Can agents find your site and its capabilities?
Crawled 12 of 12 discovered pages beyond the homepage.
Could not identify a known website platform (custom stack or unrecognised).
Can agents understand your content?
No semantic landmark elements (main, header, footer, nav) detected on the homepage.
Fix: Wrap your page structure in semantic landmarks. AI structural extractors rely on them to separate navigation from content from boilerplate.
Homepage returned 429 for Accept: text/markdown.
Homepage server response contains only 68 words of visible text. AI agents that don't execute JavaScript may see an empty page.
Fix: Consider pre-rendering or server-rendering the homepage so AI crawlers (which typically don't run JS) can see the content. Frameworks: Next.js (Server Components), Nuxt SSR, Astro, or Vite SSG.
Only 2 internal links on the homepage.
Fix: Add at least 5-10 internal links pointing to your top product, pricing, docs, blog and about pages so an AI agent can navigate to them from the homepage.
11 of 12 pages return <80 words of visible text — agents without JavaScript see an empty page: /contact (68w), /contact-us (68w), /pricing (68w), /plans (68w), /about (68w), /about-us (68w), /services (68w), /products (68w), /blog (68w), /news (68w), /faq (68w).
Fix: Pre-render or server-render these pages so AI crawlers (which usually don't execute JS) can read them. Frameworks: Next.js Server Components, Nuxt SSR, Astro, or build-time prerendering.
Homepage contains ~54 elements.
1 headings, no level skips.
Language declared as "ru".
Exactly one <h1> on the homepage.
All 12 reachable key pages have both a <title> and <h1>.
Can agents actually operate the page?
3 of 12 agent-critical accessibility audits failed (Buttons do not have an accessible name, Links do not have a discernible name, `<frame>` or `<iframe>` elements do not have a title) — an agent may be unable to identify or operate the affected elements.
Fix: Fix the failing agent-accessibility audits listed below (accessible names on controls, valid ARIA roles/relationships, nothing interactive hidden from the tree).
Lighthouse flagged this audit — agents may be unable to perceive or operate the affected elements.
Fix: Give every <button> discernible text or an aria-label so agents can identify it.
Lighthouse flagged this audit — agents may be unable to perceive or operate the affected elements.
Fix: Add a title to every <iframe> so agents can identify embedded content.
Lighthouse flagged this audit — agents may be unable to perceive or operate the affected elements.
Fix: Give every link discernible text (avoid bare icons / "click here") so agents know where it goes.
Lighthouse accessibility score: 68/100. Agents read the page through its accessibility tree, so this is a proxy for how navigable your site is to an AI agent.
Fix: Resolve the failing accessibility audits below — each one removes an element or relationship an agent would otherwise be blind to.
`[aria-*]` attributes match their roles passed.
`button`, `link`, and `menuitem` elements have accessible names passed.
`[aria-hidden="true"]` is not present on the document `<body>` passed.
`[aria-hidden="true"]` elements do not contain focusable descendents passed.
`[role]`s have all required `[aria-*]` attributes passed.
`[role]` values are valid passed.
`[aria-*]` attributes are valid and not misspelled passed.
`[aria-*]` attributes have valid values passed.
Document has a `<title>` element passed.
0.030 (field data from CrUX) — good.
709ms (field data from CrUX) — good.
No tool catalog was found at /.well-known/webmcp.json (or /.well-known/webmcp). The catalog is a community convention, not part of the WebMCP standard, so this does not affect WebMCP presence.
Fix: Consider also publishing a tool catalog at /.well-known/webmcp.json: a JSON document with a "spec" of "webmcp/0.1" and a "tools" array, where each tool declares a name and a clear description. It is a community convention (optional, not part of the WebMCP standard) that lets crawlers and agents discover your tools without executing JavaScript.
Can agents safely transact?
No Strict-Transport-Security header on the homepage.
Fix: Add `Strict-Transport-Security: max-age=15768000; includeSubDomains` so browsers and agents refuse to downgrade to http for at least six months.
/.well-known/oauth-authorization-server returned the site's HTML app shell — treating as not published.
Fix: Publish /.well-known/oauth-authorization-server so AI agents discovering your OAuth setup can negotiate flows automatically. Required if your site offers an authenticated API.
/.well-known/oauth-protected-resource returned the site's HTML app shell — treating as not published.
Fix: Publish /.well-known/oauth-protected-resource so AI agents discovering your OAuth setup can negotiate flows automatically. Required if your site offers an authenticated API.
No Web Bot Auth signature headers — sites can't verify agent identity.
Fix: Web Bot Auth (IETF HTTP Message Signatures over Signature / Signature-Input) lets you cryptographically verify which agent is hitting you. Several CDNs offer turn-key support; otherwise skip until vendor support matures.
No Referrer-Policy header on the homepage.
Fix: Add `Referrer-Policy: strict-origin-when-cross-origin` so outbound links don't leak full URLs (including query strings) to third parties.
server: nginx/1.28.0
Fix: Configure your web server / framework to suppress version strings. They give attackers a free shortlist of known CVEs to try.
CSP header present.
Homepage scheme is https:.
http://mail.ru → https://mail.ru/challenge.html?hash429=h4EswENdklAFZHJj0v0xTrOrd_KtLXGt3SlCBtMOBynFl7UK-r_f-17VpZMWaO9Fgdf73sQKBpatr4uy_xr2lqUBs3PSAaA9RoV4DGbe94FIiUakRtZkTwxsfiBXt8_kYdd5hAJ_mlROL3Gy&redirect=%2F&sign=UvdjPNMRSuPSc72SLaqFzw (2 hops).
No stack-trace markers in the first 5KB.
Homepage HTML references no http:// resources.
Valid for 82 more days (Oct 12 14:44:32 2026 GMT, issuer: YR1).
X-Content-Type-Options: nosniff.
X-Frame-Options: SAMEORIGIN.