- Blank, white page when JavaScript is disabled
- Basic functionality broken when JavaScript is disabled
- Unnecessary use of iFrames and other subdocument elements
- Loading megabytes of libraries and scripts for a basic menu animation that could be done with CSS3 or plain JS
- Taking me off-domain to log in - the logged in area should be dashboard.example.tld, not exampledashboard.tld (mainly banking sites do this)
- Requiring logging in after visiting an email address verification link
- Sending email verification links, I would really prefer verification codes that don't require visiting a link
- HTTPS mixed content errors
- Messy HTTP response headers, such as invalid values, duplicate headers, or default values for everything
- No easy way to find a contact method for the security team, such as the RFC2142 security@ email address, or security.txt