aarons.com website review

Not measured in this review.

• Fails Core Web Vitals for real visitors

  Real Chrome users on phones do not pass Google's Core Web Vitals on your site (28-day field data from the Chrome UX Report (opens in a new tab)). Google uses this in ranking.

• Real-user LCP: 3.0 s

  3.0 s

  Real visitors wait 3.0 s for the largest content to appear (75th percentile). Good is under 2.5 s.

• Real-user INP: 307 ms

  307 ms

  Real visitors wait 307 ms for the page to respond to a tap (75th percentile). Good is under 200 ms.

• Tap response (INP) got 21% slower for real visitors

  +21%

  Over the last 25 four-week periods to 2026-10-03, real Chrome visitors' tap response (inp) went from 250 ms to 305 ms at the 75th percentile (Chrome UX Report (opens in a new tab) history).

• Real-user FCP: 2.1 s

  2.1 s

  Real visitors see the first content after 2.1 s (75th percentile). Good is under 1.8 s.

• Real-user TTFB: 1.3 s

  1.3 s

  Real visitors wait 1.3 s for your server to start answering (75th percentile). Good is under 800 ms.

• Largest content (LCP) held steady for real visitors

  -5%

  Over the last 25 four-week periods to 2026-10-03, real Chrome visitors' largest content (lcp) went from 3.1 s to 3.0 s at the 75th percentile (Chrome UX Report (opens in a new tab) history).

• Page weight: 3.5 MB

  3.5 MB

  Your homepage downloads 3.5 MB on a phone, 1.4 MB of it images (42%). Under 2 MB keeps phones on slow connections fast.

• About 1.0 g of CO₂ per visit

  0.98 g

  By the Sustainable Web Design model, a visit to your homepage emits about 0.98 g of CO₂e: 117.7 kg a year at 10,000 visits a month. It scales with page weight, so every byte cut lowers it.

• 10 tap targets too small

  10 tap targets are too small or too close together to hit reliably with a finger.

  Elements (3)

• Page should contain a level-one heading (1 element)

  Page should contain a level-one heading: 1 element on the page fails this check, rated moderate by axe-core.

  Elements (1)

• No H1 headline

  There is no <h1>, so neither visitors nor Google get a clear main headline.

• No structured data

  No structured data (JSON-LD), so Google can't show rich results such as your logo, ratings or FAQs.

• No social preview image

  No Open Graph image (also missing: og:title, og:description), so links shared on LinkedIn, Slack or Facebook show no preview picture.

• No X (Twitter) card tag

  No twitter:card tag. X falls back to Open Graph, which is incomplete here.

• 264 internal links, 21 external

  The homepage links to 264 pages on aarons.com and 21 external pages.

• No Organization structured data

  There is no Organization (or LocalBusiness) JSON-LD, so search engines and AI assistants have no machine-readable facts about who runs the site: its name, logo, profiles and contact details.

• No llms.txt

  There is no /llms.txt, a short Markdown guide to your key pages for AI tools (llmstxt.org). It is optional and few AI tools read it yet, so treat it as a cheap extra.

• 15 internal pages checked

  We fetched 15 pages linked from your homepage (of 152 found) and read each the way a search engine does.

• 16 small tap targets

  16 of 27 tappable elements near the top of the page are smaller than 24 px, hard to hit with a thumb.

• 3 JavaScript errors while loading

  3 errors were logged to the browser console while the page loaded, for example “Yo is not defined”.

• 3 broken links to your own pages

  3 links from your homepage to your own site are broken, for example https://www.aarons.com/what-is-rent-to-own (network).

• No Content-Security-Policy

  No Content-Security-Policy header, the main browser-side defence against injected scripts.

• No X-Content-Type-Options

  X-Content-Type-Options: nosniff is missing, so browsers may guess file types.

• 2 links through redirect chains

  2 links go through two or more redirects, for example https://jobs.aarons.com/.

• No Referrer-Policy

  No Referrer-Policy header, so full URLs can leak to the sites you link to.

• No Permissions-Policy

  No Permissions-Policy header to switch off camera, microphone and location for embedded content.

• Deprecated X-XSS-Protection

  X-XSS-Protection is set to “1”; the header is deprecated and can introduce bugs. Use 0 or remove it.

• No security.txt

  There is no /.well-known/security.txt telling researchers how to report a security problem to you.

• No CAA record

  aarons.com has no CAA record, so any certificate authority may issue a certificate for it. A CAA record naming your provider (for example letsencrypt.org) closes that door.

• DNSSEC is off

  aarons.com's DNS answers are not signed. DNSSEC stops attackers forging them to send visitors or email elsewhere; most registrars switch it on in a click, though most sites still run without it.

• No social proof

  No testimonials, customer logos, ratings or customer counts on the homepage: nothing tells a new visitor that others already trust you.

• Local business without LocalBusiness data

  Your homepage shows a street address but no LocalBusiness JSON-LD, so Google and AI assistants have to guess your address, hours and phone from the page text.

• No phone number on the homepage

  A local customer looking to call finds no phone number on the homepage. Add one, ideally as a tap-to-call link.

• No direct contact details

  No phone number or email link on the homepage, so ready-to-buy visitors have one fewer way to reach you.

• No opening hours

  The homepage shows no opening hours. If customers visit or call, show when.

• No map or directions link

  There is no link to Google or Apple Maps. A directions link is one tap for a phone visitor.

• About 1,541 words of copy

  The homepage carries about 1,541 words of visible text.

• Email authentication score: 85/100

  Email authentication: SPF record 25 points, plus 15 when it ends in -all (10 for ~all); DMARC record 25, plus 25 for a reject policy (15 for quarantine); a DKIM key on a common selector 10.

• 5 trackers load before any consent

  5

  Before a visitor clicks anything, the page loads Google Ads, Google Analytics, Google Tag Manager, The Trade Desk and Xandr (measured from a US location before any click). A consent tool (TrustArc) is installed; check it blocks these until visitors agree where the law requires it.

• 36 cookies set on arrival

  36

  Opening the homepage sets 36 cookies, 1 of them by other companies (measured from a US location before any click).

• 37 other companies contacted

  Loading the homepage contacts 37 hosts run by other companies (fonts, scripts, analytics, ads), each of which sees the visitor's IP address.