curlsmith.com website review

Not measured in this review.

• Tap response (INP) got 32% slower for real visitors

  +32%

  Over the last 25 four-week periods to 2026-10-31, real Chrome visitors' tap response (inp) went from 138 ms to 179 ms at the 75th percentile (Chrome UX Report (opens in a new tab) history).

• Largest content (LCP) held steady for real visitors

  -9%

  Over the last 25 four-week periods to 2026-10-31, real Chrome visitors' largest content (lcp) went from 1.6 s to 1.5 s at the 75th percentile (Chrome UX Report (opens in a new tab) history).

• Page weight: 3.5 MB

  3.5 MB

  Your homepage downloads 3.5 MB on a phone, 465 KiB of it images (13%). Under 2 MB keeps phones on slow connections fast.

• About 1.0 g of CO₂ per visit

  1.00 g

  By the Sustainable Web Design model, a visit to your homepage emits about 1.00 g of CO₂e: 120.3 kg a year at 10,000 visits a month. It scales with page weight, so every byte cut lowers it.

• Links must have discernible text (3 elements)

  Links must have discernible text: 3 elements on the page fail this check, rated serious by axe-core.

  Elements (3)

• All page content should be contained by landmarks (3 elements)

  All page content should be contained by landmarks: 3 elements on the page fail this check, rated moderate by axe-core.

  Elements (3)

• Title is short (29 characters)

  Your title is only 29 characters: “CURLSMITH - GOURMET CURL CARE”. Between 30 and 65 characters leaves room to say what you do and for whom.

  View source

• No X (Twitter) card tag

  No twitter:card tag. X falls back to Open Graph, which is set, so this is minor.

• 187 internal links, 17 external

  The homepage links to 187 pages on curlsmith.com and 17 external pages.

• 2 pages without a meta description

  /pages/subscriptions and /pages/rewards have no meta description, so Google writes the search snippet from whatever text it finds.

  Elements (2)

• 15 internal pages checked

  We fetched 15 pages linked from your homepage (of 68 found) and read each the way a search engine does.

• 2 broken images

  2 images failed to load on a phone, for example https://bat.bing.com/action/0?ti=17187368&tm=gtm002&Ver=2&mid=b43c70d3-4291-4b4c-9a49-eabeea468d83&bo=1&sid=81321130d82e11f1b1c3933963cb7109&vid=81324600d82e11f1a3c4cfbc1a353b41&vids=1&msclkid=N&pi=91.

• 7 small tap targets

  7 of 32 tappable elements near the top of the page are smaller than 24 px, hard to hit with a thumb.

• 3 JavaScript errors while loading

  3 errors were logged to the browser console while the page loaded, for example “Failed to load resource: net::ERR_TUNNEL_CONNECTION_FAILED”.

• Short HSTS lifetime

  HSTS is set, but max-age is 91 days; one year is the recommended minimum.

• No Referrer-Policy

  No Referrer-Policy header, so full URLs can leak to the sites you link to.

• No Permissions-Policy

  No Permissions-Policy header to switch off camera, microphone and location for embedded content.

• Deprecated X-XSS-Protection

  X-XSS-Protection is set to “1; mode=block”; the header is deprecated and can introduce bugs. Use 0 or remove it.

• No security.txt

  There is no /.well-known/security.txt telling researchers how to report a security problem to you.

• No CAA record

  curlsmith.com has no CAA record, so any certificate authority may issue a certificate for it. A CAA record naming your provider (for example letsencrypt.org) closes that door.

• DNSSEC is off

  curlsmith.com's DNS answers are not signed. DNSSEC stops attackers forging them to send visitors or email elsewhere; most registrars switch it on in a click, though most sites still run without it.

• Local business without LocalBusiness data

  Your homepage shows a street address but no LocalBusiness JSON-LD, so Google and AI assistants have to guess your address, hours and phone from the page text.

  View source

• No phone number on the homepage

  A local customer looking to call finds no phone number on the homepage. Add one, ideally as a tap-to-call link.

• Thin social proof

  Social proof on the homepage: 6 testimonial or review blocks. Pairing it with named testimonials or customer logos makes it far more convincing.

• No direct contact details

  No phone number or email link on the homepage, so ready-to-buy visitors have one fewer way to reach you.

• No opening hours

  The homepage shows no opening hours. If customers visit or call, show when.

• No map or directions link

  There is no link to Google or Apple Maps. A directions link is one tap for a phone visitor.

• No risk reducer

  No guarantee or risk reducer (money-back, free trial, no credit card) is mentioned, which is often what tips a hesitant visitor.

• About 500 words of copy

  The homepage carries about 500 words of visible text.

• Urgency cues

  The page uses urgency cues (a countdown or limited-time wording).

• DMARC is monitor-only (p=none)

  DMARC is set to p=none, so mail pretending to be curlsmith.com is still delivered. Reports are on, so moving to quarantine is the next step.

• Email authentication score: 70/100

  Email authentication: SPF record 25 points, plus 15 when it ends in -all (10 for ~all); DMARC record 25, plus 25 for a reject policy (15 for quarantine); a DKIM key on a common selector 10.

• 10 trackers load before any consent

  10

  Before a visitor clicks anything, the page loads Amazon Ads, Google Ads, Google Analytics, Google Tag Manager and Klaviyo and 5 mores (measured from a US location before any click). A consent tool (TrustArc) is installed; check it blocks these until visitors agree where the law requires it.

• 25 cookies set on arrival

  25

  Opening the homepage sets 25 cookies, 1 of them by other companies (measured from a US location before any click).

• 63 other companies contacted

  Loading the homepage contacts 63 hosts run by other companies (fonts, scripts, analytics, ads), each of which sees the visitor's IP address.