A modern, server-rendered core
Astro renders pages on the server, with islands only where the page needs to move. Content stays crawlable and quick to first paint — the right foundation for SEO-led retail.
Technical review · biggreenegg.co.uk
Under the dome A technical review of the storefront
A walk through the platform behind www.biggreenegg.co.uk: what is built well, where heat is escaping, and the order in which we would close the vents.
IForeword
Before we light the fire
Fifty years of craft.Two years of code.
The EGG is famous for doing one thing exceptionally well, for a lifetime. Its storefront should feel the same: quick to respond, dependable under load and simple for the team to care for.
Ceramic domes before glazing. The craft is in what you cannot see.
This review looks under the dome of www.biggreenegg.co.uk. We read the storefront codebase, ran its tests and production build, examined the live site and studied production errors from this week's fetch.
We found a modern foundation, built at pace by a capable team. Astro renders pages on the server, Commerce Layer handles commerce and DatoCMS manages content. That architecture is right for a premium brand, and nothing here argues for starting again.
We also found heat escaping. Live checks still show a broken sitemap and an unusable robots file. Markets and shared templates are paid for twice. Caching, routing and a handful of production faults leak heat the shopper and the team can feel.
None of this is unusual for a platform built at speed, and all of it can be fixed. What follows shows where the heat is leaking and the order in which to close the vents: security and revenue first, then speed and resilience, then the simplification that makes every later change cheaper.
We have written it to be as useful to the commercial team as to engineers. Every finding opens to show its evidence, its business impact and its fix.
With warm regards,
Rotate° · November 2026
72,671
lines of application code under review, across 659 files.
102
components built twice, once in Astro and once in Vue.
14/19
Irish page templates that are byte-for-byte copies of the UK ones.
798KB
of homepage HTML, before a single image or script loads.
63
known vulnerable packages, one of them critical.
33
unresolved error groups in production, recorded by Sentry.
3
CDN layers between a shopper and the page, with caching bypassed at the last.
51/51
unit tests passing, and a clean production build. The good news.
IIStrengths
What's built well
Good bones
Before the heat map, credit where it is due. These are the decisions we would keep, and they are why the roadmap is a renovation rather than a rebuild.
Headless commerce, properly scoped
Commerce Layer owns catalogue, pricing, stock and orders. Market-scoped tokens are the right pattern for UK and Ireland trading side by side.
Consent, done carefully
Consent defaults closed and chat waits on a real choice. It is one of the few journeys already covered by automated checks.
Rich product data
Product, FAQ and recipe structured data already exist, and page heads carry the right language alternates. The patterns are there to extend across the site.
Observability in production
Sentry is wired to the live storefront. This run can name unresolved groups instead of guessing whether the shop is quiet.
A clean unit suite and a production build
Tests and the production build still pass after a clean install. That is the good news, and it is why the work ahead is repair rather than rescue.
IIIPlatform health
Taking the temperature
Warming up,not yet ready to cook
Search and accessibility are already holding heat — SEO 92 and accessibility 99 on mobile and desktop — so crawlers and assistive tech are in better shape than the shopper’s wait. Performance is still cold: 51 on mobile, 59 on desktop, with heat leaking through layout shift, long scripts and unused JavaScript. The six lab scores average 82 of 100 — warming, not yet ready to cook.
82
Warming
Performance
SEO
Accessibility
IVArchitecture
Anatomy of the EGG
Nine parts,one platform
Select a part to see the layer it stands for and the findings that touch it. Dots show finding counts this run, not estimated health.
VLive evidence
Where there's smoke
Smoke signalsfrom production
Not theory. Each of these is happening on the live site or has been recorded in Sentry. We captured them on 2026-11-04.
01
The sitemap is offline
Search engines receive a 500 error instead of XML when they request the sitemap.
Sear
02
robots.txt does not serve a usable policy
Crawlers asking for robots.txt get a bad response instead of crawl rules.
Sear
03
Legacy redirects loop and bounce through www
The privacy policy URL bounces between apex and www until the client gives up.
Sear
04
Page HTML cache middleware is disabled
Homepage responses show cache bypass at the edge — each miss hits origin harder.
Grill
05
Collection route logic turns upstream errors into 404
Requests without text/html in Accept are refused — crawlers see 400 on robots.txt.
Sear
06
Commerce token cookies and CSP need hardening
Some baseline headers are present; Content-Security-Policy and HSTS are missing on the homepage.
Grill
VIPrioritisation
How we prioritise
The heat scale
Every EGG owner knows the four ways to cook. We have used them to rank the work. Heat is urgency and value; the catalogue still carries effort so quick wins are easy to spot.
9
315°C and above · act now
Sear
Direct, fierce heat. Security exposure and live faults that are costing revenue or visibility today. Fix these first.
14
200–230°C · next
Grill
High value at moderate effort. Speed, resilience and accessibility work that customers will feel straight away.
7
175–190°C · then
Roast
Indirect and structural. Consolidation that takes time to do well, and makes everything after it cheaper and safer.
12
110–135°C · ongoing
Low & slow
Patient, continuous care: quality gates, tests, types and documentation. Start now and never stop.
VIICatalogue
Forty-two findings
In order of value
Numbered by priority. Filter by heat or by part of the EGG, then open any finding for its evidence, its business impact and the fix.
Heat
Nº 01 · SEO & routingSear
The sitemap returns a server error
Nº 02 · SEO & routingSear
Legacy redirects loop and bounce through www
Nº 03 · Security & accessSear
Dashboard access uses a fixed cookie value
Nº 04 · Security & accessSear
Checkout pages trust URL tokens and integration access
Nº 05 · Dependencies & runtimeSear
Many known dependency vulnerabilities remain open
Nº 06 · CommerceSear
Checkout token auth is not retried on failure
Nº 07 · SEO & routingSear
Irish locale redirects using request origin
Nº 08 · SEO & routingSear
robots.txt does not serve a usable policy
Nº 09 · Caching & deliveryGrill
Page HTML cache middleware is disabled
Nº 10 · CommerceGrill
Basket API errors go to the console only
Nº 11 · Content & dataGrill
CMS gaps crash pages instead of degrading
Nº 12 · ObservabilityGrill
Top production errors include injection probes and upstream fetch failures
Nº 13 · Experience & front endGrill
Homepage performance scores need attention
Nº 14 · Experience & front endLow & slow
105 component names exist in both Astro and Vue trees
Nº 15 · SEO & routingLow & slow
Ireland routes mirror the UK tree
Nº 16 · Content & dataLow & slow
Stockist event filter builds an invalid date string
Nº 17 · SEO & routingLow & slow
Several links lack descriptive text
Nº 18 · Experience & front endGrill
Heading order and accessible name mismatches
Nº 19 · Quality & deliveryLow & slow
Unit tests pass locally after clean install
Nº 20 · Quality & deliveryLow & slow
Dual CI and lint noise remain
Nº 21 · CommerceGrill
Collection pages load the full product catalogue
Nº 22 · Caching & deliveryGrill
SSR likely runs in US East, not UK
Nº 23 · Content & dataGrill
Every page loads navigation and Trustpilot reviews server-side
Nº 24 · Experience & front endGrill
Algolia InstantSearch ships with the header on every page
Nº 25 · SEO & routingSear
Collection route logic turns upstream errors into 404
Nº 26 · Security & accessGrill
Commerce token cookies and CSP need hardening
Nº 27 · Quality & deliveryLow & slow
Pull-request CI runs unit tests only
Nº 28 · Quality & deliveryLow & slow
No automated test covers basket to checkout
Nº 29 · Experience & front endGrill
Keyboard and focus accessibility gaps
Nº 30 · Experience & front endGrill
Images use percentage dimensions, not reserved space
Nº 31 · CommerceGrill
Checkout URLs and flags still assume beta / UK
Nº 32 · Experience & front endRoast
Homepage HTML payload is very large
Nº 33 · Experience & front endRoast
Three interactivity models on one site
Nº 34 · Content & dataRoast
Custom HTML transforms inject Pinia state
Nº 35 · CommerceRoast
Two Commerce Layer client implementations
Nº 36 · Dependencies & runtimeRoast
22 dependencies are a major version behind
Nº 37 · Dependencies & runtimeRoast
Large server-oriented chunks ship to the browser
Nº 38 · Security & accessRoast
Public POST endpoints lack validation
Nº 39 · ObservabilityLow & slow
Errors go to console, not Sentry helper
Nº 40 · Quality & deliveryLow & slow
TypeScript strictness disabled in places
Nº 41 · Quality & deliveryLow & slow
Leftovers from prior hosting stacks
Nº 42 · Dependencies & runtimeLow & slow
Build pins Node 22.23.4
VIIIValue & effort
Where to start
Value against effort
Every finding plotted by the value it unlocks and the effort it takes. Start top-left. Hover a point for a summary, and select it for the detail.
Quick winsHigh value · light effort
Signature workHigh value · substantial effort
HousekeepingModest value · light effort
Think twiceModest value · substantial effort
Value
Effort
- Sear
Act now.
- Grill
Next.
- Roast
Then.
- Low & slow
Ongoing.
Reading the chart 14 sit top-left — start there.
Built for a lifetimeAn EGG is made to be handed down. The platform that sells it deserves the same care.
The principle behind this review
IXRoadmap
A tasting menu
Four coursesto perfect heat
The roadmap is served in order of value. Each course builds on the last. Select any dish to open its finding. Effort is Light, Moderate or Substantial by technical scope — we do not invent a health score after each course.
The Platform Menu
Prepared for Big Green Egg UK & Ireland · November 2026
IAmuse-bouche
Close the vents
Stop the heat escapingSeal the security gaps and fix the faults customers and search engines are hitting today. These are mostly small, contained changes with an outsized effect on risk.
IIStarter
Bring it up to temperature
Speed & resilienceThis period, move the storefront preview onto Cloudflare behind Zero Trust so preview caching and cost leave Netlify. Production hosting comes later. Alongside that, stop shipping what nobody uses and make failure graceful, so the bigger changes that follow are safe.
IIIMain course
One recipe, two markets
Consolidate & simplifyWith commerce journeys under test, merge the Irish templates into the UK set, delete the unused component copies and settle on one way of building pages. The codebase gets smaller, clearer and cheaper to change.
IVDessert
Keep it at temperature
Upgrade & sustainWith half as much code to move, complete the framework upgrades, restore type safety and tidy what three migrations left behind. Then keep the platform there with routine care.
Finding-weight addressed after each courseWarming up → Up to temperature
This line is the share of this run’s finding-weight in courses completed so far. It is not a measured Lighthouse or platform-health score (those “after” numbers cannot be collected until the work ships).
XDuplication
Twice cooked
The cost of buildingeverything twice
The largest structural drag on the platform is duplication: components written in two frameworks, and a whole market written twice. Every fix is paid for twice, and the copies drift apart.
26,460
lines in components that exist as both Astro and Vue (102 pairs).
120
lines of unused Vue copies (1 component) that this run could not find imported.
3,369
lines of Irish page templates duplicated from the UK (19 files).
1,716
lines that actually differ between the two markets.
102 components, built twice
Each tile is one component, sized by its combined line count: the Astro copy in deep green, the Vue copy in sage. Hatched Vue copies are imported by nothing.
Astro copy
Vue copy, in use
Vue copy, unused
Hover over or focus a tile to compare its two copies.
Ireland, page by page
How much of each Irish template is identical to its UK twin. Bar length shows the size of the template; the orange tip is the part that differs.
XIFuture state
Perfect heat
The platform,up to temperature
Same proven ingredients, arranged so heat stays where it belongs: the preview on Cloudflare behind Zero Trust, one CDN that caches, rendering in London, and one way to build each page. The diagram is the recommended shape.
- Quick to respond under load — without a fictional target score.
- Dependable: sitemap, robots, and auth behave as the brand promises.
- Operable: one implementation per component, one market tree, instruments the team actually reads.
XIIAppendix
How we checked
Method & evidence
The gates, scores and production signals behind the chapters above. Everything on this page was captured on 2026-11-04.
Quality gates
- Unit tests
vitest run51 / 51 pass - Production build
astro buildPass - Linting
eslint srcNon-zero - Formatting
prettier --checkNon-zero - Types
astro check29 errors - Dependencies
npm audit63 vulns - End-to-end
playwright2 passed
Measures this run
| Measure | Today |
|---|---|
| Homepage, mobile lab | Score 51 |
| Homepage, desktop lab | Score 59 |
| Homepage HTML | 798 KB |
| Source size | 659 files, 72,671 lines |
| Known vulnerabilities (npm audit) | 63 (1 critical, 30 high) |
| Unresolved Sentry groups | 33 |
| Unit tests this run | 51 / 51 pass |
| Sitemap (live check) | HTTP 500 (after 1 redirect) |
| robots.txt (live check) | Body: Bad request |
Commit activity, Nov 2024 to Nov 2026
655 commits on this storefront in that window. Bars are this repository’s git log — not copied from the reference review.
Major upgrades outstanding
| Package | Now | Latest |
|---|---|---|
| jsdom | 27.4.0 | 31.0.0 |
| @types/jsdom | 27.0.0 | 30.0.0 |
| @astrojs/netlify | 6.6.5 | 8.2.12 |
| @astrojs/vue | 5.1.4 | 7.1.2 |
| astro | 5.18.2 | 7.4.7 |
| content-type | 1.0.5 | 3.1.1 |
| eslint-plugin-astro | 1.3.1 | 3.2.1 |
| node-html-parser | 7.0.1 | 9.0.7 |
22 dependencies a major version behind.
Production errors in Sentry
| SyntaxError: Unexpected token '(', "(select 19"... is not valid JSON · POST /content-api/newsletter-subscribe | 75 |
| TypeError: fetch failed · GET /p/[slug] | 61 |
| SyntaxError: Unexpected token '(', "(select 19"... is not valid JSON · POST /p/in-stock-notification | 60 |
| Error: [services/recipes/{slug}] "data" is undefined. · GET /r/[slug] | 44 |
| TypeError: Cannot read properties of undefined (reading 'footerContent') · GET /r/[slug] | 38 |
| TypeError: Cannot read properties of undefined (reading 'alertBarText') · GET /[slug] | 36 |
33 unresolved groups this fetch window.
Source composition
| Slice | Files | Lines |
|---|---|---|
| src total | 659 | 72,671 |
| Vue (.vue) | 210 | 31,373 |
| Astro (.astro) | 199 | 24,748 |
| TypeScript (.ts) | 143 | 9,745 |
| JavaScript (.js) | 56 | 3,956 |
| .json | 2 | 1,143 |
| CSS (.css) | 12 | 857 |
| .svg | 37 | 849 |
| git ls-files (whole repo) | 859 | — |
Counted under this client’s source roots this run. Extensions present in the tree are listed; missing frameworks are omitted, not zero-filled.
Services reviewed
| Service | Status | Health | Signal |
|---|---|---|---|
| Commerce Layer | reviewed | needs attention | SDK @commercelayer/sdk ^7.12.1 (major 8 available). Dual axios + SDK clients (finding COM-4). Checkout token pattern COM-1/COM-2. |
| DatoCMS | reviewed | needs attention | GraphQL at graphql.datocms.com (+ /preview non-prod). Used on every getServerInitData navigation/global path. CMS field gaps drive Sentry B9C/B9D (MON-1). |
| BGE Services API | reviewed | needs attention | Storefront calls parseEnvironmentFromRuntime('API_URL') for collections, recipes, routes, checkout content, etc. Not a separate repo pass this quarter. |
| Calibre | reviewed | needs attention | Week 2026-11-02 snapshot 2311 complete. Mobile perf 51, desktop 59, SEO 92, a11y 99. |
| Sentry | reviewed | needs attention | 33 unresolved groups production week ending 2026-11-02. Top noise: injection probes on newsletter/in-stock POST; fetch failed on product pages. |
| Ghost Inspector | reviewed | strong | Production suite [Big Green Egg] 29/29 passing, finished 2026-11-02. Fetch label: All passing. |
| Trustpilot | reviewed | ok | 30 reviews fetched server-side per page via getBusinessUnitReviews; proxied through content-api/trustpilot routes. |
| Netlify (hosting) | reviewed | ok | SSR adapter; NODE 22.23.4 pin; HTML cache bypass on homepage (HOST-2). |
| BunnyCDN (edge) | reviewed | ok | Homepage served via BunnyCDN; max-age=180 on HTML. |
Method & confidence
Scope. Storefront at revision adf8322, week 2026-11-02. Live site and production Sentry from fetch. Reference HTML was not overwritten.
How. Collect-all archived fetch, npm ci/test/build/lint/audit/outdated. CodeHealth skills wrote findings; skill 23 mapped reference ids.
Direction. All 37 reference findings have been re-verified in this run (see benParity). Prioritise ROUTE-1, SEO-1, SEC-1, COM-1, and ARCH/bundle debt before major Astro 7 upgrades. Template v2 (immersive chapters) is the remaining UX gap vs Ben's HTML shell.
Coverage. All 37 reference findings re-verified this run.
Confidence. Numbers on this page come from archived JSON. Matrix positions are heat × severity heuristics unless a finding sets value and effort. Part after-health and 1–10 dials are not collected — they need shipped work plus a scoring rubric.
Let's light the fire
Ready when you are
The foundations are sound and the path is clear. Begin with the first course; it closes the risks and builds momentum for everything that follows.
