
| Audit | What It Checks | Why It Matters |
|---|---|---|
| No browser errors | Console free of errors | Errors indicate broken functionality |
| No geolocation on start | Geolocation not requested on load | Permission requests need user context |
| No notification on start | Notifications not requested on load | Same principle; context before permission |
| Allows paste in passwords | Password fields allow pasting | Password managers need paste support |
| Proper image sizing | Images sized appropriately for display | Prevents blurry or wasteful images |
| Correct aspect ratios | Images maintain aspect ratio | Prevents distorted images |
| No DevTools issues | No issues flagged by DevTools | Catches various browser-detected problems |
The permission audits reflect a broader principle: never ask for permissions without user context. A geolocation prompt on page load feels invasive. The same prompt after clicking "Find stores near me" makes sense.
Scoring and version changes
Lighthouse calculates the category score from the audits included in that release. Do not hard-code an expected point deduction for one failure. Record the Lighthouse and Chrome versions in CI so a tool upgrade is easy to distinguish from a site regression.
Lighthouse 13 removed several legacy audits after moving their guidance into the newer Insights model. When an audit disappears after an upgrade, compare the basic issue and report details before assuming the site fixed it.
Common failure patterns
Third-party scripts: Ad networks, analytics, and widgets often throw console errors or use deprecated APIs. Choose better vendors or load scripts conditionally if you can't fix these.
Development leftovers: Uncaught promise rejections and code paths that only fail with production data. Treat plain console.log output as noise; runtime errors need separate investigation.
Legacy code: Old APIs that still work but are deprecated. The site functions, but the audit fails. Refactoring takes time but avoids future breakage.
Eager permission requests: Marketing pressure to prompt for notifications immediately. This tanks user trust and fails the audit. Delay permission requests until users demonstrate intent.
How to diagnose issues
Chrome DevTools:
- Open DevTools, then select the Console tab.
- Reload the page with Preserve log enabled and reproduce the relevant interaction.
- Check the Issues tab for browser-detected problems.
- Run Lighthouse from the Lighthouse tab in a clean profile.
- Repeat on one URL from each template. A shared layout or third-party script can fail across hundreds of routes.
Key things to check:
- Any JavaScript errors in console?
- Any deprecation warnings?
- What permission prompts appear on load?
- Is the page served over HTTPS?
- Does HTTP redirect to HTTPS?
All Best Practices issues
Quick reference for every audit:
| Audit | Category | Fix Guide |
|---|---|---|
| Uses HTTPS | Security | Fix |
| Redirects HTTP to HTTPS | Security | Fix |
| bfcache eligible | Browser | Fix |
| Valid charset | Browser | Fix |
| Valid DOCTYPE | Browser | Fix |
| Avoids deprecated APIs | Browser | Fix |
| No browser errors | UX | Fix |
| No geolocation on start | UX | Fix |
| No notification on start | UX | Fix |
| Allows paste in passwords | UX | Fix |
| Proper image sizing | UX | Fix |
| Correct aspect ratios | UX | Fix |
| No DevTools issues | UX | Fix |
Diagnose your specific issue
Test your entire site
The home page might pass Best Practices while blog posts throw console errors. The checkout flow might request permissions inappropriately. Dynamic pages might have image sizing issues that static pages don't.
Unlighthouse scans your entire site and surfaces Best Practices scores for every page. You'll find console errors on obscure pages, permission prompts you forgot about, and deprecated APIs in legacy sections.
The CLI is free and runs locally. Cloud adds scheduled monitoring to catch regressions, such as when a third-party script update breaks your score.