Keeping critical sites online when traffic surges

Websites that provide essential information during the COVID-19 crisis are experiencing unprecedented demand. Many visitors are first-time or infrequent web users who rely on these sites for critical updates. To support these efforts, cross-functional teams within Google have compiled guidance on keeping core functionality available, accessible, secure, usable, discoverable, and fast under extreme load.

Prioritize availability under increased demand

Sudden traffic spikes can overwhelm infrastructure that was sized for normal conditions. Focus first on ensuring the site remains reachable, even if that means simplifying pages temporarily. Consider the following measures:

  • Use a content delivery network (CDN) or expand existing capacity to absorb additional requests.
  • Enable caching at every layer—CDN, server, and browser—to reduce origin load.
  • Identify and protect critical endpoints; non-essential requests can be deprioritized or served from cache.
  • Monitor error rates and latency continuously so degradation is detected before it becomes a full outage.

Static content such as CSS, JavaScript, and images should be served with long cache lifetimes. For dynamic content, introduce short cache times or use stale-while-revalidate patterns to keep responses fresh without hammering the backend.

Keep core journeys accessible to all users

Users arriving under stress may be on older devices, slower connections, or using assistive technologies. The most important content and tasks—finding a testing center, booking an appointment, reading official guidance—must work for them.

Audit the main user journeys and remove any unnecessary obstacles:

  • Verify that all functionality is operable via keyboard alone.
  • Ensure touch targets are large enough and spaced apart.
  • Maintain sufficient color contrast and avoid conveying information by color alone.
  • Provide text alternatives for non-text content, including icons and charts.

If third-party scripts or widgets add value but slow down or break the experience on low-end devices, consider deferring or removing them on critical pages until demand stabilizes.

Preserve security and trust under pressure

Security incidents and misinformation spread quickly during a crisis. HTTPS should be enforced throughout; any page that collects personal data must keep that data protected. Redirect HTTP requests to HTTPS and use HSTS where possible.

Be cautious when adding new features or content under time pressure. Every change should go through the same review process as before, focusing on input validation, output encoding, and protection against cross-site scripting. If forms are added for new services, ensure they include CSRF protection and do not leak sensitive data in URLs or logs.

Optimize for speed on constrained connections

On congested networks, every kilobyte matters. Reduce the size of critical resources:

  • Compress text-based assets with gzip or Brotli.
  • Serve images in modern formats (WebP or AVIF) at appropriate sizes.
  • Remove unused CSS and JavaScript; consider inlining above-the-fold critical CSS.
  • Preload essential fonts and use font-display: swap to avoid invisible text.

Minimize round trips by consolidating requests and using HTTP/2 or HTTP/3. Eliminate render-blocking resources on landing pages so users see meaningful content within a few seconds on 3G-class connections.

Make content discoverable and understandable

People search for and share official information under time pressure. Structured data helps search engines surface your content in rich results:

  • Use Article, FAQPage, or SpecialAnnouncement schema markup where appropriate.
  • Keep titles and headings descriptive and concise.
  • Write in plain language; avoid jargon and unexplained acronyms.
  • Include publication dates and update markers so users know information is current.

If you publish a frequently asked questions page, match the text of each question to the language users are likely to search with. Clear, direct answers improve both usability and discoverability.

Plan for ongoing operation under load

Capacity planning should assume sustained elevated traffic rather than a short spike. Establish procedures for:

  • Rolling back recent changes that introduce regressions.
  • Scaling infrastructure horizontally where the application supports it.
  • Gracefully degrading non-critical features when resources are constrained.
  • Communicating status internally and externally when incidents occur.

Run regular load tests against representative user journeys, not just synthetic requests. Measure performance with field data from real users and make adjustments based on observed bottlenecks. Document a response plan so team members know their roles before an unexpected surge occurs.

Keeping Core Functions Up Under Load

When traffic spikes threaten availability, quick fixes and early detection matter. Start by reviewing your server health and learn how to identify, mitigate, and prevent overload issues. From there, reduce demands on your infrastructure:

  • Strip unnecessary images, videos, scripts, and fonts so each page focuses only on the functionality users actually need.
  • Optimize images to cut bandwidth usage since they remain the primary source of bloat on the web.
  • Move static content to a CDN. Providers like AWS, Azure, Cloudflare, Google Cloud, and Firebase offer documentation for setup. Check whether your CDN supports easy optimizations like dynamic image compression, text compression, or automatic minification of JS and CSS.
  • Improve HTTP caching to reduce server load with minimal code changes. The Lighthouse audit "Serve static assets with an efficient cache policy" helps detect resources with poor caching. Remember that different resource types need different freshness and caching strategies.
  • Consider service workers to cut server demand further, though this requires more technical investment. Workbox is the recommended approach because it automates boilerplate and avoids common pitfalls of using the low-level ServiceWorker API directly. Service workers also enable offline access, useful for showing hours, contact information, and other essentials with no connection.
  • Check DDoS protection if usage has jumped significantly, since high-profile sites can become targets. AWS, Azure, Cloudflare, and Google Cloud all publish mitigation guidance.

Auditing Accessibility

More people with diverse needs are likely reaching your site. Accessibility is a team effort—review guides from Google and the U.S. Digital Service that break down what product managers, engineers, designers, and QA can contribute. Then assess your current state:

  • Perform an accessibility review with WAVE browser extensions to guide manual audits.
  • Study the accessibility guides to understand keyboard navigation and screen reader support.
  • Run a Lighthouse audit for common issues and manual checks. A perfect score doesn't guarantee full accessibility; many important problems require human judgment. WAVE API and the AXE extension add further automated checks.
  • Take a structured course, such as "Start Building Accessible Web Applications Today" on egghead.io or Udacity's Web Accessibility course.
  • Browse the A11ycast playlist on YouTube for quick topic-specific tips.

Security and Privacy Under Pressure

Speeding up fixes can lead to shortcuts that open security holes. Users may be seeking very private information, and protecting that data must not waver. Understand why HTTPS is necessary for all sites, not just those handling sensitive personal data. If your hosting provider doesn't enable HTTPS by default, use Let's Encrypt or similar services to add it. Review how SameSite cookies work to make their use more secure; enforcement of SameSite labeling was temporarily rolled back, so confirm current behavior.

Usability for Newer Users

A portion of your visitors may be relying on the web in new ways, sometimes for basic needs. Some of them are not habitual web users. Audit your core functionality for simplicity:

  • Add a dismissible banner (X button) at the top of the site to communicate service updates clearly, with a call-to-action pointing to resources. Use distinct colors and fonts that stand out from page content, and keep the tone empathetic and transparent.
  • Review your critical user journeys (CUJs) to minimize physical interactions, and propose changes to product teams. For example, look for workarounds when a delivery signature is normally required.
  • Verify CUJs are simple and intuitive and suggest improvements where you see friction.
  • Apply principles of good mobile design and test CUJs on various devices. People who rarely used the web before are likely accessing from mobile.
  • Use responsive design patterns wherever possible and make sure forms are efficient and well-structured.

Search Visibility for Time-Sensitive Information

Discoverability is critical for health and employment information. Lighthouse SEO audits catch basic issues. Engine blogs from Google, Bing, Baidu, DuckDuckGo, and Yandex carry updates; several COVID-19-era posts remain relevant, including how to change online activities without harming Search presence, new schema markup for virtual/canceled events, structured data for COVID-19 announcements, and best practices for health and government sites.

Faster Load Times as a Countermeasure

Home internet use has surged, and some ISPs have struggled with increased demand. Pages can slow down through no fault of your site. Sending fewer bytes can offset reduced bandwidth:

  • Images are the web's biggest bloat factor; optimizing them reduces bandwidth sharply. Squoosh offers simple, open-source compression.
  • Run WebPageTest or Lighthouse to find the biggest performance wins.
  • Enable text compression for an easy, low-effort gain that shrinks network transfer sizes.
  • Learn how to fix website speed cross-functionally to get department buy-in.
  • Use standardized lazy-loading for images to minimize requests for off-screen pictures. Browser support isn't universal, but treat it as progressive enhancement—loading behaves normally where unsupported.
  • A/B testing and personalization scripts often block rendering when they must run before content loads. Check whether any non-critical parts can load asynchronously, balancing script essentials against page load speed via the Critical Rendering Path.
  • Third-party code accounts for around half of all requests on most sites. Optimize or temporarily disable anything not essential to site operation.
  • With fewer feature releases scheduled, use the time to remove dead weight: purge unused tags in managers, clean up bloated CSS and JS, and delete deprecated features. Chrome DevTools' Coverage tab and Puppeteer's Coverage class detect unused code.