How to defend against Account Takeovers
Learn about account takeover threats, protection strategies, and detection methods to secure your digital accounts and prevent unauthorised access.
Core Web Vitals (CWV) are a set of specific metrics that Google uses to measure the real-world user experience of a webpage, focusing on loading performance, interactivity, and visual stability. Passing the Core Web Vitals assessment is important not only for providing a good user experience but also as a ranking factor in Google Search.
The three core metrics are: 1. Largest Contentful Paint (LCP): Measures loading performance. It marks the point in the page load timeline when the main content of the page has likely loaded. 2. First Input Delay (FID): Measures interactivity. It quantifies the experience users feel when trying to interact with a page that isn't yet responsive. 3. Cumulative Layout Shift (CLS): Measures visual stability. It quantifies how much the content on a page unexpectedly shifts around during the loading process.
To pass the assessment, your page must meet the "Good" threshold for all three metrics for at least 75% of its real-world users over a 28-day period.
Metric | Good | Needs Improvement | Poor |
---|---|---|---|
LCP | ≤ 2.5 seconds | > 2.5s and ≤ 4.0s | > 4.0 seconds |
FID | ≤ 100 milliseconds | > 100ms and ≤ 300ms | > 300ms |
CLS | ≤ 0.1 | > 0.1 and ≤ 0.25 | > 0.25 |
LCP is all about how fast the largest element (usually a hero image, video, or a large block of text) becomes visible to the user.
1. Optimize Your Server Response Time (TTFB):
2. Optimize Your Images:
<picture>
element or the srcset
attribute to serve different image sizes for different screen resolutions. Don't serve a massive desktop image to a mobile user.3. Defer Offscreen Images (Lazy Loading):
<img loading="lazy" ...>
) for all images that are "below the fold" (not immediately visible). This allows the browser to prioritize loading the critical, visible content first.4. Preload the LCP Image:
<head>
of your HTML:
<link rel="preload" as="image" href="/path/to/hero-image.webp">
FID measures the time from when a user first interacts with your page (e.g., clicks a button) to the time the browser is actually able to process that event. A long FID is usually caused by the browser's main thread being busy parsing and executing large JavaScript files.
1. Break Up Long Tasks:
2. Defer or Async JavaScript:
defer
or async
attributes on your <script>
tags.async
: Downloads the script without blocking the HTML parser and executes it as soon as it's downloaded.defer
: Downloads the script without blocking and executes it only after the HTML parser has finished. defer
is generally preferred as it maintains the order of execution.3. Minimize Third-Party Scripts:
defer
.4. Use a Web Worker:
CLS is caused by elements on the page moving around after they have been initially rendered. This is a common annoyance, especially on mobile devices.
1. Always Include Size Attributes on Images and Videos:
The most common cause of CLS is images loading and pushing content down. Prevent this by always specifying the width
and height
attributes on your <img>
and <video>
tags.
<img src="image.jpg" width="640" height="360" alt="...">
The browser will use these attributes to reserve the correct amount of space for the image before it has finished downloading.
2. Reserve Space for Ads and Embeds:
3. Avoid Inserting Content Above Existing Content:
4. Use CSS Transform for Animations:
transform
property instead of properties like top
, left
, or margin
, which can trigger layout changes. transform
animations are handled by the browser's compositor thread and do not cause layout shifts.
transform: translateX(100px);
is better than margin-left: 100px;
for animations.Learn about account takeover threats, protection strategies, and detection methods to secure your digital accounts and prevent unauthorised access.
An overview of Account Takeover Attacks
A step-by-step breakdown of how credential stuffing attacks are carried out, from obtaining stolen credentials to bypassing defenses and taking over accounts.
An introduction to Anycast DNS
A quick description about what an Apex Domain is.
Learn the essential best practices for managing and rotating API keys to enhance security, prevent unauthorized access, and minimize the impact of key compromise.
© PEAKHOUR.IO PTY LTD 2025 ABN 76 619 930 826 All rights reserved.