Audit of 269 Shopify Stores Finds Median Mobile Performance Score of Just 48

·3 views

A developer ran Google PageSpeed Insights audits on 269 Shopify and DTC storefronts in July 2026, finding a median mobile performance score of just 48 out of 100. Over half the stores scored below 50, and only 9.4% reached the top tier of 90 or above. The median Largest Contentful Paint was 10 seconds, far above Google's recommended threshold of 2.5 seconds, with 88.3% of stores rated 'Poor' on that metric. Well-known brands including Gymshark, Skims, and Steve Madden all scored under 50, with Steve Madden's product-listing page taking over 23 seconds to load its main element on a throttled mobile connection. Despite the poor speed results, the same stores posted a median SEO score of 92, suggesting brands have prioritised search-crawler optimisation while neglecting actual page load performance for shoppers.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How to Call Real Phone Numbers from a Browser Using WebRTC and SIP

A developer guide explains how to connect browser-based WebRTC audio to the public telephone network (PSTN) using a SIP telephony provider such as Telnyx. The architecture involves three components: the browser capturing audio via WebRTC, a telephony provider bridging WebRTC to traditional phone infrastructure, and a backend server that issues short-lived credentials. A key security rule emphasized throughout is that API keys must never reach the browser — only a JWT token of limited duration is sent to the client. The guide also highlights non-obvious billing and timing quirks, such as zero-second calls appearing on invoices and CDR rounding mismatches. Virtual phone numbers can be purchased and configured programmatically via REST API as part of the same setup.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Chat Assistants Vulnerable to Transcript Injection via Browser DevTools

A security flaw affecting many production AI chat assistants allows attackers to manipulate conversation history directly from a browser's network tab, requiring no prompt engineering or special tools. The vulnerability stems from a common implementation pattern where the client sends the entire message history to the server on every turn, meaning all messages — including those claiming to be from the assistant — are effectively user-controlled input. By injecting fabricated assistant turns, an attacker can make the AI model believe it has already verified a user's identity or granted elevated permissions, bypassing content filters entirely since no suspicious language is used. The root cause is that AI models treat assistant-role messages as trusted records of what actually occurred, making forged history more convincing than traditional jailbreak prompts. The fix is straightforward: servers should retrieve conversation history from their own database rather than accepting it from the client, accepting only the latest user message per request.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Recreates Jollof Rice in Pure CSS for Frontend Art Challenge

A developer named Eze-Charles submitted a CSS art piece depicting a bowl of jollof rice as part of DEV Community's Frontend Challenge - Comfort Food Edition. The artwork was built entirely with CSS, using no images or SVG assets of any kind. Rice texture was achieved through layered radial gradients at varying sizes, while steam effects were created using four blurred circles. The creator noted that the steam animation was the element they were most proud of in the project. Looking ahead, the developer plans to attempt a second CSS dish featuring liquid movement or a pour animation.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Five Major Dev Tools Released This Week: GPT-5, Copilot X, Next.js 15 and More

Several significant developer tools launched in quick succession between July 27 and July 31, 2026, spanning AI models, frameworks, and cloud utilities. OpenAI released GPT-5 on July 29, 2026, alongside a new version 2.0 of its Python SDK, both aimed at improving how developers build AI-powered applications. GitHub followed on July 31 with Copilot X, an enhanced AI coding assistant featuring updated workflow integration and code assistance capabilities. React's Next.js framework reached version 15 on July 30, bringing performance improvements and new features relevant to frontend developers. Rounding out the week, Amazon released AWS CLI v3 on July 27, introducing performance gains and new commands for developers managing cloud infrastructure.

0 comments Read more at DEV Community