boxito.com website review

Not measured in this review.

• Fails Core Web Vitals for real visitors

  Real Chrome users on phones do not pass Google's Core Web Vitals on your site (28-day field data from the Chrome UX Report (opens in a new tab)). Google uses this in ranking.

• Real-user INP: 308 ms

  308 ms

  Real visitors wait 308 ms for the page to respond to a tap (75th percentile). Good is under 200 ms.

• Tap response (INP) got 36% slower for real visitors

  +36%

  Over the last 25 four-week periods to 2026-10-24, real Chrome visitors' tap response (inp) went from 218 ms to 307 ms at the 75th percentile (Chrome UX Report (opens in a new tab) history).

• Largest content (LCP) held steady for real visitors

  +3%

  Over the last 25 four-week periods to 2026-10-24, real Chrome visitors' largest content (lcp) went from 1.7 s to 1.7 s at the 75th percentile (Chrome UX Report (opens in a new tab) history).

• Page weight: 6.6 MB

  6.6 MB

  Your homepage downloads 6.6 MB on a phone, 1.9 MB of it images (30%). Under 2 MB keeps phones on slow connections fast.

• 6 images far larger than shown

  798 KiB

  6 images are downloaded at several times the size a phone draws them, for example BANNERS_-_LOS_MAS_BUSCADOS-01.jpg at 1,920 px wide, shown at 390 px. Resized copies would save about 798 KiB.

  Elements (5)

• An image on the first screen is lazy-loaded

  BANNERS_-_LOS_MAS_BUSCADOS-01.jpg is on the first screen but marked loading="lazy", so the browser waits before fetching it and the page looks finished later. Load it eagerly (and give it fetchpriority="high" if it is the main image).

  Elements (3)

• About 1.9 g of CO₂ per visit

  1.86 g

  By the Sustainable Web Design model, a visit to your homepage emits about 1.86 g of CO₂e: 223.7 kg a year at 10,000 visits a month. It scales with page weight, so every byte cut lowers it.

• 16 text elements with low contrast

  16 text elements don't have enough contrast against the background to read easily, especially outdoors on a phone.

  Elements (3)

• 11 tap targets too small

  11 tap targets are too small or too close together to hit reliably with a finger.

  Elements (3)

• Scrollable region must have keyboard access (1 element)

  Scrollable region must have keyboard access: 1 element on the page fails this check, rated serious by axe-core.

  Elements (1)

• 2 images without alt text

  2 images have no alt text, which hurts accessibility and image search.

  Elements (2)

• All page content should be contained by landmarks (4 elements)

  All page content should be contained by landmarks: 4 elements on the page fail this check, rated moderate by axe-core.

  Elements (3)

• 18 links without text

  18 visible links have no text or label, so screen readers cannot say where they go.

  Elements (3)

• Alternative text of images should not be repeated as text (4 elements)

  Alternative text of images should not be repeated as text: 4 elements on the page fail this check, rated minor by axe-core.

  Elements (3)

• No structured data

  No structured data (JSON-LD), so Google can't show rich results such as your logo, ratings or FAQs.

• No social preview image

  No Open Graph image, so links shared on LinkedIn, Slack or Facebook show no preview picture.

  View source

• One H1 headline

  Your <h1> is empty.

  View source

• 602 internal links, 12 external

  The homepage links to 602 pages on boxito.com and 12 external pages.

• No Organization structured data

  There is no Organization (or LocalBusiness) JSON-LD, so search engines and AI assistants have no machine-readable facts about who runs the site: its name, logo, profiles and contact details.

• 3 linked pages are broken

  Your homepage links to /collections/aires-acondicionados, /collections/banos and /collections/accesorios-de-griferia, which answer with an error. Visitors hit a dead end and search engines drop them.

  Elements (3)

• 4 pages without a meta description

  /collections/ventiladores, /collections/extractores, /collections/mezcladoras-para-lavabo and /collections/griferia-institucional have no meta description, so Google writes the search snippet from whatever text it finds.

  Elements (4)

• 12 pages without an H1

  /collections/aires-y-ventilacion, /collections/on-off, /collections/aires-acondicionados-inverter, /collections/ventiladores, /collections/ventiladores-de-techo and /collections/ventiladores-de-piso and 6 others have no <h1> headline, so visitors and search engines get no clear main topic.

• 15 internal pages checked

  We fetched 15 pages linked from your homepage (of 198 found) and read each the way a search engine does.

• 1 broken image

  1 image failed to load on a phone, for example https://cdnjs.cloudflare.com/ajax/libs/flag-icon-css/4.1.4/flags/4x3/mx.svg.

• 48 small tap targets

  48 of 141 tappable elements near the top of the page are smaller than 24 px, hard to hit with a thumb.

• 3 JavaScript errors while loading

  3 errors were logged to the browser console while the page loaded, for example “Failed to load resource: net::ERR_SOCKET_NOT_CONNECTED”.

• 7 broken links to your own pages

  7 links from your homepage to your own site are broken, for example https://boxito.com/collections/extractores (503).

• Short HSTS lifetime

  HSTS is set, but max-age is 91 days; one year is the recommended minimum.

• No Referrer-Policy

  No Referrer-Policy header, so full URLs can leak to the sites you link to.

• No Permissions-Policy

  No Permissions-Policy header to switch off camera, microphone and location for embedded content.

• Deprecated X-XSS-Protection

  X-XSS-Protection is set to “1; mode=block”; the header is deprecated and can introduce bugs. Use 0 or remove it.

• No security.txt

  There is no /.well-known/security.txt telling researchers how to report a security problem to you.

• No CAA record

  boxito.com has no CAA record, so any certificate authority may issue a certificate for it. A CAA record naming your provider (for example letsencrypt.org) closes that door.

• No calls to action

  We found no call-to-action buttons or links (such as “Book a demo” or “Get a quote”) anywhere on the homepage.

• Local business without LocalBusiness data

  Your homepage shows a street address but no LocalBusiness JSON-LD, so Google and AI assistants have to guess your address, hours and phone from the page text.

• No opening hours

  The homepage shows no opening hours. If customers visit or call, show when.

• No risk reducer

  No guarantee or risk reducer (money-back, free trial, no credit card) is mentioned, which is often what tips a hesitant visitor.

• About 1,700 words of copy

  The homepage carries about 1,700 words of visible text.

• Email authentication score: 95/100

  Email authentication: SPF record 25 points, plus 15 when it ends in -all (10 for ~all); DMARC record 25, plus 25 for a reject policy (15 for quarantine); a DKIM key on a common selector 10.

• 6 trackers load before any consent

  6

  Before a visitor clicks anything, the page loads Google Ads, Google Analytics, Google Tag Manager, Klaviyo and Meta Pixel and 1 more (measured from a US location before any click). No consent tool was detected. Visitors from the EU, UK and several US states must be asked first.

• 30 cookies set on arrival

  30

  Opening the homepage sets 30 cookies, 3 of them by other companies (measured from a US location before any click).

• No consent tool detected

  No known cookie consent tool loads with the page. Some sites build their own banner, and some only show one to visitors from the EU.

• 50 other companies contacted

  Loading the homepage contacts 50 hosts run by other companies (fonts, scripts, analytics, ads), each of which sees the visitor's IP address.