Node.js — nodejs.org site review — sample audit, scored 7.1/10

← gallery
7.1/10
Open ↗

About this audit

nodejs.org scored 7.1/10

Strong engineering, one locale shipping untranslated. Three serious WCAG failures repeat on every audited page and structured data is absent site-wide. Scored on 2 templates only — the homepage and Download; deeper sections (/docs, /learn, /blog) were not assessed.

This is a full example audit — 11 evidence-led findings across accessibility, performance, SEO, structured data, privacy and security, each with a measurement, a screenshot and a concrete fix. The headline issue: The Spanish homepage ships an English hero — H1, subtitle and both CTAs.

What we found

  1. criticalThe Spanish homepage ships an English hero — H1, subtitle and both CTAs

    https://nodejs.org/es declares lang="es-ES" and renders a fully translated navigation — Aprender, Acerca de, Descargar, Documentación, Contribuir — wrapped around a hero that is 100% English. The H1 reads Run JavaScript Everywhere, the subtitle is the English paragraph, the primary button says Get Node.js® and the seco

  2. warningFooter links sit at 1.31:1 against their own paragraph — 6 links on all 6 pages

    axe-core reports link-in-text-block (serious, WCAG 2.0 A, criterion 1.4.1 Use of Color) on every one of the 6 audited pages, 6 failing elements each. The trademark paragraph in the footer renders links in #417e38 inside body text of #556066 — a link-to-surrounding-text contrast of 1.31:1 where the rule requires 3:1 — a

  3. warningThe EOL support CTA's sub-label fails AA at 2.71:1 — inside a call-to-action, not a caption

    axe-core reports color-contrast (serious, WCAG 2.0 AA, criterion 1.4.3) at the 375 px viewport on /fr and /id: <small class="!text-xs"> renders 12 px text in #929fa5 on #ffffff for a measured 2.71:1, against a required 4.5:1. The failing element is not decorative fine print — it is the second line of the hero's seconda

  4. warningDownload page: the install command hides 55.7% of its width with no keyboard way to scroll

    axe-core reports scrollable-region-focusable (serious, WCAG 2.0 A, criteria 2.1.1 Keyboard and 2.1.3 Keyboard (No Exception)) on the <code> block at mobile and tablet: *"Element should have focusable content / Element should be focusable."* Measured live at 375 px: the block is 309 px wide holding 698 px of content — 3

  5. mobile3 of the 5 homepage code tabs are off-screen at 375 px, with no scroll affordance

    The homepage's code-example [role="tablist"] measures 341 px visible against 674 px of content — 333 px, 49%, is off-screen. Two tabs (Streams Pipeline, Work with Threads) are entirely invisible and a third (Read and Hash a File) is clipped mid-word. The container has overflow-x: auto but no mask-image, no gradient, no

  6. mobileThe hamburger — the only route to navigation on mobile — has a 24 × 24 px hit area

    Measured live at 375 px: the menu toggle's <label> is exactly 24 × 24 px with padding: 0 and margin: 0. Probing outward from its centre with document.elementFromPoint, the label stops responding beyond 12 px — there is no expanded hit area behind it. It sits 16 px from the right edge of the screen. At this width every

  7. warningZero JSON-LD blocks across all 6 pages — no Organization, WebSite or SoftwareApplication

    Every audited page returns 0 structured-data blocks — nothing invalid to fix, simply nothing present. The no-JavaScript crawl confirms it independently: 0 JSON-LD blocks in the raw HTML, while the title, meta description and H1 content all survive without JavaScript. Node.js is one of the most-cited software projects o

  8. warningOne English meta description is reused byte-for-byte on all 6 pages, including /fr and /id

    The same 157-character English string — *"Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts."* — is served as the meta description on all 6 audited pages. The French, Spanish and Indonesian homepages carry it untr

  9. warningtwitter:card is set to summary, discarding the 1200 × 600 card the site already generates

    nodejs.org generates a per-locale Open Graph image at /en/next-data/og/announcement/<title> — verified live: HTTP 200, image/png, 1200 × 600, 127,708 bytes, with the French page's title correctly rendered into the French card. That is real work, and it is good. Then twitter:card is set to summary, which renders a small

  10. warningHomepage LCP 2,530 ms — one 177,617-byte chunk is 98% unused

    Lighthouse (mobile, lab) scores the homepage 97, /fr 99 and /en/download 90. CLS is 0.029 across all three and server response is 132 ms / 115 ms / 105 ms. This is a fast site and most of this section is tuning, not repair. The one metric outside its threshold is homepage LCP at 2,530 ms — just past the 2,500 ms "good"

  11. warningFour standard security response headers absent on all 6 pages

    Passive observation of response headers only — no scanning or probing was performed. HTTPS is enforced with HSTS present, X-Content-Type-Options: nosniff is set, and there is no mixed content on any audited page. That is the majority of the checklist already done. Absent on all 6 pages: Content-Security-Policy, X-Frame

Audit your own site →← more sample audits