heb.com website review

Not measured in this review.

• Real-user TTFB: 890 ms

  890 ms

  Real visitors wait 890 ms for your server to start answering (75th percentile). Good is under 800 ms.

• Tap response (INP) held steady for real visitors

  -6%

  Over the last 25 four-week periods to 2026-10-03, real Chrome visitors' tap response (inp) went from 172 ms to 163 ms at the 75th percentile (Chrome UX Report (opens in a new tab) history).

• About 0.08 g of CO₂ per visit

  0.08 g

  By the Sustainable Web Design model, a visit to your homepage emits about 0.08 g of CO₂e: 9.3 kg a year at 10,000 visits a month. It scales with page weight, so every byte cut lowers it.

• Documents must have <title> element to aid in navigation (1 element)

  Documents must have <title> element to aid in navigation: 1 element on the page fails this check, rated serious by axe-core.

  Elements (1)

• <html> element must have a lang attribute (1 element)

  <html> element must have a lang attribute: 1 element on the page fails this check, rated serious by axe-core.

  Elements (1)

• No main landmark

  The page has no <main> landmark, so screen-reader users cannot jump straight to the content.

  Elements (1)

• Page should contain a level-one heading (1 element)

  Page should contain a level-one heading: 1 element on the page fails this check, rated moderate by axe-core.

  Elements (1)

• No page language

  The <html> element has no lang attribute, so screen readers may read the page in the wrong voice and accent.

  View source

• Page is set to noindex

  The robots meta tag says “noindex,nofollow”: Google is told not to list this page at all.

  View source

• No page title

  Your page has no <title>, so Google has to invent the blue link in search results.

• No meta description

  No meta description, so Google writes its own snippet from whatever text it finds.

• No H1 headline

  There is no <h1>, so neither visitors nor Google get a clear main headline.

• No structured data

  No structured data (JSON-LD), so Google can't show rich results such as your logo, ratings or FAQs.

• No canonical URL

  No canonical URL, so duplicate versions of the homepage (with or without www, with tracking parameters) can split ranking signals.

• No social preview image

  No Open Graph image (also missing: og:title, og:description), so links shared on LinkedIn, Slack or Facebook show no preview picture.

• No XML sitemap

  No XML sitemap at https://www.heb.com/sitemap/siteindex.xml, so Google discovers your pages only by following links.

• Only 0 internal links

  The homepage links to only 0 pages on your own site, so visitors and crawlers find few routes into the rest of it.

• No favicon declared

  No favicon is declared in the HTML, so browser tabs and Google's mobile results may show a generic icon.

• No X (Twitter) card tag

  No twitter:card tag. X falls back to Open Graph, which is incomplete here.

• No Organization structured data

  There is no Organization (or LocalBusiness) JSON-LD, so search engines and AI assistants have no machine-readable facts about who runs the site: its name, logo, profiles and contact details.

• No llms.txt

  There is no /llms.txt, a short Markdown guide to your key pages for AI tools (llmstxt.org). It is optional and few AI tools read it yet, so treat it as a cheap extra.

• No mobile viewport

  No viewport meta tag, so phones render the desktop layout zoomed out.

• No HTML doctype

  The page has no <!DOCTYPE html>, so browsers render it in quirks mode.

• No character set

  No character set is declared, so some characters can render as gibberish.

• No Content-Security-Policy

  No Content-Security-Policy header, the main browser-side defence against injected scripts.

• No clickjacking protection

  Neither X-Frame-Options nor a CSP frame-ancestors policy is set, so any site can embed yours in a frame.

• No X-Content-Type-Options

  X-Content-Type-Options: nosniff is missing, so browsers may guess file types.

• No Referrer-Policy

  No Referrer-Policy header, so full URLs can leak to the sites you link to.

• No Permissions-Policy

  No Permissions-Policy header to switch off camera, microphone and location for embedded content.

• No security.txt

  There is no /.well-known/security.txt telling researchers how to report a security problem to you.

• No CAA record

  heb.com has no CAA record, so any certificate authority may issue a certificate for it. A CAA record naming your provider (for example letsencrypt.org) closes that door.

• DNSSEC is off

  heb.com's DNS answers are not signed. DNSSEC stops attackers forging them to send visitors or email elsewhere; most registrars switch it on in a click, though most sites still run without it.

• No call to action on the first screen

  On a phone, there is no call to action on the first screen: visitors have to scroll to find out what to do next.

• No calls to action

  We found no call-to-action buttons or links (such as “Book a demo” or “Get a quote”) anywhere on the homepage.

• No social proof

  No testimonials, customer logos, ratings or customer counts on the homepage: nothing tells a new visitor that others already trust you.

• No analytics detected

  No analytics or tag manager detected in the HTML, so you can't measure whether any of these fixes work.

• No direct contact details

  No phone number or email link on the homepage, so ready-to-buy visitors have one fewer way to reach you.

• Only about 0 words

  The homepage has only about 0 words of visible text; thin pages give Google and first-time buyers little to go on.

• No form on the homepage

  There is no form on the homepage, so every lead has to click through to another page first.

• No risk reducer

  No guarantee or risk reducer (money-back, free trial, no credit card) is mentioned, which is often what tips a hesitant visitor.

• Email authentication score: 100/100

  Email authentication: SPF record 25 points, plus 15 when it ends in -all (10 for ~all); DMARC record 25, plus 25 for a reject policy (15 for quarantine); a DKIM key on a common selector 10.

• 2 cookies set on arrival

  2

  Opening the homepage sets 2 cookies (measured from a US location before any click).

• No consent tool detected

  No known cookie consent tool loads with the page. Some sites build their own banner, and some only show one to visitors from the EU.