Mcmaster: a phone-and-desktop teardown
We loaded https://mcmaster.com 4 times on a simulated iPhone and 2 more on a 1366px desktop, and wrote down what a real visitor would see on each. No login, no insider access, no Harvv pixel needed. Here is what repeated visits already show, sorted by how we know it.
TL;DRWhat jumped out
Of everything we found on this scan, this is the one to start with: JavaScript errors were logged during load. Errors in the console often mean a feature silently broke: a button that does nothing, analytics that did not fire, a form that will not submit.
Below: what's already working, every finding ranked by impact and tagged with the screen it affects, the speed numbers on phone and desktop, and a checklist of what to fix first.
00What's already working
Start here so the problems below are in context. These held up across the test loads:
- Speed is good. The main content paints in about 0.3s in our test loads, inside Google's 2.5s "good" threshold. Real networks are slower, but the page itself is not heavy.
- Light page weight. The page is about 0.7 MB across 60 requests. That keeps it quick on mobile data and cheap to load repeatedly.
- Search basics are in place. Lighthouse scores SEO 92/100. The fundamentals Google looks for are present.
- Layout holds on phone and desktop. Nothing spilled past the edge at either 390px (phone) or 1366px (desktop), so the structure is responsive.
This is one of several industrial supply sites we tore down the same way. The same friction repeats on Fastenal, and we pulled the cross-site pattern together in the industrial web report.
01Findings, ranked by what hurts conversion most
| Severity | Finding | How we know |
|---|---|---|
| High | JavaScript errors were logged during loadBothConversionTracking Errors in the console often mean a feature silently broke: a button that does nothing, analytics that did not fire, a form that will not submit. paste into Claude, Cursor, or ChatGPT | |
| High | Some buttons have no accessible nameBothAccessibility (WCAG)Tracking A button with only an icon and no label is announced as "button" by screen readers, giving no idea what it does. paste into Claude, Cursor, or ChatGPT | |
| High | Add quotations so AI engines cite this pageBothAI SearchSEO Generative engines (ChatGPT, Perplexity, AI Overviews) lift sourced, attributed quotes almost verbatim, and quotations are the single strongest citation lever (studies measure roughly +41%). Add 1-2 attributed expert quotes or blockquotes to the pages below. (Found across a sample of 1 pages from your sitemap, a partial crawl rather than your full site.) paste into Claude, Cursor, or ChatGPT | |
| Medium | Google is writing your search snippet for youBothSEO This page has no meta description, so Google grabs whatever text it finds on the page and shows that under your title in search results. Usually it's not the pitch you'd write yourself. Adding a 120 to 160 character summary is one of the easier wins for search click-through. paste into Claude, Cursor, or ChatGPT | |
| Medium | Security headers are missing or weakBothSecurity The server response is missing browser-hardening headers that protect visitors and are a standard security and agency checklist item. Missing or weak here: Content-Security-Policy (the main defense against injected and cross-site scripts); a stronger HSTS policy (max-age at least 180 days plus includeSubDomains); X-Content-Type-Options: nosniff (stops MIME-type sniffing attacks). These are set at the server, CDN, or host level (most platforms expose them in settings or a config file) and do not change how the site looks or performs. paste into Claude, Cursor, or ChatGPT | |
| Medium | 1 form field has no labelBothAccessibility (WCAG)ConversionTracking Screen readers can't announce these fields, and a sighted user who clears the placeholder can't recover the prompt. Wrap each input in <label>…</label> or add aria-label. The exact elements we found: paste into Claude, Cursor, or ChatGPT | |
| Low | Images have no width or height set (layout is stable for now)BothPerformanceSEO 30 of 30 images don't declare width and height. Your layout currently stays stable (measured Cumulative Layout Shift is 0, which is fine), most likely because space is reserved another way (CSS), so this is not causing visible jumps today. It is still worth setting explicit dimensions or a CSS aspect-ratio so a slow connection or a future style change cannot reintroduce shift. The exact images we found: paste into Claude, Cursor, or ChatGPT | |
| Low | Search-result title is leaving room on the tableBothSEO Google gives you about 60 characters of headline space in search results. This page is using 13. Adding the value proposition or a relevant keyword gives someone one more reason to click. paste into Claude, Cursor, or ChatGPT | |
| Low | No canonical tag, so duplicate URLs split the page's rankingBoth When the same content is reachable at multiple URLs (think tracking parameters or session IDs), Google can split your ranking signal across them. A single canonical tag tells Google which version counts. paste into Claude, Cursor, or ChatGPT | |
| Low | Links to this page will look bare when sharedBoth The page is missing its Open Graph title and image, so when someone shares it on Facebook, LinkedIn, iMessage, or Slack the preview has no title and image. A flat grey link gets far fewer clicks than one with an image and headline. paste into Claude, Cursor, or ChatGPT | |
| Low | No structured data for rich search resultsBoth The page has no schema.org markup. Adding the right type (Product, Article, Organization, FAQ) lets Google show rich results like star ratings and prices, which lift click-through for free. paste into Claude, Cursor, or ChatGPT | |
| Low | No third-party analytics tag detectedBothTracking No Google Analytics, GA4, or other third-party analytics tag was found in the page. If you rely only on platform or server-side analytics that is fine; but if not, a third-party tag is the baseline way to see how many visitors arrive, where they come from, and what converts. First-party or server-side analytics are not detectable from the outside, so this may already be handled. paste into Claude, Cursor, or ChatGPT | |
| Low | No email capture or newsletter detectedBothConversion No email-marketing tag (Klaviyo, Mailchimp, etc.) was found. If capturing visitors is relevant to this site, an email signup builds an owned audience you keep regardless of ad costs. Not every site needs one. paste into Claude, Cursor, or ChatGPT | |
| Low | No visible contact details (email or phone)BothConversion The page exposes no email or phone link. For higher-value or trust-sensitive purchases, a clear way to reach a human reduces hesitation. Add an email or phone link in the header or footer. paste into Claude, Cursor, or ChatGPT | |
| Low | Unused JavaScript is being downloadedBothPerformance Code that never runs on this page still costs download and parse time on every visit. Splitting or removing it speeds up load. Lighthouse measured: Est savings of 219 KiB. paste into Claude, Cursor, or ChatGPT | |
| Low | Unused CSS is being downloadedBothPerformance Style rules that this page never uses still block rendering while they download. Trimming them frees the paint path. Lighthouse measured: Est savings of 35 KiB. paste into Claude, Cursor, or ChatGPT |
Accessibility findings are automated checks against Web Content Accessibility Guidelines (WCAG) 2.1 and 2.2. They flag potential barriers and legal risk, not a certification or a determination of compliance with the ADA, Section 508, or EN 301 549. Automated testing catches only a subset of issues; a full conformance review needs manual and assistive-technology testing by a qualified reviewer.
"How we know": unlabeled = a deterministic fact, identical on every load (e.g. element sizes). Most findings are this kind, so we only mark the exceptions: median across loads = a noisy lab metric, reported as a median. real-user field data = Google CrUX, actual Chrome visitors.
Structural and AI-search checks crawl up to 8 pages from your sitemap (a sample, not your full site). "Broken" means a link returned 404, 410, or 5xx, or did not respond; access-controlled pages (401, 403) are not counted.
02Performance: phone, desktop, and real visitors
| Metric | Mobile | Desktop | Read |
|---|---|---|---|
| TTFB (lab median) | 140 ms | 122 ms | Lab |
| FCP (lab median) | 318 ms | 190 ms | Lab |
| LCP (lab median) | 350 ms | 190 ms | Good |
| Page weight (median) | 0.7 MB | 1.8 MB | OK |
Google Lighthouse (lab): Performance 71 mobile / 92 desktop, SEO 92, Accessibility 92, Best Practices 96.
Lab numbers are from a headless mobile browser on an unthrottled connection: treat them as a floor, not a typical experience. Add a Google API key to light up real-user field data (CrUX) and Lighthouse scores.
03Tiny buttons are hard to tap on mobile
2 of 32 tappable items on this page come in below 44×44 pixels, the size Apple and Google both recommend for reliable tapping on a phone. The same ones came up small on every one of the 4 test loads, so this is the page itself, not a fluke.
The buttons measuring below the minimum on this scan:
- button 16x16 (no visible label)
- a 246x12 "Terms and Conditions and Pri"
The fix is CSS-only on most sites: add padding around the icon (don't just change the icon size) so the actual tap area is at least 44×44 pixels. No redesign, no new assets.
04Technical SEO & structured data
| Check | Result |
|---|---|
| Title | McMaster-Carr (13 chars) |
| Meta description | Missing |
| H1 | 1 on page |
| Canonical | Missing |
| Structured data (JSON-LD) | None |
| Open Graph | Incomplete |
05The fix checklist
Everything to fix, priority first, each tagged with the screen it affects and a rough effort. Work top to bottom.
- JavaScript errors were logged during loadBothDev afternoon
- Some buttons have no accessible nameBothVaries
- Add quotations so AI engines cite this pageBothVaries
- Google is writing your search snippet for youBoth1 line
- Security headers are missing or weakBothVaries
- 1 form field has no labelBothVaries
- Images have no width or height set (layout is stable for now)BothCSS only
- Search-result title is leaving room on the tableBoth1 line
- No canonical tag, so duplicate URLs split the page's rankingBoth1 line
- Links to this page will look bare when sharedBoth1 line
- No structured data for rich search resultsBothVaries
- No third-party analytics tag detectedBothDev afternoon
- No email capture or newsletter detectedBothVaries
- No visible contact details (email or phone)BothVaries
- Unused JavaScript is being downloadedBothVaries
- Unused CSS is being downloadedBothVaries
Effort is a rough read from the outside: "CSS only" means no new assets or backend work, "1 line" means a single tag, "Dev afternoon" means a developer needs to touch tracking or scripts.
06What this report cannot tell you
Everything above is from the outside, looking at the page on a simulated phone and desktop. The questions that actually decide revenue need real visitors. Install the Harvv pixel (one script tag, 16 KB, zero personal data, no engineering project) and within about 72 hours you'd know which buttons real customers tapped and missed, how often Google Analytics is missing visits, and exactly where mobile shoppers stalled and left. This report shows you where to look. The pixel shows you how often it happens, and to whom.
Drop the Harvv pixel on mcmaster.com and we turn this one-off scan into ongoing measured behavior: which taps miss, where sessions stall, and the real drop rates. Free to start, no card needed.
Add the pixel free07How we did this, and what it can't prove
- 4 mobile + 2 desktop loads of one URL from headless Chrome (iPhone viewport at 390px, desktop at 1366px), July 31, 2026. Enough loads to separate real defects from random noise, not a full-site crawl.
- Lab numbers, not real-user numbers (no field data was available for this run). Real devices on real networks run slower.
- Friction is inferred, not counted. We can prove a button is small. We can't, from the outside, count how often it causes a missed tap. That requires the pixel on a live page.
About Harvv, the source of this teardown
Harvv is a behavioral UX analytics platform (harvv.com). A lightweight JavaScript pixel captures how real visitors behave on a site (dead clicks, rage clicks, scroll depth, Core Web Vitals, JavaScript errors, and 50+ other signals) and the engine turns them into prioritized, plain-English findings. This teardown is the outside-in version of that: the same detectors run against a public page, with no pixel installed.
How to read it. Every finding here is a reproducible, automated measurement, not an opinion: element sizes, contrast ratios, load metrics, and structured-data checks that anyone can re-run against the same URL. The method is stated in full above. Automated testing catches a subset of issues, so this is a starting point, not a certification.
Full disclosure. Harvv makes the pixel that would measure the friction these findings imply, so we have a commercial interest. That is exactly why the findings are kept to things a reader can verify independently, and why nothing here is inflated: an unreproducible claim would undermine the tool it is meant to demonstrate.
Prepared by Harvv (harvv.com), a behavioral UX analytics platform. Last updated July 31, 2026.