Technical review of the current website

CriticalEntrance animations hide the content people came to see

24 elements on the homepage start invisible (elementor-invisible) and only appear once Elementor’s JavaScript has loaded and run. The page’s Largest Contentful Paint is a paragraph of text, delayed to 10.4 s on mobile (Dine: 11.4 s). Google treats anything over 4 s as “poor”, and it feeds into search ranking through Core Web Vitals.

Fix: Animations should only enhance content that is already visible. Never gate above-the-fold text on JavaScript, and respect “reduced motion”. The redesign uses a ~2 KB script that only animates content below the fold.

CriticalThe booking engine downloads ~1.6 MB on every page view

The Mews Distributor is initialised on page load, so every visitor downloads its app (764 KB), globalisation data (453 KB) and translations (339 KB). It also contacts LaunchDarkly and Sentry, sets third-party cookies and uses deprecated browser APIs. That is about 45% of the homepage’s weight, for a widget most visitors never open.

Fix: Load Mews on the first click of a “Book” button, with the hosted Mews booking page as a fallback link. This is implemented and tested in all three previews.

HighGoogle tracking is loaded several times over

Google Tag Manager (GTM-K55BBRRV) and Site Kit’s own gtag (G-790J0XMF8B) both run. The homepage loads gtag/js five times plus gtm.js, around 800 KB of tracking script, most of it unused (Lighthouse: ~320 KB of unused gtag code alone).

Fix: Choose one route, ideally GTM with Consent Mode v2, and turn off Site Kit’s tag output. Audit the GTM container for duplicate GA4/Ads tags.

HighPage-builder overhead on every page

Each page loads 54–57 stylesheets and 21 external scripts plus 23 inline ones. The HTML document alone is 240–290 KB, with 256 Elementor wrapper elements on the homepage. It pulls in jQuery and jQuery Migrate, plus two icon fonts (eicons 106 KB, Font Awesome 77 KB) for a handful of icons. Five layout plugins stack up: Elementor, Elementor Pro, Essential Addons, Header Footer Elementor and the Astra theme. Main-thread work is 3.4 s.

Fix: A native block theme removes this layer entirely. The previews use one inlined stylesheet, one ~2 KB script and SVG icons.

HighOversized images

The media library holds originals of up to 11.6 MB (e.g. MG_6181.webp, MG_6132.webp). The Dine page loads an 829 KB hero image. The AA badges are served as 768 px PNGs (60 KB and 44 KB) to display at about 64 px, and are not lazy-loaded.

Fix: Cap uploads at about 2,560 px, serve AVIF/WebP with srcset, and size badges correctly. Badges can be about 6 KB each.

MediumSlow server response and weak caching

The homepage HTML took 1.05 s to start arriving (time to first byte), and the CDN reported the page as EXPIRED/MISS. Lighthouse flags 100 resources with short cache lifetimes, including fonts and Elementor scripts that never change between visits.

Fix: Enable full-page caching for anonymous visitors, set long Cache-Control lifetimes on versioned static assets, and check that the host’s edge cache is actually serving the HTML.

HighText that is too faint to read

10–12 headings fail colour contrast; the worst measures 1.89:1 against a minimum of 4.5:1 (3:1 for large text). These are the small grey/sage subheadings over light backgrounds.

Fix: Darken the text colours. All three redesigns pass AA contrast throughout.

HighGallery images that read as unlabelled links

11 gallery lightbox links have no accessible name, and their images carry empty aria-labels. A screen-reader user hears “link” eleven times with nothing to say where it goes.

Fix: Give each gallery image meaningful alt text and the link an accessible name.

High“Book your stay” buttons aren’t real links

The booking buttons point to href="#" and rely on script. They can’t be opened in a new tab or shared, and do nothing if Mews fails to load. There are also no tel: or mailto: links on the homepage, so the phone number can’t be tapped to call.

Fix: Use the real Mews booking URL as the link target and enhance it with the overlay, and make the phone number and email tappable links.

MediumMissing alternative text and confusing headings

14 of 31 images on the homepage, and 19 of 31 on Weddings, have no alt text. Every page has two <h1>s (e.g. “Restaurant & Dining” and “hexham”); the homepage H1 is “beaumont Hotel”. Heading levels skip (h2 → h4). The booking iframe has no title.

Fix: One descriptive H1 per page, sequential headings, alt text on informative images (empty alt only for decoration), and a title on iframes.

HighUnfinished and duplicate pages are live and indexed

Three pages are published, set to index, follow, and listed in the XML sitemap Google reads:

• /test/: Lorem ipsum, with “Lorem ipsum…” as its meta description
• /home-copy/: a duplicate of the homepage
• /weddings-2025/: a near-duplicate of Weddings

Duplicates split ranking signals, and a Lorem-ipsum page in search results looks careless.

Fix: Unpublish or delete all three, and 301-redirect /home-copy/ → / and /weddings-2025/ → /weddings/. Then request removal in Search Console.

HighStructured data describes a blog post, not a hotel

The homepage’s schema declares Article, Person and WebPage. There is no Hotel, LocalBusiness or Restaurant markup, so Google gets no machine-readable address, star rating, opening hours or reservations information. That information powers map packs and rich results for “hotel in Hexham” searches.

Fix: Add Hotel schema (with address, star rating, amenities) and a nested Restaurant (opening hours, reservations). The previews include this.

MediumWeak homepage title, heading and social preview

The homepage title is just “The Beaumont Hotel – Hexham”, which misses search terms like “boutique hotel”, “restaurant” and “Northumberland”. The H1 is “beaumont Hotel”. There’s no og:image, so links shared on Facebook, WhatsApp or Messages appear without a picture.

Fix: Write a descriptive title (e.g. “The Beaumont – Boutique Hotel & Restaurant in Hexham, Northumberland”), a real H1, and set a share image.

MediumNo security headers

None of the standard protective headers are sent: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options/frame-ancestors, X-Content-Type-Options, Referrer-Policy and Permissions-Policy. This leaves the site open to clickjacking and weakens HTTPS enforcement.

Fix: Add them at the host or CDN. HSTS, nosniff, Referrer-Policy and frame-ancestors are low-risk to enable immediately; build the CSP up gradually because of the third-party scripts.

MediumSoftware versions are advertised

Responses include X-Powered-By: PHP/8.3.35, the page source carries generator tags for WordPress 7.1.3, Site Kit 1.189.0 and Elementor 4.3.5, and /readme.html is public. None of this is a vulnerability in itself, but it saves an attacker a step when a plugin flaw is announced.

Fix: Strip X-Powered-By and the generator tags, and block readme.html and license.txt.

MediumA large plugin footprint, including AI/MCP endpoints

The public REST API exposes 723 routes. Plugins in use include:

• Elementor, Elementor Pro, the Elementor AI and Elementor “One” add-ons, and the Elementor MCP Composer
• A separate mcp endpoint
• All-in-One WP Migration, One Time Login, Envato Elements and an NPS survey plugin
• Jetpack, Jetpack Boost and Site Kit, alongside Rank Math
• Contact Form 7, CookieYes, Wordfence and Limit Login Attempts

Each plugin is something to update and a possible attack surface. The MCP/AI endpoints in particular let external tools act on the site, so they should be confirmed as authenticated-only and actually needed in production.

Fix: Remove migration, one-time-login, Envato and survey plugins from production. Consolidate overlapping SEO/performance plugins. Review the MCP endpoints, and keep everything updated with a staging site for testing.

MediumAnalytics appears to load before consent

On a fresh visit, with the CookieYes banner untouched, the browser contacted google-analytics.com, stats.g.doubleclick.net and ad.doubleclick.net, and Mews set third-party cookies. No Consent Mode default appears in the page source. This may be handled inside GTM, since Consent Mode can send cookieless pings, but it should be checked against UK GDPR and PECR.

Fix: Confirm that CookieYes and GTM Consent Mode v2 are wired together, so analytics and ads tags wait for consent and Mews loads only when someone books.