andsisters.com website review

Not measured in this review.

• Tap response (INP) got 27% slower for real visitors

  +27%

  Over the last 25 four-week periods to 2026-10-31, real Chrome visitors' tap response (inp) went from 152 ms to 197 ms at the 75th percentile (Chrome UX Report (opens in a new tab) history).

• Page weight: 10.5 MB

  10.5 MB

  Your homepage downloads 10.5 MB on a phone, 7.4 MB of it images (70%). Under 2 MB keeps phones on slow connections fast.

• 1 image over 500 KB

  EccomTiles_AW26__ApplicatorTamponsSuper.jpg weighs 526 KiB. On a phone connection a single image that size takes seconds.

  Elements (1)

• 2 images far larger than shown

  642 KiB

  2 images are downloaded at several times the size a phone draws them, for example EccomTiles_AW26__ApplicatorTamponsSuper.jpg at 3,000 px wide, shown at 274 px. Resized copies would save about 642 KiB.

  Elements (2)

• An image on the first screen is lazy-loaded

  AW26_WebBanners_Cup_Webbanner_Mobile.jpg is on the first screen but marked loading="lazy", so the browser waits before fetching it and the page looks finished later. Load it eagerly (and give it fetchpriority="high" if it is the main image).

  Elements (3)

• About 3.0 g of CO₂ per visit

  2.97 g

  By the Sustainable Web Design model, a visit to your homepage emits about 2.97 g of CO₂e: 356.6 kg a year at 10,000 visits a month. It scales with page weight, so every byte cut lowers it.

• 83 text elements with low contrast

  83 text elements don't have enough contrast against the background to read easily, especially outdoors on a phone.

  Elements (3)

• 1 tap target too small

  1 tap target is too small or too close together to hit reliably with a finger.

  Elements (1)

• Landmarks should have a unique role or role/label/title (i.e. accessible name) combination (1 element)

  Landmarks should have a unique role or role/label/title (i.e. accessible name) combination: 1 element on the page fails this check, rated moderate by axe-core.

  Elements (1)

• 5 form fields without a label

  5 form fields have no label, so screen readers announce an empty box and autofill guesses.

  View source

• 1 link without text

  1 visible link has no text or label, so screen readers cannot say where it goes.

  Elements (1)

• Headings skip levels

  Headings skip levels (h2 → h5 and h2 → h4), which makes the page harder to scan with a screen reader.

  View sourceElements (1)

• Title is long (69 characters)

  Your title is 69 characters, so Google will cut it off around 60: “The Original Silicone Menstrual Cup and Organic Period Care | Mooncup”.

  View source

• 15 H1 headlines

  There are 15 <h1> headlines (“”, “A whole lot more Mooncup.” and “A whole lot more Mooncup.”). One clear main headline is easier for people and search engines.

• Meta description is long (273 characters)

  Your meta description is 273 characters; Google truncates after about 160, so the end of your pitch is cut.

  View source

• 159 internal links, 19 external

  The homepage links to 159 pages on andsisters.com and 19 external pages.

• 4 pages without an H1

  /products/mooncup-original-menstrual-cup, /products/mooncup-beginner-menstrual-cup, /products/applicator-tampons-regular and /products/postpartum-pads have no <h1> headline, so visitors and search engines get no clear main topic.

• 2 pages slow to respond

  /collections/restocks and /collections/periods-for-business took over 3 s to send their HTML from our server.

• 15 internal pages checked

  We fetched 15 pages linked from your homepage (of 55 found) and read each the way a search engine does.

• 3 JavaScript errors while loading

  3 errors were logged to the browser console while the page loaded, for example “Shopify's Google Analytics stub called with: [array Array] See https://help.shopify.com/manual/promoting-marketing/pixe…”.

• Short HSTS lifetime

  HSTS is set, but max-age is 91 days; one year is the recommended minimum.

• No Referrer-Policy

  No Referrer-Policy header, so full URLs can leak to the sites you link to.

• No Permissions-Policy

  No Permissions-Policy header to switch off camera, microphone and location for embedded content.

• Deprecated X-XSS-Protection

  X-XSS-Protection is set to “1; mode=block”; the header is deprecated and can introduce bugs. Use 0 or remove it.

• No security.txt

  There is no /.well-known/security.txt telling researchers how to report a security problem to you.

• No CAA record

  wearemooncup.com has no CAA record, so any certificate authority may issue a certificate for it. A CAA record naming your provider (for example letsencrypt.org) closes that door.

• DNSSEC is off

  wearemooncup.com's DNS answers are not signed. DNSSEC stops attackers forging them to send visitors or email elsewhere; most registrars switch it on in a click, though most sites still run without it.

• No direct contact details

  No phone number or email link on the homepage, so ready-to-buy visitors have one fewer way to reach you.

• About 2,390 words of copy

  The homepage carries about 2,390 words of visible text.

• DMARC is monitor-only (p=none)

  DMARC is set to p=none, so mail pretending to be andsisters.com is still delivered. Add a report address, check the reports, then move to quarantine.

• Email authentication score: 70/100

  Email authentication: SPF record 25 points, plus 15 when it ends in -all (10 for ~all); DMARC record 25, plus 25 for a reject policy (15 for quarantine); a DKIM key on a common selector 10.

• 9 trackers load before any consent

  9

  Before a visitor clicks anything, the page loads Google Analytics, Google Tag Manager, Hotjar, Klaviyo and LinkedIn Insight and 4 mores (measured from a US location before any click). No consent tool was detected. Visitors from the EU, UK and several US states must be asked first.

• 29 cookies set on arrival

  29

  Opening the homepage sets 29 cookies (measured from a US location before any click).

• No consent tool detected

  No known cookie consent tool loads with the page. Some sites build their own banner, and some only show one to visitors from the EU.

• 43 other companies contacted

  Loading the homepage contacts 43 hosts run by other companies (fonts, scripts, analytics, ads), each of which sees the visitor's IP address.