DEV Community

Cover image for 4 Tiny Mistakes That Secretly Destroy App Performance
Sylwia Laskowska
Sylwia Laskowska

Posted on

4 Tiny Mistakes That Secretly Destroy App Performance

Real-world cases and energy-saving impacts

Ok, I’m back from my short vacation and returning with some useful content 😄 As you know, from time to time I write posts for you in the style of articles like Stop Installing Libraries: 10 Browser APIs That Already Solve Your Problems — which I honestly love writing, and I know you enjoy them too 🙂

Today I want to approach the topic from a slightly different angle. I’m going to show you a few interesting things that might accidentally be making your app much slower, even though they often look completely innocent at first glance. And the best part? Some of them can be fixed surprisingly quickly. Also, these are the kinds of issues Claude Code or Codex probably won’t immediately point out when you ask them “why is my app slow” 😅

Usually, we develop our applications on powerful machines with fast CPUs, plenty of RAM, and fast internet. Unfortunately, real users often live in a completely different reality. Some of them absolutely have modern hardware, but there will always be somebody using an old laptop, a cheap Android phone, weak WiFi, or mobile internet from the depths of hell 😅

And suddenly it turns out your app is painfully slow for 10–30% of users.

And that’s where the war for milliseconds begins 😀

Every example in this article is something I either personally encountered in a real project or heard about from another developer, so these are definitely not hypothetical scenarios. Check whether some of these things are secretly happening in your own application 👀

Meanwhile, I’m slowly preparing for my JSNation conference talk. If you want to support me (or just see me awkwardly talking in my garden 😄), you can give me a like here. And if you want to watch my full talk completely FOR FREE, you can grab a free badge here. HOW COOL IS THAT 😄

But enough self-promotion, let’s get to the point!

1. Custom headers → preflight requests

This is exactly why it’s worth attending conferences. Sometimes you hear about problems there that you would probably never randomly google yourself 😀

One of my colleagues talked about this issue during his presentation. His team was trying to understand why their application felt slow for some users. Naturally, the backend was blamed first. Poor backend, as always 😅

But eventually they noticed something interesting in the network tab: OPTIONS requests appearing before almost every API call. Some of them were taking hundreds of milliseconds.

So what exactly is happening here?

This is related to CORS. Browsers sometimes send an additional OPTIONS request before the actual API call. This is called a preflight request and usually happens for “non-simple” requests — for example when using methods like PUT or DELETE, but also when adding custom headers.

And yes, even a completely innocent GET request can suddenly become two network calls because somebody added X-Feature-Whatever three years ago 😅

In their case, the funniest part was that the custom header wasn’t even used anymore. It was some ancient historical leftover from years earlier. Nobody knew why it existed. Nobody questioned it. It simply survived every refactor like an immortal enterprise relic 😀

If you’re curious, I actually prepared (together with Claude Code 😅) a small repo showing this behavior here:
https://github.com/sylwia-lask/preflight-options

Let's see the screens (please appreciate my high graphic skills!):

GET request without custom header:

GET request without custom header

GET request with custom header:

GET request with custom header containing preflight request

And honestly, this kind of thing happens all the time in large projects. Somebody adds a custom header for feature flags, debugging, localization, analytics, or “temporary” metadata… and then the header survives for the next four years.

Of course, sometimes custom headers are completely justified. But if you only use them for frontend-only logic, there are often better alternatives like query params, cookies, local state, or configuration endpoints fetched once during startup.

Individually, one extra request may not look catastrophic. But if your app performs dozens of calls during startup, especially on slower mobile connections, this suddenly becomes very noticeable.

2. Code splitting that does absolutely nothing

Sometimes the problem isn’t the network itself but the gigantic JavaScript bundle we load during startup. And this is usually the moment where everybody says:

“But how? We’re already doing code splitting! We use lazy loading everywhere!”

Yeah… about that 😄

I once audited an Angular application that looked very well structured at first glance. It had modules everywhere, lazy loading, proper architecture, all the “best practices.”

And yet the application loaded painfully slowly.

Fortunately, we have tools like webpack-bundle-analyzer, source-map-explorer, rollup-plugin-visualizer, or @next/bundle-analyzer that allow us to see what’s actually happening inside our bundles.

And what did we discover?

Yes, the application was split into modules…

…except each module was like 2 KB 😅

Because almost everything important lived inside one gigantic shared module that was imported absolutely everywhere, meaning most of the application still ended up inside the main bundle anyway 😀

Congratulations, your app is now split into 400 beautifully separated files that all load at startup.

This is also not the only weird case I’ve seen. I’ve already encountered situations where the app technically “lazy loaded” modules while still downloading almost the entire application every single time 😄

For example, something like this looks perfectly fine:

{
  path: 'admin',
  loadChildren: () =>
    import('./admin/admin.module').then(m => m.AdminModule)
}
Enter fullscreen mode Exit fullscreen mode

Looks clean. Looks modern. Looks optimized.

Until you discover that AdminModule imports a massive shared module containing half the application 😅

So yeah — just because you use import() or lazy modules does not automatically mean your bundles are healthy. Always check what is actually being downloaded by the browser.

3. Unnecessary runtime dependencies

This is another extremely common problem, especially in projects where nobody really controls what npm packages people install 😅

In my current project, importing a new dependency is practically treated like a sacred ritual that requires approval from the wisest architects of the kingdom (which basically means me and two or three coworkers 😀). But in many projects, people install libraries completely thoughtlessly.

And then suddenly your application contains:

  • three analytics SDKs,
  • two date libraries,
  • all Moment.js locales,
  • the entire Lodash package because somebody needed one utility function,
  • Firebase imported globally,
  • three icon packs,
  • and some “tiny lightweight helper package” that quietly imports half the internet 😀

I once saw an application loading three different date libraries at the same time. The funniest part? The app barely even handled dates 😅 Apparently every developer simply had their own preferred religion.

Another classic example is importing Lodash like this:

import _ from 'lodash';
Enter fullscreen mode Exit fullscreen mode

instead of:

import debounce from 'lodash/debounce';
Enter fullscreen mode Exit fullscreen mode

The difference may look small, but over time these things accumulate a lot. Especially in enterprise applications that grow for years.

And unfortunately, tree shaking is not magic 😅

4. Huge background images

This one sounds almost too obvious, right?

Everybody already knows giant images are bad.

…except people still keep shipping giant images 😄

Recently, during the WeAreDevelopers podcast, we discussed which government websites loaded the fastest. Surprisingly, the UK completely dominated everybody else. Why? I’ll probably write a separate article about this later, but generally speaking, the site was just extremely simple. Very little visual noise, lots of informational text, simple layout, SSR, minimal unnecessary assets.

The second fastest was the US government website.

It followed almost exactly the same principles… except it loaded a fancy large image during startup 😅

And suddenly the large contentful paint became noticeably worse.

The funny thing about large background images is that they often look harmless on developer hardware with fast internet. But on slower devices they can absolutely destroy perceived performance.

Fortunately, there are many ways to improve this: use AVIF or WebP, compress aggressively, avoid massive hero images above the fold, lazy load non-critical visuals, and preload only truly critical assets.

And honestly?

Sometimes the fastest image is simply… no image 😀

Final thought

Application optimization is obviously an endless topic, and this article only scratches the surface. But I think one of the most important things to understand is that performance problems are often death by a thousand cuts.

One unnecessary header.

One oversized dependency.

One “temporary” shared module.

One background image nobody questioned.

Individually, none of these things look catastrophic. Together, they create an application that feels sluggish — especially on older devices or slower mobile networks.

And the really scary part?

Most of these decisions looked perfectly reasonable when they were originally introduced 😅

Top comments (53)

Collapse
 
pengeszikra profile image
Peter Vivo • Edited

Sylwia you always found some really interesting point like now a custom header, congratulation I never know that is exsist.

I did the file splitting in my - no framework - solution, thanks for the build, tailwind and the minimal rective code size, split a program to independent html pages.

> pnpm build

dist/registerSW.js                               0.13 kB
dist/manifest.webmanifest                        0.36 kB
dist/assets/manifest-B2xQAFIn.json               0.58 kB │ gzip: 0.26 kB
dist/credit.html                                 0.99 kB │ gzip: 0.46 kB
dist/adventure.html                              0.99 kB │ gzip: 0.46 kB
dist/library.html                                1.01 kB │ gzip: 0.47 kB
dist/ship.html                                   1.03 kB │ gzip: 0.51 kB
dist/card.html                                   1.03 kB │ gzip: 0.49 kB
dist/fit.html                                    1.14 kB │ gzip: 0.61 kB
dist/work.html                                   1.28 kB │ gzip: 0.55 kB
dist/mine.html                                   1.34 kB │ gzip: 0.62 kB
dist/story.html                                  1.36 kB │ gzip: 0.63 kB
dist/index.html                                  1.38 kB │ gzip: 0.68 kB
dist/deal.html                                   1.63 kB │ gzip: 0.70 kB
dist/marker.html                                 2.01 kB │ gzip: 0.86 kB
dist/travel.html                                 2.03 kB │ gzip: 0.85 kB
dist/__index.html                                2.10 kB │ gzip: 0.91 kB
dist/throw.html                                  6.14 kB │ gzip: 1.81 kB
dist/assets/style-5bcm0AOV.css                  19.64 kB │ gzip: 4.44 kB
dist/assets/marker-a3K9PoX8.css                 20.43 kB │ gzip: 4.75 kB
dist/assets/ui-elements-C42piOfa.js              0.52 kB │ gzip: 0.20 kB
dist/assets/old-bird-soft-Cet9K-fd.js            0.64 kB │ gzip: 0.40 kB
dist/assets/targetSystem-C6rfYONd.js             0.70 kB │ gzip: 0.17 kB
dist/assets/index-DPcikNFZ.js                    0.70 kB │ gzip: 0.47 kB
dist/assets/modulepreload-polyfill-B5Qt9EMX.js   0.71 kB │ gzip: 0.40 kB
dist/assets/story-BYdjpAbD.js                    0.71 kB │ gzip: 0.50 kB
dist/assets/credit-B_lCQp87.js                   0.92 kB │ gzip: 0.58 kB
dist/assets/shoot-9YV2jSCs.js                    1.11 kB │ gzip: 0.20 kB
dist/assets/work-AxYhedTL.js                     1.24 kB │ gzip: 0.59 kB
dist/assets/adventure-mfPAHVPp.js                1.26 kB │ gzip: 0.74 kB
dist/assets/fencer-CBOzlVSn.js                   1.51 kB │ gzip: 0.76 kB
dist/assets/ship-DzKwFTHn.js                     1.57 kB │ gzip: 0.79 kB
dist/assets/library-iOGeQgd2.js                  1.69 kB │ gzip: 0.87 kB
dist/assets/concept-1YqRBMyf.js                  1.70 kB │ gzip: 0.84 kB
dist/assets/travel-BjKxB5xP.js                   1.70 kB │ gzip: 0.84 kB
dist/assets/GalaxyRoute-Czkip2Wg.js              1.77 kB │ gzip: 0.85 kB
dist/assets/asset-DRNybFKp.js                    2.01 kB │ gzip: 0.50 kB
dist/assets/card-BxPOIcVT.js                     3.05 kB │ gzip: 1.03 kB
dist/assets/mine-txzynpoG.js                     3.08 kB │ gzip: 1.33 kB
dist/assets/marker-CDmeMeHZ.js                   3.08 kB │ gzip: 1.43 kB
dist/assets/throw-CtACwOyr.js                    7.86 kB │ gzip: 2.68 kB
dist/assets/deal-ptFW1zND.js                    10.26 kB │ gzip: 3.93 kB
✓ built in 1.16s

PWA v0.21.1
mode      generateSW
precache  41 entries (110.77 KiB)
Enter fullscreen mode Exit fullscreen mode
Collapse
 
sylwia-lask profile image
Sylwia Laskowska

This is actually a beautiful example that you can still achieve a very elegant bundle structure even without a framework 😄 Those sizes look really nice.

And yeah, the preflight/CORS behavior is one of those things that surprisingly many developers never really hear about in detail. I honestly feel like it’s discussed way too rarely, and the comments under this post kind of confirm that 😀

Collapse
 
dev_in_the_house profile image
Devin

Definitely

Collapse
 
pascal_cescato_692b7a8a20 profile image
Pascal CESCATO

Great advice, as always! And this is something nobody thinks about: performance isn't just about well-structured code and optimized SQL queries, but also about best practices that we all tend to forget. I try to apply the principles you mention, and generally, my sites have Lighthouse scores above 90. And yet, guess what: I still sometimes forget to optimize the size and file size of an image, or to defer the loading of a script or a font…

Collapse
 
sylwia-lask profile image
Sylwia Laskowska

Thanks, Pascal 😄 Oh yes, images were often one of the last things I optimized too 😀

Although a few years ago I worked on an app that had to function both in Western Europe and somewhere in the middle of Africa, sometimes in libraries with extremely poor internet connections. That project really trained me hard in these kinds of performance issues 😅

Collapse
 
netnavi profile image
Ahmad Firdaus

I only read the first two mistakes mentioned; I know i don't need to read the rest. I've messed up. Custom headers are often used in developer mode to bypass CROSS, but are often forgotten to be properly set up on the move. Once I write a function that calls auth for the whole apps, and when it called it runs the other function in the background with the idea it will be ready anytime i want. But the startup is as slow as a snail.

Collapse
 
sylwia-lask profile image
Sylwia Laskowska

Exactly 😄 Sometimes it’s just one tiny thing somebody added, forgot about, or “temporarily” hacked together… and suddenly the whole app feels weirdly slow 😀

And then the entire team spends days staring at the network tab wondering what on earth is going on 😅

Collapse
 
netnavi profile image
Ahmad Firdaus

and right now... vibe coding makes it worse... I mean, i join one volunteer project, many are students, and many just use full AI from drafting to deployment using agent, and when some thing wrong... you know that it is like finding a nail in a haystsack.

Thread Thread
 
sylwia-lask profile image
Sylwia Laskowska

Yeah, exactly 😅 And it becomes even worse when people don’t really have the theoretical foundations yet, because then debugging turns into absolute chaos.

If you fully rely on agents from drafting to deployment, but don’t really understand what’s happening underneath, performance issues become a complete nightmare to untangle 😀

Collapse
 
moopet profile image
Ben Sinclair

Sometimes the fastest image is simply… no image

I think this covers 99% of everything. The problems with deciding whether to split your giant JS bundle go away if you don't use it, because unless you're writing a DAW or an office suite or something, you're almost certainly solving problems that don't exist.

Collapse
 
sylwia-lask profile image
Sylwia Laskowska

There’s definitely some truth to that 😄 Thankfully, it does feel like the industry is slowly moving back toward minimalism again.

And honestly, loading giant fancy images everywhere is often pretty absurd nowadays 😀 The early-2000s “every website must look like a movie intro” era should probably stay in the past 😅

Collapse
 
edmundsparrow profile image
Ekong Ikpe • Edited

Performance must be a top-tier checklist item for any eco-conscious developer. Every kilobyte saved in a bundle and every millisecond saved in execution is energy that isn't being wasted.

"Sometimes the fastest image is simply… no image 😀"

Collapse
 
sylwia-lask profile image
Sylwia Laskowska

I really love this perspective 🙂 Exactly, performance isn’t only about happier users or better business metrics. It’s also about efficiency and avoiding unnecessary waste. Every oversized bundle, unnecessary request, or giant image means extra energy consumption somewhere in the chain. And when millions of users open an app, those “tiny” decisions suddenly stop being tiny!

Collapse
 
leob profile image
leob • Edited

"OPTIONS requests appearing before almost every API call" - I noticed that in a project of mine, and then we decided (in the end) to simply host the API and the "app" (SPA) on the same subdomain - meaning, no CORS ...

But reading your article makes me think it might actually have been solvable with CORS (so with the two separate subdomains) ...

P.S. if it's because of a "custom header" (but what exactly is that?) then it might have had something to do with the AWS environment we were running in (Cloudfront etc) and maybe there wasn't much we could do ...

Collapse
 
sylwia-lask profile image
Sylwia Laskowska

Yeah, in your case moving everything under the same origin may honestly have been the safest and simplest solution.

And by “custom header” I mean headers we add ourselves in the frontend, often globally in some interceptor, things like X-Feature-Flag, X-Client-Version, X-Debug, etc. Those can trigger preflight requests even for normal GET calls.

But to be fair, preflights can also happen because of things like Authorization headers, PUT/PATCH/DELETE methods, or even application/json, so depending on your setup there may indeed not have been much you could realistically avoid 🙂

Collapse
 
leob profile image
leob • Edited

Thanks! That more or less confirms what I thought (well, based on what you explained in the article) - we do indeed have those auth headers, and probably some other ones as well, so there might indeed not be that much we could do ...

Our backend was/is hosted in the US (East coast), and I'm located somewhere half around the globe, and I could REALLY notice an annoying amount of latency in UI responses and API requests - so then I started checking the network tab, and saw those pre-flight requests ...

In the end, apart from getting rid of CORS, we optimized a lot of other things, almost eliminating all of that lag - so that made the difference between an "annoying" UX and a fairly pleasant one ...

Thread Thread
 
sylwia-lask profile image
Sylwia Laskowska

Yeah, that’s exactly how it usually goes 😄 At first it’s very easy to blame “the network” or “the backend,” but once you start digging into the details, all kinds of weird little things suddenly appear.

And honestly, I think this is also why AI probably won’t replace us that quickly 😀 Real-world performance issues are often this messy mix of infrastructure, browser behavior, historical decisions, accidental complexity, and random enterprise archaeology 😄

Hopefully we survive until retirement 😂

Thread Thread
 
leob profile image
leob • Edited

Yes, we will survive! Isn't that the title of a famous song? No, it's "I will survive"! :-)

Thread Thread
 
sylwia-lask profile image
Sylwia Laskowska

Hahahaha this just reminded me of a story 😄 A Polish couple I know once wanted to use “I Will Survive” as their first dance song at their wedding xDDDD

When I explained to them that the song is literally about a breakup, they suddenly looked very concerned and decided to search for another one instead 😀

Thread Thread
 
leob profile image
leob

Haha yeah it would have been like a bad omen ;-)

Collapse
 
anna2612 profile image
Anna Jambhulkar

This is a really practical breakdown.

The “death by a thousand cuts” point is exactly how many production problems actually happen. One old custom header, one shared module that quietly pulls half the app, one unnecessary dependency, one huge hero image — none of them looks catastrophic alone, but together they shape the user experience.

I’m seeing a similar pattern while building NEES Core Engine, but on the AI runtime side. Small unmanaged choices around context, memory, tools, fallbacks, and traceability don’t look dangerous individually, but over time they turn into reliability problems in production AI products.

For frontend performance, we use network tabs, bundle analyzers, and real-device testing. For AI products, I think we need the same mindset: runtime visibility, governance, and traceability around what actually happens after deployment.

Great article — very practical and grounded.

Collapse
 
sylwia-lask profile image
Sylwia Laskowska

Thanks for this comment. Honestly, this is such a great contribution to the discussion!

And I think you’re absolutely right. AI products already have — or soon will have — very similar kinds of problems. Different technology, but the same “death by a thousand cuts” effect caused by lots of tiny unmanaged decisions.

Which is honestly kind of fascinating 😀 We move forward technologically, but a lot of the old engineering knowledge still turns out to be extremely useful in these new environments too 🙂

Collapse
 
anna2612 profile image
Anna Jambhulkar

Thank you — I really liked the way you framed the original post.

That “death by a thousand cuts” pattern is exactly what I think AI products are starting to face too.

In normal apps, tiny unmanaged decisions can slowly damage performance, reliability, and user experience.

In AI products, the same thing can happen through:

  • small prompt changes
  • unclear memory usage
  • inconsistent role behavior
  • missing escalation rules
  • weak traceability
  • tiny workflow exceptions that nobody documents

Individually, each issue looks minor. But together, they create drift, unpredictability, and trust problems.

That is why I think a lot of old engineering lessons still matter in AI systems. Observability, boundaries, reviewability, and clear contracts are becoming just as important as model quality.

Different technology, same engineering truth: small unmanaged decisions eventually become system-level failures.

Collapse
 
gnomeman4201 profile image
GnomeMan4201

Less is more sometimes. This is a good reminder that performance problems usually don’t start as huge failures, they stack up from tiny choices.

Collapse
 
sylwia-lask profile image
Sylwia Laskowska

Exactly 😄 One small mistake here, one tiny oversight there… and suddenly the whole application starts feeling sluggish 😀

Collapse
 
gramli profile image
Daniel Balcarek

These are really nice tips for improving performance quickly and without huge effort 👍

I usually put code quality and readability before raw performance. Highly optimized code is great, but if the team is afraid to touch it because nobody fully understands it, that’s a highway to hell. So the code splitting example sounds way too familiar to me, but shh 😄

Collapse
 
sylwia-lask profile image
Sylwia Laskowska

Oh, absolutely 😄 Premature optimization can become a complete nightmare for maintainability. And honestly, on the frontend, good practices plus modern ESNext/browser features already solve a huge amount of problems.

Also… the “theoretical code splitting” situation is incredibly common 😄

Collapse
 
adamthedeveloper profile image
Adam - The Developer • Edited

Welcome back home @sylwia-lask

Collapse
 
sylwia-lask profile image
Sylwia Laskowska

Hahaha thanks 😄 I missed you guys too 🙂

Some comments may only be visible to logged-in visitors. Sign in to view all comments.