Skip to main content

Lighthouse Best Practices Guide

Understand Lighthouse Best Practices audits, fix common security and browser issues, and verify failures across every page template.
Harlan WiltonHarlan Wilton6 min read Published Updated

Best Practices audits check whether your site follows established web standards for security, browser compatibility, and user experience. Most produce a pass or fail result, though the exact audit set and category scoring can change between Lighthouse versions.

A site can score 100 on Performance and still fail Best Practices because of a single console error or missing HTTPS. These audits catch the fundamentals that are easy to overlook but damage user trust.

What Best Practices measures

Treat the category score as a summary, then inspect each failed audit. A score alone cannot tell you whether the problem is a harmless deprecation in a third-party script or an insecure request that exposes user data.

These audits fall into three categories:

  • Security - Protecting users from attacks and data theft.
  • Browser Compatibility - Ensuring your site works across browsers and devices.
  • User Experience - Respecting user expectations and avoiding dark patterns.

Security audits

Security audits verify your site protects users from common attack vectors.

AuditWhat It ChecksWhy It Matters
Uses HTTPSPage loaded over secure connectionPrevents man-in-the-middle attacks, required for modern APIs
Redirects HTTP to HTTPSHTTP requests redirect to HTTPSEnsures users always land on secure version

Browsers treat HTTP pages as insecure, and many web platform APIs require a secure context. Redirect every HTTP request to HTTPS, then check for mixed content loaded by scripts, styles, images, and frames.

Browser compatibility audits

These audits check that your site works correctly across browsers and uses modern web platform features.

AuditWhat It ChecksWhy It Matters
bfcache eligiblePage can use back/forward cacheInstant back navigation, better UX
Valid charsetCharacter encoding declared properlyPrevents garbled text, accessibility issues
Valid DOCTYPEHTML5 doctype presentStandards mode rendering, predictable behavior
Avoids deprecated APIsNo deprecated browser APIs usedFuture-proofing, avoiding breaking changes

The bfcache audit is particularly impactful. When eligible, back/forward navigation is instant; the browser restores the page from memory rather than reloading. Users expect this behavior and notice when it's broken.

User experience audits

UX audits catch patterns that frustrate users or violate their expectations.

AuditWhat It ChecksWhy It Matters
No browser errorsConsole free of errorsErrors indicate broken functionality
No geolocation on startGeolocation not requested on loadPermission requests need user context
No notification on startNotifications not requested on loadSame principle; context before permission
Allows paste in passwordsPassword fields allow pastingPassword managers need paste support
Proper image sizingImages sized appropriately for displayPrevents blurry or wasteful images
Correct aspect ratiosImages maintain aspect ratioPrevents distorted images
No DevTools issuesNo issues flagged by DevToolsCatches various browser-detected problems

The permission audits reflect a broader principle: never ask for permissions without user context. A geolocation prompt on page load feels invasive. The same prompt after clicking "Find stores near me" makes sense.

Scoring and version changes

Lighthouse calculates the category score from the audits included in that release. Do not hard-code an expected point deduction for one failure. Record the Lighthouse and Chrome versions in CI so a tool upgrade is easy to distinguish from a site regression.

Lighthouse 13 removed several legacy audits after moving their guidance into the newer Insights model. When an audit disappears after an upgrade, compare the basic issue and report details before assuming the site fixed it.

Common failure patterns

Third-party scripts: Ad networks, analytics, and widgets often throw console errors or use deprecated APIs. Choose better vendors or load scripts conditionally if you can't fix these.

Development leftovers: Uncaught promise rejections and code paths that only fail with production data. Treat plain console.log output as noise; runtime errors need separate investigation.

Legacy code: Old APIs that still work but are deprecated. The site functions, but the audit fails. Refactoring takes time but avoids future breakage.

Eager permission requests: Marketing pressure to prompt for notifications immediately. This tanks user trust and fails the audit. Delay permission requests until users demonstrate intent.

How to diagnose issues

Chrome DevTools:

  1. Open DevTools, then select the Console tab.
  2. Reload the page with Preserve log enabled and reproduce the relevant interaction.
  3. Check the Issues tab for browser-detected problems.
  4. Run Lighthouse from the Lighthouse tab in a clean profile.
  5. Repeat on one URL from each template. A shared layout or third-party script can fail across hundreds of routes.

Key things to check:

  • Any JavaScript errors in console?
  • Any deprecation warnings?
  • What permission prompts appear on load?
  • Is the page served over HTTPS?
  • Does HTTP redirect to HTTPS?

All Best Practices issues

Quick reference for every audit:

AuditCategoryFix Guide
Uses HTTPSSecurityFix
Redirects HTTP to HTTPSSecurityFix
bfcache eligibleBrowserFix
Valid charsetBrowserFix
Valid DOCTYPEBrowserFix
Avoids deprecated APIsBrowserFix
No browser errorsUXFix
No geolocation on startUXFix
No notification on startUXFix
Allows paste in passwordsUXFix
Proper image sizingUXFix
Correct aspect ratiosUXFix
No DevTools issuesUXFix
Diagnose your specific issue

Test your entire site

The home page might pass Best Practices while blog posts throw console errors. The checkout flow might request permissions inappropriately. Dynamic pages might have image sizing issues that static pages don't.

Unlighthouse scans your entire site and surfaces Best Practices scores for every page. You'll find console errors on obscure pages, permission prompts you forgot about, and deprecated APIs in legacy sections.

The CLI is free and runs locally. Cloud adds scheduled monitoring to catch regressions, such as when a third-party script update breaks your score.