goodr.com website review

Not measured in this review.

• Fails Core Web Vitals for real visitors

  Real Chrome users on phones do not pass Google's Core Web Vitals on your site (28-day field data from the Chrome UX Report (opens in a new tab)). Google uses this in ranking.

• Real-user CLS: 0.30

  0.30

  For real visitors the layout shifts by 0.30 (75th percentile). Good is under 0.1.

• Tap response (INP) got 15% slower for real visitors

  +15%

  Over the last 25 four-week periods to 2026-10-31, real Chrome visitors' tap response (inp) went from 80 ms to 95 ms at the 75th percentile (Chrome UX Report (opens in a new tab) history).

• Largest content (LCP) held steady for real visitors

  -6%

  Over the last 25 four-week periods to 2026-10-31, real Chrome visitors' largest content (lcp) went from 0.7 s to 0.7 s at the 75th percentile (Chrome UX Report (opens in a new tab) history).

• Page weight: 6.1 MB

  6.1 MB

  Your homepage downloads 6.1 MB on a phone, 2.0 MB of it images (33%). Under 2 MB keeps phones on slow connections fast.

• About 1.7 g of CO₂ per visit

  1.73 g

  By the Sustainable Web Design model, a visit to your homepage emits about 1.73 g of CO₂e: 208.1 kg a year at 10,000 visits a month. It scales with page weight, so every byte cut lowers it.

• 3 text elements with low contrast

  3 text elements don't have enough contrast against the background to read easily, especially outdoors on a phone.

  Elements (3)

• [role="img"] and [role="image"] elements must have alternative text (1 element)

  [role="img"] and [role="image"] elements must have alternative text: 1 element on the page fails this check, rated serious by axe-core.

  Elements (1)

• Document should not have more than one banner landmark (1 element)

  Document should not have more than one banner landmark: 1 element on the page fails this check, rated moderate by axe-core.

  Elements (1)

• Landmarks should have a unique role or role/label/title (i.e. accessible name) combination (1 element)

  Landmarks should have a unique role or role/label/title (i.e. accessible name) combination: 1 element on the page fails this check, rated moderate by axe-core.

  Elements (1)

• 3 links without text

  3 visible links have no text or label, so screen readers cannot say where they go.

  Elements (3)

• Headings skip levels

  Headings skip levels (h1 → h4 and h2 → h4), which makes the page harder to scan with a screen reader.

  View sourceElements (2)

• 2 H1 headlines

  There are 2 <h1> headlines (“goodr Sunglasses” and “Holiday Gifting,Solved.”). One clear main headline is easier for people and search engines.

  View source

• 878 internal links, 7 external

  The homepage links to 878 pages on goodr.com and 7 external pages.

• No Organization structured data

  There is no Organization (or LocalBusiness) JSON-LD, so search engines and AI assistants have no machine-readable facts about who runs the site: its name, logo, profiles and contact details.

• 3 pages without a meta description

  /collections/all-styles, /collections/fashion-collection and /collections/square-sunglasses have no meta description, so Google writes the search snippet from whatever text it finds.

  Elements (3)

• 12 pages without an H1

  /collections/all-styles, /collections/best-sellers, /collections/limited-edition, /collections/prescription-goodr, /collections/high-performance-sports and /collections/fashion-collection and 6 others have no <h1> headline, so visitors and search engines get no clear main topic.

• 15 internal pages checked

  We fetched 15 pages linked from your homepage (of 198 found) and read each the way a search engine does.

• 1 broken image

  1 image failed to load on a phone, for example https://goodr.com/.

• 5 JavaScript errors while loading

  5 errors were logged to the browser console while the page loaded, for example “Cannot read properties of null (reading 'addEventListener')”.

• Short HSTS lifetime

  HSTS is set, but max-age is 91 days; one year is the recommended minimum.

• No Referrer-Policy

  No Referrer-Policy header, so full URLs can leak to the sites you link to.

• No Permissions-Policy

  No Permissions-Policy header to switch off camera, microphone and location for embedded content.

• Deprecated X-XSS-Protection

  X-XSS-Protection is set to “1; mode=block”; the header is deprecated and can introduce bugs. Use 0 or remove it.

• No security.txt

  There is no /.well-known/security.txt telling researchers how to report a security problem to you.

• No CAA record

  goodr.com has no CAA record, so any certificate authority may issue a certificate for it. A CAA record naming your provider (for example letsencrypt.org) closes that door.

• DNSSEC is off

  goodr.com's DNS answers are not signed. DNSSEC stops attackers forging them to send visitors or email elsewhere; most registrars switch it on in a click, though most sites still run without it.

• No direct contact details

  No phone number or email link on the homepage, so ready-to-buy visitors have one fewer way to reach you.

• About 479 words of copy

  The homepage carries about 479 words of visible text.

• DMARC is monitor-only (p=none)

  DMARC is set to p=none, so mail pretending to be goodr.com is still delivered. Reports are on, so moving to quarantine is the next step.

• Email authentication score: 70/100

  Email authentication: SPF record 25 points, plus 15 when it ends in -all (10 for ~all); DMARC record 25, plus 25 for a reject policy (15 for quarantine); a DKIM key on a common selector 10.

• 11 trackers load before any consent

  11

  Before a visitor clicks anything, the page loads Amazon Ads, Google Ads, Google Analytics, Google Tag Manager and Hotjar and 6 mores (measured from a US location before any click). A consent tool (OneTrust) is installed; check it blocks these until visitors agree where the law requires it.

• 36 cookies set on arrival

  36

  Opening the homepage sets 36 cookies, 1 of them by other companies (measured from a US location before any click).

• 65 other companies contacted

  Loading the homepage contacts 65 hosts run by other companies (fonts, scripts, analytics, ads), each of which sees the visitor's IP address.