The check catalog
73 checks in 8 categories. Each page explains what the check verifies, why a failure costs you something and how to fix it. Nothing here is a black box.
Crawlability10AI search readiness7Agent readiness18On-page SEO11Structured data5Performance9Accessibility5Security headers8
73 checks
Crawlability
10 checks
- The audited URL answers with HTTP 200criticalcrawl.http-statusThe URL ends in HTTP 200 after redirects.
- Redirects are short and do not loopmediumcrawl.redirect-chainAt most one redirect hop, and no redirect loops.
- The site is served over HTTPShighcrawl.httpsThe final URL uses HTTPS and the http version redirects to it.
- One canonical host answers for every variantmediumcrawl.host-canonicalThe www and non-www variants, with and without a trailing slash, resolve to a single form.
- robots.txt exists and is usablehighcrawl.robots-txtThe file exists, returns 200, parses, and stays under 500 KiB.
- The default robots rules do not block the sitecriticalcrawl.robots-blockingThe wildcard rules in robots.txt do not block the audited URL or the key paths of the site.
- A valid sitemap is published and declaredhighcrawl.sitemapThe sitemap exists, parses as XML, is declared in robots.txt, and its sample urls answer with 200.
- The page is not marked as noindexcriticalcrawl.noindexNo noindex directive appears in the meta robots tag or in the X-Robots-Tag header.
- The canonical link points at the page itselfhighcrawl.canonicalA rel=canonical link exists, is absolute, matches the page and does not point at a redirect or an error.
- Internal links resolvemediumcrawl.internal-linksSampled internal links answer with 2xx, or with a single redirect.
AI search readiness
7 checks
- AI crawlers are allowed in robots.txtmediumai.crawler-accessWhat robots.txt says about each known AI crawler, classified as training, search or user triggered.
- AI crawlers receive the same page as everyone elsehighai.bot-fetch-parityThe page returns the same status and substantially the same content to AI crawler user agents as to a default client.
- An llms.txt file describes the sitelowai.llms-txtThe file exists, is plain text or Markdown, has a title and a summary, and its links resolve.
- An llms-full.txt file is availableinfoai.llms-full-txtThe optional llms-full.txt file exists.
- The main content is in the initial HTMLhighai.content-without-jsThe main content is present before JavaScript runs, not only after the page is rendered.
- A Markdown version of the page is offeredinfoai.markdown-alternateThe page offers a Markdown version through an alternate link or a .md URL.
- Agent discovery files are publishedinfoai.agent-discoveryMachine readable discovery files such as an MCP server card, an API catalog and an OpenAPI document are available.
Agent readiness
18 checks
- Link headers point agents to the API and docslowagents.link-headersThe page answers with Link headers (RFC 8288) that name agent-useful resources such as api-catalog, service-desc or service-doc.
- Agents can ask for the page as Markdownlowagents.markdown-negotiationA request with Accept: text/markdown receives the page as Markdown (Content-Type: text/markdown), while browsers still get HTML.
- robots.txt states how AI may use the contentlowagents.content-signalsrobots.txt declares Content-Signal preferences for search, ai-input and ai-train.
- An API catalog lists the site's APIslowagents.api-catalog/.well-known/api-catalog answers with an application/linkset+json document whose linkset names each API and its description.
- An MCP server card describes the MCP serverlowagents.mcp-server-card/.well-known/mcp/server-card.json describes the site's MCP server: its name and how to reach it.
- An Agent Skills index lists the skills agents can uselowagents.agent-skills/.well-known/agent-skills/index.json lists skills, each with a name, a description and the url of its SKILL.md.
- auth.md tells agents how to authenticatelowagents.auth-md/auth.md explains, in Markdown, how an agent registers and authenticates, or that it does not need to.
- OAuth discovery metadata is publishedlowagents.oauth-discoveryA site whose API needs credentials publishes /.well-known/oauth-authorization-server or /.well-known/openid-configuration.
- OAuth protected resource metadata is publishedlowagents.oauth-protected-resourceA site whose API needs credentials publishes /.well-known/oauth-protected-resource naming the resource and its authorization servers.
- An ARD catalog lists the site's agentic resourceslowagents.ard/.well-known/ai-catalog.json is an Agentic Resource Discovery manifest with a specVersion, a host and valid entries.
- The page registers WebMCP toolslowagents.webmcpThe page registers tools for in-browser agents through document.modelContext (WebMCP).
- DNS records announce the site's agents (DNS-AID)infoagents.dns-aidDNS for AI Discovery records exist at _index._agents, _a2a._agents or _mcp._agents, signed with DNSSEC.
- The site signs its own bots (Web Bot Auth)infoagents.web-bot-auth/.well-known/http-message-signatures-directory publishes the keys the site's own bots sign their requests with.
- A Personal Agent Protocol manifest is publishedinfoagents.poppy/.well-known/poppy.json declares the organization and how personal agents may act on the site.
- Agents can pay with x402infoagents.x402The site answers paid requests with HTTP 402 and x402 payment requirements.
- The API describes machine payments (MPP)infoagents.mppThe OpenAPI document marks paid operations with x-payment-info for the Machine Payments Protocol.
- A Universal Commerce Protocol profile is publishedinfoagents.ucp/.well-known/ucp describes the store's commerce capabilities for agents.
- An Agentic Commerce Protocol document is publishedinfoagents.acp/.well-known/acp.json describes how agents can check out on the site.
On-page SEO
11 checks
- The title tag is present and well sizedhighpage.titleA title exists, is roughly 30 to 60 characters, and is unique across the sampled pages.
- The meta description is present and well sizedmediumpage.meta-descriptionA meta description exists, is roughly 70 to 160 characters, and is unique across the sampled pages.
- The page has exactly one H1mediumpage.h1Exactly one non-empty H1 element exists.
- The heading outline does not skip levelslowpage.heading-orderHeadings descend one level at a time and none of them is empty.
- The document declares its languagelowpage.langThe html element carries a valid BCP 47 language tag.
- The hreflang annotations are completemediumpage.hreflangWhen hreflang is used, the codes are valid, the links are reciprocal and an x-default exists.
- The Open Graph tags are completelowpage.open-graphog:title, og:description, og:image and og:url are present and the image resolves.
- The Twitter card tags are completelowpage.twitter-cardtwitter:card is set and the fields that match the card type are present.
- Images carry alternative textmediumpage.image-altEvery image that carries meaning has an alt attribute.
- The viewport allows zoominghighpage.viewportA viewport meta tag is present and does not disable zoom.
- The page carries enough contentlowpage.thin-contentThe visible word count is not very low for the page type.
Structured data
5 checks
- The JSON-LD blocks are validhighschema.json-ld-validEvery JSON-LD block parses as JSON and declares a context and a type.
- The structured data types found on the pageinfoschema.types-detectedLists the schema.org types the page declares.
- The structured data carries its required propertiesmediumschema.required-propertiesDetected types include the required and recommended properties for that type.
- The site identifies its organisationmediumschema.organizationAn Organization or WebSite entity is present. An Organization also declares a logo and its sameAs profiles.
- The page declares its breadcrumbslowschema.breadcrumbsA BreadcrumbList entity is present on nested pages.
Performance
9 checks
- The server answers quicklymediumperf.ttfbTime to first byte, measured from the audit location.
- The largest element appears quicklyhighperf.lcpLargest Contentful Paint on a throttled mobile profile.
- The page does not shift while it loadsmediumperf.clsCumulative Layout Shift on a throttled mobile profile.
- The page responds to input quicklymediumperf.tbtTotal Blocking Time, the lab stand in for Interaction to Next Paint.
- The page is not too heavylowperf.page-weightTotal transfer size of the page and its subresources.
- Text assets are compressedmediumperf.compressionText responses are served with gzip or Brotli.
- Static assets are cachedlowperf.cachingStatic assets carry an effective Cache-Control header.
- Images use modern formatslowperf.image-formatsImages are served in modern formats and are not grossly oversized.
- The page is not blocked by head resourcesmediumperf.render-blockingRender blocking CSS and JavaScript in the document head.
Accessibility
5 checks
- Text meets the colour contrast requirementmediuma11y.contrastText contrast follows WCAG 2 AA for normal and large text.
- Form controls have labelshigha11y.form-labelsEvery form control carries an accessible label.
- The page uses landmarkslowa11y.landmarksThe page has a main landmark and a sensible landmark structure.
- Interactive elements have accessible nameshigha11y.namesLinks, buttons and images expose a name to assistive technology.
- The ARIA usage is validmediuma11y.ariaARIA roles and attributes are used in ways that assistive technology can act on.
Security headers
8 checks
- The certificate is valid for the hosthighsec.tls-certificateThe TLS handshake succeeds, so the chain is trusted and the hostname matches.
- Strict Transport Security is setmediumsec.hstsThe Strict-Transport-Security header is present with a max-age of at least six months.
- The page has no mixed contenthighsec.mixed-contentNo http subresource is loaded by an https page.
- A Content Security Policy is setlowsec.cspA Content-Security-Policy header exists, and script-src does not rely on unsafe-inline.
- The content type is not sniffedlowsec.content-type-optionsThe X-Content-Type-Options header is set to nosniff.
- A referrer policy is setlowsec.referrer-policyThe Referrer-Policy header is present.
- The page cannot be framedlowsec.clickjackingX-Frame-Options is set, or the content security policy declares frame-ancestors.
- Cookies are set with safe flagslowsec.cookie-flagsCookies set by the response use Secure, HttpOnly where appropriate, and SameSite.
No check matches these filters.