Originally published on the Prufa blog.
Five days ago we audited 49 Show HN launches and found that 78% had a critical bug on day one. This week we pointed the same free audit at a different cohort: 14 products freshly posted to r/SideProject. We expected more of the same.
We got the opposite — and it turned out to be more interesting.
Not one of the 14 had a critical finding. No broken signup flow, no canonical pointing at the wrong domain, no analytics tag silently swallowing every event. By the measure that matters most on launch day — does the core thing work — these builders shipped clean.
And yet every single site had findings. They just all live one tier down, in a layer so consistent it reads like a shared checklist nobody handed out:
11 of 14 sent no analytics events at all.
11 of 14 shipped with no Content-Security-Policy and could be framed by any site (noX-Frame-Options).
11 of 14 had serious accessibility violations.
12 of 14 had tap targets smaller than 24px on mobile.
9 of 14 took over four seconds to paint their largest element on mobile.
8 of 14 had no canonical link on the entry page.
No site is named in this post. The point isn't to embarrass anyone — these are good builders who got a real product live. The point is that the same common side-project launch mistakes show up again and again, and if 11 of 14 strangers have them, you probably have a few too.
Methodology, briefly
We pulled 20 URLs from recent r/SideProject posts and ran each through the same audit a free Prufa run does: a real browser loads the public pages and captures network traffic, console output, response codes, headers, and the rendered DOM, then a fixed suite of deterministic checks grades the evidence. Same input, same verdict.
Of the 20: 14 completed cleanly, 4 were blocked by bot protection before our runner could load them, and 2 didn't finish inside our polling window. The numbers below are from the 14 that completed.
Two honest caveats. First, 14 is a small sample — treat these as directional, not census. Second, every number below is from a code-verified check; the audit also produces LLM-written UX observations (a hero that over-claims, a CTA with no clear primary action), but those are advisory and counted nowhere in this data. The LLM in our pipeline never grades results — plain code does.
What actually breaks on a side-project launch: the numbers
| Sites affected (of 14) | Finding | Severity |
|---|---|---|
| 12 | Tap targets smaller than 24px (mobile) | warning |
| 12 | Slow largest-contentful-paint (9 of them over 4s) | warning |
| 11 | No analytics events detected | info |
| 11 | No Content-Security-Policy header | info |
| 11 | Page can be framed by any site (no X-Frame-Options) | info |
| 11 | Serious accessibility violations | warning |
| 11 | No llms.txt | info |
| 10 | Minor accessibility violations | info |
| 9 | No X-Content-Type-Options: nosniff | info |
| 9 | Text assets served without compression | info |
| 8 | No canonical link on entry page | info |
| 7 | Unknown URLs return 200 instead of 404 | warning |
| 7 | No structured data on entry page | info |
| 6 | No Strict-Transport-Security header | warning |
| 5 | Missing Open Graph tags | info |
| 4 | Missing meta description | warning |
| 4 | http:// does not redirect to https:// | warning |
| 4 | Images missing alt text | info |
The most common mistake: flying blind on your own launch
Eleven of the fourteen sites sent no analytics events whatsoever. The page loads, the browser records every outbound request, and nothing resembling an analytics beacon ever leaves it.
This was the single most common finding in the Show HN cohort too, and it stings more for a side project. You posted to r/SideProject for one reason — to find out if anyone wants this. The traffic from that post is the clearest signal you will get for weeks: which referrer converted, which screenshot made people click, how many visitors actually reached the signup. For 11 of these 14 builders, that data was never recorded. The launch happened; the evidence didn't.
(We can only see a recognized beacon — if you run a first-party collector we don't have a signature for, you'd show up here too. Worth a 30-second check of your own network tab either way.)
The security headers nobody adds
Eleven sites had no Content-Security-Policy and could be embedded in an iframe by any website on the internet — the setup behind clickjacking. Nine were missing X-Content-Type-Options: nosniff; six had no HSTS; four served http:// without redirecting to https://.
None of these is exploitable on its own for most side projects, and none will page you. But they're each a one-line fix in your host or framework config, and they're the difference between "looks like a weekend hack" and "looks like someone who knows what they're doing" to anyone who checks. Several were also soft-404s — 7 of 14 returned 200 OK for URLs that don't exist, which quietly pollutes search indexing and hides broken links from your own logs.
The mobile and accessibility tax
Twelve sites had tap targets under 24px and nine took over four seconds to paint on mobile — one took 18.5 seconds. Most launch traffic from a social post is mobile; a four-second hero is a meaningful chunk of visitors gone before they see the thing.
Eleven sites had serious accessibility violations (the kind axe-core flags as serious — missing form labels, insufficient contrast, controls with no accessible name). These aren't only a compliance question: a button a screen reader can't name is often a button that's confusing to everyone, and contrast failures are just hard-to-read text.
The AEO gap: 11 of 14 have no llms.txt
Eleven sites had no llms.txt and seven had no structured data on the entry page. A year ago that was a non-issue. Now a real and growing share of "how do I…" and "what's the best tool for…" traffic resolves inside ChatGPT, Perplexity, and Google's AI overviews — and those engines lean on machine-readable signals to understand and cite you. A side project with no structured data and no llms.txt is invisible to exactly the channel that's growing fastest.
What we take from this
The Show HN cohort failed loudly — broken flows, dead analytics tags, canonical tags aimed at the wrong domain. This cohort failed quietly, and uniformly. Zero criticals is genuinely good news; it means these builders shipped working products. But "nothing is broken" and "nothing is leaking" are different claims, and all 14 were leaking in the same handful of places: reach (analytics, AEO, SEO), trust (security headers), and reach-again (mobile speed, accessibility).
None of it requires judgment to detect. Every finding above is a deterministic check against evidence a browser can capture — a request that did or didn't happen, a header that is or isn't present, a response code. Which is exactly why it should be automated instead of living on a checklist you mean to get to.
That's the audit we ran on these 14 sites, and it's free: paste a URL on the Prufa homepage and get the same machine-verified findings for your own launch in about a minute. Ideally before you post it.