# Response compression is enabled

- **Pattern:** `ab-002536` (`site-health-check.performance-signals.compression-enabled`)
- **Severity:** high
- **Lifecycle:** active
- **Last modified:** 2026-04-18
- **Canonical URL:** https://auditbuffet.com/patterns/ab-002536
- **License:** CC-BY-4.0 — attribute to AuditBuffet Pattern Catalog (https://auditbuffet.com/patterns/ab-002536)

## Why it matters

Uncompressed HTML, CSS, and JavaScript responses force users to download 3–5x more bytes than necessary. For a 200 KB uncompressed page, enabling Brotli or gzip typically reduces transfer to 40–80 KB — a direct reduction in time-to-interactive, especially on mobile connections. ISO 25010 performance-efficiency is directly impacted: slow load times increase bounce rate, hurt Core Web Vitals scores, and degrade SEO rankings. Compression is a server-side toggle that costs negligible CPU and delivers guaranteed bandwidth savings. Its absence signals misconfigured infrastructure rather than an intentional choice.

## Severity rationale

High because missing compression directly increases page load time by 3–5x for text assets, with measurable impact on Core Web Vitals, bounce rate, and SEO rankings on every page load.

## Remediation

Enable Brotli or gzip compression at your server or CDN. On nginx:

```nginx
gzip on;
gzip_comp_level 6;
gzip_types text/html text/css application/javascript application/json image/svg+xml;
```

For Brotli (nginx with `ngx_brotli` module):

```nginx
brotli on;
brotli_comp_level 6;
brotli_types text/html text/css application/javascript;
```

On Vercel and Netlify, compression is enabled automatically — no action needed. For Express, add the `compression` middleware:

```js
import compression from 'compression';
app.use(compression());
```

Verify: `curl -sI -H 'Accept-Encoding: gzip, br' https://yoursite.com | grep -i content-encoding`.

## Detection

- **ID:** `compression-enabled`
- **Severity:** `high`
- **What to look for:** Extract the `Content-Encoding` header from the final response. Count the compression-related headers present (`Content-Encoding`, `Transfer-Encoding`, `Vary: Accept-Encoding`). The `Content-Encoding` value must be one of the 3 accepted compression algorithms: `gzip`, `br` (Brotli), or `deflate`. Also note the `Content-Length` or `size_download` value from the curl metrics to provide size context.
- **Pass criteria:** `Content-Encoding` header is present in the final response with a value of `gzip`, `br`, or `deflate`. The header must appear on the HTML document response (not just on static assets). Report the compression algorithm and download size in bytes.
- **Fail criteria:** No `Content-Encoding` header on the final response, or the value is `identity` (explicitly uncompressed), or the header is absent entirely.
- **Skip (N/A) when:** The response body is smaller than 1024 bytes (1 KB), as compression provides negligible benefit for very small responses.
- **Detail on fail:** `"No Content-Encoding header — response is not compressed"`
- **Remediation:** Compression reduces transfer size by 60-80%, significantly improving load times. Enable it at the server or CDN level:

  ```
  # nginx
  gzip on;
  gzip_types text/html text/css application/javascript application/json;
  ```

  On Vercel and Netlify, compression is enabled by default. For Express: `app.use(compression())` using the `compression` npm package. Verify with: `curl -sI -H 'Accept-Encoding: gzip, br' {URL} | grep -i content-encoding`

## External references

- iso-25010 performance-efficiency.time-behaviour

Taxons: performance

HTML version: https://auditbuffet.com/patterns/ab-002536