// library

Web Assets & Performance rules

17 rules

Severity

Bucket

ActiveBucketWeb Assets & Performance Clear all

Critical
Fingerprint assets and cache immutably
All static JS/CSS/font/image files MUST use content-hashed filenames (e.g., app.9c1a7b.js) and be served with "Cache-Control: public, max-age=31536000, immutable". HTML and other non-fingerprinted documents MUST be served with "Cache-Control: no-cache" (or equivalent) to enable conditional revalidation.
web-static-assetscaching-strategy+2
High
Compress text assets with Brotli/Gzip and set Vary
Serve text-based assets (JS, CSS, JSON, SVG) with Brotli (br) when the client sends "Accept-Encoding: br" and fallback to gzip. Always set "Vary: Accept-Encoding" and do NOT compress already-compressed formats (e.g., .png, .jpg, .woff2).
web-static-assetsperformance-efficiency+1
High
Immutable cache and Vary for precompressed files
Serve precompressed .br/.gz variants when the client sends Accept-Encoding, set "Vary: Accept-Encoding", and apply immutable caching for hashed assets; keep HTML revalidatable.
web-static-assetscaching-strategy+1
High
Immutable cache for hashed assets, no-cache for HTML
In Express, use serve-static with setHeaders to apply "Cache-Control: public, max-age=31536000, immutable" for files matching /\.[0-9a-f]{8,}\./ and "Cache-Control: no-cache" for HTML. Also set correct Content-Type.
web-static-assetscaching-strategy+1
High
Preload critical fonts and use font-display: swap
Preload render-blocking WOFF2 fonts using <link rel="preload" as="font" type="font/woff2" crossorigin> and define @font-face with "font-display: swap". Only preload fonts used above the fold.
web-static-assetsperformance-efficiency+1
High
Serve responsive images with modern formats and lazy-load
Provide AVIF/WebP fallbacks via <img srcset> with width/height attributes, meaningful sizes, and "loading=lazy" plus "decoding=async". Avoid shipping oversized PNG/JPEG when AVIF/WebP is supported.
web-static-assetsperformance-efficiency
High
Use next/image with explicit dimensions and alt
Always use the Next.js Image component for images with width/height (or fill) and meaningful alt text. Avoid plain <img> for app assets.
stack-nextjsstack-react+3
High
Versioned static resources with long cache
Enable content versioning and long-lived caching via ResourceChain with VersionResourceResolver and set Cache-Control to public, max-age=31536000 for static locations; keep HTML templates non-immutable.
web-static-assetscaching-strategy+1
Low
Cache and compression for static resources
In Kotlin Ktor, install CachingHeaders and Compression. Set immutable caching for hashed resources and no-cache for HTML; include "Vary: Accept-Encoding".
web-static-assetscaching-strategy+1
Low
Correct Content-Type and cache headers for assets
For PHP-served assets, emit the precise Content-Type (e.g., text/css; charset=utf-8, application/javascript, font/woff2) and set immutable caching for hashed files; never apply immutable caching to HTML.
web-static-assetscaching-strategy
Low
Dynamic import for heavy client-only widgets
Use next/dynamic with { ssr: false } for large client-only components (maps, editors) and provide a lightweight loading fallback.
stack-nextjsstack-react+2
Low
ETag/Last-Modified for non-immutable assets
For Go static servers, set immutable Cache-Control for hashed files; otherwise set "Cache-Control: no-cache" and support conditional GET via ETag or Last-Modified using file info.
web-static-assetscaching-strategy
Low
Restrict production source maps
Do not expose full, unminified source maps publicly in production. If source maps are required for error tracking, serve them behind authentication or IP allowlists and set "X-Robots-Tag: noindex".
web-static-assetssecurity-hardening
Low
Set correct MIME types for all static assets
Serve assets with accurate Content-Type (e.g., text/css, application/javascript, image/avif, image/webp, font/woff2, image/svg+xml) and include charset for text types. Do not default to text/plain or application/octet-stream.
web-static-assetsperformance-efficiency+1
Low
StaticFileOptions with cache policy and types
Configure UseStaticFiles with OnPrepareResponse to set "Cache-Control: public, max-age=31536000, immutable" for hashed assets and "no-cache" for HTML; ensure correct Content-Type (e.g., "font/woff2", "text/css").
web-static-assetscaching-strategy+1
Low
Use Metadata API instead of <Head>
Declare SEO metadata via export const metadata or generateMetadata; avoid manual <Head> in App Router.
stack-nextjsstack-react+2
Low
Use next/font for fonts (no <link> to external CDNs)
Load fonts via next/font (google or local) and apply on html/body; avoid runtime <link> to fonts that cause FOUT/CLS.
stack-nextjsstack-react+2

17 rules

Fingerprint assets and cache immutably

Compress text assets with Brotli/Gzip and set Vary

Immutable cache and Vary for precompressed files

Immutable cache for hashed assets, no-cache for HTML

Preload critical fonts and use font-display: swap

Serve responsive images with modern formats and lazy-load

Use next/image with explicit dimensions and alt

Versioned static resources with long cache

Cache and compression for static resources

Correct Content-Type and cache headers for assets

Dynamic import for heavy client-only widgets

ETag/Last-Modified for non-immutable assets

Restrict production source maps

Set correct MIME types for all static assets

StaticFileOptions with cache policy and types

Use Metadata API instead of <Head>

Use next/font for fonts (no <link> to external CDNs)

Fingerprint assets and cache immutably

Compress text assets with Brotli/Gzip and set Vary

Immutable cache and Vary for precompressed files

Immutable cache for hashed assets, no-cache for HTML

Preload critical fonts and use font-display: swap

Serve responsive images with modern formats and lazy-load

Use next/image with explicit dimensions and alt

Versioned static resources with long cache

Cache and compression for static resources

Correct Content-Type and cache headers for assets

Dynamic import for heavy client-only widgets

ETag/Last-Modified for non-immutable assets

Restrict production source maps

Set correct MIME types for all static assets

StaticFileOptions with cache policy and types

Use Metadata API instead of <Head>

Use next/font for fonts (no <link> to external CDNs)