I spend a lot of time auditing systems — the house, the media server, other people’s networks. It finally occurred to me that the one system I’d never audited was the one with my name on the domain. So I ran the full treatment on this site: every page measured live, every finding traced to a file and line.

Twenty-three findings. Seven critical or high. Reader, it was not great.

The 105 MB homepage

The star of the show: the homepage was silently transferring 105 MB across 293 requests. Not a typo. The photo carousel — the thing that shows you twelve nice drone shots — was rendering the entire 278-image gallery into the page. Twice. Full-resolution originals, both times. On a phone plan, visiting my homepage cost more data than streaming an episode of television. “Sharp guy, builds things, has taste” is a hard read to land when your homepage is a denial-of-service attack against your own visitors.

Blocking my own analytics

Runner-up: analytics. At some point I’d moved my analytics instance to a new domain and never updated the site’s Content-Security-Policy header, which meant every page had been dutifully blocking its own analytics script. Amount of visitor data collected since the repoint: zero. Rows. None. I had opinions about my traffic for months, and every one of them was fiction. The fix was one line in one header file.

Third: all nine blog posts 404’d. The index page listed them beautifully, and every single link led nowhere, because the route that renders an individual post didn’t exist. The write-ups were in the repo the whole time, unreachable. If you’re reading this post, on this site, at a URL that works, savor the irony with me.

The rest of the pile

Also in the pile: the mobile layout was 597 pixels wide in a 390-pixel viewport because one flex row refused to shrink (a single min-w-0 class fixed it), the social-share image was a 1.7 MB transparent PNG cutout of my head that rendered badly on every platform that touched it, the RSS icon on every page linked to a feed that didn’t exist, and a committed doc had a hardcoded API key in it, which is the kind of finding that gets a special little flag in my notes and a same-day fix.

Silent failures, every one

The uncomfortable part isn’t any single bug. It’s that every one of these was a silent failure. The site looked fine. It loaded (eventually), the links looked clickable, the analytics dashboard was politely empty in a way that read as “quiet month” rather than “you’ve been blind since April.” Nothing was on fire; everything was wrong. Which is exactly what I keep finding when I audit systems that aren’t mine — it was just my turn.

Everything on this list is fixed. The next audit will find something else, which is less a prediction than an honest description of maintaining a website. For now, you’re reading it over a connection I no longer feel guilty about.