Site Audit·fullspeedahead.com

Security · security.outdated-encryption

Ask your host to turn off the old TLS 1.0 and TLS 1.1 protocols and allow only TLS 1.2 and above. These older versions have known weaknesses that let an attacker on the same network read traffic between your site and a visitor. Turning them off is a server setting and does not change your site.

What we measured:

SSL/TLS protocol TLSv1.0 is unsafe. SSL/TLS protocol TLSv1.1 is unsafe.

Accessibility · accessibility.missing-image-alt

Add a short description to each meaningful image, saying what it shows. Blind and partially sighted visitors hear this text in place of the image, and search engines use it to understand the picture. Images that are pure decoration should be given an empty description so they are skipped.

Affects 421 pages. The scan reported a count without listing the pages.

What we measured:

421 page(s) without image alt attributes

Speed · performance.broken-links

Fix or remove these links. A visitor who hits one usually leaves, and search engines treat a site full of dead links as poorly maintained.

Affected pages:

• https://www.fullspeedahead.com/sites/default/files/advagg_css/css__JOuYpO6K1WTeh-281h1xtEgS6sFHeutnruDJtYAI_CU__dqh8oJwCAEtI8YtpZ647X-y6_Hg9Lfvu0F0UDlISlMk__6MnMiVRJETAgqt74UoLmpnwTbBJWEcZtPVENuax2oyY.css

What we measured:

403 https://www.fullspeedahead.com/sites/default/files/advagg_css/css__JOuYpO6K1WTeh-281h1xtEgS6sFHeutnruDJtYAI_CU__dqh8oJwCAEtI8YtpZ647X-y6_Hg9Lfvu0F0UDlISlMk__6MnMiVRJETAgqt74UoLmpnwTbBJWEcZtPVENuax2oyY.css

Speed · performance.slow-pages

These pages took more than 3 seconds to respond. Most visitors give up before that. The usual causes are large uncompressed images, too many plugins, and no caching. Start with caching, it is the cheapest fix and usually the biggest one.

Affected pages:

• https://fullspeedahead.com/en/news/highlights-month-metron-55-sl-tubular
• https://fullspeedahead.com/en/fsa-world/how-choose-right-road-frame-size
• https://fullspeedahead.com/en/fsa-world/just-between-us-milan-vader
• https://fullspeedahead.com/en/news/team-mclaren-bahrain-choose-vision-official-wheel-partner
• https://fullspeedahead.com/en/fsa-world/tour-taiwan-success
• https://fullspeedahead.com/en/fsa-world/we-road-bh-burgos-and-valcar-cylance
• https://fullspeedahead.com/it/find-store
• https://fullspeedahead.com/en/fsa-world/kfx-i28-total-control
• https://fullspeedahead.com/en/news/vision-tech-guide-washing-pro-bike%E2%80%99s-0
• https://fullspeedahead.com/en/fsa-world/martinez-places-3rd-amgen-tour-california

and 10 more

What we measured:

9.3s https://fullspeedahead.com/en/news/highlights-month-metron-55-sl-tubular
9.0s https://fullspeedahead.com/en/fsa-world/how-choose-right-road-frame-size
8.6s https://fullspeedahead.com/en/fsa-world/just-between-us-milan-vader
6.6s https://fullspeedahead.com/en/news/team-mclaren-bahrain-choose-vision-official-wheel-partner
6.2s https://fullspeedahead.com/en/fsa-world/tour-taiwan-success

Speed · performance.slow-largest-paint

Google measures how long it takes for the biggest thing on screen, usually the main image or headline, to become visible. It should happen within 2.5 seconds and on these pages it does not. The usual fixes are compressing the main image, loading it sooner, and turning on caching.

Affected pages:

• https://fullspeedahead.com/
• https://fullspeedahead.com/en/fsa-world
• https://fullspeedahead.com/en/find-store
• https://fullspeedahead.com/en/technology
• https://fullspeedahead.com/en/company
• https://fullspeedahead.com/en/teams
• https://fullspeedahead.com/en/support

What we measured:

22.7s https://fullspeedahead.com/
20.6s https://fullspeedahead.com/en/fsa-world
17.1s https://fullspeedahead.com/en/find-store
8.1s https://fullspeedahead.com/en/technology
8.0s https://fullspeedahead.com/en/company

Speed · performance.layout-shift

Things move on screen as the page loads, so someone can reach for a button and have it shift out from under them. It is usually caused by images and adverts without a reserved space. Setting a width and height on images fixes most of it.

Affected pages:

• https://fullspeedahead.com/en/fsa-world
• https://fullspeedahead.com/en/technology

<img src="/photo.jpg" width="1200" height="800" alt="...">

What we measured:

shift score 0.28 https://fullspeedahead.com/en/fsa-world
shift score 0.13 https://fullspeedahead.com/en/technology

Speed · performance.low-speed-score

Google scores each page out of 100 for speed on a mobile connection, and these score under 50. Page speed is one of the things Google uses to decide search rankings, so this costs visibility as well as visitors.

Affected pages:

• https://fullspeedahead.com/en/fsa-world
• https://fullspeedahead.com/en/company
• https://fullspeedahead.com/en/find-store
• https://fullspeedahead.com/
• https://fullspeedahead.com/en/technology
• https://fullspeedahead.com/en/support
• https://fullspeedahead.com/en/teams

What we measured:

scored 29 out of 100: https://fullspeedahead.com/en/fsa-world
scored 34 out of 100: https://fullspeedahead.com/en/company
scored 34 out of 100: https://fullspeedahead.com/en/find-store
scored 39 out of 100: https://fullspeedahead.com/
scored 43 out of 100: https://fullspeedahead.com/en/technology

Speed · performance.unused-javascript

A large amount of JavaScript is downloaded and parsed but never runs on the page. This is normally unused plugins or a bundle that ships everything to every page. Removing what is not needed makes every page load faster.

Affects 7 pages. The scan reported a count without listing the pages.

What we measured:

7 page(s) affected. Est savings of 560 KiB

Security · security.header-strict-transport-security

Add the Strict-Transport-Security header. It tells browsers to always connect over the encrypted version of your site, even when someone types the address without it. This is a one line change on the server.

Strict-Transport-Security: max-age=31536000; includeSubDomains

What we measured:

Strict-Transport-Security header is not set. It enforces secure connections and protects against MITM attacks.

Security · security.header-content-security-policy

Add a Content-Security-Policy header listing the places your site is allowed to load scripts and styles from. It is the main defence against an attacker injecting code into a page. Introduce it in report-only mode first so you can see what it would block before it blocks anything.

Content-Security-Policy-Report-Only: default-src 'self'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; script-src 'self'

What we measured:

Content-Security-Policy header is not set. It restricts resources the page can load and prevents XSS attacks.

Search · seo.missing-meta-description

Write a short summary for each page, around 150 characters. Google shows this under the page title in search results. Without one, Google picks a sentence from the page itself, which often reads badly and costs you clicks.

Affected pages:

• https://fullspeedahead.com/en/discipline/e-bike
• https://fullspeedahead.com/en/discipline/gravel
• https://fullspeedahead.com/en/discipline/mtb
• https://fullspeedahead.com/en/discipline/road
• https://fullspeedahead.com/en/fsa-world/andrew-taylor-cruisin-through-taiwan-and-bali
• https://fullspeedahead.com/en/fsa-world/boost-or-not-boost-problem
• https://fullspeedahead.com/en/fsa-world/caroline-mani-claims-silver-world-championships
• https://fullspeedahead.com/en/fsa-world/freedom-it%E2%80%99s-fastest-josh-gibb
• https://fullspeedahead.com/en/fsa-world/giro-story-ep2-two-fantastic-champions-nibali-and-contador

What we measured:

9 page(s) without a meta description

Search · seo.duplicate-titles

Give each page a distinct title. When pages share one, search engines cannot tell them apart and will usually show only one of them, so the others get no traffic.

Affects 10 pages. The scan reported a count without listing the pages.

What we measured:

10 pages share the title "Full Speed Ahead"
4 pages share the title "Discipline | Full Speed Ahead"
2 pages share the title "Eurobike Hot News | Full Speed Ahead"
2 pages share the title "A CHAT WITH PAOLA GIANOTTI | Full Speed Ahead"
2 pages share the title "A BIKE IS LIKE A CANVAS: THE CARRARO BLUE STORY | Full Speed Ahead"

Technology · tech.outdated-bootstrap

Older Bootstrap major versions are no longer maintained, and the earlier ones also drag in a copy of jQuery. The site is on 3.3.7. Anything below 5.3.8 is either on a release line that has ended or is missing fixes published since. Test the update on a copy of the site rather than on the live one.

What we measured:

Detected Bootstrap 3.3.7 from page variable jQuery.fn.tooltip.Constructor.VERSION: 3.3.7. Checked against a local list last updated on 2026-09-08, with no network call.

Technology · tech.outdated-centos

CentOS is discontinued, so the server operating system itself is no longer getting security fixes. Moving off it is a project rather than an update, so it is worth planning rather than leaving until something breaks.

What we measured:

Detected CentOS from header Server: CentOS. Checked against a local list last updated on 2026-09-08, with no network call.

Technology · tech.outdated-jquery

jQuery has had cross site scripting problems fixed in later releases, and its oldest major versions are unmaintained entirely. The site is on 1.10.2. Anything below 3.7.1 is either on a release line that has ended or is missing fixes published since. Test the update on a copy of the site rather than on the live one.

What we measured:

Detected jQuery 1.10.2 from script: jquery. Checked against a local list last updated on 2026-09-08, with no network call.

Technology · tech.outdated-openssl

This is the software that encrypts traffic to the site. Once a release reaches end of life it stops getting security fixes, which undermines every secure connection the site makes. The site is on 1.0.2k. Anything below 3.4.7 is either on a release line that has ended or is missing fixes published since. Test the update on a copy of the site rather than on the live one.

What we measured:

Detected OpenSSL 1.0.2k from header Server: OpenSSL/1.0.2k. Checked against a local list last updated on 2026-09-08, with no network call.

Technology · tech.outdated-php

PHP releases stop receiving security fixes about three years after they come out. Past that point, known problems in the language the site is written in stay unfixed. The site is on 5.6.40. Anything below 8.2.33 is either on a release line that has ended or is missing fixes published since. Test the update on a copy of the site rather than on the live one.

What we measured:

Detected PHP 5.6.40 from header Server: PHP/5.6.40. Checked against a local list last updated on 2026-09-08, with no network call.

Accessibility · accessibility.missing-h1

Give every page one main heading that says what the page is about. Screen reader users navigate by headings, and search engines use it to work out the subject of the page.

Affects 5 pages. The scan reported a count without listing the pages.

<h1>What this page is about</h1>

What we measured:

5 page(s) without <h1> heading

Accessibility · accessibility.skipped-heading-levels

Use headings in order without skipping, so a main heading is followed by a second level heading rather than jumping straight to a third. People using a screen reader rely on that order to move around the page, and skipping levels makes sections seem to belong to the wrong place.

Affected pages:

• https://fullspeedahead.com/en/support
• https://fullspeedahead.com/zhs
• https://fullspeedahead.com/zht
• https://fullspeedahead.com/
• https://fullspeedahead.com/en/fsa-world
• https://fullspeedahead.com/en
• https://fullspeedahead.com/es
• https://fullspeedahead.com/fr
• https://fullspeedahead.com/de
• https://fullspeedahead.com/ja

and 190 more

What we measured:

421 page(s) with skipped heading levels

Speed · performance.slow-server-response

Across the whole scan the server averaged over a second to respond. That delay is added to every single page view before anything appears on screen. Server side caching or a better hosting plan will move this more than any change to the site itself.

What we measured:

Average response time across the crawl was 2.54s

Speed · performance.page-too-heavy

Reduce the size of these pages. Images are almost always the cause. Saving them at the size they are actually displayed and in a modern format usually cuts the weight by more than half without any visible difference. This matters most to visitors on a phone signal.

Affects 2 pages. The scan reported a count without listing the pages.

What we measured:

2 page(s) exceed the ~2.5 MB transfer-size budget

Speed · performance.no-compression

Turn on Brotli compression on the server, or gzip if Brotli is not available. It shrinks pages before they are sent, often to a quarter of their size. It is a hosting setting, costs nothing, and needs no change to the site.

Affects 421 pages. The scan reported a count without listing the pages.

What we measured:

421 page(s) do not support Brotli compression.

Speed · performance.unminified-javascript

The JavaScript still contains the spacing and comments meant for developers. Compacting it on the way out is a standard build step and takes nothing away from the site.

Affects 7 pages. The scan reported a count without listing the pages.

What we measured:

7 page(s) affected. Est savings of 96 KiB

Speed · performance.unused-css-rules

Much of the stylesheet does not apply to anything on the page. Trimming unused styling reduces what has to be downloaded before the page can be drawn.

Affects 7 pages. The scan reported a count without listing the pages.

What we measured:

7 page(s) affected. Est savings of 49 KiB

Speed · performance.cache

Images, styling and scripts are not being kept by the browser for long enough, so someone visiting a second time downloads them all over again. This is a server setting, not a change to the site.

Affects 7 pages. The scan reported a count without listing the pages.

Cache-Control: public, max-age=31536000, immutable

What we measured:

7 page(s) affected. Est savings of 599 KiB

Speed · performance.font-display

The page waits for its custom fonts before showing any text, so visitors see a blank area first. Telling the browser to show the text immediately in a fallback font, then swap, removes that wait.

Affects 7 pages. The scan reported a count without listing the pages.

@font-face {
  font-family: "Your Font";
  src: url(...);
  font-display: swap;
}

What we measured:

7 page(s) affected. Est savings of 740 ms

Speed · performance.image-delivery

The images being sent are bigger than the space they are shown in, and are in older formats. Saving them at the displayed size and in a modern format usually cuts their weight by half or more with no visible change.

Affects 6 pages. The scan reported a count without listing the pages.

What we measured:

6 page(s) affected. Est savings of 738 KiB

Speed · performance.lcp-discovery

The largest image on the page is only discovered after other work finishes, so it starts downloading late. Referencing it directly in the page, rather than loading it through script or styling, lets the browser start on it immediately.

Affects 3 pages. The scan reported a count without listing the pages.

<link rel="preload" as="image" href="/hero.jpg" fetchpriority="high">

What we measured:

3 page(s) affected

Speed · performance.legacy-javascript

The site includes extra code so that very old browsers can run it. Modern browsers download it and throw it away. Adjusting the build to target current browsers removes the duplication.

Affects 7 pages. The scan reported a count without listing the pages.

"browserslist": ["defaults", "not IE 11"]

What we measured:

7 page(s) affected. Est savings of 26 KiB

Speed · performance.render-blocking

Stylesheets and scripts in the top of the page block it from appearing at all until they have downloaded. Loading the non essential ones later, or marking them as deferred, lets the page appear while they finish in the background. This is usually the single biggest win available.

Affects 7 pages. The scan reported a count without listing the pages.

<script defer src="..."></script>
<link rel="stylesheet" href="..." media="print" onload="this.media='all'">

What we measured:

7 page(s) affected. Est savings of 7,220 ms

Speed · performance.total-byte-weight

The total download for these pages is far above what a phone on a normal connection handles comfortably. Images are usually most of it, followed by scripts.

Affects 6 pages. The scan reported a count without listing the pages.

What we measured:

6 page(s) affected. Total size was 4,512 KiB

Speed · performance.mainthread-work-breakdown

The device spends a long time running scripts and laying out the page, during which taps and clicks do nothing. Reducing the amount of script is the fix, and it matters most on cheaper phones.

Affects 7 pages. The scan reported a count without listing the pages.

What we measured:

7 page(s) affected. 3.5 s

Speed · performance.unsized-images

Images do not declare their dimensions, so the browser does not know how much room to leave and content moves once they arrive. Setting a width and height on each image stops the jumping.

Affects 7 pages. The scan reported a count without listing the pages.

<img src="/photo.jpg" width="1200" height="800" alt="...">

What we measured:

7 page(s) affected

Security · security.header-x-frame-options

Add the X-Frame-Options header set to sameorigin. Without it, someone can load your site invisibly inside theirs and trick visitors into clicking things they cannot see.

X-Frame-Options: SAMEORIGIN

What we measured:

X-Frame-Options header is not set. It prevents clickjacking attacks when set to 'deny' or 'sameorigin.

Security · security.header-referrer-policy

Add a Referrer-Policy header, for example strict-origin-when-cross-origin. It stops the full address of the page someone was on being handed to every external site they click through to.

Referrer-Policy: strict-origin-when-cross-origin

What we measured:

Referrer-Policy header is not set. It controls referrer header sharing and enhances privacy and security.

Security · security.header-permissions-policy

Add a Permissions-Policy header turning off features your site does not need, such as camera, microphone and location. It reduces what embedded third party content is able to ask your visitors for.

Permissions-Policy: camera=(), microphone=(), geolocation=()

What we measured:

Permissions-Policy header is not set. It allows enabling/disabling browser APIs and features for security.

Search · seo.missing-canonical

Add a canonical link to each page. It tells search engines which address is the real one when the same page can be reached more than one way, for example with and without a trailing slash. Without it, search engines can treat those as competing copies and rank all of them lower.

Affects 20 pages. The scan reported a count without listing the pages.

<link rel="canonical" href="https://example.com/the-page/">

What we measured:

20 page(s) without a rel=canonical link

Search · seo.duplicate-meta-descriptions

Write a separate description for each page. Repeated descriptions make every result look the same to someone scanning a search results page.

Affects 20 pages. The scan reported a count without listing the pages.

What we measured:

20 pages share the description "Full Speed Ahead (FSA) produces world class bicycle components for road cycling and mou..."
4 pages share the description "COMPONENTI D'ALTA GAMMA PER IL CICLISMO ROAD E OFFROAD. Non ci limitiamo a sponsor..."
2 pages share the description "We’d like everyone to think back to the time they purchased their first bike or even th..."
2 pages share the description "The particular situation that forced all of us far from the races didn't stop us, ..."
2 pages share the description "The Italian ultra-cyclist, Paola Gianotti, was the fastest woman to ride around the wor..."

Technology · tech.outdated-apache-http-server

Apache fixes security problems only in its newest release, so an old build carries every issue found since it shipped, even when the version number still looks current. The site is on 2.4.6. Anything below 2.4.68 is either on a release line that has ended or is missing fixes published since. Test the update on a copy of the site rather than on the live one.

What we measured:

Detected Apache HTTP Server 2.4.6 from header Server: Apache/2.4.6. Checked against a local list last updated on 2026-09-08, with no network call.

Accessibility · accessibility.multiple-h1

Keep one main heading per page and make the rest sub headings. More than one makes it unclear what the page is actually about.

Affects 10 pages. The scan reported a count without listing the pages.

What we measured:

10 page(s) with multiple <h1> headings