Skip to content
Atomic WaxBook an AssessmentBook

← Field Notes

We measured our own sites against the basics. We had skipped several.

Peter Benes ·

A tidy row of identical houses being inspected under a magnifying glass, one of them subtly different.

Our prober had a rule we were proud of: every check exists because a real bug was found in production. It kept the check list grounded. Nothing in it was theoretical.

On July 29 we noticed what that rule costs. A prober built only from scar tissue can only catch the kinds of failure somebody has already tripped over. Anything nobody had hit yet was invisible, and some of the most basic things on the web sat in that gap.

So we stopped asking the prober and measured eight origins directly: our own Atomic Wax sites plus one outside benchmark we compare against.

What we found

Content-Security-Policy was missing on all eight. Every one, including the benchmark. A CSP header tells the browser which scripts and sources a page is allowed to load, and none of us were sending one.

HSTS, the header that tells browsers to only ever reach a domain over HTTPS, was missing on five of the seven sites we checked for it. aibubblequestion.com was the one site we could point to as doing it right.

Four sites answered with a 200 on both the bare domain and www: thelingerieshoppe.ca, atomicwax.com, kpixies.com and dancewearcanada.ca. Two URLs, one page, no redirect. Search engines have to guess which one is real. The benchmark redirected correctly. This was the cheapest fix in the whole estate: one redirect rule per Cloudflare zone.

None of the eight used srcset, the attribute that lets a browser pick a right-sized image for the screen. Low impact today, because these pages carry few images. It is still a default to set before anyone builds an image-heavy site on the same template.

The mobile problem we could not see

We expected to find viewport problems. We didn’t. The viewport tag was correct on every site.

The real mobile problem was layout: things crowding, overflowing and wrapping badly on a phone. An HTTP and HTML prober cannot see that, because layout only exists once a browser renders the page.

That gave us a useful way to sort checks into three tiers:

  1. Things you can verify from HTTP alone: status codes, redirects, headers.
  2. Things you can verify from the raw HTML: titles, canonicals, structured data, the viewport tag.
  3. Things that need a real rendered browser: layout, overflow, Core Web Vitals.

Our prober covered the first two tiers. Mobile lives in the third, so that is where we were blind.

Thresholds we adopted

For the browser tier we took the published numbers instead of inventing our own: Largest Contentful Paint at 2.5 seconds, Interaction to Next Paint at 200 milliseconds, Cumulative Layout Shift at 0.1, all measured at the 75th percentile.

We also flagged WCAG 2.2 AA as a standard to hold, not a nice-to-have. For consumer directories in Canada, accessibility sits close to legal territory, and a directory like thelingerieshoppe.ca is exactly that kind of site.

The rule we changed

The scar-tissue rule stays. Checks that come from real failures are the best checks we have. What changed is that real failures are no longer the only source. New checks are now seeded from external standards as well: security headers, canonical handling, Core Web Vitals, accessibility. If a respected standard says something matters, we measure it before it bites us.

What happened next

Three of these became permanent checks on August 7: CSP, HSTS and www canonical. Scores fell across the board. The estate dropped to 66% conformance, and kpixies.com went from 84% to 73%. Nothing on the sites had changed. The drop was a measurement change, not a regression. Our note at the time put it plainly: the estate had not got worse, it had started being measured properly.

That is the part we would want a prospect to notice. A score that only ever goes up usually means the measuring stick is too short.

What this means if you hire us

Atomic Wax sites are checked against outside standards, not only against the bugs we happen to have met, and the checks run against the live site rather than a report about it. The free assessment uses the same lens, so the gaps we found in our own sites are the first things we look for in yours.