Export Report
OVERALL SCORE
Level 3, Bot-Aware
- AI Discoverability 43 out of 100
- Agent Ease of Use 54 out of 100
- Security & Trust 46 out of 100
- GEO, AIO and AEO 69 out of 100
- SEO 92 out of 100
- Performance and Accessibility 53 out of 100
What AI sees of your website
Home | Okta Developer
Secure, scalable, and highly available authentication and user management for any app.
Next step
Turn this report into a fix workflow
14 failed checks are ready to move into MCP or CLI remediation. Generate a repair prompt, connect the scanner to your coding agent, or open the integration docs before your next rescan.
| Metric | Score | Status | Passed | Failed | Warning | Evidence |
|---|---|---|---|---|---|---|
| AI Discoverability | 43 | Priority fix | 17 | 21 | 5 | View details |
| Discoverability | 67 | Needs work | 8 | 2 | 0 | View details |
| Content Readiness | 18 | Priority fix | 8 | 18 | 2 | View details |
| Bot Access Control | 45 | Priority fix | 1 | 1 | 3 | View details |
| Agent Ease of Use | 54 | Needs work | 3 | 1 | 12 | View details |
| API | 67 | Needs work | 2 | 0 | 2 | |
| Auth | 48 | Priority fix | 1 | 1 | 2 | View details |
| MCP | 50 | Needs work | 0 | 0 | 3 | |
| Skill Discovery | 50 | Needs work | 0 | 0 | 5 | |
| GEO, AIO and AEO | 69 | Needs work | 11 | 3 | 4 | View details |
| GEO Readiness | 61 | Needs work | 3 | 1 | 2 | View details |
| AIO Readiness | 88 | Mostly ready | 4 | 0 | 2 | |
| AEO Readiness | 58 | Needs work | 4 | 2 | 0 | View details |
| SEO | 92 | Strong | 9 | 1 | 0 | View details |
| SEO | 92 | Strong | 9 | 1 | 0 | View details |
| Security & Trust | 46 | Priority fix | 8 | 5 | 4 | View details |
| Security & Trust | 46 | Priority fix | 8 | 5 | 4 | View details |
| Performance and Accessibility | 53 | Needs work | 16 | 7 | 3 | View details |
| Performance | 34 | Priority fix | 12 | 7 | 3 | View details |
| Accessibility | 89 | Mostly ready | 4 | 0 | 0 |
Prioritized recommendations
Issues ranked by score impact
47 items need attention
AI DiscoverabilityDiscoverabilityEstablished
Link headers
Link headers failed at "Find useful Link headers".
100 Fail
AI DiscoverabilityDiscoverabilityEstablished
Link headers
Link headers failed at "Find useful Link headers".
Needs attention
Link headers
Issue
No useful agent discovery Link headers were found.
Why it matters
Link headers let automated clients discover API catalogs, documentation, and machine-readable alternates without parsing page markup first.
Check name
Link headers
Score
0/100
Status
fail
Category
Discoverability
Maturity
Established
Goal
Include Link response headers for agent discovery using RFC 8288.
Result
Link headers failed at "Find useful Link headers".
Validation steps
Find useful Link headers
No useful agent discovery Link headers were found.
Fetch same-origin Link header targets
Link headers did not expose any same-origin targets to validate.
Agent Ease of UseMCPEmerging recommendation
MCP Server Card
MCP Server Card has a validation warning at "Discover MCP server card".
25 Warning
Agent Ease of UseMCPEmerging recommendation
MCP Server Card
MCP Server Card has a validation warning at "Discover MCP server card".
Needs attention
MCP Server Card
Issue
No MCP server card was found at current, transitional, or linked discovery paths.
Why it matters
MCP server cards give agents a stable, public pre-connection discovery surface for server identity, remote transports, protocol compatibility, and safe routing without guessing endpoints.
Check name
MCP Server Card
Score
50/100
Status
warning
Category
MCP
Maturity
Emerging recommendation
Goal
Publish an MCP Server Card that helps agents discover remote MCP server transports before opening a session.
Result
MCP Server Card has a validation warning at "Discover MCP server card".
Validation steps
Discover MCP server card
No MCP server card was found at current, transitional, or linked discovery paths.
Agent Ease of UseMCPEmerging recommendation
WebMCP
WebMCP has a validation warning at "Probe WebMCP operability".
25 Warning
Agent Ease of UseMCPEmerging recommendation
WebMCP
WebMCP has a validation warning at "Probe WebMCP operability".
Needs attention
WebMCP
Issue
No WebMCP surface was found to probe.
Details
Why it matters
WebMCP gives agents structured page and browser tool hints so they can understand actions without relying only on screen scraping.
Check name
WebMCP
Score
50/100
Status
warning
Category
MCP
Maturity
Emerging recommendation
Goal
Expose browser/page WebMCP tools and compatible static WebMCP metadata when a site wants agents to understand in-page actions.
Result
WebMCP has a validation warning at "Probe WebMCP operability".
Validation steps
Detect WebMCP runtime API
Expose current WebMCP tools through document.modelContext.registerTool(), or clearly document navigator.modelContext as a compatibility/polyfill profile.
Probe WebMCP operability
No WebMCP surface was found to probe.
WebMCP operability findings
- No WebMCP surface was found to probe.
- Conventional WebMCP manifest paths were checked but did not return a valid manifest.
Validate declarative WebMCP form tools
No W3C-style declarative WebMCP form attributes were found.
Validate MCP-aware HTML annotations
No data-mcp-tool or hyphenated WebMCP compatibility annotations were found.
Validate static WebMCP JSON compatibility
No static WebMCP JSON manifest or WMCP interaction graph was found.
Validate WebMCP tool metadata quality
Use clear tool names, useful descriptions, constrained schemas, side-effect clarity, and profile-appropriate naming.
Review WebMCP security and policy signals
Remove secrets and prompt-injection text from WebMCP metadata, avoid private endpoints, and use Permissions-Policy and annotations for tool safety.
Agent Ease of UseAuthEstablished
OAuth / OIDC discovery
OAuth / OIDC discovery failed at "Fetch discovery metadata".
19 Fail
Agent Ease of UseAuthEstablished
OAuth / OIDC discovery
OAuth / OIDC discovery failed at "Fetch discovery metadata".
Needs attention
OAuth / OIDC discovery
Issue
OAuth/OIDC was claimed or referenced, but no registered OAuth/OIDC discovery document was found.
Why it matters
OAuth and OIDC discovery let agents and API clients find authorization, token, and key endpoints programmatically instead of scraping login pages or guessing provider setup.
Check name
OAuth / OIDC discovery
Score
43/100
Status
fail
Category
Auth
Maturity
Established
Goal
Publish OAuth/OIDC discovery metadata only when the site operates or advertises a real OAuth/OIDC authorization server.
Result
OAuth / OIDC discovery failed at "Fetch discovery metadata".
Validation steps
Fetch discovery metadata
OAuth/OIDC was claimed or referenced, but no registered OAuth/OIDC discovery document was found.
AI DiscoverabilityBot Access ControlEstablished
AI bot rules in robots.txt
AI bot rules in robots.txt failed at "Classify AI crawler rules".
17 Fail
AI DiscoverabilityBot Access ControlEstablished
AI bot rules in robots.txt
AI bot rules in robots.txt failed at "Classify AI crawler rules".
Needs attention
AI bot rules in robots.txt
Issue
No explicit User-agent rules were found for major AI crawler tokens.
Why it matters
AI crawler product tokens have different meanings. Explicit robots.txt groups make training, search, and retrieval access policy auditable for compliant crawler operators.
Check name
AI bot rules in robots.txt
Score
31/100
Status
fail
Category
Bot Access Control
Maturity
Established
Goal
Declare deliberate robots.txt rules for major AI training, AI search, user-triggered, and dataset crawlers.
Result
AI bot rules in robots.txt failed at "Classify AI crawler rules".
Validation steps
Classify AI crawler rules
No explicit User-agent rules were found for major AI crawler tokens.
AI DiscoverabilityContent ReadinessEmerging recommendation
llms.txt
llms.txt failed at "Fetch root llms.txt".
17 Fail
AI DiscoverabilityContent ReadinessEmerging recommendation
llms.txt
llms.txt failed at "Fetch root llms.txt".
Needs attention
llms.txt
Issue
/llms.txt was not found or could not be fetched.
Why it matters
llms.txt is an emerging Markdown convention for giving language-model clients curated context and links before they crawl broadly. Broken, private, or low-signal links make the file much less useful even when it exists.
Check name
llms.txt
Score
0/100
Status
fail
Category
Content Readiness
Maturity
Emerging recommendation
Goal
Publish a concise llms.txt index that helps agents discover useful public site context.
Result
llms.txt failed at "Fetch root llms.txt".
Validation steps
Fetch root llms.txt
/llms.txt was not found or could not be fetched.
Inspect optional llms-full.txt
Passed.
AI DiscoverabilityContent ReadinessEstablished
Organization / WebSite schema
Organization / WebSite schema is missing or incomplete.
17 Fail
AI DiscoverabilityContent ReadinessEstablished
Organization / WebSite schema
Organization / WebSite schema is missing or incomplete.
Needs attention
Organization / WebSite schema
Issue
No Organization or Organization subtype was found in Schema.org structured data. No WebSite entity was found in Schema.org structured data. Missing identity field(s): Organization.name, Organization.url, WebSite.name, WebSite.url. WebSite.publisher is missing. Organization schema is missing logo and sameAs or public contact evidence.
Why it matters
Organization and WebSite schema help agents identify the publisher, canonical site identity, logo, and related profiles for attribution.
Check name
Organization / WebSite schema
Score
0/100
Status
fail
Category
Content Readiness
Maturity
Established
Goal
Identify the site owner and website entity in structured data.
Result
Organization / WebSite schema is missing or incomplete.
Validation steps
Organization entity
No Organization or Organization subtype was found in Schema.org structured data.
WebSite entity
No WebSite entity was found in Schema.org structured data.
Identity fields
Missing identity field(s): Organization.name, Organization.url, WebSite.name, WebSite.url.
WebSite publisher linkage
WebSite.publisher is missing.
Organization trust fields
Organization schema is missing logo and sameAs or public contact evidence.
AI DiscoverabilityContent ReadinessEstablished
Structured data
Structured data failed at "Recognized structured data format".
17 Fail
AI DiscoverabilityContent ReadinessEstablished
Structured data
Structured data failed at "Recognized structured data format".
Needs attention
Structured data
Issue
No JSON-LD, Microdata, or RDFa structured data was found.
Why it matters
Structured data gives agents explicit entities, relationships, and page meaning that are harder to infer reliably from visual layout alone.
Check name
Structured data
Score
0/100
Status
fail
Category
Content Readiness
Maturity
Established
Goal
Expose machine-readable page entities and relationships through a recognized structured-data syntax.
Result
Structured data failed at "Recognized structured data format".
Validation steps
Recognized structured data format
No JSON-LD, Microdata, or RDFa structured data was found.
Page-relevant schema family
The page has specific visible content intent, but structured data does not include a matching primary schema family.
Agent Ease of UseAuthEmerging recommendation
Auth.md Agent Registration
Auth.md Agent Registration has a validation warning at "Warn when auth surface lacks Auth.md".
17 Warning
Agent Ease of UseAuthEmerging recommendation
Auth.md Agent Registration
Auth.md Agent Registration has a validation warning at "Warn when auth surface lacks Auth.md".
Needs attention
Auth.md Agent Registration
Issue
The site appears to support login, signup, account access, or credentials but does not publish /auth.md.
Why it matters
Human login and signup flows are often opaque to agents. Auth.md gives automated clients a stable registration contract instead of forcing them to scrape docs, automate browser forms, or guess credential flows.
Check name
Auth.md Agent Registration
Score
50/100
Status
warning
Category
Auth
Maturity
Emerging recommendation
Goal
Publish Auth.md v1 metadata so agents can discover how to register, claim a user, and obtain credentials.
Result
Auth.md Agent Registration has a validation warning at "Warn when auth surface lacks Auth.md".
Validation steps
Warn when auth surface lacks Auth.md
The site appears to support login, signup, account access, or credentials but does not publish /auth.md.
Agent Ease of UseAuthEmerging recommendation
OAuth Protected Resource
OAuth Protected Resource has a validation warning at "Detect protected-resource applicability".
17 Warning
Agent Ease of UseAuthEmerging recommendation
OAuth Protected Resource
OAuth Protected Resource has a validation warning at "Detect protected-resource applicability".
Needs attention
OAuth Protected Resource
Issue
Generic authentication signals were found, but no OAuth Protected Resource metadata signal was detected.
Why it matters
Protected-resource metadata tells agents which API/resource is locked, which authorization servers can issue tokens for it, and how a 401 challenge maps back to the correct resource.
Check name
OAuth Protected Resource
Score
50/100
Status
warning
Category
Auth
Maturity
Emerging recommendation
Goal
Publish OAuth Protected Resource Metadata for OAuth-protected APIs and MCP resources so clients can identify the resource and its authorization servers.
Result
OAuth Protected Resource has a validation warning at "Detect protected-resource applicability".
Validation steps
Detect protected-resource applicability
Generic authentication signals were found, but no OAuth Protected Resource metadata signal was detected.
Agent Ease of UseAPIEstablished
API Catalog
API Catalog has a validation warning at "Fetch API catalog".
17 Warning
Agent Ease of UseAPIEstablished
API Catalog
API Catalog has a validation warning at "Fetch API catalog".
Needs attention
API Catalog
Issue
This origin appears to publish or claim public APIs, but no RFC 9727 API catalog was found.
Why it matters
API catalogs help agents find API endpoints, service descriptions, documentation, status resources, auth metadata, and related machine-readable contracts without guessing entry points.
Check name
API Catalog
Score
67/100
Status
warning
Category
API
Maturity
Established
Goal
Publish an API catalog for automated public API discovery using RFC 9727 when this origin exposes public APIs.
Result
API Catalog has a validation warning at "Fetch API catalog".
Validation steps
Fetch API catalog
This origin appears to publish or claim public APIs, but no RFC 9727 API catalog was found.
Agent Ease of UseAPIEstablished
OpenAPI discovery
OpenAPI discovery has a validation warning at "Discover OpenAPI document".
17 Warning
Agent Ease of UseAPIEstablished
OpenAPI discovery
OpenAPI discovery has a validation warning at "Discover OpenAPI document".
Needs attention
OpenAPI discovery
Issue
The site appears to publish or document a public API, but no OpenAPI or Swagger document was found.
Why it matters
OpenAPI documents let agents understand operations, schemas, authentication, servers, and request/response formats before calling an API.
Check name
OpenAPI discovery
Score
67/100
Status
warning
Category
API
Maturity
Established
Goal
Publish a valid OpenAPI or Swagger document for public API discovery when this origin exposes public APIs.
Result
OpenAPI discovery has a validation warning at "Discover OpenAPI document".
Validation steps
Discover OpenAPI document
The site appears to publish or document a public API, but no OpenAPI or Swagger document was found.
AI DiscoverabilityContent ReadinessEstablished
Author attribution
Author attribution is partially implemented.
16 Fail
AI DiscoverabilityContent ReadinessEstablished
Author attribution
Author attribution is partially implemented.
Needs attention
Author attribution
Issue
Applicable editorial content has no usable author, creator, publisher, visible byline, or HTML attribution signal.
Why it matters
Author attribution helps agents cite content responsibly, assess source credibility, and distinguish editorial pages from anonymous marketing copy.
Check name
Author attribution
Score
5/100
Status
fail
Category
Content Readiness
Maturity
Established
Goal
Identify content authors or publishers for trust and attribution.
Result
Author attribution is partially implemented.
Validation steps
Schema.org attribution
Editorial content has no Schema.org author, creator, or publisher attribution.
Author identity quality
No named author or publisher identity could be extracted.
Visible byline parity
Structured author/publisher names were not found in visible byline text.
HTML attribution support
No supporting HTML author metadata, rel=author link, or visible byline was found.
AI DiscoverabilityContent ReadinessEstablished
Markdown negotiation
Markdown negotiation is missing or incomplete.
15 Fail
AI DiscoverabilityContent ReadinessEstablished
Markdown negotiation
Markdown negotiation is missing or incomplete.
Needs attention
Markdown negotiation
Issue
Best candidate returned Content-Type "text/html" instead of text/markdown.
Why it matters
Markdown representations give agents a cleaner page form while preserving normal HTML for browsers and cache-safe representation handling.
Check name
Markdown negotiation
Score
10/100
Status
fail
Category
Content Readiness
Maturity
Established
Goal
Expose a useful Markdown representation through negotiation or an explicit alternate URL.
Result
Markdown negotiation is missing or incomplete.
Validation steps
Markdown representation
No usable Markdown representation was found through negotiation, advertised alternates, or conservative .md mirror checks.
Same-URL negotiation
Same-URL Accept: text/markdown did not return a valid Markdown representation.
Markdown format validation
Markdown response contains too much raw HTML to be a clean agent-facing Markdown representation.
Advertised Markdown alternate
No Link or HTML rel=alternate text/markdown URL was advertised.
Conventional .md mirror
Conventional .md mirror candidates did not return valid Markdown.
GEO, AIO and AEOGEO, AIO & AEOEmerging recommendation
AEO: Answer-first passages
AEO: Answer-first passages scored 20/100 and needs a fix.
14 Fail
GEO, AIO and AEOGEO, AIO & AEOEmerging recommendation
AEO: Answer-first passages
AEO: Answer-first passages scored 20/100 and needs a fix.
Needs attention
AEO: Answer-first passages
Issue
20 section(s) bury or omit a concise opening answer.
Details
Why it matters
Answer engines need visible answer passages, clear question and heading structure, entity definitions, evidence, and trust signals. These signals improve extraction and attribution, but they do not guarantee answer-engine citations or search features.
Check name
AEO: Answer-first passages
Score
20/100
Status
fail
Category
GEO, AIO & AEO
Maturity
Emerging recommendation
Goal
Make page content easy for answer engines and assistants to extract, answer from, and attribute without promising inclusion in any proprietary answer surface.
Result
AEO: Answer-first passages scored 20/100 and needs a fix.
Agent Ease of UseSkill DiscoveryEmerging recommendation
A2A Agent Card
A2A Agent Card has a validation warning at "Discover A2A Agent Card".
13 Warning
Agent Ease of UseSkill DiscoveryEmerging recommendation
A2A Agent Card
A2A Agent Card has a validation warning at "Discover A2A Agent Card".
Needs attention
A2A Agent Card
Issue
No A2A Agent Card was found at the current, legacy, or fallback discovery paths.
Why it matters
A2A Agent Cards provide protocol-specific discovery for agent identity, skills, input and output modes, transport bindings, capabilities, and security requirements. Legacy A2A also used /.well-known/agent.json, so scanners must classify the card shape before reporting readiness.
Check name
A2A Agent Card
Score
50/100
Status
warning
Category
Skill Discovery
Maturity
Emerging recommendation
Goal
Publish a version-appropriate A2A Agent Card so A2A-compatible clients can discover agent skills and invoke the declared endpoint safely.
Result
A2A Agent Card has a validation warning at "Discover A2A Agent Card".
Validation steps
Discover A2A Agent Card
No A2A Agent Card was found at the current, legacy, or fallback discovery paths.
Agent Ease of UseSkill DiscoveryEmerging recommendation
Agent Skills index
Agent Skills index has a validation warning at "Discover Agent Skills index".
13 Warning
Agent Ease of UseSkill DiscoveryEmerging recommendation
Agent Skills index
Agent Skills index has a validation warning at "Discover Agent Skills index".
Needs attention
Agent Skills index
Issue
No Agent Skills discovery index was found at the canonical or legacy path.
Why it matters
An Agent Skills index lets agents discover task-specific instructions through a small trusted index, then verify and load only the skill artifacts they need.
Check name
Agent Skills index
Score
50/100
Status
warning
Category
Skill Discovery
Maturity
Emerging recommendation
Goal
Publish an Agent Skills discovery index that advertises digest-pinned SKILL.md or archive artifacts.
Result
Agent Skills index has a validation warning at "Discover Agent Skills index".
Validation steps
Discover Agent Skills index
No Agent Skills discovery index was found at the canonical or legacy path.
Agent Ease of UseSkill DiscoveryEmerging recommendation
agents.json
agents.json has a validation warning at "Discover agents.json".
13 Warning
Agent Ease of UseSkill DiscoveryEmerging recommendation
agents.json
agents.json has a validation warning at "Discover agents.json".
Needs attention
agents.json
Issue
No Wildcard-style agents.json file was found.
Why it matters
Wildcard agents.json gives agents workflow-level context beyond plain OpenAPI, including flows, links, examples, and API action structure. It is an emerging OpenAPI-adjacent proposal, so scanners should validate the contract shape without treating it as an A2A or IETF standard.
Check name
agents.json
Score
50/100
Status
warning
Category
Skill Discovery
Maturity
Emerging recommendation
Goal
Publish a Wildcard-style agents.json file so agents can discover OpenAPI-backed workflows, links, examples, and authentication requirements.
Result
agents.json has a validation warning at "Discover agents.json".
Validation steps
Discover agents.json
No Wildcard-style agents.json file was found.
AI DiscoverabilityBot Access ControlInformational
Content Signal
Content Signal has a validation warning at "Validate declared usage preferences".
13 Warning
AI DiscoverabilityBot Access ControlInformational
Content Signal
Content Signal has a validation warning at "Validate declared usage preferences".
Needs attention
Content Signal
Issue
No Content-Usage or Content-Signal declarations were found.
Why it matters
Content usage preference signals communicate intended downstream AI use separately from robots.txt crawl permission. They can express training and search preferences for compliant systems without replacing access-control rules.
Check name
Content Signal
Score
50/100
Status
warning
Category
Bot Access Control
Maturity
Informational
Goal
Declare AI content usage preferences when the site intentionally publishes machine-readable usage policy.
Result
Content Signal has a validation warning at "Validate declared usage preferences".
Validation steps
Validate declared usage preferences
No Content-Usage or Content-Signal declarations were found.
Agent Ease of UseSkill DiscoveryEmerging recommendation
DNS-AID Agent Discovery
DNS-AID Agent Discovery has a validation warning at "Query DNS-AID records".
13 Warning
Agent Ease of UseSkill DiscoveryEmerging recommendation
DNS-AID Agent Discovery
DNS-AID Agent Discovery has a validation warning at "Query DNS-AID records".
Needs attention
DNS-AID Agent Discovery
Issue
No DNS-AID HTTPS/SVCB records were found under _agents.
Why it matters
DNS-AID lets agents discover index, A2A, and other agent entrypoints before fetching HTTP metadata. HTTPS/SVCB records provide the service-binding substrate, while DNSSEC can authenticate the discovery answer when available.
Check name
DNS-AID Agent Discovery
Score
50/100
Status
warning
Category
Skill Discovery
Maturity
Emerging recommendation
Goal
Publish DNS-AID HTTPS/SVCB records under _agents for DNS-based agent entrypoint discovery.
Result
DNS-AID Agent Discovery has a validation warning at "Query DNS-AID records".
Validation steps
Query DNS-AID records
No DNS-AID HTTPS/SVCB records were found under _agents.
Check DNSSEC authentication evidence
DNSSEC authentication evidence was not visible for the DNS-AID labels or hostname.
AI DiscoverabilityBot Access ControlEmerging recommendation
RSL license signal
No RSL declarations were found.
13 Warning
AI DiscoverabilityBot Access ControlEmerging recommendation
RSL license signal
No RSL declarations were found.
Needs attention
RSL license signal
Issue
No RSL declarations were found.
Why it matters
Really Simple Licensing is an emerging rights-expression layer for communicating content usage and licensing terms separately from robots.txt crawl permission.
Check name
RSL license signal
Score
50/100
Status
warning
Category
Bot Access Control
Maturity
Emerging recommendation
Goal
Declare machine-readable content licensing terms for compliant AI and crawler systems when the site needs them.
Result
No RSL declarations were found.
Validation steps
Discover RSL declarations
No RSL declarations were found.
AI DiscoverabilityBot Access ControlEmerging recommendation
TDMRep declaration
No TDMRep declaration was found.
13 Warning
AI DiscoverabilityBot Access ControlEmerging recommendation
TDMRep declaration
No TDMRep declaration was found.
Needs attention
TDMRep declaration
Issue
No TDMRep declaration was found at /.well-known/tdmrep.json.
Why it matters
TDMRep is a W3C Community Group protocol and IANA-registered well-known URI for declaring text and data mining reservation policy on applicable content.
Check name
TDMRep declaration
Score
50/100
Status
warning
Category
Bot Access Control
Maturity
Emerging recommendation
Goal
Publish a machine-readable text and data mining reservation declaration and verifiable ODRL policy when the site needs one.
Result
No TDMRep declaration was found.
Validation steps
Fetch /.well-known/tdmrep.json
No TDMRep declaration was found at /.well-known/tdmrep.json.
Security & TrustSecurity & TrustEstablished
Content-Security-Policy
Content-Security-Policy failed at "Find enforcing CSP delivery".
12 Fail
Security & TrustSecurity & TrustEstablished
Content-Security-Policy
Content-Security-Policy failed at "Find enforcing CSP delivery".
Needs attention
Content-Security-Policy
Issue
Applicable HTML response is missing an enforcing Content-Security-Policy header.
Why it matters
Content Security Policy reduces the impact of injection bugs by limiting where scripts, styles, frames, forms, and other browser resources can load or execute.
Check name
Content-Security-Policy
Score
40/100
Status
fail
Category
Security & Trust
Maturity
Established
Goal
Constrain browser resource loading and script execution with an enforcing Content-Security-Policy header.
Result
Content-Security-Policy failed at "Find enforcing CSP delivery".
Validation steps
Find enforcing CSP delivery
Applicable HTML response is missing an enforcing Content-Security-Policy header.
Security & TrustSecurity & TrustEstablished
Referrer-Policy
Referrer-Policy failed at "Find Referrer-Policy header".
12 Fail
Security & TrustSecurity & TrustEstablished
Referrer-Policy
Referrer-Policy failed at "Find Referrer-Policy header".
Needs attention
Referrer-Policy
Issue
Referrer-Policy header is missing.
Why it matters
Referrer-Policy controls how much URL context is sent to other origins, limiting accidental leakage of paths, queries, and identifiers.
Check name
Referrer-Policy
Score
40/100
Status
fail
Category
Security & Trust
Maturity
Established
Goal
Limit how much referrer data leaves the site with an explicit Referrer-Policy header.
Result
Referrer-Policy failed at "Find Referrer-Policy header".
Validation steps
Find Referrer-Policy header
Referrer-Policy header is missing.
Review observed browser responses
One or more same-origin HTML documents observed by Chrome did not emit Referrer-Policy.
Security & TrustSecurity & TrustEstablished
Frame protection
Frame protection failed at "Validate X-Frame-Options".
11 Fail
Security & TrustSecurity & TrustEstablished
Frame protection
Frame protection failed at "Validate X-Frame-Options".
Needs attention
Frame protection
Issue
No valid X-Frame-Options fallback is present.
Why it matters
Frame protection blocks hostile sites from embedding pages in deceptive frames, reducing clickjacking and UI redressing risk.
Check name
Frame protection
Score
44/100
Status
fail
Category
Security & Trust
Maturity
Established
Goal
Prevent unwanted framing with an enforcing CSP frame-ancestors directive or a valid X-Frame-Options fallback.
Result
Frame protection failed at "Validate X-Frame-Options".
Validation steps
Validate CSP frame-ancestors
No enforcing CSP frame-ancestors directive is present.
Validate X-Frame-Options
No valid X-Frame-Options fallback is present.
Review observed browser responses
One or more same-origin HTML documents observed by Chrome did not emit valid frame protection.
Security & TrustSecurity & TrustEstablished
HSTS header
HSTS header failed at "Find Strict-Transport-Security".
10 Fail
Security & TrustSecurity & TrustEstablished
HSTS header
HSTS header failed at "Find Strict-Transport-Security".
Needs attention
HSTS header
Issue
HTTPS response is missing Strict-Transport-Security.
Why it matters
HSTS tells browsers to keep using HTTPS after the first secure visit, reducing downgrade, SSL-stripping, and mixed-transport risk for repeat users.
Check name
HSTS header
Score
50/100
Status
fail
Category
Security & Trust
Maturity
Established
Goal
Require HTTPS for repeat browser visits with a valid Strict-Transport-Security policy.
Result
HSTS header failed at "Find Strict-Transport-Security".
Validation steps
Find Strict-Transport-Security
HTTPS response is missing Strict-Transport-Security.
GEO, AIO and AEOGEO, AIO & AEOEmerging recommendation
AEO: Evidence and trust
AEO: Evidence and trust scored 43/100 and needs a fix.
10 Fail
GEO, AIO and AEOGEO, AIO & AEOEmerging recommendation
AEO: Evidence and trust
AEO: Evidence and trust scored 43/100 and needs a fix.
Needs attention
AEO: Evidence and trust
Issue
Missing answer evidence or trust signals: author, publisher, freshnessDate, sameAs.
Details
Why it matters
Answer engines need visible answer passages, clear question and heading structure, entity definitions, evidence, and trust signals. These signals improve extraction and attribution, but they do not guarantee answer-engine citations or search features.
Check name
AEO: Evidence and trust
Score
43/100
Status
fail
Category
GEO, AIO & AEO
Maturity
Emerging recommendation
Goal
Make page content easy for answer engines and assistants to extract, answer from, and attribute without promising inclusion in any proprietary answer surface.
Result
AEO: Evidence and trust scored 43/100 and needs a fix.
Security & TrustSecurity & TrustEstablished
X-Content-Type-Options
X-Content-Type-Options failed at "Find X-Content-Type-Options".
9 Fail
Security & TrustSecurity & TrustEstablished
X-Content-Type-Options
X-Content-Type-Options failed at "Find X-Content-Type-Options".
Needs attention
X-Content-Type-Options
Issue
Browser-loadable response is missing X-Content-Type-Options.
Why it matters
X-Content-Type-Options tells browsers to trust declared media types instead of sniffing content, reducing the risk that mislabeled files execute as active content.
Check name
X-Content-Type-Options
Score
57/100
Status
fail
Category
Security & Trust
Maturity
Established
Goal
Prevent browser MIME sniffing for browser-loadable responses with X-Content-Type-Options: nosniff.
Result
X-Content-Type-Options failed at "Find X-Content-Type-Options".
Validation steps
Find X-Content-Type-Options
Browser-loadable response is missing X-Content-Type-Options.
Review observed browser responses
One or more same-origin active resources observed by Chrome did not emit X-Content-Type-Options: nosniff.
AI DiscoverabilityContent ReadinessEstablished
Semantic HTML
Semantic HTML is partially implemented.
8 Warning
AI DiscoverabilityContent ReadinessEstablished
Semantic HTML
Semantic HTML is partially implemented.
Needs attention
Semantic HTML
Issue
Semantic HTML is incomplete: expected exactly one visible main landmark, found 0; 6 links missing accessible names; 11 images missing alt attributes.
Details
Why it matters
Semantic HTML gives browsers, assistive technology, search systems, and agents reliable landmarks, headings, controls, form semantics, and image context.
Check name
Semantic HTML
Score
54/100
Status
warning
Category
Content Readiness
Maturity
Established
Goal
Expose readable page structure through semantic HTML and accessible controls.
Result
Semantic HTML is partially implemented.
Validation steps
Page landmarks
Expected exactly one visible main landmark; found 0.
Links
6 links are missing accessible names.
Image text alternatives
11 images are missing alt attributes.
GEO, AIO and AEOGEO, AIO & AEOEmerging recommendation
GEO: Citable passages
GEO: Citable passages scored 35/100 and needs a fix.
8 Fail
GEO, AIO and AEOGEO, AIO & AEOEmerging recommendation
GEO: Citable passages
GEO: Citable passages scored 35/100 and needs a fix.
Needs attention
GEO: Citable passages
Issue
No evidence-backed, citation-length explanatory paragraph was found.
Details
Why it matters
Generative answer systems work best with visible, self-contained, evidence-backed content, clear entities, trustworthy attribution, structured page sections, and crawler-accessible HTML. These signals improve machine understanding even though they do not guarantee AI citations.
Check name
GEO: Citable passages
Score
35/100
Status
fail
Category
GEO, AIO & AEO
Maturity
Emerging recommendation
Goal
Make page content easy for AI answer engines to extract, cite, and attribute without promising inclusion in any proprietary answer surface.
Result
GEO: Citable passages scored 35/100 and needs a fix.
GEO, AIO and AEOGEO, AIO & AEOEmerging recommendation
AIO: Source and trust signals
AIO: Source and trust signals scored 50/100 and needs improvement.
8 Warning
GEO, AIO and AEOGEO, AIO & AEOEmerging recommendation
AIO: Source and trust signals
AIO: Source and trust signals scored 50/100 and needs improvement.
Needs attention
AIO: Source and trust signals
Issue
Missing AIO trust signals: author, publisher, freshnessDate.
Details
Why it matters
Google AI Overviews and AI Mode depend on normal Google Search eligibility, snippet permissions, useful visible content, consistent structured data, trust signals, and page experience basics. These signals help Google understand and preview a page, but they do not guarantee selection.
Check name
AIO: Source and trust signals
Score
50/100
Status
warning
Category
GEO, AIO & AEO
Maturity
Emerging recommendation
Goal
Make page content eligible, understandable, and previewable for Google Search AI features without promising inclusion.
Result
AIO: Source and trust signals scored 50/100 and needs improvement.
GEO, AIO and AEOGEO, AIO & AEOEmerging recommendation
GEO: Source and trust signals
GEO: Source and trust signals scored 50/100 and needs improvement.
6 Warning
GEO, AIO and AEOGEO, AIO & AEOEmerging recommendation
GEO: Source and trust signals
GEO: Source and trust signals scored 50/100 and needs improvement.
Needs attention
GEO: Source and trust signals
Issue
Missing source or trust signals: authorOrOwner, freshnessDate, entityLinks.
Details
Why it matters
Generative answer systems work best with visible, self-contained, evidence-backed content, clear entities, trustworthy attribution, structured page sections, and crawler-accessible HTML. These signals improve machine understanding even though they do not guarantee AI citations.
Check name
GEO: Source and trust signals
Score
50/100
Status
warning
Category
GEO, AIO & AEO
Maturity
Emerging recommendation
Goal
Make page content easy for AI answer engines to extract, cite, and attribute without promising inclusion in any proprietary answer surface.
Result
GEO: Source and trust signals scored 50/100 and needs improvement.
GEO, AIO and AEOGEO, AIO & AEOEmerging recommendation
GEO: Structured extraction
GEO: Structured extraction scored 63/100 and needs improvement.
4 Warning
GEO, AIO and AEOGEO, AIO & AEOEmerging recommendation
GEO: Structured extraction
GEO: Structured extraction scored 63/100 and needs improvement.
Needs attention
GEO: Structured extraction
Issue
Missing or weak extraction signals: summary or key takeaways, FAQ or question-answer section where appropriate, typed JSON-LD structured data.
Details
Why it matters
Generative answer systems work best with visible, self-contained, evidence-backed content, clear entities, trustworthy attribution, structured page sections, and crawler-accessible HTML. These signals improve machine understanding even though they do not guarantee AI citations.
Check name
GEO: Structured extraction
Score
63/100
Status
warning
Category
GEO, AIO & AEO
Maturity
Emerging recommendation
Goal
Make page content easy for AI answer engines to extract, cite, and attribute without promising inclusion in any proprietary answer surface.
Result
GEO: Structured extraction scored 63/100 and needs improvement.
GEO, AIO and AEOGEO, AIO & AEOEmerging recommendation
AIO: Page experience proxy
AIO: Page experience proxy scored 80/100 and needs improvement.
3 Warning
GEO, AIO and AEOGEO, AIO & AEOEmerging recommendation
AIO: Page experience proxy
AIO: Page experience proxy scored 80/100 and needs improvement.
Needs attention
AIO: Page experience proxy
Issue
11 image(s) are missing width/height attributes.
Details
Why it matters
Google AI Overviews and AI Mode depend on normal Google Search eligibility, snippet permissions, useful visible content, consistent structured data, trust signals, and page experience basics. These signals help Google understand and preview a page, but they do not guarantee selection.
Check name
AIO: Page experience proxy
Score
80/100
Status
warning
Category
GEO, AIO & AEO
Maturity
Emerging recommendation
Goal
Make page content eligible, understandable, and previewable for Google Search AI features without promising inclusion.
Result
AIO: Page experience proxy scored 80/100 and needs improvement.
AI DiscoverabilityDiscoverabilityEstablished
IndexNow key
IndexNow key is informational for this page.
Informational
AI DiscoverabilityDiscoverabilityEstablished
IndexNow key
IndexNow key is informational for this page.
Needs attention
IndexNow key
Issue
IndexNow key is informational for this page.
Why it matters
IndexNow lets sites notify participating search engines about changed URLs, but ownership verification requires a UTF-8 key file whose filename matches the key.
Check name
IndexNow key
Score
100/100
Status
informational
Category
Discoverability
Maturity
Established
Goal
Verify that IndexNow ownership key placement is detectable when the site advertises it.
Result
IndexNow key is informational for this page.
Validation steps
Find advertised IndexNow key location
No IndexNow key location was advertised in HTML, Link headers, or robots.txt.
Fetch and validate IndexNow key file
No discoverable IndexNow key file was found.
Performance and AccessibilityBest PracticesBrowser audit
Charset declaration is missing or occurs too late in the HTML
100 Fail
Performance and AccessibilityBest PracticesBrowser audit
Charset declaration is missing or occurs too late in the HTML
Check name
Charset declaration is missing or occurs too late in the HTML
Score
0/100
Status
fail
Device
desktop
Category
Best Practices
Fix guidance
A character encoding declaration is required. It can be done with a `<meta>` tag in the first 1024 bytes of the HTML or in the Content-Type HTTP response header. [Learn more about declaring the character encoding](https://developer.chrome.com/docs/lighthouse/best-practices/charset/).
Evidence
{
"description": "A character encoding declaration is required. It can be done with a `<meta>` tag in the first 1024 bytes of the HTML or in the Content-Type HTTP response header. [Learn more about declaring the character encoding](https://developer.chrome.com/docs/lighthouse/best-practices/charset/)."
}SEOSEOBrowser audit
Image elements do not have `[alt]` attributes
100 Fail
SEOSEOBrowser audit
Image elements do not have `[alt]` attributes
Check name
Image elements do not have `[alt]` attributes
Score
0/100
Status
fail
Device
desktop
Category
SEO
Fix guidance
Informative elements should aim for short, descriptive alternate text. Decorative elements can be ignored with an empty alt attribute. [Learn more about the `alt` attribute](https://dequeuniversity.com/rules/axe/4.11/image-alt).
Evidence
{
"description": "Informative elements should aim for short, descriptive alternate text. Decorative elements can be ignored with an empty alt attribute. [Learn more about the `alt` attribute](https://dequeuniversity.com/rules/axe/4.11/image-alt)."
}Performance and AccessibilityPerformanceBrowser audit
Avoid large layout shifts
10 Fail
Performance and AccessibilityPerformanceBrowser audit
Avoid large layout shifts
Check name
Avoid large layout shifts
Score
0/100
Status
fail
Device
desktop
Category
Performance
Estimated savings
2 layout shifts found
Fix guidance
These are the largest layout shifts observed on the page. Each table item represents a single layout shift, and shows the element that shifted the most. Below each item are possible root causes that led to the layout shift. Some of these layout shifts may not be included in the CLS metric value due to [windowing](https://web.dev/articles/cls#what_is_cls). [Learn how to improve CLS](https://web.dev/articles/optimize-cls)
References
https://web.dev/learn/performance/Evidence
{
"description": "These are the largest layout shifts observed on the page. Each table item represents a single layout shift, and shows the element that shifted the most. Below each item are possible root causes that led to the layout shift. Some of these layout shifts may not be included in the CLS metric value due to [windowing](https://web.dev/articles/cls#what_is_cls). [Learn how to improve CLS](https://web.dev/articles/optimize-cls)",
"displayValue": "2 layout shifts found"
}Performance and AccessibilityPerformanceBrowser audit
Document does not have a main landmark.
10 Fail
Performance and AccessibilityPerformanceBrowser audit
Document does not have a main landmark.
Check name
Document does not have a main landmark.
Score
0/100
Status
fail
Device
desktop
Category
Performance
Fix guidance
One main landmark helps screen reader users navigate a web page. [Learn more about landmarks](https://dequeuniversity.com/rules/axe/4.11/landmark-one-main).
References
https://web.dev/learn/performance/Evidence
{
"description": "One main landmark helps screen reader users navigate a web page. [Learn more about landmarks](https://dequeuniversity.com/rules/axe/4.11/landmark-one-main)."
}Performance and AccessibilityPerformanceBrowser audit
Layout shift culprits
10 Fail
Performance and AccessibilityPerformanceBrowser audit
Layout shift culprits
Check name
Layout shift culprits
Score
0/100
Status
fail
Device
desktop
Category
Performance
Fix guidance
Layout shifts occur when elements move absent any user interaction. [Investigate the causes of layout shifts](https://developer.chrome.com/docs/performance/insights/cls-culprit), such as elements being added, removed, or their fonts changing as the page loads.
References
https://web.dev/learn/performance/Evidence
{
"description": "Layout shifts occur when elements move absent any user interaction. [Investigate the causes of layout shifts](https://developer.chrome.com/docs/performance/insights/cls-culprit), such as elements being added, removed, or their fonts changing as the page loads."
}Performance and AccessibilityPerformanceBrowser audit
Links do not have a discernible name
10 Fail
Performance and AccessibilityPerformanceBrowser audit
Links do not have a discernible name
Check name
Links do not have a discernible name
Score
0/100
Status
fail
Device
desktop
Category
Performance
Fix guidance
Link text (and alternate text for images, when used as links) that is discernible, unique, and focusable improves the navigation experience for screen reader users. [Learn how to make links accessible](https://dequeuniversity.com/rules/axe/4.11/link-name).
References
https://web.dev/learn/performance/Evidence
{
"description": "Link text (and alternate text for images, when used as links) that is discernible, unique, and focusable improves the navigation experience for screen reader users. [Learn how to make links accessible](https://dequeuniversity.com/rules/axe/4.11/link-name)."
}Performance and AccessibilityPerformanceBrowser audit
Network dependency tree
10 Fail
Performance and AccessibilityPerformanceBrowser audit
Network dependency tree
Check name
Network dependency tree
Score
0/100
Status
fail
Device
desktop
Category
Performance
Fix guidance
[Avoid chaining critical requests](https://developer.chrome.com/docs/performance/insights/network-dependency-tree) by reducing the length of chains, reducing the download size of resources, or deferring the download of unnecessary resources to improve page load.
References
https://web.dev/learn/performance/Evidence
{
"description": "[Avoid chaining critical requests](https://developer.chrome.com/docs/performance/insights/network-dependency-tree) by reducing the length of chains, reducing the download size of resources, or deferring the download of unnecessary resources to improve page load."
}Performance and AccessibilityPerformanceBrowser audit
Reduce JavaScript execution time
10 Fail
Performance and AccessibilityPerformanceBrowser audit
Reduce JavaScript execution time
Check name
Reduce JavaScript execution time
Score
0/100
Status
fail
Device
desktop
Category
Performance
Estimated savings
2.5 s
Fix guidance
Consider reducing the time spent parsing, compiling, and executing JS. You may find delivering smaller JS payloads helps with this. [Learn how to reduce Javascript execution time](https://developer.chrome.com/docs/lighthouse/performance/bootup-time/).
References
https://web.dev/learn/performance/Evidence
{
"description": "Consider reducing the time spent parsing, compiling, and executing JS. You may find delivering smaller JS payloads helps with this. [Learn how to reduce Javascript execution time](https://developer.chrome.com/docs/lighthouse/performance/bootup-time/).",
"displayValue": "2.5 s",
"numericValue": 2549.0479999999975
}Performance and AccessibilityPerformanceBrowser audit
Loading performance
6 Fail
Performance and AccessibilityPerformanceBrowser audit
Loading performance
Check name
Loading performance
Score
44/100
Status
fail
Device
desktop
Category
Performance
Fix guidance
Review the grouped loading performance checks and improve the failing sub-checks listed in evidence.
References
https://web.dev/learn/performance/Evidence
{
"checks": [
{
"id": "network-rtt",
"score": 100,
"title": "Network Round Trip Times",
"displayValue": "60 ms",
"numericValue": 63.596295
},
{
"id": "speed-index",
"score": 32,
"title": "Speed Index",
"displayValue": "2.8 s",
"numericValue": 2799.5565558354474
},
{
"id": "largest-contentful-paint",
"score": 42,
"title": "Largest Contentful Paint",
"displayValue": "2.6 s",
"numericValue": 2647.4484637727173
},
{
"id": "interactive",
"score": 33,
"title": "Time to Interactive",
"displayValue": "5.5 s",
"numericValue": 5488.640626282515
},
{
"id": "first-contentful-paint",
"score": 36,
"title": "First Contentful Paint",
"displayValue": "1.8 s",
"numericValue": 1843.00549595631
},
{
"id": "total-blocking-time",
"score": 3,
"title": "Total Blocking Time",
"displayValue": "1,180 ms",
"numericValue": 1180.8636100678646
},
{
"id": "max-potential-fid",
"score": 2,
"title": "Max Potential First Input Delay",
"displayValue": "680 ms",
"numericValue": 676
},
{
"id": "server-response-time",
"score": 100,
"title": "Initial server response time was short",
"displayValue": "Root document took 0 ms",
"numericValue": 4
}
]
}Performance and AccessibilityPerformanceBrowser audit
Avoid enormous network payloads
5 Warning
Performance and AccessibilityPerformanceBrowser audit
Avoid enormous network payloads
Check name
Avoid enormous network payloads
Score
50/100
Status
warning
Device
desktop
Category
Performance
Estimated savings
Total size was 3,031 KiB
Fix guidance
Large network payloads cost users real money and are highly correlated with long load times. [Learn how to reduce payload sizes](https://developer.chrome.com/docs/lighthouse/performance/total-byte-weight/).
References
https://web.dev/learn/performance/Evidence
{
"description": "Large network payloads cost users real money and are highly correlated with long load times. [Learn how to reduce payload sizes](https://developer.chrome.com/docs/lighthouse/performance/total-byte-weight/).",
"displayValue": "Total size was 3,031 KiB",
"numericValue": 3103949
}Performance and AccessibilityPerformanceBrowser audit
Legacy JavaScript
5 Warning
Performance and AccessibilityPerformanceBrowser audit
Legacy JavaScript
Check name
Legacy JavaScript
Score
50/100
Status
warning
Device
desktop
Category
Performance
Estimated savings
Est savings of 54 KiB
Fix guidance
Polyfills and transforms enable older browsers to use new JavaScript features. However, many aren't necessary for modern browsers. Consider modifying your JavaScript build process to not transpile [Baseline](https://web.dev/articles/baseline-and-polyfills) features, unless you know you must support older browsers. [Learn why most sites can deploy ES6+ code without transpiling](https://developer.chrome.com/docs/performance/insights/legacy-javascript)
References
https://web.dev/learn/performance/Evidence
{
"description": "Polyfills and transforms enable older browsers to use new JavaScript features. However, many aren't necessary for modern browsers. Consider modifying your JavaScript build process to not transpile [Baseline](https://web.dev/articles/baseline-and-polyfills) features, unless you know you must support older browsers. [Learn why most sites can deploy ES6+ code without transpiling](https://developer.chrome.com/docs/performance/insights/legacy-javascript)",
"displayValue": "Est savings of 54 KiB"
}Performance and AccessibilityPerformanceBrowser audit
Render-blocking requests
5 Warning
Performance and AccessibilityPerformanceBrowser audit
Render-blocking requests
Check name
Render-blocking requests
Score
50/100
Status
warning
Device
desktop
Category
Performance
Fix guidance
Requests are blocking the page's initial render, which may delay LCP. [Deferring or inlining](https://developer.chrome.com/docs/performance/insights/render-blocking) can move these network requests out of the critical path.
References
https://web.dev/learn/performance/Evidence
{
"description": "Requests are blocking the page's initial render, which may delay LCP. [Deferring or inlining](https://developer.chrome.com/docs/performance/insights/render-blocking) can move these network requests out of the critical path."
}Fix with MCP or CLI
Use this report as the handoff into remediation. Generate a coding-agent prompt with the failing checks attached, or jump to the MCP and CLI setup docs before your next rescan.
Score history
Public scan score over time
Public reports for this website origin. Select any point or report link to open that canonical report.
| Scan date | Score | Readiness | Report |
|---|---|---|---|
| 51/100 | Level 3, Bot-Aware | Current report |