Can agents find your site and its capabilities?
Crawled 5 of 12 discovered pages beyond the homepage.
Could not identify a known website platform (custom stack or unrecognised).
Can agents understand your content?
60 of 61 images have alt attributes (98%).
Fix: Add alt text to the remaining images. Empty alt="" is fine for purely-decorative graphics.
Only 22/61 images have width+height — large CLS risk.
Fix: Set width and height on every <img> so the browser reserves space before the image loads. A layout that shifts while loading makes an AI agent mis-click the element it targeted.
Missing landmark elements: main, header, nav.
3 of 5 pages are missing <title> and/or <h1>: /en/contact-us, /contact-us, /services.
Fix: Make sure every page sets a unique <title> and exactly one <h1>. The title is how an AI agent confirms it landed on the right page after navigating.
Homepage returns text/markdown when requested.
Homepage server response contains 373 words of visible text — content is reachable without executing JavaScript.
Homepage contains ~1192 elements.
22 headings, no level skips.
Language declared as "en".
19 internal links found.
Exactly one <h1> on the homepage.
All 5 pages return ≥80 words of visible text without JavaScript.
Can agents actually operate the page?
5 of 7 visible interactive form fields have labels.
Fix: Associate every input with a label — either wrap it in <label>, link via for/id, or set aria-label / aria-labelledby.
No tool catalog was found at /.well-known/webmcp.json (or /.well-known/webmcp). The catalog is a community convention, not part of the WebMCP standard, so this does not affect WebMCP presence.
Fix: Consider also publishing a tool catalog at /.well-known/webmcp.json: a JSON document with a "spec" of "webmcp/0.1" and a "tools" array, where each tool declares a name and a clear description. It is a community convention (optional, not part of the WebMCP standard) that lets crawlers and agents discover your tools without executing JavaScript.
Can agents safely transact?
/.well-known/oauth-authorization-server returned the site's HTML app shell — treating as not published.
Fix: Publish /.well-known/oauth-authorization-server so AI agents discovering your OAuth setup can negotiate flows automatically. Required if your site offers an authenticated API.
/.well-known/oauth-protected-resource returned the site's HTML app shell — treating as not published.
Fix: Publish /.well-known/oauth-protected-resource so AI agents discovering your OAuth setup can negotiate flows automatically. Required if your site offers an authenticated API.
No Web Bot Auth signature headers — sites can't verify agent identity.
Fix: Web Bot Auth (IETF HTTP Message Signatures over Signature / Signature-Input) lets you cryptographically verify which agent is hitting you. Several CDNs offer turn-key support; otherwise skip until vendor support matures.
HSTS max-age=15552000 is below six months.
Fix: Raise max-age to at least 15768000 (six months). The HSTS preload list requires 31536000 (one year).
cf-ray: a1eb5b4c7a5aa016-AMS (Cloudflare); Server: cloudflare
CSP header present.
Homepage scheme is https:.
http://almosafer.com → https://global.almosafer.com/en (4 hops).
No stack-trace markers in the first 5KB.
Homepage HTML references no http:// resources.
Referrer-Policy: no-referrer-when-downgrade.
Valid for 33 more days (Aug 24 03:43:36 2026 GMT, issuer: E7).
Server / X-Powered-By headers don't leak product version.
X-Content-Type-Options: nosniff.
CSP frame-ancestors directive present.