concacaf.com website review

Not measured in this review.

• Fails Core Web Vitals for real visitors

  Real Chrome users on phones do not pass Google's Core Web Vitals on your site (28-day field data from the Chrome UX Report (opens in a new tab)). Google uses this in ranking.

• Real-user CLS: 0.27

  0.27

  For real visitors the layout shifts by 0.27 (75th percentile). Good is under 0.1.

• Real-user LCP: 3.0 s

  3.0 s

  Real visitors wait 3.0 s for the largest content to appear (75th percentile). Good is under 2.5 s.

• Tap response (INP) got 44% slower for real visitors

  +44%

  Over the last 25 four-week periods to 2026-10-31, real Chrome visitors' tap response (inp) went from 105 ms to 161 ms at the 75th percentile (Chrome UX Report (opens in a new tab) history).

• Real-user FCP: 2.1 s

  2.1 s

  Real visitors see the first content after 2.1 s (75th percentile). Good is under 1.8 s.

• Real-user TTFB: 1.1 s

  1.1 s

  Real visitors wait 1.1 s for your server to start answering (75th percentile). Good is under 800 ms.

• Largest content (LCP) held steady for real visitors

  +5%

  Over the last 25 four-week periods to 2026-10-31, real Chrome visitors' largest content (lcp) went from 2.8 s to 3.0 s at the 75th percentile (Chrome UX Report (opens in a new tab) history).

• Page weight: 2.6 MB

  2.6 MB

  Your homepage downloads 2.6 MB on a phone, 766 KiB of it images (29%). Under 2 MB keeps phones on slow connections fast.

• 3 images far larger than shown

  286 KiB

  3 images are downloaded at several times the size a phone draws them, for example b6dfe29337d7464aa49420eb14137461.webp at 1,727 px wide, shown at 26 px. Resized copies would save about 286 KiB.

  Elements (3)

• About 0.7 g of CO₂ per visit

  0.73 g

  By the Sustainable Web Design model, a visit to your homepage emits about 0.73 g of CO₂e: 87.8 kg a year at 10,000 visits a month. It scales with page weight, so every byte cut lowers it.

• 2 text elements with low contrast

  2 text elements don't have enough contrast against the background to read easily, especially outdoors on a phone.

  Elements (2)

• All page content should be contained by landmarks (3 elements)

  All page content should be contained by landmarks: 3 elements on the page fail this check, rated moderate by axe-core.

  Elements (3)

• Title is short (27 characters)

  Your title is only 27 characters: “Concacaf | Official Website”. Between 30 and 65 characters leaves room to say what you do and for whom.

  View source

• 323 internal links, 17 external

  The homepage links to 323 pages on concacaf.com and 17 external pages.

• 2 pages with very little text

  /competitions/central-american-cup/matches/c52810f2173141a59aa3779aa64f961e/verdes-fc-vs-fc-motagua and /competitions/central-american-cup/matches/b425f4eb84564a059b117ce6f4c006e5/olimpia-vs-deportivo-mixco have under 150 words in the HTML. Thin pages rarely rank; if the text loads with JavaScript, crawlers that don't run it see even less.

• 15 internal pages checked

  We fetched 15 pages linked from your homepage (of 200 found) and read each the way a search engine does.

• No Content-Security-Policy

  No Content-Security-Policy header, the main browser-side defence against injected scripts.

• No clickjacking protection

  Neither X-Frame-Options nor a CSP frame-ancestors policy is set, so any site can embed yours in a frame.

• No X-Content-Type-Options

  X-Content-Type-Options: nosniff is missing, so browsers may guess file types.

• No Referrer-Policy

  No Referrer-Policy header, so full URLs can leak to the sites you link to.

• No Permissions-Policy

  No Permissions-Policy header to switch off camera, microphone and location for embedded content.

• No security.txt

  There is no /.well-known/security.txt telling researchers how to report a security problem to you.

• No CAA record

  concacaf.com has no CAA record, so any certificate authority may issue a certificate for it. A CAA record naming your provider (for example letsencrypt.org) closes that door.

• DNSSEC is off

  concacaf.com's DNS answers are not signed. DNSSEC stops attackers forging them to send visitors or email elsewhere; most registrars switch it on in a click, though most sites still run without it.

• No call to action on the first screen

  On a phone, there is no call to action on the first screen: visitors have to scroll to find out what to do next.

• Local business without LocalBusiness data

  Your homepage shows a street address but no LocalBusiness JSON-LD, so Google and AI assistants have to guess your address, hours and phone from the page text.

  View source

• No phone number on the homepage

  A local customer looking to call finds no phone number on the homepage. Add one, ideally as a tap-to-call link.

• No direct contact details

  No phone number or email link on the homepage, so ready-to-buy visitors have one fewer way to reach you.

• No opening hours

  The homepage shows no opening hours. If customers visit or call, show when.

• No form on the homepage

  There is no form on the homepage, so every lead has to click through to another page first.

• No map or directions link

  There is no link to Google or Apple Maps. A directions link is one tap for a phone visitor.

• No risk reducer

  No guarantee or risk reducer (money-back, free trial, no credit card) is mentioned, which is often what tips a hesitant visitor.

• About 2,628 words of copy

  The homepage carries about 2,628 words of visible text.

• Email authentication score: 100/100

  Email authentication: SPF record 25 points, plus 15 when it ends in -all (10 for ~all); DMARC record 25, plus 25 for a reject policy (15 for quarantine); a DKIM key on a common selector 10.

• 1 tracker load before any consent

  1

  Before a visitor clicks anything, the page loads Google Tag Manager (measured from a US location before any click). A consent tool (TrustArc) is installed; check it blocks these until visitors agree where the law requires it.

• 4 cookies set on arrival

  4

  Opening the homepage sets 4 cookies (measured from a US location before any click).

• 3 other companies contacted

  Loading the homepage contacts 3 hosts run by other companies (fonts, scripts, analytics, ads), each of which sees the visitor's IP address.