bugmd.com website review

Not measured in this review.

• Fails Core Web Vitals for real visitors

  Real Chrome users on phones do not pass Google's Core Web Vitals on your site (28-day field data from the Chrome UX Report (opens in a new tab)). Google uses this in ranking.

• Real-user LCP: 3.3 s

  3.3 s

  Real visitors wait 3.3 s for the largest content to appear (75th percentile). Good is under 2.5 s.

• Real-user INP: 260 ms

  260 ms

  Real visitors wait 260 ms for the page to respond to a tap (75th percentile). Good is under 200 ms.

• Real-user FCP: 2.5 s

  2.5 s

  Real visitors see the first content after 2.5 s (75th percentile). Good is under 1.8 s.

• Page weight: 5.1 MB

  5.1 MB

  Your homepage downloads 5.1 MB on a phone, 453 KiB of it images (9%). Under 2 MB keeps phones on slow connections fast.

• 2 images far larger than shown

  52 KiB

  2 images are downloaded at several times the size a phone draws them, for example shome-split-hero-epc.jpg at 1,200 px wide, shown at 390 px. Resized copies would save about 52 KiB.

  Elements (2)

• About 1.5 g of CO₂ per visit

  1.46 g

  By the Sustainable Web Design model, a visit to your homepage emits about 1.46 g of CO₂e: 175.0 kg a year at 10,000 visits a month. It scales with page weight, so every byte cut lowers it.

• All page content should be contained by landmarks (1 element)

  All page content should be contained by landmarks: 1 element on the page fails this check, rated moderate by axe-core.

  Elements (1)

• 8 links without text

  8 visible links have no text or label, so screen readers cannot say where they go.

• No structured data

  No structured data (JSON-LD), so Google can't show rich results such as your logo, ratings or FAQs.

• 67 internal links, 7 external

  The homepage links to 67 pages on bugmd.com and 7 external pages.

• No Organization structured data

  There is no Organization (or LocalBusiness) JSON-LD, so search engines and AI assistants have no machine-readable facts about who runs the site: its name, logo, profiles and contact details.

• 9 pages without a meta description

  /pages/catalog, /collections/all-products, /pages/where-to-buy, /products/bugmd-vamoose-pro, /pages/select-your-defense and /collections/flying-pests and 3 others have no meta description, so Google writes the search snippet from whatever text it finds.

  Elements (8)

• 1 page without an H1

  /pages/catalog has no <h1> headline, so visitors and search engines get no clear main topic.

• 1 page with very little text

  /pages/where-to-buy has under 150 words in the HTML. Thin pages rarely rank; if the text loads with JavaScript, crawlers that don't run it see even less.

• 15 internal pages checked

  We fetched 15 pages linked from your homepage (of 23 found) and read each the way a search engine does.

• 1 broken image

  1 image failed to load on a phone, for example https://bat.bing.com/action/0?ti=25147873&Ver=2&mid=0adabf81-fad5-4f43-90b3-3df8f02ba51b&bo=1&sid=c01095f0d87611f183652ff68c5bf4b1&vid=c0109b90d87611f19af79bcc1529cc51&vids=1&msclkid=N&pi=918639831&lg.

• 6 JavaScript errors while loading

  6 errors were logged to the browser console while the page loaded, for example “Unexpected token ';'”.

• Short HSTS lifetime

  HSTS is set, but max-age is 91 days; one year is the recommended minimum.

• 2 links through redirect chains

  2 links go through two or more redirects, for example https://bugmd.com/account/login.

• No Referrer-Policy

  No Referrer-Policy header, so full URLs can leak to the sites you link to.

• No Permissions-Policy

  No Permissions-Policy header to switch off camera, microphone and location for embedded content.

• Deprecated X-XSS-Protection

  X-XSS-Protection is set to “1; mode=block”; the header is deprecated and can introduce bugs. Use 0 or remove it.

• No security.txt

  There is no /.well-known/security.txt telling researchers how to report a security problem to you.

• No CAA record

  bugmd.com has no CAA record, so any certificate authority may issue a certificate for it. A CAA record naming your provider (for example letsencrypt.org) closes that door.

• DNSSEC is off

  bugmd.com's DNS answers are not signed. DNSSEC stops attackers forging them to send visitors or email elsewhere; most registrars switch it on in a click, though most sites still run without it.

• About 1,202 words of copy

  The homepage carries about 1,202 words of visible text.

• Email authentication score: 100/100

  Email authentication: SPF record 25 points, plus 15 when it ends in -all (10 for ~all); DMARC record 25, plus 25 for a reject policy (15 for quarantine); a DKIM key on a common selector 10.

• 11 trackers load before any consent

  11

  Before a visitor clicks anything, the page loads Amazon Ads, Google Ads, Google Analytics, Google Tag Manager and Klaviyo and 6 mores (measured from a US location before any click). No consent tool was detected. Visitors from the EU, UK and several US states must be asked first.

• 37 cookies set on arrival

  37

  Opening the homepage sets 37 cookies (measured from a US location before any click).

• No consent tool detected

  No known cookie consent tool loads with the page. Some sites build their own banner, and some only show one to visitors from the EU.

• 82 other companies contacted

  Loading the homepage contacts 82 hosts run by other companies (fonts, scripts, analytics, ads), each of which sees the visitor's IP address.