904 articles from web.dev.
When loading scripts, it takes time for the browser to evaluate them prior to execution, which can cause long tasks. Learn how script evaluation works, and what you can do to keep it from causing long tasks during page load.
How to securely display user-controlled content on web applications.
An insecure application could expose users and systems to various types of damage. When a malicious party uses vulnerabilities or lack of security features to their advantage to cause damage, it is called an attack. We'll take a look at different types of attacks in this guide so you know what to look for when securing your application.
This article lists the most important security headers you can use to protect your website. Use it to understand web-based security features, learn how to implement them on your website, and as a reference for when you need a reminder.
When the word "security" comes to mind, it's usually in the context of bad news. But security is something to be taken as a positive and necessary part of web development just like "user experience" or "accessibility".
Assistive technologies rely on developers using semantic HTML. But what are semantics, and how do screen readers use them?
Introduction to ARIA and non-native HTML semantics
Introduction to semantics and assistive technology
WebP images are smaller than their JPEG and PNG counterparts—usually on the magnitude of a 25–35% reduction in filesize. This decreases page sizes and improves performance.
Serving desktop-sized images to mobile devices can use 2–4x more data than needed. Instead of a "one-size-fits-all" approach to images, serve different image sizes to different devices.
The pros and cons of using consistent or different expiry logic across the service worker cache and HTTP cache layers.
A deep-dive into the service worker lifecycle.
Working with service workers is new and unfamiliar for many web devs. This post provides some tips for wrapping your mind around them.
The browser's HTTP cache is your first line of defense. It's not necessarily the most powerful or flexible approach, and you have limited control over the lifetime of cached responses. But there are several rules of thumb that give you a sensible caching implementation without much work, so you should always try to follow them.
Best practices for timing your service worker registration.
A payment transaction using Web Payments starts with the discovery of your payment app. Learn how to set up a payment method and get your payment app ready for merchants and customers to make payments.
Shadow DOM allows web developers to create compartmentalized DOM and CSS for web components
Use cross-platform browser features to build sign-in forms that are secure, accessible and easy to use.
Practical developer guidance about what to do when a user logs out of the website.
Help your users sign up, sign in and manage their account details with a minimum of fuss.
An SXG is a delivery mechanism that makes it possible to authenticate the origin of a resource independently of how it was delivered.
Learn how to serve signed exchanges (SXGs) using Web Packager.
Paint is the process of filling in pixels that eventually get composited to the users' screens. It is often the longest-running of all tasks in the pipeline, and one to avoid if at all possible.
Leverage A/B testing to evaluate the impact of site speed on your business metrics.
Learn about measuring animations, how to think about animation frames, and overall page smoothness.
Asking a user to provide a one-time password is a common way to confirm a user's identity. Learn best practices to build an SMS OTP form, with great user experience.
Starting in Chrome 81, scrollers remain snapped when the page layout changes. In other words, you no longer need to add event listeners to force resnapping.
You can influence the way your site appears when shared via social media by adding a few lines of code to each page. This can help bring more people to your site by providing previews with richer information than would otherwise be available.
Improve web debugging experience with source maps.
For Google I/O 2019, we introduced three new Web Performance initiatives that we hope will lead to better user experiences for everyone.
Read about the latest developments in speed tooling including new performance metrics, updates to PageSpeed Insights and Chrome User Experience Report (CrUX), and insights from Web Almanac analysis of the web ecosystem.
How To Think About Speed Tools
stale-while-revalidate helps developers balance between immediacy—loading cached content right away—and freshness—ensuring updates to the cached content are used in the future.
Compositing is where the painted parts of the page are put together for displaying on screen.
There are many different options for storing data in the browser. Which one is best for your needs?
The Streams API allows JavaScript to programmatically access streams of data received over the network and process them as desired.
Learn how to deploy a CSP based on script nonces or hashes as a defense-in-depth against cross-site scripting.
For the longest time, you had to resort to workarounds and libraries to create a deep copy of a JavaScript value. The Platform now ships with `structuredClone()`, a built-in function for deep-copying.
The focus indicator identifies the focused element. For users who can't or don't use a mouse, this indicator is extremely important, as it acts as a stand-in for their mouse-pointer.