Glossary

This documentation is written for both buyers and developers. Here are the terms that recur in the tests and reports, explained without assuming prior knowledge.

The abbreviations in this list are also wired into the whole documentation: hover over an abbreviation anywhere in the text and you'll get the explanation.

Scores and measurement

Score: A number between 1.0 and 5.0, where 5.0 is best. Each test produces its own. See grading.
Review: The list of concrete problems a test can print in addition to the score. Turned on with -r on the command line.
Regression: Something that used to work getting worse, often after a deployment.

Performance

LCP: Largest Contentful Paint. The time until the page's largest visible content block is in place. Measures when the page feels loaded to the visitor.
CLS: Cumulative Layout Shift. How much content jumps around while the page loads. High values make people click the wrong thing.
Speed Index: A composite measure of how quickly the visible area of the page fills with content.
Sitespeed.io: The open source tool Webperf uses to measure performance. It drives a real browser and measures what actually happens.
Lighthouse: Google's analysis tool, built into Chrome. Scores performance, accessibility, SEO and best practice.

Accessibility

WCAG: Web Content Accessibility Guidelines. The international standard for accessible web content. The levels are A, AA and AAA; AA is the usual level referenced in legislation.
DOS Act: The Swedish act on accessibility to digital public services. Among other things it requires public sector bodies to publish an accessibility statement. In the EU more broadly, the equivalent duties come from the Web Accessibility Directive and the European Accessibility Act.
Pa11y and Axe: Two tools that automatically look for accessibility errors in the code. They find roughly a third of all WCAG problems. The rest requires human review.
Accessibility statement: The page where an organisation reports how accessible its website is, what falls short, and how to report problems.

Privacy and security

Tracker: A script or request that collects information about the visitor, often on someone else's behalf.
Fingerprinting: A technique that identifies a visitor by combining properties of their browser, without cookies.
Webbkoll: An open source site checker that shows what a web page leaks about its visitors to third parties. Since summer 2026 Webperf runs its own installation of it, rather than loading the public service at webbkoll.5july.net. See test 31.
HSTS: A header that tells the browser to always use HTTPS for the domain, even if someone links to http://.
CSP: Content Security Policy. Rules for which resources a page may load. One of the most effective defences against malicious code slipping in.
Schrems II: The 2020 Court of Justice of the European Union ruling that restricts transfers of personal data to the United States. It affects the choice of cloud services and analytics tools.

Technology and operations

HTTP/2 and HTTP/3: Newer versions of the protocol that fetches web pages. Both retrieve many files in parallel and are faster than HTTP/1.1, especially on mobile networks.
TLS: The encryption behind HTTPS. Versions 1.2 and 1.3 are current; 1.0 and 1.1 are considered insecure.
IPv6: The newer version of the internet protocol. Needed for the site to be reachable by visitors on IPv6-only networks.
DNSSEC: Signing of DNS answers, so nobody can forge where a domain points.
CDN: Content Delivery Network. A network of servers that delivers content from a location near the visitor.
Sitemap: An XML file listing a website's pages for search engines.
security.txt: A standardised file at /.well-known/security.txt stating where security problems should be reported.
IndexNow: A protocol for telling search engines immediately when pages are added, changed or removed, instead of waiting for the next crawl.
Webhook: A call a service sends to an address you control when something has happened, so your own systems can react.