I spend much time on audits of systems: the house, the media server, other people’s networks. Then a thought finally arrived. The one system that I never audited was the one with my name on the domain. So I ran the full treatment on this site. I measured each page live. I traced each finding to a file and a line.

Twenty-three findings. Seven critical or high. Reader, it was not great.

The 105 MB homepage

The star of the show: the homepage silently transferred 105 MB across 293 requests. That is not a typo. The photo carousel shows you twelve nice drone shots. It rendered the whole 278-image gallery into the page. Twice. Full-resolution originals, both times.

On a phone plan, a visit to my homepage cost more data than one episode of streamed television. The message of the site is “sharp guy, builds things, has taste.” That message does not land when your homepage is a denial-of-service attack against your own visitors.

I blocked my own analytics

The runner-up: analytics. At some point, I moved my analytics instance to a new domain. I did not update the Content-Security-Policy header of the site. So each page dutifully blocked its own analytics script. Visitor data collected since the move: zero. Rows. None.

I had opinions about my traffic for months. Each opinion was fiction. The fix was one line in one header file.

Third: all nine blog posts returned 404. The index page listed them beautifully. Every single link led nowhere, because the route that renders one post did not exist. The write-ups sat in the repo the whole time, unreachable. If you read this post, on this site, at a URL that works, savor the irony with me.

The rest of the pile

Also in the pile: the mobile layout was 597 pixels wide in a 390-pixel viewport, because one flex row refused to shrink. A single min-w-0 class fixed it. The social-share image was a 1.7 MB transparent PNG cutout of my head. It rendered badly on every platform that touched it.

The RSS icon on each page linked to a feed that did not exist. And one committed doc contained a hardcoded API key. That kind of finding gets a special little flag in my notes and a same-day fix.

Each failure was silent

The uncomfortable part is not one single bug. Each of these failures was silent. The site looked fine. It loaded, eventually. The links looked clickable. The analytics dashboard was politely empty, and that read as “quiet month,” not as “you were blind since April.”

Nothing was on fire. Everything was wrong. I find exactly this when I audit systems that are not mine. It was just my turn.

Everything on this list is fixed. The next audit will find something else. That is not a prediction. That is an honest description of website maintenance. For now, you read this over a connection that no longer makes me feel guilty.