DEV Community

Cover image for Things That Pass Every Check on a Client Site and Still Don't Work
Artur Pokładek
Artur Pokładek

Posted on AI-assisted

Things That Pass Every Check on a Client Site and Still Don't Work

A client never opens Lighthouse. They open their inbox, and there are no enquiries in it.

I keep running into this on client sites and on sites I take over from someone else, one of them built with v0. The last one on the list I built myself.

1. The form says thank you

On a shop I took over, the contact form showed a green "Thank you". The email behind it never arrived.

Autofill can break a form too. One site had a honeypot field that the browser filled in on its own, and the real enquiries were thrown away as bot submissions. Elsewhere the enquiries did arrive, in the spam folder, because the domain had no SPF or DKIM records.

2. "What matters is that it works"

That's what the owner of a shop built with v0 told me. Row Level Security in Supabase was switched off, so the shop worked just as well for anyone who opened the browser console.

On another site the Supabase service role key sat in the client JS bundle. That key skips RLS entirely. Turning RLS on wouldn't have helped there anyway.

3. The noindex that shipped with the site

The site went live months ago with the noindex tag from staging still in the head. Google is very polite about this. It was asked not to index the pages, and for months it didn't.

A robots.txt that blocked /_next/ did the same job from a different angle. That folder is where Next.js keeps its scripts and styles. Googlebot couldn't fetch them, and on that site it rendered an empty page.

4. Lighthouse 100 on placeholders

The score was measured on placeholder images. Then the client started uploading photos straight from their phone, several megabytes each, and LCP went downhill from there.

The same perfect score sat on a site whose hero took seconds to show up on a real phone on 4G.

5. The cookie banner with two Accept buttons

The banner has a Reject button, and clicking it sets exactly the same cookies as Accept.

6. The pages that send Google somewhere else

Many subpages share the same title and the same canonical URL, and each one tells Google that the real page lives somewhere else. Google takes them at their word. One page stays in the index and the rest drop out.

Sometimes the sitemap joins in, full of localhost or vercel.app preview links.

7. 100vh on an iPhone

The hero is exactly one screen tall in Chrome's device emulator. On the phone itself, Safari's address bar covers the call to action.

svh or dvh fixes it, once somebody picks up an iPhone and checks.

8. The menu that needs a mouse

Subpages open on hover. Phones don't hover, and on a phone those pages can't be reached from the menu at all.

The phone number in the footer has no tel: link either. On the device that could actually call it, you can read the number and that's it.

9. alt="image"

Every image on the site has alt="image", and the accessibility audit is green. That audit checked that the attribute exists and stopped there.

10. The domain nobody owns

The domain expires, or the SSL certificate does, and only then does anyone ask whose account it's on.

One client's domain sat on my own account for a while. Handing it over took far more effort than it should have.

The same silence covers smaller things. The map on one site died when its API key expired, and nobody noticed. Somewhere there is a backup, too, and a restore has never been tested.

11. Me

I've sat looking at a green CI run while something on production was down.

I've also tested a contact form by sending it to my own inbox, watched the message arrive and called it done. At the client's end, the enquiries landed in spam. The only inbox that form ever worked for was mine.

That's eleven. Put your twelfth in the comments.

Top comments (0)