hp.com website review

Not measured in this review.

• Fails Core Web Vitals for real visitors

  Real Chrome users on phones do not pass Google's Core Web Vitals on your site (28-day field data from the Chrome UX Report (opens in a new tab)). Google uses this in ranking.

• Real-user INP: 520 ms

  520 ms

  Real visitors wait 520 ms for the page to respond to a tap (75th percentile). Good is under 200 ms.

• Real-user LCP: 3.4 s

  3.4 s

  Real visitors wait 3.4 s for the largest content to appear (75th percentile). Good is under 2.5 s.

• Real-user FCP: 2.5 s

  2.5 s

  Real visitors see the first content after 2.5 s (75th percentile). Good is under 1.8 s.

• Real-user TTFB: 1.5 s

  1.5 s

  Real visitors wait 1.5 s for your server to start answering (75th percentile). Good is under 800 ms.

• Tap response (INP) held steady for real visitors

  -5%

  Over the last 25 four-week periods to 2026-10-03, real Chrome visitors' tap response (inp) went from 523 ms to 503 ms at the 75th percentile (Chrome UX Report (opens in a new tab) history).

• Largest content (LCP) held steady for real visitors

  +1%

  Over the last 25 four-week periods to 2026-10-03, real Chrome visitors' largest content (lcp) went from 3.3 s to 3.3 s at the 75th percentile (Chrome UX Report (opens in a new tab) history).

• Page weight: 2.6 MB

  2.6 MB

  Your homepage downloads 2.6 MB on a phone, 932 KiB of it images (36%). Under 2 MB keeps phones on slow connections fast.

• 1 image far larger than shown

  140 KiB

  1 image is downloaded at several times the size a phone draws it, for example all-in-desktop.png at 2,388 px wide, shown at 360 px. Resized copies would save about 140 KiB.

  Elements (1)

• 2 images below the first screen load straight away

  2 images further down the page (117 KiB) download before anyone scrolls to them. Adding loading="lazy" lets the first screen load first.

  Elements (2)

• About 0.7 g of CO₂ per visit

  0.73 g

  By the Sustainable Web Design model, a visit to your homepage emits about 0.73 g of CO₂e: 87.1 kg a year at 10,000 visits a month. It scales with page weight, so every byte cut lowers it.

• 16 tap targets too small

  16 tap targets are too small or too close together to hit reliably with a finger.

  Elements (3)

• All page content should be contained by landmarks (132 elements)

  All page content should be contained by landmarks: 132 elements on the page fail this check, rated moderate by axe-core.

  Elements (3)

• Title is long (69 characters)

  Your title is 69 characters, so Google will cut it off around 60: “Laptop Computers, Desktops, Printers, Ink & Toner | HP® Official Site”.

  View source

• No structured data

  No structured data (JSON-LD), so Google can't show rich results such as your logo, ratings or FAQs.

• No XML sitemap

  No XML sitemap at https://www.hp.com/sitemap-gb-en-mag.xml, so Google discovers your pages only by following links.

• No X (Twitter) card tag

  No twitter:card tag. X falls back to Open Graph, which is set, so this is minor.

• 187 internal links, 45 external

  The homepage links to 187 pages on hp.com and 45 external pages.

• No Organization structured data

  There is no Organization (or LocalBusiness) JSON-LD, so search engines and AI assistants have no machine-readable facts about who runs the site: its name, logo, profiles and contact details.

• No llms.txt

  There is no /llms.txt, a short Markdown guide to your key pages for AI tools (llmstxt.org). It is optional and few AI tools read it yet, so treat it as a cheap extra.

• 1 linked page hidden from search

  /us-en/subscriptions/instant-ink.html is marked noindex but linked from your homepage. If it is meant to be found, remove the noindex.

  Elements (1)

• 15 internal pages checked

  We fetched 15 pages linked from your homepage (of 156 found) and read each the way a search engine does.

• 1 JavaScript error while loading

  1 error was logged to the browser console while the page loaded, for example “Failed to load resource: the server responded with a status of 404 ()”.

• No Content-Security-Policy

  No Content-Security-Policy header, the main browser-side defence against injected scripts.

• Short HSTS lifetime

  HSTS is set, but max-age is 0 days; one year is the recommended minimum.

• 4 redirects before the homepage

  Opening https://hp.com goes through 4 redirects before the homepage loads.

• No Referrer-Policy

  No Referrer-Policy header, so full URLs can leak to the sites you link to.

• No Permissions-Policy

  No Permissions-Policy header to switch off camera, microphone and location for embedded content.

• No CAA record

  hp.com has no CAA record, so any certificate authority may issue a certificate for it. A CAA record naming your provider (for example letsencrypt.org) closes that door.

• DNSSEC is off

  hp.com's DNS answers are not signed. DNSSEC stops attackers forging them to send visitors or email elsewhere; most registrars switch it on in a click, though most sites still run without it.

• No analytics detected

  No analytics or tag manager detected in the HTML, so you can't measure whether any of these fixes work.

• No direct contact details

  No phone number or email link on the homepage, so ready-to-buy visitors have one fewer way to reach you.

• No form on the homepage

  There is no form on the homepage, so every lead has to click through to another page first.

• No risk reducer

  No guarantee or risk reducer (money-back, free trial, no credit card) is mentioned, which is often what tips a hesitant visitor.

• About 671 words of copy

  The homepage carries about 671 words of visible text.

• Email authentication score: 95/100

  Email authentication: SPF record 25 points, plus 15 when it ends in -all (10 for ~all); DMARC record 25, plus 25 for a reject policy (15 for quarantine); a DKIM key on a common selector 10.

• 1 tracker load before any consent

  1

  Before a visitor clicks anything, the page loads Google Tag Manager (measured from a US location before any click). A consent tool (OneTrust) is installed; check it blocks these until visitors agree where the law requires it.

• 30 cookies set on arrival

  30

  Opening the homepage sets 30 cookies (measured from a US location before any click).

• 6 other companies contacted

  Loading the homepage contacts 6 hosts run by other companies (fonts, scripts, analytics, ads), each of which sees the visitor's IP address.