https://example-store.com

Evidence: Product titles, prices, and descriptions are present in the initial HTML — an agent can read them without executing JavaScript.

Evidence: Valid schema.org/Product JSON-LD found on 18 of 18 sampled product pages, including name, price, and availability.

Evidence: A /llms.txt is published but does not follow the convention — it has no "# " title line and no markdown links, so an agent cannot navigate from it.

Fix: Give your /llms.txt an `# H1` title, a `>` one-line summary, and markdown links to your key product and policy pages.

# example-store.com
> Independent outdoor-gear store. Free shipping over $75.

## Catalog
- /collections/tents: Backpacking and car-camping tents
- /collections/sleeping-bags: Down and synthetic bags

## Policies
- /pages/shipping: Shipping & delivery
- /pages/returns: 30-day returns

Evidence: schema.org/Organization is present but missing "sameAs" social links and "contactPoint", so agents cannot reliably attribute or contact your brand.

Fix: Extend the Organization JSON-LD with sameAs and contactPoint fields.

{
  "@context": "https://schema.org",
  "@type": "Organization",
  "name": "Example Store",
  "url": "https://example-store.com",
  "sameAs": [
    "https://x.com/examplestore",
    "https://www.instagram.com/examplestore"
  ],
  "contactPoint": {
    "@type": "ContactPoint",
    "contactType": "customer support",
    "email": "[email protected]"
  }
}

Evidence: Every sampled page declares a self-referencing canonical URL and a descriptive <title>.

Evidence: robots.txt found and parses cleanly. AI crawlers (GPTBot, Google-Extended, ClaudeBot) are allowed.

Evidence: sitemap.xml found with 412 URLs and referenced from robots.txt. Last-modified dates are present.

Evidence: 23 product pages share the same generic meta description ("Shop quality outdoor gear at Example Store."). Duplicate descriptions weaken snippets and AI summaries.

Fix: Generate a unique meta description per product from its key attributes.

Evidence: og:title, og:description, og:image, and og:type are present on home, collection, and product templates.

Evidence: Each sampled page has exactly one <h1> that matches the page intent.

Evidence: Lab LCP is 1.9s on a simulated 4G connection — within the "good" threshold of 2.5s.

Evidence: CLS is 0.14 — above the 0.1 "good" threshold. A hero banner and product images load without reserved dimensions.

Fix: Set explicit width and height (or aspect-ratio) on the hero and product images to reserve layout space.

<img
  src="/img/hero.jpg"
  width="1280"
  height="640"
  alt="Two hikers setting up a tent at dusk"
/>

Evidence: 41 of 96 sampled images have empty or missing alt attributes, including primary product photos. Screen-reader users and agents cannot identify them.

Fix: Add concise, descriptive alt text to every meaningful image; mark purely decorative images with alt="".

Evidence: Body and heading text meet the 4.5:1 contrast ratio. One muted footer link sits at 4.6:1 — passing but close.

Evidence: <header>, <nav>, <main>, and <footer> landmarks are present and used consistently across templates.

Evidence: Served over HTTPS with a valid certificate (expires in 67 days). HTTP requests 301-redirect to HTTPS.

Evidence: Strict-Transport-Security is present but max-age is only 86400 (1 day) and omits includeSubDomains.

Fix: Raise max-age to at least one year and include subdomains once you have verified HTTPS everywhere.

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Evidence: No Content-Security-Policy header was returned. Without a CSP the store is more exposed to cross-site scripting and content injection.

Fix: Add a Content-Security-Policy header, starting in report-only mode to find violations before enforcing.

Content-Security-Policy: default-src 'self'; img-src 'self' https: data:; script-src 'self'; object-src 'none'; frame-ancestors 'none'

Evidence: X-Content-Type-Options: nosniff and Referrer-Policy: strict-origin-when-cross-origin are both set.

Evidence: All sub-resources (scripts, styles, images, fonts) load over HTTPS. No mixed-content warnings detected.