Why Lighthouse scores actually matter
Google Lighthouse is a free tool that audits websites across four categories: Performance, Accessibility, Best Practices, and SEO. Each gets a score from 0 to 100. While the scores themselves aren't a direct ranking factor in Google search, they measure the things that are — page speed, mobile-friendliness, security, and whether your content is structured properly for search engines to understand.
More importantly, Lighthouse measures what your visitors actually experience. A site that scores poorly is usually slow, hard to read on a phone, missing security headers, or has broken elements. Fixing Lighthouse scores means fixing the things that drive visitors away before they even read what you offer.
For a local business website — a salon, a clinic, a shop, a sole trader — a good Lighthouse score means Google sees your site as trustworthy, visitors stay longer, and more of them convert into enquiries.
Where we started: the real numbers
When we first audited vengera.co.uk with Lighthouse 12.8.2 (the latest version, running headless Chrome), here's what we found:
- Best Practices: 82/100 — one scored failure: "Uses deprecated APIs" triggered by Cloudflare's Bot Fight Mode JavaScript challenge
- Accessibility: 95/100 — three contrast failures on the dark theme affecting small text and links
- Performance: already strong — the site was built lean, served 153 KB of HTML+CSS+JS combined, and scored in the high 90s
- SEO: 100/100 — the site structure was already correct
For a site that was already performing well, three specific gaps stood between us and perfection.
Fix 1: Self-hosted fonts
The problem: The site used Google Fonts. Every visit triggered a request to Google's servers, which meant the browser had to wait for that external request before it could render the text. This is called "render-blocking" — the visitor sees a blank screen while waiting for fonts from a third party.
The fix: We downloaded the font files (Inter, in WOFF2 format) and served them directly from vengera.co.uk. The browser loads everything from one place, the font is cached once and reused, and there's no third-party dependency slowing things down.
The benefit: Faster page loads, no reliance on Google's servers, and the font always loads even if Google Fonts is blocked.
Fix 2: CSS and JavaScript cache versioning
The problem: When you update your website, returning visitors may still see the old version because their browser cached the previous CSS and JavaScript files. Without cache-busting, returning visitors see a broken or outdated site.
The fix: We added version strings to CSS and JS file references: styles.css?v=20260627b. When the version changes, the browser treats it as a new file and downloads the latest copy. When it hasn't changed, the browser uses its cached version — saving bandwidth and loading faster.
The benefit: Zero stale-file bugs on deploy, perfect cache efficiency for returning visitors.
Fix 3: CSP security headers with hash whitelisting
The problem: A Content Security Policy (CSP) tells browsers which scripts they're allowed to run. It blocks injected malicious scripts. But if your own legitimate inline scripts aren't whitelisted, CSP blocks them too — breaking your site while trying to protect it.
The fix: We computed SHA-256 cryptographic hashes of our inline scripts and added them to the CSP header. This tells browsers: "allow these exact scripts — block everything else." Each deploy, we recompute the hashes and update the header.
The benefit: Full CSP protection with zero false positives. The site is protected against XSS attacks and Lighthouse reports zero CSP violations.
Fix 4: Cloudflare Bot Fight Mode trade-off
The problem: Cloudflare's Bot Fight Mode injects a JavaScript challenge into every page to block automated bots. That JavaScript uses deprecated browser APIs, which Lighthouse flags as a Best Practices failure. Our Best Practices score was stuck at 82 — because of Cloudflare's code, not ours.
The fix: We turned Bot Fight Mode off. The site still has Cloudflare's standard crawler protection, a honeypot on the contact form, and required consent. For this type of brochure site, the practical spam exposure delta is tiny — and the Lighthouse score jumped from 82 to 100.
The trade-off: We documented this consciously: 100 Best Practices is worth more than the marginal extra protection Bot Fight Mode provided, especially since the site already has form-level anti-spam.
Fix 5: Accessibility contrast on dark theme
The problem: Three text elements on the dark theme didn't have enough contrast between text colour and background. Lighthouse flagged them as accessibility failures — text that was too hard to read for people with visual impairments.
The fix: We lightened the three affected text colours slightly — enough to pass WCAG contrast ratios without making the page look washed out. Three colour values changed in the CSS.
The benefit: Accessibility 95 accelerated to 100. The changes are subtle but ensure every visitor can read every element comfortably.
The final scores
After these five fixes, the live site scored:
- Best Practices: 100/100
- Accessibility: 100/100
- Performance: 99/100
- SEO: 100/100
Beyond Lighthouse: what "agent-ready" means
Lighthouse is about making your site good for humans and search engines. But there's a newer layer that's growing fast: AI agents. When someone asks ChatGPT, Claude, Perplexity, or Siri "find me a local IT support person near Long Eaton," the AI doesn't browse your site visually. It reads machine-readable signals — structured metadata, well-known endpoints, and DNS records that tell it who you are and what you do.
isitagentready.com is an independent scanner that checks whether your site is discoverable, understandable, and usable by AI agents. It scores sites from Level 1 (invisible) to Level 5 (Agent-Native — the maximum).
Vengera.co.uk scores Level 5 "Agent-Native" — the highest level the scanner awards.
What Level 5 requires
- llms.txt — a plain-text file listing every important page, readable by AI agents directly. Think of it as a sitemap for AI.
- auth.md — a markdown file describing who you are, what you do, and how to contact you. Agents read it to understand your business.
- agent-card.json — structured metadata about your site at
/.well-known/agent-card.json. - MCP server card — a service description for AI tool protocols at
/.well-known/mcp/server-card.json. - DNS-AID records — AI Discovery DNS records with DNSSEC validation. These let agents verify your site is genuinely yours.
Each of these is a small, static file — no moving parts, no maintenance burden. Once published, they work continuously and silently, making your site visible to every AI crawler and assistant that looks for it.
Why this matters for YOUR local business website
1. Google rankings
Perfect Lighthouse scores don't guarantee top rankings, but they remove every technical penalty. Google has confirmed that page experience signals — speed, mobile-friendliness, security, accessibility — are ranking factors. A site scoring 50-70 is leaving ranking positions on the table.
2. Visitor experience
People leave slow, broken, or hard-to-read websites within seconds. A clean Lighthouse score means your site loads fast, works on any device, and every visitor — regardless of ability — can read and use it comfortably.
3. AI discoverability
This is the one most business owners haven't heard about yet. When someone asks an AI assistant "who does website design near me," the AI doesn't search Google — it queries its training data, live search indexes, and agent-readable signals. If your site has no llms.txt, no agent-card, and no structured metadata, you simply don't appear in those results. Level 5 agent-readiness makes sure you're in the conversation.
What did NOT require a rebuild
Everything described above was achieved without rebuilding the site. No framework change, no platform migration, no starting over. All five Lighthouse fixes were edits to existing files — CSS, HTML meta, server configuration. The agent-readiness signals are plain-text files we published once. The entire process took an afternoon.
This matters because most small business owners assume "my website needs a full rebuild" when it often doesn't. The bones are usually fine — the site just needs targeted optimization to go from 70 to 100.
The takeaway
Perfect Lighthouse scores and full agent-readiness aren't reserved for big tech companies. They're achievable for any well-built small business website with a handful of specific, explainable fixes.
This is the bar I build to for every client site — not because perfect scores matter for their own sake, but because the work required to get there — fast fonts, clean security, accessibility, structured data, AI visibility — is the same work that makes a website actually work for a business.
Want your website brought up to this standard?
I can audit your current site, tell you honestly what needs fixing, and do the work. No rebuild, no agency price tag — just practical fixes explained in plain English.