1. Legacy Windows Authentication Protocols

• Kerberos and NTLM Authentication: Many applications and services, including group policies and user profile management, rely on Kerberos and NTLM protocols, which require AD DS. Entra ID does not natively support these legacy protocols.
• Group Policies: AVD VMs often require group policy objects (GPOs) for centralized management, which are a core feature of AD DS. GPOs allow for detailed management and configuration of Windows settings, security policies, software deployment, and more.

2. Session Host Compatibility

• Remote Desktop Protocol (RDP): Azure Virtual Desktops are built on Remote Desktop Session Hosts (RDSH), which require domain-joined VMs to enforce user identity management, profile management, and access policies within a Windows Server domain. The integration with AD DS provides compatibility with these traditional Windows components.
• Profile and Application Management: User profiles, roaming profiles, and folder redirection are often required in multi-session environments like AVD. These mechanisms generally depend on AD DS to manage access to resources such as file shares.

3. Hybrid Identity Scenarios

• Hybrid Identity Integration: Many organizations use hybrid identity solutions, where their on-premises Active Directory is synchronized with Entra ID using tools like Azure AD Connect. Domain-joining the AVD VMs to AD DS ensures that users can seamlessly access both on-premises and cloud-based resources, such as file shares and printers, using the same set of credentials.
• Seamless SSO: AD DS provides single sign-on (SSO) across many applications and services that may still rely on traditional AD authentication mechanisms. Entra ID, by itself, is not designed to manage these older systems, making AD DS necessary for environments with legacy needs.

4. Application Compatibility

• Legacy Applications: Many line-of-business applications used in enterprise environments may require AD DS for authentication and directory services. These applications might not be compatible with Entra ID due to their reliance on on-premises directory services, Kerberos, or NTLM.
• Application and Resource Access: Domain-joining ensures that AVD VMs can interact with legacy applications that require AD DS-based authentication or access control, ensuring full compatibility with existing infrastructures.

Why Entra ID Alone Can’t Fully Replace AD DS (Yet)

While Entra ID offers modern identity management features such as conditional access, Multi-Factor Authentication (MFA), and cloud-based directory services, it doesn’t yet provide full support for some legacy protocols and services. Microsoft Entra ID (Azure AD) is designed as a cloud-based identity platform that focuses on modern authentication protocols (such as OAuth2 and OpenID Connect) and doesn’t natively support older technologies such as:

• Kerberos and NTLM
• Group Policy Management
• LDAP-based authentication for many applications

Additionally, many enterprises still rely on hybrid environments where on-premises Active Directory and cloud-based Entra ID work together, making the need for AD DS domain-joining necessary for full compatibility.

Looking Forward: Azure AD Join and Azure AD DS

• Azure AD Join: In some modern scenarios, Microsoft has enabled support for Azure AD-joined VMs for single-session (personal) desktops. This removes the need for traditional AD DS in certain use cases where only modern cloud-native services are required.
• Azure AD DS (Azure Active Directory Domain Services): Azure AD DS offers a managed domain in the cloud, which mimics many of the traditional AD DS features. This is helpful for organizations looking to migrate away from on-premises AD DS while maintaining support for legacy protocols and applications.

However, while Azure AD Join and Azure AD DS are improving, for multi-session desktops (which is common in AVD scenarios), a full AD DS domain join is still often necessary to ensure compatibility and full functionality.

Conclusion

Azure Virtual Desktop VMs need to domain-join AD DS primarily to support legacy Windows authentication protocols (like Kerberos and NTLM), group policies, and legacy applications that rely on AD DS. While Entra ID provides modern identity management and supports certain newer cloud-based features, it doesn’t fully replace the traditional Active Directory infrastructure in hybrid or legacy environments yet, especially for multi-session virtual desktops.

Overview of the Vulnerabilities

The vulnerabilities identified in Ubiquiti’s cameras and routers primarily relate to two significant issues: amplification attacks and privacy risks. These vulnerabilities are present in various models of Ubiquiti’s UniFi cameras and routers, which are widely used in both residential and commercial settings.

Amplification Attacks

Amplification attacks exploit the inherent design of certain network protocols to increase the volume of traffic sent to a target, overwhelming it and causing a denial of service (DoS). In the context of Ubiquiti devices, these attacks leverage the Ubiquiti Discovery Protocol (UDP 10001), which allows unauthenticated requests to be amplified significantly, creating a substantial threat.

Privacy Risks

Privacy risks associated with these vulnerabilities stem from the ability of attackers to gain unauthorized access to sensitive information. Ubiquiti cameras, designed for surveillance and security, can be turned into tools for espionage if compromised. Attackers can potentially access live feeds, recorded footage, and other personal data, posing a significant threat to user privacy.

Detailed Analysis of Amplification Attacks

Amplification attacks are a form of Distributed Denial of Service (DDoS) attack, where attackers exploit vulnerabilities in network protocols to amplify the volume of traffic directed at a target. This section provides a detailed analysis of how these attacks are executed and their implications for Ubiquiti users.

How Amplification Attacks Work

Amplification attacks involve sending a small amount of data to a vulnerable server, which then responds with a much larger amount of data to the victim’s IP address. This results in a flood of traffic that can overwhelm the victim’s network, rendering it inoperable.

1. Initiation: The attacker sends a request to a vulnerable Ubiquiti device using the Ubiquiti Discovery Protocol. This request is typically small but crafted to solicit a large response.
2. Amplification: The Ubiquiti device responds with a much larger packet of data. The amplification factor can be significant, with some cases resulting in a response that is 30 to 50 times larger than the original request.
3. Impact: The amplified traffic is directed towards the target, causing network congestion, service disruption, and potential outages.

Ubiquiti’s Vulnerable Protocol

The Ubiquiti Discovery Protocol (UDP 10001) is intended for device discovery and management. However, its lack of authentication and rate limiting makes it susceptible to abuse in amplification attacks.

• Lack of Authentication: The protocol does not require authentication, allowing attackers to send requests without verifying their identity.
• Absence of Rate Limiting: The protocol does not impose restrictions on the number of requests that can be sent, enabling attackers to flood the network with traffic.
• High Amplification Factor: The protocol’s design allows for a high amplification factor, making it an attractive target for attackers seeking to maximise their impact.

Real-World Implications

The vulnerabilities in Ubiquiti devices have real-world implications for users and organisations:

• Denial of Service: Amplification attacks can result in prolonged service disruptions, affecting business operations and critical infrastructure.
• Network Congestion: The increased traffic can lead to network congestion, affecting the performance of other devices and services.
• Financial Losses: Businesses may incur significant financial losses due to downtime, lost productivity, and the cost of mitigating attacks.

Privacy Risks and Exploitation

In addition to amplification attacks, Ubiquiti devices are also vulnerable to privacy risks. Attackers can exploit these vulnerabilities to gain unauthorized access to sensitive information, compromising user privacy and security.

Unauthorized Access to Camera Feeds

Ubiquiti cameras are designed for security and surveillance, providing users with live feeds and recorded footage. However, vulnerabilities in these devices can allow attackers to access camera feeds without authorization.

• Live Feed Access: Attackers can potentially gain access to live camera feeds, allowing them to monitor user activities in real-time.
• Recorded Footage: Access to recorded footage poses a significant privacy risk, as attackers can view and download sensitive content.
• Privacy Violations: Unauthorized access to camera feeds can result in severe privacy violations, particularly in residential settings where cameras are used for home security.

Data Theft and Espionage

The vulnerabilities in Ubiquiti devices can also facilitate data theft and espionage, posing a significant threat to users and organisations.

• Personal Data Theft: Attackers can access personal data stored on Ubiquiti devices, including user credentials, network configurations, and other sensitive information.
• Corporate Espionage: In commercial settings, attackers can exploit vulnerabilities to gain access to confidential business information, facilitating corporate espionage.
• National Security Risks: In critical infrastructure settings, compromised Ubiquiti devices can pose national security risks, allowing attackers to gain access to sensitive information and systems.

Vulnerability Discovery and Reporting

The discovery of these vulnerabilities in Ubiquiti devices highlights the importance of ongoing security research and responsible vulnerability reporting. This section provides an overview of how these vulnerabilities were discovered and the steps taken to address them.

Research and Discovery

The vulnerabilities in Ubiquiti devices were identified by security researchers who conducted extensive analysis and testing. These researchers utilised various methods to identify and exploit weaknesses in the devices, ultimately uncovering the amplification and privacy risks.

• Network Analysis: Researchers analysed network traffic to identify patterns and anomalies that could indicate vulnerabilities.
• Protocol Inspection: By examining the Ubiquiti Discovery Protocol, researchers identified weaknesses in its design and implementation.
• Exploit Testing: Researchers conducted controlled exploit tests to determine the feasibility and impact of potential attacks.

Responsible Disclosure

Upon discovering the vulnerabilities, researchers followed responsible disclosure practices to ensure that Ubiquiti was informed of the issues and given an opportunity to address them before public disclosure.

• Notification: Researchers notified Ubiquiti of the vulnerabilities, providing detailed information and recommendations for remediation.
• Collaboration: Researchers collaborated with Ubiquiti to develop and test patches and updates to mitigate the vulnerabilities.
• Public Disclosure: After Ubiquiti released patches and updates, researchers publicly disclosed the vulnerabilities to raise awareness and encourage users to apply the fixes.

Ubiquiti’s Response

In response to the discovered vulnerabilities, Ubiquiti took several steps to address the issues and protect users.

• Patches and Updates: Ubiquiti released patches and firmware updates to address the vulnerabilities and enhance the security of affected devices.
• User Education: Ubiquiti provided guidance and resources to help users understand the vulnerabilities and implement security measures.
• Ongoing Security Efforts: Ubiquiti committed to ongoing security efforts, including regular vulnerability assessments and improvements to its security practices.

Mitigation Strategies and Best Practices

To protect against amplification attacks and privacy risks, users of Ubiquiti devices are encouraged to implement the following mitigation strategies and best practices.

Applying Patches and Updates

One of the most effective ways to mitigate vulnerabilities in Ubiquiti devices is to apply patches and firmware updates provided by Ubiquiti.

• Regular Updates: Users should regularly check for and apply updates to ensure their devices are protected against known vulnerabilities.
• Automatic Updates: Enabling automatic updates can help ensure that devices receive the latest security patches as soon as they are available.
• Verification: After applying updates, users should verify that the devices are functioning correctly and that the vulnerabilities have been addressed.

Network Security Measures

In addition to applying patches and updates, users can implement network security measures to protect against attacks.

• Firewall Configuration: Configuring firewalls to block unauthorized access and restrict traffic can help prevent attacks.
• Intrusion Detection Systems: Implementing intrusion detection systems can help identify and mitigate potential threats in real-time.
• Network Segmentation: Segregating networks can help contain attacks and prevent the spread of malicious traffic.

Device Configuration and Hardening

Proper configuration and hardening of Ubiquiti devices can significantly reduce the risk of exploitation.

• Disable Unused Services: Disabling unused services and protocols can reduce the attack surface and limit opportunities for exploitation.
• Authentication and Encryption: Implementing strong authentication and encryption mechanisms can help protect against unauthorized access.
• Regular Audits: Conducting regular audits and assessments of device configurations can help identify and address potential vulnerabilities.

User Awareness and Training

User awareness and training are critical components of a comprehensive security strategy.

• Security Awareness Training: Providing security awareness training to users can help them recognise potential threats and adopt secure practices.
• Phishing Prevention: Educating users about phishing attacks can help prevent social engineering attacks that target user credentials.
• Incident Response: Establishing an incident response plan can help organisations respond effectively to security incidents and minimize their impact.

Future Considerations and Recommendations

The discovery of vulnerabilities in Ubiquiti devices underscores the

importance of continuous improvement in security practices and the need for proactive measures to protect against evolving threats. This section outlines future considerations and recommendations for Ubiquiti, users, and the broader security community.

Ubiquiti’s Role in Enhancing Security

As a leading provider of networking solutions, Ubiquiti has a responsibility to prioritise security and ensure that its products are safe and reliable.

• Security by Design: Ubiquiti should adopt a security-by-design approach, integrating security considerations into the development process from the outset.
• Regular Vulnerability Assessments: Conducting regular vulnerability assessments can help identify and address potential security issues before they are exploited.
• User Collaboration: Ubiquiti should collaborate with users and the security community to gather feedback and improve security practices.

User Responsibility and Best Practices

Users also have a role to play in ensuring the security of their devices and networks.

• Proactive Security Measures: Users should adopt proactive security measures, including regular updates, network security practices, and device configuration.
• Vulnerability Reporting: Reporting potential vulnerabilities to Ubiquiti and other vendors can help improve security and protect against emerging threats.
• Community Engagement: Engaging with the security community can provide users with valuable insights and resources for improving their security posture.

The Role of the Security Community

The security community plays a crucial role in identifying and addressing vulnerabilities, and its efforts should be supported and encouraged.

• Collaborative Research: Collaboration between researchers, vendors, and users can lead to more effective vulnerability discovery and mitigation efforts.
• Responsible Disclosure Practices: Following responsible disclosure practices ensures that vulnerabilities are addressed before they are exploited.
• Security Awareness and Education: Promoting security awareness and education can help users and organisations better understand and mitigate security risks.

Conclusion

The vulnerabilities discovered in Ubiquiti cameras and routers highlight the ongoing challenges in securing network devices and the importance of proactive measures to protect against amplification attacks and privacy risks. By understanding the nature of these vulnerabilities and implementing appropriate security measures, users can significantly reduce their risk and protect their networks and data.

Ubiquiti’s response to these vulnerabilities demonstrates the importance of collaboration between vendors, researchers, and users in addressing security challenges. By continuing to prioritise security and adopt best practices, Ubiquiti and its users can work together to enhance the safety and reliability of their products and networks.

In a rapidly evolving threat landscape, vigilance and proactive measures are essential to protect against emerging threats and ensure the security and privacy of users worldwide.

We, therefore, decided it was important to upgrade to new hardware and, ideally, upgrade the OS to a newer version of Windows. Doing an OS upgrade in a live environment is a bad idea, and we wanted to avoid rebooting at all or taking down the client sites during maintenance.

To image a Windows Server while running in a live environment (i.e., without rebooting into a live USB or CD) requires specialised software that can handle disk imaging without interrupting the server’s operations. There are several free tools available that meet these criteria and offer features like automatic uploading to FTP or saving via SMB network shares. Below, I will recommend some suitable software and provide a step-by-step guide on how to use them.

Recommended Software

There are several applications you can use to image a Windows server.

1. Disk2vhd

• Description: Disk2vhd is a free utility from Microsoft’s Sysinternals Suite that allows you to create VHD (Virtual Hard Disk) images of your Windows environment while the system is running.
• Pros: Lightweight, easy to use, no downtime required.
• Cons: Creates VHD instead of ISO, but can be converted to ISO if needed.

2. Win32 Disk Imager

• Description: Win32 Disk Imager is a tool primarily used for writing images to USB devices but can be used to create raw disk images.
• Pros: Simple interface, creates raw disk images.
• Cons: Requires additional steps to convert to ISO.

3. AOMEI Backupper

• Description: AOMEI Backupper is a free backup and cloning tool that supports creating disk images in a live environment.
• Pros: User-friendly interface, supports network shares for saving images.
• Cons: Requires a conversion tool for ISO creation.

4. DriveImage XML

• Description: DriveImage XML is a free imaging and backup solution that supports live imaging of Windows systems.
• Pros: Simple to use, supports network destinations.
• Cons: Does not directly create ISO files.

Step-by-Step Guide Using Disk2vhd

Here’s a detailed guide on using Disk2vhd to create a VHD image, convert it to ISO, and upload it to an FTP or SMB network share.

Step 1: Download and Install Disk2vhd

1. Download Disk2vhd: Download the executable from the official site.
2. Run the Program: Since Disk2vhd is portable, you don’t need to install it. Simply run the executable.

Step 2: Create a VHD Image

1. Select Volumes: Open Disk2vhd and select the volumes you want to include in the VHD image. Ensure that you select the system partition (usually C:) and any other partitions relevant to your server.
2. Destination Path: Choose a destination path for the VHD file. This should be a location with enough space to store the complete image.
3. VHDX Option: You can choose to create a VHDX file for larger disk support and better resilience (VHDX is a newer format supported by Hyper-V).
4. Create the Image: Click “Create” to start the imaging process. Disk2vhd will work in the background, allowing you to continue using the server.

Optional Step 3: Convert VHD to ISO

VHD images are designed to work with Microsoft Hyper V, but when hosting using virtualisation, we use Proxmox, so you will want to convert the image to an ISO.

After creating the VHD image, you’ll need to convert it to an ISO file using a tool like OSFMount and ImgBurn.

Step 3.1: Mount VHD using OSFMount

1. Download OSFMount: Get OSFMount from OSFMount’s website.
2. Mount VHD: Use OSFMount to mount the VHD file as a virtual drive.
3. Check Drive Contents: Ensure the mounted drive appears correctly and contains all expected data.

Step 3.2: Convert to ISO with ImgBurn

1. Download ImgBurn: Install ImgBurn from ImgBurn’s website.
2. Create ISO: Open ImgBurn and select Create image file from files/folders.
3. Select Source: Use the mounted VHD as the source for the ISO file.
4. Choose Destination: Specify the location to save the ISO file.
5. Build ISO: Click the “Build” button to create the ISO file from the VHD.

Step 4: Upload ISO to FTP/SMB

You can automate the upload of the ISO file to FTP or SMB network shares using built-in Windows features or third-party tools like WinSCP.

Step 4.1: Upload to FTP

1. Download WinSCP: Get WinSCP from WinSCP’s website.
2. Create a Script: Create a WinSCP script for automated upload.

   open ftp://username:password@ftpserver.com
   put C:\Path\To\Your\ISO.iso /remote/path/
   exit

3. Schedule Task: Use Task Scheduler to run the WinSCP script after the ISO creation.

• Open Task Scheduler.
• Create a new task and set the trigger to start after Disk2vhd completes.
• Set the action to run the WinSCP script.

Step 4.2: Upload to SMB

1. Use Command Line: Use net use command to map the SMB share and copy the file.

   net use \\server\share /user:username password
   xcopy C:\Path\To\Your\ISO.iso \\server\share\
   net use \\server\share /delete

2. Automate with Batch Script: Save the above commands in a .bat file and schedule it using Task Scheduler, similar to the FTP upload process.

Step 5: Verify ISO Integrity

After the upload, verify the ISO file’s integrity to ensure it was created and transferred correctly. You can use tools like HashTab to compare hash values.

Conclusion

Using Disk2vhd allows you to create a VHD image of your live Windows Server environment without downtime. The process involves creating a VHD, converting it to ISO, and automatically uploading it to FTP or SMB network shares using scripts and Task Scheduler. This method is efficient for backing up or migrating server environments without interrupting services.

If you prefer a more graphical interface or additional features like differential backups, consider AOMEI Backupper Standard or DriveImage XML, although they may require extra steps for ISO creation.

Can Google Groups Be Indexed?

Yes, content on public Google Groups can be indexed by search engines. This includes discussions, posts, and any publicly visible information. As with any web content, the presence of relevant keywords and valuable information can contribute to its visibility in search engine results. However, it’s important to note the following:

1. Quality of Content: Search engines prioritize high-quality, valuable content. Simply posting in Google Groups with the intention of improving SEO may not be effective if the content is not informative or engaging.
2. Link Value: While you can include links in your Google Group posts, the SEO value of these links is typically limited. Search engines like Google are sophisticated enough to recognize the nature of these links and may not give them the same weight as links from more authoritative sources.

Using Google Groups for SEO:

1. Community Engagement: Google Groups can be a platform to engage with a community that’s relevant to your niche. This engagement can increase your visibility and authority in the subject area.
2. Content Ideas and Keywords: Discussions in Google Groups can provide insights into what your target audience is interested in, helping you generate content ideas and identify potential keywords for your website or blog.
3. Backlink Opportunities: While directly posted links might not carry significant weight, engaging in meaningful conversations can lead to natural backlink opportunities if members reference your content elsewhere.
4. Brand Visibility: Active participation in relevant groups can enhance your brand’s visibility and reputation, indirectly benefiting your SEO efforts.

Best Practices:

• Provide Value: Always aim to contribute valuable insights and information to the group, rather than just promoting your content.
• Avoid Spamming: Do not spam groups with links to your website. This practice is frowned upon and can harm your reputation.
• Follow Group Rules: Adhere to the guidelines and rules of each group to maintain a positive standing within the community.

Conclusion:

While Google Groups can be indexed and potentially rank for content, using them directly for SEO purposes requires a nuanced approach. The primary focus should be on community engagement, information sharing, and building authority in your subject area. Direct SEO benefits, such as link building, are more likely to be indirect and should not be the sole reason for participating in these groups.

Key Features of Google Groups:

1. Email-based Group Discussions: Allows users to create and manage email lists. Members can send and receive messages via email, with the option to view and respond to these messages online as well.
2. Web Forum Interface: Offers a forum-style interface for online discussions, enabling threaded conversations that are easy to follow.
3. Collaboration and Sharing: Integrates with other Google services like Google Drive, Calendar, and Docs, facilitating easy sharing and collaboration within the group.
4. Customisation and Control: Group owners can customise settings, including membership approval, posting permissions, and privacy options to control who can join and how information is shared.
5. Archiving and Searchability: Messages in Google Groups are archived, making it easy to search for past discussions and information.
6. Notifications and Digests: Members can choose to receive immediate updates, daily summaries, or no email notifications.

Uses of Google Groups:

• Project Teams: For coordinating tasks, sharing documents, and maintaining communication among team members.
• Educational Purposes: Teachers and students can use it for class discussions, group assignments, and resource sharing.
• Organisations and Clubs: Non-profits, clubs, and other organizations can utilize it for announcements, event planning, and member engagement.
• Support Forums: Companies and developers can create support forums for their products or services.

Setting Up a Google Group:

1. Create a Group: Go to the Google Groups website and click on “Create Group.” Fill in the details like group name, email address, and description.
2. Customise Settings: Choose the appropriate settings for privacy, member roles, and posting permissions based on the group’s purpose.
3. Invite Members: Add members by sending invitations or sharing the group link.
4. Start Discussions: Create topics for discussion, share files, and collaborate using integrated Google Workspace tools.

Best Practices:

• Define Clear Guidelines: Establish and communicate clear guidelines for group discussions and postings.
• Moderate Actively: Monitor the group for spam and ensure discussions remain on-topic and respectful.
• Utilise Integrations: Make the most of Google Groups’ integration with other Google services for a seamless collaboration experience.
• Regular Updates: Keep the group active with regular updates, prompts for discussion, and relevant content.

Conclusion:

Google Groups is a powerful tool for communication and collaboration, offering a range of features suitable for various group dynamics and purposes. Its integration with other Google services and customisation options make it a go-to choice for many businesses, educational institutions, and communities. By understanding and leveraging its capabilities, users can enhance group interaction and productivity.

During the processing of optimising page speed, I have noticed that the Google PageSpeed Insight tools is not quite as easy to understand as it first looks.

Specifically, the overall lighthouse performance score you get given doesn’t always correlate to what you will end up seeing in Google Search Console.

This can cause frustration considering the search console needs 28 days of data before it shows any changes in the Core Web Vitals section.

So, what is important and what is not? In particular, what bit do you need to focus on when testing changes you have just done to your website?

The post references data from Mighty Gadget which has the largest number of pages and the greatest number of origin data within search console out of my clients.

Google Search Console Core Web Vitals

Withing your Google Search Console, there is a section under experience called core web vitals. This section will tell you if you need to improve anything on your site. It is broken down into mobile and desktop results.

Mobile results are arguably the most important. Most traffic comes from mobile, Google generally uses mobile-first indexing, and, in my experience, it is the mobile score that is lower than desktop.

If you don’t have a lot of traffic to your website, this section may only display limited data or no data at all, but it is still important to optimise your site for speed.

PageSpeed Insights Total Score (Lighthouse performance scoring)

The big score you get in a circle provides a useful idea of how a page is doing. When you make a change, and the score goes up, then you have probably done something right.

If it is 98+ then all the other numbers are probably fine. However, if you are in the low 90s, I have found that it is quite likely you could end up with Search Console informing you that a URL needs improvement.

PageSpeed Insights Origin Summary Data

This the data that is used within Search Console. It looks at historical data across devices over 28 days. So, this section is useless when testing changes you have just done. However, this is the big thing Google will look at when factoring in core web vitals into the ranking algorithm.

Within this section, the text part will indicate if a page passes all the core web vitals. Then the individual score tells you where you have passed and failed.

The sections with a blue tag next to them are the core web vitals, and these are what you want to be green.  If a single one of them is yellow, you will fail the core web vitals assessment, and it will show in the search console that the URL needs improvement.

Lab Data

When making changes, this is the section you need to look at. It is not 100% accurate because it is a synthetic test and may not reflect on the performance devices get, which is what is used for the origin data.

Lab data only shows 2 of the 3 core web vitals, and both of these need to be green for you to pass the core web vitals assessment.

From my experience, if you get a total score in the low 90s, there is a good chance one of these results will be yellow, which means you fail the assessment even though at the top of the page, the result indicates green.

This is quite important because if you don’t notice this, it is going to be a 28-day wait before you realise your change hasn’t worked the way you want in the search console, I, unfortunately, know this from experience.

Diagnostics & Opportunities

This bit is all the independent tests from the lab data that either passes the audit or could do with improvement.

It provides you with a list of all the things you need to fix.

How to improve Google PageSpeed Insights score and core web vitals assessment results?

Making improvements is much harder. Most off the shelf WordPress themes from the likes of ThemeForest will have poor PageSpeed results, especially when combines with all the plugins most web developers use to achieve the functionality you want.

Quick and easy fixes include:

1. Use an all-in-one caching & optimisation plugin – WP Rocket is the best
   • Be warned, settings such as optimise CSS delivery are good at improving the final score but can cause problems with the Content Layout Shift assessment
2. Minimise CSS & JS – WP rocket does this, but Auto Optimise works well too.
3. Image optimisation – Use a plugin to compress and resize your images and also service them in a next gen format – I use ShortPixel it is the most affordable and works well
4. Use a content delivery network
   • Cloudflare is free, but I find it doesn’t make that much of a change to PageSpeed results
   • WP Rocket has an affordable option that works natively within their plugin
   • I had the best results with Stackpath
5. Remove as much as possible from your plugins and WordPress theme. Anything you are not using, disable it.

The above options won’t magically fix a poorly optimised website, but they will improve things. Things like WP Rocket need some tweaking to find the best settings.

Of course, the ultimate solution would be to have a website developed from the bottom up to factor in page speed. This will typically cost a lot of money and is not a viable option for a lot of small businesses. Even mid-priced web design agencies rarely bother about page speed.

The term is self-explanatory; this is when a user searches for something and then never follows through by clicking onto a website.

What are zero-click searches?

Zero-click searches have always been a thing; sometimes, you just don’t need to click onto a website to find out information (I regularly use Google to check the spellings of things).

However, zero-click searches are growing significantly, and this is largely due to the way Google presents information within its search results.

2019 vs 2020 Zero-Click Searches

In June 2019, it was reported that just over half of all searches generated no follow-through clicks to a website, the three months prior to this sat at 49.76%.

In the latest piece of research, published by Rand Fishkin, of Moz fame, now Sparktoro, that number has increased by around 30%, going from half of all searches to pushing two thirds (64.82%).

Note – These figures are far from accurate, but it gives us an idea of the extent of zero-click searches.

What causes zero-click searches?

Many zero-click searches are perfectly natural. One example would be when the user searched, didn’t find what they were looking for, then refined the search and then clicked. The first search would be zero click.

Similarly, likes my previous example, many just don’t need you to click through regardless of which search engine you may use.

However, Google has been aggressively rolling out featured snippets in recent years and new ways of displaying search results that dissuade people from clicking through to a website.

If you have ever searched any list orientated terms (best of/top) then you will often (almost always) be greeted with a snippet showing you the bullet points from that search. While the featured snippet will be more likely to get the clicks than the other results, the is much less need to click through to any site.

This also happens when searching for specific information; Google will now index specific paragraphs to be used in snippets which will often show the exact information you are looking for.

Are zero-click searches bad?

Yes, no, maybe. It depends on your business and the objective of your website.

Small local business that are advertising their services probably won’t suffer any negative effects. If anything, zero-click can be beneficial; things like maps and phone number searches can all end up being counted as zero click.

Anyone that earns money from advertising or that wants to grow a community and the overall traffic to a website will likely suffer to varying degrees.

The big concern is what are the long term prospects of this. In 2020, the search giant had more than 91% of the global market share worldwide and over 87% in the US. Google also controls a massive share of all advertising in the US, including more than 95% of search advertising and over 50% of display ads.

So any business that is reliant on the performance of their website to generate income is completely controlled by Google.

Similar to Amazon reviews, there is a growing number of cases where businesses are being caught out buying reviews.

Google has a lot of fake reviews

Similarly, a lot of people will leave negative reviews maliciously, while a lot fo the time this will be a genuine unhappy customer, some customers use the threat of negative reviews as a bargaining chip. Sometimes users will accidentally leave the review on the wrong page or accidentally select one star. Sadly, some competing businesses will also leave negative reviews or even buy negative reviews as a form of negative SEO.

This has led many businesses frustrated when they know the service, they provide is excellent but they are receiving unfair reviews.

It has always been possible to apply for takedowns of these reviews, but Google has never made the process easy or transparent.

How to manage your reviews with Google

Now things have improved a little.

The newest feature in Google My Business allows business owners to see recent reviews on their listings in a single place and check the status of reviews they reported to Google.

The new tool is available here.

Step one is to select your business, then select if you want to check the status of a reported review or if you want to report a new review for a takedown.

After you select report a new review for a takedown, Google gives you a list of your recent reviews that you can click to view on Google Maps or submit a takedown request:

If you select the option to check the status of a review you previously reported, it will show you those reviews, including the current status.

You can then select that review to see more of a summary and even submit an appeal if your takedown request was not accepted.

Overall

It is great to see that Google has simplified the takedown process and made it much easier to see what the result of the process was.

It is not something I would get overly excited about, though, if Google thinks the review is valid for any reason, then they will keep it there with nothing much you can do about it.

Zero-Click Searches

A Zero-Click Searches refer to a search engine results page (SERP) which answers the query right at the top with a featured snippet in a way that the user doesn’t need any further clicks to complete the search. A zero-click search is one that satisfies the search intent at the top of the SERP.

I have had some amazing results with featured snippets, and I can’t say I notice a significant effect from Zero-Click Search.

50% drop in featured snippet followed by recovery

In the middle of February this year, Google started to show significantly fewer featured snippets in its search results. Several analytics services reported up to a 50% drop in the number of snippets shown.

However, a month later and these services are now showing that Featured Snippets are back to normal levels.

Google has made on no comment on why it happened or why it has come back, but the current theory is a bug.

How to get featured snippets?

There are typically 5 types of featured snippet:

1. Paragraph
2. Numbered list
3. Bullet list
4. Table
5. Video

The basics of achieving these is quite easy; you just need to produce content that works for the above 5 categories.

However, moving beyond the obvious, using the appropriate H1, H2 and H3 tags and then combine this with a table of contents for each post can help trigger paragraph snippets and improve rankings for parts of your page.

The hard part is writing the content that would trigger a featured snippet then ranking it high enough to actually trigger it.

Generally, the best way to do this is to have sections of your content that specifically answer questions, such as this how to get featured snippets sections.

Featured snippets to improve backlinks

Featured snippets are both a great way to drive traffic to a site but also improve the number of backlinks to your site. When people research references they are more likely to link to the the top results, or in this case the featured snippet.

Google knows this and has been pushing the importance of page speed over the years. This importance of this will start to play more of a role in a websites organic rankings within Google in May 2021. Google will use the Core Web Vitals as part of the ranking algorithm.

Google has stated that the change will only be a small factor in how a website ranks in the results. There are thousands of variables taken into account and Core Web Vitals will be just one part of the algorithm.

However, I have always prided myself on running a high-end server for clients of Dolphin Promotions and do my best to select WordPress themes that offer both functionality and performance.

Unfortunately, the perceived page speed doesn’t always translate as well to the Google PageSpeed Insights and its Core Web Vitals.

Google factors in worst-case scenarios for page speeds. So, me visiting dolphinpromotions.co.uk may only take a fraction of a second to load, but at the time of writing, Google only gives it a score of 57 for mobile and 90 for desktop.

Following a recent move to a new and improved server, I have been looking at ways to improve page speeds beyond what the server can offer.

A common technique is to use caching plugins often combined with a content delivery network or CDN. I have recently been experimenting with two popular options and other techniques to improve the page speeds of both this site and my clients.

LiteSpeed Cache + QUIC.cloud CDN vs WP Rocket + Cloudflare CDN

LiteSpeed is actually a web server, which is an alternative to Apache and is often regarded as the fastest server on the market.

However, LiteSpeed Cache and the newly launched QUIC.cloud CDN work with none LightSpeed servers. I use Apache & NGINX; while this plugin and CDN works with them, it is likely the benefits won’t be as good as running them on a native LiteSpeed server.

WP Rocket is probably the most recommended premium caching plugin on the market. For a good reason, too, its easy to use and effective. Then Cloudflare offers a basic and free CDN.

Divi Theme

I have liked the Divi WordPress theme for years, this site uses it, as does several of my clients. Feature-rich themes you find on ThemeForest, often using Elementor may offer a superior look and easier development, but often they are too bogged down in features to run particularly fast.

That’s not to say I don’t like the other options, but for the sake of this test, I have used Divi.

Mobile vs Desktop Pagespeed – Mobile first indexing

I predominantly use a laptop or desktop when on the internet, so it can be easy to forget about optimising for mobile. But the fact is, most web traffic nowadays is via mobile.

While Dolphin gets more desktop traffic than mobile, MightyGadget.co.uk, which I host, receives 60% of traffic via mobile, 37% via desktop and 3% via tablet.

Again, Google knows this, and this is why they have introduced mobile first indexing, this means the site is indexed as if the user is using a mobile. Poorly optimised sites will suffer.

AMP Pages – Improve mobile page speeds with accelerated mobile pages

One trick to improve mobile page speed scores is to use Accelerated Mobile Pages (AMP). This is a sort of slimmed-down HTML designed specifically for mobile. 

It is often no practical for clients to have a separate AMP theme designed, but if the site has a news or blog section, you can often have AMP running on that while easily retaining the company brand.

This is good if you are attempting to grow traffic and rankings through the creation of quality content via your blog.

In the case of this site, I have AMP on the blog pages. At the time of writing, this post, has a score of 63 for the normal page and 84 for the AMP page. 

Benefits of HTTP/2

A more recent change to the Google PageSpeed scores is factoring in HTTP/2. HTTP/2 is the first new version of HTTP since HTTP/1.1, which was standardised in 1997.

You don’t need to worry too much about the technicalities of it, but most major browsers had added HTTP/2 support by the end of 2015. HTTP/2 reduces latency and improves page speed by factoring in various technologies that have been implemented over the years.

For the URL dolphinpromotions.co.uk/blog/ Google suggests that using HTTP/2 can cut page load speeds by up to 2.19 seconds. Cloudflare even supports HTTP/3 (with QUIC), which offers even more improvements.

Enabling these option on Dolphin improved the blog page performance from 51 to 61

Pagespeed Results

Divi WordPress Theme – PageSpeed with no optimisation

With this test, I have the Divi theme installed, no caching plugin, then Cloudflare switched to development mode and also proxy switched off.

The results are impressive, Divi is well optimised before you start bogging things down with plugins. If you have a basic website, you can probably get away without a paid caching plugin.

Divi WordPress Theme – PageSpeed with using LiteSpeed Cache + QUIC.cloud CDN

At the time of writing, I had been running LiteSpeed Cache + QUIC.cloud CDN on the site for a few weeks. Perceived performance is good, the site runs fast, but it has not been quite as good as I would have liked.

QUIC.cloud is an interesting option and well worth considering. It is a new CDN with various optimisation options, some free and some which you can enable for minimum costs.

If you are already on a Lightspeed server, I’d definitely use this method first. For none LiteSpeed servers, the CDN offers 1GB for free data, 1,000 images optimised, 100 Critical CSS calculations and 100 low-quality image placeholders.

Using a Lightspeed server, this goes up 5 fold, and then LiteSpeed Enterprise servers have 10 fold the base rate.

Pricing is pretty cheap too; you buy credits then apply them. It does start to add up once you add it to each of the 4 optimisation services, but you don’t have to use them all.

With this installed on my website I achieved better scores but only by a small margin.

Divi WordPress Theme – PageSpeed with WP Rocket + Cloudflare CDN

Finally, with WP Rocket installed I started to achieve excellent scores for both mobile and desktop. In some cases, we are looking at over a 20-point difference between Lightspeed Cache and WP Rocket then over 30 points difference with no optimisation.

The one caveat is the lightweight AMP pages, which actually saw the score decrease for both the caching plugins.

Overall

I regard caching plugins as an essential part of a website, there is no reason not to use one in most scenarios.

In the case of Dolphin Promotions, the scores were decent to start. With my other site, Mighty Gadget, it suffered from quite low scores due to a large number of plugins combined with Google AdSense adverts severely reducing speeds. Implementing WP Rocket and Cloudflare has taken all the scores to 80+ for mobile, with most of the desktop scores sitting in the high 90’s if not 100.

My two examples are premium options; people with smaller sites on a budget could opt for free options. I found Autoptimize works quite well.

For smaller sites, a paid for CDN is unlikely to offer a big return on investment, but it is always worth considering, and Cloudflare offers basic free options.

I find a lot of small companies or the small companies developing sites for other small companies cheap out on both hosting and the various speed optimisations available to websites. Most companies seem to make a website look pretty and then completely ignore these basics as well as SEO.

Of course, good quality hosting, premium caching, and a CDN incurs increased costs. I have had clients regularly try to haggle me down to £100 per year because that’s what their former web designer charged.

However, if you are a business that is reliant on work coming through your website, is paying £250+ really that much of an issue if it offers an improved user experience and better rankings in Google? It seems daft that some companies will spend thousands on having a website developed than baulk at the thought of paying £20 a month or so to keep the website running well.