escentual.com website review

Not measured in this review.

• Fails Core Web Vitals for real visitors

  Real Chrome users on phones do not pass Google's Core Web Vitals on your site (28-day field data from the Chrome UX Report (opens in a new tab)). Google uses this in ranking.

• Real-user INP: 349 ms

  349 ms

  Real visitors wait 349 ms for the page to respond to a tap (75th percentile). Good is under 200 ms.

• Tap response (INP) got 102% slower for real visitors

  +102%

  Over the last 25 four-week periods to 2026-10-31, real Chrome visitors' tap response (inp) went from 172 ms to 353 ms at the 75th percentile (Chrome UX Report (opens in a new tab) history).

• About 0.1 g of CO₂ per visit

  0.11 g

  By the Sustainable Web Design model, a visit to your homepage emits about 0.11 g of CO₂e: 13.8 kg a year at 10,000 visits a month. It scales with page weight, so every byte cut lowers it.

• Delayed refresh under 20 hours must not be used (1 element)

  Delayed refresh under 20 hours must not be used: 1 element on the page fails this check, rated critical by axe-core.

  Elements (1)

• 1 image without alt text

  1 image has no alt text, which hurts accessibility and image search.

• All page content should be contained by landmarks (1 element)

  All page content should be contained by landmarks: 1 element on the page fails this check, rated moderate by axe-core.

  Elements (1)

• Headings should not be empty (1 element)

  Headings should not be empty: 1 element on the page fails this check, rated minor by axe-core.

  Elements (1)

• 2 H1 headlines

  There are 2 <h1> headlines (“Escentual” and “Collection:”). One clear main headline is easier for people and search engines.

• Meta description is long (215 characters)

  Your meta description is 215 characters; Google truncates after about 160, so the end of your pitch is cut.

  View source

• 550 internal links, 10 external

  The homepage links to 550 pages on escentual.com and 10 external pages.

• Organization data is thin (3 of 6 facts)

  Your Organization JSON-LD is missing logo, description and contact details. These are the facts AI assistants use to describe a business and to tell it apart from others with a similar name.

• No llms.txt

  There is no /llms.txt, a short Markdown guide to your key pages for AI tools (llmstxt.org). It is optional and few AI tools read it yet, so treat it as a cheap extra.

• 2 pages without a meta description

  /policies/shipping-policy and /collections/haircare-offers have no meta description, so Google writes the search snippet from whatever text it finds.

  Elements (2)

• 2 pages without an H1

  /policies/shipping-policy and /collections/haircare-offers have no <h1> headline, so visitors and search engines get no clear main topic.

• 15 internal pages checked

  We fetched 15 pages linked from your homepage (of 183 found) and read each the way a search engine does.

• 3 JavaScript errors while loading

  3 errors were logged to the browser console while the page loaded, for example “Failed to load resource: the server responded with a status of 429 ()”.

• Short HSTS lifetime

  HSTS is set, but max-age is 91 days; one year is the recommended minimum.

• 1 link through redirect chains

  1 link go through two or more redirects, for example https://shopify.com/85318631748/account/.

• No Referrer-Policy

  No Referrer-Policy header, so full URLs can leak to the sites you link to.

• No Permissions-Policy

  No Permissions-Policy header to switch off camera, microphone and location for embedded content.

• Deprecated X-XSS-Protection

  X-XSS-Protection is set to “1; mode=block”; the header is deprecated and can introduce bugs. Use 0 or remove it.

• No security.txt

  There is no /.well-known/security.txt telling researchers how to report a security problem to you.

• No CAA record

  escentual.com has no CAA record, so any certificate authority may issue a certificate for it. A CAA record naming your provider (for example letsencrypt.org) closes that door.

• DNSSEC is off

  escentual.com's DNS answers are not signed. DNSSEC stops attackers forging them to send visitors or email elsewhere; most registrars switch it on in a click, though most sites still run without it.

• No call to action on the first screen

  On a phone, there is no call to action on the first screen: visitors have to scroll to find out what to do next.

• No social proof

  No testimonials, customer logos, ratings or customer counts on the homepage: nothing tells a new visitor that others already trust you.

• No analytics detected

  No analytics or tag manager detected in the HTML, so you can't measure whether any of these fixes work.

• Only about 10 words

  The homepage has only about 10 words of visible text; thin pages give Google and first-time buyers little to go on.

• Email authentication score: 95/100

  Email authentication: SPF record 25 points, plus 15 when it ends in -all (10 for ~all); DMARC record 25, plus 25 for a reject policy (15 for quarantine); a DKIM key on a common selector 10.

• No consent tool detected

  No known cookie consent tool loads with the page. Some sites build their own banner, and some only show one to visitors from the EU.

• 2 other companies contacted

  Loading the homepage contacts 2 hosts run by other companies (fonts, scripts, analytics, ads), each of which sees the visitor's IP address.