first4figures.com website review

Not measured in this review.

• Tap response (INP) held steady for real visitors

  +9%

  Over the last 25 four-week periods to 2026-10-31, real Chrome visitors' tap response (inp) went from 113 ms to 126 ms at the 75th percentile (Chrome UX Report (opens in a new tab) history).

• Largest content (LCP) held steady for real visitors

  -9%

  Over the last 25 four-week periods to 2026-10-31, real Chrome visitors' largest content (lcp) went from 1.9 s to 1.7 s at the 75th percentile (Chrome UX Report (opens in a new tab) history).

• Page weight: 3.0 MB

  3.0 MB

  Your homepage downloads 3.0 MB on a phone, 280 KiB of it images (9%). Under 2 MB keeps phones on slow connections fast.

• About 0.9 g of CO₂ per visit

  0.85 g

  By the Sustainable Web Design model, a visit to your homepage emits about 0.85 g of CO₂e: 102.5 kg a year at 10,000 visits a month. It scales with page weight, so every byte cut lowers it.

• [role="img"] and [role="image"] elements must have alternative text (44 elements)

  [role="img"] and [role="image"] elements must have alternative text: 44 elements on the page fail this check, rated serious by axe-core.

  Elements (3)

• 9 text elements with low contrast

  9 text elements don't have enough contrast against the background to read easily, especially outdoors on a phone.

  Elements (3)

• All page content should be contained by landmarks (4 elements)

  All page content should be contained by landmarks: 4 elements on the page fail this check, rated moderate by axe-core.

  Elements (3)

• Landmarks should have a unique role or role/label/title (i.e. accessible name) combination (1 element)

  Landmarks should have a unique role or role/label/title (i.e. accessible name) combination: 1 element on the page fails this check, rated moderate by axe-core.

  Elements (1)

• Title is long (70 characters)

  Your title is 70 characters, so Google will cut it off around 60: “First 4 Figures - Leading global manufacturer of licensed collectibles”.

  View source

• 70 internal links, 11 external

  The homepage links to 70 pages on first4figures.com and 11 external pages.

• Organization data is thin (2 of 6 facts)

  Your Organization JSON-LD is missing logo, sameAs (social profiles), description and contact details. These are the facts AI assistants use to describe a business and to tell it apart from others with a similar name.

  View source

• 15 links to non-canonical URLs

  Your homepage links to 15 pages by a URL that isn't their canonical one, for example /collections/highlight-latest-additions/products/tears-of-the-kingdom-zelda-exclusive-edition, whose canonical is /products/tears-of-the-kingdom-zelda-exclusive-edition. Linking straight to the canonical URL saves crawlers a detour and keeps ranking signals on one address.

  Elements (8)

• 1 page without an H1

  /collections/highlight-latest-additions/products/sonic-frontiers-sonic-the-hedgehog-and-super-sonic-combo-edition has no <h1> headline, so visitors and search engines get no clear main topic.

• 1 page with very little text

  /collections/highlight-latest-additions/products/sonic-frontiers-sonic-the-hedgehog-and-super-sonic-combo-edition has under 150 words in the HTML. Thin pages rarely rank; if the text loads with JavaScript, crawlers that don't run it see even less.

• 15 internal pages checked

  We fetched 15 pages linked from your homepage (of 59 found) and read each the way a search engine does.

• 1 JavaScript error while loading

  1 error was logged to the browser console while the page loaded, for example “Cannot read properties of null (reading 'text')”.

• Short HSTS lifetime

  HSTS is set, but max-age is 91 days; one year is the recommended minimum.

• No Referrer-Policy

  No Referrer-Policy header, so full URLs can leak to the sites you link to.

• No Permissions-Policy

  No Permissions-Policy header to switch off camera, microphone and location for embedded content.

• Deprecated X-XSS-Protection

  X-XSS-Protection is set to “1; mode=block”; the header is deprecated and can introduce bugs. Use 0 or remove it.

• No security.txt

  There is no /.well-known/security.txt telling researchers how to report a security problem to you.

• No CAA record

  first4figures.com has no CAA record, so any certificate authority may issue a certificate for it. A CAA record naming your provider (for example letsencrypt.org) closes that door.

• DNSSEC is off

  first4figures.com's DNS answers are not signed. DNSSEC stops attackers forging them to send visitors or email elsewhere; most registrars switch it on in a click, though most sites still run without it.

• No call to action on the first screen

  On a phone, there is no call to action on the first screen: visitors have to scroll to find out what to do next.

• Thin social proof

  Social proof on the homepage: a star rating. Pairing it with named testimonials or customer logos makes it far more convincing.

• No analytics detected

  No analytics or tag manager detected in the HTML, so you can't measure whether any of these fixes work.

• No risk reducer

  No guarantee or risk reducer (money-back, free trial, no credit card) is mentioned, which is often what tips a hesitant visitor.

• About 1,059 words of copy

  The homepage carries about 1,059 words of visible text.

• Urgency cues

  The page uses urgency cues (a countdown or limited-time wording).

• Email authentication score: 85/100

  Email authentication: SPF record 25 points, plus 15 when it ends in -all (10 for ~all); DMARC record 25, plus 25 for a reject policy (15 for quarantine); a DKIM key on a common selector 10.

• 6 trackers load before any consent

  6

  Before a visitor clicks anything, the page loads Google Ads, Google Analytics, Google Tag Manager, Klaviyo and Meta Pixel and 1 more (measured from a US location before any click). No consent tool was detected. Visitors from the EU, UK and several US states must be asked first.

• 18 cookies set on arrival

  18

  Opening the homepage sets 18 cookies (measured from a US location before any click).

• No consent tool detected

  No known cookie consent tool loads with the page. Some sites build their own banner, and some only show one to visitors from the EU.

• 41 other companies contacted

  Loading the homepage contacts 41 hosts run by other companies (fonts, scripts, analytics, ads), each of which sees the visitor's IP address.