PFpassfail.no

Test reference

All 38 test fixtures available on passfail.no. Each test maps to a Teste.no plugin slug and can be toggled between pass and fail.

Quick reference

Critical= blocking for production sitesHigh= important best practiceMedium= nice to have
header= controlled via HTTP response headersdomain= only available at the domain root level

Security & Headers

6 tests

Content Security Policy depth

csp-deep-auditCriticalheader
F

Permissive CSP (unsafe-inline, unsafe-eval, wildcard, no object-src/base-uri/frame-ancestors).

P

Strict CSP with nonces, no unsafe-* directives.

Mixed content

mixed-contentCritical
F

Load http:// resources on this https:// page.

P

All resources loaded over https://.

Security headers

security-headersCriticalheader
F

Strip HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy.

P

All six recommended security headers present.

Cookie compliance

cookie-complianceHighheader
F

Set a tracking cookie without Secure/SameSite/HttpOnly.

P

No tracking cookies set without consent.

Cache headers

cache-header-auditMediumheader
F

Omit Cache-Control entirely on the HTML document.

P

Sensible Cache-Control (private, no-store).

CORS policy

cors-auditMediumheader
F

Reflect any Origin with Access-Control-Allow-Credentials: true.

P

No CORS headers on HTML document.

SEO & Metadata

4 tests

SEO meta tags

seo-meta-tagsCritical
F

Drop title, meta description, H1, canonical, and OG tags.

P

Title, description, H1, canonical, and full OG present.

Redirect chain

redirect-chainHighheader
F

3 chained 302 redirects before reaching the page.

P

Direct 200 response, no redirects.

Structured data

structured-data-validatorHigh
F

Malformed JSON-LD (broken JSON + missing required fields).

P

Valid Organization + WebSite JSON-LD.

Deep 404 scanner

deep-404-scannerMediumdomain
F

Sitemap includes URLs that return 404. Orphan pages not linked from nav.

P

All sitemap URLs resolve. All pages reachable from navigation.

Content Quality

7 tests

Mobile friendliness

mobile-friendlinessCritical
F

Remove viewport meta, force 1400px wide layout.

P

Standard responsive viewport.

Accessibility (axe)

accessibility-scanHigh
F

Placeholder-only inputs, low contrast, missing alt, no button role.

P

Labelled inputs, sufficient contrast, proper semantics.

Accessibility deep

accessibility-deepHigh
F

Keyboard traps, missing skip links, broken focus order, missing landmarks.

P

Skip link, proper landmarks, logical focus order, no keyboard traps.

Broken links

broken-linksHigh
F

/sample page with dead internal + external links.

P

/sample page with all valid links.

Image optimization

image-optimizationHigh
F

Heavy legacy-format image, no lazy loading, no alt text.

P

Modern, lazy-loaded, properly sized image with alt.

HTML validity (W3C)

w3c-html-validationMedium
F

Deliberately invalid HTML (orphan tags, duplicate IDs).

P

Clean, validator-friendly HTML5.

Mobile responsive signals

mobile-responsiveMediumdomain
F

No manifest.json, no touch icons, no theme-color meta.

P

Web manifest, apple-touch-icon, theme-color present.

Performance

5 tests

Core Web Vitals

core-web-vitalsCritical
F

Layout shift elements, huge unoptimized hero, render-blocking inline styles.

P

Stable layout, optimized assets, no CLS triggers.

Response time

response-timeCritical
F

Server-side delay of ~3 seconds.

P

Sub-200ms server response.

Third-party scripts

third-party-script-perfHigh
F

Four heavy render-blocking third-party scripts in <head>.

P

No third-party scripts.

HTTP/2 or HTTP/3

http-protocol-checkMedium
F

Hosting-level — cannot be controlled at page level.

P

HTTP/2 over TLS.

Visual regression

visual-regressionMedium
F

Page layout breaks: wrong fonts, shifted elements, broken colors, misaligned grid.

P

Clean, stable layout matching the visual baseline.

Analytics & Tracking

1 tests

Analytics setup

analytics-auditMedium
F

Broken GTM container, render-blocking, no consent mode, no GA4.

P

No tracking on this page (clean baseline).

Forms

2 tests

Form validation

form-submission-validationHigh
F

Form POSTs to stub that always returns 200, no validation.

P

Required-field validation, honeypot, server-side check.

Contact page

contact-formMedium
F

/contact page with no HTTPS form action, missing fields, no spam protection.

P

/contact page with proper form, validation, honeypot, HTTPS action.

Infrastructure & Root Files

4 tests

Sensitive file exposure

sensitive-file-exposureCriticaldomain
F

Respond 200 for /.env, /.git/HEAD, /wp-admin, /backup.sql.

P

All sensitive paths return 404.

Robots.txt

robots-txtHighdomain
F

Block all crawlers (Disallow: /) or return empty file.

P

Sensible rules with Sitemap reference.

Sitemap XML

sitemap-validationHighdomain
F

Broken XML with invalid URLs and bad lastmod dates.

P

Valid XML sitemap with fresh sample URLs.

AI search readiness

ai-search-readinessMediumdomain
F

No llms.txt, AI crawlers blocked in robots.txt.

P

Valid llms.txt + llms-full.txt, AI crawlers allowed.

API & Endpoints

3 tests

API health check

api-health-checkCriticaldomain
F

/api/health returns 503 with degraded status.

P

/api/health returns 200 with all services healthy.

API latency

api-latency-benchmarkHighdomain
F

/api/health responds with ~2 second delay.

P

/api/health responds in under 100ms.

GraphQL introspection

graphql-introspectionHighdomain
F

/api/graphql exposes full schema via introspection query.

P

/api/graphql blocks introspection (403).

AI & LLM Readiness

3 tests

AI source review

ai-source-reviewHigh
F

HTML contains debug comments, console.log leaks, version strings, TODO markers.

P

Clean production HTML with no debug artifacts.

AI citability

ai-citability-checkMedium
F

Thin content, no clear headings, no source attribution, no factual structure.

P

Citation-friendly content with clear headings, facts, sources, and structure.

AI platform readiness

ai-platform-readinessMedium
F

No platform-specific AI signals (missing FAQ schema, no how-to markup, thin content).

P

FAQ + HowTo structured data, citation-friendly headings, AI platform signals.