getdivvy.com website review

Not measured in this review.

• Fails Core Web Vitals for real visitors

  Real Chrome users on phones do not pass Google's Core Web Vitals on your site (28-day field data from the Chrome UX Report (opens in a new tab)). Google uses this in ranking.

• Real-user CLS: 0.28

  0.28

  For real visitors the layout shifts by 0.28 (75th percentile). Good is under 0.1.

• Real-user INP: 269 ms

  269 ms

  Real visitors wait 269 ms for the page to respond to a tap (75th percentile). Good is under 200 ms.

• Real-user FCP: 2.0 s

  2.0 s

  Real visitors see the first content after 2.0 s (75th percentile). Good is under 1.8 s.

• Real-user TTFB: 980 ms

  980 ms

  Real visitors wait 980 ms for your server to start answering (75th percentile). Good is under 800 ms.

• Tap response (INP) held steady for real visitors

  +2%

  Over the last 25 four-week periods to 2026-10-24, real Chrome visitors' tap response (inp) went from 261 ms to 268 ms at the 75th percentile (Chrome UX Report (opens in a new tab) history).

• Largest content (LCP) got 18% slower for real visitors

  +18%

  Over the last 25 four-week periods to 2026-10-24, real Chrome visitors' largest content (lcp) went from 2.0 s to 2.4 s at the 75th percentile (Chrome UX Report (opens in a new tab) history).

• Page weight: 2.0 MB

  2.0 MB

  Your homepage downloads 2.0 MB on a phone, 34 KiB of it images (2%). Under 2 MB keeps phones on slow connections fast.

• About 0.6 g of CO₂ per visit

  0.57 g

  By the Sustainable Web Design model, a visit to your homepage emits about 0.57 g of CO₂e: 68.4 kg a year at 10,000 visits a month. It scales with page weight, so every byte cut lowers it.

• 3 text elements with low contrast

  3 text elements don't have enough contrast against the background to read easily, especially outdoors on a phone.

  Elements (3)

• 114 form fields without a label

  114 form fields have no label, so screen readers announce an empty box and autofill guesses.

  View source

• All page content should be contained by landmarks (1 element)

  All page content should be contained by landmarks: 1 element on the page fails this check, rated moderate by axe-core.

  Elements (1)

• 9 links without text

  9 visible links have no text or label, so screen readers cannot say where they go.

  Elements (3)

• Headings should not be empty (1 element)

  Headings should not be empty: 1 element on the page fails this check, rated minor by axe-core.

  Elements (1)

• No structured data

  No structured data (JSON-LD), so Google can't show rich results such as your logo, ratings or FAQs.

• No XML sitemap

  No XML sitemap at https://www.bill.com/sitemap.xml, so Google discovers your pages only by following links.

• 421 internal links, 32 external

  The homepage links to 421 pages on getdivvy.com and 32 external pages.

• No Organization structured data

  There is no Organization (or LocalBusiness) JSON-LD, so search engines and AI assistants have no machine-readable facts about who runs the site: its name, logo, profiles and contact details.

• 4 pages slow to respond

  /, /product/accounts-payable, /product/accounts-receivable and /product/cash-flow-forecasting took over 3 s to send their HTML from our server.

• 15 internal pages checked

  We fetched 15 pages linked from your homepage (of 113 found) and read each the way a search engine does.

• 4 small tap targets

  4 of 9 tappable elements near the top of the page are smaller than 24 px, hard to hit with a thumb.

• 2 JavaScript errors while loading

  2 errors were logged to the browser console while the page loaded, for example “wf.push is not a function”.

• No Content-Security-Policy

  No Content-Security-Policy header, the main browser-side defence against injected scripts.

• No clickjacking protection

  Neither X-Frame-Options nor a CSP frame-ancestors policy is set, so any site can embed yours in a frame.

• No X-Content-Type-Options

  X-Content-Type-Options: nosniff is missing, so browsers may guess file types.

• 1 link through redirect chains

  1 link go through two or more redirects, for example https://billcommunity.bettermode.io/.

• No Referrer-Policy

  No Referrer-Policy header, so full URLs can leak to the sites you link to.

• No Permissions-Policy

  No Permissions-Policy header to switch off camera, microphone and location for embedded content.

• No security.txt

  There is no /.well-known/security.txt telling researchers how to report a security problem to you.

• No CAA record

  bill.com has no CAA record, so any certificate authority may issue a certificate for it. A CAA record naming your provider (for example letsencrypt.org) closes that door.

• DNSSEC is off

  bill.com's DNS answers are not signed. DNSSEC stops attackers forging them to send visitors or email elsewhere; most registrars switch it on in a click, though most sites still run without it.

• No call to action on the first screen

  On a phone, there is no call to action on the first screen: visitors have to scroll to find out what to do next.

• A 13-field form

  Your longest form asks for 13 fields (8 required). Every extra field lowers completion.

  View source

• No direct contact details

  No phone number or email link on the homepage, so ready-to-buy visitors have one fewer way to reach you.

• About 1,630 words of copy

  The homepage carries about 1,630 words of visible text.

• Email authentication score: 90/100

  Email authentication: SPF record 25 points, plus 15 when it ends in -all (10 for ~all); DMARC record 25, plus 25 for a reject policy (15 for quarantine); a DKIM key on a common selector 10.

• 4 trackers load before any consent

  4

  Before a visitor clicks anything, the page loads Google Ads, Google Analytics, Google Tag Manager and Segment (measured from a US location before any click). A consent tool (OneTrust) is installed; check it blocks these until visitors agree where the law requires it.

• 14 cookies set on arrival

  14

  Opening the homepage sets 14 cookies (measured from a US location before any click).

• 34 other companies contacted

  Loading the homepage contacts 34 hosts run by other companies (fonts, scripts, analytics, ads), each of which sees the visitor's IP address.