Performance checklist

Measure first. Opinion second.

Frontend — Core Web Vitals

LCP (Largest Contentful Paint) — ≤ 2.5s

• Hero image preloaded, sized, fetchpriority="high".
• Critical CSS inlined or loaded before render-blocking resources.
• Fonts: font-display: swap, preloaded if above the fold.
• No render-blocking JS on the critical path. defer or async.

CLS (Cumulative Layout Shift) — ≤ 0.1

• width/height on images and iframes.
• Reserved space for async content (skeletons, aspect-ratio boxes).
• No ads / embeds inserted above existing content without reservation.
• No web-font swap without matching metrics.

INP (Interaction to Next Paint) — ≤ 200ms

• No long tasks (>50ms) on interaction paths.
• Break up work: scheduler.yield(), idle callbacks, debounced expensive calcs.
• Virtualize long lists.
• Event handlers don't do layout thrash — batch reads then writes.

Frontend — bundle

• Tree-shake-friendly imports. import { x } from 'lib' — not import lib from 'lib' unless required.
• No moment — use date-fns or Temporal polyfill.
• No full lodash — use lodash-es named imports or dropping to native.
• Code-split routes. Lazy-load heavy components that aren't above the fold.
• Images: modern formats (WebP/AVIF), responsive srcset, served from a CDN.

Backend — query layer

• No query inside a loop over a result set (N+1). Batch with IN/JOIN/dataloader.
• Every WHERE / ORDER BY / JOIN column used on large tables is indexed.
• SELECT * replaced with specific columns on hot paths.
• Pagination uses cursors, not offset, on tables that grow.
• Queries have statement timeouts.

Backend — request

• Timeouts on every outbound call.
• Retries capped with backoff. Never infinite.
• Circuit breakers for dependencies you can't trust.
• Response compression enabled (gzip/brotli).
• Static assets behind a CDN with long Cache-Control.

Cache

• Layers have clear ownership: browser, CDN, app memory, database.
• TTLs tied to staleness tolerance, not wish.
• Invalidation path is obvious. If you can't invalidate it, you can't cache it.
• Cache-Control: stale-while-revalidate for content that tolerates it.

Instrumentation

• Real User Monitoring (RUM) for Web Vitals on production.
• Server: p50/p95/p99 latency per endpoint.
• Flame graphs available in production (sampled) for hot paths.
• Alerts on regression — not just absolute thresholds.

Common mistakes

• "Add caching" to mask a slow query — fix the query.
• Memoizing in React before measuring — often makes things worse.
• Index everything — indexes have a write cost; pick with intention.
• Serve Gzip but forget to compress API JSON — biggest gzip wins are often in the API.