Virgilio

The page registers no tools via the WebMCP browser API (navigator.modelContext).

Fix: Expose your actions to AI agents with the WebMCP browser API: register tools via navigator.modelContext.registerTool. Optionally also publish a /.well-known/webmcp.json tool catalog as a discovery signpost.

Crawled 6 of 12 discovered pages beyond the homepage.

Could not identify a known website platform (custom stack or unrecognised).

Homepage ignored Accept: text/markdown and returned HTML.

Fix: Serve a markdown version of high-value pages when the client asks for text/markdown. AI summarisers, chatbots and IDE agents prefer markdown — fewer tokens, no DOM noise.

Homepage contains ~2581 elements — heavy.

Fix: Aim for under 1500 elements on the homepage. Heavier DOMs slow first paint and overflow some AI crawlers' parse buffers.

Only 2 internal links on the homepage.

Fix: Add at least 5-10 internal links pointing to your top product, pricing, docs, blog and about pages so an AI agent can navigate to them from the homepage.

Missing landmark elements: main.

6 of 6 pages are missing <title> and/or <h1>: /video/sitemap/sitemapURLstatic.txt.xml.gz, /video/sitemap/sitemap_playlist_speciali.xml.gz, /video/sitemap/sitemapURLbrightcovevideo-1.xml.gz, /video/sitemap/sitemap_tags.xml.gz, /video/sitemap/sitemapURLbrightcovevideo-2.xml.gz, /video/sitemap/sitemapURLbrightcovevideo-3.xml.gz.

Fix: Make sure every page sets a unique <title> and exactly one <h1>. The title is how an AI agent confirms it landed on the right page after navigating.

2 of 6 pages return <80 words of visible text — agents without JavaScript see an empty page: /video/sitemap/sitemapURLstatic.txt.xml.gz (60w), /video/sitemap/sitemap_playlist_speciali.xml.gz (40w).

Fix: Pre-render or server-render these pages so AI crawlers (which usually don't execute JS) can read them. Frameworks: Next.js Server Components, Nuxt SSR, Astro, or build-time prerendering.

Homepage server response contains 2788 words of visible text — content is reachable without executing JavaScript.

247 headings, no level skips.

Language declared as "it-IT".

203 of 203 <img> tags have alt attributes.

203/203 images set width and height — no layout shift.

Exactly one <h1> on the homepage.

3 of 11 agent-critical accessibility audits failed (Links do not have a discernible name, `<frame>` or `<iframe>` elements do not have a title, `[aria-hidden="true"]` elements contain focusable descendents) — an agent may be unable to identify or operate the affected elements.

Fix: Fix the failing agent-accessibility audits listed below (accessible names on controls, valid ARIA roles/relationships, nothing interactive hidden from the tree).

Lighthouse flagged this audit — agents may be unable to perceive or operate the affected elements.

Fix: Don't place focusable/interactive elements inside aria-hidden="true" containers.

Lighthouse flagged this audit — agents may be unable to perceive or operate the affected elements.

Fix: Add a title to every <iframe> so agents can identify embedded content.

Lighthouse flagged this audit — agents may be unable to perceive or operate the affected elements.

Fix: Give every link discernible text (avoid bare icons / "click here") so agents know where it goes.

The page registers no tools via the navigator.modelContext browser API, so an AI agent has no structured way to operate it.

Fix: Expose your site’s actions to AI agents with the WebMCP browser API: call navigator.modelContext.registerTool({ name, description, inputSchema, execute }) from your page so an agent can invoke them. Implement it directly, or with a library like the @mcp-b polyfill (https://mcp-b.ai). Spec: https://github.com/webmachinelearning/webmcp.

Lighthouse accessibility score: 81/100. Agents read the page through its accessibility tree, so this is a proxy for how navigable your site is to an AI agent.

Fix: Resolve the failing accessibility audits below — each one removes an element or relationship an agent would otherwise be blind to.

0.200 (field data from CrUX) — needs improvement.

Fix: A layout that shifts while loading makes an AI agent mis-click the element it targeted. Eliminate CLS by setting explicit width/height on images and embeds, avoiding inserted content above existing content, and reserving space for ad slots.

`[aria-*]` attributes match their roles passed.

`[aria-hidden="true"]` is not present on the document `<body>` passed.

`[role]`s have all required `[aria-*]` attributes passed.

`[role]` values are valid passed.

`[aria-*]` attributes are valid and not misspelled passed.

`[aria-*]` attributes have valid values passed.

Buttons have an accessible name passed.

Document has a `<title>` element passed.

1 of 1 visible interactive form fields have labels.

342ms (field data from CrUX) — good.

No tool catalog was found at /.well-known/webmcp.json (or /.well-known/webmcp). The catalog is a community convention, not part of the WebMCP standard, so this does not affect WebMCP presence.

Fix: Consider also publishing a tool catalog at /.well-known/webmcp.json: a JSON document with a "spec" of "webmcp/0.1" and a "tools" array, where each tool declares a name and a clear description. It is a community convention (optional, not part of the WebMCP standard) that lets crawlers and agents discover your tools without executing JavaScript.

No Strict-Transport-Security header on the homepage.

Fix: Add `Strict-Transport-Security: max-age=15768000; includeSubDomains` so browsers and agents refuse to downgrade to http for at least six months.

Found 1 http:// reference in the homepage HTML — browsers will block these resources.

Fix: Update every http:// resource URL to https:// (or use protocol-relative `//`). Common offenders: image CDNs and legacy embed snippets.

/.well-known/oauth-authorization-server returned 404.

Fix: Publish /.well-known/oauth-authorization-server so AI agents discovering your OAuth setup can negotiate flows automatically. Required if your site offers an authenticated API.

/.well-known/oauth-protected-resource returned 404.

Fix: Publish /.well-known/oauth-protected-resource so AI agents discovering your OAuth setup can negotiate flows automatically. Required if your site offers an authenticated API.

No Web Bot Auth signature headers — sites can't verify agent identity.

Fix: Web Bot Auth (IETF HTTP Message Signatures over Signature / Signature-Input) lets you cryptographically verify which agent is hitting you. Several CDNs offer turn-key support; otherwise skip until vendor support matures.

No Content-Security-Policy header on the homepage.

Fix: Add a Content-Security-Policy. Even a strict default-src directive cuts XSS blast radius dramatically. Start in report-only mode to find violations.

No Referrer-Policy header on the homepage.

Fix: Add `Referrer-Policy: strict-origin-when-cross-origin` so outbound links don't leak full URLs (including query strings) to third parties.

No `X-Content-Type-Options: nosniff` header.

Fix: Add `X-Content-Type-Options: nosniff` to prevent browsers (and some agents) from re-interpreting your responses as a different content type.

x-amz-cf-id: cHKTX1y6yNR_n1QHDGyuzhjhAVpYDPwEApqzbiqC (AWS CloudFront)

Homepage scheme is https:.

http://virgilio.it → https://www.virgilio.it/ (1 hop).

No stack-trace markers in the first 5KB.

Valid for 164 more days (Jan 1 23:59:59 2027 GMT, issuer: Sectigo Public Server Authentication CA OV R36).

Server / X-Powered-By headers don't leak product version.

X-Frame-Options: SAMEORIGIN.