graffeo.com website review

Not measured in this review.

• Tap response (INP) got 15% slower for real visitors

  +15%

  Over the last 25 four-week periods to 2026-10-31, real Chrome visitors' tap response (inp) went from 96 ms to 111 ms at the 75th percentile (Chrome UX Report (opens in a new tab) history).

• Largest content (LCP) held steady for real visitors

  +8%

  Over the last 25 four-week periods to 2026-10-31, real Chrome visitors' largest content (lcp) went from 1.4 s to 1.5 s at the 75th percentile (Chrome UX Report (opens in a new tab) history).

• Page weight: 2.8 MB

  2.8 MB

  Your homepage downloads 2.8 MB on a phone, 288 KiB of it images (10%). Under 2 MB keeps phones on slow connections fast.

• About 0.8 g of CO₂ per visit

  0.81 g

  By the Sustainable Web Design model, a visit to your homepage emits about 0.81 g of CO₂e: 96.9 kg a year at 10,000 visits a month. It scales with page weight, so every byte cut lowers it.

• 1 text element with low contrast

  1 text element doesn't have enough contrast against the background to read easily, especially outdoors on a phone.

  Elements (1)

• Title is short (14 characters)

  Your title is only 14 characters: “Graffeo Coffee”. Between 30 and 65 characters leaves room to say what you do and for whom.

  View source

• Meta description is long (250 characters)

  Your meta description is 250 characters; Google truncates after about 160, so the end of your pitch is cut.

  View source

• No X (Twitter) card tag

  No twitter:card tag. X falls back to Open Graph, which is set, so this is minor.

• 65 internal links, 3 external

  The homepage links to 65 pages on graffeo.com and 3 external pages.

• 5 linked pages hidden from search

  /products/the-legacy-gift-set, /products/the-north-beach-gift-set, /products/the-ultimate-gift-set, /pages/graffeo-subscriptionkit and /products/2-lb-essentials-kit-hat are marked noindex but linked from your homepage. If they are meant to be found, remove the noindex.

  Elements (5)

• 1 page without a meta description

  /collections/all has no meta description, so Google writes the search snippet from whatever text it finds.

  Elements (1)

• 7 pages without an H1

  /pages/graffeo-gifting2026, /products/graffeo-dark-roast, /products/graffeo-light-roast, /products/graffeo-swiss-water-decaf, /products/graffeo-custom-blends and /pages/graffeo-subscriptionkit and 1 other have no <h1> headline, so visitors and search engines get no clear main topic.

• 15 internal pages checked

  We fetched 15 pages linked from your homepage (of 21 found) and read each the way a search engine does.

• 3 small tap targets

  3 of 14 tappable elements near the top of the page are smaller than 24 px, hard to hit with a thumb.

• 2 JavaScript errors while loading

  2 errors were logged to the browser console while the page loaded, for example “Failed to load resource: the server responded with a status of 404 ()”.

• Short HSTS lifetime

  HSTS is set, but max-age is 91 days; one year is the recommended minimum.

• 1 link through redirect chains

  1 link go through two or more redirects, for example https://graffeo.com/account.

• No Referrer-Policy

  No Referrer-Policy header, so full URLs can leak to the sites you link to.

• No Permissions-Policy

  No Permissions-Policy header to switch off camera, microphone and location for embedded content.

• Deprecated X-XSS-Protection

  X-XSS-Protection is set to “1; mode=block”; the header is deprecated and can introduce bugs. Use 0 or remove it.

• No security.txt

  There is no /.well-known/security.txt telling researchers how to report a security problem to you.

• No CAA record

  graffeo.com has no CAA record, so any certificate authority may issue a certificate for it. A CAA record naming your provider (for example letsencrypt.org) closes that door.

• DNSSEC is off

  graffeo.com's DNS answers are not signed. DNSSEC stops attackers forging them to send visitors or email elsewhere; most registrars switch it on in a click, though most sites still run without it.

• No call to action on the first screen

  On a phone, there is no call to action on the first screen: visitors have to scroll to find out what to do next.

• Thin social proof

  Social proof on the homepage: 5 testimonial or review blocks. Pairing it with named testimonials or customer logos makes it far more convincing.

• No risk reducer

  No guarantee or risk reducer (money-back, free trial, no credit card) is mentioned, which is often what tips a hesitant visitor.

• About 338 words of copy

  The homepage carries about 338 words of visible text.

• DMARC is monitor-only (p=none)

  DMARC is set to p=none, so mail pretending to be graffeo.com is still delivered. Reports are on, so moving to quarantine is the next step.

• Email authentication score: 75/100

  Email authentication: SPF record 25 points, plus 15 when it ends in -all (10 for ~all); DMARC record 25, plus 25 for a reject policy (15 for quarantine); a DKIM key on a common selector 10.

• 5 trackers load before any consent

  5

  Before a visitor clicks anything, the page loads Google Ads, Google Tag Manager, Klaviyo, Meta Pixel and Microsoft Clarity (measured from a US location before any click). No consent tool was detected. Visitors from the EU, UK and several US states must be asked first.

• 29 cookies set on arrival

  29

  Opening the homepage sets 29 cookies (measured from a US location before any click).

• No consent tool detected

  No known cookie consent tool loads with the page. Some sites build their own banner, and some only show one to visitors from the EU.

• 42 other companies contacted

  Loading the homepage contacts 42 hosts run by other companies (fonts, scripts, analytics, ads), each of which sees the visitor's IP address.