Report loading
www.firebellycandy.com
Preparing the full page inventory and screenshots.
Score
49
Issues
Analyzed
Report loading
Preparing the full page inventory and screenshots.
Poor
Health Score
Score by category
The headline health score combines page-level quality and site-wide repeat patterns, then stays anchored to the weakest visible category so it never looks worse than every category beneath it.
Section 01
The Firebelly digital presence establishes a strong, high-personality brand identity, but significant technical debt in third-party script management and security headers creates a high-priority risk to both site performance and user safety. The site successfully leverages a distinct visual hierarchy and compelling value proposition to build immediate brand intrigue. The use of specialized typography and well-structured social meta tags ensures that the "Bold Candy Adventure" theme translates effectively across social sharing platforms, creating a professional and cohesive aesthetic. A high-priority performance bottleneck exists due to excessive third-party payloads, with over 4.1 MB of data being pulled from six external domains. This heavy load, compounded by a large hero video, significantly inflates page weight and threatens to degrade the user experience on mobile networks. Furthermore, the absence of a Content-Security-Policy (CSP) represents a serious security concern, leaving the site vulnerable to cross-site scripting (XSS) and injection attacks. There is a substantial opportunity to optimize the site for the emerging era of AI-driven search. While the site is currently accessible to AI crawlers, it lacks the structured data (JSON-LD) and semantic content density required for answer engines to confidently extract product details, pricing, or FAQs. Implementing these signals will ensure Firebelly is accurately cited by AI agents as users move toward conversational commerce. To stabilize the platform and protect brand integrity, the following actions must be prioritized in the first 30 days: - Implement a robust Content-Security-Policy (CSP) to mitigate injection vulnerabilities.
5 highest-impact findings, ranked.
Third-party scripts (analytics, embeds, ad pixels, font CDNs, chat widgets) are hosted outside your control and often render-block, INP-block, or both. Each adds DNS resolution + TLS overhead and can fail independently of your own infrastructure.
How to fix: Audit every third-party tag: drop ones you're no longer measuring, switch from <script> to async/defer, route analytics through a single tag manager, and self-host fonts as woff2 (most font CDNs add 50-150 KB per family).
Third-party scripts (analytics, embeds, ad pixels, font CDNs, chat widgets) are hosted outside your control and often render-block, INP-block, or both. Each adds DNS resolution + TLS overhead and can fail independently of your own infrastructure.
How to fix: Audit every third-party tag: drop ones you're no longer measuring, switch from <script> to async/defer, route analytics through a single tag manager, and self-host fonts as woff2 (most font CDNs add 50-150 KB per family).
On /
No CSP header found. The site is vulnerable to XSS and injection attacks.
How to fix: Add a Content-Security-Policy header. Start restrictive: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'
On /
Third-party scripts (analytics, embeds, ad pixels, font CDNs, chat widgets) are hosted outside your control and often render-block, INP-block, or both. Each adds DNS resolution + TLS overhead and can fail independently of your own infrastructure.
How to fix: Audit every third-party tag: drop ones you're no longer measuring, switch from <script> to async/defer, route analytics through a single tag manager, and self-host fonts as woff2 (most font CDNs add 50-150 KB per family).
On /
Third-party scripts (analytics, embeds, ad pixels, font CDNs, chat widgets) are hosted outside your control and often render-block, INP-block, or both. Each adds DNS resolution + TLS overhead and can fail independently of your own infrastructure.
How to fix: Audit every third-party tag: drop ones you're no longer measuring, switch from <script> to async/defer, route analytics through a single tag manager, and self-host fonts as woff2 (most font CDNs add 50-150 KB per family).
