YSlow Ruleset Limitations

YSlow generates the page performance summaries by accessing the page components. As of today, browsers allow different levels of access to page components, which limits YSlow’s supported ruleset in each implementation. The table below lists the supported rules by browser/platform.

Limitations Explained

XHRs resolve any redirects on requests, it means when a request is made for url A that gets redirected to B that redirects to C, there's no trace of all redirects involved, thus this rule is never triggered.
When scaning the page searching for components, XHRs can't be detected, hence these rules are not triggered.
Only cookies sent over HTTP headers are considered and those components hosted in the same domain as the main page.
Empty resources are not listed in HAR files.
Since there's no real browser involved, a pseudo browser (JSDOM) is used to render the page which does not provide accurate results.
No rendered image dimension information is available in HAR files. Inline and style background images can't be distinguished from regular images.
Rule is only triggered when favicon is listed in exported HAR files.

Techniques Used to Access Page Components

Firefox

It was the original implementation of YSlow and provides full access to page components information throught Firebug Net Panel. Since it's a add-on, Firefox allows cross domain access to iframes and CSS files hosted in different domains than the page domain.

Chrome

Chrome extension API currently does not provide access to the netwok panel data, hence XHR requests are made for each component (script, css, images, etc) found on the page being analyzed. Cross domain XHRs are possible within Chrome extension sandbox environment.

Mobile/Bookmarklet, Opera and Safari

It relies on YQL as a proxy in order to get HTTP headers of page components, for all requests the user-agent string is passed to impersonate the browser making the request.

Command line (HAR)

HAR files contain all HTTP headers information needed to YSlow analyze page performance, however since there's no real browser involved, some rules are not applicable.