grenade.com website review

Not measured in this review.

• Tap response (INP) got 14% slower for real visitors

  +14%

  Over the last 25 four-week periods to 2026-10-31, real Chrome visitors' tap response (inp) went from 140 ms to 166 ms at the 75th percentile (Chrome UX Report (opens in a new tab) history).

• Largest content (LCP) held steady for real visitors

  -6%

  Over the last 25 four-week periods to 2026-10-31, real Chrome visitors' largest content (lcp) went from 1.6 s to 1.6 s at the 75th percentile (Chrome UX Report (opens in a new tab) history).

• Page weight: 2.9 MB

  2.9 MB

  Your homepage downloads 2.9 MB on a phone, 731 KiB of it images (25%). Under 2 MB keeps phones on slow connections fast.

• 1 image below the first screen load straight away

  1 image further down the page (63 KiB) download before anyone scrolls to it. Adding loading="lazy" lets the first screen load first.

  Elements (1)

• About 0.8 g of CO₂ per visit

  0.81 g

  By the Sustainable Web Design model, a visit to your homepage emits about 0.81 g of CO₂e: 97.7 kg a year at 10,000 visits a month. It scales with page weight, so every byte cut lowers it.

• ARIA attributes must conform to valid names (1 element)

  ARIA attributes must conform to valid names: 1 element on the page fails this check, rated critical by axe-core.

  Elements (1)

• 16 text elements with low contrast

  16 text elements don't have enough contrast against the background to read easily, especially outdoors on a phone.

  Elements (3)

• 2 tap targets too small

  2 tap targets are too small or too close together to hit reliably with a finger.

  Elements (2)

• ARIA commands must have an accessible name (1 element)

  ARIA commands must have an accessible name: 1 element on the page fails this check, rated serious by axe-core.

  Elements (1)

• Contentinfo landmark should not be contained in another landmark (1 element)

  Contentinfo landmark should not be contained in another landmark: 1 element on the page fails this check, rated moderate by axe-core.

  Elements (1)

• Document should not have more than one contentinfo landmark (1 element)

  Document should not have more than one contentinfo landmark: 1 element on the page fails this check, rated moderate by axe-core.

  Elements (1)

• Landmarks should have a unique role or role/label/title (i.e. accessible name) combination (1 element)

  Landmarks should have a unique role or role/label/title (i.e. accessible name) combination: 1 element on the page fails this check, rated moderate by axe-core.

  Elements (1)

• All page content should be contained by landmarks (1 element)

  All page content should be contained by landmarks: 1 element on the page fails this check, rated moderate by axe-core.

  Elements (1)

• ARIA role should be appropriate for the element (17 elements)

  ARIA role should be appropriate for the element: 17 elements on the page fail this check, rated minor by axe-core.

  Elements (3)

• 1 link without text

  1 visible link has no text or label, so screen readers cannot say where it goes.

  Elements (3)

• Alternative text of images should not be repeated as text (7 elements)

  Alternative text of images should not be repeated as text: 7 elements on the page fail this check, rated minor by axe-core.

  Elements (3)

• Headings skip levels

  Headings skip levels (h2 → h4), which makes the page harder to scan with a screen reader.

  View sourceElements (1)

• One H1 headline

  Your <h1> is empty.

  View source

• 161 internal links, 16 external

  The homepage links to 161 pages on grenade.com and 16 external pages.

• 1 linked page hidden from search

  /products/2026-protein-bar-advent-calendar is marked noindex but linked from your homepage. If it is meant to be found, remove the noindex.

  Elements (1)

• 3 pages without a meta description

  /collections/all, /collections/soft-core-protein-bars and /collections/protein-bar-bundles-subscribe-save have no meta description, so Google writes the search snippet from whatever text it finds.

  Elements (3)

• 15 internal pages checked

  We fetched 15 pages linked from your homepage (of 55 found) and read each the way a search engine does.

• 19 small tap targets

  19 of 66 tappable elements near the top of the page are smaller than 24 px, hard to hit with a thumb.

• Short HSTS lifetime

  HSTS is set, but max-age is 91 days; one year is the recommended minimum.

• 3 links through redirect chains

  3 links go through two or more redirects, for example https://www.grenade.com/customer_authentication/redirect?locale=en&region_country=GB.

• No Referrer-Policy

  No Referrer-Policy header, so full URLs can leak to the sites you link to.

• No Permissions-Policy

  No Permissions-Policy header to switch off camera, microphone and location for embedded content.

• Deprecated X-XSS-Protection

  X-XSS-Protection is set to “1; mode=block”; the header is deprecated and can introduce bugs. Use 0 or remove it.

• No security.txt

  There is no /.well-known/security.txt telling researchers how to report a security problem to you.

• DNSSEC is off

  grenade.com's DNS answers are not signed. DNSSEC stops attackers forging them to send visitors or email elsewhere; most registrars switch it on in a click, though most sites still run without it.

• Thin social proof

  Social proof on the homepage: 5 testimonial or review blocks. Pairing it with named testimonials or customer logos makes it far more convincing.

• No direct contact details

  No phone number or email link on the homepage, so ready-to-buy visitors have one fewer way to reach you.

• No risk reducer

  No guarantee or risk reducer (money-back, free trial, no credit card) is mentioned, which is often what tips a hesitant visitor.

• About 1,105 words of copy

  The homepage carries about 1,105 words of visible text.

• Email authentication score: 100/100

  Email authentication: SPF record 25 points, plus 15 when it ends in -all (10 for ~all); DMARC record 25, plus 25 for a reject policy (15 for quarantine); a DKIM key on a common selector 10.

• 7 trackers load before any consent

  7

  Before a visitor clicks anything, the page loads Google Ads, Google Analytics, Google Tag Manager, Meta Pixel and Microsoft Ads and 2 mores (measured from a US location before any click). No consent tool was detected. Visitors from the EU, UK and several US states must be asked first.

• 35 cookies set on arrival

  35

  Opening the homepage sets 35 cookies (measured from a US location before any click).

• No consent tool detected

  No known cookie consent tool loads with the page. Some sites build their own banner, and some only show one to visitors from the EU.

• 43 other companies contacted

  Loading the homepage contacts 43 hosts run by other companies (fonts, scripts, analytics, ads), each of which sees the visitor's IP address.