dubai.ae · Government & Public Services
Can agents find your site and its capabilities?
Lighthouse Agentic Browsing audits ran.
Could not identify a known website platform (custom stack or unrecognised).
Can agents understand your content?
Homepage ignored Accept: text/markdown and returned HTML.
Fix: Serve a markdown version of high-value pages when the client asks for text/markdown. AI summarisers, chatbots and IDE agents prefer markdown — fewer tokens, no DOM noise.
21 of 26 images have alt attributes (81%).
Fix: Add alt text to the remaining images. Empty alt="" is fine for purely-decorative graphics.
Only 0/26 images have width+height — large CLS risk.
Fix: Set width and height on every <img> so the browser reserves space before the image loads. A layout that shifts while loading makes an AI agent mis-click the element it targeted.
Missing landmark elements: main, header, footer.
Found 17 <h1> tags. Most AI summarisers expect exactly one.
Fix: Demote the secondary H1s to H2 — keep H1 reserved for the page title.
Homepage server response contains 505 words of visible text — content is reachable without executing JavaScript.
Homepage contains ~718 elements.
18 headings, no level skips.
Language declared as "en-US".
15 internal links found.
Can agents actually operate the page?
1.18s (field data from CrUX, for this page). Needs improvement.
Fix: Every request an AI agent makes pays this server latency, and agents make many requests per task. Reduce TTFB with edge caching, a CDN, and shipping less server-side work per request.
All 10 agent-critical accessibility audits passed — an agent can perceive and operate the page through its accessibility tree.
`[aria-*]` attributes match their roles passed.
`[aria-hidden="true"]` is not present on the document `<body>` passed.
`[aria-hidden="true"]` elements do not contain focusable descendents passed.
`[role]`s have all required `[aria-*]` attributes passed.
`[role]` values are valid passed.
`[aria-*]` attributes are valid and not misspelled passed.
`[aria-*]` attributes have valid values passed.
Buttons have an accessible name passed.
Document has a `<title>` element passed.
Links have a discernible name passed.
Lighthouse accessibility score: 100/100. Agents read the page through its accessibility tree, so this is a proxy for how navigable your site is to an AI agent.
2 of 2 visible interactive form fields have labels.
All audits passed
0.004
0.050 (field data from CrUX, for this page). Good.
5 forms missing annotations
Lists the [WebMCP tools](https://developer.chrome.com/docs/ai/webmcp) registered at the time of analysis.
Can agents safely transact?
/.well-known/oauth-authorization-server returned 403.
Fix: Publish /.well-known/oauth-authorization-server so AI agents discovering your OAuth setup can negotiate flows automatically. Required if your site offers an authenticated API.
/.well-known/oauth-protected-resource returned 404.
Fix: Publish /.well-known/oauth-protected-resource so AI agents discovering your OAuth setup can negotiate flows automatically. Required if your site offers an authenticated API.
No Web Bot Auth signature headers — sites can't verify agent identity.
Fix: Web Bot Auth (IETF HTTP Message Signatures over Signature / Signature-Input) lets you cryptographically verify which agent is hitting you. Several CDNs offer turn-key support; otherwise skip until vendor support matures.
No Content-Security-Policy header on the homepage.
Fix: Add a Content-Security-Policy. Even a strict default-src directive cuts XSS blast radius dramatically. Start in report-only mode to find violations.
No Referrer-Policy header on the homepage.
Fix: Add `Referrer-Policy: strict-origin-when-cross-origin` so outbound links don't leak full URLs (including query strings) to third parties.
x-akamai-transformed: 9 - 0 pmb=mRUM,1 (Akamai)
max-age=31536000, includeSubDomains=true, preload=true.
Homepage scheme is https:.
http://dubai.ae → https://www.dubai.ae/ (2 hops).
No stack-trace markers in the first 5KB.
Homepage HTML references no http:// resources.
Valid for 89 more days (Dec 3 06:04:38 2026 GMT, issuer: YR2).
Server / X-Powered-By headers don't leak product version.
X-Content-Type-Options: nosniff.
X-Frame-Options: SAMEORIGIN.