> ## Documentation Index
> Fetch the complete documentation index at: https://docs.37audits.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Lighthouse Best Practices Auditor
> Runs the Google Lighthouse Best Practices category on the page and scores it against configurable thresholds
**Security Auditor** — runs the [Google Lighthouse](https://github.com/GoogleChrome/lighthouse) Best Practices category against the monitored page and reports its score: below 90 is a warning and below 50 is a failure, both thresholds set per monitored URL. Every audit Lighthouse lists under the score is a check of its own, with Lighthouse's own description and the offending elements.
The score is the one Lighthouse computes, so it matches Chrome DevTools and PageSpeed Insights.
No performance trace is recorded, so the run finishes seconds after the page loads.
This auditor starts a headless Chromium, lets Lighthouse load the page with the desktop preset (or the mobile profile, by preference) and run only its Best Practices audits, and reads the category score from the report. It tells you whether the page follows the web platform's safety and hygiene rules: the Best Practices score. The check names the lowest-scoring audits of the category, so the report says what to fix first. Lighthouse's Best Practices audits cover HTTPS, front-end libraries with known vulnerabilities, browser console errors, deprecated APIs, third-party cookies, image aspect ratios and resolution, source maps and the document's doctype and charset.
The Lighthouse Best Practices auditor is one of four auditors that share one Lighthouse image; the others are Lighthouse Performance, Lighthouse Accessibility, Lighthouse Best Practices and Lighthouse SEO. Enable the ones a URL needs: each runs its own Lighthouse pass.
## How it works
1. **Thresholds** — reads `formFactor`, `warningBelowScore` and `failBelowScore`. When `failBelowScore` is not lower than `warningBelowScore` the audit fails with a single check (`401`) and Lighthouse does not run.
2. **Lighthouse run** — runs the Lighthouse CLI (version pinned in the image, reported in the `100` check) with the `best-practices` category only, the `desktop` preset or the `mobile` form factor, and the 37AuditsBot user agent. The run has a time budget derived from the audit's remaining time; a page that does not finish loading inside it is an `ERROR` (`500`).
3. **Blocked or unloadable page** — an HTTP 403, 429 or Cloudflare challenge on the document is the platform's blocked response (`590`). Any other Lighthouse runtime error (`NO_FCP`, `PAGE_HUNG`, `DNS_FAILURE`, `ERRORED_DOCUMENT_REQUEST`, …) is an `ERROR` (`500`) that names the error.
4. **Score** — the Best Practices score (0–100) is compared with the thresholds: below `failBelowScore` is `FAIL` (`400`), from `failBelowScore` up to but excluding `warningBelowScore` is `WARNING` (`300`). A category Lighthouse could not score is an `ERROR` (`501`). At or above `warningBelowScore` the audit succeeds (`200`).
5. **Audits** — every audit Lighthouse lists under the Best Practices score becomes a check: a scored audit below Lighthouse's pass mark (0.9) is a `FAIL` whose code is 400 plus the audit's fixed number in this auditor's catalog (16 audits, `410`–`431`); an audit Lighthouse reports without a score or leaves to a manual check is an `INFORMATION` with 100 plus that number. An audit a newer Lighthouse adds gets `490` or `190` until the catalog is updated. Hidden Lighthouse audits and audits that do not apply to the page are not reported. These checks keep their own status but never change the result: the score alone decides it.
6. **Report pin** — every result carries an `INFORMATION` check (`100`) with the Lighthouse and Chrome versions, the device profile, the run duration and Lighthouse's benchmark index, because scores are only comparable between runs of the same Lighthouse version.
The Lighthouse navigation is **not** signed with Web Bot Auth: Lighthouse opens its own browser target and its only header hook adds headers to every request of the page, which breaks cross-origin fetches. Allowlist the 37AuditsBot user agent if the site challenges unsigned bots. With Basic auth the `Authorization` header is sent on every request the page makes, third-party origins included, so prefer allowlisting over credentials for a staging site that loads third-party scripts.
## Preferences
| Key | Type | Default | Description |
| - | - | - | - |
| `formFactor` | string | `desktop` | `desktop` (Lighthouse desktop preset: no CPU slowdown, fast network) or `mobile` (Moto G Power emulation, simulated 4G and 4x CPU slowdown, the PageSpeed Insights default). Any other value falls back to `desktop`. |
| `warningBelowScore` | integer (1–100) | `90` | A Best Practices score below this value produces a `WARNING` (`300`). |
| `failBelowScore` | integer (0–99) | `50` | A Best Practices score below this value produces a `FAIL` (`400`). Must be lower than `warningBelowScore`. |
An invalid value (missing, fractional, outside 0–100) makes the auditor fall back to that preference's default and log a warning. A fail threshold equal to or above the warning threshold is not an invalid value: it makes the audit fail (`401`) until the thresholds are fixed.
## What it audits
Every row maps to one `checkRule*` method and one `CheckCode`.
| CheckCode | Status | When it fires | Recommendation | Why it matters |
| - | - | - | - | - |
| `37A-LighthouseBestPracticesAuditor-100` | `INFORMATION` | Always. Records the Lighthouse and Chrome versions, the device profile, the run duration and the benchmark index: `Lighthouse 12.8.2 on Chrome 138.0.7204.0 audited the page as desktop in 18 s (benchmark index 2186).` | — (recommendation is `null`; nothing for the site to change) | — |
| `37A-LighthouseBestPracticesAuditor-114` | `INFORMATION` | Lighthouse reports audit `csp-xss` without a score: Ensure CSP is effective against XSS attacks. Message: `Ensure CSP is effective against XSS attacks: {display value or item count} (Lighthouse Best Practices audit csp-xss, desktop; reported without a score).` | A strong Content Security Policy (CSP) significantly reduces the risk of cross-site scripting (XSS) attacks. Learn how to use a CSP to prevent XSS ([https://developer.chrome.com/docs/lighthouse/best-practices/csp-xss/](https://developer.chrome.com/docs/lighthouse/best-practices/csp-xss/)) Found: `{up to three items}`. | — |
| `37A-LighthouseBestPracticesAuditor-115` | `INFORMATION` | Lighthouse reports audit `has-hsts` without a score: Use a strong HSTS policy. Message: `Use a strong HSTS policy: {display value or item count} (Lighthouse Best Practices audit has-hsts, desktop; reported without a score).` | Deployment of the HSTS header significantly reduces the risk of downgrading HTTP connections and eavesdropping attacks. A rollout in stages, starting with a low max-age is recommended. Learn more about using a strong HSTS policy. ([https://developer.chrome.com/docs/lighthouse/best-practices/has-hsts](https://developer.chrome.com/docs/lighthouse/best-practices/has-hsts)) Found: `{up to three items}`. | — |
| `37A-LighthouseBestPracticesAuditor-116` | `INFORMATION` | Lighthouse reports audit `origin-isolation` without a score: Ensure proper origin isolation with COOP. Message: `Ensure proper origin isolation with COOP: {display value or item count} (Lighthouse Best Practices audit origin-isolation, desktop; reported without a score).` | The Cross-Origin-Opener-Policy (COOP) can be used to isolate the top-level window from other documents such as pop-ups. Learn more about deploying the COOP header. ([https://web.dev/articles/why-coop-coep#coop](https://web.dev/articles/why-coop-coep#coop)) Found: `{up to three items}`. | — |
| `37A-LighthouseBestPracticesAuditor-117` | `INFORMATION` | Lighthouse reports audit `clickjacking-mitigation` without a score: Mitigate clickjacking with XFO or CSP. Message: `Mitigate clickjacking with XFO or CSP: {display value or item count} (Lighthouse Best Practices audit clickjacking-mitigation, desktop; reported without a score).` | The `X-Frame-Options` (XFO) header or the `frame-ancestors` directive in the `Content-Security-Policy` (CSP) header control where a page can be embedded. These can mitigate clickjacking attacks by blocking some or all sites from embedding the page. Learn more about mitigating clickjacking ([https://developer.chrome.com/docs/lighthouse/best-practices/clickjacking-mitigation](https://developer.chrome.com/docs/lighthouse/best-practices/clickjacking-mitigation)). Found: `{up to three items}`. | — |
| `37A-LighthouseBestPracticesAuditor-118` | `INFORMATION` | Lighthouse reports audit `trusted-types-xss` without a score: Mitigate DOM-based XSS with Trusted Types. Message: `Mitigate DOM-based XSS with Trusted Types: {display value or item count} (Lighthouse Best Practices audit trusted-types-xss, desktop; reported without a score).` | The `require-trusted-types-for` directive in the `Content-Security-Policy` (CSP) header instructs user agents to control the data passed to DOM XSS sink functions. Learn more about mitigating DOM-based XSS with Trusted Types ([https://developer.chrome.com/docs/lighthouse/best-practices/trusted-types-xss](https://developer.chrome.com/docs/lighthouse/best-practices/trusted-types-xss)). Found: `{up to three items}`. | — |
| `37A-LighthouseBestPracticesAuditor-126` | `INFORMATION` | Lighthouse reports audit `js-libraries` without a score: Detected JavaScript libraries. Message: `Detected JavaScript libraries: {display value or item count} (Lighthouse Best Practices audit js-libraries, desktop; reported without a score).` | All front-end JavaScript libraries detected on the page. Learn more about this JavaScript library detection diagnostic audit ([https://developer.chrome.com/docs/lighthouse/best-practices/js-libraries/](https://developer.chrome.com/docs/lighthouse/best-practices/js-libraries/)). Found: `{up to three items}`. | — |
| `37A-LighthouseBestPracticesAuditor-190` | `INFORMATION` | An audit this catalog does not list (added by a newer Lighthouse) is reported without a score or left to a manual check. Message as above, with the audit's own title and id; `inCatalog` is `false` in the data. | Lighthouse's description of the audit, then the first items it found. | — |
| `37A-LighthouseBestPracticesAuditor-501` | `ERROR` | Lighthouse ran but gave the Best Practices category no score (`score: null`). | Re-run the audit; if the Best Practices score stays empty, check the page for errors during load in Lighthouse's report. | — |
| `37A-LighthouseBestPracticesAuditor-400` | `FAIL` | The Best Practices score is below `failBelowScore`. Message: `Lighthouse Best Practices score is 42/100 (desktop); the fail threshold is 50.` | Raise the Best Practices score (`{score}`) by fixing its lowest-scoring audits first: `{audit title} ({display value})`; … | Outdated libraries, console errors and insecure requests are the defects attackers and browser updates exploit first, so the page breaks or gets compromised without warning. |
| `37A-LighthouseBestPracticesAuditor-410` | `FAIL` | Lighthouse audit `is-on-https` scores below 0.9: Does not use HTTPS. Message: `Does not use HTTPS: {display value or item count} (Lighthouse Best Practices audit is-on-https, desktop).` | All sites should be protected with HTTPS, even ones that don't handle sensitive data. This includes avoiding mixed content ([https://developers.google.com/web/fundamentals/security/prevent-mixed-content/what-is-mixed-content](https://developers.google.com/web/fundamentals/security/prevent-mixed-content/what-is-mixed-content)), where some resources are loaded over HTTP despite the initial request being served over HTTPS. HTTPS prevents intruders from tampering with or passively listening in on the communications between your app and your users, and is a prerequisite for HTTP/2 and many new web platform APIs. Learn more about HTTPS ([https://developer.chrome.com/docs/lighthouse/pwa/is-on-https/](https://developer.chrome.com/docs/lighthouse/pwa/is-on-https/)). Found: `{up to three offending items}`. | All sites should be protected with HTTPS, even ones that don't handle sensitive data. This includes avoiding mixed content, where some resources are loaded over HTTP despite the initial request being served over HTTPS. HTTPS prevents intruders from tampering with or passively listening in on the communications between your app and your users, and is a prerequisite for HTTP/2 and many new web platform APIs. |
| `37A-LighthouseBestPracticesAuditor-411` | `FAIL` | Lighthouse audit `redirects-http` scores below 0.9: Does not redirect HTTP traffic to HTTPS. Message: `Does not redirect HTTP traffic to HTTPS: {display value or item count} (Lighthouse Best Practices audit redirects-http, desktop).` | Make sure that you redirect all HTTP traffic to HTTPS in order to enable secure web features for all your users. Learn more ([https://developer.chrome.com/docs/lighthouse/pwa/redirects-http/](https://developer.chrome.com/docs/lighthouse/pwa/redirects-http/)). Found: `{up to three offending items}`. | Make sure that you redirect all HTTP traffic to HTTPS in order to enable secure web features for all your users. |
| `37A-LighthouseBestPracticesAuditor-412` | `FAIL` | Lighthouse audit `geolocation-on-start` scores below 0.9: Requests the geolocation permission on page load. Message: `Requests the geolocation permission on page load: {display value or item count} (Lighthouse Best Practices audit geolocation-on-start, desktop).` | Users are mistrustful of or confused by sites that request their location without context. Consider tying the request to a user action instead. Learn more about the geolocation permission ([https://developer.chrome.com/docs/lighthouse/best-practices/geolocation-on-start/](https://developer.chrome.com/docs/lighthouse/best-practices/geolocation-on-start/)). Found: `{up to three offending items}`. | Users are mistrustful of or confused by sites that request their location without context. Consider tying the request to a user action instead. |
| `37A-LighthouseBestPracticesAuditor-413` | `FAIL` | Lighthouse audit `notification-on-start` scores below 0.9: Requests the notification permission on page load. Message: `Requests the notification permission on page load: {display value or item count} (Lighthouse Best Practices audit notification-on-start, desktop).` | Users are mistrustful of or confused by sites that request to send notifications without context. Consider tying the request to user gestures instead. Learn more about responsibly getting permission for notifications ([https://developer.chrome.com/docs/lighthouse/best-practices/notification-on-start/](https://developer.chrome.com/docs/lighthouse/best-practices/notification-on-start/)). Found: `{up to three offending items}`. | Users are mistrustful of or confused by sites that request to send notifications without context. Consider tying the request to user gestures instead. |
| `37A-LighthouseBestPracticesAuditor-419` | `FAIL` | Lighthouse audit `paste-preventing-inputs` scores below 0.9: Prevents users from pasting into input fields. Message: `Prevents users from pasting into input fields: {display value or item count} (Lighthouse Best Practices audit paste-preventing-inputs, desktop).` | Preventing input pasting is a bad practice for the UX, and weakens security by blocking password managers.Learn more about user-friendly input fields ([https://developer.chrome.com/docs/lighthouse/best-practices/paste-preventing-inputs/](https://developer.chrome.com/docs/lighthouse/best-practices/paste-preventing-inputs/)). Found: `{up to three offending items}`. | Preventing input pasting is a bad practice for the UX, and weakens security by blocking password managers. |
| `37A-LighthouseBestPracticesAuditor-420` | `FAIL` | Lighthouse audit `image-aspect-ratio` scores below 0.9: Displays images with incorrect aspect ratio. Message: `Displays images with incorrect aspect ratio: {display value or item count} (Lighthouse Best Practices audit image-aspect-ratio, desktop).` | Image display dimensions should match natural aspect ratio. Learn more about image aspect ratio ([https://developer.chrome.com/docs/lighthouse/best-practices/image-aspect-ratio/](https://developer.chrome.com/docs/lighthouse/best-practices/image-aspect-ratio/)). Found: `{up to three offending items}`. | Image display dimensions should match natural aspect ratio. |
| `37A-LighthouseBestPracticesAuditor-421` | `FAIL` | Lighthouse audit `image-size-responsive` scores below 0.9: Serves images with low resolution. Message: `Serves images with low resolution: {display value or item count} (Lighthouse Best Practices audit image-size-responsive, desktop).` | Image natural dimensions should be proportional to the display size and the pixel ratio to maximize image clarity. Learn how to provide responsive images ([https://web.dev/articles/serve-responsive-images](https://web.dev/articles/serve-responsive-images)). Found: `{up to three offending items}`. | Image natural dimensions should be proportional to the display size and the pixel ratio to maximize image clarity. |
| `37A-LighthouseBestPracticesAuditor-422` | `FAIL` | Lighthouse audit `viewport` scores below 0.9: Does not have a `` tag with `width` or `initial-scale`. Message: `Does not have a tag with width or initial-scale: {display value or item count} (Lighthouse Best Practices audit viewport, desktop).` | A `` not only optimizes your app for mobile screen sizes, but also prevents a 300 millisecond delay to user input ([https://developer.chrome.com/blog/300ms-tap-delay-gone-away/](https://developer.chrome.com/blog/300ms-tap-delay-gone-away/)). Learn more about using the viewport meta tag ([https://developer.chrome.com/docs/lighthouse/pwa/viewport/](https://developer.chrome.com/docs/lighthouse/pwa/viewport/)). Found: `{up to three offending items}`. | A \ not only optimizes your app for mobile screen sizes, but also prevents a 300 millisecond delay to user input. |
| `37A-LighthouseBestPracticesAuditor-423` | `FAIL` | Lighthouse audit `font-size` scores below 0.9: Document doesn't use legible font sizes. Message: `Document doesn't use legible font sizes: {display value or item count} (Lighthouse Best Practices audit font-size, desktop).` | Font sizes less than 12px are too small to be legible and require mobile visitors to “pinch to zoom” in order to read. Strive to have >60% of page text ≥12px. Learn more about legible font sizes ([https://developer.chrome.com/docs/lighthouse/seo/font-size/](https://developer.chrome.com/docs/lighthouse/seo/font-size/)). Found: `{up to three offending items}`. | Font sizes less than 12px are too small to be legible and require mobile visitors to “pinch to zoom” in order to read. Strive to have >60% of page text ≥12px. |
| `37A-LighthouseBestPracticesAuditor-424` | `FAIL` | Lighthouse audit `doctype` scores below 0.9: Page lacks the HTML doctype, thus triggering quirks-mode. Message: `Page lacks the HTML doctype, thus triggering quirks-mode: {display value or item count} (Lighthouse Best Practices audit doctype, desktop).` | Specifying a doctype prevents the browser from switching to quirks-mode. Learn more about the doctype declaration ([https://developer.chrome.com/docs/lighthouse/best-practices/doctype/](https://developer.chrome.com/docs/lighthouse/best-practices/doctype/)). Found: `{up to three offending items}`. | Specifying a doctype prevents the browser from switching to quirks-mode. |
| `37A-LighthouseBestPracticesAuditor-425` | `FAIL` | Lighthouse audit `charset` scores below 0.9: Charset declaration is missing or occurs too late in the HTML. Message: `Charset declaration is missing or occurs too late in the HTML: {display value or item count} (Lighthouse Best Practices audit charset, desktop).` | A character encoding declaration is required. It can be done with a `` tag in the first 1024 bytes of the HTML or in the Content-Type HTTP response header. Learn more about declaring the character encoding ([https://developer.chrome.com/docs/lighthouse/best-practices/charset/](https://developer.chrome.com/docs/lighthouse/best-practices/charset/)). Found: `{up to three offending items}`. | A character encoding declaration is required. It can be done with a \ tag in the first 1024 bytes of the HTML or in the Content-Type HTTP response header. |
| `37A-LighthouseBestPracticesAuditor-427` | `FAIL` | Lighthouse audit `deprecations` scores below 0.9: Uses deprecated APIs. Message: `Uses deprecated APIs: {display value or item count} (Lighthouse Best Practices audit deprecations, desktop).` | Deprecated APIs will eventually be removed from the browser. Learn more about deprecated APIs ([https://developer.chrome.com/docs/lighthouse/best-practices/deprecations/](https://developer.chrome.com/docs/lighthouse/best-practices/deprecations/)). Found: `{up to three offending items}`. | Deprecated APIs will eventually be removed from the browser. |
| `37A-LighthouseBestPracticesAuditor-428` | `FAIL` | Lighthouse audit `third-party-cookies` scores below 0.9: Uses third-party cookies. Message: `Uses third-party cookies: {display value or item count} (Lighthouse Best Practices audit third-party-cookies, desktop).` | Third-party cookies may be blocked in some contexts. Learn more about preparing for third-party cookie restrictions ([https://privacysandbox.google.com/cookies/prepare/overview](https://privacysandbox.google.com/cookies/prepare/overview)). Found: `{up to three offending items}`. | Third-party cookies may be blocked in some contexts. |
| `37A-LighthouseBestPracticesAuditor-429` | `FAIL` | Lighthouse audit `errors-in-console` scores below 0.9: Browser errors were logged to the console. Message: `Browser errors were logged to the console: {display value or item count} (Lighthouse Best Practices audit errors-in-console, desktop).` | Errors logged to the console indicate unresolved problems. They can come from network request failures and other browser concerns. Learn more about this errors in console diagnostic audit ([https://developer.chrome.com/docs/lighthouse/best-practices/errors-in-console/](https://developer.chrome.com/docs/lighthouse/best-practices/errors-in-console/)) Found: `{up to three offending items}`. | Errors logged to the console indicate unresolved problems. They can come from network request failures and other browser concerns. |
| `37A-LighthouseBestPracticesAuditor-430` | `FAIL` | Lighthouse audit `valid-source-maps` scores below 0.9: Missing source maps for large first-party JavaScript. Message: `Missing source maps for large first-party JavaScript: {display value or item count} (Lighthouse Best Practices audit valid-source-maps, desktop).` | Source maps translate minified code to the original source code. This helps developers debug in production. In addition, Lighthouse is able to provide further insights. Consider deploying source maps to take advantage of these benefits. Learn more about source maps ([https://developer.chrome.com/docs/devtools/javascript/source-maps/](https://developer.chrome.com/docs/devtools/javascript/source-maps/)). Found: `{up to three offending items}`. | Source maps translate minified code to the original source code. This helps developers debug in production. In addition, Lighthouse is able to provide further insights. Consider deploying source maps to take advantage of these benefits. |
| `37A-LighthouseBestPracticesAuditor-431` | `FAIL` | Lighthouse audit `inspector-issues` scores below 0.9: Issues were logged in the `Issues` panel in Chrome Devtools. Message: `Issues were logged in the Issues panel in Chrome Devtools: {display value or item count} (Lighthouse Best Practices audit inspector-issues, desktop).` | Issues logged to the `Issues` panel in Chrome Devtools indicate unresolved problems. They can come from network request failures, insufficient security controls, and other browser concerns. Open up the Issues panel in Chrome DevTools for more details on each issue. Found: `{up to three offending items}`. | Issues logged to the Issues panel in Chrome Devtools indicate unresolved problems. They can come from network request failures, insufficient security controls, and other browser concerns. Open up the Issues panel in Chrome DevTools for more details on each issue. |
| `37A-LighthouseBestPracticesAuditor-490` | `FAIL` | A scored audit this catalog does not list (added by a newer Lighthouse) scores below 0.9. Message: `{Lighthouse title}: {display value or item count} (Lighthouse Best Practices audit {id}, desktop).` | Lighthouse's description of the audit, then the first offending items. | Lighthouse's description of the audit without its learn-more link. |
| `37A-LighthouseBestPracticesAuditor-300` | `WARNING` | The Best Practices score is below `warningBelowScore` and not below `failBelowScore`. Message: `Lighthouse Best Practices score is 75/100 (desktop); the warning threshold is 90.` | Raise the Best Practices score (`{score}`) by fixing its lowest-scoring audits first: `{audit title} ({display value})`; … | Outdated libraries, console errors and insecure requests are the defects attackers and browser updates exploit first, so the page breaks or gets compromised without warning. |
| `37A-LighthouseBestPracticesAuditor-401` | `FAIL` | `failBelowScore` is equal to or above `warningBelowScore`; Lighthouse does not run. Message: `failBelowScore (90) must be lower than warningBelowScore (50).` | Set `failBelowScore` below `warningBelowScore` on the auditor's Configuration tab; the defaults are 50 and 90. | With the thresholds inverted no score can be a warning, so the audit would hide regressions until they are already failures. |
| `37A-LighthouseBestPracticesAuditor-500` | `ERROR` | Lighthouse could not load the page: the run exceeded its time budget, or Lighthouse reported a runtime error (`NO_FCP`, `PAGE_HUNG`, `DNS_FAILURE`, `ERRORED_DOCUMENT_REQUEST`, …). Message: `Lighthouse could not audit {url}: NO_FCP: The page did not paint any content.` | Make `{url}` load in a browser within the audit's time limit and re-run the audit. Last error was `"{error}"`. | — |
| `37A-LighthouseBestPracticesAuditor-200` | `SUCCESS` | The Best Practices score is at or above `warningBelowScore`. Message: `Lighthouse Best Practices score is 95/100 (desktop). At or above the warning threshold of 90.` | — | — |
| `37A-LighthouseBestPracticesAuditor-590` | `ERROR` | The audited page answered HTTP 403, HTTP 429 or a Cloudflare challenge, so 37AuditsBot was blocked before it could read the page. | Allow 37AuditsBot in your firewall or bot protection: allowlist its user agent, or verify its Web Bot Auth signature. See [https://www.37audits.com/bot](https://www.37audits.com/bot). | While 37AuditsBot is blocked this audit cannot look at the site, so problems on it go unreported. |
The score check carries in `data`: `category`, `score`, `formFactor`, both thresholds, `failingAudits` (up to ten audits of the category below Lighthouse's pass mark, lowest score first, each with `id`, `title`, `score`, `displayValue`), `lighthouseVersion`, `chromeVersion`, `benchmarkIndex`, `elapsedSeconds` and `runWarnings`. Each audit check (`1NN`, `4NN`) adds `auditId`, `auditTitle`, `auditScore` (0–100 or `null`), `scoreDisplayMode`, `displayValue`, `weight`, `group`, `numericValue`, `numericUnit`, `learnMore` (Lighthouse's documentation link), `inCatalog`, `itemCount` and `items` (up to ten rows of Lighthouse's details table: DOM nodes reduced to selector, snippet, label and explanation; source locations to `url:line:column`).
## Output documentation
| Status | Description | Test logic |
| - | - | - |
| **INFORMATION** | Report pin, manual checks and unscored audits | Always one `100` check with the Lighthouse and Chrome versions, device profile, duration and benchmark index; plus one `1NN` check per audit Lighthouse leaves to a manual check or reports without a score. |
| **SUCCESS** | The Best Practices score is at or above the warning threshold | The score is `>= warningBelowScore`; the message states the score and counts the failing audits. Every result, whatever its status, also carries one `4NN` check per scored audit below 0.9; it never changes the status. |
| **WARNING** | The Best Practices score is below the warning threshold and not below the fail threshold | One `300` check; the summary states the score. |
| **FAIL** | The Best Practices score is below the fail threshold, or the thresholds are inverted | One `400` check, or a single `401` check when `failBelowScore >= warningBelowScore`. |
| **ERROR** | Lighthouse could not audit the page or score the category | `500` when the page did not load inside the budget or Lighthouse reported a runtime error; `501` when the category has no score; `590` when the page blocked 37AuditsBot. |
## Risks and considerations
### A score is not a certification
Lighthouse automates the Best Practices checks a machine can run on one page load (HTTPS, front-end libraries with known vulnerabilities, browser console errors, deprecated APIs, third-party cookies, image aspect ratios and resolution, source maps and the document's doctype and charset). A perfect score means no automated check failed, not that the page is flawless; manual review still finds problems automation cannot.
### Desktop and mobile differ
The two device profiles render the page at different sizes, so the audits that depend on layout can give different results. Pick the profile that matches the audience and keep it, because the scores of the two profiles are not strictly comparable.
### The run is unsigned
The Lighthouse navigation carries the 37AuditsBot user agent but no Web Bot Auth signature. A site that only admits signed bots answers with a challenge, which this audit reports as blocked (`590`).
### The score alone decides the result
Lighthouse weighs its audits into the score, so a page can score 90 with one audit failing. The result follows the score, as Lighthouse's gauge does: that page is a `SUCCESS`. The failing audit is still listed as a `FAIL` check, because the item is what the owner has to fix, but it never changes the status of the result. The check order follows Lighthouse's report: heavier audits first, then the lowest scores.
### Codes are fixed per audit
Each audit keeps its number across Lighthouse upgrades, so a deep link to a code stays valid. An audit a newer Lighthouse adds is reported with `490` (failing) or `190` (informative or manual) and `inCatalog: false` in its data until the catalog in this auditor is extended; an audit Lighthouse removes keeps its number unused.
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.