`Just a moment|challenges\.cloudflare\.com|Sorry, you have been blocked|Incapsula incident ID|aws-waf-token|Akamai bot manager|enable javascript and cookies to continue/i on the first 4000 chars of title plus body text downgrades the row to warn; AI crawlers named in the fix text: GPTBot, ClaudeBot, OAI-SearchBot (mega-analyzer), GPTBot, ClaudeBot, OAI-SearchBot, Googlebot (analyzer). - Why: AI crawlers read the raw HTML and do not run JavaScript, so a page that only renders in the browser is invisible to them no matter how good the content is. - Fix: Server-render or prerender the page so the content is in the HTML response, and do that before any content fix on a JavaScript-only site. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **4.4 JSON-LD blocks on page: `<n>`** - Pass: The page carries at least two application/ld+json blocks. - Warn: Exactly one JSON-LD block is present. - Fail: No JSON-LD block is present. - Numbers and lists the tool uses: Count of /application\/ld\+json/g matches in the HTML; pass >= 2, warn 1, fail 0 (mega-seo-analyzer); >= 2 blocks is one of four AEO tests (competitor-gap-matrix). - Why: AI retrievers and agent commerce surfaces read structured data density as a sign the page is machine-readable. - Fix: Publish at least two JSON-LD blocks, for example an Organization or LocalBusiness node plus a page-type node such as Article, FAQPage or Service. - Verify: [Competitor Gap Matrix](https://jwatte.com/tools/competitor-gap-matrix/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: schema.org JSON-LD. - [ ] **4.5 FAQPage schema present** - Pass: A JSON-LD node typed FAQPage is on the page when the page has question and answer content. - Numbers and lists the tool uses: schemaTypes includes 'FAQPage' (mega-analyzer); /FAQPage/i on the raw HTML, weight 12 in the AEO bucket (batch-analyzer); at least 4 Question/Answer pairs, or details/summary as the alternative (single-site-gen, site-migration-gen); FAQ sections with a clear Q&A format (analyzer site builder scaffold). - Why: FAQPage gives answer engines ready-made question and answer pairs and qualifies the page for FAQ rich results and People Also Ask. - Fix: Add a FAQPage JSON-LD block whose Question names and acceptedAnswer text mirror the visible FAQ on the page, with at least four pairs. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/) and 1 more. Standard: schema.org FAQPage. - [ ] **4.6 FAQ schema parity, all `<n>` visible Q(s) are in JSON-LD** - Pass: Every visible FAQ question has a matching FAQPage Question and there are no schema-only ghost entries. - Fail: Schema-only ghost entries exist, visible FAQs are missing from the schema, or the page has visible questions and zero in JSON-LD, which is often an empty FAQPage placeholder. - Numbers and lists the tool uses: Schema questions: nodes whose @type matches /\bQuestion\b/ with a name. Visible question sources (mega-analyzer): h2/h3/h4/h5 inside [itemtype*="FAQPage" i], [class*="faq" i], [id*="faq" i], section[aria-labelledby*="faq" i], [class*="accordion" i]; details > summary; dt; button[aria-expanded]; [class*="faq-question" i], [class*="accordion-button" i]; a visible question needs normalized length 8 to 250 and either a ? or a start of /^(what|how|when|why|where|who|which|can|do|does|is|are|should|will|may)\b/i and must not start with /^(ready|looking|need|want|tired|interested|curious|wondering|thinking)\b/i; normalization: curly quotes to straight, lowercase, non letter/number removed, whitespace collapsed. Visible question patterns (faq-schema-parity): details > summary; h2 to h5 containing ? and at most 300 chars with the following siblings or the aria-controls panel as the answer; dt with the following dd; button[aria-expanded] with its aria-controls panel; [class*=faq-question i].question.accordion-button with a sibling [class*=faq-answer i].answer.accordion-body.accordion-content; question length 5 to 400 chars and either contains ? or starts with what, how, when, why, where, who, which, can, do, does, is, are, should, will, may; dedupe on normalized text preferring the entry with answer text. Pass needs schemaOnly = 0, visibleOnly = 0 and schemaQs > 0. - Why: A mismatch between the schema and the visible FAQ is the most common silent reason Google suppresses the FAQ rich result, and ghost entries can suppress the whole result. - Fix: Make the FAQPage Question names match the visible FAQ text one to one, remove schema entries that have no visible question, and use standard FAQ markup (details/summary, question headings, dl, aria-expanded accordions) so the questions are detectable. - Verify: [FAQ Schema Parity](https://jwatte.com/tools/faq-schema-parity/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: Google FAQ rich result guidelines. - [ ] **4.7 FAQ content present in a recognizable markup pattern** - Pass: At least one question and answer pair on the page is found as FAQPage JSON-LD, a details/summary block, or a question heading followed by an answer block. - Numbers and lists the tool uses: faq-answer-extractability sources: JSON-LD objects whose @type is or contains 'Question' with name and acceptedAnswer.text; `<details>` with a `<summary>` plus non-summary child text; h2, h3, h4 whose text matches /\?\s*$/ followed by P, UL, OL siblings until the next h1 to h6; dedupe on the lowercased trimmed question. faq-harvester details method: summary text non-empty and under 200 chars, answer = the details body sliced to 500 chars; question-heading method: h2, h3, h4, dt, strong, b with text 6 to 200 chars that ends with ? or matches /^(?:how|what|why|can|is|are|do|does|should|when|where|which|who|will)\b/i, answer collected from the next P, UL, OL, DIV, DD siblings within 3 tries and under 500 chars, stopping at H2, H3, H4, DT. apple-business-audit: manual checkbox for Q&A content Siri can read. - Why: Answer engines, featured snippets and Siri can only quote a question and answer they can find, and custom widgets or JavaScript-only accordions hide the FAQ from them. - Fix: Publish FAQs as FAQPage JSON-LD plus visible details/summary blocks or question headings with the answer paragraph directly below, and keep accordion summaries under 200 characters. - Verify: [FAQ Extractability](https://jwatte.com/tools/faq-answer-extractability/), [FAQ Harvester](https://jwatte.com/tools/faq-harvester/), [Apple Business](https://jwatte.com/tools/apple-business-audit/). Standard: schema.org FAQPage, Question, Answer. - [ ] **4.8 HowTo schema (step-by-step content)** - Pass: Pages whose title or H1 describes a procedure carry HowTo JSON-LD. - Warn: The page is not procedural, so a missing HowTo is reported as optional information. - Fail: An editorial page with a how-to or step-by-step title has no HowTo schema. - Numbers and lists the tool uses: Procedural regex /\bhow\s+to\b|step[- ]by[- ]step|\bstep\s*\d/i on the title plus H1, gated on editorial context (mega-analyzer); /HowTo/i on the raw HTML, weight 8 (batch-analyzer); HowTo steps required by the scaffold (single-site-gen, site-migration-gen), how-to content with step-by-step structure (analyzer site builder). - Why: HowTo markup turns numbered instructions into a step-by-step rich result and gives answer engines the ordered steps. - Fix: Add HowTo JSON-LD with one HowToStep per numbered step, on procedural pages only. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/) and 1 more. Standard: schema.org HowTo. - [ ] **4.9 Speakable schema present** - Pass: A SpeakableSpecification node or a speakable property is present in the page's JSON-LD. - Warn: Missing on a non-editorial site is reported as optional information, and mega-aeo-analyzer scores the missing case 50 instead of 100. - Fail: An editorial page (Article-class type, content-hub path or RSS feed, and not a local-service type) has no speakable markup (mega-analyzer). - Numbers and lists the tool uses: schemaTypes includes 'SpeakableSpecification' or /speakable/i on the HTML (analyzer); /"@type"\s*:\s*"SpeakableSpecification"/i (mega-seo-analyzer); /SpeakableSpecification/i, info row excluded from the score denominator (sge-readiness-audit); /"@type":\s*"Speakable\w*"|"speakable"/i scored 100 present or 50 absent (mega-aeo-analyzer); /speakable/i, weight 10 in the GEO and AEO buckets and 6 in the Schema bucket (batch-analyzer); schemaTypes includes SpeakableSpecification, weight 8 (mega-batch); one of four AEO tests (competitor-gap-matrix); editorial gate (mega-analyzer): Article-class /^(Article|BlogPosting|NewsArticle|TechArticle|ScholarlyArticle|Newsletter|Periodical|Blog)$/ or hub paths blog, articles, insights, resources, learn, guides, news, posts, essays, stories, publications, reports, press, wire, notes, journal; the scaffold puts SpeakableSpecification on the hero and key answer paragraphs (single-site-gen). - Why: Speakable markup tells Google and voice assistants exactly which passages on the page are suitable to read aloud or quote. - Fix: Add a speakable property with a SpeakableSpecification and cssSelector to the WebPage or Article JSON-LD, pointing at the headline and the key answer paragraphs. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [SGE Readiness Audit](https://jwatte.com/tools/sge-readiness-audit/), [Competitor Gap Matrix](https://jwatte.com/tools/competitor-gap-matrix/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/) and 5 more. Standard: schema.org SpeakableSpecification; Google Speakable structured data. - [ ] **4.10 Speakable node names a cssSelector or xpath** - Pass: Each Speakable or SpeakableSpecification node has a cssSelector or an xpath (schema-validator); a node typed Speakable has cssSelector or xpath (rich-results-eligibility-audit). - Warn: Neither is set, and schema-validator reports both recommended fields as missing. - Fail: Neither cssSelector nor xpath is present, which rich-results-eligibility-audit counts as a missing required field. - Numbers and lists the tool uses: Required: cssSelector or xpath, either one satisfies, applied only to nodes whose first @type is Speakable (rich-results-eligibility-audit); recommended pair cssSelector, xpath on Speakable and SpeakableSpecification nodes, with both missing warnings dropped when either is set (schema-validator). - Why: Without a selector the speakable node points at nothing, so the assistant has no passage to read. - Fix: Add cssSelector (preferred) or xpath pointing at the speakable passage. - Verify: [Schema Validator](https://jwatte.com/tools/schema-validator/), [Rich Results Eligibility Audit](https://jwatte.com/tools/rich-results-eligibility-audit/). Standard: Google Speakable structured data; schema.org SpeakableSpecification. - [ ] **4.11 SpeakableSpecification has invalid selector(s) (`<n>`)** - Pass: Every speakable cssSelector points at a visible body element that exists, and no xpath uses the class word-boundary pattern. - Fail: A cssSelector targets meta, link, title or head, a class selector matches no element on the page, or an xpath uses contains(concat(' ', normalize-space(@class), ' ')...). - Numbers and lists the tool uses: Head selectors /^meta\b|^link\b|^title\b|^head\b/i; class selector /^\.([\w-]+)$/ with no matching element in the DOM; xpath /contains\s*$\s*concat\s*\(\s*'\s*'\s*,\s*normalize-space\s*\(\s*@class\s*$/ (mega-analyzer). - Why: Speakable needs visible body content, and Google's validator mangles the XPath word-boundary pattern into phantom tokens and reports no matches. - Fix: Point cssSelector at visible body elements that exist on the page, use plain tag or class selectors, and drop xpath entirely. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: Google Speakable structured data. - [ ] **4.12 Speakable candidate: heading with a direct-answer paragraph** - Pass: The H1 is always a recommended candidate; an H2 or H3 is recommended when the first paragraph after it is 60 to 320 characters. - Warn: An H2 or H3 with no following paragraph, or one shorter than 60 or longer than 320 characters, is shown as info and left unchecked, so only the heading would be marked. - Numbers and lists the tool uses: Headings h1, h2, h3 with text length >= 6; paragraph = first following sibling P, scan stops at UL, OL or H1 to H6; recommended (pre-checked, rendered as pass) when the tag is H1 or the paragraph is 60 to 320 chars, otherwise rendered as info; heading selector '#'+id, else tag+'.'+first class, else tag; paragraph selector '#'+id, else 'p.'+first class, else heading selector+' + p' (speakable-generator). - Why: A speakable selector that lands on a heading alone gives the assistant nothing to read, the answer paragraph is what gets spoken. - Fix: Put a 60 to 320 character direct-answer paragraph right after each heading you want a voice assistant to read. - Verify: [Speakable Gen.](https://jwatte.com/tools/speakable-generator/). Standard: schema.org SpeakableSpecification. - [ ] **4.13 Site identity extractable for AI citation (`<n>`/4 signals)** - Pass: At least two of four sources state who the site is and what it does: a JSON-LD description, a non-generic meta description, a distinct og:description, and a definitional first paragraph. - Warn: Fewer than two of the four signals are present. - Numbers and lists the tool uses: Signal 1: Organization, WebSite, Person or LocalBusiness JSON-LD description >= 40 chars; signal 2: meta description >= 50 chars and not /^(welcome to|home page|official website|site of)/i; signal 3: og:description >= 50 chars and different from the meta description; signal 4: first `<p>` longer than 50 chars with >= 12 words matching /\b(is|are|helps?|provides?|builds?|writes?|covers?|sells?|offers?|teaches?|hosts?|makes?)\b/i; pass needs 2 of 4 (mega-analyzer, analyzer). - Why: An AI model needs a clear sentence it can quote when someone asks what your business is, and it prefers sites that state that plainly. - Fix: Write a first paragraph that says 'X is a Y that does Z' and put a matching description in the meta description, og:description and JSON-LD. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **4.14 Meta description reads as a direct answer** - Pass: The meta description is longer than 50 characters and opens with a definitional phrase. - Numbers and lists the tool uses: Length > 50 and /^(a |the |an |it is|we |this |how |what |why )/i, weight 8 in the AEO bucket (batch-analyzer). - Why: Answer engines lift the description as a candidate answer, so one that opens with a direct statement gets quoted more often than a slogan. - Fix: Rewrite the description to open with a direct definitional sentence such as 'The X is ...' or 'We ...'. - Verify: [Batch Compare](https://jwatte.com/tools/batch-analyzer/). - [ ] **4.15 Definition pattern in the first paragraph** - Pass: The first substantial paragraph opens with a definitional sentence such as 'X is', 'X refers to' or 'X means'. - Warn: No definitional sentence is found, reported as a warning by the mega-analyzer verdict layer and sge-readiness-audit. - Numbers and lists the tool uses: mega-analyzer: first 100 words, chunk longer than 20 chars matching /\b(is|are|means?|refers?\s+to)\b/i, verdict only added when wordCount >= 800 and the page looks like an article (Article schema, a /blog/, /articles/, /posts/, /news/ or /guides/ path, or >= 5 H2s with >= 1500 words and fewer than 10 images) and not like a landing page (root path, WebSite plus ItemList/CollectionPage schema, or >= 10 images with >= 3 H2s); featured-snippet-extractability: first paragraph from 'main p, article p.content p, p' matching /^[A-Z][A-Za-z0-9 -]{2,30} (is|are|refers to|means|describes) /, info when missing; sge-readiness-audit: first paragraph in main, article, [role="main"] or body with >= 10 words matching /^[A-Za-z"'][^.]*\b(is|are|refers?\s+to|means?|describes?|represents?|provides?|enables?)\b[^.]+[.!]/i; definition pattern required by the scaffold (single-site-gen, site-migration-gen). - Why: Featured snippets, People Also Ask and AI Overviews disproportionately quote an opening sentence shaped 'X is Y'. - Fix: Open the page with one sentence that defines or directly answers the topic, 'X is a Y that does Z', within the first 40 words. - Verify: [Featured-Snippet Extractability Audit](https://jwatte.com/tools/featured-snippet-extractability/), [SGE Readiness Audit](https://jwatte.com/tools/sge-readiness-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/) and 1 more. - [ ] **4.16 Answer conciseness, first paragraph is `<n>` words** - Pass: The first paragraph with at least 10 words is 25 to 80 words long. - Warn: The lead paragraph is longer than 80 words. - Fail: The lead paragraph is shorter than 25 words, or no paragraph with at least 10 words exists. - Numbers and lists the tool uses: Content area = main, else article, else [role="main"], else body; candidate paragraph needs >= 10 words; pass window 25 to 80 words (sge-readiness-audit). - Why: AI Overviews prefer a short lead paragraph that answers the page's core question in one breath. - Fix: Make the first substantial paragraph a 25 to 80 word direct answer to the question the page exists for. - Verify: [SGE Readiness Audit](https://jwatte.com/tools/sge-readiness-audit/). - [ ] **4.17 Heading-to-query alignment, `<n>`/`<n>` H2s match question patterns** - Pass: The content area has at least four H2s with at least two phrased as questions (sge-readiness-audit), or at least one H2 is question-shaped (featured-snippet-extractability). - Warn: Three or more H2s but fewer than two question-shaped ones (sge-readiness-audit), or no question-shaped H2 at all (featured-snippet-extractability). - Fail: Fewer than three H2s in the content area (sge-readiness-audit). - Numbers and lists the tool uses: Question H2 = /\?\s*$/ or /^(how|what|why|when|where|which|who|can|does|do|is|are)\s/i, pass >= 1 (featured-snippet-extractability); /\?|^(what|why|how|when|where|who|which|can|does|is|are|should|do)\b/i scoped to main, article, [role=main] or body, pass 4 H2s with 2 questions, warn at 3 H2s (sge-readiness-audit). - Why: Featured snippets and AI Overviews are most often lifted from the paragraph right under a heading that matches the question the user typed. - Fix: Pick three to five queries the page should win and turn an H2 into each one, for example 'How does X work?' or 'What is the difference between Y and Z?'. - Verify: [Featured-Snippet Extractability Audit](https://jwatte.com/tools/featured-snippet-extractability/), [SGE Readiness Audit](https://jwatte.com/tools/sge-readiness-audit/). - [ ] **4.18 Direct-answer paragraph immediately after each H2** - Pass: Question H2s are followed directly by a concise answer paragraph. - Warn: No question H2 is followed by a 30 to 80 word paragraph (featured-snippet-extractability). - Fail: Fewer than two H2s have a paragraph or list as the next element (batch-analyzer). - Numbers and lists the tool uses: featured-snippet-extractability: next sibling scanned until /^(P|UL|OL|DIV|TABLE)$/, only a P counts, 30 to 80 words, pass >= 1, guidance 40 to 60 words; batch-analyzer: h2 whose nextElementSibling is P, UL or OL, pass >= 2, weight 10; scaffold: a 40 to 60 word direct answer after every H2 with concrete numbers and entities (single-site-gen, site-migration-gen), direct answer paragraphs after each H2 (analyzer site builder). - Why: The extractor wants a short paragraph straight after the question, longer ones get truncated and shorter ones do not qualify. - Fix: Right after each question H2, write a 40 to 60 word paragraph whose first sentence answers the question, with no throat-clearing. - Verify: [Featured-Snippet Extractability Audit](https://jwatte.com/tools/featured-snippet-extractability/), [Site Analyzer](https://jwatte.com/tools/analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/) and 1 more. - [ ] **4.19 Long-form article has a Table of Contents** - Pass: A long page has a list near the top made mostly of in-page anchor links. - Warn: A long article has no table of contents, reported as a warning by the mega-analyzer verdict layer. - Numbers and lists the tool uses: mega-analyzer: one of the first 4 ol/ul lists has >= 3 a[href^=#] links and links divided by li count >= 0.7; verdict only added when wordCount >= 800 and the page looks like an article (Article schema, a /blog/, /articles/, /posts/, /news/ or /guides/ path, or >= 5 H2s with >= 1500 words and fewer than 10 images) and not like a landing page (root path, WebSite plus ItemList/CollectionPage schema, or >= 10 images with >= 3 H2s); batch-analyzer: only when body text > 4000 chars, first 4 lists, >= 3 a[href^='#'], weight 5; scaffold: TOC on pages of >= 1500 words (single-site-gen, site-migration-gen), table of contents for long content (analyzer site builder). - Why: A linked table of contents helps voice assistants and AI retrievers jump to the right section of a long page. - Fix: Add an `<ol>` of anchor links to each H2 near the top of any page over about 800 words. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/) and 1 more. - [ ] **4.20 Structured content formats, `<n>` lists + `<n>` table(s)** - Pass: The content area has lists shaped for snippets: at least one ul/ol with 3 to 10 items averaging 20 to 200 characters (featured-snippet-extractability), at least three lists or two lists plus a table (sge-readiness-audit), or at least two lists or tables (batch-analyzer). - Warn: At least one list or one table in the content area but fewer than three lists and not two lists plus a table (sge-readiness-audit). - Fail: No lists and no tables in the content area (sge-readiness-audit). - Numbers and lists the tool uses: featured-snippet-extractability: items 3 to 10 and average li text length 20 to 200 chars, pass >= 1, zero renders as info; sge-readiness-audit: pass lists >= 3 or (lists >= 2 and tables >= 1), warn lists >= 1 or tables >= 1 below that, fail no lists and no tables; batch-analyzer: ul, ol, table count >= 2, weight 10; analyzer site builder scaffold: definition lists for key terms. - Why: Featured list snippets and AI Overviews render lists directly, but skip items that are too short and truncate items that are too long. - Fix: For 'steps to', 'ways to' and 'best' queries, add a 3 to 10 item list where each item is 20 to 200 characters and starts with a verb or noun phrase, and use definition lists for key terms. - Verify: [Featured-Snippet Extractability Audit](https://jwatte.com/tools/featured-snippet-extractability/), [SGE Readiness Audit](https://jwatte.com/tools/sge-readiness-audit/), [Site Analyzer](https://jwatte.com/tools/analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/). - [ ] **4.21 `<n>` properly-headed tables** - Pass: At least one table on the page has a `<thead>` or a `<th>`. - Numbers and lists the tool uses: table.querySelector('thead') || table.querySelector('th'), pass >= 1, zero renders as info (featured-snippet-extractability); comparison tables required by the scaffold (single-site-gen, site-migration-gen). - Why: For comparison and specification questions Google and AI Overviews prefer a table with explicit column headers. - Fix: For comparison queries add a table with a `<thead>` row of `<th>` cells. - Verify: [Featured-Snippet Extractability Audit](https://jwatte.com/tools/featured-snippet-extractability/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/), [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/). - [ ] **4.22 Semantic HTML structure (`<n>` tags in use)** - Pass: At least four of the 18 semantic HTML elements appear on the page. - Warn: Fewer than four structural tags are in use. - Numbers and lists the tool uses: Tags counted: article, section, aside, nav, main, header, footer, time, figure, figcaption, cite, mark, details, summary, abbr, kbd, dfn, blockquote; pass >= 4; first 10 listed (analyzer); the principles name article, section, time, figure, cite, details, main, header, footer as preferred over a generic div (mega-analyzer, analyzer, mega-seo-analyzer). - Why: Semantic tags tell crawlers what each block is and drive how AI models chunk the page for retrieval. - Fix: Replace generic `<div>` containers that play a structural role with article, section, main, header, footer, time, figure, cite and details. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). - [ ] **4.23 `<cite>` / blockquote cite markup used (`<n>`)** - Pass: The page has at least one `<cite>` element or a blockquote or q with a cite attribute. - Warn: No cite or blockquote cite markup is found (analyzer, mega-seo-analyzer). - Numbers and lists the tool uses: /<cite\b/gi plus /<blockquote[^>]*\bcite=/gi, pass >= 1 (analyzer); /<cite\b|<blockquote[^>]+cite=|<q[^>]+cite=/i (mega-seo-analyzer); /<cite|<blockquote[^>]+cite=/i as one of four AEO tests (competitor-gap-matrix). - Why: AI engines weight tagged citations as evidence that your claims trace back to a source. - Fix: Wrap external quotes, statistics and figures in `<cite>`Source Name`</cite>` or `<blockquote cite="URL">`. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Competitor Gap Matrix](https://jwatte.com/tools/competitor-gap-matrix/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). - [ ] **4.24 Attribution coverage** - Pass: Attribution score is 80 or higher, meaning claim-shaped sentences are matched by external links or Claim schema is present. - Warn: Score between 60 and 79. - Fail: Score below 60. - Numbers and lists the tool uses: claims = matches of /\b\d{1,3}(\.\d+)?%|\$\d+|\b(according to|per |based on)\b/g on the lowercased body text; links = count of a[href^="http"]; score = min(100, claims ? round(links / max(1, claims) * 60) : 80); +20 capped at 100 when /"@type":\s*"Claim(Review)?"/i matches (mega-aeo-analyzer). - Why: A page that makes numeric claims without linking to where they came from reads as unverified to an AI answer engine. - Fix: Add inline links to the source of each factual claim and consider schema.org Claim or ClaimReview markup for the top facts. - Verify: [Mega AEO Analyzer](https://jwatte.com/tools/mega-aeo-analyzer/). Standard: schema.org Claim, ClaimReview. - [ ] **4.25 Paragraph lengths optimized for AI retrieval (`<n>` paragraphs)** - Pass: Most main-content paragraphs fall in the retrieval window of about 40 to 150 words, with few stubs and few over-long blocks. - Warn: Too many thin or chunky paragraphs (analyzer, mega-analyzer), some concise paragraphs but long blocks remain (sge-readiness-audit), or a retrievable-share score of 60 to 79 (mega-aeo-analyzer). - Fail: Fewer than three concise paragraphs (sge-readiness-audit), a retrievable-share score under 60 or no `<p>` elements at all (mega-aeo-analyzer), or a passage under 40 or over 250 words scoring zero for length (passage-retrieval). - Numbers and lists the tool uses: analyzer: needs 3+ paragraphs, thin = under 25 words, chunky = over 150, warn when thin >= ceil(0.6 * n) or chunky >= ceil(0.3 * n), target 40 to 150; mega-analyzer: scope main, article or [role="main"] else body, selectors p, [class*="faq-answer" i], [class*="answer-inner" i], [role="region"][aria-labelledby], excluding nav, footer, header, aside, short < 25, long > 150, substantive >= 20, ideal 40 to 150, gate 3 paragraphs, thin = not (median >= 25 or ideal >= 5) and substantive < 5, chunky = long >= ceil(paragraphs * 0.3); passage-retrieval per passage: 40 to 150 words +20 points, 151 to 250 +8, under 40 or over 250 zero; sge-readiness-audit: short = 15 to 60 words, long > 100, pass 5 short and at most 2 long, warn floor 3 short; mega-aeo-analyzer: ideal 40 to 100 words, too long > 120, too short < 20, score = round(ideal / paragraphs * 100), pass >= 80, warn >= 60, no `<p>` at all scores 30; principles: each `<p>` targets 40 to 150 words (mega-analyzer, analyzer, mega-seo-analyzer). - Why: AI retrievers embed each paragraph as its own chunk of about 150 tokens, so a stub carries no answer and an over-long block gets split mid-thought. - Fix: Merge paragraphs under about 25 words into their neighbors and split anything over 150 words, so each paragraph is a self-contained 40 to 150 word answer. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [SGE Readiness Audit](https://jwatte.com/tools/sge-readiness-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega AEO Analyzer](https://jwatte.com/tools/mega-aeo-analyzer/) and 1 more. - [ ] **4.26 Passage extractability (`<n>` IDEAL 134 to 167 word passages)** - Pass: At least three paragraphs of 134 to 167 words on the page; the number that sit directly under an H1, H2 or H3 is reported in the detail but does not gate the verdict. - Warn: One or two paragraphs of 134 to 167 words (amber). - Fail: No paragraph in the 134 to 167 word range, rendered grey (text-light) rather than red. - Numbers and lists the tool uses: Every `<p>` is measured; ideal = word count >= 134 and <= 167; headed when the previous element sibling, after skipping /^(BR|SPAN|EM|STRONG|A|I|B)$/i, matches /^H[123]$/i; green when ideal passages >= 3, amber when >= 1, grey when 0; the headed count is detail only (mega-analyzer). - Why: Since Gemini 3 became Google's default, citation selection favors self-contained 134 to 167 word passages under a heading, and pages need three or more to compete for AI Overview citations. - Fix: Write at least three self-contained 134 to 167 word passages, each directly under a question-intent H2 or H3. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **4.27 Entity density** - Pass: At least 15 recognizable named entities per 1,000 words. - Warn: 8 to 14 entities per 1,000 words. - Fail: Fewer than 8 entities per 1,000 words, rendered grey (text-light) rather than red. - Numbers and lists the tool uses: Phrase regex /\b([A-Z][a-z]+(?:\s+[A-Z][a-z]+)+)\b/g plus single tokens /^[A-Z][a-z]{2,}$/ after dropping the first token of each sentence and excluding I, The, A, An, This, That, These, Those, It, We, He, She, They, You, And, But, Or, So, If, Then, For, To, In, On, At, By, Of; density = round(entityCount / wordCount * 1000, 1 decimal); green >= 15, amber >= 8, grey (text-light) below 8 (mega-analyzer); the scaffold requires concrete numbers, statistics and named entities in the copy (single-site-gen). - Why: Pages that name specific people, organizations, places and products anchor in the model's knowledge graph, and pages with 15 or more entities per 1,000 words see a reported 4.8x citation lift. - Fix: Name the specific people, organizations, places, products and dates in the copy instead of generic nouns. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/). - [ ] **4.28 Tokenizer efficiency** - Pass: Score 80 or higher: the main body has at least 200 words with modest punctuation and numeric density. - Warn: Score 60 to 79, with fixes shown below 70. - Fail: Score below 60. - Numbers and lists the tool uses: nav, footer, script, style, aside, header elements removed first; start at 100; -20 when punctuation density (non-word non-space chars / text length) > 0.18; -15 when numeric density (numbers / words) > 0.15; -20 when words < 200; floor 0 (mega-aeo-analyzer). - Why: Dense punctuation and number tables waste the tokens an AI model spends on your page and blur the meaning it can extract. - Fix: Reduce punctuation clusters and dense numeric tables, prefer prose to markdown-style tables, and make sure the body has at least 200 words. - Verify: [Mega AEO Analyzer](https://jwatte.com/tools/mega-aeo-analyzer/). - [ ] **4.29 `<n>` named entity span(s), anchors retrieval to topics** - Pass: The passage contains at least one multi-word capitalized name, worth 15 points. - Numbers and lists the tool uses: ENTITY_SPAN = /\b([A-Z][a-zA-Z]+(?:\s+[A-Z][a-zA-Z]+){1,3})\b/g; single capitalized words are filtered out; +15 (passage-retrieval). - Why: A retriever matches passages to topic and entity queries, so a passage that names nothing cannot be matched. - Fix: Name the product, company, place or person the passage is about rather than using generic nouns. - [ ] **4.30 First sentence is self-contained** - Pass: The passage's first sentence has subject-verb structure and does not open with an orphan pronoun, worth 15 points plus 10 for the separate no-pronoun rule. - Numbers and lists the tool uses: First sentence = /^[^.!?]+[.!?]/ else the whole text; verb list is|are|was|were|has|have|had|does|do|did|can|will|should|would|could|means|describes|refers|works|provides|offers|contains|requires; ORPHAN_PRONOUNS /^(he|she|they|this|that|these|those|it|its|their|them)\b/i; +15 for a verb plus no pronoun, +10 separately for no orphan pronoun (passage-retrieval). - Why: A passage whose opening sentence leans on something said earlier cannot be quoted on its own. - Fix: Open each paragraph with a complete statement that names its subject instead of a pronoun. - [ ] **4.31 Answer-form structure (definition / Q&A pattern)** - Pass: The passage opens as a definition such as 'The X is ...' or as an explicit Q: / A: pair, worth 15 points. - Numbers and lists the tool uses: ANSWER_FORM = /^(the\s+\w+\s+(is|are|was|were|means|describes|refers|consists|involves))|^\w+\s+(is|are)\s+(a|an|the|one|the)\b|^(q\s*:|question\s*:)/i; +15, no issue string on a miss (passage-retrieval). - Why: Passages shaped 'The X is ...' or 'Q: ... A: ...' answer a question directly, which is what gets quoted. - Fix: Lead with a definition sentence or an explicit question and answer pair. - [ ] **4.32 Specific claim / data point present** - Pass: The passage contains a number, percentage, currency amount, year, multiplier, version or full date, worth 10 points. - Warn: No specific claim in a passage longer than 30 words. - Numbers and lists the tool uses: SPECIFIC_CLAIM = /\b(\d+(\.\d+)?%|\$\d+|€\d+|£\d+|\d{4}\b|\d+x|±\d+|version\s+\d+|v\d+\.\d+)\b|[A-Z][a-z]+\s+\d{1,2},\s+\d{4}/; issue raised only when word count > 30; +10 (passage-retrieval). - Why: Generic prose is rarely cited, a concrete figure gives the answer engine something to quote. - Fix: Add a concrete number, date, price, percentage or version to the passage. - [ ] **4.33 Under heading: "`<value>`"** - Pass: A heading of more than 3 characters precedes the passage within the lookup window, worth 10 points. - Numbers and lists the tool uses: Heading text length > 3; kudos shows the first 60 chars; lookup scans 12 previous siblings, then 8 previous siblings per ancestor level up to the root; +10 (passage-retrieval). - Why: The surrounding heading gives the retriever a topical handle for the passage. - Fix: Put a descriptive H2 or H3 directly above each block of paragraphs. - [ ] **4.34 Internal anchor link in passage (+5)** - Pass: The passage contains an in-page anchor link, worth 5 points. - Numbers and lists the tool uses: /<a [^>]*href="#/ tested against the passage text; +5 (passage-retrieval). - Why: An internal anchor lets a retriever deep-link back to the exact chunk. - Fix: Give sections ids and link to them within the content. - [ ] **4.35 Passage `<n>`, `<n>` words, `<n>`/100** - Pass: The passage scores 70 or higher out of 100. - Warn: Score 50 to 69 (mega-analyzer row); 40 to 69 is neither strong nor weak (passage-retrieval). - Fail: Score below 50 (mega-analyzer row); below 40 counts as weak (passage-retrieval). - Numbers and lists the tool uses: score = min(100, +20 length, +15 entity, +15 first sentence, +15 answer form, +10 specific claim, +10 no orphan pronoun, +10 heading, +5 anchor); strong >= 70, weak < 40, preview first 180 chars (passage-retrieval); mega-analyzer row bands >= 70 pass, 50 to 69 warn, < 50 fail, rows excluded from the Full Summary rollup; candidates: root = main, [role="main"], article, else body; nodes 'p, li > p, blockquote p, figure figcaption' with no NAV, HEADER, FOOTER, ASIDE, FORM, SCRIPT or STYLE ancestor, text longer than 30 chars and at least 12 words; pages built entirely from divs or widgets yield no passages. - Why: A page with a great overall score can still be uncitable if every paragraph is too thin, leans on pronouns or names no entities. - Fix: Merge passages under 40 words with their neighbors, replace a leading pronoun with the named subject, and rework the opening sentence to name the topic. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **4.36 Average passage score `<n>`/100, Strong (>=70) `<n>`, Weak (<40) `<n>`, Total passages `<n>`** - Pass: The average passage score is 70 or higher with no weak passages under 40. - Warn: Average 50 to 69. - Fail: Average below 50, or any passage scoring under 40. - Numbers and lists the tool uses: avg = round(sum of scores / count), 0 with no passages; strong >= 70, ok >= 50, else weak (passage-retrieval); mega-analyzer summary: avg >= 70 good, >= 50 ok, else bad; weak = score < 40 and weak > 0 is bad; target average 70+ with no chunks under 40. - Why: The average summarizes how citable the page's paragraphs are on their own. - Fix: Raise the average by fixing the lowest-scoring passages first. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **4.37 Length 40-300 chars** - Pass: Each FAQ answer is 40 to 300 characters long. - Numbers and lists the tool uses: 40 and 300 characters, inclusive (faq-answer-extractability). - Why: Answer length is one of eight linguistic signals Google's featured snippet selection is known to weight. - Fix: Trim or expand each answer to 40 to 300 characters. - Verify: [FAQ Extractability](https://jwatte.com/tools/faq-answer-extractability/). - [ ] **4.38 First word is a concrete subject** - Pass: The first sentence of the FAQ answer does not start with a pronoun or a transition word. - Numbers and lists the tool uses: pronounStart /^(it|this|that|these|those|they|he|she|we)\b/i; transitionStart /^(however|therefore|moreover|also|but|and|so|in|for|to)\b/ on the lowercased first sentence split on /(?<=[.!?])\s+/ (faq-answer-extractability). - Why: An answer that starts with 'It' or 'However' needs the question for context and extracts poorly as a standalone snippet. - Fix: Open the answer with the question's subject, not a pronoun. - Verify: [FAQ Extractability](https://jwatte.com/tools/faq-answer-extractability/). - [ ] **4.39 Pronoun density < 6%** - Pass: Pronouns make up less than 6% of the FAQ answer's words. - Numbers and lists the tool uses: density = pronouns / words, pass < 0.06, 0 when the word count is 0; pronoun regex /\b(it|this|that|they|them|he|she|we|us|their|its)\b/g on the lowercased answer; words split on /\s+/ (faq-answer-extractability). - Why: Low pronoun density keeps the answer self-contained for snippet and AI-answer extraction. - Fix: Replace pronouns with the concrete noun they refer to so the answer stands alone. - Verify: [FAQ Extractability](https://jwatte.com/tools/faq-answer-extractability/). - [ ] **4.40 Fact-dense (numbers or proper nouns)** - Pass: The FAQ answer has at least two numeric tokens or capitalized proper nouns combined. - Numbers and lists the tool uses: (numbers + properNouns) >= 2; numbers /\b\d+([.,]\d+)?%?\b/g; proper nouns /\b[A-Z][a-z]{2,}/g (faq-answer-extractability). - Why: Fact density is a signal the snippet selector weights. - Fix: Include at least one concrete fact, name or number in the answer. - Verify: [FAQ Extractability](https://jwatte.com/tools/faq-answer-extractability/). - [ ] **4.41 Question subject restated in answer** - Pass: At least two of the question's key words, or all of them when there are fewer than two, appear in the answer. - Numbers and lists the tool uses: Key words longer than 3 letters not in the stop list what, when, where, which, who, why, does, this, that, with; question lowercased with /[^a-z0-9 ]+/g removed; required echoes = min(key word count, 2) (faq-answer-extractability). - Why: Restating the subject lets the answer stand alone without the question. - Fix: Open with the question's subject and echo its key terms in the answer. - Verify: [FAQ Extractability](https://jwatte.com/tools/faq-answer-extractability/). - [ ] **4.42 Answer begins with declarative statement** - Pass: The FAQ answer starts with an article or a capitalized word followed by another word. - Numbers and lists the tool uses: /^(the|a|an|[A-Z][a-z]+)\s+\w+/ (faq-answer-extractability). - Why: A declarative opener is the form the snippet extractor prefers. - Fix: Rewrite the opener as 'The X ...', 'A Y ...' or a capitalized subject followed by a verb phrase. - Verify: [FAQ Extractability](https://jwatte.com/tools/faq-answer-extractability/). - [ ] **4.43 Direct-answer verb in first sentence** - Pass: The first sentence of the FAQ answer contains a direct-answer verb such as is, are or means. - Numbers and lists the tool uses: Verb list is, are, was, were, means, describes, refers, provides, offers, contains, requires, works, takes, includes; first sentence = split on /(?<=[.!?])\s+/ index 0 (faq-answer-extractability). - Why: A direct verb marks the sentence as an answer rather than a preamble. - Fix: Make the first sentence a direct statement using a verb such as is, are, means, provides or includes. - Verify: [FAQ Extractability](https://jwatte.com/tools/faq-answer-extractability/). - [ ] **4.44 First sentence self-contained** - Pass: The first six words of the FAQ answer's first sentence contain no bare 'this' or 'that' without a following noun. - Numbers and lists the tool uses: /\b(this|that)\b(?!\s+\w+)/i applied to the first six words of the first sentence (faq-answer-extractability). - Why: An unresolved 'this' or 'that' makes the answer depend on the question for context. - Fix: Make the first sentence stand alone without the question. - Verify: [FAQ Extractability](https://jwatte.com/tools/faq-answer-extractability/). - [ ] **4.45 FAQ extractability, avg `<n>`%** - Pass: Each FAQ answer passes at least 75% of the eight checks (strong). - Warn: An answer passes 50 to 74% of the checks (mid). - Fail: An answer passes under 50% of the checks (weak). - Numbers and lists the tool uses: pct = round(hits / 8 * 100); strong >= 75, mid >= 50, weak < 50; page average = round(sum(pct) / count); the AI rewrite prompt lists answers under 60%, first 8 after sorting ascending (faq-answer-extractability). - Why: Answer quality decides whether Google actually uses the FAQ as a featured snippet or an AI-answer citation. - Fix: Rewrite each weak answer to satisfy its failed checks: 40 to 300 characters, open with the question's subject, include one fact or number, and make the first sentence stand alone. - Verify: [FAQ Extractability](https://jwatte.com/tools/faq-answer-extractability/). - [ ] **4.46 LLM referral analytics segment** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: Referrer regex chatgpt.com|perplexity.ai|claude.ai|gemini.google.com|copilot.microsoft.com|phind.com|you.com|duckduckgo.com/ai (mega-analyzer); GA4 segment with referrer chatgpt.com|perplexity.ai|claude.ai|gemini.google.com|copilot.microsoft.com|phind.com|you.com (analyzer); chatgpt.com|perplexity.ai|claude.ai|gemini.google.com|copilot.microsoft.com (mega-seo-analyzer); secondary KPI: brand citations from seoClarity, Profound or Bing Webmaster; brand websites earn only about 3% of LLM citations, the other 97% go to Reddit, YouTube, publishers, retailer product pages and Wikipedia. - Why: You cannot tell whether answer-engine work is paying off unless visits referred by AI assistants are tracked separately. - Fix: Create an analytics segment whose referrer matches the AI assistant domains and treat LLM referral visits as the AEO KPI. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). - [ ] **4.47 Google Preferred Sources opt-in widget** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: Deep link https://www.google.com/preferences/source/?source=`<hostname>`; users can save up to 5 publishers; emitted as `<aside class="jw-preferred-sources">` when the Website URL parses to a hostname (eeat-generator). - Why: Google AI Mode and Search let readers mark up to five preferred publishers, and readers who already trust you will do it when asked. - Fix: Add an aside on high-traffic pages inviting readers to add your site to their Google Preferred Sources, linking to the deep link for your hostname. - Verify: [E-E-A-T Generator](https://jwatte.com/tools/eeat-generator/). Standard: Google Preferred Sources (AI Mode + Search). - [ ] **4.48 People Also Ask** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: /data-rhq="PAA"|"peopleAlsoAsk"|class="[^"]*\brelated-question-pair\b|People also ask|aria-label="People also ask"/i on the pasted results-page HTML (serp-features). - Why: When the results page for your query shows a People Also Ask box, those questions are the ones you can win with a heading and a short answer. - Fix: Cover each People Also Ask question as an H2 or H3 with a short answer on your page and pair it with FAQPage schema. - Verify: [SERP Features](https://jwatte.com/tools/serp-features/). Standard: schema.org FAQPage. - [ ] **4.49 Gap analysis feature: RSS Feed** - Pass: The page links an RSS or Atom feed in the head. - Fail: No feed link while another site in the comparison batch has one. - Numbers and lists the tool uses: link[type=application/rss+xml] or link[type=application/atom+xml]; the feature gap table only renders with 2 or more successful results (Batch Analyzer). - Why: A feed lets readers, aggregators and AI systems follow new content without crawling the whole site. - Fix: Publish an RSS or Atom feed and link it in the head of every page. - Verify: [Batch Compare](https://jwatte.com/tools/batch-analyzer/). - [ ] **4.50 Gap analysis feature: JSON Feed** - Pass: The page links a JSON Feed or references /feed.json. - Fail: No JSON Feed while another site in the comparison batch has one. - Numbers and lists the tool uses: link[type=application/feed+json] or /feed\.json/i anywhere in the HTML (Batch Analyzer). - Why: JSON Feed is the machine-friendly feed format newer readers and agents prefer. - Fix: Publish /feed.json and link it in the head. - Verify: [Batch Compare](https://jwatte.com/tools/batch-analyzer/). ## 5. Being read by ChatGPT, Claude, Perplexity and Google's AI Before an AI can cite you it has to be allowed in, and then it has to find the files written for it. This section is the AI crawlers in robots.txt, the host challenge pages that block them without telling anyone, llms.txt and ai.txt, and the agent-facing surfaces that Cloudflare's public readiness score at https://isitagentready.com/ looks for. **Verify this section with:** [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Site Analyzer](https://jwatte.com/tools/analyzer/), [robots.txt Simulator](https://jwatte.com/tools/robots-txt-simulator/), [Agent Ready Audit](https://jwatte.com/tools/agent-ready-audit/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [AI Posture Audit](https://jwatte.com/tools/ai-posture-audit/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/), [Mega Batch](https://jwatte.com/tools/mega-batch/), [Migration Analyzer](https://jwatte.com/tools/migration-analyzer/), [Mega AEO Analyzer](https://jwatte.com/tools/mega-aeo-analyzer/), [Content Velocity](https://jwatte.com/tools/content-velocity/), [AI Bot Allowlist Validator](https://jwatte.com/tools/ai-bot-allowlist-validator/), [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [LLMs.txt Generator](https://jwatte.com/tools/llms-txt-generator/). - [ ] **5.1 AI crawlers blocked in robots.txt: `<list>` / none** - Pass: No AI crawler in the registry is disallowed: its robots.txt group has no Disallow: / line, or no group names it and the wildcard group allows it. - Fail: An AI crawler's own User-agent group contains Disallow: / and no Allow line (Mega Analyzer fails, Analyzer reports it as informational). - Numbers and lists the tool uses: Bot list: registry categories ai-llm, ai-search and data (Mega Analyzer), fallback GPTBot, ChatGPT-User, ClaudeBot, Claude-Web, anthropic-ai, PerplexityBot, Google-Extended, CCBot, Applebot-Extended, Bytespider; Analyzer checks 15 bots: GPTBot, ChatGPT-User, OAI-SearchBot, ClaudeBot, Claude-Web, anthropic-ai, PerplexityBot, Google-Extended, CCBot, Applebot-Extended, Bytespider, DuckAssistBot, cohere-ai, FacebookBot, Amazonbot; Mega Analyzer audit prompt names GPTBot, ClaudeBot, PerplexityBot, Google-Extended, CCBot, Bytespider, Applebot-Extended, Meta-ExternalAgent and the retrieval-stage crawlers GPTBot, OAI-SearchBot, ClaudeBot, anthropic-ai, PerplexityBot; statuses disallowed / explicit-allow / allowed-default; blockedAll = Disallow: / present and no Allow lines; groups split on blank lines (/\n\s*\n/), user-agent lines /^user-agent\s*:/i, disallow lines /^disallow\s*:/i; robots.txt Simulator evaluates Googlebot, Bingbot, GPTBot, ClaudeBot, PerplexityBot, Google-Extended, Applebot-Extended, Bytespider or * per URL, matched case-insensitively against each User-agent line. - Why: An AI answer engine cannot cite a page its crawler is told not to fetch. - Fix: Allow the AI crawlers you want citations from in robots.txt as an allow-list rather than a deny-list, and add an explicit User-agent group for any AI crawler you want to treat differently from *. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [robots.txt Simulator](https://jwatte.com/tools/robots-txt-simulator/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: robots.txt (RFC 9309). - [ ] **5.2 AI bot rules in robots.txt** - Pass: At least one User-agent line in robots.txt names a known AI crawler, whether the rule allows or disallows it. - Fail: No per-bot User-agent directive names any known AI crawler, so every bot falls under User-agent: * (Agent-Ready Audit, the Mega Analyzer parity card and Cloudflare's scorer fail this; Analyzer reports it as informational). - Numbers and lists the tool uses: Agent-Ready Audit KNOWN_AI_BOTS (23, lowercased): gptbot, oai-searchbot, chatgpt-user, claudebot, claude-web, anthropic-ai, perplexitybot, perplexity-user, google-extended, googlebot, applebot-extended, applebot, bytespider, meta-externalagent, facebookbot, ccbot, cohere-ai, amazonbot, youbot, duckassistbot, mistralai-user, diffbot, timpibot; line regex /^\s*user-agent\s*:\s*(.+?)\s*(?:#.*)?$/i; parish audit (Analyzer) matches /GPTBot|ClaudeBot|PerplexityBot|OAI-SearchBot|Google-Extended/i; Mega Analyzer parity card row 'robots.txt AI rules' passes when at least one line matches /^\s*user-agent\s*:\s*(GPTBot|ChatGPT-User|OAI-SearchBot|ClaudeBot|Claude-Web|anthropic-ai|PerplexityBot|Google-Extended|Googlebot-News|CCBot|Applebot-Extended|Bytespider|Amazonbot|Meta-ExternalAgent|FacebookBot|cohere-ai|Diffbot|YouBot|Timpibot|MistralAI-User)\b/gim (20 bots); Single Site Gen and Site Migration Gen expect explicit Allow for GPTBot, ClaudeBot, anthropic-ai, PerplexityBot, Google-Extended, CCBot, Applebot-Extended, ChatGPT-User, OAI-SearchBot, Bytespider, YouBot, Amazonbot; shared bot registry (33 entries) robots.txt tokens by tier: critical GPTBot, OAI-SearchBot, ChatGPT-User, ClaudeBot, PerplexityBot, Googlebot, Google-Extended, bingbot; major Claude-Web, Perplexity-User, Applebot, Bytespider, CCBot, Meta-ExternalAgent (also facebookexternalhit), Amazonbot, MistralAI-User (also mistralai), DuckDuckBot, YandexBot (also yandex), Baiduspider (also baidu); optional anthropic-ai, Applebot-Extended, cohere-ai, Cohere-Training-Data-Crawler, YouBot, Diffbot, Timpibot, omgili (also omgilibot), PetalBot, Slurp (also yahoo! slurp), facebookexternalhit, LinkedInBot, Twitterbot, Slackbot (also slackbot-linkexpanding); anthropic-ai, Applebot-Extended and Google-Extended are policy-only tokens with no live crawler; the AI Bot Policy Generator writes a block for every registry bot except the preview category, adding legacy search bots (Googlebot, bingbot, PetalBot, DuckDuckBot, YandexBot, Slurp, Baiduspider) only when 'Include legacy bots' is checked. - Why: Silence in robots.txt is ambiguous; a named rule tells each AI crawler exactly what you decided, and Cloudflare's scorer counts even an Allow rule. - Fix: Add an explicit User-agent block for each AI crawler you want to allow or disallow (for example GPTBot, ClaudeBot, PerplexityBot, Google-Extended) plus a Sitemap line; the AI Bot Policy Generator at /tools/ai-bot-policy-gen/ writes a paired robots.txt and ai.txt. - Verify: [Agent Ready Audit](https://jwatte.com/tools/agent-ready-audit/), [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: robots.txt (RFC 9309); Cloudflare Agent Readiness Score (https://isitagentready.com/). - [ ] **5.3 Content-Signal directive in robots.txt (contentsignals.org)** - Pass: Robots.txt contains a Content-Signal line declaring search, ai-input and ai-train preferences. - Warn: No Content-Signal line and fewer than 3 named AI bot rules (Mega Analyzer); Mega SEO Analyzer reports absence as informational. - Fail: No Content-Signal directive at all (Agent-Ready Audit scores this as a fail, and Cloudflare's scorer fails a site that has per-bot rules but no Content-Signal line). - Numbers and lists the tool uses: line regex /^\s*content-signal\s*:/mi; Mega Analyzer also passes (as info) when at least 3 named AI bot rules exist from GPTBot, ChatGPT-User, OAI-SearchBot, ClaudeBot, Claude-Web, anthropic-ai, PerplexityBot, Google-Extended, Googlebot-News, CCBot, Applebot-Extended, Bytespider, Amazonbot, Meta-ExternalAgent, FacebookBot, cohere-ai, Diffbot, YouBot, Timpibot, MistralAI-User; Mega SEO Analyzer looks in the page HTML for /content-signals\s*:|<meta[^>]+name=["']content-signals["']/i; tokens search, ai-input, ai-train each yes or no; the AI Bot Policy Generator writes 'Content-Signal: search=<yes|no>, ai-input=<yes|no>, ai-train=<yes|no>' in the User-agent: * block, search=yes and ai-input=yes when any bot has crawl=allow, ai-train=yes only when any bot has train=allow. - Why: It lets you grant or deny AI training, AI answer input and search inclusion separately instead of one blunt Allow or Disallow, and Cloudflare AI Crawl Control adopted it as the default. - Fix: Add 'Content-Signal: search=yes, ai-input=yes, ai-train=yes' (adjust the values to your policy) to the User-agent: * block of robots.txt. - Verify: [Agent Ready Audit](https://jwatte.com/tools/agent-ready-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: contentsignals.org / IETF Content Signals draft; Cloudflare Agent Readiness Score (https://isitagentready.com/). - [ ] **5.4 Content-Signal declared in every robots.txt user-agent group** - Pass: Every User-agent group in robots.txt carries its own Content-Signal line with valid tokens. - Warn: One or more groups lack the line, or a token is not one of search, ai-input, ai-train set to yes or no. - Numbers and lists the tool uses: valid token /^(search|ai-input|ai-train)\s*=\s*(yes|no)$/i; consecutive User-agent lines form one group (RFC 9309). - Why: A crawler obeys exactly one group and a named group replaces the wildcard group, so a Content-Signal placed only under User-agent: * is invisible to named AI crawlers. - Fix: Repeat the Content-Signal directive inside each User-agent group, not just the wildcard block. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: RFC 9309; contentsignals.org. - [ ] **5.5 ai.txt policy served** - Pass: /ai.txt or /.well-known/ai.txt returns HTTP 200 with a body. - Warn: Neither path is served (most tools warn, Mega SEO Analyzer pushes an impact 2 recommendation, Migration Analyzer reports 'ai.txt: not found' as informational); Mega Analyzer reports it as informational on platforms that cannot host root files. - Numbers and lists the tool uses: paths /ai.txt, /.well-known/ai.txt (Analyzer, Mega Analyzer, AI Posture Audit, Batch Analyzer, Mega Batch and Migration Analyzer accept either; the Mega SEO Analyzer recommendation keys on /ai.txt only); Spawning format: 'User-Agent: *' + 'Allow: /', then per bot 'User-Agent: `<name>`' with 'Allow: /' when training is allowed else 'Disallow: /'; reference https://site.spawning.ai/spaces/ai-txt; generator footer names `<origin>`/robots.txt, the /.well-known/ai.txt mirror and `<origin>`/contact/. - Why: Robots.txt governs crawling only; ai.txt is the training-data policy file honored by OpenAI, Anthropic, Google-Extended, Perplexity and CCBot, so without it AI crawlers have no explicit training opt-in or opt-out signal. - Fix: Generate one with the ai.txt Generator at /tools/ai-txt-gen/ and serve the identical file at /ai.txt and /.well-known/ai.txt. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [AI Posture Audit](https://jwatte.com/tools/ai-posture-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/) and 3 more. Standard: Spawning ai.txt; RFC 8615 for the .well-known mirror. - [ ] **5.6 `<n>` AI-crawler(s) have conflicting CRAWL signals across robots.txt / meta robots / X-Robots-Tag** - Pass: For every AI bot, the crawl directive read from robots.txt, the X-Robots-Tag header and the robots meta tag agree, and robots.txt parsed to at least one group. - Warn: At least one bot has two or more non-empty sources that disagree. - Numbers and lists the tool uses: AI_BOTS (22): GPTBot, ChatGPT-User, OAI-SearchBot, ClaudeBot, Claude-Web, anthropic-ai, PerplexityBot, Google-Extended, Googlebot, CCBot, Applebot-Extended, Applebot, Bytespider, Meta-ExternalAgent, FacebookBot, DuckAssistBot, cohere-ai, Amazonbot, YouBot, Diffbot, Timpibot, MistralAI-User; robots.txt groups split on /\n\s*\n/, comments stripped /#.*$/, user-agent lines /^user-agent\s*:/i; a group is disallow if any /^disallow\s*:\s*(.*)$/i has value '/', else allow if any /^allow\s*:\s*(.*)$/i has value '/', else null; a bot-specific group wins over '*'; meta robots /\bnoindex\b/ = disallow, /\bindex\b/ or /\bfollow\b/ = allow; X-Robots-Tag split on ',', a part containing ':' not starting /^\s*max-/i is read as '`<ua>`: `<directive>`', otherwise '*'; the X-Robots-Tag candidate counts only when robots.txt does not disallow the bot and (the header names the bot or robots.txt has no bot-specific group); the meta candidate counts only when robots.txt does not disallow the bot and has no bot-specific group; the AI Posture Audit's own matrix compares robots.txt, X-Robots-Tag and meta robots for every bot without that gating; detail lists at most 6 bots; AI Posture Audit matrix covers registry categories ai-llm, ai-search, data and search (29 bots) with a 'none' cell when a source says nothing about the bot; regenerated files map operators GPTBot/ChatGPT-User/OAI-SearchBot OpenAI, ClaudeBot/Claude-Web/anthropic-ai Anthropic, PerplexityBot Perplexity, Google-Extended/Googlebot Google, CCBot Common Crawl, Applebot-Extended/Applebot Apple, Bytespider ByteDance, Meta-ExternalAgent/FacebookBot Meta, DuckAssistBot DuckDuckGo, cohere-ai Cohere, Amazonbot Amazon, YouBot You.com, Diffbot Diffbot, Timpibot Timpi, MistralAI-User Mistral. - Why: All three sources answer the same question (may this bot fetch the page) and when they disagree for a bot the result is unpredictable, a silent misconfiguration classic audits miss. - Fix: Make robots.txt, the X-Robots-Tag header and the robots meta tag agree per bot; the AI Posture Audit at /tools/ai-posture-audit/ shows the per-bot matrix and can regenerate an aligned robots.txt plus ai.txt (header comments, 'User-agent: *' + 'Allow: /', 'Sitemap: `<origin>`/sitemap.xml', then one block per bot). - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [AI Posture Audit](https://jwatte.com/tools/ai-posture-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: RFC 9309; Google robots meta and X-Robots-Tag documentation. - [ ] **5.7 AI-bot meta posture** - Pass: The robots meta tag carries no noai or noimageai directive. - Numbers and lists the tool uses: /<meta[^>]+name=["']robots["'][^>]+(noai|noimageai)/i; scored 0 or 100. - Why: Noai tells AI engines not to use the page, which removes it from citations. - Fix: Remove noai and noimageai from the robots meta tag if you want AI engines to cite this page. - Verify: [Mega AEO Analyzer](https://jwatte.com/tools/mega-aeo-analyzer/). Standard: noai / noimageai meta directive. - [ ] **5.8 Platform-managed bot challenge blocks AI crawlers, `<vendor>`** - Pass: A non-browser request receives real page content, not a CDN or WAF challenge page, and the body text exceeds 500 characters. - Fail: A challenge marker matches (Cloudflare 'Just a moment', Vercel Security Checkpoint, AWS WAF, Imperva, Akamai) so AI crawlers receive an empty challenge page; Mega Analyzer then grades the AI Crawler View F and flags 499 risk, and Content Velocity counts the URL as 0 words and 0 schema. - Numbers and lists the tool uses: Vercel /Vercel Security Checkpoint|X-Vercel-Challenge-Token|x-vercel-mitigated/i; Cloudflare /cf-mitigated:\s*challenge|`<title>`Just a moment\.{3}<\/title>|challenges\.cloudflare\.com\/cdn-cgi\/challenge-platform|`<title>`Sorry, you have been blocked<\/title>/i; AWS WAF /`<title>`403 Forbidden<\/title>[\s\S]{0,2000}x-amzn-waf|aws-waf-token|x-amzn-trace-id[\s\S]{0,500}403/i; Imperva /imperva|incapsula|Request unsuccessful\. Incapsula incident ID/i; Akamai /Akamai bot manager|reference #\d+\.[a-z0-9]+\.akamai/i; first 4000 chars scanned; body text must exceed 500 chars; TRT clinic audit marker on the home page /challenges\.cloudflare\.com|cf-browser-verification|just a moment|enable javascript and cookies|__cf_chl|turnstile/i; shared isAiBlock rules: 403 + cf-mitigated matching challenge|block; 403 + server cloudflare + challenges.cloudflare.com in body; 403 + CSP referencing challenges.cloudflare.com; cloudflare server + noindex,nofollow + under 50 words; window._cf_chl_opt or cf-challenge-platform in body; cf-mitigated header at any status; any matched vendor (Cloudflare, AWS WAF, Akamai Bot Manager, Imperva / Incapsula, Sucuri, Vercel Firewall) returning 403 or 503 with under 200 words; platform-managed hosts /Pixieset|SmugMug|Squarespace|Format|Showit|Wix|GoDaddy\sBuilder/i; when blocked, content checks fall back to a Wayback or Google Cache copy. - Why: GPTBot, ChatGPT-User, ClaudeBot, PerplexityBot, Google-Extended and OAI-SearchBot all hit the same wall, read a noindex challenge page, time out and walk away, so your robots.txt and ai.txt never matter. - Fix: Vercel: disable Attack Challenge Mode; Cloudflare: enable Verified Bots or write a WAF Skip rule for the AI crawlers and lower Bot Fight Mode; AWS WAF, Imperva, Akamai: reduce sensitivity or allowlist the AI crawlers. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [AI Posture Audit](https://jwatte.com/tools/ai-posture-audit/), [Content Velocity](https://jwatte.com/tools/content-velocity/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **5.9 `<n>` of `<n>` critical AI bots cannot read this page** - Pass: Every probed AI crawler receives HTTP 2xx with real content when the request identifies itself as that crawler. - Fail: Any crawler gets a challenge page (CHALLENGED), HTTP 429 (THROTTLED), HTTP 451 or another 4xx without a challenge (BLOCKED), or a stripped body (PARTIAL); severity critical. - Numbers and lists the tool uses: Mega Analyzer probes the registry critical tier filtered to live-probeable: GPTBot, OAI-SearchBot, ChatGPT-User, ClaudeBot, PerplexityBot, Googlebot, bingbot (fallback when the registry has not loaded: GPTBot, ClaudeBot, PerplexityBot, Googlebot; skipped in ?fast=1 mode); Mega Analyzer verdicts: error when the fetch fails, challenged when the shared isAiBlock rules match, blocked on any HTTP status 400 or higher (no separate THROTTLED), partial when the baseline exceeds 50 words and the body has fewer than max(20, 15% of baseline) words, otherwise allowed; AI Posture Audit and AI Bot Allowlist Validator probe every live-probeable registry bot: GPTBot, OAI-SearchBot, ChatGPT-User, ClaudeBot, Claude-Web, PerplexityBot, Perplexity-User, Applebot, Googlebot, bingbot, Bytespider, CCBot, Meta-ExternalAgent, Amazonbot, MistralAI-User, cohere-ai, Cohere-Training-Data-Crawler, YouBot, Diffbot, Timpibot, omgili, PetalBot, DuckDuckBot, YandexBot, Slurp, Baiduspider, facebookexternalhit, LinkedInBot, Twitterbot, Slackbot (anthropic-ai, Applebot-Extended and Google-Extended have no live identity and show n/a); validator verdicts: ALLOWED = HTTP 2xx with content; CHALLENGED = WAF challenge page per the shared isAiBlock rules; THROTTLED = HTTP 429; BLOCKED = HTTP 451 (unavailable for legal reasons) or any other 400 to 499 without a challenge page; PARTIAL = word count below max(20, 15% of the browser baseline) when the baseline exceeds 50 words; 5xx counts as an origin error, not a block; 350 ms delay between probes; first 12 blocked bots listed. - Why: A CDN can pass browsers but still block specific bots or serve them a stripped page, so a policy file that says allow proves nothing until each crawler actually gets the page. - Fix: In the CDN dashboard enable Verified Bots or write a Skip rule for the retrieval bots (OAI-SearchBot, ClaudeBot, PerplexityBot, Applebot, Googlebot, bingbot); on AWS WAF write the IPSet plus identity rule; on Akamai add a Bot Manager exception; raise or exempt AI crawlers from rate limits; confirm with the AI Bot Allowlist Validator, cross-check server logs, and re-run about 7 days after the fix. - Verify: [AI Posture Audit](https://jwatte.com/tools/ai-posture-audit/), [AI Bot Allowlist Validator](https://jwatte.com/tools/ai-bot-allowlist-validator/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **5.10 PARTIAL: HTTP 200 but body is `<n>` words vs `<n>` baseline** - Pass: Each AI crawler's response carries roughly the same word count as the browser baseline fetch of the page. - Warn: The baseline exceeds 50 words and the crawler's body has fewer than max(20, 15% of baseline) words, or fewer than 20 words (empty). - Fail: The browser baseline itself is a WAF challenge, so bot protection is challenging every visitor that is not allowlisted. - Numbers and lists the tool uses: baseline > 50 words; threshold max(20, baseline * 0.15); empty threshold 20 words; word count strips script and style blocks and tags then splits on whitespace. - Why: A 200 OK with almost no text usually means a dynamic-rendering or prerender setup is handing the bot the app shell instead of the full page, a soft block that never shows up as an error. - Fix: Fix the dynamic-rendering or prerendering configuration so bots receive the fully rendered HTML; if even the browser baseline is challenged, relax the WAF before judging individual bots. - Verify: [AI Bot Allowlist Validator](https://jwatte.com/tools/ai-bot-allowlist-validator/). - [ ] **5.11 Identity + AI-discovery files: `<path>` present (HTTP 200, `<size>`) / missing / HTTP `<n>`** - Pass: Each discovery file returns HTTP 200 with a non-empty text body at its exact path, not an HTML page. - Warn: A path returns a non-404 error such as 403 or 500 (AI Posture Audit). - Fail: The path returns 404 or nothing, or the body is an HTML shell (a soft 404 page served with a 200). - Numbers and lists the tool uses: Presence rule (Analyzer): status 200 to 299, body at least 3 chars, first 400 chars must not match /<!doctype\s+html|<html[\s>]/ unless the first 40 chars match /^(#|user-agent|sitemap|<\?xml)/i, size cap 50000 chars for llms.txt, llms-full.txt.well-known/llms.txt, sitemap-image.xml, sitemap.xml, sitemap-news.xml, feed.xml, feed.json, otherwise 4000; Mega Batch: text longer than 5 chars, no '<!DOCTYPE', no '<html', status under 400; Mega SEO Analyzer: status 200 to 299 only; E-E-A-T Analyzer: body longer than 10 chars; AI Posture Audit paths (23): /robots.txt, /ai.txt, /.well-known/ai.txt, /llms.txt, /llms-full.txt, /.well-known/llms.txt, /llms-ctx.txt, /llms-ctx-full.txt, /humans.txt, /.well-known/security.txt, /.well-known/agent-card.json, /.well-known/ai-plugin.json, /.well-known/mcp/server-card.json, /.well-known/mcp.json, /.well-known/agent-skills/index.json, /.well-known/api-catalog, /.well-known/oauth-authorization-server, /.well-known/oauth-protected-resource, /.well-known/http-message-signatures-directory, /AGENTS.md, /sitemap.xml, /feed.xml, /feed.json; Mega SEO Analyzer (19) adds /.well-known/ucp and /sitemap_agentic_discovery.xml; Mega Analyzer adds /sitemap-image.xml, /sitemap-news.xml, /.well-known/openid-configuration, /.well-known/skills/index.json, /.well-known/acp.json, /openapi.json, /.well-known/ai-catalog.json, /auth.md; Analyzer adds /.well-known/change-password, /.well-known/webfinger, /ads.txt, /site.webmanifest, /manifest.json and reports a count out of 11; Mega Batch probes robots.txt, sitemap.xml, llms.txt, llms-full.txt.well-known/llms.txt, ai.txt.well-known/ai.txt.well-known/security.txt, humans.txt, sitemap-image.xml, site.webmanifest; E-E-A-T Analyzer probes robots.txt.well-known/security.txt, llms.txt, llms-full.txt.well-known/agent-card.json, sitemap.xml; site generators template robots.txt, sitemap.xml, feed.xml, feed.json, llms.txt, llms-full.txt, security.txt, ads.txt, app-ads.txt, humans.txt, agent-card.json, ai-plugin.json and .well-known/* per site; Single Site Gen postures: public (allow crawlers and AI bots, Sitemap line, llms.txt, llms-full.txt, JSON-LD.well-known), api-noindex (Allow / plus Disallow: /api/ and X-Robots-Tag noindex), private (Disallow: /, meta noindex, custom 404, no sitemap or llms.txt). - Why: These files are the machine-readable surface AI engines read to learn your identity, retrieval paths and policies, and a CMS that answers every unknown path with a 200 HTML page makes a missing file look present while feeding the bot garbage. - Fix: Publish each file you need as plain text or JSON at its exact path with the right Content-Type, make unknown paths return a real 404, and write complete content for every missing file rather than a template with TODO placeholders; work in this order: crawl conflicts, then discovery files that improve citation, then llms.txt repairs, then nice-to-haves (security.txt, agent-card.json, humans.txt). - Verify: [AI Posture Audit](https://jwatte.com/tools/ai-posture-audit/), [Site Analyzer](https://jwatte.com/tools/analyzer/), [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/) and 2 more. Standard: RFC 8615 well-known URIs; RFC 9116 security.txt; llmstxt.org; humanstxt.org; RFC 9727; RFC 8414; RFC 9728; MCP SEP-2127; Agent Skills v0.2.0; Google A2A; Web Bot Auth; AGENTS.md; JSON Feed. - [ ] **5.12 llms.txt found** - Pass: /llms.txt (or /.well-known/llms.txt) returns HTTP 200 with a text body. - Warn: Missing: most tools warn ('No llms.txt', 'No llms.txt (open first-mover win)' for parishes), Mega SEO Analyzer pushes an impact 3 recommendation, Migration Analyzer reports 'llms.txt: not found' as informational, and the TRT clinic audit fails the home page without it. - Numbers and lists the tool uses: paths /llms.txt, /.well-known/llms.txt (Mega Analyzer, Mega Batch and the Analyzer parish check accept either); the Analyzer main check, Mega SEO Analyzer, Batch Analyzer and Migration Analyzer check /llms.txt only; TRT clinic audit also accepts a /llms.txt reference in the HTML (/\/llms\.txt/i); size cap 50000 chars when fetched (Analyzer). - Why: Llms.txt is the one-page map that tells ChatGPT, Claude and Perplexity what your site is about and which pages to reference, and AI retrieval engines preferentially cite sites that publish one. - Fix: Publish /llms.txt per llmstxt.org: a '# Site Name' title, a '> one-line description', then '## Pages' style sections with '- [title](https://absolute-url): description' lines; a parish would list Mass schedule and contact, a clinic its conditions, cost and locations. Generators: /tools/llms-txt-generator/ and /tools/ai-txt-gen/. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/) and 2 more. Standard: llmstxt.org. - [ ] **5.13 llms.txt is missing the required H1 title line** - Pass: Exactly one line in llms.txt is a Markdown H1. - Warn: More than one H1 line ('llms.txt has multiple H1 titles'). - Fail: Zero H1 lines. - Numbers and lists the tool uses: H1 regex /^# [^#]/ per line, file split on /\r?\n/ (shared module); Analyzer hasTitle /^#\s+.+/m. - Why: The H1 is the site or project name and the spec allows exactly one; without it the file is not compliant. - Fix: Start the file with '# `<Site or Project Name>`' on the first content line and demote any extra H1 to H2. - Verify: [AI Posture Audit](https://jwatte.com/tools/ai-posture-audit/), [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: llmstxt.org. - [ ] **5.14 llms.txt has no description blockquote** - Pass: At least one line in llms.txt is a Markdown blockquote describing the site. - Warn: Zero blockquote lines. - Numbers and lists the tool uses: regex /^>\s+.+/ (shared module and Analyzer hasDesc /^>\s+.+/m). - Why: AI retrieval uses this line as the canonical summary of the site. - Fix: Add a single-line '> `<description>`' directly under the H1. - Verify: [AI Posture Audit](https://jwatte.com/tools/ai-posture-audit/), [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: llmstxt.org. - [ ] **5.15 llms.txt has no H2 sections** - Pass: At least one Markdown H2 line groups the links. - Warn: Zero H2 lines. - Numbers and lists the tool uses: regex /^## [^#]/; the llms.txt Generator groups links by first path segment with root URLs under 'Core', ordered by URL count descending. - Why: Without sections the file is a flat link dump that retrievers cannot navigate. - Fix: Organize links under H2 sections such as '## Projects', '## Docs', '## Blog', '## About'. - Verify: [AI Posture Audit](https://jwatte.com/tools/ai-posture-audit/), [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: llmstxt.org. - [ ] **5.16 llms.txt has only `<n>` link item(s)** - Pass: At least 3 Markdown list-item links are present ('llms.txt structure valid (`<n>` sections, `<n>` links)'). - Warn: 1 or 2 link items. - Fail: Zero link items ('llms.txt has no link items'). - Numbers and lists the tool uses: link item regex /^\s*-\s+\[.+?\]$.+?$/; 0 fails, under 3 warns, 3 or more passes; typical range 5 to 20 link items; Analyzer requires a ## section with at least 3 lines matching /https?:\/\/\S+/ and hasUrls /https?:\/\//m, sections split on /\n(?=##\s)/; Single Site Gen and Site Migration Gen expect '## Pages' with 3 or more URL lines plus '## Resources'; generator lines are '- [`<title>`](`<url>`): `<description>`' with titles cut to 80 chars and descriptions to 160. - Why: Retrieval engines need somewhere to follow; most retrievable llms.txt files carry 5 to 20 links across Projects, Docs, Blog and About. - Fix: Add '- [name](url): description' link items until each main section lists your key pages. - Verify: [AI Posture Audit](https://jwatte.com/tools/ai-posture-audit/), [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: llmstxt.org. - [ ] **5.17 `<n>` relative link(s) in llms.txt** - Pass: Every link href in llms.txt starts with a URI scheme (https:, tel: and mailto: all count). - Warn: One or more hrefs are scheme-less (/path../path, path). - Numbers and lists the tool uses: href capture /\]$([^)]+)$/; scheme test /^[a-z][a-z0-9+.-]*:/i. - Why: LLMs do not resolve relative paths reliably when they fetch the file directly. - Fix: Use absolute URLs (https://...) for every link. - Verify: [AI Posture Audit](https://jwatte.com/tools/ai-posture-audit/), [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: llmstxt.org. - [ ] **5.18 Diff vs live /llms.txt (`<n>` bytes): `<n>` URL(s) to add, `<n>` URL(s) in live file but not in current sitemap** - Pass: The live /llms.txt link list matches the pages in the current sitemap, nothing to add and nothing stale. - Warn: The live endpoint returns HTML (likely a 404 page) so there is no file to diff. - Numbers and lists the tool uses: link URLs parsed with /^-\s+\[.*?\]$(\S+?)$/gm; a live body matching /<!doctype/i counts as no file; up to 20 URLs shown per list; pages with no `<title>` are dropped. - Why: An llms.txt that drifts from the sitemap sends AI retrievers to pages you removed and hides pages you added. - Fix: Add the listed sitemap URLs, remove the stale ones, or replace the live file with the generated one from /tools/llms-txt-generator/. - Verify: [LLMs.txt Generator](https://jwatte.com/tools/llms-txt-generator/). Standard: llmstxt.org. - [ ] **5.19 llms-full.txt found (`<n>`KB)** - Pass: /llms-full.txt is served and longer than 500 characters. - Warn: Present but 500 characters or fewer ('thin'), or absent (Analyzer; Mega Analyzer on editorial sites, with info on platform-limited sites). - Numbers and lists the tool uses: thin threshold 500 chars, recommendation 2000+ chars (Analyzer); generators require at least 2000 chars of per-page summaries (Single Site Gen, Site Migration Gen); Mega Analyzer checks only on editorial-context sites; path /llms-full.txt. - Why: Llms.txt is the summary; llms-full.txt gives AI models the full picture of your site, and retrieval engines preferentially cite sites that publish one. - Fix: Create /llms-full.txt with full descriptions, About, Pages, Key Content Themes, FAQs and Contact, aiming for 2000+ characters. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/). Standard: llmstxt.org. - [ ] **5.20 /.well-known/llms.txt RFC 8615 mirror served** - Pass: /.well-known/llms.txt is served (presence only; no tool compares its body to /llms.txt). - Warn: Missing ('No /.well-known/llms.txt mirror'); platform-limited sites get info. - Numbers and lists the tool uses: path /.well-known/llms.txt; Content-Type text/plain. - Why: Clients that follow well-known discovery look at the RFC 8615 location first. - Fix: Copy /llms.txt to /.well-known/llms.txt and serve it with Content-Type text/plain. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: RFC 8615. - [ ] **5.21 humans.txt identity file** - Pass: /humans.txt is served. - Warn: /humans.txt is not served (Mega Analyzer warn; downgraded to info when the platform cannot host root files); Batch Analyzer weights it 6 points in the GEO score. - Numbers and lists the tool uses: path /humans.txt. - Why: An identity file that tells people and machines who builds and runs the site. - Fix: Publish /humans.txt naming the team and site details. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: humanstxt.org. - [ ] **5.22 Link response headers (RFC 8288)** - Pass: The homepage response carries a Link header pointing at discovery resources. - Warn: No Link header (Mega Analyzer warns; Agent-Ready Audit scores it as a fail). - Fail: A Link header that uses a relation not registered with IANA is indistinguishable from a typo and does not count (Mega Analyzer fix rule). - Numbers and lists the tool uses: any Link header passes; recommended rel values api-catalog, mcp-server-card, agent-skills, llms-txt, sitemap (Agent-Ready Audit); IANA-registered relations only, api-catalog, service-desc, service-doc, describedby, author, privacy-policy, in one comma-separated header (Mega Analyzer fix rule); display truncated at 200 chars (Mega Analyzer) or 300 chars (Agent-Ready Audit). - Why: Agents that read response headers instead of parsing HTML find your discovery resources only through Link headers. - Fix: Add Link headers at the origin (Netlify _headers or netlify.toml, or your server config), for example </.well-known/api-catalog>; rel="api-catalog"; type="application/linkset+json", using only IANA-registered relations. - Verify: [Agent Ready Audit](https://jwatte.com/tools/agent-ready-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: RFC 8288; Cloudflare Agent Readiness Score (https://isitagentready.com/). - [ ] **5.23 Markdown for Agents declaration** - Pass: The page head declares a Markdown alternate: link rel=alternate with type text/markdown or an href ending in .md. - Numbers and lists the tool uses: selectors link[rel="alternate"][type*="markdown"], link[rel="alternate"][href$=".md"] (Mega Analyzer); regex /<link[^>]+rel=["']alternate["'][^>]+type=["']text\/markdown["']/i or /<link[^>]+rel=["']alternate["'][^>]+href=["'][^"']+\.md["']/i (Mega SEO Analyzer, informational when absent). - Why: Retrievers look for the declaration before negotiating, and Cloudflare's Agent Readiness Score rewards a Markdown alternate so agents can fetch structured text instead of parsing HTML. - Fix: Add `<link rel="alternate" type="text/markdown" href="page.md">` to the head and serve a .md companion; generator at /tools/markdown-for-agents-generator/. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: Markdown for Agents working draft; Cloudflare Agent Readiness Score (https://isitagentready.com/). - [ ] **5.24 Markdown content negotiation** - Pass: A request with Accept: text/markdown returns a Markdown variant of the page ('YES (active+passive)' when the head also declares it). - Warn: The head declares a Markdown alternate but the origin does not answer Accept: text/markdown ('PASSIVE ONLY'); or negotiation works but the Markdown response lacks Vary: Accept, so CDNs collapse the Markdown and HTML variants into one cache entry (Mega Analyzer warn, vary_accept_on_md_response). - Fail: Neither the declaration nor negotiation exists ('NO' in Mega Analyzer); Agent-Ready Audit scores a missing Markdown variant as a fail. - Numbers and lists the tool uses: supported when Content-Type matches /markdown/i, or the body looks like Markdown (/^---\n[\s\S]*?\n---\n/ front matter or /^#\s/m within the first 2000 chars) and is under 70% of the HTML length (body.length < html.length * 0.7); Vary and Content-Signal response headers recorded; Vary check = /\baccept\b/i against the Vary header of the Markdown response, run only when negotiation is supported; fix rule: Vary: Accept on both branches with HTML the default for */*. - Why: When an agent asks for text/markdown and gets it, it reads clean structured text instead of a full HTML page; Cloudflare's Markdown for Agents and equivalent origin negotiation both count. - Fix: Enable Cloudflare Markdown for Agents, or pre-generate Markdown per page and serve it when Accept prefers text/markdown, keeping HTML as the default and sending Vary: Accept on both branches. - Verify: [Agent Ready Audit](https://jwatte.com/tools/agent-ready-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: Markdown for Agents; Cloudflare Agent Readiness Score (https://isitagentready.com/). - [ ] **5.25 Per-page .md companion at `<path>`.md** - Pass: A sibling Markdown file exists at `<path>`.md (or negotiation already works) for content pages. - Warn: A content path has no companion (info when negotiation already works). - Numbers and lists the tool uses: content paths /^\/(blog|posts|articles|insights|news|guides|docs|library)\b/i; companion path = path minus trailing slash and .html plus '.md'; skipped for /; counts as present on status 200 with a /markdown/i Content-Type or /^#\s/m in the first 500 chars. - Why: AI clients can fetch the Markdown twin directly without content negotiation. - Fix: Generate a parallel /`<path>`.md for each post (Eleventy pagination or Astro getStaticPaths). - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **5.26 SPA shell with no server-rendered content** - Pass: The server HTML has no known SPA mount element, or the page renders at least one H1 and 150 or more words without JavaScript. - Warn: Not a shell but fewer than 300 words rendered ('THIN', Mega Analyzer AI Crawler View card). - Fail: A mount id (root, app, __next, __nuxt, __svelte, gatsby-focus-wrapper, ___gatsby, __remix) is present and the page has no H1 or fewer than 150 words. - Numbers and lists the tool uses: mount ids root, app, __next, __nuxt, __svelte, gatsby-focus-wrapper, ___gatsby, __remix; rendered = h1 count > 0 and wordCount >= 150 (Mega Analyzer, Analyzer); AI Crawler View card RENDERED at 300+ words, THIN below 300 with advice to add 200+ words. - Why: GPTBot, ClaudeBot, OAI-SearchBot and Googlebot read the server HTML and do not execute JavaScript, so an empty mount div is an empty page to them. - Fix: Server-render or pre-render the main content: renderToString injected into index.html at build time, a static-site generator (Eleventy, Astro, Next.js static export) or a prerender step. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: Cloudflare Agent Readiness Score (https://isitagentready.com/). - [ ] **5.27 Empty <`<tag>` id="`<id>`">, content injected by JS** - Pass: No known header, footer, main or framework wrapper element is empty in the server-rendered HTML. - Warn: The element with id site-header is effectively empty. - Fail: Site-footer, root, app, __next, gatsby-focus-wrapper, svelte, nuxt or `<main>` is effectively empty (critical); an empty bottom-bar is informational; Batch Analyzer deducts 5 points per critical shell, capped at 20. - Numbers and lists the tool uses: INJECTION_TARGETS: site-footer (critical), site-header (warn), root, app, __next, gatsby-focus-wrapper, svelte, nuxt (critical), bottom-bar (info); `<main>` checked separately; effectively empty = textContent with whitespace removed is 30 chars or fewer AND no descendant matching a,button,p,h1,h2,h3,h4,h5,h6,li,img,input,textarea,iframe. - Why: AI crawlers do not run JavaScript, so a header, footer or main region filled in by script is invisible to them, taking your navigation, contact details and landmarks with it. - Fix: Inline the critical content as static HTML; the script can still overwrite it on DOMContentLoaded for humans, which keeps the UX while fixing AI visibility. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/). - [ ] **5.28 Page is server-rendered, visible to AI retrievers** - Pass: The server HTML carries enough static text: body text of 200 characters or more, and an SSR score of 4 or more. - Warn: SSR score 2 or 3: partial server rendering with weak signals. - Fail: Body text under 200 characters on a page that has a `<title>`, or SSR score under 2 (renders empty without JavaScript, critical for AI eligibility). - Numbers and lists the tool uses: Audit Toolkit: `<title>` non-empty and body textContent (whitespace collapsed) under 200 chars; AI Posture Audit SSR score: +2 body text >= 300 chars, +1 at least 1 h1 and 1 h2, +1 at least 3 p elements, +1 article, main or [itemtype*=schema.org] present, +1 text to HTML ratio > 0.05, +1 a noscript element with more than 200 chars of text, -3 body text < 200 chars with 5 or more script elements; rendered >= 4, partial 2 to 3, shell < 2. - Why: AI retrievers (GPTBot, ClaudeBot, PerplexityBot, OAI-SearchBot, ChatGPT-User) index whatever text is in the HTML before any script runs. - Fix: Server-side render the main content, ship a meaningful noscript fallback, or pre-render at build time (Next.js getStaticProps, Astro, Eleventy, Hugo, plain HTML) so every primary heading and the lead paragraph are in the HTML. - Verify: [AI Posture Audit](https://jwatte.com/tools/ai-posture-audit/). - [ ] **5.29 NLWeb foundation present (RSS/Atom feed + schema)** - Pass: The head links an RSS, Atom or JSON feed and the page carries schema.org markup. - Warn: An editorial site is missing either (Mega Analyzer, Mega SEO Analyzer). - Fail: One or both missing scores 50 or 0 ('NLWeb foundation partial', Mega AEO Analyzer). - Numbers and lists the tool uses: Mega SEO Analyzer regex /<link[^>]+rel=["']alternate["'][^>]+type=["'](?:application\/(?:rss\+xml|atom\+xml|feed\+json))["']/i; Mega AEO Analyzer selectors link[rel="alternate"][type*="rss"], [type*="atom"], [type*="feed+json"] (+50) and script[type=application/ld+json] (+50); Mega Analyzer feed = link[type="application/rss+xml"] or link[type="application/atom+xml"] (a JSON Feed link alone does not count) plus at least one schema type, gated on editorial context or the foundation already being present. - Why: NLWeb-style agents index from a structured feed plus schema rather than the page UI. - Fix: Add `<link rel="alternate" type="application/rss+xml" href="/feed.xml">` to the head and JSON-LD schema.org markup describing the page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [Mega AEO Analyzer](https://jwatte.com/tools/mega-aeo-analyzer/). Standard: NLWeb (Microsoft); RSS/Atom; JSON Feed. - [ ] **5.30 JSON Feed (feed.json) discoverable** - Pass: The head links a JSON Feed or /feed.json is served (editorial sites). - Warn: Missing on an editorial site. - Numbers and lists the tool uses: link type application/feed+json or path /feed.json; gate editorial context. - Why: AI retrieval prefers JSON Feed over RSS. - Fix: Add `<link rel="alternate" type="application/feed+json" href="/feed.json">` and publish the feed. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: JSON Feed. - [ ] **5.31 WebMCP capability declaration present** - Pass: WebMCP markers exist, or the page has no agent-callable call to action (then not applicable, full credit). - Warn: A page with a CTA (book a demo, start trial, sign up, add to cart, checkout) has no WebMCP markers (Mega Analyzer warn; Mega AEO Analyzer score 60); Mega SEO Analyzer reports absence as informational. - Numbers and lists the tool uses: markers meta[name=webmcp], link[rel=webmcp], script[type=application/webmcp+json], [data-webmcp-action] (Mega Analyzer, Mega AEO Analyzer); regex /<meta[^>]+name=["']webmcp["']|<link[^>]+rel=["']webmcp["']|<script[^>]+type=["']application\/webmcp\+json["']|data-webmcp-action/i (Mega SEO Analyzer); agent CTA in Mega Analyzer = commerce surface or /(?:book a demo|start (?:free )?trial|sign up|subscribe|request a quote|get started|contact sales|book now)/i on the first 50000 chars of body text; agent CTA in Mega AEO Analyzer = /(?:add to cart|add-to-cart|buy now|checkout|book a demo|start (?:free )?trial|sign up|subscribe|request a quote|contact sales|book now)/i on the first 50000 chars of body text. - Why: WebMCP lets a site declare its transactional actions so agents call them directly instead of guessing from the UI; pure content pages have nothing to declare. - Fix: Declare actions (add-to-cart, book-demo, start-trial) with `<meta name="webmcp">` or `<script type="application/webmcp+json">`. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [Mega AEO Analyzer](https://jwatte.com/tools/mega-aeo-analyzer/). Standard: W3C WebMCP proposal. - [ ] **5.32 WebMCP tools registered with document.modelContext.registerTool** - Pass: The homepage HTML, or a WebMCP script it loads, calls registerTool( and references modelContext (document.modelContext, or the navigator.modelContext alias); not applicable when the page has no agent CTA. - Warn: Only provideContext( is found (removed from the WebMCP draft on 2026-03-05, pull request 132), a WebMCP marker is present with no registerTool( call, or a CTA page registers nothing (Agent-Ready Audit scores the missing case as a fail and the provideContext-only case as a warning). - Numbers and lists the tool uses: a pass needs both /modelContext/i and /\bregisterTool\s*\(/; legacy /\bprovideContext\s*\(/; markers /(?:navigator|document)\s*\.\s*modelContext/i and /data-webmcp-imperative/i; external scripts with src matching /webmcp|model-?context|agent-tools/i are read (at most 3). The Mega Analyzer tests only inline JavaScript and those scripts, so an article that mentions the API in its text, a code sample or JSON-LD is not counted as a registration. - Why: Chrome's WebMCP documentation and ChatGPT's Site tools describe registering tools one at a time with document.modelContext.registerTool; a page that only calls the removed provideContext() is probably registering nothing, and with a strict script-src 'self' CSP the call lives in an external file. - Fix: Register each tool on page load with document.modelContext.registerTool({name, description, inputSchema, execute}), and call provideContext({tools:[...]}) only as a fallback when registerTool is missing; spec at https://webmachinelearning.github.io/webmcp/. - Verify: [Agent Ready Audit](https://jwatte.com/tools/agent-ready-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: W3C WebMCP Community Draft; Cloudflare Agent Readiness Score (https://isitagentready.com/). - [ ] **5.33 agent-card.json (/.well-known/agent-card.json) served** - Pass: /.well-known/agent-card.json is served, or the site is not an agent target. - Warn: An agent target has no card (Mega Analyzer); Mega SEO Analyzer gives an impact 1 recommendation and Analyzer an info row. - Numbers and lists the tool uses: path /.well-known/agent-card.json; agent target (Mega Analyzer) = a published agent surface (MCP card, ai-catalog, agent skills, api-catalog, agent card, ai-plugin), or schema /SoftwareApplication|WebAPI|APIReference/, or host /^(api|developer|docs|graphql)\./i, or links /\/api\/(v\d+|reference|docs)|\/graphql\b|\/developer\b|\/api-docs\b/i, or copy /\b(api[- ]key|developer (portal|docs|api)|api documentation|generate (an )?api key|gpt action|openai plugin)\b/i in the first 60000 chars; generator expects name, description, capabilities, auth policy and endpoints. - Why: The A2A agent card is the machine-readable identity agent frameworks check first, declaring your capabilities to other agents. - Fix: Publish a small JSON at /.well-known/agent-card.json declaring name, description, capabilities, auth policy and agent-facing endpoints; skip it if you offer no agent-callable surface. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/). Standard: Google A2A Agent Card; Cloudflare Agent Readiness Score (https://isitagentready.com/). - [ ] **5.34 ai-plugin.json (/.well-known/ai-plugin.json) served** - Pass: /.well-known/ai-plugin.json is served, or the site is not an agent target. - Warn: An agent target has no manifest (Mega Analyzer); Analyzer reports presence only. - Numbers and lists the tool uses: path /.well-known/ai-plugin.json; generator expects name_for_model, description_for_model and an API spec. - Why: Older ChatGPT plugin and GPT-action integrations key off this path. - Fix: Publish the manifest if you have a GPT-action integration; otherwise absence is fine. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/). Standard: OpenAI plugin manifest. - [ ] **5.35 API Catalog (RFC 9727) at /.well-known/api-catalog** - Pass: /.well-known/api-catalog returns 200 with JSON whose linkset property is an array (Agent-Ready Audit); Mega Analyzer passes on the file being served, or when the site is not an agent target. - Warn: An agent target has no catalog (Mega Analyzer); Mega SEO Analyzer impact 1 recommendation. - Fail: The linkset array is missing or the path does not return 200 (Agent-Ready Audit); the file has no extension so Content-Type: application/linkset+json must be set explicitly by the server (Mega Analyzer fix rule, not probed). - Numbers and lists the tool uses: path /.well-known/api-catalog; media type application/linkset+json; body shape {"linkset":[{"anchor":"...","service-desc":[{"href":"...","type":"..."}]}]}; relations service-desc, service-doc, status. - Why: Agents discover your OpenAPI spec, docs and status endpoints declaratively without parsing markup. - Fix: Publish a linkset array with anchor and link relations per RFC 9727 Appendix A and set Content-Type: application/linkset+json at the server. - Verify: [Agent Ready Audit](https://jwatte.com/tools/agent-ready-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: RFC 9727; RFC 9264 linkset; Cloudflare Agent Readiness Score (https://isitagentready.com/). - [ ] **5.36 MCP Server Card (SEP-2127) at /.well-known/mcp/server-card.json** - Pass: A server card JSON with serverInfo, tools or transports is served at a known path (or the site is not an agent target). - Warn: An agent target has no card (Mega Analyzer); Mega SEO Analyzer impact 1 recommendation; Agent-Ready Audit scores absence as a fail. - Numbers and lists the tool uses: paths /.well-known/mcp/server-card.json, /.well-known/mcp.json, /.well-known/mcp/server-cards.json (Agent-Ready Audit tries them in that order); required fields serverInfo (name, version), transports (http-stream, websocket, webmcp), capabilities (tools, resources, prompts). - Why: The card advertises your tools to MCP clients; without it agents cannot programmatically discover MCP capabilities. - Fix: If you run an MCP server, publish /.well-known/mcp/server-card.json with serverInfo, transports and capabilities and validate it with /tools/mcp-server-audit/; never publish a card without a real server behind it. - Verify: [Agent Ready Audit](https://jwatte.com/tools/agent-ready-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: MCP SEP-2127 (modelcontextprotocol PR 2127); Cloudflare Agent Readiness Score (https://isitagentready.com/). - [ ] **5.37 MCP Server Card published on BOTH SEP-2127 + Cloudflare paths** - Pass: The card is served at both /.well-known/mcp.json and /.well-known/mcp/server-card.json. - Warn: Only one path is served. - Numbers and lists the tool uses: /.well-known/mcp.json (Cloudflare scorer), /.well-known/mcp/server-card.json (SEP-2127). - Why: Cloudflare's scorer reads one path and the SEP-2127 spec names the other. - Fix: Publish the same card at both paths. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: MCP SEP-2127; Cloudflare Agent Readiness Score (https://isitagentready.com/). - [ ] **5.38 Agent Skills index (v0.2.0) at /.well-known/agent-skills/index.json** - Pass: An index JSON whose skills property is an array is served (or the site is not an agent target). - Warn: An agent target has no index (Mega Analyzer); Mega SEO Analyzer impact 1 recommendation; Agent-Ready Audit scores absence as a fail. - Fail: An entry's sha256 digest does not match the SKILL.md it names, or was hand-computed (Mega Analyzer fix rule). - Numbers and lists the tool uses: paths /.well-known/agent-skills/index.json, legacy /.well-known/skills/index.json; each entry needs name, type, description, url and an optional sha256 that must match the file, computed at build time. - Why: The index lists SKILL.md files describing what an agent can do with your site. - Fix: Publish /.well-known/agent-skills/index.json per the v0.2.0 RFC with name, type, description and url per skill and build-time sha256 digests. - Verify: [Agent Ready Audit](https://jwatte.com/tools/agent-ready-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: Agent Skills Discovery RFC v0.2.0; Cloudflare Agent Readiness Score (https://isitagentready.com/). - [ ] **5.39 ARD manifest (AI catalog) at /.well-known/ard.json or /.well-known/ai-catalog.json** - Pass: A catalog is found the way Lighthouse finds it and parses as a JSON object (or the site is not an agent target and serves nothing there). - Warn: An agent target without a catalog; a file that is not a JSON object; a site that answers either address with a web page (HTTP 200), which Lighthouse reads as a broken catalog and scores 0 even on a site with no catalog. - Info: The fetch was blocked or did not answer, so nothing is concluded. - Numbers and lists the tool uses: Lighthouse 13.5.0 reads the first of robots.txt Agentmap, `<link rel="ai-catalog">`, Link rel="ai-catalog", /.well-known/ai-catalog.json; Lighthouse next (ARD v0.91) tries Agentmap, rel="ard" (tag, then header), /.well-known/ard.json, then the older names. - Why: ARD v0.91 readers must check /.well-known/ard.json and may skip the older path, while Lighthouse 13.5.0 still reads the older path. - Fix: Publish one file at /.well-known/ard.json and the same bytes at /.well-known/ai-catalog.json, as application/json with Access-Control-Allow-Origin: *. Make every /.well-known/ address you do not publish answer 404. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Agent Endpoint Inspector](https://jwatte.com/tools/agent-endpoint-inspector/). Standard: Agentic Resource Discovery (ARD) v0.91, https://agenticresourcediscovery.org/spec/ (read October 13, 2026). - [ ] **5.40 ARD manifest passes Lighthouse's ard-schema audit (13.5 and next)** - Pass: Score 1 with no issues under both Lighthouse 13.5.0 (the current release) and Lighthouse next (ARD v0.91). The tools run Lighthouse's own validator code for both and report two rows. - Warn: Any error (score 0) or warning (score 0.9). Each issue is explained in plain words with Lighthouse's own message under it. - Numbers and lists the tool uses: Lighthouse 13.5.0: top level only specVersion ("1.0"), host and entries; host only displayName (required), identifier, documentationUrl, logoUrl, trustManifest (a host.url or host.description scores 0); entry identifier /^urn:air:[a-zA-Z0-9.-]+(:[a-zA-Z0-9._-]+)+$/, displayName, type, exactly one of url or data, url as a full URI, updatedAt as a date-time, metadata values flat; a warning for any type outside application/ai-catalog+json, application/agent-card+json, application/a2a-agent-card+json, application/mcp-server-card+json, application/agent-skills+zip, application/agent-skills+gzip, text/markdown; profile="urn:air:agent-skills", application/ai-registry, application/ai-registry+json; representativeQueries 2 to 5. Lighthouse next: root and host open, application/* extension types information only, text/plain, text/html and a bare text/markdown still warnings, found only at the older address is a warning. - Why: One extra field in host fails the whole audit, and an entry without representative queries is not found by ARD search. - Fix: Keep host to its allowed fields; list only agent resources as entries (MCP server card, A2A agent card, one entry per SKILL.md) and keep other files (llms.txt, AGENTS.md, sitemaps, data) as flat URLs in an entry's metadata and in /.well-known/api-catalog; give every entry 2 to 5 real questions. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Agent Endpoint Inspector](https://jwatte.com/tools/agent-endpoint-inspector/). Standard: ARD v0.91 sections 3.3, 4 and 5.1; Lighthouse 13.5.0 (npm) ard-schema audit, Agentic Browsing category. - [ ] **5.41 ARD manifest discoverable by more than one route** - Pass: At least 2 of these exist: a catalog at a well-known path, a robots.txt Agentmap line, a `<link rel="ard">` (or rel="ai-catalog") in the head, a Link header with rel="ard" (or rel="ai-catalog"). - Warn: Fewer than 2 routes. - Numbers and lists the tool uses: Agentmap /^\s*Agentmap:\s*(\S+)/im; rel values ard and ai-catalog in a `<link>` tag or the Link header; threshold 2. - Why: Header readers, robots.txt readers and head readers are different clients. - Fix: Add 'Agentmap: https://`<domain>`/.well-known/ard.json' to robots.txt, `<link rel="ard" href="/.well-known/ard.json">` to the head and `</.well-known/ard.json>; rel="ard"` to the Link header (ARD v0.91 section 5.1). - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: ARD v0.91 section 5.1. - [ ] **5.42 auth.md served at site root with a conforming H1** - Pass: /auth.md is served and its H1 contains 'auth.md'. - Warn: Missing, or the H1 lacks the literal 'auth.md' (a heading like '# Authentication' is not recognised). - Numbers and lists the tool uses: H1 /^#\s+(.+)$/m must match /auth\.md/i; Cloudflare's scorer passes auth.md only when /.well-known/oauth-protected-resource also exists (their rule), which the tools reproduce but do not endorse for sites with no authorization server. - Why: The literal H1 is how a scanner tells a real auth.md from other Markdown, and an honest auth.md tells agents whether any auth is required at all. - Fix: Publish /auth.md headed '# auth.md for yourdomain.com' and state 'no auth required' explicitly when that is the case; do not invent OAuth metadata for an authorization server that does not exist. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: OAuth Protected Resource Metadata; MCP; Cloudflare Agent Readiness Score (https://isitagentready.com/). - [ ] **5.43 OAuth / OIDC discovery (RFC 8414)** - Pass: /.well-known/oauth-authorization-server or /.well-known/openid-configuration returns 200. - Warn: Agent-Ready Audit fails when neither path returns 200; Mega SEO Analyzer adds an impact 1 recommendation whenever /.well-known/oauth-authorization-server is absent (it does not probe openid-configuration). - Numbers and lists the tool uses: paths /.well-known/oauth-authorization-server, /.well-known/openid-configuration (Agent-Ready Audit passes on either; Mega SEO Analyzer probes only /.well-known/oauth-authorization-server). - Why: Agents need issuer and endpoint metadata to authenticate against protected APIs; it is intentionally absent on read-only public sites. - Fix: If you have protected APIs, publish issuer and endpoints per RFC 8414; a read-only site can leave this absent and should not fake it. - Verify: [Agent Ready Audit](https://jwatte.com/tools/agent-ready-audit/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: RFC 8414; OpenID Connect Discovery; Cloudflare Agent Readiness Score (https://isitagentready.com/). - [ ] **5.44 OAuth Protected Resource (RFC 9728)** - Pass: /.well-known/oauth-protected-resource returns 200. - Warn: Not served (Mega SEO Analyzer impact 1 recommendation; Agent-Ready Audit scores it as a fail). - Numbers and lists the tool uses: path /.well-known/oauth-protected-resource. - Why: Tells agents which authorization server issues tokens for this resource. - Fix: Required only for protected APIs; publish it when you have one, and leave it absent (a real 404 is correct) on a read-only site. - Verify: [Agent Ready Audit](https://jwatte.com/tools/agent-ready-audit/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: RFC 9728; Cloudflare Agent Readiness Score (https://isitagentready.com/). - [ ] **5.45 DNS-based agent discovery record published** - Pass: The zone publishes an SVCB record at _entries._agents or _search._agents (ARD v0.91), a real _index._agents SVCB record (DNS-AID), or a _catalog._agents TXT record with url=https://`<domain>`/... (an early ARD draft form, still accepted and labeled as such), or the site is not an agent target. - Warn: An agent target has neither record; a wildcard zone that answers a random control name is called out because it gives scanners a false pass; TXT present without SVCB is noted. - Numbers and lists the tool uses: TXT at _catalog._agents.`<domain>` matching /url\s*=\s*https?:\/\//i; SVCB or HTTPS records at _entries._agents, _search._agents, _index._agents, _a2a._agents and _mcp._agents under `<domain>`; DNSSEC = DNSKEY records > 0; every *.netlify.app answers '1 . alpn=h2' at _index._agents so control matches are discarded; Cloudflare's scored value is the SVCB half. - Why: DNS lets agents find your catalog before touching the web server, but several managed DNS providers support neither SVCB nor DNSSEC. - Fix: Where your DNS host supports SVCB, publish one at _entries._agents.`<domain>` pointing at the catalog (ARD v0.91 section 5.1) and sign the zone; otherwise treat DNS as unreachable, since it is optional and Lighthouse does not check it. No ARD version defines a TXT format; an existing _catalog._agents TXT record does no harm and should point at /.well-known/ard.json. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: ARD v0.91 section 5.1; DNS-AID draft; Cloudflare Agent Readiness Score (https://isitagentready.com/). - [ ] **5.46 AGENTS.md (root), Agentic AI Foundation spec** - Pass: /AGENTS.md is served, or the site has no developer surface. - Warn: A site with a developer surface has none (Mega Analyzer; platform-limited sites get info); Mega SEO Analyzer impact 1 recommendation. - Numbers and lists the tool uses: path /AGENTS.md; developer surface = agent target, or an api-catalog, or links /\/(docs|developer|api[\-_]?docs|reference)\b/i, and not a local-service schema site, and not an editorial site whose primary type is /^(NewsArticle|BlogPosting|Article|Newsletter|TechArticle|ScholarlyArticle|Periodical|Blog|CollectionPage|ItemList|WebPage)$/ unless SoftwareApplication, WebApplication, APIReference or WebAPI is also declared. - Why: Read by 35+ AI coding tools (Cursor, Claude Code, Codex, Copilot, Gemini CLI) for setup, conventions and test commands. - Fix: Publish /AGENTS.md with ## Setup, ## Test, ## Conventions and ## Gotchas; skip it if your site has no developer or repo surface (generator at /tools/claude-md-generator/). - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: https://agents.md/. - [ ] **5.47 Root /index.md marker present** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: path /index.md; counts as present on status 200 with a /markdown/i Content-Type or /^#\s/m in the first 500 chars; rendered only when present. - Why: Agents fetch Markdown shortcuts before crawling the site map (the Joost.blog pattern of sibling .md files). - Fix: Publish /index.md as a Markdown twin of the home page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **5.48 llms-ctx.txt (FastHTML llmstxt.org extension)** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: path /llms-ctx.txt; Mega Analyzer checks only docs-like sites (llms-full.txt present, or more than 5 Markdown alternate links, or more than 8000 words, or schema /TechArticle|APIReference|HowTo|LearningResource/); Mega SEO Analyzer impact 1 recommendation when absent. - Why: An XML-tagged reading list that wraps your linked .md pages so a docs or knowledge-base site can be loaded into one prompt. - Fix: Publish /llms-ctx.txt wrapping the linked .md pages in `<doc>` tags (generator at /tools/llms-txt-generator/). - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: llmstxt.org (FastHTML extension). - [ ] **5.49 llms-ctx-full.txt (FastHTML llmstxt.org extension)** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: path /llms-ctx-full.txt; same docs-site gate as llms-ctx.txt. - Why: The full-corpus XML-tagged variant of llms-ctx.txt. - Fix: Publish /llms-ctx-full.txt alongside llms-ctx.txt on docs sites. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: llmstxt.org (FastHTML extension). - [ ] **5.50 JSON Feed v1.1 fields (language, authors[], feed_url)** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: checked only when feed.json exists; version must match /1\.1/ and at least one of authors[] non-empty, language or feed_url must be present; parse errors reported as info. - Why: Author and locale fields give AI retrievers attribution and language signals. - Fix: Set version to https://jsonfeed.org/version/1.1 and add language, authors and feed_url. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: JSON Feed 1.1. - [ ] **5.51 Web Bot Auth signature directory (informational)** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: path /.well-known/http-message-signatures-directory returns 200; neutral in the Agent Readiness Score (Cloudflare treats it as neutral) and unscored in Agent-Ready Audit (pass when 200, info otherwise); Mega Analyzer adds a passing row only when the directory is present and never a failing one; Mega SEO Analyzer impact 1 recommendation when absent. - Why: Public keys for cryptographically signed bot identities; relevant only if you operate friendly bots, and honestly absent on a read-only content site. - Fix: No fix needed on a content site; publish the directory only if you run bots whose identity others should verify. - Verify: [Agent Ready Audit](https://jwatte.com/tools/agent-ready-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: IETF Web Bot Auth / HTTP Message Signatures draft; Cloudflare Agent Readiness Score (https://isitagentready.com/). - [ ] **5.52 `<n>` bot(s) use the "allow crawl, deny training" pattern, this is intentional and not a conflict** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: a bot counts when robots.txt resolves to allow and ai.txt resolves to disallow (bot-specific ai.txt group, else the ai.txt '*' group); up to 10 bots listed; generator presets: open-web all crawl=allow train=allow, closed all disallow, aeo-friendly per bot (crawl/train): GPTBot allow/disallow, OAI-SearchBot allow/allow, ChatGPT-User allow/allow, ClaudeBot allow/disallow, Claude-Web allow/allow, anthropic-ai allow/disallow, Google-Extended allow/disallow, PerplexityBot allow/allow, Meta-ExternalAgent allow/disallow, Applebot-Extended allow/disallow, Bytespider disallow/disallow, Amazonbot allow/disallow, CCBot allow/disallow, cohere-ai allow/disallow, YouBot allow/allow, DuckAssistBot allow/allow, MistralAI-User allow/allow, Diffbot allow/disallow, Timpibot allow/allow, others crawl=allow train=disallow; AI Posture Audit aeo-friendly preset: crawl=disallow only for Bytespider, train=disallow for GPTBot, anthropic-ai, Google-Extended, Applebot-Extended, Meta-ExternalAgent, CCBot, cohere-ai, Amazonbot, Bytespider; intent labels: allow/disallow = 'AEO-friendly, train-hostile', allow/allow = 'Fully open', disallow/disallow = 'Fully closed', disallow/allow = 'Train-allowed but crawl-denied (unusual)'. - Why: Robots.txt governs crawling and ai.txt governs training, so letting a bot fetch pages for answers while refusing training use is the intended AEO-friendly posture, not a misconfiguration; only 'train allowed but crawl denied' is odd because a bot cannot train on pages it cannot crawl. - Fix: No change needed for the allow-crawl, deny-train pattern; re-check any bot labelled unusual. - Verify: [AI Posture Audit](https://jwatte.com/tools/ai-posture-audit/). - [ ] **5.53 Agent Readiness Score** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: reproduces Cloudflare's score: category score = round(passed / (passed + failed) * 100) with neutral rows excluded, overall = round(totalPassed / totalCounted * 100), null when nothing is counted (Agent-Ready Audit reports 0); Mega Analyzer card: 80+ good, 50 to 79 ok, under 50 bad; Agent-Ready Audit levels over 12 scored probes: 80+ Level 5 Agent-Native, 60+ Level 4 Agent-Friendly, 40+ Level 3 Agent-Aware, 20+ Level 2 Discoverable, under 20 Level 1 Basic Web Presence, category pill pass when passed equals total, fail when passed is 0; categories: Discoverability (robots.txt, sitemap.xml, Link header, DNS-AID SVCB), Content (Markdown negotiation), Bot Access Control (AI bot rules, Content-Signal, Web Bot Auth neutral), API / Auth / MCP / Skills (API Catalog, OAuth discovery, OAuth Protected Resource, auth.md plus PRM, MCP Server Card, A2A Agent Card, Agent Skills, WebMCP, ARD manifest), Commerce (x402, MPP, UCP, ACP, AP2 derived from the A2A card) dropped entirely off a commerce surface; Web Bot Auth and the 4 commerce protocols are never counted by Agent-Ready Audit; informational rows are not counted (Agent-Ready Audit rows added with scored=false; Mega Analyzer info-severity rows map to neutral); measured example 7 of 15 = 47; fix-prompt keys: ard_catalog_present, ard_catalog_conformance, ard_alternate_discovery, auth_md_present, content_signal_group_coverage, dns_agent_discovery, dns_aid_dnssec, api_catalog_present, mcp_server_card_present, agent_skills_index_present, content_signal_declared, link_response_header, mcp_card_dual_path, webmcp_capability_declared. - Why: The score explains why a client's site 'says 47' on isitagentready.com and makes disagreements between checkers visible. - Fix: Raise the passing rows in each category using the per-row fixes above, following two rules: never publish a manifest that points at something that 404s (no MCP card without an MCP server, no OAuth metadata when nothing is protected, an honest auth.md), and generate every discovery file from one source of truth at build time; re-run /tools/agent-ready-audit/?url=`<url>`&autorun=1 to confirm. - Verify: [Agent Ready Audit](https://jwatte.com/tools/agent-ready-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: Cloudflare Agent Readiness Score (https://isitagentready.com/). - [ ] **5.54 Meta-WebIndexer allowed by robots.txt (Meta AI citations)** - Pass: robots.txt allows the meta-webindexer token at the page path and at /, through its own group or the * group. - Fail: Either path is disallowed, or robots.txt answers a 5xx or no response, which RFC 9309 treats as complete disallow. - Numbers and lists the tool uses: the RFC 9309 parser shared at /js/rfc9309-robots.js: a group starts at a User-agent line and runs across blank lines, comments and other records until a User-agent line that follows a rule; the product token is the leading run of letters, underscores and hyphens, matched case-insensitively; every group naming the token is combined, else every * group; the longest match in octets wins and Allow wins a tie; * matches any run of characters and a trailing $ anchors; an empty Disallow is no rule; /robots.txt is always allowed; a 4xx robots.txt means allow-all. - Why: Meta says allowing Meta-WebIndexer "helps us cite and link to your content in Meta AI's responses". It is the one documented lever for Meta AI citations. Blocking Meta-ExternalAgent (training) is a separate decision and does not need it. - Fix: Allow meta-webindexer on the pages you want cited. If it has its own group, remove the blocking Disallow there; if it falls to *, narrow the * rule. - Verify: [Meta AI Crawler + Link Preview Audit](https://jwatte.com/tools/meta-ai-crawler-audit/). Standard: RFC 9309 (https://www.rfc-editor.org/rfc/rfc9309); Meta Web Crawlers, Updated May 21, 2026 (https://developers.facebook.com/docs/sharing/webmasters/web-crawlers/). - [ ] **5.55 facebookexternalhit allowed by robots.txt at this path (link previews)** - Pass: facebookexternalhit is allowed at the page path. - Warn: It is disallowed, so link previews on Facebook, Instagram and Messenger will be blank. - Numbers and lists the tool uses: the parser from the check above; a table beside it gives, for facebookexternalhit, meta-webindexer, meta-externalagent, meta-externalfetcher and meta-externalads, the group each obeys, the verdict with the deciding rule, and any Content-Signal line in that group (informational: a contentsignals.org convention Meta does not document reading); Meta-ExternalFetcher disallowed is informational because Meta says it "may bypass robots.txt rules"; FacebookBot and facebookcatalog groups are reported as legacy and harmless. - Why: facebookexternalhit builds the title, description and image of every shared link, and Meta's crawler page names a robots.txt Disallow as the way to block its crawlers. - Fix: Allow facebookexternalhit on every page people share. - Verify: [Meta AI Crawler + Link Preview Audit](https://jwatte.com/tools/meta-ai-crawler-audit/). Standard: RFC 9309; Meta Web Crawlers, Updated May 21, 2026 (https://developers.facebook.com/docs/sharing/webmasters/web-crawlers/). - [ ] **5.56 Named Meta groups keep the * Disallow rules** - Pass: The * group has no Disallow lines, or every group naming a Meta token also blocks each path the * group disallows. - Warn: A group naming facebookexternalhit, meta-webindexer, meta-externalagent, meta-externalfetcher or meta-externalads can fetch a path the * group disallows. Named groups for other crawlers with the same gap are listed as informational. - Numbers and lists the tool uses: each * Disallow pattern becomes a sample path (* turns into x and a trailing $ is dropped), is confirmed blocked for *, then is tested through the parser for the named token. - Why: A crawler obeys only the group that names it (RFC 9309 section 2.2.1), so a named group with Allow: / quietly reopens /admin/, /thank-you/ and everything else the * group closed. - Fix: Repeat every * Disallow line inside each named group, or delete a named group that only says Allow: /. - Verify: [Meta AI Crawler + Link Preview Audit](https://jwatte.com/tools/meta-ai-crawler-audit/). Standard: RFC 9309 section 2.2.1. - [ ] **5.57 No robots.txt rules stranded below a named group** - Pass: No Allow or Disallow line sits below a blank line or a comment inside a named group. - Warn: One or more rules below a blank line or comment bind to the named group above them; the tool gives the line numbers and the group. The same layout inside the * group is informational, because those rules still bind to *. - Numbers and lists the tool uses: a rule is stranded when its group already has rules and a blank or comment-only line comes between; every later rule of that group belongs to the same stranded run until the next User-agent line. - Why: Blank lines and comments do not end a group; only a User-agent line does. A Disallow meant for everyone, written below the last named group, applies to that one crawler. - Fix: Move rules meant for everyone under User-agent: * and repeat them in each named group. - Verify: [Meta AI Crawler + Link Preview Audit](https://jwatte.com/tools/meta-ai-crawler-audit/). Standard: RFC 9309. - [ ] **5.58 robots.txt answers 200 or 4xx, as text, under 500 KiB** - Pass: robots.txt answers 200 with a text file. - Warn: A 5xx from the site (crawlers must then assume complete disallow), an HTML page in place of a text file, or a file over 512,000 bytes (500 KiB). No answer to the audit's own request is informational ("not verified"), because it says nothing about what Meta's crawlers get. - Numbers and lists the tool uses: a 4xx is informational (allow-all); HTML is detected from a text/html Content-Type or a body that starts with a doctype or an html tag. - Why: RFC 9309 says a crawler "MUST assume complete disallow" when robots.txt is unreachable because of server or network errors, and requires crawlers to parse at least the first 500 KiB, so rules past that point may be ignored. - Fix: Serve /robots.txt as text/plain with a 200, or a 404 if you want no rules at all. - Verify: [Meta AI Crawler + Link Preview Audit](https://jwatte.com/tools/meta-ai-crawler-audit/). Standard: RFC 9309. - [ ] **5.59 Meta's crawlers and WhatsApp get the page (no 403, 429, 503 or challenge)** - Pass: facebookexternalhit, Meta-WebIndexer and WhatsApp get the page. - Warn: A bare 429 with no vendor challenge header (often the audit's own burst of requests; re-run), any other non-2xx status for facebookexternalhit, Meta-WebIndexer or WhatsApp (named with its status), or Meta-ExternalAgent blocked at the HTTP layer while robots.txt allows it. A user agent the audit could not reach is reported as not verified, never as a pass or a failure. - Fail: facebookexternalhit, Meta-WebIndexer or WhatsApp gets a 403 or 503, a cf-mitigated or x-amzn-waf-action header, or a page titled "Just a moment" or "Attention Required". - Numbers and lists the tool uses: user agents sent: facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php), meta-webindexer/1.1, meta-externalagent/1.1, meta-externalfetcher/1.1, meta-externalads/1.1, WhatsApp/2.22.20.72 A and a stock Chrome 153 on Linux baseline; the comparison with the baseline (title, og:title, og:image, final URL, body within 10%) is labelled INFERRED and the data-center Chrome row REPORTED, and neither is scored. - Why: A firewall rule or bot-fight mode that challenges these user agents blanks every preview and shuts out the crawler Meta names for Meta AI citations, whatever robots.txt says. - Fix: Let the tokens through the CDN or WAF, matching each as a case-insensitive substring of the User-Agent. Do not build IP allowlists: Meta's crawler page no longer explains how to verify its IP addresses; that section is gone from the May 21, 2026 revision. - Verify: [Meta AI Crawler + Link Preview Audit](https://jwatte.com/tools/meta-ai-crawler-audit/). Standard: Meta Web Crawlers, Updated May 21, 2026 (https://developers.facebook.com/docs/sharing/webmasters/web-crawlers/); WhatsApp link previews. ## 6. Local: the Business Profile, the map pin and the directories For a business with a door, the map pin outranks the homepage. This section is the Google Business Profile, name-address-phone consistency across every directory that lists you, the map listing itself, and Apple's equivalent. **Verify this section with:** [Schema Validator](https://jwatte.com/tools/schema-validator/), [Rich Results Eligibility Audit](https://jwatte.com/tools/rich-results-eligibility-audit/), [GBP + Review Signal Audit](https://jwatte.com/tools/gbp-review-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [Trust Signal Surface](https://jwatte.com/tools/trust-signal-surface-audit/), [About-Page Conversion Audit](https://jwatte.com/tools/about-page-conversion-audit/), [Mega GEO Analyzer](https://jwatte.com/tools/mega-geo-analyzer/), [Site Analyzer](https://jwatte.com/tools/analyzer/), [E-E-A-T Generator](https://jwatte.com/tools/eeat-generator/), [Google Maps](https://jwatte.com/tools/google-maps-audit/), [Local Directories](https://jwatte.com/tools/local-directories/), [NAP Consistency](https://jwatte.com/tools/nap-consistency/), [Apple Business](https://jwatte.com/tools/apple-business-audit/), [SERP Features](https://jwatte.com/tools/serp-features/). - [ ] **6.1 LocalBusiness: all required fields present (name, address, telephone)** - Pass: A LocalBusiness node (or a local subtype) carries name, address and telephone, and the name is 2 to 80 characters. - Warn: Schema Validator warns when a recommended field (telephone, openingHours, geo or image) is missing, except that openingHoursSpecification on a local-business subtype satisfies the openingHours recommendation; GBP Review Audit warns when the JSON-LD has no name field. - Fail: Schema Validator fails a node missing name or address; the Rich Results audit fails a node typed exactly LocalBusiness that is missing any of name, address or telephone. - Numbers and lists the tool uses: Required name, address; recommended telephone, openingHours, geo, image, with the openingHours warning suppressed when openingHoursSpecification is set and @type matches /^(LocalBusiness|SelfStorage(?:Facility)?|LodgingBusiness|Hotel|MedicalBusiness|ProfessionalService|HomeAndConstructionBusiness|RealEstateAgent|AutomotiveBusiness|MovingCompany|TravelAgency|FoodEstablishment|HealthAndBeautyBusiness|Plumber|Electrician|HVACBusiness|RoofingContractor|InsuranceAgency|FinancialService|LegalService|Dentist|Physician|Restaurant)$/ (Schema Validator); required name, address, telephone and recommended image, openingHoursSpecification, priceRange, geo, applied only to nodes typed exactly LocalBusiness, subtypes such as Restaurant or Dentist do not match (Rich Results Eligibility Audit); name regex /"name"\s*:\s*"([^"\\]{2,80})"/i, 2 to 80 characters with no double quotes or backslashes inside (GBP Review Audit); the Schema Fix Bundle LocalBusiness preset emits @id `<origin>`#localbusiness, name, image, PostalAddress (streetAddress, addressLocality, addressRegion, postalCode, addressCountry US), telephone, email, url, openingHoursSpecification Monday to Friday 09:00 to 17:00, geo GeoCoordinates, priceRange $$, aggregateRating and sameAs placeholders for Google Maps, Yelp and Facebook, with the required label name, address, telephone, openingHours, geo (optional). - Why: Local rich results and the map pack read your business name, address and phone from this node, and the name must match your Google Business Profile exactly, including punctuation, Inc or LLC, and capitalization. - Fix: Add one LocalBusiness node (or the right subtype) with name, PostalAddress and telephone, then add image, openingHoursSpecification, priceRange and geo when they are true. Where you declare openingHoursSpecification you may also add a short openingHours string such as Mo-Su 08:00-20:00, since both forms are valid and complementary. - Verify: [Schema Validator](https://jwatte.com/tools/schema-validator/), [Rich Results Eligibility Audit](https://jwatte.com/tools/rich-results-eligibility-audit/), [GBP + Review Signal Audit](https://jwatte.com/tools/gbp-review-audit/). Standard: Google Local Business structured data; schema.org LocalBusiness. - [ ] **6.2 Contact: tel/mailto links and visible phone number** - Pass: The page has a clickable tel: link and the phone number spelled out as plain text (the footer counts); the Mega Analyzer also looks for a mailto: link. - Warn: Mega SEO Analyzer warns when neither a tel: link nor a phone pattern is found; GBP Review Audit warns when the phone exists only inside a tel: link or schema and is not spelled out in body text; on pages that are not local-like the Mega Analyzer reports a missing signal as informational. - Fail: Mega Analyzer fails a local-like page (a local-business schema type or a Local- or YMYL- vertical) that lacks the signal; Trust Signal Surface Audit fails when the /contact page has no phone pattern. - Numbers and lists the tool uses: Mega Analyzer: a[href^=tel:], a[href^=mailto:], phone regex /($\d{3}$\s*\d{3}[- .]?\d{4}|\b\d{3}[- .]?\d{3}[- .]?\d{4}\b|\+\d{1,3}[ -]?\d{3}[ -]?\d{3}[ -]?\d{4})/ on body plus footer text; Mega SEO Analyzer regex /tel:\+?\d|[$\[]?\d{3}[$\]]?[\s\-\.]?\d{3}[\s\-\.]?\d{4}/i on the HTML; GBP Review Audit body regex /\b(?:$?\d{3}$?[\s.\-]?\d{3}[\s.\-]?\d{4})\b/ on body text, counted only when the tel: or schema phone check already passed; Trust Signal Surface Audit regex /(\+?\d[\d\s().-]{7,}\d)/ on the /contact page. - Why: Maps, voice assistants and Google Business Profile verification read the phone from visible page text, and a tap-to-call link is how mobile visitors reach you. - Fix: Put the phone number in plain text in the footer and on the contact page, wrap it in an a href="tel:+1..." link, and add a mailto: link for email. - Verify: [GBP + Review Signal Audit](https://jwatte.com/tools/gbp-review-audit/), [Trust Signal Surface](https://jwatte.com/tools/trust-signal-surface-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). - [ ] **6.3 Contact: visible physical address** - Pass: A full street address (or a PO box) appears as plain text on the page, or PostalAddress JSON-LD carries streetAddress, postalCode or addressLocality. - Warn: Trust Signal Surface Audit warns when neither the homepage nor the audited page body shows a street address or PO box; Mega SEO Analyzer and About Page Conversion Audit report a missing address signal as informational. - Fail: Mega Analyzer fails a local-like page without an address; Trust Signal Surface Audit fails when the /contact page has no street address or PO box. - Numbers and lists the tool uses: Mega Analyzer: addrFull /\b\d{1,5}\s+[A-Z][a-zA-Z.]+(?:\s+[A-Z][a-zA-Z.]+)*,?\s+[A-Z][a-zA-Z.\s]+,\s*[A-Z]{2}\s+\d{5}/, or streetLine /\b\d{1,5}\s+[A-Z][a-zA-Z.']{2,30}(?:\s+[A-Z][a-zA-Z.']{2,30})*\s+(Street|St\.?|Avenue|Ave\.?|Boulevard|Blvd\.?|Road|Rd\.?|Drive|Dr\.?|Lane|Ln\.?|Way|Highway|Hwy\.?|Parkway|Pkwy\.?|Court|Ct\.?|Place|Pl\.?|Circle|Cir\.?|Terrace|Ter\.?|Trail|Trl\.?|Square|Sq\.?)\b/i plus a ZIP /\b\d{5}(?:-\d{4})?\b/ nearby or a state name (the 50 US states plus D.C., Ontario, Quebec, British Columbia, Alberta), or PostalAddress JSON-LD; Mega SEO Analyzer /\b(street|ave|avenue|blvd|road|drive|lane|highway)\b|<address/i; Trust Signal Surface Audit on the /contact page /\b\d{1,5}\s+[A-Z][a-z]+\s+(St|Ave|Blvd|Rd|Way|Lane|Dr|Ct|Pl)\b|PO\s*Box\s+\d+/ and on home plus page body ADDR_RE /\b\d{1,5}\s+[A-Z][a-zA-Z.]+(?:\s+[A-Z][a-zA-Z.]+)*\s+(Street|St|Avenue|Ave|Boulevard|Blvd|Road|Rd|Way|Lane|Ln|Drive|Dr|Court|Ct|Place|Pl|Parkway|Pkwy|Highway|Hwy|Terrace|Ter|Circle|Cir)\b\.?/ or /PO\s*Box\s+\d+/i; About Page Conversion Audit /\b\d{1,5}\s+[\w\s]+(street|st\.|avenue|ave\.|blvd|road|rd\.|drive|dr\.|way|lane|ln\.),/i or ZIP /\b\d{5}(-\d{4})?\b/. - Why: Google Maps and Apple Maps parse the address from plain text, and a consistent visible address is a core local ranking and trust signal. - Fix: Print the full street address (street, city, state, ZIP) in the footer and on the contact page inside an address element, and mirror it in PostalAddress inside your LocalBusiness JSON-LD. - Verify: [Trust Signal Surface](https://jwatte.com/tools/trust-signal-surface-audit/), [About-Page Conversion Audit](https://jwatte.com/tools/about-page-conversion-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: schema.org PostalAddress. - [ ] **6.4 Contact: visible business hours** - Pass: Hours appear as plain text: day-prefixed ranges, a time range, 24/7 wording or "by appointment" (Mega Analyzer), or a day range plus time range or an always-open phrase (Trust Signal Surface Audit). - Warn: Trust Signal Surface Audit warns when no hours pattern is found in the home and page body; on pages that are not local-like the Mega Analyzer reports the gap as informational. - Fail: Mega Analyzer fails a local-like page with no visible hours. - Numbers and lists the tool uses: Mega Analyzer: hoursDayPrefix /\b(mon|monday|tue|tuesday|wed|wednesday|thu|thursday|fri|friday|sat|saturday|sun|sunday|weekdays|weekends)\b[^.<]{0,30}\d{1,2}(:\d{2})?\s?(am|pm)?\s?[-`<en dash>`to]{1,3}\s?\d{1,2}(:\d{2})?\s?(am|pm)?/i, hoursNoDay /\b\d{1,2}(:\d{2})?\s?(am|pm)\s?(?:to|-|`<en dash>`|)\s?\d{1,2}(:\d{2})?\s?(am|pm)\b/i, hoursAlways /\b(24\s?\/?\s?7|24\s?hours|open\s+(all\s+)?(day|night|24|7\s+days))/i, hoursByAppt /\bby\s+appointment(\s+only)?\b/i, or openingHours / openingHoursSpecification anywhere in the HTML; Trust Signal Surface Audit: DAY (?:Mon|Tue|Tues|Wed|Thu|Thur|Thurs|Fri|Sat|Sun|Monday|Tuesday|Wednesday|Thursday|Friday|Saturday|Sunday), TIME \d{1,2}(?::\d{2})?\s*(?:am|pm|AM|PM), hoursRe DAY(?:\s*[`<en dash>`\-to]+\s*DAY)?\s*[:\-`<en dash>`]?\s*TIME\s*[`<en dash>`\-to]+\s*TIME, hoursAlways as above. - Why: Hours in body text feed Google Business Profile and voice questions like "are they open now", and "by appointment only" is a legitimate model that counts. - Fix: Render hours in body text, for example "Mon to Fri 9am to 5pm" or "By appointment only", and add openingHoursSpecification in schema. - Verify: [Trust Signal Surface](https://jwatte.com/tools/trust-signal-surface-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org OpeningHoursSpecification. - [ ] **6.5 NAP consistency** - Pass: Score 80 or more: at least one real phone number and one street address on the page, plus either a business-name marker or one phone number repeated consistently. - Warn: Score 60 to 79, for example phones and addresses found but no name marker and no repeated phone. - Fail: Score under 60. - Numbers and lists the tool uses: phone regex /$\d{3}$\s?\d{3}-\d{4}|\b\d{3}-\d{3}-\d{4}\b/g, dropping any match of the placeholder regex /555[- .]?01\d{2}|^$?(\d)\1{2}$?[- .]?\1{3}[- .]?\1{4}$|123[- .]?456[- .]?7890/; email regex /[a-z0-9._-]+@[a-z0-9.-]+\.[a-z]{2,}/gi dropping /example\.(com|org|net)$|yourdomain|yoursite|email@/i (emails are counted in the detail only and do not score); address regex /\b\d{1,5}\s+[A-Z][a-zA-Z]+\s+(St|Ave|Rd|Blvd|Dr|Ln|Way|Ct|Pl)\b/g; name regex /\borganizationname|companyname|"name":\s*"/i; +30 if any phone, +30 if any address, +20 if name marker, +20 if every phone found is the same number and there is more than one, capped at 100; pass 80 or more, warn 60 to 79, fail under 60. - Why: Name, address and phone shown the same way on every page is the first thing local search checks against your listings. - Fix: Display name, address and phone prominently in the footer and on the contact page, and use one phone and address format on every page. - Verify: [Mega GEO Analyzer](https://jwatte.com/tools/mega-geo-analyzer/). - [ ] **6.6 Phone number in tel: link + schema** - Pass: The business node (LocalBusiness or Organization) has a telephone field; GBP Review Audit also accepts an a[href^="tel:"] link on the page. - Warn: Schema Validator warns when a LocalBusiness node lacks the recommended telephone. - Fail: Rich Results audit fails a node typed exactly LocalBusiness without telephone; Mega Analyzer fails when a LocalBusiness or Organization node exists without telephone on laundromat, self-storage, car wash, HVAC, electrician, handyman and hotel sites. - Numbers and lists the tool uses: Mega Analyzer regex /"telephone"\s*:/i inside a LocalBusiness or Organization node; HVAC sites expect E.164 format; GBP Review Audit /"telephone"/i on the JSON-LD text or selector a[href^="tel:"]. - Why: Click-to-call in the map pack and mobile listing clicks come from this field, and a missing phone is the biggest friction point for mobile visitors. - Fix: Add telephone in E.164 form (+1XXXXXXXXXX) to the business node and keep a visible tel: link on the page. - Verify: [GBP + Review Signal Audit](https://jwatte.com/tools/gbp-review-audit/), [Schema Validator](https://jwatte.com/tools/schema-validator/), [Rich Results Eligibility Audit](https://jwatte.com/tools/rich-results-eligibility-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org telephone. - [ ] **6.7 Street address in schema** - Pass: The business JSON-LD has a PostalAddress with streetAddress. - Fail: Mega Analyzer fails on home, contact, location, office or facility pages of its gated verticals; men's health clinic location pages also fail when streetAddress or addressLocality is an empty string; HVAC, electrician and handyman nodes fail only when neither PostalAddress nor areaServed is present. - Numbers and lists the tool uses: GBP Review Audit /"address"\s*:\s*\{[^}]*"streetAddress"/i; Mega Analyzer /"PostalAddress"/i on legal and CPA office pages and home-inspection contact pages, /"PostalAddress"|"streetAddress"/i on laundromat and self-storage home, contact, location or facility pages, car wash home or contact pages, hotel nodes and butcher storefront nodes; HVAC, electrician and handyman fail condition !hasPostal && !hasAreaServed; clinic emptyAddress /"streetAddress"\s*:\s*""/ or /"addressLocality"\s*:\s*""/; required by the Rich Results audit (nodes typed exactly LocalBusiness) and Schema Validator. - Why: Without a structured address the map pack cannot place you, and "near me" results and Google Business Profile parity depend on it. - Fix: Add address as a PostalAddress with streetAddress, addressLocality, addressRegion, postalCode and addressCountry to the business node. A service-area business with no storefront should declare areaServed instead. - Verify: [GBP + Review Signal Audit](https://jwatte.com/tools/gbp-review-audit/), [Schema Validator](https://jwatte.com/tools/schema-validator/), [Rich Results Eligibility Audit](https://jwatte.com/tools/rich-results-eligibility-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org PostalAddress. - [ ] **6.8 Address present but no geo (GeoCoordinates)** - Pass: The business node has geo with GeoCoordinates latitude and longitude. - Warn: Schema Validator warns when geo is missing from a LocalBusiness node. - Fail: Mega Analyzer fails when a PostalAddress exists without geo (laundromat, self-storage, car wash, HVAC, electrician, handyman), when a butcher storefront node has no geo, on homebuilder community pages that have a business or Place node, on hotel home or contact pages, and on men's health clinic location pages. - Numbers and lists the tool uses: regex /"geo"\s*:\s*\{|"GeoCoordinates"|"latitude"/i; recommended field geo (Schema Validator, Rich Results audit). - Why: Latitude and longitude let the map pack pin the exact spot instead of guessing from the address. - Fix: Add geo: {"@type":"GeoCoordinates","latitude":..,"longitude":..} to the business node. - Verify: [Schema Validator](https://jwatte.com/tools/schema-validator/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org GeoCoordinates. - [ ] **6.9 Hours in schema + body** - Pass: The business node declares openingHoursSpecification (or openingHours). - Warn: Hours found only in page copy: GBP Review Audit warns when body text has day names but schema has none; GEO Analyzer scores 60 when hours appear only in copy; Schema Validator warns when openingHours is missing unless openingHoursSpecification is present on a local-business subtype. - Fail: GBP Review Audit fails when there are no hours anywhere; GEO Analyzer scores 30 when neither schema nor copy has hours; Mega Analyzer fails when hours schema is missing on legal and CPA office pages, home-inspection contact pages, laundromat and self-storage home, contact, location or facility pages, car wash, HVAC, electrician and handyman home or contact pages, restaurant pages that carry Restaurant schema, men's health clinic location pages and butcher storefront nodes. - Numbers and lists the tool uses: schema regex /"openingHoursSpecification"|"openingHours"/i (GBP Review Audit, Mega Analyzer laundromat and self-storage), /"openingHours(?:Specification)?"/i (Mega Analyzer legal, CPA, inspection), /"openingHoursSpecification"/i (Mega Analyzer restaurant); GBP Review Audit body regex /(monday|tuesday|wednesday|thursday|friday|saturday|sunday|mon[\-`<en dash>`]fri|mon[\-`<en dash>`]sat|24\s*hours|open\s*24)/i; GEO Analyzer checks the first LocalBusiness, Restaurant, Store or Service node, copy regex /\bhours of operation|business hours|open (mon|tue|wed|thu|fri|sat|sun)/i, scores 95 / 60 / 30. - Why: "Open now" answers in Google, Maps, voice assistants and AI come from structured hours, and they must match your Google Business Profile exactly. - Fix: Add openingHoursSpecification with dayOfWeek, opens and closes for every block (full Monday to Sunday), identical to the hours on your Google Business Profile. - Verify: [GBP + Review Signal Audit](https://jwatte.com/tools/gbp-review-audit/), [Schema Validator](https://jwatte.com/tools/schema-validator/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega GEO Analyzer](https://jwatte.com/tools/mega-geo-analyzer/). Standard: schema.org OpeningHoursSpecification. - [ ] **6.10 Service-area coverage** - Pass: The LocalBusiness or Service node declares areaServed (or serviceArea), or the page uses service-area language. - Fail: GEO Analyzer scores 30 when there is no LocalBusiness or Service node or the node has no areaServed; GBP Review Audit reports a missing signal as informational (optional for storefront-only businesses); Mega Analyzer fails on homebuilder community nodes, home-inspection contact and service pages, laundromat pages that offer pickup-and-delivery, butcher storefront nodes, HVAC, electrician and handyman nodes that have neither PostalAddress nor areaServed, and HVAC, electrician and handyman home or contact pages that have an address but no areaServed. - Numbers and lists the tool uses: GEO Analyzer: first LocalBusiness or Service node, score 90 declared, 30 missing; GBP Review Audit regex /"areaServed"|serving\s+(?:all\s+of\s+)?[A-Z][a-z]+|we serve|service\s+area/i; Mega Analyzer /"areaServed"/i, laundromat /"areaServed"|"serviceArea"/i gated on the services list including pickup-delivery. - Why: Searches from surrounding towns match on areaServed, so a business that travels to customers or serves several markets is invisible there without it. - Fix: Declare areaServed as a City, State, GeoCircle or Place array listing the metro, county and nearby cities you serve, and show the same list on the page. - Verify: [GBP + Review Signal Audit](https://jwatte.com/tools/gbp-review-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega GEO Analyzer](https://jwatte.com/tools/mega-geo-analyzer/). Standard: schema.org areaServed. - [ ] **6.11 sameAs citation links present** - Pass: The business node has a sameAs array linking your listing profiles (Google Business Profile, Yelp, Facebook and the platforms for your trade). - Warn: Parish analyzer warns when no sameAs appears anywhere in the HTML. - Fail: Mega Analyzer fails when sameAs is missing on car wash home or contact pages, HVAC, electrician and handyman business nodes and men's health clinic location pages; CPA office pages and home-inspection contact pages fail with fewer than 3 citation anchors found in sameAs plus body and footer, listing the missing ones (Yelp and Better Business Bureau each raise their own issue on CPA pages); hotel home or contact pages fail when 3 or more of the 5 listing platforms are missing. - Numbers and lists the tool uses: CPA anchors (7): Google Business Profile /maps\.google\.com[^"\s]*cid=|google\.com\/maps[^"\s]*cid=|g\.page\/[a-z0-9-]+|business\.google\.com\/(?:dashboard|n\/)/i, Yelp /yelp\.com\/biz\//i, BBB /bbb\.org\/(?:us|en|[a-z]{2})\//i or /bbb\.org\/business-reviews/i, LinkedIn /linkedin\.com\/company\//i, Facebook /facebook\.com\/[A-Za-z0-9.\-_]+\b/i, Apple Maps /maps\.apple\.com|place\.apple/i, ClearlyRated /clearlyrated\.com/i, pass at 3 or more, gated to office pages or path /contact|location|office/i; inspection anchors (6): Google Business Profile, Yelp, BBB /bbb\.org\//i, InterNACHI /internachi\.org\/(?:inspector|find)/i or /nachi\.org\//i, Facebook, Google reviews /search\.google\.com\/local\/reviews|google\.com\/maps[^"\s]*reviews/i, pass at 3 or more, gated to contact pages or path /contact|location|service-area/i; hotel platforms (5): google /google\.com\/maps|maps\.google|g\.page|business\.google|"https?:\/\/[^"]*google[^"]*"/i, apple /maps\.apple\.com|mapsconnect\.apple/i, yelp /yelp\.com\/biz/i, tripadvisor /tripadvisor\.[a-z.]+\/(Hotel_Review|Restaurant_Review|Tourism)/i, ota /booking\.com\/hotel|expedia\.com|hotels\.com|marriott\.com|hilton\.com/i, pass when at most 1 missing, fail at 3 or more missing; suggested targets: car wash GBP, Yelp, Facebook, Instagram; HVAC GBP, Facebook, Yelp, BBB, Nextdoor, manufacturer dealer-locator; electrician GBP, Facebook, Yelp, BBB, HomeAdvisor, Nextdoor; handyman GBP, Facebook, Yelp, Angi, Thumbtack; parish analyzer /sameAs/i anywhere in the HTML. - Why: Each linked profile is an authority anchor that Google's local reconciler and AI search use to confirm you are one real business, and for hotels the listing surface is the booking surface. - Fix: Add a sameAs array to the business node with the Google Business Profile or Maps URL, Yelp, Facebook, BBB and the directories for your trade, claiming any profile you do not yet have. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org sameAs. - [ ] **6.12 Google Maps canonical URL in sameAs** - Pass: SameAs includes the canonical Google Maps URL https://www.google.com/maps?cid=`<n>`. - Fail: Reported as informational when absent on a general local-business node (Mega Analyzer, Schema Validator); fails on CPA office pages and home-inspection contact pages (Mega Analyzer). - Numbers and lists the tool uses: format https://www.google.com/maps?cid=<19-digit-id>; the Mega Analyzer general row also accepts maps.app.goo.gl; Schema Validator regex /google\.com\/maps\?cid=\d+/i on sameAs strings, gated to a node typed one of LocalBusiness, RealEstateAgent, Attorney, Dentist, Physician, InsuranceAgency, AccountingService, SelfStorage, LodgingBusiness, Hotel, Restaurant, MovingCompany, TravelAgency with a non-empty sameAs; on CPA and inspection pages the Mega Analyzer accepts maps.google.com or google.com/maps with cid=, g.page/`<slug>`, or business.google.com/dashboard or /n/. - Why: The Maps cid URL is the verified Maps entity reference and the second strongest Knowledge Graph anchor after the kgmid, so it ties your site to your place pin. - Fix: In Google Maps click your pin, choose Share and copy the link (https://maps.app.goo.gl/`<token>`), follow its redirect with curl -sI `<share-url>`, convert the hex CID after the colon in the 0x...:0x... segment of the Location header to decimal, and add https://www.google.com/maps?cid=`<decimal>` to sameAs. - Verify: [Schema Validator](https://jwatte.com/tools/schema-validator/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **6.13 Google Business Profile share URL in sameAs** - Pass: SameAs includes a Google Business Profile URL (share.google, g.page or business.google.com). - Fail: Reported as informational when absent. - Numbers and lists the tool uses: regexes /share\.google\//, /g\.page\//, /business\.google\.com\// on the joined sameAs strings; the pass row renders when one of those is present and no Maps cid URL (google.com/maps?cid= or maps.app.goo.gl) is present; the informational row renders when none of the five patterns is found; nothing renders when a Maps cid URL is present. - Why: The share URL pairs with the Maps cid URL as a second pointer to the same Google listing. - Fix: Add the profile share URL (share.google, g.page or business.google.com) to sameAs next to the Maps cid URL. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **6.14 Local-business entity is missing a Google Knowledge Graph kgmid** - Pass: The local-business node declares its kgmid either as a sameAs URL https://www.google.com/search?kgmid=/g/`<id>` or as a PropertyValue identifier. - Fail: Reported as informational when a local-ish node with a non-empty sameAs has neither form. - Numbers and lists the tool uses: URL regex /google\.com\/search\?kgmid=\/[gm]\/[\w-]+/i; identifier propertyID regex /kgmid|googleKgmid|knowledgeGraph/i (identifier may be an object or an array of objects); local-ish gate as for the Maps cid check. - Why: The kgmid is the strongest single signal you can publish to reconcile your business with its Google Knowledge Graph entity. - Fix: Take the %2Fg%2F`<base32>` segment from the resolved Maps share URL redirect (it decodes to /g/`<base32>`) and add both https://www.google.com/search?kgmid=/g/`<base32>` in sameAs and identifier {"@type":"PropertyValue","propertyID":"googleKgmid","value":"/g/`<base32>`"}. - Verify: [Schema Validator](https://jwatte.com/tools/schema-validator/). Standard: Google Knowledge Graph. - [ ] **6.15 Local-business entity is missing a Google Place ID** - Pass: The local-business node declares its Google Place ID as a PropertyValue identifier. - Fail: Reported as informational when a local-ish node with a non-empty sameAs has no identifier whose propertyID matches the Place ID regex. - Numbers and lists the tool uses: propertyID regex /googlePlaceId|placeId/i; local-ish gate as for the Maps cid check. - Why: The Place ID binds your entity to its Google Business Profile, and the FtId hex in the Maps share URL redirect is that Place ID. - Fix: From the same Maps share URL redirect take the FtId hex (for example 0x54aca3f245411dd5 in the !1s0x... segment) and add identifier {"@type":"PropertyValue","propertyID":"googlePlaceId","value":"0x..."}. - Verify: [Schema Validator](https://jwatte.com/tools/schema-validator/). Standard: Google Places API Place ID. - [ ] **6.16 Payment methods disclosed** - Pass: PaymentAccepted is in the schema or the body text states the accepted payment types. - Fail: Reported as informational when neither is found. - Numbers and lists the tool uses: /"paymentAccepted"/i on the JSON-LD; body regex /(accept|accepted).*(visa|mastercard|amex|american express|discover|cash|apple pay|google pay|venmo|zelle|hsa|fsa|insurance)/i; Mega Analyzer car wash pass row 'paymentAccepted present.'. - Why: Accepted payment types are a common qualifier people search for on Google Business Profile. - Fix: List accepted payment types in paymentAccepted on the business node and in the footer. - Verify: [GBP + Review Signal Audit](https://jwatte.com/tools/gbp-review-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org paymentAccepted. - [ ] **6.17 Services / products listed** - Pass: The business node itemizes services with makesOffer, hasOfferCatalog or offers, or the site has a services, menu, treatments, products or pricing page. - Warn: GEO Analyzer scores 70 when the offer catalog exists but the copy has no services-page language; GBP Review Audit warns when neither schema offers nor a services path is found. - Fail: GEO Analyzer scores 30 or 50 when the LocalBusiness node has no makesOffer or hasOfferCatalog. - Numbers and lists the tool uses: GBP Review Audit /"hasOfferCatalog"|"offers"\s*:/i or path /\/(services|menu|treatments|products|pricing)/i; GEO Analyzer base 30, +40 makesOffer or hasOfferCatalog, +20 services-page regex /\b(our services|services we offer|what we do)\b/i on the lowercased HTML, cap 100, pass at 80 or more, warn 60 to 79, fail under 60. - Why: Itemized services feed featured snippets and must mirror the Services tab on your Google Business Profile. - Fix: Declare makesOffer or hasOfferCatalog on the LocalBusiness node with each service, and keep a Services page with each service as its own H2 and paragraph matching the GBP Services tab. - Verify: [GBP + Review Signal Audit](https://jwatte.com/tools/gbp-review-audit/), [Mega GEO Analyzer](https://jwatte.com/tools/mega-geo-analyzer/). Standard: schema.org hasOfferCatalog; schema.org makesOffer. - [ ] **6.18 Multi-location structure** - Pass: Score 90 when more than one LocalBusiness-family node is found; a single node scores 80 (single-location structure). - Fail: Score 30 when no LocalBusiness or Organization node exists. - Numbers and lists the tool uses: a node counts when @type is LocalBusiness or its string @type matches /LocalBusiness|Plumber|Restaurant|Store/; more than one node = 90, one = 80, none = 30. - Why: Each location needs its own page and its own business node so the map pack can rank every branch, while a single-location site still passes. - Fix: Add LocalBusiness schema; if you have several locations, give each its own URL with a unique LocalBusiness node and NAP on that page. - Verify: [Mega GEO Analyzer](https://jwatte.com/tools/mega-geo-analyzer/). Standard: schema.org LocalBusiness. - [ ] **6.19 Geo meta triplet (geo.position, geo.region, geo.placename)** - Pass: The page has geo.position, geo.region and geo.placename meta tags (any of the three counts). - Warn: Missing on a local-business page renders as a warning in the vertical readiness rows. - Fail: Fails on a page whose schema type matches the local-business list; on any other page a missing triplet is informational only (not a failure on author, SaaS, blog or portfolio pages). - Numbers and lists the tool uses: metas geo.position, geo.region, geo.placename; local-business gate /LocalBusiness|Restaurant|Store|AutoRepair|DryCleaningOrLaundry|LodgingBusiness|RealEstateAgent|SelfStorage|Laundromat|HomeAndConstructionBusiness/i tested on the schema types joined by comma; formats geo.position LAT;LNG, geo.region US-XX, geo.placename City. - Why: Apple Maps, Bing and voice assistants read these tags as a strong signal of where a local business sits. - Fix: On local-business pages add meta name="geo.position" content="LAT;LNG", meta name="geo.region" content="US-XX" and meta name="geo.placename" content="City". - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **6.20 Embedded or linked Google Map** - Pass: The page embeds or links your Google Map or Google Business Profile. - Warn: GBP Review Audit warns when no Google Map link or embed is found. - Fail: Mega Analyzer fails home, contact, location or facility pages of laundromat, self-storage, car wash, HVAC, electrician, handyman and men's health clinic sites that have no Google Business Profile or Maps link. - Numbers and lists the tool uses: GBP Review Audit /maps\.google|google\.com\/maps|maps\.app\.goo\.gl|embed\/.*google/i; Mega Analyzer /g\.page\/|business\.google\.|maps\.google\.|goo\.gl\/maps|\/maps\/place\/|google\.com\/maps/i on the raw HTML. - Why: A map embed or profile link on your own site reinforces the location match with your Google Business Profile, which is the biggest lead source for most local businesses. - Fix: Create and verify the Google Business Profile with the right category (for example Laundromat, Self-storage facility, Car wash), match NAP exactly, embed the Google Map iframe on the contact page, link the profile and add it to sameAs. - Verify: [GBP + Review Signal Audit](https://jwatte.com/tools/gbp-review-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **6.21 Hyperlocal content** - Pass: Score 80 (the cap) from "near / in / serving / located in `<City>`" phrases and ZIP codes in the page text. - Warn: Score 60 to 79. - Fail: Score under 60. - Numbers and lists the tool uses: city regex /\b(near|in|serving|located in)\s+[A-Z][a-z]+(?:\s+[A-Z][a-z]+)?/g run against the lowercased HTML (the capital-letter class is tested on lowercased text); ZIP regex /\b\d{5}(-\d{4})?\b/g; score = min(80, cityMatches*15 + zipMatches*5); pass 80 or more, warn 60 to 79, fail under 60. - Why: Naming the cities, neighborhoods and ZIP codes you serve in body copy is how search ties your pages to local queries. - Fix: Mention the specific cities, neighborhoods and ZIP codes you serve in body copy, and build a landing page for each service area. - Verify: [Mega GEO Analyzer](https://jwatte.com/tools/mega-geo-analyzer/). - [ ] **6.22 Visual proof signal (gallery or ≥ 8 images)** - Pass: The page links a gallery, photos, our-work, portfolio or before-after page or heading, or carries at least 8 images. - Warn: Fewer than 8 images and no gallery page. - Numbers and lists the tool uses: path regex /\/(gallery|photos|our-work|portfolio|before-after)/i on the raw HTML; heading regex /<h\d[^>]*>(gallery|photos|our work|portfolio)/i; image count doc.querySelectorAll('img').length >= 8; fix prompt: if the business has fewer than 20 GBP photos, add 10 priority photos (exterior, interior, team, work samples, product, logo, signage). - Why: Google Business Profile favors businesses that show their work in photos. - Fix: Add a gallery or photos page with real images of the exterior, interior, team and work samples, and upload the same set to your Google Business Profile. - Verify: [GBP + Review Signal Audit](https://jwatte.com/tools/gbp-review-audit/). - [ ] **6.23 Booking / appointment widget** - Pass: The page has booking language or a known booking or live-chat vendor embed. - Fail: GBP Review Audit reports a missing booking signal as informational; Mega Analyzer counts chat and booking as contact signals without failing. - Numbers and lists the tool uses: GBP Review Audit /book (?:now|online|an appointment)|schedule (?:now|online|an appointment)|reserve|reservation|calendly|acuity|setmore|vagaro|boulevard|mindbody|opentable|resy|tock/i; Mega Analyzer BOOKING_RE /(calendly\.com|cal\.com\/embed|savvycal\.com|app\.acuityscheduling|hubspot\.com\/meetings|chilipiper|oncehub\.com|book\.stripe|square\.site\/book)/i and CHAT_RE /(intercom\.io|widget\.intercom|static\.zdassets|zopim|tawk\.to|drift\.com|tidio|crisp\.chat|helpscout\.net|js\.hs-scripts|olark\.com|livechatinc)/i; contactSignals = count of tel link, mailto link, visible phone, visible address, visible hours, live chat, booking widget. - Why: Online booking makes the site conversion-ready and raises eligibility for the Book button on your Google Business Profile. - Fix: Add an online booking link or embed (or live chat) where it fits the business. - Verify: [GBP + Review Signal Audit](https://jwatte.com/tools/gbp-review-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **6.24 Create or claim your Google Business Profile** - Pass: A Google Business Profile exists, is verified, and is filled with name, category, address or service area, phone, website, description, hours, at least 5 photos, products or services with pricing and at least one post. - Numbers and lists the tool uses: photos at least 5 (logo, storefront or office, team, products, action shots); at least one post; the business name must match the website and Wikidata exactly; verification by postcard PIN, phone or email; add the profile URL to schema sameAs ("sameAs": "https://business.google.com/your-profile-url"). - Why: A verified, active Google Business Profile with consistent name, address and phone is what powers the local pack and is a Knowledge Panel trigger. - Fix: Go to business.google.com, add your business with the exact name, category, address or service area, phone and website, complete verification, then fill the description (same as Wikidata), hours, photos, products or services with pricing and a first post, and add the profile URL to sameAs. - Verify: [E-E-A-T Generator](https://jwatte.com/tools/eeat-generator/). - [ ] **6.25 Listing accessible** - Pass: The public Google Maps place page for the listing loads signed out and carries a title (og:title or the title tag). - Fail: Critical severity when no title can be read from the listing page. - Numbers and lists the tool uses: title from meta[property="og:title"] content, else the title tag text; severity critical. - Why: If your listing does not load publicly, customers and graders cannot see any of the other listing signals. - Fix: Confirm the Maps share URL resolves to your live, verified listing. - Verify: [Google Maps](https://jwatte.com/tools/google-maps-audit/). - [ ] **6.26 Description / category present** - Pass: The listing has accurate primary and secondary categories and a description of at least 40 characters. - Fail: Google Maps Audit reports a short or missing description as informational. - Numbers and lists the tool uses: og:description length >= 40 characters (Google Maps Audit); categories chosen during GBP setup, proxied by the profile URL field being filled (E-E-A-T Generator). - Why: The local pack is powered by profile category and description data, so the wrong category or an empty description hides you from the searches you want. - Fix: Select the accurate primary and secondary categories in Google Business Profile and write a description of at least 40 characters that matches the one on your site. - Verify: [Google Maps](https://jwatte.com/tools/google-maps-audit/), [E-E-A-T Generator](https://jwatte.com/tools/eeat-generator/). - [ ] **6.27 Phone visible** - Pass: The Google listing shows a North American phone number. - Warn: No phone number found on the listing. - Numbers and lists the tool uses: regex /(\+?1?[ -]?$?\d{3}$?[ -]?\d{3}[ -]?\d{4})/ on the listing text. - Why: Phone is one of the three NAP fields the map pack shows and calls from. - Fix: Add the phone number to the Google Business Profile, matching the website exactly. - Verify: [Google Maps](https://jwatte.com/tools/google-maps-audit/). - [ ] **6.28 Address visible** - Pass: The Google listing shows a street address with a recognized suffix. - Warn: No street address found on the listing. - Numbers and lists the tool uses: regex /\b(\d+\s+[\w .,]+(?:St|Ave|Blvd|Rd|Way|Dr|Ln|Pl|Pkwy))/ on the listing text. - Why: Address is one of the three NAP fields the map pack uses to place and rank you. - Fix: Add the street address to the Google Business Profile, matching the website exactly. - Verify: [Google Maps](https://jwatte.com/tools/google-maps-audit/). - [ ] **6.29 Hours of operation visible** - Pass: The Google listing shows open or closed status or day names. - Warn: No hours found on the listing. - Numbers and lists the tool uses: regex /Open (?:now|today|24 hours?)|Closed|hours of operation|Monday|Tuesday|Wednesday|Thursday|Friday|Saturday|Sunday/i on the listing text. - Why: Missing hours on the listing strongly suppresses rank. - Fix: Add hours to the Google Business Profile, identical to the hours on your site. - Verify: [Google Maps](https://jwatte.com/tools/google-maps-audit/). - [ ] **6.30 Website link present** - Pass: The Google listing shows a website link. - Warn: No website link found on the listing. - Numbers and lists the tool uses: regex /(?:Website|website link|visit (?:our )?website)|<a[^>]+https?:\/\//i run on the listing body text. - Why: A website URL on the listing is a graded signal and the path from the map pack to your site. - Fix: Add the website URL to the Google Business Profile. - Verify: [Google Maps](https://jwatte.com/tools/google-maps-audit/). - [ ] **6.31 Photos count signal** - Pass: The Google listing exposes a hero image (og:image) and shows a photo count. - Warn: No og:image on the listing, or no photo count shown. - Numbers and lists the tool uses: og:image content non-empty; photo count regex /\d+\s*photos?/i; target 20 or more photos (Google Maps Audit); at least 5 photos to start: logo, storefront or office, team, products, action shots (E-E-A-T Generator). - Why: Photo volume is a graded map-pack signal and the first thing a customer sees on your card. - Fix: Upload at least 5 photos to start and aim for 20 or more: exterior, interior, team, products or services. - Verify: [Google Maps](https://jwatte.com/tools/google-maps-audit/), [E-E-A-T Generator](https://jwatte.com/tools/eeat-generator/). - [ ] **6.32 Services / products listed (Google listing)** - Pass: The Google listing text mentions services, products, menu, treatments or offerings. - Warn: No services or products found on the listing. - Numbers and lists the tool uses: regex /services|products|menu|treatments|offerings/i on the listing text. - Why: The Services tab on Google Business Profile feeds long-tail intent matching. - Fix: Mirror your services in the GBP Services tab. - Verify: [Google Maps](https://jwatte.com/tools/google-maps-audit/). - [ ] **6.33 Products / Services Pricing signal** - Pass: The Google listing shows product or pricing cues. - Fail: Reported as informational when no pricing cue is found. - Numbers and lists the tool uses: regex /product|pricing|\$\d+|starting at|from \$/i on the listing text. - Why: Products and priced services are graded listing-completeness signals. - Fix: Add Products with photos and price for retail, or a Service list with price bands for service businesses. - Verify: [Google Maps](https://jwatte.com/tools/google-maps-audit/). - [ ] **6.34 Business attributes set** - Pass: The Google listing shows ownership, accessibility, amenity or payment attributes. - Fail: Reported as informational when no attribute token is found. - Numbers and lists the tool uses: attribute tokens: women-owned, veteran-owned, black-owned, lgbtq, family-owned, locally owned, wheelchair, accessible, free wi-fi or wifi, accepts credit cards. - Why: Attributes feed the filter panel on Google Business Profile. - Fix: Set attributes for ownership, accessibility, amenities and payments in the profile. - Verify: [Google Maps](https://jwatte.com/tools/google-maps-audit/). - [ ] **6.35 Booking / quote / reservation action** - Pass: The Google listing shows a book, reserve or quote action. - Warn: No booking, reservation or quote action found on the listing. - Numbers and lists the tool uses: regex /book (?:now|online|appointment)|reserve|reservation|request a quote|request an estimate/i on the listing text. - Why: A Book, Reserve or Quote button raises click-through and lead capture from the map pack. - Fix: Enable the Book, Reserve or Quote button in Google Business Profile. - Verify: [Google Maps](https://jwatte.com/tools/google-maps-audit/). - [ ] **6.36 Messaging enabled** - Pass: The Google listing shows a chat or message action. - Fail: Reported as informational when no messaging cue is found. - Numbers and lists the tool uses: regex /chat|message (?:us|the business)|send a message/i on the listing text; response SLA 24 hours. - Why: Messaging on Google Business Profile captures inquiries but only works if you can answer within 24 hours. - Fix: Turn on GBP messaging and commit to answering within 24 hours. - Verify: [Google Maps](https://jwatte.com/tools/google-maps-audit/). - [ ] **6.37 Questions & Answers tab populated** - Pass: The Google listing text mentions questions, FAQ, Q&A or people also ask. - Fail: Reported as informational when no Q&A cue is found. - Numbers and lists the tool uses: regex /questions?|frequently asked|q&a|people also ask/i on the listing text; advice 5 to 10 owner Q&As. - Why: A populated Q&A tab answers common pre-purchase questions right on the listing. - Fix: Proactively add 5 to 10 owner Q&As covering the questions people ask before buying. - Verify: [Google Maps](https://jwatte.com/tools/google-maps-audit/). - [ ] **6.38 Recent Posts / Updates signal** - Pass: The Google listing text mentions posts or updates. - Fail: Reported as informational when no post or update cue is found. - Numbers and lists the tool uses: regex /update|post|latest (?:post|update)/i on the listing text; cadence every 7 days. - Why: Posts expire and rank drops without a steady cadence. - Fix: Publish a GBP Post every 7 days. - Verify: [Google Maps](https://jwatte.com/tools/google-maps-audit/). - [ ] **6.39 Directory listings present (Yelp, BBB, Bing Places, Yellow Pages, Foursquare, Nextdoor, Apple Maps, Facebook Page, Angi, HomeAdvisor, Thumbtack, TripAdvisor)** - Pass: The business has a listing in each directory that applies to it, confirmed by searching the directory and ticking its box. - Fail: An unticked directory is named as missing in the submission prompt. - Numbers and lists the tool uses: 12 directories with search URLs: Yelp https://yelp.com/search?find_desc=<business name + city>; BBB https://bbb.org/search?find_text=`<query>`; Bing Places https://bing.com/maps?q=`<query>`; Yellow Pages https://yellowpages.com/search?search_terms=`<query>`; Foursquare https://foursquare.com/explore?q=`<query>`; Nextdoor https://nextdoor.com/search/?query=`<query>`; Apple Maps https://maps.apple.com/?q=`<query>`; Facebook Page https://facebook.com/search/pages/?q=`<query>`; Angi https://angi.com/companylist.htm?SearchTerm=`<query>`; HomeAdvisor https://homeadvisor.com/cs/search.aspx?q=`<query>`; Thumbtack https://thumbtack.com/search?query=`<query>`; TripAdvisor https://tripadvisor.com/Search?q=`<query>`. - Why: Yelp carries top citation weight, BBB is a trust signal customers still check, Bing feeds the Microsoft and LinkedIn ecosystem, Yellow Pages is still crawled, Foursquare feeds other directory APIs, Nextdoor is hyperlocal, Apple Maps covers about 30 percent of US users, Facebook is one of the largest review platforms, and Angi, HomeAdvisor, Thumbtack and TripAdvisor cover home services and hospitality. - Fix: For each missing directory, use its add-a-business page, meet its requirements (categories, photos, ownership verification), and start with the directories that carry the most citation weight for your trade. - Verify: [Local Directories](https://jwatte.com/tools/local-directories/). - [ ] **6.40 `<listing>`: NAP fields match canonical** - Pass: All three fields (name, phone, address) on the listing match the canonical NAP after normalization, and the same name, website URL, description, logo, phone and address are used on every platform. - Warn: 1 or 2 mismatched fields on a listing (partial drift), each shown as `<Field>`: `<variant>` ≠ `<canon>`. - Fail: All 3 fields differ (major drift). - Numbers and lists the tool uses: input lines in the form Listing name | Name | Phone | Address, split on newlines then on | with trim, a missing listing name becomes (unknown); buckets 0 issues pass, 1 to 2 warn, 3 fail; summary tiles Exact match = 0 issues, Partial = 1 or 2, Major drift = 3; all three canonical fields are required and at least one variant line; five fields to keep identical across platforms: business name (exact spelling, capitalization, punctuation), website URL (choose www or non-www and stick with it), the same core description sentence, the same logo or profile photo file, phone and address (E-E-A-T Generator). - Why: Spacing, abbreviation and phone-format mismatches across listings hurt local rank, and a phone or address mismatch can mean a duplicate listing exists. - Fix: Correct each mismatched listing in its own admin in priority order Google, Apple, Bing, Yelp, Facebook, BBB, Foursquare, then industry directories, merge or claim-and-update any duplicate, and re-audit monthly. - Verify: [NAP Consistency](https://jwatte.com/tools/nap-consistency/), [E-E-A-T Generator](https://jwatte.com/tools/eeat-generator/). - [ ] **6.41 Name: `<variant>` ≠ `<canon>`** - Pass: The listing's business name equals the canonical name after normalization. - Numbers and lists the tool uses: normName: lowercase, trim, strip a trailing legal suffix matching /\s+(llc|inc|ltd|corp|co\.?)\s*$/i, collapse runs of whitespace, hyphen, underscore, comma or period (/[\s\-_.]+/g) to one space, trim. - Why: Business-name drift in suffix, punctuation or spacing is one of the three mismatch classes that weaken your citations. - Fix: Edit the listing's business name in that platform's admin to match the canonical name exactly. - Verify: [NAP Consistency](https://jwatte.com/tools/nap-consistency/). - [ ] **6.42 Phone: `<variant>` ≠ `<canon>`** - Pass: The listing's phone equals the canonical phone after stripping formatting and a leading country code 1. - Numbers and lists the tool uses: normPhone: remove all non-digits (/\D/g), then strip a leading 1 from an 11-digit number (/^1(\d{10})$/ to $1). - Why: Phone-format mismatches hurt local rank, and a different phone may mean a duplicate listing. - Fix: Correct the listing phone in the platform admin; if the mismatch points to a duplicate listing, merge it or claim and update it. - Verify: [NAP Consistency](https://jwatte.com/tools/nap-consistency/). - [ ] **6.43 Address: `<variant>` ≠ `<canon>`** - Pass: The listing's address equals the canonical address after abbreviation and punctuation normalization. - Numbers and lists the tool uses: normAddr: lowercase, trim; word replacements street to st, avenue to ave, boulevard to blvd, road to rd, drive to dr, lane to ln, place to pl, court to ct, suite to ste, apartment to apt, north to n, south to s, east to e, west to w; collapse /[\s\-_.]+/g to one space; state names idaho to id, california to ca; trim. - Why: Abbreviation and spacing differences (Street vs St., Idaho vs ID) are normalized away, so anything still flagged is real address drift. - Fix: Correct the listing address in the platform admin; if the mismatch points to a duplicate listing, merge it or claim and update it. - Verify: [NAP Consistency](https://jwatte.com/tools/nap-consistency/). - [ ] **6.44 Primary category exact (Apple Business Connect)** - Pass: The Apple Business Connect primary category matches the Apple Maps taxonomy, ticked in the worksheet. - Why: Apple categories differ from Google, so the category must be picked from the Apple Maps taxonomy to match the right searches. - Fix: In Apple Business Connect choose the primary category that matches the Apple Maps taxonomy for your business. - Verify: [Apple Business](https://jwatte.com/tools/apple-business-audit/). - [ ] **6.45 Business name clean (no keyword stuffing)** - Pass: The Apple Maps listing name is the real business name with no added keywords, ticked in the worksheet. - Why: Apple penalizes keyword stuffing in the name harder than Google does. - Fix: Set the Apple Business Connect name to the exact business name and remove any added service or city keywords. - Verify: [Apple Business](https://jwatte.com/tools/apple-business-audit/). - [ ] **6.46 Logo uploaded (square, ≥ 512px)** - Pass: A square logo of at least 512px is uploaded to Apple Business Connect. - Numbers and lists the tool uses: square, >= 512px. - Why: The logo shows in the Apple Maps pin card. - Fix: Upload a square logo of at least 512px in Apple Business Connect. - Verify: [Apple Business](https://jwatte.com/tools/apple-business-audit/). - [ ] **6.47 Hero image (landscape, ≥ 1200px)** - Pass: A landscape hero image of at least 1200px is uploaded to Apple Business Connect. - Numbers and lists the tool uses: landscape, >= 1200px. - Why: The hero image shows in the Apple Maps place card carousel. - Fix: Upload a landscape hero image of at least 1200px in Apple Business Connect. - Verify: [Apple Business](https://jwatte.com/tools/apple-business-audit/). - [ ] **6.48 Photos ≥ 10 (recent)** - Pass: At least 10 recent photos are uploaded to the Apple Maps listing. - Numbers and lists the tool uses: >= 10 photos. - Why: Apple Maps rotates these photos in the place card carousel. - Fix: Upload at least 10 recent photos to Apple Business Connect and refresh them as the business changes. - Verify: [Apple Business](https://jwatte.com/tools/apple-business-audit/). - [ ] **6.49 Hours accurate + holiday hours** - Pass: Regular hours and holiday hours on the Apple Maps listing are accurate. - Why: Apple Maps pulls these hours into Siri answers. - Fix: Set regular hours and holiday hours in Apple Business Connect and keep them identical to your site and Google Business Profile. - Verify: [Apple Business](https://jwatte.com/tools/apple-business-audit/). - [ ] **6.50 Phone + website + email verified** - Pass: Phone, website and email are all verified on the Apple Maps listing. - Why: All three feed Siri responses. - Fix: Verify the phone, website and email in Apple Business Connect. - Verify: [Apple Business](https://jwatte.com/tools/apple-business-audit/). - [ ] **6.51 Business description 40-300 chars** - Pass: The Apple Business Connect description is between 40 and 300 characters. - Numbers and lists the tool uses: 40 to 300 characters. - Why: The description appears below the hero on the place card and should mirror your Google Business Profile description for consistency. - Fix: Write a 40 to 300 character description in Apple Business Connect that mirrors your GBP description. - Verify: [Apple Business](https://jwatte.com/tools/apple-business-audit/). - [ ] **6.52 Attributes: accessibility, takeout, Wi-Fi, parking, curbside, drive-thru** - Pass: The accessibility, takeout and Wi-Fi attributes and the parking, curbside and drive-thru attributes are filled on the Apple Maps listing. - Numbers and lists the tool uses: attributes: accessibility, takeout, Wi-Fi; newer attributes: parking, curbside, drive-thru. - Why: Every attribute powers a filter search in Apple Maps. - Fix: Fill every attribute in Apple Business Connect, including the newer parking, curbside and drive-thru fields. - Verify: [Apple Business](https://jwatte.com/tools/apple-business-audit/). - [ ] **6.53 Action items configured** - Pass: The Order, Menu, Reserve and Gift Card action buttons are configured on the Apple Maps listing. - Numbers and lists the tool uses: buttons: Order, Menu, Reserve, Gift Card. - Why: Each action button triggers a native iOS handoff straight from the place card. - Fix: Configure the Order, Menu, Reserve and Gift Card actions that apply to you in Apple Business Connect. - Verify: [Apple Business](https://jwatte.com/tools/apple-business-audit/). - [ ] **6.54 Reservations integration (OpenTable / Resy)** - Pass: A reservations provider is integrated with the Apple Maps listing. - Numbers and lists the tool uses: providers named: OpenTable, Resy. - Why: Integration enables one-tap booking from Apple Maps. - Fix: Connect your OpenTable or Resy account in Apple Business Connect. - Verify: [Apple Business](https://jwatte.com/tools/apple-business-audit/). - [ ] **6.55 Appointment slots visible (services)** - Pass: Bookable appointment slots show on the Apple Maps listing. - Why: For trades, dental, medical and salons, Apple pulls open slots from your booking platform onto the listing. - Fix: Connect your booking platform in Apple Business Connect so appointment slots appear on the listing. - Verify: [Apple Business](https://jwatte.com/tools/apple-business-audit/). - [ ] **6.56 Apple Pay + Express Menu enabled** - Pass: Apple Pay and Express Menu are enabled on the Apple Maps listing. - Why: They give iOS users native checkout where it applies. - Fix: Enable Apple Pay and Express Menu in Apple Business Connect where they apply to your business. - Verify: [Apple Business](https://jwatte.com/tools/apple-business-audit/). - [ ] **6.57 Tipping enabled (where applicable)** - Pass: Apple Pay Tipping is enabled on the Apple Maps listing. - Why: Apple Pay Tipping shows for restaurants, salons and trades that opt in. - Fix: Opt in to Apple Pay Tipping in Apple Business Connect if you accept tips. - Verify: [Apple Business](https://jwatte.com/tools/apple-business-audit/). - [ ] **6.58 Gift cards enabled (Apple Wallet)** - Pass: Apple Wallet gift cards are enabled on the Apple Maps listing. - Why: For retail and restaurants, Apple Wallet integration reduces purchase friction. - Fix: Enable Apple Wallet gift cards in Apple Business Connect. - Verify: [Apple Business](https://jwatte.com/tools/apple-business-audit/). - [ ] **6.59 Showcase promotions active** - Pass: Showcase promotions are running on the Apple Maps listing. - Why: Showcases are Apple's version of Google Business Profile Posts and drive place-card clicks. - Fix: Publish a Showcase promotion in Apple Business Connect and keep one active. - Verify: [Apple Business](https://jwatte.com/tools/apple-business-audit/). - [ ] **6.60 Indoor Maps (if applicable)** - Pass: Indoor floor plans are provided for a large venue. - Why: Apple supports indoor floor plans for large venues. - Fix: If you run a large venue, submit indoor floor plans through Apple Business Connect. - Verify: [Apple Business](https://jwatte.com/tools/apple-business-audit/). - [ ] **6.61 Look Around imagery accurate (if in city)** - Pass: Apple's ground-level Look Around imagery shows the current storefront. - Why: Look Around is Apple's ground-level imagery, and an outdated storefront confuses visitors. - Fix: If your storefront changed, request an imagery update through Apple Business Connect. - Verify: [Apple Business](https://jwatte.com/tools/apple-business-audit/). - [ ] **6.62 Business Connect updates monthly** - Pass: The Apple Business Connect profile receives at least one meaningful edit per month. - Numbers and lists the tool uses: one meaningful edit per month; Apple deprioritizes profiles untouched for 6 or more months; the worksheet accepts up to 5 competitor URLs and lists 24 signals. - Why: Apple deprioritizes profiles untouched for 6 or more months. - Fix: Make one meaningful edit to the Apple Business Connect profile every month. - Verify: [Apple Business](https://jwatte.com/tools/apple-business-audit/). - [ ] **6.63 Apple Search Ads Maps placement (optional)** - Pass: Paid Apple Maps search placement has been tested. - Why: Paid placement inside Apple Maps search is an opt-in test worth running for higher-ticket categories. - Fix: If your category is higher-ticket, run a test of Apple Search Ads placement in Maps. - Verify: [Apple Business](https://jwatte.com/tools/apple-business-audit/). - [ ] **6.64 Google Posts cadence (process check)** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: one Google Business Profile Post every 7 days (weekly); Posts expire after 7 days; fix prompt calendar: 12 posts over 90 days across Offer, Event and Update types, each at most 1,500 characters with one call to action. - Why: Posts expire after 7 days and relevance drops fast without a steady cadence, while an active profile is a Knowledge Panel trigger. - Fix: Publish a Google Business Profile Post every week, planned as a 90-day calendar of 12 posts across Offer, Event and Update types, each under 1,500 characters with one call to action. - Verify: [GBP + Review Signal Audit](https://jwatte.com/tools/gbp-review-audit/), [E-E-A-T Generator](https://jwatte.com/tools/eeat-generator/). - [ ] **6.65 Local pack / Map** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: SERP HTML regex /data-async-context="query.*?local_pack|aria-label="(?:Map|Businesses in .*)"|"localPack":/i, reported as yes or no. - Why: A local pack on the results page means the query has geo intent, and a Google Business Profile with consistent NAP, categories and reviews dominates that space. - Fix: For queries that show a local pack, invest in the Google Business Profile first: consistent NAP, accurate categories and steady reviews. - Verify: [SERP Features](https://jwatte.com/tools/serp-features/). ## 7. Trust: who is behind this site, and can a machine confirm it Author bylines, dates that are true, an about page and a way to make contact, the sameAs links that tie a name to its profiles, and the legal pages that say the business is real. Search engines call this E-E-A-T; an AI answer engine calls it whether to cite you. **Verify this section with:** [Batch Compare](https://jwatte.com/tools/batch-analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Trust Signal Surface](https://jwatte.com/tools/trust-signal-surface-audit/), [Competitor Gap Matrix](https://jwatte.com/tools/competitor-gap-matrix/), [Migration Analyzer](https://jwatte.com/tools/migration-analyzer/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/), [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/), [Legal Pages Generator](https://jwatte.com/tools/legal-pages-generator/), [About-Page Conversion Audit](https://jwatte.com/tools/about-page-conversion-audit/), [Mega Batch](https://jwatte.com/tools/mega-batch/), [E-E-A-T Author Entity Graph](https://jwatte.com/tools/e-e-a-t-author-entity-graph/), [SGE Readiness Audit](https://jwatte.com/tools/sge-readiness-audit/), [Schema Fix Bundle](https://jwatte.com/tools/schema-fix-bundle/), [Author Authority per Article](https://jwatte.com/tools/author-authority-per-article/), [Mega AEO Analyzer](https://jwatte.com/tools/mega-aeo-analyzer/), [Mega GEO Analyzer](https://jwatte.com/tools/mega-geo-analyzer/), [E-E-A-T Generator](https://jwatte.com/tools/eeat-generator/), [Schema Validator](https://jwatte.com/tools/schema-validator/), [Monoclone Gen.](https://jwatte.com/tools/monoclone-generator/), [GBP + Review Signal Audit](https://jwatte.com/tools/gbp-review-audit/), [Google Maps](https://jwatte.com/tools/google-maps-audit/), [SERP Features](https://jwatte.com/tools/serp-features/), [Apple Business](https://jwatte.com/tools/apple-business-audit/). - [ ] **7.1 Page cites external sources** - Pass: The page links out to one or more authoritative external sites. - Fail: Zero external links earn no credit (Batch Analyzer). - Numbers and lists the tool uses: Tiers 5, 2 and 1 external links for full, partial and minimal credit (Batch Analyzer). - Why: Outbound citations to authoritative sources are a trust signal for readers and AI engines. - Fix: Cite external authoritative sources where claims are made. - Verify: [Batch Compare](https://jwatte.com/tools/batch-analyzer/). - [ ] **7.2 humans.txt identity file served** - Pass: A /humans.txt file is served listing team names, roles and a contact. - Warn: A missing humans.txt is a warning in Mega Analyzer and Analyzer (Analyzer also repeats it as an informational 'No humans.txt' row in its aux-file section); on a platform that cannot serve root files Mega Analyzer reports it as informational. - Numbers and lists the tool uses: path /humans.txt; Batch Analyzer lists humans.txt with weight 6 but does not fetch it, so that point is never earned. - Why: AI citation engines and IndieWeb tools read humans.txt as a sign that named people stand behind the site. - Fix: Publish /humans.txt at the site root with the team, their roles and a contact, following humanstxt.org. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/). Standard: humanstxt.org. - [ ] **7.3 Privacy policy link found** - Pass: Every page links to a published privacy policy page. - Warn: Analyzer reports a missing privacy link as a warning; Mega SEO Analyzer warns only when fewer than 2 of its 3 policy links (privacy, terms, cookies) are present; Migration Analyzer warns when only 1 to 2 of its 4 legal pages are linked. - Fail: Mega Analyzer fails its 'Privacy Policy linked from landing page' row when no href matches its regex; E-E-A-T Analyzer fails when no href matches /privacy/i; Trust Signal Surface Audit fails when /privacy does not return a page; Migration Analyzer fails when none of its 4 legal pages are linked. - Numbers and lists the tool uses: Mega Analyzer href /\/privacy(\/|$|-policy|-notice|_policy)|\/pp\/?$/i; Analyzer href /privacy|datenschutz|politica[- ]?privacidad/i or link text /privacy policy|datenschutz/i; Mega SEO Analyzer /href=["'](?:[^"']*\/)?(?:privacy(?:-policy)?|policies\/privacy(?:-policy)?)\b/i counted toward 2 of 3 policy links (Shopify /policies/* accepted); E-E-A-T Analyzer any href /privacy/i; Batch Analyzer any href /privacy/i (weight 5); Trust Signal Surface Audit fetches /privacy; Competitor Gap Matrix href="/privacy; Migration Analyzer paths /privacy /terms /disclaimer /accessibility /cookies /cookie-policy /tos /legal /gdpr (privacy slot satisfied by /privacy, /gdpr, /cookies or /cookie-policy), pass at 3 or more of 4 pages, warn 1 to 2, fail 0; Single Site Gen lists /privacy among its required trust signals; Site Migration Gen requires /privacy/ linked from the footer of every page. - Why: Any site that collects data, even through analytics, needs a privacy policy, and if the page does not link to one it is effectively missing. - Fix: Publish a privacy policy page at /privacy and link it from the footer of every page. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Trust Signal Surface](https://jwatte.com/tools/trust-signal-surface-audit/), [Competitor Gap Matrix](https://jwatte.com/tools/competitor-gap-matrix/) and 6 more. Standard: GDPR; CCPA. - [ ] **7.4 Terms of service page** - Pass: The page links to a published terms of service or terms of use page. - Warn: Mega SEO Analyzer warns when fewer than 2 of the 3 policy links (privacy, terms, cookies) are present; Migration Analyzer warns when only 1 to 2 of its 4 legal pages are linked. - Fail: Trust Signal Surface Audit fails when /terms does not return a page; E-E-A-T Analyzer fails when no href matches /disclaimer|terms/i; Mega Analyzer fails its 'Terms of Use / Terms of Service page linked' row when no href matches its regex. - Numbers and lists the tool uses: Mega Analyzer href /\/(terms|tos|tou|legal|terms-of-service|terms-of-use|terms-and-conditions|disclaimer)(\/|$|\.html)/i; Mega SEO Analyzer href /(?:[^"']*\/)?(?:terms(?:-of-(?:service|use))?|policies\/terms(?:-of-(?:service|use))?)\b/i; E-E-A-T Analyzer href /disclaimer|terms/i; Trust Signal Surface Audit fetches /terms; Competitor Gap Matrix href="/terms; Migration Analyzer paths /terms /tos /legal among its 4 legal pages; Site Migration Gen requires /terms/ in the footer of every page. - Why: A missing terms page reads as an amateur operation and leaves the rules for using the site unstated. - Fix: Publish a terms of service page at /terms and link it from the footer of every page. - Verify: [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Trust Signal Surface](https://jwatte.com/tools/trust-signal-surface-audit/), [Competitor Gap Matrix](https://jwatte.com/tools/competitor-gap-matrix/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/) and 3 more. - [ ] **7.5 Cookie Policy Detected** - Pass: The page links to a cookie policy page (a /privacy#cookies anchor is accepted). - Warn: E-E-A-T Analyzer reports a missing cookie policy link as a warning; Mega SEO Analyzer warns only when fewer than 2 of its 3 policy links (privacy, terms, cookies) are present; Migration Analyzer does not report cookies separately, it counts /cookies or /cookie-policy toward its privacy slot. - Fail: Mega Analyzer fails its 'Cookie Policy linked (separate from Privacy Policy)' row when no href matches /[\/#]cookies?/i. - Numbers and lists the tool uses: Mega Analyzer href /[\/#]cookies?/i; Mega SEO Analyzer /href=["'](?:[^"']*\/)?(?:cookies?(?:-policy)?|policies\/cookies?(?:-policy)?)\b/i; E-E-A-T Analyzer href /cookie/i or body text 'cookie policy'; Migration Analyzer paths /cookies /cookie-policy count toward its privacy slot; Legal Pages Generator links /cookies/ from the privacy policy; Site Migration Gen requires /cookies/ or a cookie disclosure by category (essential, analytics, marketing) with purpose and retention. - Why: If the site sets cookies or runs tracking, visitors need a page that names the cookies and how to control them. - Fix: Publish the cookie policy at /cookies and link it from the footer and from the privacy policy. - Verify: [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [Migration Analyzer](https://jwatte.com/tools/migration-analyzer/) and 2 more. - [ ] **7.6 Legal pages linked: `<n>` / 4** - Pass: The site publishes and links /disclaimer and /accessibility pages alongside privacy and terms. - Warn: Migration Analyzer warns when only 1 to 2 of the 4 legal pages (privacy, terms, disclaimer, accessibility) are linked. - Fail: Migration Analyzer fails when none of the 4 legal pages are linked. - Numbers and lists the tool uses: Migration Analyzer counts 4 slots via paths /privacy /terms /disclaimer /accessibility /cookies /cookie-policy /tos /legal /gdpr (privacy slot = /privacy, /gdpr, /cookies or /cookie-policy; terms slot = /terms, /tos or /legal), pass at 3 or more, warn 1 to 2, fail 0; Single Site Gen and Site Migration Gen list /privacy /contact /disclaimer /accessibility as required trust signals; Site Migration Gen additionally requires the accessibility statement to name a WCAG 2.2 Level AA target, known issues and a contact, and all legal pages linked from the footer on every page. - Why: Disclaimer and accessibility pages round out the trust pages that show a real organization operates the site. - Fix: Publish a disclaimer page and an accessibility statement (WCAG 2.2 AA target, known issues, a contact for problems) and link both from the footer. - Verify: [Migration Analyzer](https://jwatte.com/tools/migration-analyzer/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/), [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/). Standard: WCAG 2.2 AA. - [ ] **7.7 Refund, shipping and DPA policy links** - Pass: Where they apply, the page links to refund or return, shipping or delivery, and data-processing-agreement pages. - Warn: Mega Analyzer reports a missing refund, shipping or DPA link as informational, and only when the matching schema type is on the page. - Numbers and lists the tool uses: refund /\/(refunds?|returns?|refund-policy|return-policy|exchanges?)(\/|$)/i, flagged only when the page carries Product, OfferCatalog or Service schema; shipping /\/(shipping|shipping-policy|delivery)(\/|$)/i, only with Product schema; dpa /\/(dpa|data-processing|subprocessors?|gdpr-dpa)(\/|$)/i, only with SoftwareApplication or Service schema; all three are informational rows in the Mega Analyzer depth section. - Why: Product sellers and software vendors are expected to publish these business-specific policy pages. - Fix: Publish the applicable policy pages and link them from the footer. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **7.8 Cookie preference center and consent banner** - Pass: A consent banner is actually rendered on the page and a cookie preference center link is present. - Warn: Analyzer and Mega SEO Analyzer report a missing consent mechanism as a warning; Mega Analyzer reports both the rendered banner element and the preference center link as informational rows. - Numbers and lists the tool uses: Mega Analyzer preference links /\/(cookie-settings|cookie-preferences|privacy-settings|manage-cookies|cookie-manage|opt-out|do-not-sell)(\/|$)/i or body /(cookie\s+(settings|preferences)|manage\s+cookies|do\s+not\s+sell|privacy\s+preferences)/i; banner selectors [id*="cookie" i], [class*="cookie" i][class*="banner" i], [class*="consent" i][class*="banner" i], [id*="onetrust" i], [id*="cookiebot" i], [role="dialog"][aria-label*="cookie" i], [aria-describedby*="cookie" i] or body /\b(we\s+use\s+cookies|this\s+(?:site|website)\s+uses\s+cookies|by\s+clicking\s+(?:accept|agree))/i; Analyzer /cookie.?consent|cookie.?banner|onetrust|cookiebot|osano|quantcast|trustarc|cookie.?policy|gdpr|site_cookie_consent|siteConsent/i with platform marker /OneTrust|CookieConsent|cookie_consent|Osano|TrustArc/i; Mega SEO Analyzer /cookie(consent|bar|banner)|cookieyes|osano|onetrust|cookiebot|termly|iubenda|borlabs|complianz/i; Legal Pages Generator footer link labelled 'Manage cookies' or 'Privacy Settings', no non-essential cookies before consent for EU or UK visitors, withdrawal as easy as consent. - Why: If analytics or ads fire before consent, EU and UK visitors are tracked without permission, and loading a vendor script is not the same as showing the banner. - Fix: Install a consent platform that renders a banner and gates analytics and ads until consent, and add a 'Manage cookies' preference link in the footer. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [Legal Pages Generator](https://jwatte.com/tools/legal-pages-generator/). Standard: GDPR / ePrivacy Directive. - [ ] **7.9 Privacy Policy: sections 1 to 10 plus changes clause** - Pass: The privacy policy names the data collected, the purposes, every embedded third-party service with its purpose and policy link, retention periods, the rights for each jurisdiction served with a response time, transfer safeguards, a children clause, a health clause where health data is collected, and a changes clause. - Numbers and lists the tool uses: data categories: email address, name, physical address, payment information (processed by the payment provider, full card numbers never stored), IP address and device identifiers, analytics cookies, advertising cookies and pixels, uploaded content, health-related information, information about children under 13 (COPPA); defaults email, ip, analytics; collection moments: visit, form, subscribe, account, purchase, interact; five purposes: operate and improve the Site, communicate (marketing with consent where required), process transactions, detect fraud and abuse, comply with law; third-party services library: Google Analytics 4, Google Ads, Meta (Facebook) Pixel, Stripe, PayPal, Mailchimp / Mailjet, SendGrid / Postmark, Cloudflare, Netlify, Vercel, Intercom / Crisp, Microsoft Clarity, HubSpot, YouTube / Vimeo, each listed as name, purpose and policy link, default GA4; statement 'We do not sell personal information to third parties'; 'Do Not Sell or Share My Personal Information' footer link when California is served; retention: account data for the life of the account plus 90 days, anonymized analytics up to 26 months; jurisdictions us, ca, eu, uk, canada, au, br (defaults us, ca, eu), each with its own rights paragraph (GDPR: access, rectify, erase, restrict, object, port, withdraw consent, complain; CCPA: know, delete, correct, limit sensitive PI, opt out, non-discrimination; PIPEDA and Quebec Law 25; Australian APPs with OAIC escalation; LGPD); 'We respond within 30 days'; Standard Contractual Clauses for transfers; age 13 children clause, COPPA commitments when children's data is collected; HIPAA paragraph only when health data is collected, PHI handled under a separate Notice of Privacy Practices; material changes announced at least 30 days before taking effect; 'Last updated' date. - Why: Different laws require different clauses, and a policy that names each vendor, retention period and regional right is what regulators and careful visitors look for. - Fix: Generate or rewrite the privacy policy so every section above is present, checking every data category actually collected, every embedded vendor and every region visitors come from. - Verify: [Legal Pages Generator](https://jwatte.com/tools/legal-pages-generator/). Standard: GDPR; UK-GDPR; CCPA / CPRA; PIPEDA; Quebec Law 25; Australian Privacy Act; LGPD; COPPA; HIPAA; EU Standard Contractual Clauses. - [ ] **7.10 Cookie Policy: categories, control and consent sections** - Pass: The cookie policy defines cookies and similar technologies, lists each cookie category with its vendors and lifetimes, explains how to control cookies, and states the consent commitments for GDPR users and Do-Not-Track. - Numbers and lists the tool uses: definition covers localStorage, session storage, pixels and SDKs; strictly necessary: session, consent-preference, CSRF-protection and load-balancer cookies, cannot be turned off; functional: theme and language preferences, optional; analytics section when GA4 or Microsoft Clarity is used (GA4 retention up to 26 months, policy links https://policies.google.com/privacy and https://privacy.microsoft.com/privacystatement); advertising section when Google Ads or Meta Pixel is used (links https://policies.google.com/privacy and https://www.facebook.com/privacy/policy/); browser control via https://www.allaboutcookies.org/; GDPR and UK users: no non-essential cookies until consent, withdrawal via the Preference Center; Do-Not-Track honored where technically feasible; California residents pointed to 'Do Not Sell or Share My Personal Information'. - Why: Naming each service, its purpose and cookie lifetime is what makes a cookie policy useful rather than boilerplate. - Fix: Write the cookie policy by category, name every vendor with its purpose and retention, and state that no non-essential cookies are set before consent. - Verify: [Legal Pages Generator](https://jwatte.com/tools/legal-pages-generator/). Standard: GDPR; UK-GDPR; CCPA / CPRA. - [ ] **7.11 Terms of Service: eligibility through changes clauses** - Pass: The terms cover eligibility, account responsibility, acceptable use, intellectual property, user-submitted content, third-party links, disclaimer of warranties, limitation of liability, indemnification, governing law and a changes clause. - Numbers and lists the tool uses: eligibility age 13, age 18 for transactions, SaaS adds a representation of authority to bind the organization; account clause: keep credentials secure, SaaS variant adds notify immediately of unauthorized use; seven acceptable-use prohibitions: violate law, bypass rate limits or authentication, scrape or mirror except per robots.txt and ai.txt, interfere with users, upload malware or infringing content, impersonate, spam; IP: viewing and link-sharing allowed, redistribution, re-hosting, automated scraping beyond allow-lists and re-packaging prohibited without written permission; e-commerce types add a Purchases clause (refund or return policy linked from every product page and the footer, prices subject to change, taxes may apply); SaaS adds a Subscription + billing clause (automatic renewal, cancel any time effective at the end of the billing period, no pro-rated refunds for partial periods except where required by law); UGC: worldwide royalty-free license to host, display and distribute, user keeps ownership; third-party links disclaimer; 'as is' and 'as available' warranty disclaimer; liability cap $100 or the amount paid in the preceding 12 months, whichever is greater; indemnification; governing law without regard to conflict-of-law principles, venue in that jurisdiction; material changes announced at least 30 days ahead. - Why: Complete terms set the rules for using the site and limit the business's exposure. - Fix: Draft terms of service that include every clause above and enter the governing-law state or country before publishing. - Verify: [Legal Pages Generator](https://jwatte.com/tools/legal-pages-generator/). - [ ] **7.12 Business + site basics and contact section on every generated document** - Pass: Every legal document states the legal business name, site URL, effective date, contact email, mailing address and governing law, ends with a contact block, and has been reviewed by an attorney before publishing. - Fail: A bracketed placeholder such as '[Your Business Name]' or '[Your mailing address]' left in a published document. - Numbers and lists the tool uses: placeholders '[Your Business Name]', 'https://yoursite.com', 'privacy@yoursite.com', '[Your mailing address]', '[Your state / country]'; effective date as YYYY-MM-DD; every document opens with 'Effective date' and the privacy policy also 'Last updated'; contact block at the end of the Privacy Policy, Terms, Refund Policy and DPA with email, business name and mailing address, the DPA labelling it 'DPO / Privacy contact'; drafting rules: plain language, each clause cites its law (GDPR Art. X, CCPA section X, FTC 16 CFR 255), 30-day notice for material changes, paragraphs of 3 to 5 sentences, a closing 'Attorney review recommendations' section flagging HIPAA, FINRA and state-bar requirements, output labelled 'template draft, for attorney review'. - Why: A physical mailing address is a CAN-SPAM and CCPA requirement and the contact email is where legal and privacy requests arrive. - Fix: Fill in every identity field, replace any leftover placeholder, and have a licensed attorney review before publishing, especially with sensitive data, several regions or meaningful revenue. - Verify: [Legal Pages Generator](https://jwatte.com/tools/legal-pages-generator/). Standard: CAN-SPAM; CCPA. - [ ] **7.13 Disclaimers: FTC affiliate, medical, financial, legal** - Pass: The page carries the disclaimer that matches its content type: affiliate, medical, financial or legal. - Fail: E-E-A-T Analyzer reports a missing affiliate or sponsorship disclosure as informational only. - Numbers and lists the tool uses: Mega Analyzer FTC /\b(as\s+an\s+amazon\s+associate|affiliate\s+disclosure|we\s+(?:may\s+)?earn\s+(?:a\s+)?commission|this\s+post\s+contains\s+affiliate|compensated\s+affiliate)\b/i, informational and only when Article, BlogPosting or Review schema is present; medical /\b(not\s+(?:medical|professional)\s+advice|consult\s+(?:your|a)\s+(?:doctor|physician|healthcare)|for\s+informational\s+purposes\s+only)\b/i, only with Medical*, HealthTopicContent or Physician schema; financial /\b(not\s+(?:financial|investment|tax)\s+advice|past\s+performance\s+(?:does\s+not|is\s+not)|informational\s+purposes?\s+only|your\s+capital\s+is\s+at\s+risk)\b/i, only with FinancialService, InvestmentOrDeposit or BankOrCreditUnion schema; legal /\b(not\s+legal\s+advice|attorney\s+advertising|prior\s+results\s+do\s+not\s+guarantee|attorney[- ]client\s+relationship)\b/i, only with LegalService or Attorney schema; E-E-A-T Analyzer body substrings affiliate, sponsored, disclosure (informational); Legal Pages Generator business types blog, affiliate, newsletter, ecom-physical, ecom-digital, saas, consulting, local-service, medical, financial, legal; generated wording: medical (general information only, not medical advice, not intended to diagnose, treat, cure or prevent any disease, consult a qualified provider); financial (not financial, investment, tax or legal advice, past performance does not guarantee future results, risk of loss of principal, not a registered investment adviser, no solicitation or offer); legal (may constitute attorney advertising, not legal advice, no attorney-client relationship formed, do not send confidential information until a relationship exists in writing, prior results do not guarantee similar outcomes); affiliate for affiliate or blog types (commission at no additional cost, 'As an Amazon Associate, `<business>` earns from qualifying purchases', 16 CFR 255); general fallback for ecommerce, saas and consulting (no warranties of accuracy, use at your own risk). - Why: YMYL and monetized content needs an explicit disclaimer so readers know the limits of the advice and how the site earns money. - Fix: Add the disclaimer matching the content type in the footer or near the content, using the wording above. - Verify: [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Legal Pages Generator](https://jwatte.com/tools/legal-pages-generator/). Standard: FTC Endorsement Guides, 16 CFR 255; state bar attorney-advertising rules. - [ ] **7.14 Site-purpose links in HTML: about=<yes/no>** - Pass: The page links to an About page. - Warn: Mega SEO Analyzer warns when only one of the about and contact links is present. - Fail: Mega SEO Analyzer fails when neither about nor contact is linked; E-E-A-T Analyzer fails when no href matches /about|author|bio|team/i; Mega Analyzer fails its 'Link to an about page' row when no href matches /\/about/i; Batch Analyzer requires both about and contact links for its point. - Numbers and lists the tool uses: Mega Analyzer /\/about/i; Mega SEO Analyzer href /href=["'][^"']*\/about(?:\/|["'?#])/i; Batch Analyzer any raw href /about/i and /contact/i (weight 8); E-E-A-T Analyzer any href /about|author|bio|team/i; Mega Analyzer depth row fails when the about link is absent. - Why: The About page is a top E-E-A-T signal and answers Google's question of who is behind the site and why it exists. - Fix: Publish an About page at /about and link it from the header or footer of every page. - Verify: [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/). Standard: Google Helpful Content self-assessment; Google Quality Rater Guidelines. - [ ] **7.15 About page substantive** - Pass: The /about page HTML is longer than 1,500 characters. - Warn: An About page under 1,500 characters is reported as thin. - Fail: No /about page at all (length 0) is reported as missing. - Numbers and lists the tool uses: path /about; length over 3,000 chars reported as robust, over 1,500 adequate, 1 to 1,500 thin, 0 missing; detail rounds to hundreds of chars. - Why: A thin or missing About page undermines the credibility infrastructure that readers and engines check first. - Fix: Expand the About page with who runs the business, its history, credentials and how to reach you. - Verify: [Trust Signal Surface](https://jwatte.com/tools/trust-signal-surface-audit/). Standard: Google News Initiative trust-project model. - [ ] **7.16 mailto: link or /contact page** - Pass: The page links to a contact page or carries a mailto link. - Warn: Mega SEO Analyzer warns when only one of the about and contact links is present. - Fail: Mega Analyzer fails its 'mailto: link or /contact page' row when neither is present; E-E-A-T Analyzer fails when no href matches /contact/i; Mega SEO Analyzer fails when neither about nor contact is linked. - Numbers and lists the tool uses: Mega Analyzer /\/contact/i or a mailto link; Mega SEO Analyzer href /href=["'][^"']*\/contact(?:\/|["'?#])/i; Batch Analyzer any raw href /contact/i together with /about/i (weight 8); E-E-A-T Analyzer any href /contact/i. - Why: Visitors, journalists and engines cannot verify or reach a business that has no contact route. - Fix: Publish a contact page at /contact with an email address and link it from every page. - Verify: [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/). Standard: Google Helpful Content self-assessment. - [ ] **7.17 Contact path: `<email>` `<phone>` `<booking link>`** - Pass: An email address or a phone number is visible on the page, ideally with a calendar booking link. - Warn: About Page Conversion Audit warns when neither email nor phone is visible and again when no booking link is present; Mega Analyzer rates 1 to 2 of 7 contact signals as ok. - Fail: Mega Analyzer rates 0 of 7 contact signals as bad. - Numbers and lists the tool uses: email /\bmailto:|\b[\w.%+-]+@[\w.-]+\.[a-z]{2,}\b/i; phone /\btel:|$\d{3}$\s*\d{3}|\b\d{3}[-.\s]\d{3}[-.\s]\d{4}\b/; booking link /calendly|cal\.com|savvycal|tidycal|acuityscheduling|scheduleonce|youcanbookme|hubspot\.com\/meetings/i (a booking link alone does not pass); Competitor Gap Matrix /tel:\+?\d/i and /<address|\b(street|avenue|blvd)\b/i; Mega Analyzer contact signals out of 7, 3 or more good, 1 ok, 0 bad; live-chat vendors Intercom, Zendesk, Drift, Tidio, Crisp, HelpScout, Tawk, Olark, LiveChat, HubSpot; booking vendors Calendly, Cal.com, SavvyCal, Acuity, HubSpot Meetings, Chili Piper, OnceHub, Stripe Payment Links (both reported as informational). - Why: High-intent visitors who reach the About or contact page need a direct route, and a booking link converts 2 to 3 times better than a bare contact form. - Fix: Show an email address, a tel: phone link and a postal address, and add a calendar booking link for consultations. - Verify: [About-Page Conversion Audit](https://jwatte.com/tools/about-page-conversion-audit/), [Competitor Gap Matrix](https://jwatte.com/tools/competitor-gap-matrix/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **7.18 Contact Info in Schema** - Pass: Any JSON-LD block carries contactPoint, email or telephone. - Fail: E-E-A-T Analyzer fails when none of contactPoint, email or telephone appears in any JSON-LD block. - Numbers and lists the tool uses: keys contactPoint, email, telephone searched recursively through all JSON-LD blocks; Single Site Gen and Site Migration Gen require Organization contactPoint alongside the /contact page. - Why: Structured contact data lets engines confirm the business is reachable without parsing the page. - Fix: Add contactPoint, email or telephone to the Organization node. - Verify: [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/), [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/). Standard: schema.org Organization contactPoint / email / telephone. - [ ] **7.19 Authors or team page** - Pass: The site links to a team, people or authors page. - Fail: Trust Signal Surface Audit fails when neither /authors nor /team returns a page; Mega Analyzer fails its team-link row unless the page carries NewsMediaOrganization, WebApplication, SoftwareApplication, Dataset, DataCatalog or Periodical schema or ProfilePage plus Person, where it is informational; About Page Conversion Audit reports an absent team link as informational. - Numbers and lists the tool uses: Mega Analyzer /\/team|\/people|\/staff|\/leadership|\/founders?/i; Trust Signal Surface Audit fetches /authors and /team; About Page Conversion Audit /\/team|\/people|our team|meet the team/i. - Why: Multi-author publications and businesses with staff should show the people behind the work, each with their own bio. - Fix: Publish a team or authors page and give each person a bio with Person schema and sameAs links. - Verify: [Trust Signal Surface](https://jwatte.com/tools/trust-signal-surface-audit/), [About-Page Conversion Audit](https://jwatte.com/tools/about-page-conversion-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: Google News Initiative trust-project model. - [ ] **7.20 Editorial policy page** - Pass: An editorial policy page exists and is linked. - Warn: E-E-A-T Analyzer reports a missing editorial policy as a warning. - Fail: Trust Signal Surface Audit fails when neither /editorial-policy nor /policies/editorial returns a page. - Numbers and lists the tool uses: Trust Signal Surface Audit paths /editorial-policy, /policies/editorial; E-E-A-T Analyzer href /editorial/i or body text 'editorial policy'. - Why: Without documented editorial standards a site reads as an opinion site rather than an edited publication. - Fix: Publish a one-page editorial policy describing how content is researched, reviewed and updated, and link it from the footer. - Verify: [Trust Signal Surface](https://jwatte.com/tools/trust-signal-surface-audit/), [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/). Standard: Google News Initiative trust-project model. - [ ] **7.21 Corrections policy page** - Pass: A corrections policy page exists at /corrections or /policies/corrections. - Fail: Trust Signal Surface Audit fails when neither /corrections nor /policies/corrections returns a page. - Numbers and lists the tool uses: paths /corrections, /policies/corrections. - Why: News and authority sites are expected to say how errors are reported and fixed. - Fix: Publish a one-page corrections policy and link it from the footer. - Verify: [Trust Signal Surface](https://jwatte.com/tools/trust-signal-surface-audit/). Standard: Google News Initiative trust-project model. - [ ] **7.22 Internal links: pricing, FAQ and content hub** - Pass: The page links to pricing, an FAQ (or carries FAQPage schema) and a blog or content hub. - Warn: Mega Analyzer reports the pricing link as informational only. - Fail: A missing FAQ link (or FAQPage schema) or a missing blog / resources / guides link renders as a failed check in the Mega Analyzer depth rows. - Numbers and lists the tool uses: pricing /\/pric(?:e|ing)|\/plans?|\/cost|\/quote/i; faq /\/faq|\/frequently[- ]asked/i or FAQPage schema; blog href /\/(blog|articles?|insights?|resources|learn|guides?|news|desks?|coverage|briefs?|publications?|stories|topics?|sections?|categor(?:y|ies)|reports?|wire|posts?|essays?|notes?|journal)(\/|$|\?|#)/i or schema type /^(BlogPosting|NewsArticle|Article|Newsletter|TechArticle|ScholarlyArticle|Periodical)$/ or a rel=alternate feed link of type rss+xml, atom+xml or feed+json or links matching /[?&#](?:view|desk|section|topic|category|tab)=/i. - Why: FAQ pages are among the most citable content for answer engines, and a content hub shows ongoing expertise even when it is not at /blog/. - Fix: Link pricing, an FAQ and the content hub from the landing page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: Google Quality Rater Guidelines. - [ ] **7.23 Internal links: careers** - Pass: The page links to a careers page (careers, jobs, hiring or work-with-us path). - Warn: The Mega Analyzer depth row reports the careers link as informational only. - Numbers and lists the tool uses: careers /\/careers|\/jobs|\/hiring|\/work[- ]with[- ]us/i, rendered as informational only. - Why: Open roles are a secondary sign of an established, operating business. - Fix: Add and link a careers page where the business has open roles. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **7.24 Person schema on the page** - Pass: A Person node for the author or owner is present in the JSON-LD. - Warn: SGE Readiness Audit warns when only one of Person schema, Organization schema or a meta[name=author] / [rel=author] element is present (Organization plus a meta author or rel=author passes without Person); E-E-A-T Author Entity Graph warns with 1 to 2 distinct Person entities. - Fail: Mega Analyzer E-E-A-T tab renders a missing Person node as a failed check; E-E-A-T Author Entity Graph fails with 0 Person entities, meaning every article is bylined to an anonymous identity from Google's perspective; SGE Readiness Audit fails with no Person schema, no Organization schema and no meta author. - Numbers and lists the tool uses: E-E-A-T Author Entity Graph counts distinct Persons deduplicated by lowercased name across the root page and crawled author pages, 3 or more good, 1 to 2 warn, 0 fail, falling back to the first rel=author link; captured fields name, url, jobTitle, affiliation, knowsAbout, hasCredential, sameAs, alumniOf, worksFor; Batch Analyzer passes on a Person with name, an organization-subtype node with name, or any author field (weight 12); Mega Batch weight 15; SGE Readiness any schema type /Person/i; Single Site Gen Person fields name, jobTitle, knowsAbout, sameAs, url, image; Schema Fix Bundle emits the author Person as {@type: Person, @id: `<page url>`#author, name, url: `<origin>`/author/`<slug>`/, sameAs: [Wikidata, ORCID, LinkedIn]} referenced by Article, BlogPosting, Recipe, Book and Course. - Why: Google and AI engines resolve bylines to entities; a byline without Person schema is invisible to the E-E-A-T signal chain, and author is a required field for Article-family rich results. - Fix: Add a Person node for the author or owner with name, jobTitle, url, image, knowsAbout and sameAs, and reference it as author on every article. - Verify: [E-E-A-T Author Entity Graph](https://jwatte.com/tools/e-e-a-t-author-entity-graph/), [SGE Readiness Audit](https://jwatte.com/tools/sge-readiness-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega Batch](https://jwatte.com/tools/mega-batch/) and 3 more. Standard: schema.org Person. - [ ] **7.25 Organization schema on the page** - Pass: An Organization node for the publisher or business is present in the JSON-LD. - Warn: SGE Readiness Audit warns when only one of Person schema, Organization schema or a meta[name=author] / [rel=author] element is present; Organization plus a meta author or rel=author passes. - Fail: Mega Analyzer E-E-A-T tab renders a missing Organization node as a failed check; SGE Readiness Audit fails with no Person schema, no Organization schema and no meta author. - Numbers and lists the tool uses: SGE Readiness any schema type /Organization/i, with meta[name="author"] or [rel="author"] counted as author attribution; Mega Batch weight 15. - Why: The Organization node is the publisher identity that engines use to score source credibility. - Fix: Add an Organization node with name, url, logo, sameAs and contact details and reference it as publisher. - Verify: [SGE Readiness Audit](https://jwatte.com/tools/sge-readiness-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega Batch](https://jwatte.com/tools/mega-batch/). Standard: schema.org Organization. - [ ] **7.26 Author byline / authorship: `<n>` of 3 signals** - Pass: At least two of the three authorship signals are present: a visible 'By Firstname Lastname' byline, a rel=author link and a Person author in schema. - Warn: Mega SEO Analyzer warns with exactly one signal; Author Authority per Article warns when no byline element is detected. - Fail: Mega SEO Analyzer fails with zero signals; Mega AEO Analyzer scores 40 out of 100 when no Person schema, meta author or rel=author is found; Trust Signal Surface Audit fails 'Author byline on page' when none of rel=author, itemprop=author or an author class is found. - Numbers and lists the tool uses: Mega SEO Analyzer rel=author /<[^>]+rel=["']?author["']?/i, Person-schema author /"@type"\s*:\s*"Person"/i together with /"author"\s*:/i, byline /\bby\s+[A-Z][a-z]+(?:\s+[A-Z][a-z]+){1,2}\b/ on body text, pass 2, warn 1; Trust Signal Surface Audit /<(?:a|div|span)[^>]*rel=["']author["']|itemprop=["']author["']|class=["'][^"']*author/i; Author Authority per Article selectors [class*="byline"], [class*="author"], [rel="author"], [itemprop="author"] with text under 200 chars, preferring /^by\s/i; Mega AEO Analyzer /"@type":\s*"Person"|<meta[^>]+name=["']author["']|rel=["']author["']/i scores 100 or 40; Single Site Gen bylines link to /about or /author/`<slug>` with Person schema. - Why: Readers and engines need to see who wrote the page; the Quality Rater Guidelines section 2.5.2 asks for clarity of authorship. - Fix: Add a visible 'By [Name] · [Role] · [Date]' line near the headline, link the name to the author page with rel=author, and declare the Person as author in the Article schema. - Verify: [Trust Signal Surface](https://jwatte.com/tools/trust-signal-surface-audit/), [Author Authority per Article](https://jwatte.com/tools/author-authority-per-article/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [Mega AEO Analyzer](https://jwatte.com/tools/mega-aeo-analyzer/) and 1 more. Standard: Google Search Quality Rater Guidelines Section 2.5.2. - [ ] **7.27 rel=author or author-profile link present** - Pass: The byline (or a link element in the head) carries rel=author pointing at the author's profile page. - Warn: Analyzer, Mega Analyzer and Author Authority per Article report a missing rel=author as a warning. - Fail: Mega Analyzer E-E-A-T tab renders a missing rel=author or author-profile link as a failed check on every page. - Numbers and lists the tool uses: selectors link[rel="author"], a[rel="author"], a[rel~=author]; Analyzer /rel=["']?author/gi; Author Authority per Article also accepts a[href*="/author/"], a[href*="/authors/"], a[href*="/contributor"] with non-empty text; Batch Analyzer weight 6; Mega Analyzer editorial-context gate; author page requirements from Author Authority per Article: dedicated /author/`<slug>`/ page with Person schema, sameAs to LinkedIn or an academic profile, a 200+ word bio with credentials and a list of recent posts; its 8-point score buckets at 6 (strong) and 4 (mid-tier). - Why: The rel=author link connects each article to a verified person, which Google E-E-A-T and AI citation engines use to attribute content. - Fix: Link the byline name to a per-author page with rel=author (or add `<link rel="author">` in the head) and give that page Person schema, sameAs links, a 200+ word bio and recent posts. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Author Authority per Article](https://jwatte.com/tools/author-authority-per-article/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/). - [ ] **7.28 Author looks like a CMS default placeholder** - Pass: The article author is a named person or the organization, not a CMS default account. - Fail: The author name matches admin, administrator, webmaster, default, wp-admin, wp_admin, wpadmin, root, test, user or owner. - Numbers and lists the tool uses: author.name /^(?:admin|administrator|webmaster|default|wp[-_]?admin|root|test|user|owner)$/i. - Why: A WordPress or HubSpot factory default author tells engines nobody real is credited. - Fix: Set the author to a real person or to the Organization. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **7.29 article:author, article:published_time, article:modified_time meta** - Pass: Article pages carry the Open Graph article:author, article:published_time and article:modified_time meta tags. - Warn: Mega Analyzer reports a missing article:author as a warning, and a missing article:published_time or article:modified_time (both required) as a separate warning, on pages with Article schema or og:type article. - Numbers and lists the tool uses: meta property article:author, article:published_time, article:modified_time; gate hasArticle or ogType == article. - Why: Social networks and AI crawlers read the article:* meta to attribute authorship and judge freshness. - Fix: Add `<meta property="article:author" content="profile URL">` plus the published and modified time meta on article pages. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: Open Graph article object. - [ ] **7.30 Date apparatus: datePublished=<yes/no>, dateModified=<yes/no>** - Pass: The page's JSON-LD carries both datePublished and dateModified. - Warn: Mega SEO Analyzer warns when only one of the two dates is present; Mega Analyzer marks a missing dateModified as a warning on editorial sites and optional on service-business sites; Mega AEO Analyzer scores dateModified alone at 65 (warn band 60 to 79); SGE Readiness Audit warns when time elements exist but none holds a parseable date. - Fail: Mega SEO Analyzer fails with neither date; E-E-A-T Analyzer fails when no datePublished exists; SGE Readiness Audit fails with no schema date, itemprop date or time[datetime]; Mega Analyzer fails an editorial or Article page with neither date and its E-E-A-T tab renders a missing dateModified as a failed check on every page. - Numbers and lists the tool uses: Mega Analyzer reads the first datePublished, dateModified and author.url on nodes typed /Article|BlogPosting|NewsArticle|FAQPage|WebPage|ProfilePage|AboutPage|ContactPage|CollectionPage|WebSite|Organization/ (first element when author is an array; author.url is extracted but not checked); Mega SEO Analyzer /"datePublished"\s*:/i and /"dateModified"\s*:/i; Analyzer /"dateModified"/ in any block; SGE Readiness /"date(Published|Modified|Created)"/ or [itemprop="datePublished"], [itemprop="dateModified"] or time[datetime] with ISO prefix /^\d{4}-\d{2}/; Author Authority per Article reads [itemprop="datePublished"], meta[property="article:published_time"], time[datetime] (missing = warn) and [itemprop="dateModified"], meta[property="article:modified_time"] (missing = info); Mega AEO Analyzer base 30, +35 for /"dateModified":\s*"([^"]+)"/i, +15 for datePublished, +20 for body /\bas of \d{4}|updated [A-Z][a-z]+ \d{4}|last updated/i, pass at 80; Batch Analyzer /"dateModified"/ weight 6 (GEO and AEO buckets) and 5 (E-E-A-T bucket), both dates weight 6 (schema bucket). - Why: Discover, AI Overviews and answer engines rank fresh content higher and need machine-readable dates to judge it. - Fix: Add datePublished and dateModified (ISO dates) and an author with url to the Article or WebPage node, and keep dateModified current when the page changes. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [SGE Readiness Audit](https://jwatte.com/tools/sge-readiness-audit/), [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Author Authority per Article](https://jwatte.com/tools/author-authority-per-article/) and 4 more. Standard: schema.org datePublished / dateModified. - [ ] **7.31 Visible "Updated on [date]" stamp in page body** - Pass: The visible page text (including the footer) carries an updated, last updated, last modified or reviewed phrase followed by a date. - Warn: Mega Analyzer crawl check (editorial context only), E-E-A-T Analyzer and Trust Signal Surface Audit report a missing stamp as a warning. - Fail: Mega Analyzer E-E-A-T tab renders a missing stamp as a failed check on every page; Trust Signal Surface Audit's separate 'dateModified visible on page' row fails when neither a `<time datetime>` nor a class containing date, updated or modified is present. - Numbers and lists the tool uses: regex /\b(updated|last\s+updated|last\s+modified|reviewed)\s*(on|:)?\s*([A-Z][a-z]+\s+\d{1,2},?\s+20\d{2}|\d{4}-\d{2}-\d{2})\b/i (Batch Analyzer E-E-A-T bucket omits 'reviewed', weight 4; AEO bucket weight 5); Trust Signal Surface Audit separate row 'dateModified visible on page' /<time[^>]*datetime|class=["'][^"']*(date|updated|modified)/i (fail when missing); Mega AEO Analyzer adds 20 points for /\bas of \d{4}|updated [A-Z][a-z]+ \d{4}|last updated/i; Mega Analyzer crawl check editorial-context gate, E-E-A-T tab row ungated. - Why: Crawlers that extract text without parsing JSON-LD still pick up a visible freshness cue. - Fix: Render a visible 'Last updated: Month DD, YYYY' line at the top or bottom of evergreen pages and keep it in sync with dateModified. - Verify: [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Trust Signal Surface](https://jwatte.com/tools/trust-signal-surface-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/) and 1 more. - [ ] **7.32 Content is fresh** - Pass: The page was updated within the last 90 days according to its modified or published date. - Warn: 91 to 365 days since the date is reported as possibly stale; over 365 days as outdated. - Fail: No parseable date at all is reported as informational (no freshness signal). - Numbers and lists the tool uses: 90 days pass; 365 days stale boundary; date sources meta[property=article:modified_time], meta[name=article:modified_time], meta[property=article:published_time], then the first time[datetime]. - Why: Google may deprioritize content that has not been touched in a year. - Fix: Review and update evergreen pages, then bump article:modified_time and dateModified. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **7.33 HTML `<cite>` or `<blockquote cite="...">` markup used (`<n>`)** - Pass: At least one `<cite>` element or blockquote with a cite attribute is present (Mega SEO Analyzer wants 2 or more). - Warn: Mega Analyzer warns when blockquotes exist but none is cited; Mega SEO Analyzer warns with exactly one cite marker. - Fail: Mega Analyzer E-E-A-T tab fails when blockquotes exist but none is cited; when the page has no blockquotes at all, a missing cite is reported as informational, not a failure. - Numbers and lists the tool uses: Mega Analyzer and Batch Analyzer citeElements + blockquoteCited >= 1 (Batch weight 6 AEO bucket, 4 E-E-A-T bucket); Mega SEO Analyzer /<cite\b|<blockquote[^>]+cite=/gi, pass 2, warn 1, info 0, alongside outbound link count /<a [^>]+href=["']https?:\/\/[^"']+["']/gi. - Why: Machine-readable citation markup makes claims verifiable and raises source-quality scores in answer engines. - Fix: Wrap source names in `<cite>` and add cite="`<url>`" on every blockquote. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/). Standard: HTML cite element. - [ ] **7.34 Data-source attribution** - Pass: Statistics on the page are introduced with explicit sourcing phrases such as 'according to' or 'source:'. - Warn: The Mega Analyzer specificity row reports a missing attribution as informational. - Numbers and lists the tool uses: /\b(according\s+to|source\s*:|data\s+from|as\s+reported\s+(?:by|in)|cited\s+(?:by|in)|per\s+(?:the\s+)?(?:\w+\s+){1,3}report)\b/i. - Why: Transparent sourcing supports trustworthiness and makes numbers citable. - Fix: Say where each number comes from next to the number. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **7.35 Authoritative Data Sources Cited** - Pass: The body text references authoritative research or government data sources at least twice. - Warn: Exactly one such reference is reported as few data citations. - Fail: No such reference at all is reported as No Data Source Citations (fail). - Numbers and lists the tool uses: /(pubmed|doi\.org|census\.gov|bls\.gov|harvard|stanford|ncbi|\.edu\/|research\.)/gi on body text; pass 2 or more, warn 1. - Why: Citing primary research and government data shows the expertise behind the claims. - Fix: Cite PubMed, DOI.gov or .edu sources for the facts on the page. - Verify: [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/). - [ ] **7.36 Links to Authoritative Domains** - Pass: The page links to .gov.edu, DOI or PubMed sources at least three times. - Warn: One or two such links are reported as few authoritative outbound links. - Fail: No links to .gov.edu, DOI or PubMed is reported as No Links to Authoritative Domains (fail). - Numbers and lists the tool uses: /\.(gov|edu)\b|doi\.org|pubmed/i on hrefs; pass 3 or more, warn 1 to 2. - Why: Outbound links to authoritative domains build the page's own authoritativeness. - Fix: Link the claims on the page to their .gov.edu, DOI or PubMed sources. - Verify: [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/). - [ ] **7.37 Citation density, `<n>` outbound links to external sources** - Pass: The page has at least five outbound links to hostnames other than its own (Analyzer accepts one). - Warn: SGE Readiness Audit warns with 2 to 4 outbound links. - Fail: SGE Readiness Audit fails with fewer than 2 outbound links; Analyzer reports 0 external links as informational. - Numbers and lists the tool uses: SGE Readiness a[href^="http"] whose hostname differs from the page, pass 5, warn floor 2; Analyzer external http(s) anchors to other hostnames, pass 1. - Why: Pages that cite external sources show research depth, which AI systems treat as a credibility signal. - Fix: Add outbound citations to primary and authoritative sources. - Verify: [SGE Readiness Audit](https://jwatte.com/tools/sge-readiness-audit/), [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **7.38 Credentials Mentioned** - Pass: The visible text mentions degrees, certifications or licenses at least twice. - Warn: One credential term is reported as minimal; About Page Conversion Audit warns when no credential is detected. - Fail: E-E-A-T Analyzer fails with no credential term at all. - Numbers and lists the tool uses: E-E-A-T Analyzer /(phd|ph\.d|m\.s\.|mba|certified|licensed|accredited|board.certified)/gi on lowercased body text, pass 2, warn 1, fail 0; About Page Conversion Audit /\b(phd|ph\.d|mba|md|jd|bs|ba|ms|ma|cfa|cpa|cissp|cism|cissp|pe|license|certification|certified|accredited|alumni|graduate|attended)\b/i on raw HTML, pass or warn. - Why: Qualifications shown in the copy are how readers and raters judge expertise. - Fix: Name relevant degrees, certifications and licenses near the author's photo or in the bio, leaving out filler credentials. - Verify: [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [About-Page Conversion Audit](https://jwatte.com/tools/about-page-conversion-audit/). - [ ] **7.39 Credentials (hasCredential on Person)** - Pass: At least one Person entity carries a hasCredential entry. - Warn: Zero credentials across all Person entities is reported as a warning. - Numbers and lists the tool uses: any hasCredential entry; +5 author-entity score per credential; Single Site Gen credential properties alumniOf, worksFor, educationalCredentialAwarded, award. - Why: Credentials on the Person entity feed the E-E-A-T signal chain in machine-readable form. - Fix: Add hasCredential (EducationalOccupationalCredential or Certification) with recognizedBy, plus alumniOf, worksFor and award, to each author's Person node. - Verify: [E-E-A-T Author Entity Graph](https://jwatte.com/tools/e-e-a-t-author-entity-graph/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/). Standard: schema.org hasCredential, EducationalOccupationalCredential. - [ ] **7.40 Person Schema with jobTitle** - Pass: A jobTitle value exists somewhere in the JSON-LD. - Fail: No jobTitle anywhere in the JSON-LD is reported as No jobTitle in Schema (fail). - Numbers and lists the tool uses: key jobTitle searched recursively; first value shown. - Why: A job title on the Person node states the professional role behind the content. - Fix: Add jobTitle to the Person schema. - Verify: [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/). Standard: schema.org Person jobTitle. - [ ] **7.41 knowsAbout Topics Listed** - Pass: The Person schema lists at least three knowsAbout topics. - Warn: E-E-A-T Analyzer warns with 1 to 2 topics; E-E-A-T Author Entity Graph warns with 0 topics across all Person entities. - Fail: E-E-A-T Analyzer fails with no knowsAbout in the schema. - Numbers and lists the tool uses: E-E-A-T Analyzer flattened knowsAbout values, pass 3, warn 1, detail shows first 5; E-E-A-T Author Entity Graph any topic, shows first 6 at 40 chars. - Why: Breadth of declared topics shows depth of expertise, and topics that match the article subject are the stronger signal. - Fix: Add a knowsAbout array to the Person schema listing the expert topics that match what the site writes about. - Verify: [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [E-E-A-T Author Entity Graph](https://jwatte.com/tools/e-e-a-t-author-entity-graph/). Standard: schema.org Person knowsAbout. - [ ] **7.42 `<n>` sameAs URLs (>=3 recommended)** - Pass: The Person or Organization schema carries a sameAs array with at least three off-site profile URLs. - Warn: E-E-A-T Analyzer warns with 1 to 2 sameAs URLs; Mega Analyzer reports fewer than 3 as informational; Mega GEO Analyzer scores exactly 3 links at 75 (warn); E-E-A-T Author Entity Graph warns when the total across all Person entities is below 6; Analyzer and Mega SEO Analyzer warn when no sameAs exists at all. - Fail: E-E-A-T Analyzer fails with 0 sameAs; Mega GEO Analyzer scores 0 to 2 links at 0, 25 or 50 (fail under 60). - Numbers and lists the tool uses: Analyzer any JSON-LD block containing 'sameAs'; Mega SEO Analyzer /"sameAs"\s*:\s*\[/i; Batch Analyzer /sameAs/i weight 12, 3 or more links weight 8, 6 or more weight 4; Mega Batch unique sameAs from a JSON-LD walk, 3 or more weight 15, 6 or more weight 5; E-E-A-T Analyzer flattened sameAs pass 3, warn 1; Mega Analyzer 3, showing up to 8; Mega GEO Analyzer counts sameAs on the first LocalBusiness or Organization node, score = count x 25 capped at 100, 4 or more passes; E-E-A-T Author Entity Graph total sameAs across Person entities 6, persons with 2 or more sameAs counted as externally bound; Single Site Gen and Site Migration Gen 3 or more of LinkedIn, Wikidata, ORCID, GitHub, X, Crunchbase; E-E-A-T Generator universal profiles: Google Business Profile, LinkedIn personal, LinkedIn company, Facebook, Instagram, X / Twitter, YouTube, Wikidata QID, Bing Places, Yelp, BBB; industry-gated: Amazon Author Central and Goodreads (author), ORCID (author, medical, education), Zillow and Realtor.com (real estate), TripAdvisor (hotel, restaurant), Booking.com (hotel), OpenTable (restaurant), Healthgrades and Zocdoc (medical, dental), Avvo and Justia (legal), SpareFoot (storage), Houzz and Thumbtack (home services), Psychology Today (recovery, medical), SAMHSA (recovery). - Why: SameAs tells engines the entity on the site is the same entity on LinkedIn, Wikidata, Google Business Profile and the rest, and AI search computes entity confidence by traversing those links. - Fix: Add a sameAs array to the Person or Organization node with at least three, ideally six or more, full profile URLs: Google Business Profile, LinkedIn, Wikidata, the industry directory, and the social profiles the business actually maintains. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [E-E-A-T Author Entity Graph](https://jwatte.com/tools/e-e-a-t-author-entity-graph/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/) and 7 more. Standard: schema.org sameAs. - [ ] **7.43 Wikidata reference detected** - Pass: A Wikidata item for the business or person exists and its URL appears in sameAs or the page HTML. - Warn: Analyzer and Mega SEO Analyzer report a missing Wikidata reference as a warning; Mega Analyzer's E-E-A-T tab reports it as informational. - Fail: E-E-A-T Analyzer fails with no Wikidata reference; Batch Analyzer and Mega Batch withhold weight 12; E-E-A-T Generator marks the action item missing until a QID is entered. - Numbers and lists the tool uses: regex /wikidata\.org/i on sameAs or HTML (E-E-A-T Analyzer /wikidata/i on sameAs plus substring 'wikidata.org'); E-E-A-T Analyzer Knowledge Panel Readiness is High only with overall score 75 or more, a Wikidata reference and 3 or more sameAs, Medium at 50; E-E-A-T Generator Wikidata statements: business instance of P31 = business Q4830453, country P17 = United States Q30, official website P856, industry P452, inception P571, founded by P112; person P31 = human Q5, occupation P106, citizenship P27, website P856, employer P108; book P31 = book Q571, author P50, publication date P577, title P1476; snippet "sameAs": "https://www.wikidata.org/wiki/Q[YOUR_QID]"; add descriptions in more than one language. - Why: Wikidata is the number one feed into Google's Knowledge Graph and a Knowledge Panel trigger, though it matters most for entities that meet notability. - Fix: Create the Wikidata item (label, description, aliases, the property statements above, descriptions in several languages), note the Q-number and add its URL to sameAs. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/) and 4 more. Standard: Wikidata. - [ ] **7.44 ORCID reference detected** - Pass: An orcid.org profile URL appears in sameAs or the page HTML (applies to academic and research authors). - Fail: Analyzer and E-E-A-T Analyzer report a missing ORCID as informational; Batch Analyzer and Mega Batch withhold weight 8 and 5. - Numbers and lists the tool uses: regex /orcid\.org/i; ORCID record must be PUBLIC, list the employer and the site domain; snippet "sameAs": "https://orcid.org/0000-0002-XXXX-XXXX"; E-E-A-T Generator shows the ORCID field only for author, medical and education industries; Batch Analyzer methodology gives Wikidata and ORCID 20 points combined. - Why: ORCID is a free researcher ID that signals intellectual credibility for academic authors. - Fix: If the author publishes research, register at orcid.org, set the record public, and add the ORCID URL to sameAs. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [E-E-A-T Generator](https://jwatte.com/tools/eeat-generator/) and 3 more. Standard: ORCID. - [ ] **7.45 LinkedIn Profile Linked** - Pass: A LinkedIn /in/ or /company/ profile URL appears in sameAs (or in the page links). - Fail: E-E-A-T Analyzer fails with no LinkedIn reference in sameAs or page links; Schema Validator reports a missing LinkedIn sameAs as an informational row. - Numbers and lists the tool uses: Schema Validator /linkedin\.com\/(in|company)\//i on sameAs of nodes typed /^(Person|Organization|LocalBusiness|Corporation|RealEstateAgent|Attorney|Dentist|Physician|FinancialService|InsuranceAgency|AccountingService)$/ with a non-empty sameAs; E-E-A-T Analyzer /linkedin/i on sameAs or any href; E-E-A-T Generator personal profile headline '[Title] at [Company]', company as current Experience, website in Contact Info, URL https://www.linkedin.com/in/yourname/; company page with exact business name, website, industry, size, description matching Wikidata, logo and banner, 2 to 3 updates posted. - Why: LinkedIn is the most-crawled professional identity directory and the canonical cross-reference for B2B entity reconciliation. - Fix: Complete the personal and company LinkedIn pages and add both URLs to sameAs. - Verify: [Schema Validator](https://jwatte.com/tools/schema-validator/), [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [E-E-A-T Generator](https://jwatte.com/tools/eeat-generator/). - [ ] **7.46 Strong Social Presence** - Pass: At least three social platforms are linked from sameAs or page links (Batch Analyzer needs two references). - Warn: E-E-A-T Analyzer warns with 1 to 2 platforms. - Fail: E-E-A-T Analyzer fails with 0 social links; Batch Analyzer withholds weight 15 below 2 matches. - Numbers and lists the tool uses: E-E-A-T Analyzer platforms facebook.com, twitter.com, x.com, youtube.com, instagram.com, pass 3, warn 1; Batch Analyzer /facebook\.com|twitter\.com|x\.com|linkedin\.com|instagram\.com|youtube\.com|tiktok\.com/gi, 2 or more, weight 15; E-E-A-T Generator Instagram: professional Business account connected to a Facebook Page, same logo, exact business name, at least 3 posts before adding to schema; TikTok: Business account, website link needs 1,000+ followers or a Business account. - Why: Social profiles corroborate identity across platforms and double as sameAs anchors. - Fix: Set up business profiles on the platforms you will maintain, use the exact business name and logo, and link them from the page and sameAs. - Verify: [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/), [E-E-A-T Generator](https://jwatte.com/tools/eeat-generator/). - [ ] **7.47 `<n>` rel='me' identity links** - Pass: The page carries rel="me" links to the owned profiles (E-E-A-T Analyzer and Batch Analyzer want at least two). - Warn: Analyzer warns with 0 rel=me links; E-E-A-T Analyzer warns with exactly one. - Fail: E-E-A-T Analyzer fails with 0 rel=me links. - Numbers and lists the tool uses: Mega Analyzer link[rel~="me"], a[rel~="me"] (token match), relMe > 0; Batch Analyzer and Mega Batch link[rel="me"], a[rel="me"]; Analyzer and E-E-A-T Analyzer count `<link>` elements whose rel is exactly me; Analyzer relMe > 0; Mega Batch relMe > 0 weight 8; E-E-A-T Analyzer pass 2, warn 1, fail 0; Batch Analyzer 2 or more, weight 8; Single Site Gen spec: rel="me" links in `<head>` pointing to the same profiles; E-E-A-T Generator emits one `<link rel="me" href="<url>">` per entered profile in this key order: google, linkedin, linkedin_co, facebook, instagram, twitter, youtube, wikidata, bing, yelp, bbb, amazon_author, goodreads, orcid, zillow, realtor, tripadvisor, booking, opentable, healthgrades, zocdoc, avvo, justia, sparefoot, houzz, thumbtack, psychtoday, samhsa; Monoclone Generator base layout adds one rel=me link per site in the network. - Why: Rel=me is the IndieWeb identity link that verifies the same person or business owns each profile, closing a loop engines can crawl. - Fix: Add `<link rel="me" href="...">` in the head for each owned profile (and each owned site), matching the sameAs list. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [E-E-A-T Generator](https://jwatte.com/tools/eeat-generator/) and 4 more. Standard: IndieWeb rel=me; HTML rel=me link relation. - [ ] **7.48 Entity anchors (KG)** - Pass: The Person, Organization or vertical entity node carries at least three Knowledge Graph reconciliation anchors and no binding defects. - Warn: 1 to 2 anchors is amber; a fragment @id without a slash is flagged SLASH. - Fail: In priority order: an unresolved bind reference (GSC TYPE), a date-only value (GSC DATE), duplicate inline entities or conflicting @ids (DUP @id), more than one page-type node (DILUTION), an inline page-type mainEntityOfPage (PHANTOM MEP), an anonymous author or publisher Organization (ANON ORG), HTML entities inside JSON-LD (HTML ENT), HTML-encoded ampersands in sameAs (& BUG), or zero anchors (NONE). - Numbers and lists the tool uses: anchors counted (entityAnchorCount): Google kgmid /[?&]kgmid=\/[gm]\/\w+/, Google Maps cid /google\.com\/maps\?cid=\d+/ or /maps\.app\.goo\.gl\//, Google Business Profile /share\.google\// or /g\.page\// or /business\.google\.com\// or a Maps cid, LinkedIn /linkedin\.com\/(in|company)\//, Wikidata, Gravatar /(?:^|\/\/)(?:[a-z0-9.-]+\.)?gravatar\.com\/(?!avatar\/)[A-Za-z0-9._-]+/i, all tested against the joined sameAs list, plus an identifier PropertyValue with propertyID /kgmid|googleKgmid|knowledgeGraph/i (counted only when no kgmid sameAs) and propertyID /googlePlaceId|placeId/i; dual-typed Person plus vertical type, @id merged across blocks, mainEntityOfPage, ProfilePage, ItemList and hasMap are listed in the detail line but do not add to the count; 3 anchors green, 1 amber; N/A when no Person, Organization or vertical entity; E-E-A-T bucket weights: Person 12, Organization 12, sameAs 3 or more 15, 6 or more 5, Wikidata 10, ORCID 5, kgmid 2, Maps cid or GBP 1, no circular sameAs 1, Gravatar 1, no duplicate inline entities 1, no @id conflicts 1. - Why: AI search pipelines need something to bind the name to this URL against; a real estate agent site lost AI Mode citations for the operator's own name after a schema cleanup removed these cross-references. - Fix: Fix the flagged binding defect first, then add the kgmid, Maps cid, Business Profile share link, LinkedIn, Wikidata, Gravatar and industry directory URLs to sameAs. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **7.49 Google Knowledge Graph kgmid linked** - Pass: The entity's Google Knowledge Graph id is carried as a kgmid sameAs URL or as an identifier PropertyValue (a Google Place ID identifier also counts as an anchor). - Warn: Mega Analyzer reports an absent kgmid as informational. - Numbers and lists the tool uses: sameAs https://www.google.com/search?kgmid=/g/...; identifier [{@type: PropertyValue, propertyID matching /kgmid|googleKgmid|knowledgeGraph/i, value /g/...}] (adds 1 anchor only when no kgmid sameAs) and propertyID /googlePlaceId|placeId/i (adds 1 anchor). - Why: The kgmid is the strongest single Knowledge Graph reconciliation signal. - Fix: Find the entity's kgmid from its Knowledge Panel share link and add it as a sameAs URL and/or an identifier PropertyValue, alongside a googlePlaceId identifier for local businesses. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org PropertyValue. - [ ] **7.50 Circular self-reference in sameAs** - Pass: No sameAs entry resolves to the page's own origin. - Numbers and lists the tool uses: own origin derived from canonical or og:url; origin plus pathname compared with trailing slashes collapsed; circularSameAsCount must be 0. - Why: SameAs must point to other canonical profiles of the same entity; the site's own URL there is noise that weakens the cross-reference signal. - Fix: Remove the site's own URL from sameAs (keep it in url) and replace it with real off-site profiles. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **7.51 HTML-encoded ampersands in sameAs URLs (subset): `<n>`** - Pass: No sameAs URL contains an HTML-encoded ampersand. - Numbers and lists the tool uses: sameAsHtmlEncodedCount must be 0; gated on a Person or Organization node. - Why: Google's Knowledge Graph crawler tries to follow sameAs URLs, so an & inside one breaks the link. - Fix: Emit JSON-LD without template autoescaping so sameAs URLs come out raw. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org sameAs. - [ ] **7.52 mainEntityOfPage on Person/Org: object @id pointing at a ProfilePage** - Pass: MainEntityOfPage on the Person or Organization node is an object @id that references a ProfilePage block on the page. - Warn: An object @id that does not point at a ProfilePage is reported as informational (add a ProfilePage block with a matching @id); a missing mainEntityOfPage is also informational, reported as MISSING with the suggested {"@id":"`<bio-page>`/#profilepage"} form. - Fail: A string URL form (weak binding). - Numbers and lists the tool uses: recommended form {"@id":"`<page>`/#profilepage"} paired with a ProfilePage block with a matching @id; gated on a Person or Organization node. - Why: The object @id form pointing at a ProfilePage is the strongest AI Mode binding between the entity and its page. - Fix: Change mainEntityOfPage to the {"@id":"`<page>`/#profilepage"} object form and add a ProfilePage block with that @id. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org mainEntityOfPage, ProfilePage. - [ ] **7.53 ProfilePage rich-result type declared: yes / no** - Pass: The page's JSON-LD declares a ProfilePage node (only the type is tested; the suggested shape is mainEntity {"@id":"<Person @id>"}). - Numbers and lists the tool uses: hasProfilePage = schemaTypes includes ProfilePage; gated on a Person or Organization node. - Why: Person or Organization alone are not rich-result eligible; ProfilePage makes the bio page eligible for Google's profile-page rich result. - Fix: Add @type ProfilePage with mainEntity {"@id":"<Person @id>"} on the bio page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: Google Profile Page structured data; schema.org ProfilePage. - [ ] **7.54 Anonymous author/publisher Organization in Article/NewsArticle: `<n>`** - Pass: Every author and publisher on Article, BlogPosting, NewsArticle, Recipe and Review nodes is an @id reference, not an inline Organization without an @id. - Numbers and lists the tool uses: anonAuthorPublisherCount must be 0; node types checked /^(Article|BlogPosting|NewsArticle|Recipe|Review)$/; an author or publisher object typed /Organization|NewsMediaOrganization/ with no @id counts; gated on a Person or Organization node. - Why: An inline Organization in author or publisher creates a phantom anonymous sibling of the canonical site Organization. - Fix: Replace the inline Organization with a {"@id":"`<site>`/#organization"} reference. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org Article, NewsArticle, Organization. - [ ] **7.55 Review / AggregateRating schema** - Pass: First-party testimonials on the page are backed by Review or AggregateRating JSON-LD (with reviewCount), or the page has no testimonials, is a publication or app, or shows borrowed third-party reviews where markup would be a spam risk. - Warn: GBP Review Audit warns when no reviews or testimonials are shown on the page, and flags an aggregateRating on the business's own node; Mega SEO Analyzer reports no review or testimonial signal as informational. - Fail: Mega Analyzer fails when visible testimonial sections have no Review or AggregateRating JSON-LD; Mega GEO Analyzer scores Review signals under 60 when no reviews are shown and few review profiles are linked. - Numbers and lists the tool uses: Mega Analyzer passes when Review or AggregateRating is in schemaTypes; renders a Not applicable pass when no element matches [class*="testimonial" i], [class*="review" i], blockquote (a blockquote whose `<cite>` tokens all appear in one JSON-LD Person or Organization name is excluded as a self-quote), when a NewsMediaOrganization, WebApplication, SoftwareApplication, Dataset, DataCatalog or Periodical type is present, or when the body text matches /\b(google review|verified google|yelp review|trustpilot|tripadvisor|facebook review|bbb review)\b/; GBP Review Audit passes on visible review or testimonial wording, a review widget or Review items with text; Mega GEO Analyzer Review signals base 20, +35 reviews shown, +25 for two or more review profiles linked (+15 for one), +20 leave-a-review link, nothing for aggregateRating on the business's own node, pass at 80, warn at 60; Mega SEO Analyzer /"@type"\s*:\s*"(Review|AggregateRating)"|\btestimonial\b/i; Competitor Gap Matrix /"@type"\s*:\s*"(Review|AggregateRating)"/i as one of five trust tests; Single Site Gen and Site Migration Gen require Review or AggregateRating. - Why: Structured ratings on a product, app, book or course can earn review stars and let AI search cite 'rated X by N customers'. A business's own LocalBusiness or Organization markup cannot earn stars, and ratings copied from other sites are not allowed. - Fix: Mark up real first-party reviews of things you sell, never inflated and never copied from Google or Yelp. For the business itself, show reviews as text and link to your review profiles. - Verify: [GBP + Review Signal Audit](https://jwatte.com/tools/gbp-review-audit/), [Competitor Gap Matrix](https://jwatte.com/tools/competitor-gap-matrix/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/) and 3 more. Standard: Google rich-results spam policy; schema.org Review / AggregateRating. - [ ] **7.56 Review-platform outbound links** - Pass: The page links to at least one third-party review platform profile, and GBP Review Audit wants Google plus at least one more platform. - Warn: GBP Review Audit warns with fewer than two platforms linked; Trust Signal Surface Audit warns when the homepage links no external review platform; E-E-A-T Analyzer reports a missing BBB reference as informational. - Fail: Mega Analyzer rates zero review-platform links as bad. - Numbers and lists the tool uses: Mega Analyzer hosts g2.com, capterra.com, trustpilot.com, bbb.org, producthunt.com, glassdoor.com, clutch.co, gartner.com, softwareadvice.com, getapp.com, reviews.google; GBP Review Audit counts Google (/search\.google\.com\/local\/writereview|google\.com\/maps\/place|maps\.app\.goo\.gl|g\.page/i), Yelp /yelp\.com\/biz/i, BBB /bbb\.org\//i, Facebook /facebook\.com\/[^"'\/]+\/?(reviews|recommendations)?/i, pass at 2 or more; Trust Signal Surface Audit /(trustpilot\.com|bbb\.org|g2\.com|capterra\.com)/i on the homepage; E-E-A-T Analyzer 'bbb.org' in body or href; suggested pairings: Yelp + BBB + Healthgrades for medical, Yelp + Angi + HomeAdvisor for trades, Yelp + TripAdvisor + OpenTable for restaurants. - Why: Outbound links to review profiles corroborate reputation and are the aggregator signal AI and search engines weight. - Fix: Link the Google review profile plus at least one vertical platform (Yelp, BBB, Facebook, Healthgrades, Avvo, Angi, G2 or Capterra) from the homepage. - Verify: [GBP + Review Signal Audit](https://jwatte.com/tools/gbp-review-audit/), [Trust Signal Surface](https://jwatte.com/tools/trust-signal-surface-audit/), [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **7.57 Google review URL linked from site** - Pass: The site links to its Google review, Maps place or g.page short link. - Warn: No link is reported as 'No Google leave-a-review short-link'. - Numbers and lists the tool uses: /search\.google\.com\/local\/writereview|google\.com\/maps\/place|maps\.app\.goo\.gl|g\.page/i on the raw HTML. - Why: The Google short link is the entry point for gathering the reviews that feed the Business Profile signal. - Fix: Generate a g.page/r/... link in Google Business Profile and link it from the site, every invoice, receipt and post-service email, with a same-day text request after service. - Verify: [GBP + Review Signal Audit](https://jwatte.com/tools/gbp-review-audit/). - [ ] **7.58 "Leave a review" CTA in body** - Pass: The body text asks visitors to leave or write a review. - Warn: No call to action is reported as a warning. - Numbers and lists the tool uses: /leave (?:us )?a review|write a review|share your experience|rate us|review us/i. - Why: A visible review call to action lifts review conversion. - Fix: Add a 'Leave us a Google review' block to the homepage footer, the contact page and the thank-you page. - Verify: [GBP + Review Signal Audit](https://jwatte.com/tools/gbp-review-audit/). - [ ] **7.59 Rating visible / Rating >= 4.2** - Pass: A star rating renders for the business and it is at least 4.2. - Fail: No rating at all (the listing needs its first reviews) or a rating below 4.2, both critical. - Numbers and lists the tool uses: rating regexes /(\d\.\d)\s*$/ and /(\d\.\d)\s*★/ on whitespace-collapsed text; threshold 4.2 (Google Maps Audit); E-E-A-T Generator cites 4.5+ average with 50+ reviews as the level that lifts local pack visibility. - Why: A listing with no rating or a low one cannot compete for the map pack. - Fix: Gather first reviews so a rating renders, then keep it above 4.2 by asking every satisfied customer and resolving complaints. - Verify: [Google Maps](https://jwatte.com/tools/google-maps-audit/), [E-E-A-T Generator](https://jwatte.com/tools/eeat-generator/). - [ ] **7.60 >= 20 reviews / Aim for 50+ Google reviews (currently `<n>`)** - Pass: The Google Business Profile shows at least 20 reviews, with 50 or more as the target. - Warn: Google Maps Audit warns with fewer than 20 reviews. - Fail: E-E-A-T Generator marks the action item missing below 50 reviews. - Numbers and lists the tool uses: review count regex /\(([\d.]+)$|([\d.]+)\s+Google reviews/; 20 (Google Maps Audit); 50 (E-E-A-T Generator), 50+ reviews with a 4.5+ average cited for measurably higher local pack visibility. - Why: Google factors in review quantity, rating, recency and velocity when ranking local businesses. - Fix: Run a post-service review request workflow until the Google count passes 50. - Verify: [Google Maps](https://jwatte.com/tools/google-maps-audit/), [E-E-A-T Generator](https://jwatte.com/tools/eeat-generator/). - [ ] **7.61 Social proof: testimonial block, case-study link, customer logo strip** - Pass: The page shows two or more testimonials, links to a case study or customer story, and carries a customer logo strip or 'trusted by' wording. - Warn: E-E-A-T Analyzer warns with exactly one case-study or testimonial phrase; the Mega Analyzer social-proof rows report absence as informational. - Fail: E-E-A-T Analyzer fails with zero case-study or testimonial phrases. - Numbers and lists the tool uses: testimonial block blockquote, [class*="testimonial" i], [class*="quote" i] count 2 or more; case study href /(case[-_ ]?stud|customer[-_ ]?stor|success[-_ ]?stor|client[-_ ]?stor)/i or paths /case-studies/, /customer-stories/, /success-stories/; logo strip [class*="logo" i][class*="strip" i], [class*="customer" i][class*="logo" i], [aria-label*="customer" i][aria-label*="logo" i] or body /\b(trusted by|used by|customers include|as used at)\b/i; E-E-A-T Analyzer /(case study|testimonial|client|customer review)/gi pass 2, warn 1. - Why: Case studies, testimonials and customer logos demonstrate real-world experience, calibrated against high-signal sites such as Stripe, Linear and Notion. - Fix: Add at least two testimonials, a case-study page and a customer logo strip. - Verify: [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **7.62 Award / recognition signal** - Pass: The Organization node lists an award or the body text names a recognition. - Warn: The Mega Analyzer social-proof row reports absence as informational; E-E-A-T Generator marks the credentials and awards item missing until the awards field is filled. - Numbers and lists the tool uses: /\b(winner of|1st place|first place|voted best|#1\s+(?:ranked|rated|in)|featured (?:in|on)|as seen (?:in|on)|award[- ]?winning|recognized by|top[- ](?:10|25|50|100)\b|inc\.?\s*5000|fast\s?company|forbes\s+(?:\d{2,4}|best|top)|y\s?combinator|techcrunch\s+disrupt|product\s?hunt\s+#\d|hackathon)/i or Organization.award entries. - Why: Recognition is an E-E-A-T authority indicator. - Fix: Add award to the Organization node and name real recognitions on the page, adding new credentials, awards and publications as they are earned. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [E-E-A-T Generator](https://jwatte.com/tools/eeat-generator/). Standard: schema.org award. - [ ] **7.63 Press / "as seen in" block detected** - Pass: The page has a press or as-seen-in section or names a major outlet that covered the business. - Warn: About Page Conversion Audit warns when no press section is detected; Mega SEO Analyzer reports it as informational. - Numbers and lists the tool uses: Mega SEO Analyzer /as seen in|featured in|press|media kit/i; About Page Conversion Audit /as.?seen.?(in|on)|featured.?(in|on)|press.?mentions|media.?(coverage|mentions)|in the news|covered by|(\bforbes|bloomberg|wsj|techcrunch|fast.?company|nyt|new york times|inc|entrepreneur|wired|reuters)\b/i. - Why: Even one credible third-party logo lifts About page conversion 5 to 15 percent. - Fix: When real third-party coverage exists, add a press block with logos linked to the source articles, near the founder photo. - Verify: [About-Page Conversion Audit](https://jwatte.com/tools/about-page-conversion-audit/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). - [ ] **7.64 5. Trust Badges HTML Section** - Pass: The homepage or About page shows a badge strip with the Google rating and review count, the industry platform rating, years in business, licenses and awards. - Fail: With no inputs the generated section contains only the comment ''. - Numbers and lists the tool uses: badges: '`<rating>` Google Rating (`<count>` reviews)', '`<rating>` `<industry label>` Rating (`<count>` reviews)', 'Est. `<year>`, `<years>` years in business' where years = current year minus founding year, one badge per license line, one per award line; review count defaults to 0; industry rating label: restaurant Yelp, hotel TripAdvisor, real estate Zillow, medical and dental Healthgrades, legal Avvo, author Goodreads, saas G2/Capterra, storage SpareFoot, recovery, nonprofit and education Google, all others Yelp. - Why: Reviews are ranking signals, and cross-platform ratings shown together compound trust. - Fix: Enter the real Google and industry ratings with counts, founding year, licenses and awards, then paste the badge section on the homepage or About page. - Verify: [E-E-A-T Generator](https://jwatte.com/tools/eeat-generator/). - [ ] **7.65 Tenure signal detected** - Pass: The page states a founding year or a years-of-experience count. - Warn: No 'years of experience' or 'founded in' statement is reported as a warning. - Numbers and lists the tool uses: year /(founded|established|since|in business|serving.{0,30})\s*(?:in\s*)?(\d{4})/i; years /(\d{1,2})\+?\s*(years?|yrs)\s*(of\s*)?(experience|in business|serving|building|working)/i. - Why: 'Founded 2018' or '14 years of experience' is a specific trust claim that beats vague words like 'seasoned'. - Fix: Put one specific number (years, clients or projects) in the first 100 words of the About page. - Verify: [About-Page Conversion Audit](https://jwatte.com/tools/about-page-conversion-audit/). - [ ] **7.66 Quantified experience detected** - Pass: The page carries at least two quantified claims such as clients served or projects completed. - Warn: About Page Conversion Audit warns with no quantified number; the Mega Analyzer specificity row reports fewer than two as informational. - Numbers and lists the tool uses: About Page Conversion Audit /\b\d{2,}[,]?\d{0,3}\+?\s*(clients|customers|projects|audits|deals|students|readers|books sold|sites|engagements|businesses)/gi; Mega Analyzer quantifiedClaimsCount 2 or more. - Why: '4,200 clients served' beats 'many clients'; specific numbers are more credible and more citable than vague marketing. - Fix: Add at least one specific count in the first 100 words and use numbers with units throughout. - Verify: [About-Page Conversion Audit](https://jwatte.com/tools/about-page-conversion-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **7.67 License / insurance / bonded marker** - Pass: The page prints a license number or bonded-and-insured wording. - Warn: The Mega Analyzer specificity row reports absence as informational. - Numbers and lists the tool uses: /\b(license(?:d|#)?\s*(?:no\.?|number)?\s*[:#]?\s*[a-z0-9\-]+|bonded\s+(?:and|&)\s+insured|fully\s+(?:licensed|insured|bonded)|(?:contractor|medical|nursing|attorney|bar|real\s?estate)\s+license\s+#)\b/i; Legal Pages Generator local-service notice: licensed and insured as required in operating jurisdictions, license numbers available on request, not a warranty of outcomes. - Why: License and insurance status is a primary trust signal for trades, legal, medical and real estate businesses. - Fix: Print the license number and insured or bonded status in the footer and on the About and contact pages. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Legal Pages Generator](https://jwatte.com/tools/legal-pages-generator/). - [ ] **7.68 Founder / author photo detected** - Pass: An image on the About page has founder, author or headshot keywords in its alt text or src. - Warn: No labelled human photo on a page with more than two images is reported as 'Human photo not clearly labeled'. - Fail: No match on a page with two or fewer images is reported as 'No human photo detected'. - Numbers and lists the tool uses: /founder|ceo|author|owner|headshot|bio|portrait|profile|team/ on lowercased alt plus src; warn gate more than 2 images. - Why: Visitors are four times more likely to trust a page with a human face, and the About page is where identity is established. - Fix: Put a professional photo of a real person above the fold with alt text containing founder, bio, author or CEO, not a stock image. - Verify: [About-Page Conversion Audit](https://jwatte.com/tools/about-page-conversion-audit/). - [ ] **7.69 Copyright Notice Found** - Pass: The body text contains the word copyright, a copyright symbol or a year. - Warn: Neither is reported as a warning. - Numbers and lists the tool uses: substring 'copyright' or /©|\d{4}/. - Why: A copyright line with the current year is a small sign the site is maintained. - Fix: Add a copyright notice with the current year in the footer. - Verify: [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/). - [ ] **7.70 Knowledge Panel** - Pass: A branded search shows a Knowledge Panel for the business or person. - Numbers and lists the tool uses: SERP markers /data-async-context="query.*?kgmid|class="[^"]*\bkno-kp\b|"knowledgeGraph":|aria-label="Knowledge Graph"/i; triggers listed by E-E-A-T Generator: a Wikidata entry with sameAs to your profiles, consistent name, address and phone across 10+ platforms, on-site schema linking those profiles, mentions from authoritative third-party sources, a Google Business Profile with reviews and activity; check quarterly. - Why: A Knowledge Panel appears when the Knowledge Graph has enough corroborated data about the entity, which is the same data AI answers rely on. - Fix: Build Wikipedia or Wikidata presence, consistent sameAs and Business Profile activity, then check for the panel each quarter. - Verify: [SERP Features](https://jwatte.com/tools/serp-features/), [E-E-A-T Generator](https://jwatte.com/tools/eeat-generator/). - [ ] **7.71 Security / compliance badges** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: /\b(soc\s?2|iso\s?27001|iso\s?9001|hipaa\s+compliant|gdpr\s+compliant|ccpa\s+compliant|pci[- ]?dss|fedramp|sox\s+compliant|ssl\s+secured|mcafee\s+secure|norton\s+secured)\b/i; Mega Analyzer trust-stats row rates a count above 0 as good; specificity row lists SOC 2, ISO 27001, HIPAA, GDPR, PCI-DSS. - Why: Compliance claims are trust signals for B2B buyers, but only when they are real. - Fix: State real certifications with evidence such as a report or certificate link; never claim one you do not hold. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **7.72 Gravatar profile URL in sameAs** - Pass: Gravatar profile URL present in sameAs (Mega Analyzer: +1 E-E-A-T point when the page hosts a Person, Organization or vertical agent entity; Author Entity Graph: +2 per Gravatar-bound author); absence renders an informational row and a Schema Validator info issue. - Numbers and lists the tool uses: /(?:^|\/\/)(?:[a-z0-9.-]+\.)?gravatar\.com\/(?!avatar\/)[A-Za-z0-9._-]+/i on sameAs (avatar/ image paths excluded); Schema Validator gate: node type /^(Person|Organization|LocalBusiness|Corporation|RealEstateAgent|Attorney|Dentist|Physician|FinancialService|InsuranceAgency|AccountingService)$/ with a non-empty sameAs; Mega Analyzer E-E-A-T +1 only when hasPerson or hasOrg or hasVerticalAgent; E-E-A-T Author Entity Graph +2 score per Gravatar-bound author; form https://gravatar.com/`<slug>`. - Why: The Gravatar slug encodes a hash of the verified email, tying one identity across WordPress, Disqus, Stack Exchange and many comment systems, which is the strongest portable anchor for operators who cannot qualify for Wikidata. - Fix: Add https://gravatar.com/`<your-slug>` to the Person's sameAs. - Verify: [Schema Validator](https://jwatte.com/tools/schema-validator/), [E-E-A-T Author Entity Graph](https://jwatte.com/tools/e-e-a-t-author-entity-graph/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **7.73 Author photo in article: yes / no** - Pass: Author photo found via the selectors (pass); absence renders an info row; counts 1 of 8 points in the Author authority score (6 or more pass, 4 to 5 warn, under 4 fail) - Numbers and lists the tool uses: selectors [class*="author"] img, [rel="author"] img, [itemprop="author"] img; recommended 120 x 120 minimum, WebP, alt="[Name]". - Why: An author photo is a cheap authorship signal with outsized impact. - Fix: Add an author photo (120 x 120 minimum, WebP, alt text with the name) in the byline or an 'About the author' block. - Verify: [Author Authority per Article](https://jwatte.com/tools/author-authority-per-article/). - [ ] **7.74 Author bio snippet detected: yes / no** - Pass: Bio marker regex matches body text (pass); absence renders an info row; counts 1 of 8 points in the Author authority score (6 or more pass, 4 to 5 warn, under 4 fail) - Numbers and lists the tool uses: /about the author|author bio|written by|\bcredentials?\b|\bexpertise\b/i on body text; E-E-A-T Generator bio partial: `<section itemscope itemtype="https://schema.org/Person">` with itemprop image (120 x 120, round), name, jobTitle, description, '`<n>`+ years of experience' and up to 8 profile links as `<a rel="me noopener">`. - Why: A bio block with credentials shows why this author can speak to the topic. - Fix: Add a 2 to 4 sentence bio with title, years of experience and certifications near the end of each article, and a fuller microdata-annotated bio on the About or author page. - Verify: [Author Authority per Article](https://jwatte.com/tools/author-authority-per-article/), [E-E-A-T Generator](https://jwatte.com/tools/eeat-generator/). Standard: schema.org Person (microdata). - [ ] **7.75 Google Scholar Reference** - Pass: 'scholar.google' found in body text or HTML: pass (10 points in the Expertise pillar score); absent: info row excluded from the score. - Numbers and lists the tool uses: substring 'scholar.google' in body text or HTML. - Why: A Google Scholar profile establishes research credentials for academic authors. - Fix: If applicable, link the author's Google Scholar profile. - Verify: [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/). - [ ] **7.76 ResearchGate / Academia Reference** - Pass: 'researchgate' or 'academia.edu' found in body text or HTML: pass (10 points in the Expertise pillar score); absent: info row excluded from the score. - Numbers and lists the tool uses: substrings 'researchgate', 'academia.edu' in body text or HTML. - Why: Academic platform profiles corroborate research credentials. - Fix: If applicable, link ResearchGate or academia.edu profiles. - Verify: [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/). - [ ] **7.77 Crunchbase Reference** - Pass: 'crunchbase' found in body text or a sameAs URL: pass (10 points in the Authoritativeness pillar score); absent: info row excluded from the score. - Numbers and lists the tool uses: substring 'crunchbase' in body text or /crunchbase/i on sameAs. - Why: A Crunchbase profile is a business credibility signal for companies. - Fix: If applicable, create a Crunchbase profile and link it from sameAs. - Verify: [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/). - [ ] **7.78 Professional affiliations shown** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: /member of|affiliated|partner|\b(bbb|better business bureau|chamber of commerce|trade association|aapc|aicpa|bar|society)\b/i. - Why: Association logos such as BBB, the bar, a CPA society or a trade group reinforce legitimacy. - Fix: Show the logos of relevant associations the business belongs to. - Verify: [About-Page Conversion Audit](https://jwatte.com/tools/about-page-conversion-audit/). - [ ] **7.79 .well-known/webfinger found** - Pass: Pass row when /.well-known/webfinger returns a 2xx non-empty body (10 points in the Network section score); absence adds no row. - Numbers and lists the tool uses: path /.well-known/webfinger; absence is not reported. - Why: WebFinger enables federated identity discovery for ActivityPub and Mastodon. - Fix: Serve a WebFinger resource if the site participates in the fediverse. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). Standard: WebFinger. - [ ] **7.80 Global Privacy Control reference detected** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: /globalprivacycontrol|\bGPC\b/i. - Why: Honoring the Global Privacy Control signal is how the site respects browser-level opt-outs. - Fix: Honor the Sec-GPC signal and say so in the privacy policy. - Verify: [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: Global Privacy Control. - [ ] **7.81 Review-response cadence (process check)** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: reply to 100% of 1 to 3 star reviews within 48 hours; reply to 4 to 5 star reviews within 7 days; post-service review request workflow; respond to every review. - Why: Google ranks businesses that respond to reviews higher, and review recency and velocity are ranking inputs. - Fix: Set up a post-service review request and a response script library for 1, 2, 3 and 5 star reviews, professional in tone with no defensiveness or legal-sounding language. - Verify: [GBP + Review Signal Audit](https://jwatte.com/tools/gbp-review-audit/), [E-E-A-T Generator](https://jwatte.com/tools/eeat-generator/). - [ ] **7.82 Accept reviews from Apple Maps users** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: manual checklist item; Apple Maps shows Yelp and TripAdvisor reviews inline and the Yelp integration is automatic. - Why: Apple Maps users see the Yelp and TripAdvisor ratings, so those profiles feed the Apple listing too. - Fix: Keep the Yelp and TripAdvisor profiles current so the Apple Business Connect listing surfaces reviews. - Verify: [Apple Business](https://jwatte.com/tools/apple-business-audit/). - [ ] **7.83 Visible consent / cookie banner element present / Cookie preference center link** - Pass: A visible consent banner element and a cookie preference center link are present. - Numbers and lists the tool uses: hasConsentBannerEl = any element matching [id*="cookie" i], [class*="cookie" i][class*="banner" i], [class*="consent" i][class*="banner" i], [id*="onetrust" i], [id*="cookiebot" i], [role="dialog"][aria-label*="cookie" i], [aria-describedby*="cookie" i], or body text matching /\b(we\s+use\s+cookies|this\s+(?:site|website)\s+uses\s+cookies|by\s+clicking\s+(?:accept|agree))/i; hasPreferenceCenter = any link href matching /\/(cookie-settings|cookie-preferences|privacy-settings|manage-cookies|cookie-manage|opt-out|do-not-sell)(\/|$)/i, or body text matching /(cookie\s+(settings|preferences)|manage\s+cookies|do\s+not\s+sell|privacy\s+preferences)/i; both rows use renderInfo so absence is reported as information. - Why: GDPR requires a way to withdraw consent as easily as it was given and CCPA requires a Do Not Sell link, and a footer 'Manage cookies' link covers both. - Fix: Add a consent banner and a footer 'Manage cookies' link (see /blog/blog-cookie-preference-center-link/). - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: GDPR Art. 7(3); CCPA. - [ ] **7.84 Privacy Policy linked from landing page** - Pass: The page links to a privacy policy. - Fail: No link on the page matches the privacy-path pattern (the row renders as a failed check). - Numbers and lists the tool uses: href regex /\/privacy(\/|$|-policy|-notice|_policy)|\/pp\/?$/i over the page's a[href] links; Legal Pages Generator policy section How we protect information declares TLS in transit, encryption at rest where applicable, access controls, and regular audits, and states that no system is perfectly secure. - Why: Privacy laws and the platforms you embed require a reachable privacy policy, and its absence is a visible trust gap. - Fix: Publish /privacy/ describing what you collect and how you protect it, and link it from the footer. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: GDPR Art. 13; CCPA 1798.130. - [ ] **7.85 Cookie Policy linked (separate from Privacy Policy)** - Pass: The page links to a cookie policy. - Fail: No link matches the cookie-path pattern (the row renders as a failed check). - Numbers and lists the tool uses: href regex /[\/#]cookies?/i over the page's a[href] links (a /privacy#cookies anchor also counts). - Why: Loading analytics or embeds sets cookies, and the ePrivacy rules expect a cookie disclosure. - Fix: Add /cookies (or /privacy#cookies) and link it from the footer. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: ePrivacy Directive. - [ ] **7.86 Terms of Use / Terms of Service page linked** - Pass: The page links to a terms page. - Fail: No link matches the terms-path pattern (the row renders as a failed check). - Numbers and lists the tool uses: href regex /\/(terms|tos|tou|legal|terms-of-service|terms-of-use|terms-and-conditions|disclaimer)(\/|$|\.html)/i over the page's a[href] links. - Why: Terms set acceptable use, liability and dispute rules for everyone who uses the site. - Fix: Publish a terms page and link it from the footer. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). ## 8. Speed and Core Web Vitals Core Web Vitals are a ranking input and a real-user measurement. This section is what the field data reports, what makes the largest element slow, what shifts the layout, what third-party scripts cost, and whether the CDN is actually caching. **Verify this section with:** [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/), [CWV Fix Generator](https://jwatte.com/tools/cwv-fix-generator/), [Competitor Gap Matrix](https://jwatte.com/tools/competitor-gap-matrix/), [Edge Cache Effectiveness Probe](https://jwatte.com/tools/edge-cache-effectiveness-probe/), [Uptime + Response-Time Diagnostic](https://jwatte.com/tools/uptime-check/), [DIY Uptime Alert Generator](https://jwatte.com/tools/diy-uptime-alert-generator/), [Core Web Vitals Audit](https://jwatte.com/tools/cwv-audit/), [Mega Batch](https://jwatte.com/tools/mega-batch/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/), [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/), [CrUX Field Data Probe](https://jwatte.com/tools/crux-field-data-probe/), [Image Alt Audit](https://jwatte.com/tools/image-alt-audit/), [Image LCP Candidate Audit](https://jwatte.com/tools/image-lcp-candidate-audit/), [Third-Party Script Cost Audit](https://jwatte.com/tools/third-party-script-cost/), [Migration Analyzer](https://jwatte.com/tools/migration-analyzer/), [Trust Signal Surface](https://jwatte.com/tools/trust-signal-surface-audit/), [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **8.1 Content-Encoding compression active** - Pass: The HTML response carries a Content-Encoding header of br, gzip or zstd. - Warn: Compressed with gzip or zstd but not brotli (Mega SEO Analyzer), brotli being 15-25% smaller. - Fail: No compression at all fails in Mega SEO Analyzer, loses 4 points in the Batch Analyzer hosting score, and warns in Mega Analyzer and Analyzer. - Numbers and lists the tool uses: Regex /br|gzip|zstd/i on the Content-Encoding header (Mega Analyzer, Analyzer, Batch Analyzer weight 4, Competitor Gap Matrix); brotli preferred, /br/i passes and /gzip|br|zstd/i without br warns, brotli cited as 15-25% smaller than gzip (Mega SEO Analyzer); generator config nginx brotli on, brotli_comp_level 6, gzip_comp_level 6, gzip_vary on, types text/plain text/css text/xml application/javascript application/json application/xml image/svg+xml font/woff2, Apache AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css application/javascript application/json, Netlify, Cloudflare and Vercel need no config (CWV Fix Generator). - Why: Uncompressed HTML, CSS and JS take longer to download, which delays the first byte and the largest paint. - Fix: Turn on Brotli (or at least gzip) at the host or CDN; most CDNs do this by default, self-hosted nginx or Apache needs the compression config. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Competitor Gap Matrix](https://jwatte.com/tools/competitor-gap-matrix/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/) and 2 more. Standard: RFC 9110 Content-Encoding; RFC 7932 (Brotli). - [ ] **8.2 Cache-Control: `<value>`** - Pass: The response sends a Cache-Control header. - Warn: No Cache-Control header (Mega SEO Analyzer). - Numbers and lists the tool uses: Header presence only (Mega SEO Analyzer); generator pattern for a Netlify or Cloudflare Pages _headers file: /*.css, /*.js, /*.woff2 and /images/* get Cache-Control: public, max-age=31536000, immutable and need fingerprinted filenames such as app.a3b4c.css, HTML at /* gets Cache-Control: public, max-age=0, s-maxage=600, stale-while-revalidate=86400 (CWV Fix Generator). - Why: Without caching rules every repeat visit downloads the same files again and the CDN cannot serve pages for you. - Fix: Send Cache-Control on every response: one year plus immutable for fingerprinted static assets, and a short max-age with s-maxage and stale-while-revalidate for HTML. - Verify: [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [CWV Fix Generator](https://jwatte.com/tools/cwv-fix-generator/). Standard: RFC 9111. - [ ] **8.3 Edge-cache header observed** - Pass: The response carries an edge-cache header (cf-cache-status, x-cache, cache-status or age) and, where classified, reports a HIT. - Warn: No edge-cache header is reported as info in Mega SEO Analyzer; in the Edge-Cache Effectiveness Probe a URL with no hit or miss token but Age over 0 is AGED, an EXPIRED, REVALIDATED, STALE or DYNAMIC token is DYNAMIC, and no cache headers at all is UNKNOWN. - Fail: A MISS token in cf-cache-status, x-cache or cache-status (Edge-Cache Effectiveness Probe). - Numbers and lists the tool uses: Headers cf-cache-status, x-cache, age (Mega SEO Analyzer); headers cf-cache-status, x-cache, cache-status, age evaluated in the order hit, miss, aged (Age > 0), dynamic, unknown, with hit = /HIT|hit/ on cf-cache-status or /HIT/i on x-cache or /hit/ on cache-status, miss = /MISS|miss/ on cf-cache-status or /MISS/i on x-cache or /miss/ on cache-status, dynamic = /EXPIRED|REVALIDATED|STALE|DYNAMIC/i on the three status headers joined, up to 30 pasted URLs (Edge-Cache Effectiveness Probe). - Why: Without an edge cache in front of it, every visit hits your origin server directly, which is slower and costs more. - Fix: Put the site behind a CDN or edge cache, and for URLs that show MISS add Cache-Control: public, max-age=N, s-maxage=N; consider stale-while-revalidate for dynamic URLs. - Verify: [Edge Cache Effectiveness Probe](https://jwatte.com/tools/edge-cache-effectiveness-probe/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). - [ ] **8.4 Edge cache-hit ratio: `<n>`% (`<n>` / `<n>`)** - Pass: At least 70% of the sampled URLs are served from the edge cache. - Warn: A hit ratio of 40% to 69%, or 30% or more of the sampled URLs classified miss, dynamic or unknown (reported as '`<n>` URLs bleeding origin traffic'). - Fail: A hit ratio under 40%. - Numbers and lists the tool uses: pass >= 70%, warn >= 40%, fail < 40%, ratio = round(hits / probed * 100); bleeding-origin warning when miss + dynamic + unknown >= 0.3 of the sampled URLs; sample of up to 30 URLs. - Why: Every page your CDN could have served but did not is extra latency for the visitor and extra load and cost on your origin. - Fix: Review Cache-Control, the Vary header (a Vary on User-Agent or Accept-Encoding for no reason fragments the cache key), Set-Cookie on HTML responses (many CDNs skip caching when present, so move cookies to a sub-domain or a cookie-less media domain), and strip or normalize utm_* and fbclid parameters at the edge; re-probe weekly. - Verify: [Edge Cache Effectiveness Probe](https://jwatte.com/tools/edge-cache-effectiveness-probe/). - [ ] **8.5 `<n>` unversioned URL(s) cached as immutable or near-permanent** - Pass: No URL without a content hash or version marker is served with Cache-Control immutable or a max-age of a month or more. - Fail: One or more URLs with no content hash or version marker are served with Cache-Control immutable or a max-age of 2592000 seconds (30 days) or more. - Numbers and lists the tool uses: /immutable/i in Cache-Control, or max-age >= 2592000 from /max-age=(\d+)/i; a URL counts as versioned when it matches /[.\-_][0-9a-f]{8,}\.[a-z0-9]+($|\?)/i, /[?&](v|ver|rev|hash|build)=[^&]+/i or /\/v\d+\//i; up to 3 affected paths listed. - Why: Immutable tells the browser never to check again, so on a file whose name never changes your next deploy stays invisible to every returning visitor until the cache expires, even though a fresh fetch looks correct. - Fix: Either fingerprint the filename so immutable is true, or drop immutable and shorten max-age, adding stale-while-revalidate to keep repeat views fast. - Verify: [Edge Cache Effectiveness Probe](https://jwatte.com/tools/edge-cache-effectiveness-probe/). - [ ] **8.6 HTTP/3 advertised via Alt-Svc** - Pass: The alt-svc response header advertises h3. - Warn: Not advertised is reported as info, not a warning (Mega SEO Analyzer). - Numbers and lists the tool uses: Regex /h3(-\d+)?=/i on the alt-svc header (Mega SEO Analyzer); /h3=/i on alt-svc (Competitor Gap Matrix). - Why: HTTP/3 sets up connections faster and handles flaky mobile networks better than HTTP/2. - Fix: Enable HTTP/3 at the host or CDN and make sure it advertises it with an Alt-Svc header. - Verify: [Competitor Gap Matrix](https://jwatte.com/tools/competitor-gap-matrix/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: RFC 9114. - [ ] **8.7 Link header with preload: <yes (Early Hints candidate) / no>** - Pass: A Link response header is present and contains rel=preload. - Warn: A Link header without preload, or no Link header at all, is reported as info (103 Early Hints not in use). - Numbers and lists the tool uses: Regex /rel=preload/i on the Link response header. - Why: A preload in the Link header lets the CDN send a 103 Early Hints response, so the browser starts fetching critical files before the HTML arrives. - Fix: Send a Link: `<url>`; rel=preload header for the critical stylesheet, font or hero image so the CDN can emit 103 Early Hints. - Verify: [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: RFC 8297 (103 Early Hints). - [ ] **8.8 Vary: Accept on Markdown response (cache-correctness)** - Pass: When the page answers an Accept: text/markdown request with Markdown, the response carries a Vary header that names Accept. - Warn: Markdown negotiation works but Vary: Accept is missing. - Numbers and lists the tool uses: Regex /\baccept\b/i on the Vary header; only evaluated when Markdown negotiation was tested and supported. - Why: Without Vary: Accept a CDN can store the Markdown and HTML versions under one cache entry and hand the wrong one to the next visitor. - Fix: Set Vary: Accept in netlify.toml or your origin headers for every URL that serves Markdown by content negotiation. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: RFC 9110 Vary. - [ ] **8.9 Response time: `<n>` ms (server-side, one-shot)** - Pass: The page responds in under 1000 ms. - Warn: 1000 ms to under 3000 ms (Uptime Check); a Prometheus SlowResponse alert fires when the probe duration stays over 3 seconds for 5 minutes (DIY Uptime Alert Generator). - Fail: 3000 ms or more (Uptime Check). - Numbers and lists the tool uses: 1000 ms, 3000 ms (Uptime Check); probe_http_duration_seconds > 3 for 5m, severity warning (DIY Uptime Alert Generator). - Why: A slow single probe from one location means real visitors in distant regions see something considerably worse, and sustained slow responses tend to come before outages. - Fix: Check the hosting tier, origin latency, caching and upstream dependencies, and put a CDN in front of the origin. - Verify: [Uptime + Response-Time Diagnostic](https://jwatte.com/tools/uptime-check/), [DIY Uptime Alert Generator](https://jwatte.com/tools/diy-uptime-alert-generator/). - [ ] **8.10 HTML weight: `<n>`KB** - Pass: The uncompressed HTML is 100 KB or less. - Warn: 101 KB to 250 KB is reported as info in Analyzer and as ok in Mega Analyzer; over 250 KB warns in Analyzer (heavy). - Fail: Over 250 KB shows red in the Mega Analyzer stat and loses 15 points in the Mega Analyzer and Mega Batch Perf + AI score; over 200 KB deducts from the CWV Audit LCP signal; Single Site Gen and Site Migration Gen specify at most 250 KB per page. - Numbers and lists the tool uses: 100 KB good, 250 KB heavy, KB = round(html.length / 1024) (Mega Analyzer, Analyzer); Lighthouse flags over 100 KB uncompressed HTML (Analyzer); at most 250 KB, weight 15 in the Perf + AI score (Mega Analyzer, Mega Batch); 250 KB per page (Single Site Gen, Site Migration Gen); 200 KB with deduction min(40, (KB - 200) / 15) points off the LCP signal, KB = round(Blob size / 1024) (CWV Audit). - Why: A big HTML document takes longer to download and parse before anything can be drawn. - Fix: Trim markup, inline only the critical CSS and move large inline scripts and styles into cached external files. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Core Web Vitals Audit](https://jwatte.com/tools/cwv-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega Batch](https://jwatte.com/tools/mega-batch/) and 2 more. Standard: Lighthouse. - [ ] **8.11 DOM size: `<n>` nodes** - Pass: The page has 1500 elements or fewer. - Warn: Over 1500 nodes is flagged heavy (Analyzer). - Numbers and lists the tool uses: 1500 nodes, the Lighthouse threshold (Mega Analyzer, Analyzer, Mega Batch weight 12, Single Site Gen, Site Migration Gen); weight 10 in the Mega Analyzer Perf + AI score. - Why: Large DOM trees use more memory, slow down rendering and make every interaction slower. - Fix: Reduce nesting depth and node count; remove wrapper divs, hidden duplicate menus and unused markup. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega Batch](https://jwatte.com/tools/mega-batch/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/) and 1 more. Standard: Lighthouse. - [ ] **8.12 Performance score: `<n>`/100** - Pass: The PageSpeed Insights mobile performance score is 90 or higher. - Warn: 50 to 89, needs improvement. - Fail: Under 50, poor. - Numbers and lists the tool uses: PageSpeed Insights API v5 with category=performance and strategy=mobile; score = round(categories.performance.score * 100); pass >= 90, warn >= 50; scores below 90 may affect rankings (Analyzer manual reminder). - Why: The mobile performance score is Google's own summary of how fast the page loads, and Core Web Vitals directly affect rankings. - Fix: Run the page at pagespeed.web.dev and target a mobile performance score of 90 or more. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). Standard: Google PageSpeed Insights / Lighthouse performance score. - [ ] **8.13 LCP: `<n>` s** - Pass: Largest Contentful Paint is 2.5 seconds or less. - Warn: Over 2.5 seconds up to 4 seconds, needs improvement. - Fail: Over 4 seconds, poor. - Numbers and lists the tool uses: good <= 2500 ms, needs improvement <= 4000 ms, poor > 4000 ms; Analyzer reads the Lighthouse lab value from PageSpeed Insights mobile; Mega SEO Analyzer and CrUX Field Data Probe read the Chrome UX Report 28-day p75 field value for the URL, falling back to origin data; target LCP < 2.5 s (Single Site Gen, Site Migration Gen); target LCP <= 2.5 s on mobile (CWV Fix Generator); CWV Audit instead estimates a heuristic LCP signal from static HTML, 100 minus its page-weight, blocking CSS, blocking script, eager-image and font-preload deductions, good >= 85, warn >= 60. - Why: LCP measures how long the biggest visible element takes to appear, and it is a Core Web Vital that Google ranks on. - Fix: Keep the hero image eager with fetchpriority=high, preload it, serve it in AVIF or WebP with srcset, cut render-blocking CSS and JS and speed up the server; after a fix wait 7 to 14 days for the field data to reflect it. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [CrUX Field Data Probe](https://jwatte.com/tools/crux-field-data-probe/), [Core Web Vitals Audit](https://jwatte.com/tools/cwv-audit/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/) and 3 more. Standard: Google Core Web Vitals LCP thresholds (2.5 s good, 4 s poor); Chrome UX Report 28-day window. - [ ] **8.14 INP: `<n>` ms** - Pass: Interaction to Next Paint is 200 ms or less. - Warn: Over 200 ms up to 500 ms, needs improvement. - Fail: Over 500 ms, poor. - Numbers and lists the tool uses: good <= 200 ms, needs improvement <= 500 ms, poor > 500 ms, Chrome UX Report p75 (Mega SEO Analyzer, CrUX Field Data Probe); target INP < 200 ms (Single Site Gen, Site Migration Gen); target INP <= 200 ms (CWV Fix Generator); CWV Audit estimates a heuristic INP signal from static HTML, 100 minus its total-script, inline-script and GTM deductions, good >= 85, warn >= 60. - Why: INP measures how quickly the page responds when someone taps or clicks, and it is a Core Web Vital that Google ranks on. - Fix: Cut or defer third-party scripts (the usual culprit is a long task from a tag or chat widget), split long JavaScript tasks and keep event handlers light. - Verify: [CrUX Field Data Probe](https://jwatte.com/tools/crux-field-data-probe/), [Core Web Vitals Audit](https://jwatte.com/tools/cwv-audit/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/) and 2 more. Standard: Google Core Web Vitals INP thresholds (200 ms good, 500 ms poor). - [ ] **8.15 CLS: `<n>`** - Pass: Cumulative Layout Shift is 0.1 or less. - Warn: Over 0.1 up to 0.25, needs improvement. - Fail: Over 0.25, poor. - Numbers and lists the tool uses: good <= 0.1, needs improvement <= 0.25, poor > 0.25; Analyzer reads the Lighthouse lab value from PageSpeed Insights mobile to three decimals; Mega SEO Analyzer and CrUX Field Data Probe read the Chrome UX Report p75 value and compare the raw percentile as returned while displaying it as v / 100 to three decimals; target CLS < 0.1 (Single Site Gen, Site Migration Gen); target CLS <= 0.1 (CWV Fix Generator); CWV Audit estimates a heuristic CLS signal, 100 minus its missing-dimension image and font-display deductions, good >= 85, warn >= 60. - Why: CLS measures how much the page jumps around while loading, and it is a Core Web Vital that Google ranks on. - Fix: Give every image, iframe and embed explicit width and height or an aspect-ratio box, reserve space for ads and late content and stop fonts swapping late. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [CrUX Field Data Probe](https://jwatte.com/tools/crux-field-data-probe/), [Core Web Vitals Audit](https://jwatte.com/tools/cwv-audit/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/) and 3 more. Standard: Google Core Web Vitals CLS thresholds (0.1 good, 0.25 poor). - [ ] **8.16 FCP: `<n>` s** - Pass: First Contentful Paint is 1.8 seconds or less at p75. - Warn: Over 1.8 seconds up to 3 seconds, needs improvement. - Fail: Over 3 seconds, poor. - Numbers and lists the tool uses: good <= 1800 ms, needs improvement <= 3000 ms, poor > 3000 ms, Chrome UX Report p75. - Why: FCP is when the first text or image shows up for real visitors, so a slow FCP means a blank screen. - Fix: Reduce render-blocking resources and server response time, which drive FCP. - Verify: [CrUX Field Data Probe](https://jwatte.com/tools/crux-field-data-probe/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: Chrome UX Report FCP thresholds. - [ ] **8.17 TTFB: `<n>` ms** - Pass: Time to First Byte is 800 ms or less at p75. - Warn: Over 800 ms up to 1800 ms, needs improvement. - Fail: Over 1800 ms, poor. - Numbers and lists the tool uses: good <= 800 ms, needs improvement <= 1800 ms, poor > 1800 ms, Chrome UX Report p75 EXPERIMENTAL_TIME_TO_FIRST_BYTE (Mega SEO Analyzer, CrUX Field Data Probe); target TTFB <= 800 ms (CWV Fix Generator). - Why: TTFB is how long real visitors wait for the server to start answering, and everything else on the page waits behind it. - Fix: The usual culprits are origin compute, database time or un-cached origin hits; cache HTML at the edge and check the hosting tier. - Verify: [CrUX Field Data Probe](https://jwatte.com/tools/crux-field-data-probe/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: Chrome UX Report TTFB thresholds. - [ ] **8.18 All `<img>` tags have width + height** - Pass: Every img element declares both width and height attributes. - Warn: Analyzer, Image Alt Audit and Image LCP Candidate Audit (any of the first 6 images) report missing dimensions as a warning; Mega SEO Analyzer warns when the first image lacks either attribute. - Fail: Mega Analyzer shows the missing width/height count red and loses 10 points in its Perf + AI score on any missing image; Mega Batch loses 12 points on any; Batch Analyzer loses 10 points when fewer than 80% of images have both; Image LCP Candidate Audit fails when the first image (the LCP candidate) is missing width or height; CWV Audit deducts from its CLS signal. - Numbers and lists the tool uses: Missing = not both width and height attributes; images inside `<picture>` excluded in the itemized lists (Mega Analyzer, Analyzer, Batch Analyzer, Mega Batch) but not in the Batch Analyzer score bucket, CWV Audit, Image Alt Audit or Image LCP Candidate Audit; up to 30 src values listed (Analyzer), up to 20 (Batch Analyzer, Mega Batch); weight 10 in the Mega Analyzer Perf + AI score, weight 12 (Mega Batch); 80% of images with both, weight 10 (Batch Analyzer); 8 points per image capped at 60 off the CLS signal (CWV Audit); first image regex /\bwidth\s*=/i and /\bheight\s*=/i (Mega SEO Analyzer); first image and the first 6 images checked (Image LCP Candidate Audit); generator adds CSS img, video { max-width: 100%; height: auto; } (CWV Fix Generator). - Why: Without dimensions the browser reserves no space, so the page jumps when each image arrives, which is the layout shift Google measures as CLS. - Fix: Put the intrinsic pixel width and height on every img (and video), enforce it in the template, and keep them responsive with CSS max-width: 100%; height: auto. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Image Alt Audit](https://jwatte.com/tools/image-alt-audit/), [Core Web Vitals Audit](https://jwatte.com/tools/cwv-audit/), [Image LCP Candidate Audit](https://jwatte.com/tools/image-lcp-candidate-audit/) and 6 more. Standard: Core Web Vitals CLS. - [ ] **8.19 Legacy image formats (`<n>` JPG/PNG/GIF)** - Pass: No image is served as JPG, PNG or GIF; images use WebP or AVIF, ideally inside `<picture>` with a fallback. - Warn: Image LCP Candidate Audit warns when the first image is not webp, avif or svg, and when 3 or more of the first 6 images are legacy; Image Alt Audit warns on a PNG or JPEG 1200 px wide or wider. - Fail: Mega Analyzer loses 8 points in its Perf + AI score on any legacy image and itemizes them; Analyzer reports the count as info; Batch Analyzer and Mega Batch only list legacy images in the fix prompt. - Numbers and lists the tool uses: Legacy regex /\.(jpg|jpeg|png|gif)(\?|$)/i on src or data-src (Mega Analyzer, Batch Analyzer, Mega Batch); modern = src contains .webp or .avif or a `<picture>` source[type*=webp] or source[type*=avif] (Mega Analyzer); extension regex /\.(avif|webp|jpg|jpeg|png|gif|svg)(?:$|[?#])/ on src and srcset candidates with up to 30 listed (Analyzer); weight 8 in the Mega Analyzer Perf + AI score; up to 20 listed in the prompt (Batch Analyzer, Mega Batch); modern = webp, avif, svg for the first image, warn at 3 or more legacy among the first 6 (Image LCP Candidate Audit); natural width >= 1200 px and extension png, jpg or jpeg (Image Alt Audit); conversion commands magick hero.jpg -quality 82 hero.webp and magick hero.jpg -quality 65 hero.avif (CWV Fix Generator); savings cited: WebP about 30% and AVIF about 50% smaller (Mega Analyzer), 30-50% (Analyzer), 25-50% (Image Alt Audit), AVIF 40-60% and 30-60% weight saving (Image LCP Candidate Audit), AVIF 30-50% and WebP 25-35% (CWV Fix Generator). - Why: JPG, PNG and GIF files are far heavier than the same picture in WebP or AVIF, and image bytes are usually the biggest part of page weight. - Fix: Convert images to AVIF and WebP at build or upload time (sharp, squoosh, or a WordPress plugin such as LiteSpeed Cache, Imagify, ShortPixel or WebP Express) and serve them through `<picture>``<source type="image/avif">``<source type="image/webp">``<img src="fallback.jpg">``</picture>`. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Image Alt Audit](https://jwatte.com/tools/image-alt-audit/), [Image LCP Candidate Audit](https://jwatte.com/tools/image-lcp-candidate-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/) and 5 more. - [ ] **8.20 Responsive images using srcset (`<n>`/`<n>`)** - Pass: At least half of the images carry srcset (checked when the page has 3 or more images). - Warn: Below 50% with 3 or more images (Mega Analyzer); the first image without srcset warns (Image LCP Candidate Audit). - Fail: Batch Analyzer fails its score bucket below 30% with 3 or more images. - Numbers and lists the tool uses: Gate imgs >= 3, srcset share >= 0.5 (Mega Analyzer); gate imgs >= 3, img[srcset] + source[srcset] over img count >= 0.3, weight 8 (Batch Analyzer); first image srcset non-empty, suggested 3 sizes such as 480w, 960w, 1600w plus a sizes attribute (Image LCP Candidate Audit); generator pattern widths 400w 800w 1200w 1600w with sizes="(max-width: 768px) 100vw, 1200px" (CWV Fix Generator). - Why: Without srcset a phone downloads the full desktop-size image, often about four times more than it needs. - Fix: Add srcset with three or four widths and a sizes attribute to content images, starting with the hero. - Verify: [Image LCP Candidate Audit](https://jwatte.com/tools/image-lcp-candidate-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/), [CWV Fix Generator](https://jwatte.com/tools/cwv-fix-generator/). - [ ] **8.21 Lazy loading: `<n>`/`<n>` images** - Pass: When the page has more than 2 images, at least one below-the-fold image uses loading=lazy, and no more than 3 images load eagerly. - Warn: More than 2 images and none lazy (Analyzer). - Fail: More than 3 eager images (no loading attribute or loading=eager) costs 10 points off the CWV Audit LCP signal. - Numbers and lists the tool uses: imagesTotal > 2 gate, at least one img[loading=lazy]; 0 images or 2 or fewer reported as info (Analyzer); eager = no loading attribute or loading === 'eager', > 3 eager images, 10 points off the LCP signal (CWV Audit); generator pattern gives below-fold img loading="lazy" decoding="async" with width and height and iframe loading="lazy" with width and height, about 50% of initial bytes saved on image-heavy pages (CWV Fix Generator). - Why: Images the visitor cannot see yet compete for bandwidth with the hero image; lazy-loading them frees the connection for what shows first. - Fix: Add loading="lazy" to every image and iframe below the fold, and keep the hero and the first viewport eager. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Core Web Vitals Audit](https://jwatte.com/tools/cwv-audit/), [CWV Fix Generator](https://jwatte.com/tools/cwv-fix-generator/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/) and 1 more. - [ ] **8.22 Large file size: `<n>`KB (consider WebP/AVIF)** - Pass: Each image file is 500,000 bytes or smaller. - Warn: An image over 500,000 bytes. - Numbers and lists the tool uses: Content-Length > 500000 bytes in the direct image URL audit and in batch mode (up to 25 URLs); the direct mode label cites WebP saves 85-92% and AVIF 92-95% at this size; the batch mode label is '`<n>`KB (consider WebP/AVIF)'. - Why: One oversized image can dominate the whole page weight and the largest paint. - Fix: Resize the image to the largest size actually displayed and convert it to WebP or AVIF. - Verify: [Image Alt Audit](https://jwatte.com/tools/image-alt-audit/). - [ ] **8.23 Detected LCP candidate** - Pass: The initial HTML contains at least one img, and the first one in DOM order is taken as the LCP candidate. - Warn: No img in the initial HTML; the LCP is probably a CSS background-image or a video poster, which the browser discovers late. - Numbers and lists the tool uses: candidates = first 6 img elements, LCP candidate = the first; each records src (currentSrc or src), srcset, loading, fetchpriority, width, height, alt and the extension from /\.(webp|avif|jpg|jpeg|png|gif|svg)(\?|#|$)/i, '?' when no match. - Why: LCP is won or lost on one element, usually the hero image, so the audit needs to know which one to check. - Fix: For a CSS background hero, use image-set() for AVIF and WebP with a fallback and add <link rel="preload" as="image" href="hero.avif" imagesrcset=... fetchpriority="high"> in `<head>`; verify the LCP element in the Chrome DevTools Performance panel. - Verify: [Image LCP Candidate Audit](https://jwatte.com/tools/image-lcp-candidate-audit/). - [ ] **8.24 First `<img>` not lazy-loaded** - Pass: The first image in the HTML (the LCP candidate) does not carry loading=lazy. - Warn: Any of the first 6 images lazy-loaded (Image LCP Candidate Audit). - Numbers and lists the tool uses: First /<img\b[^>]*>/i matched against /loading\s*=\s*["']?lazy/i (Mega SEO Analyzer); loading attribute lowercased === 'lazy' on the first image fails, any lazy among the first 6 warns, first 1 to 2 images should be eager, 200-800 ms delay cited (Image LCP Candidate Audit); first img tag must not match /loading=["']lazy["']/i (Competitor Gap Matrix). - Why: Loading=lazy on the hero tells the browser to wait before fetching the very image that decides LCP, which is the most common silent LCP killer. - Fix: Remove loading="lazy" from the above-the-fold hero, and use loading="eager" or omit the attribute for the first one or two images. - Verify: [Image LCP Candidate Audit](https://jwatte.com/tools/image-lcp-candidate-audit/), [Competitor Gap Matrix](https://jwatte.com/tools/competitor-gap-matrix/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [CWV Fix Generator](https://jwatte.com/tools/cwv-fix-generator/) and 1 more. Standard: Core Web Vitals LCP. - [ ] **8.25 LCP candidate has fetchpriority="high"** - Pass: The first image carries fetchpriority="high". - Warn: Missing or another value is reported as info in Mega SEO Analyzer and as a warning in Image LCP Candidate Audit. - Numbers and lists the tool uses: Regex /fetchpriority\s*=\s*["']?high/i on the first img (Mega SEO Analyzer); fetchpriority lowercased === 'high', 100-300 ms improvement cited (Image LCP Candidate Audit); /(fetchpriority=["']high["'])/i anywhere in the HTML (Competitor Gap Matrix). - Why: Fetchpriority=high moves the hero image up the browser's download queue so it arrives before less important files. - Fix: Add fetchpriority="high" to the LCP image (and to its preload link). - Verify: [Image LCP Candidate Audit](https://jwatte.com/tools/image-lcp-candidate-audit/), [Competitor Gap Matrix](https://jwatte.com/tools/competitor-gap-matrix/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/). Standard: Core Web Vitals LCP. - [ ] **8.26 LCP image not preloaded** - Pass: A `<link rel="preload" as="image">` for the hero appears in `<head>` before any CSS, with fetchpriority="high". - Numbers and lists the tool uses: Generator pattern: mobile variant media="(max-width: 768px)" and desktop variant media="(min-width: 769px)", each with fetchpriority="high", imagesrcset and imagesizes (100vw mobile, 1200px desktop); the LCP img itself carries fetchpriority="high" loading="eager" decoding="async" width="1200" height="675"; 200-800 ms LCP saving on mobile cited. - Why: The browser only finds the hero image after it has parsed the HTML and loaded the CSS; a preload moves that discovery to the very start of the page load. - Fix: Add the preload links to `<head>` before any stylesheet and set fetchpriority="high" on the LCP img. - Verify: [CWV Fix Generator](https://jwatte.com/tools/cwv-fix-generator/). - [ ] **8.27 Iframes / embeds without width+height** - Pass: Every iframe declares width and height and sits in a container with a CSS aspect-ratio. - Numbers and lists the tool uses: Generator pattern: wrapper div with aspect-ratio: 16 / 9; width: 100%, iframe width="560" height="315" with style width and height 100% and border 0, a title attribute, loading="lazy" and an allow list (accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture). - Why: An iframe is 0 by 0 pixels until its content loads, so a YouTube or map embed without dimensions pushes everything below it down. - Fix: Set width and height on every iframe and wrap it in an aspect-ratio container. - Verify: [CWV Fix Generator](https://jwatte.com/tools/cwv-fix-generator/). - [ ] **8.28 Dynamic content without reserved space (ads, embeds, lazy-loaded)** - Pass: Ad slots, embeds, carousels and lazy-loaded sections have reserved space through aspect-ratio or min-height. - Numbers and lists the tool uses: Generator pattern: .ad-slot-300x250 { width: 300px; aspect-ratio: 300 / 250; background: #f0f0f0; contain: layout paint; } .youtube-embed-wrapper { aspect-ratio: 16 / 9; width: 100%; } .user-content-block { min-height: 200px; } for variable-height content. - Why: Anything that loads after the first paint shoves the content below it unless its box already has a size. - Fix: Give every async-loaded rectangle an aspect-ratio box, or a min-height when the height is unpredictable. - Verify: [CWV Fix Generator](https://jwatte.com/tools/cwv-fix-generator/). - [ ] **8.29 Render-blocking stylesheets: `<n>`** - Pass: No more than 2 stylesheets block rendering. - Warn: 3 or 4 blocking stylesheets (Mega SEO Analyzer); more than 3 (Image LCP Candidate Audit). - Fail: More than 4 (Mega SEO Analyzer); more than 2 costs 15 points off the CWV Audit LCP signal. - Numbers and lists the tool uses: Regex /<link[^>]+rel=["']stylesheet["']/gi excluding media=print and tags with an onload attribute, pass <= 2, warn 3 to 4, fail > 4 (Mega SEO Analyzer); blocking = no media, media=all or media=screen, > 2 deducts 15 points off the LCP signal (CWV Audit); regex /<link[^>]+rel=["']stylesheet["']/g, pass <= 3 (Image LCP Candidate Audit); generator pattern inlines about 14 KB of critical CSS and loads the rest with <link rel="preload" as="style" onload="this.onload=null;this.rel='stylesheet'"> plus a `<noscript>` fallback, extraction tools critters, critical-css, beasties (CWV Fix Generator); critical CSS inline (Single Site Gen, Site Migration Gen). - Why: Each blocking stylesheet is a network round-trip the browser must finish before it can draw anything. - Fix: Inline the critical above-the-fold CSS and load the rest without blocking (preload as=style with an onload swap, or media=print plus onload). - Verify: [Core Web Vitals Audit](https://jwatte.com/tools/cwv-audit/), [Image LCP Candidate Audit](https://jwatte.com/tools/image-lcp-candidate-audit/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [CWV Fix Generator](https://jwatte.com/tools/cwv-fix-generator/) and 2 more. - [ ] **8.30 `<n>` render-blocking scripts (no async/defer)** - Pass: External scripts carry async or defer, with no more than 2 blocking script[src] tags. - Fail: More than 2 script[src] without async or defer costs 15 points off the CWV Audit LCP signal; Third-Party Script Cost labels each external script BLOCKING when it has neither attribute. - Numbers and lists the tool uses: blocking = neither async nor defer, > 2, 15 points off the LCP signal (CWV Audit); async regex /<script[^>]+async[\s\S]{0,200}src=["']?/i and defer regex /<script[^>]+defer[\s\S]{0,200}src=["']?/i per external script (Third-Party Script Cost); generator pattern defer for app code, async for independent scripts such as gtag, analytics injected on window load after a 2000 ms setTimeout with async = true (CWV Fix Generator); GA4 gtag async, Clarity deferred (Single Site Gen). - Why: A synchronous script in `<head>` stops the HTML parser until it downloads and runs, delaying everything the visitor sees. - Fix: Add defer to app scripts and async to independent ones such as analytics, and load third-party tags after the load event. - Verify: [Core Web Vitals Audit](https://jwatte.com/tools/cwv-audit/), [Third-Party Script Cost Audit](https://jwatte.com/tools/third-party-script-cost/), [CWV Fix Generator](https://jwatte.com/tools/cwv-fix-generator/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/). - [ ] **8.31 External scripts: `<n>`** - Pass: The page loads no more than 10 scripts from other hostnames and no more than 15 script[src] tags in total. - Warn: More than 10 scripts on other hostnames (Migration Analyzer). - Fail: More than 15 script[src] elements costs 15 points off the CWV Audit INP signal. - Numbers and lists the tool uses: > 15 script[src], 15 points off the INP signal (CWV Audit); > 10 external-host scripts (Migration Analyzer); unique external script URLs counted with regex /<script[^>]+src=["']([^"']+)["']/gi, same-host scripts excluded, protocol-relative srcs resolved to https (Third-Party Script Cost). - Why: Every script is download and main-thread work, and the total is what makes taps feel sluggish. - Fix: Remove scripts you do not use, combine what remains, and defer the rest. - Verify: [Core Web Vitals Audit](https://jwatte.com/tools/cwv-audit/), [Third-Party Script Cost Audit](https://jwatte.com/tools/third-party-script-cost/), [Migration Analyzer](https://jwatte.com/tools/migration-analyzer/). - [ ] **8.32 `<n>` inline scripts (each blocks the main thread)** - Pass: No more than 5 inline scripts, none larger than 1 KB. - Fail: More than 5 inline scripts costs 10 points off the CWV Audit INP signal. - Numbers and lists the tool uses: script:not([src]) count > 5, 10 points off the INP signal (CWV Audit); no inline script over 1 KB (Single Site Gen, Site Migration Gen). - Why: Each inline script runs on the main thread while the page is still being built. - Fix: Move inline code into a deferred external file and keep any remaining inline script tiny. - Verify: [Core Web Vitals Audit](https://jwatte.com/tools/cwv-audit/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/), [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/). - [ ] **8.33 Third-party script cost: high / med / low** - Pass: No high-cost third-party host loads on the page, or each one is deferred, consent-gated or loaded only after the first user interaction. - Warn: A medium-cost host is present (Third-Party Script Cost). - Fail: A high-cost host is present (Third-Party Script Cost); Google Tag Manager detected costs 8 points off the CWV Audit INP signal. - Numbers and lists the tool uses: High hosts: googletagmanager.com, googleadservices.com, facebook.net, connect.facebook.net, hotjar.com, fullstory.com, intercom.io, intercomcdn.com, driftt.com, drift.com, zdassets.com, hubspot.com, hs-scripts.com (sort weight 3); medium hosts: google-analytics.com, googletag, clarity.ms, segment.com, segment.io, calendly.com, hsforms.net, klaviyo.com, cookiebot.com, cookielaw.org, osano.com (weight 2); low hosts: stripe.com, js.stripe.com, cookieyes.com, termly.io, cdn.jsdelivr.net, unpkg.com, cdnjs.cloudflare.com, and any unrecognized host defaults to low (weight 1); match = host.includes(key), first key wins; approximate per-script size in KB from body length plus a summed total; table sorted by class weight then size descending; 31 keys in the KNOWN_COSTS table (the footer text says about 40) (Third-Party Script Cost); literals 'googletagmanager' or 'gtm.js', 8 points off the INP signal (CWV Audit); generator loader injects the script with async after the first click, scroll, keydown, mousemove or touchstart ({ once: true, passive: true }) or after a 3000 ms fallback timer, 50-300 ms per script cited (CWV Fix Generator). - Why: Chat widgets, pixels, session recorders and tag managers are the single biggest cause of Core Web Vitals regressions on small-business sites. - Fix: For each high-cost script decide keep, defer, consent-gate or remove; load pixels, GTM, FullStory, Hotjar and Intercom only after the first user interaction, render a static 'Chat with us' button that swaps in the real widget on click, consider lighter analytics such as Plausible or Fathom, and measure LCP and INP before and after. - Verify: [Third-Party Script Cost Audit](https://jwatte.com/tools/third-party-script-cost/), [Core Web Vitals Audit](https://jwatte.com/tools/cwv-audit/), [CWV Fix Generator](https://jwatte.com/tools/cwv-fix-generator/). - [ ] **8.34 `<n>` third-party CDN asset(s) could be self-hosted** - Pass: No font, script or stylesheet is loaded from a public CDN that could be self-hosted. - Numbers and lists the tool uses: CDN profiles: fonts.googleapis.com and fonts.gstatic.com (font), fonts.bunny.net and use.fontawesome.com (font), cdn.jsdelivr.net (script or css), cdnjs.cloudflare.com (script or css), unpkg.com (script or css), code.jquery.com (script), stackpath.bootstrapcdn.com and maxcdn.bootstrapcdn.com (script or css), use.typekit.net (font), cdn.tailwindcss.com (css); link[href], script[src] and @import URLs in inline `<style>` via /@import\s+(?:url\()?[\"']?(https?:\/\/[^\"')]+)/gi; own host (www. stripped), data:, javascript: and blob: excluded; analytics, chat and payment SDKs excluded; Tailwind play CDN costs a 350 KB+ runtime CSS download; 100-300 ms LCP win cited. - Why: Each public CDN costs a DNS lookup and TLS handshake on first visit, takes away your control over caching, integrity and compression, adds a third-party privacy hop, and goes down when the CDN does (jsdelivr.net and unpkg.com both had multi-hour outages in 2024-25). - Fix: Download the versioned asset once into /vendor/ or /fonts/ with a long Cache-Control, self-host Google Fonts with google-webfonts-helper, and replace the Tailwind CDN with a built tailwind.css (npx tailwindcss --minify). - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **8.35 Resource hints (`<n>` preconnect, `<n>` dns-prefetch, `<n>` preload)** - Pass: The page has at least 2 resource hints in total, with 1 to 4 preconnects covering the render-critical third-party origins. - Warn: Fewer than 2 hints (Mega Analyzer, Trust Signal Surface Audit); more than 4 preconnects (Mega SEO Analyzer); zero preconnect or zero dns-prefetch is reported as info (Analyzer, Mega SEO Analyzer). - Fail: Mega Analyzer fails when the page uses 5 or more external hosts and has fewer than min(3, hosts) preconnect or dns-prefetch links. - Numbers and lists the tool uses: preconnect + dns-prefetch + preload >= 2, weight 4 in the Perf + AI score (Mega Analyzer; Trust Signal Surface Audit with regexes /<link[^>]+rel=["'][^"']*\bpreconnect\b[^"']*["']/gi and the same shape for dns-prefetch and preload); externals >= 5 and hints < min(3, externals) fails, external hosts from /(?:src|href)\s*=\s*["']https?:\/\/([^"'/]+)/gi capped at 50 (Mega Analyzer); preconnect 1 to 4 passes, > 4 warns, regex /<link[^>]+rel=["']preconnect["']/gi (Mega SEO Analyzer); dns-prefetch /<link[^>]+rel=["']dns-prefetch["']/i (Mega SEO Analyzer); link[rel=preconnect] > 0 and link[rel=dns-prefetch] > 0 (Analyzer); /(rel=["']preconnect["'])/i (Competitor Gap Matrix); max 4 to 6 preconnects, 300-500 ms handshake cost cited (CWV Fix Generator); preconnect third-party critical origins (Single Site Gen, Site Migration Gen, Analyzer scaffold). - Why: A DNS lookup plus TLS handshake to a font, image or script host costs 100 to 500 ms on mobile before the file even starts downloading; a hint lets the browser do it while the HTML is still parsing. - Fix: Add `<link rel="preconnect">` for the 2 to 4 origins that are render-critical (font host, LCP image host, critical API), with crossorigin only where the fetch is CORS-mode such as fonts.gstatic.com; give analytics and other async origins at most a dns-prefetch; preload the LCP hero with `<link rel="preload" as="image">`. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Trust Signal Surface](https://jwatte.com/tools/trust-signal-surface-audit/), [Competitor Gap Matrix](https://jwatte.com/tools/competitor-gap-matrix/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/) and 4 more. Standard: W3C Resource Hints / Preload. - [ ] **8.36 Font preload hints: `<n>`** - Pass: When the page declares @font-face, at least one `<link rel="preload" as="font">` exists. - Warn: Zero font preloads is reported as info (Mega SEO Analyzer). - Fail: @font-face declared with no font preload costs 10 points off the CWV Audit LCP signal. - Numbers and lists the tool uses: Regex /<link[^>]+rel=["']preload["'][^>]+as=["']font["']/gi, > 0 (Mega SEO Analyzer); /@font-face/g count in the HTML vs link[rel="preload"][as="font"], fontFaces > 0 and 0 preloads deducts 10 (CWV Audit); generator pattern `<link rel="preload" as="font" type="font/woff2" crossorigin>` (CWV Fix Generator). - Why: A font declared inside CSS is discovered late, after the stylesheet downloads; preloading pulls it to the start of the page load. - Fix: Preload the one or two critical woff2 files in `<head>` with as="font" type="font/woff2" crossorigin. - Verify: [Core Web Vitals Audit](https://jwatte.com/tools/cwv-audit/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [CWV Fix Generator](https://jwatte.com/tools/cwv-fix-generator/). - [ ] **8.37 font-display: swap / optional present: <yes/no>** - Pass: Every @font-face rule declares font-display: swap or optional. - Warn: @font-face present without font-display swap or optional (Mega SEO Analyzer). - Fail: @font-face present without the literal 'font-display:swap' costs 5 points off the CWV Audit CLS signal. - Numbers and lists the tool uses: Gate /@font-face/i, regex /font-display\s*:\s*(swap|optional)/i (Mega SEO Analyzer); literal 'font-display:swap' with no space, 5 points off the CLS signal (CWV Audit); generator pattern swap = immediate fallback text, optional = use the font only if cached, fallback = 100 ms block then 3 s swap, example woff2 with font-weight: 100 900 and unicode-range U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, up to 3 s of invisible text without it (CWV Fix Generator); font-display: swap (Single Site Gen, Site Migration Gen, Analyzer scaffold). - Why: Without font-display the browser can hide all text for up to 3 seconds while the web font downloads. - Fix: Add font-display: swap (or optional) to each @font-face rule so fallback text shows immediately. - Verify: [Core Web Vitals Audit](https://jwatte.com/tools/cwv-audit/), [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [CWV Fix Generator](https://jwatte.com/tools/cwv-fix-generator/) and 2 more. - [ ] **8.38 Font swap causes layout shift** - Pass: The fallback font is metric-matched to the web font with size-adjust, ascent-override, descent-override and line-gap-override. - Numbers and lists the tool uses: Generator pattern: @font-face 'Inter Fallback' with src: local('Arial'); ascent-override: 90.20%; descent-override: 22.48%; line-gap-override: 0%; size-adjust: 107.40%; body font-family: 'Inter', 'Inter Fallback', sans-serif. - Why: When the fallback font is a different size from the real one, the swap reflows every line of text, which shows up as layout shift. - Fix: Define a metric-matched fallback @font-face (generate the overrides with capsize or the font style matcher) and list it right after the web font in font-family. - Verify: [CWV Fix Generator](https://jwatte.com/tools/cwv-fix-generator/). Standard: https://github.com/seek-oss/capsize and https://meowni.ca/font-style-matcher/ cited as generators. - [ ] **8.39 Minified CSS/JS** - Pass: Stylesheets and scripts are served minified. - Why: Whitespace and comments in CSS and JS are bytes every visitor downloads for nothing. - Fix: Minify CSS and JS in the build step. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/), [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/). - [ ] **8.40 No abandoned-site tech fingerprints detected** - Pass: No IE-era polyfills or outdated libraries are present. - Fail: Detected, rated critical. - Numbers and lists the tool uses: Seven fingerprints on the raw HTML: html5shiv or html5shim, selectivizr, respond.js or respond.min.js, IE conditional comments via /<!--\s*\[if\s+(lt\s+)?IE/i, jQuery 1.x or 2.0 via /jquery[\/.-](1\.\d+|2\.0)/i, Bootstrap 2.x or 3.x via /bootstrap[\/.-](2\.\d+|3\.\d+)/i, AngularJS 1.x via /angular\.js\/1\.|angularjs\/1\./i; any match sets hasAbandonedTech and the check fails at severity critical, listing the detected names. - Why: IE-era polyfills and outdated libraries tell crawlers and AI retrieval engines the site has not been maintained (Ahrefs 2024 freshness study; Profound 2024 LLM-citation cohort). - Fix: Remove html5shiv, selectivizr, respond.js and IE conditional comments, and bring jQuery, Bootstrap and AngularJS up to current versions. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **8.41 Web app manifest linked** - Pass: The `<head>` links a web app manifest. - Warn: Missing is a warning in the Mega Analyzer report. - Numbers and lists the tool uses: link[rel=manifest] href, resolved against the audited URL; weight 3 in the Perf + AI score. - Why: Google Discover eligibility and the Chrome install prompt both depend on a manifest. - Fix: Add `<link rel="manifest" href="/site.webmanifest">` to the `<head>` of every page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: W3C Web Application Manifest. - [ ] **8.42 Non-passive scroll / touch listeners** - Pass: Touchstart, wheel and scroll listeners are registered with { passive: true }. - Numbers and lists the tool uses: Events touchstart, wheel, scroll; listeners that must call preventDefault are isolated to the specific element with { passive: false }. - Why: A single non-passive touch or wheel listener forces the browser to wait for your code before it can scroll, so every scroll stutters. - Fix: Mark scroll, wheel and touch listeners passive and isolate any listener that needs preventDefault. - Verify: [CWV Fix Generator](https://jwatte.com/tools/cwv-fix-generator/). - [ ] **8.43 Event handlers fire on every event (scroll / input / resize)** - Pass: High-frequency handlers are debounced, throttled or gated behind requestAnimationFrame. - Numbers and lists the tool uses: debounce 200 ms on input; throttle 100 ms on scroll with { passive: true }; requestAnimationFrame ticking pattern for scroll and resize; 60 events per second cited. - Why: An input or scroll handler that runs 60 times a second swamps the main thread and makes the page feel sticky. - Fix: Wrap input handlers in debounce, and scroll and resize handlers in throttle or a requestAnimationFrame gate. - Verify: [CWV Fix Generator](https://jwatte.com/tools/cwv-fix-generator/). - [ ] **8.44 Long tasks (>50ms) blocking main thread** - Pass: No JavaScript task runs longer than 50 ms. - Numbers and lists the tool uses: 50 ms long-task threshold; await scheduler.yield() inside loops (Chrome 129+); requestIdleCallback chunks with a 50 ms budget (performance.now() + 50); heavy work offloaded to a Web Worker via postMessage. - Why: Any script that runs for more than 50 ms blocks every tap and click until it finishes. - Fix: Split long work with scheduler.yield or requestIdleCallback, or move it to a Web Worker. - Verify: [CWV Fix Generator](https://jwatte.com/tools/cwv-fix-generator/). - [ ] **8.45 Below-fold sections rendered on first paint** - Pass: Long below-the-fold sections use content-visibility: auto with contain-intrinsic-size. - Numbers and lists the tool uses: content-visibility: auto; contain-intrinsic-size: auto 500px on .article-section.comments-list.related-posts.footer-wide; not applied to above-the-fold content such as .hero and .main-cta; 50-80% render-time cut cited. - Why: The browser lays out and paints the whole page on first load, including sections nobody has scrolled to; content-visibility lets it skip them until needed. - Fix: Apply content-visibility: auto with contain-intrinsic-size to long below-fold sections only, never to the hero. - Verify: [CWV Fix Generator](https://jwatte.com/tools/cwv-fix-generator/). - [ ] **8.46 Speculation Rules API: <enabled / not configured>** - Pass: A `<script type="speculationrules">` is present. - Warn: Not configured is reported as info. - Numbers and lists the tool uses: Regex /<script[^>]+type=["']speculationrules["']/i. - Why: Speculation rules let the browser prerender the page a visitor is most likely to open next, so it appears instantly. - Fix: Add a speculationrules script that prerenders or prefetches the likely next pages. - Verify: [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: Speculation Rules API. - [ ] **8.47 View Transitions API: detected** - Pass: The HTML contains a @view-transition rule or ::view-transition CSS (reported only when found). - Numbers and lists the tool uses: Regex /@view-transition\s*\{|::view-transition/i. - Why: Cross-document view transitions make page-to-page navigation feel like one smooth app. - Fix: Optional; add a @view-transition rule for cross-document transitions. - Verify: [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: View Transitions API. - [ ] **8.48 Service Worker detected** - Pass: The HTML registers a service worker. - Warn: None found is reported as info. - Numbers and lists the tool uses: Regex /serviceWorker|navigator\.serviceWorker/i on the HTML. - Why: A service worker allows offline access and background sync; not required, but useful for repeat visits. - Fix: Optional; register a service worker if offline access or repeat-visit caching would help the site. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **8.49 `<n>` Shopify app scripts loading** - Pass: 4 or fewer Shopify app embeds load. - Warn: 5 to 8. - Fail: More than 8. - Numbers and lists the tool uses: Count of /cdn/shop/apps/ or apps.shopifycdn.com references; 4, 8; Shopify sites only. - Why: Each installed app embed is a separate blocking request on every page. - Fix: In Shopify Admin > Apps > installed, disable or remove the apps you do not use. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **8.50 Custom CSS bundle size** - Pass: The Squarespace Custom CSS block is under 20,000 characters. - Warn: 20,000 characters or more. - Numbers and lists the tool uses: Length of the style id=customCss block; 20000; Squarespace sites only. - Why: A huge inline Custom CSS block is the most common Squarespace slowdown. - Fix: Consolidate and trim the Custom CSS block. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **8.51 `<n>` typography font sources** - Pass: No more than 2 font sources load. - Warn: More than 2. - Numbers and lists the tool uses: Count of use.typekit.net or fonts.squarespace.com references; 2; Squarespace sites only. - Why: Every extra font source is another download that can shift text after it appears. - Fix: Consolidate fonts under Design > Fonts. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **8.52 `<n>` parastorage bundles loaded** - Pass: 10 or fewer static.parastorage.com bundles load. - Warn: More than 10. - Numbers and lists the tool uses: Count of static.parastorage.com references; 10; Wix sites only. - Why: The Wix client-side runtime is one of the heaviest on the web, and every extra bundle adds to it. - Fix: Remove Wix apps and page elements you do not need. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **8.53 jQuery loading (Webflow default)** - Pass: The Webflow site does not load jQuery. - Warn: JQuery found. - Numbers and lists the tool uses: /js/webflow-`<hash>`.js plus jquery in the HTML; Webflow sites only. - Why: Webflow ships jQuery with every site by default even when nothing uses it. - Fix: Site Settings > Custom Code, disable jQuery if nothing depends on it. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **8.54 Contentful image CDN in use** - Pass: Images are served from ctfassets.net. - Warn: Not found. - Numbers and lists the tool uses: (images|assets|cdn).ctfassets.net; Contentful sites only. - Why: Serving Contentful images from anywhere else loses the on-the-fly resizing and the edge cache. - Fix: Serve images from ctfassets.net. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **8.55 Sanity reads via apicdn.sanity.io** - Pass: Content reads go through apicdn.sanity.io. - Warn: Only api.sanity.io found. - Numbers and lists the tool uses: apicdn.sanity.io vs api.sanity.io; neither host found is reported as info; Sanity sites only. - Why: Api.sanity.io hits the origin on every read while apicdn.sanity.io serves from an edge cache. - Fix: Switch reads to apicdn.sanity.io and keep api.sanity.io for writes. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **8.56 Data source: <this URL / origin-wide> (Chrome UX Report 28-day p75)** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: source = 'URL' when loadingExperience.metrics has keys, 'origin' when originLoadingExperience.metrics has keys, else null; when neither exists the Field Performance dimension is skipped (Mega SEO Analyzer) or the probe stops with 'No CrUX field data available for this URL or origin' (CrUX Field Data Probe); strategy mobile or desktop and overall_category shown; metric keys LARGEST_CONTENTFUL_PAINT_MS, INTERACTION_TO_NEXT_PAINT, CUMULATIVE_LAYOUT_SHIFT_SCORE, FIRST_CONTENTFUL_PAINT_MS, EXPERIMENTAL_TIME_TO_FIRST_BYTE; 28-day CrUX window. - Why: Origin-wide data means this specific page does not get enough Chrome traffic to have its own numbers, and no data at all means the site is too small or new to appear in the Chrome UX Report yet. - Fix: No fix; the site needs enough real Chrome visitors to appear in CrUX, so use lab tools in the meantime and wait 7 to 14 days after a fix for field data to reflect it. - Verify: [CrUX Field Data Probe](https://jwatte.com/tools/crux-field-data-probe/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: Chrome UX Report; Google PageSpeed Insights API v5. - [ ] **8.57 Format-conversion savings (WebP / AVIF)** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: Rendered when at least one image returned Content-Length > 0 and Content-Type image/*; projected WebP ratio: webp, avif, svg 1.0, gif 0.40, jpg/jpeg 0.75, png or other 0.22 under 50,000 bytes, 0.12 under 200,000, else 0.10; projected AVIF ratio: avif, svg 1.0, webp 0.70, gif 0.30, jpg/jpeg 0.50, png or other 0.16 under 50,000, 0.08 under 200,000, else 0.06; slow-4G transfer at 1600 kbps, seconds = bytes * 8 / 1024 / 1600; top 10 files by AVIF bytes saved; per-file and batch totals use the same ratios. - Why: The transfer-time difference is a direct LCP change on mobile, so this shows how many seconds the conversion would buy. - Fix: On WordPress, LiteSpeed Cache, Imagify, ShortPixel or WebP Express convert on upload; on a static site add a build step with sharp or squoosh-cli and a `<picture>` tag with WebP and AVIF sources. - Verify: [Image Alt Audit](https://jwatte.com/tools/image-alt-audit/). - [ ] **8.58 Marketing / runtime stack layers** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: analytics: GA4, Google Tag Manager, Plausible, Fathom Analytics, Matomo, Mixpanel, Segment, Hotjar, FullStory, Microsoft Clarity, Amplitude; consent: Cookiebot, OneTrust, CookieYes, Osano, Termly, iubenda, Complianz, Borlabs Cookie; payment: Stripe, PayPal, Square, Klarna, Afterpay, Braintree, Apple Pay; support: Intercom, Drift, Zendesk, Crisp Chat, Tidio, Help Scout Beacon; booking: Calendly, Cal.com; email: Mailchimp form, ConvertKit, Klaviyo; membership: Memberstack, Outseta, Pico. - Why: Knowing which third-party services the page loads is the starting point for deciding which ones cost more speed than they are worth. - Fix: Review the list against what the business actually uses and remove the rest. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). ## 9. Accessibility Accessibility is a legal exposure as well as a quality bar. This section is the WCAG 2.2 AA criteria the tools test, the critical failures that are also the most common lawsuit claims, forms, color scheme, and the accessibility statement page. **Verify this section with:** [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [ADA Litigation Risk Score](https://jwatte.com/tools/ada-litigation-risk/), [Legal Pages Generator](https://jwatte.com/tools/legal-pages-generator/), [Site Analyzer](https://jwatte.com/tools/analyzer/), [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/), [Migration Analyzer](https://jwatte.com/tools/migration-analyzer/), [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/), [Mega Batch](https://jwatte.com/tools/mega-batch/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [User Preference Media Queries Audit](https://jwatte.com/tools/prefers-color-scheme-audit/), [Rendered DOM Paste Audit](https://jwatte.com/tools/rendered-dom-paste-audit/), [Image LCP Candidate Audit](https://jwatte.com/tools/image-lcp-candidate-audit/), [Form Conversion Audit](https://jwatte.com/tools/form-conversion-audit/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/), [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/). - [ ] **9.1 Accessibility statement linked** - Pass: The site links to an accessibility statement page, or the page mentions an accessibility statement, WCAG conformance or ADA compliance. - Warn: ADA Litigation Risk warns instead of failing when no accessibility link or statement wording is found. - Fail: Mega Analyzer and E-E-A-T Analyzer fail the page when no accessibility statement link is found. - Numbers and lists the tool uses: Mega Analyzer link regex /\/(accessibility|a11y|accessibility-statement|ada)(\/|$)/i on hrefs; E-E-A-T Analyzer /accessibility|wcag/i on hrefs or the phrase 'accessibility statement' in body text; ADA Litigation Risk /\/accessibility(?:\.html|\/|")|accessibility statement|accessibility policy|ADA compliance|WCAG 2\.[12]/i on the HTML. - Why: An accessibility statement documents your conformance target and gives visitors a way to report barriers, and it is the first thing plaintiff-side ADA firms look for. - Fix: Publish an /accessibility/ page that names your WCAG 2.1 AA or 2.2 AA target, a contact email for barrier reports, known limitations and a last-updated date, and link it from the footer of every page. - Verify: [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [ADA Litigation Risk Score](https://jwatte.com/tools/ada-litigation-risk/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: W3C accessibility statement guidance; ADA Title III (2024 DOJ rule); EN 301 549. - [ ] **9.2 Accessibility Statement: required sections** - Pass: The statement names WCAG 2.2 Level AA as the target, lists the practices followed, discloses known limitations, gives a feedback channel with a response commitment, describes the stack and assistive-technology test matrix, and cites the regulations that apply. - Numbers and lists the tool uses: Target WCAG 2.2 Level AA (https://www.w3.org/TR/WCAG22/); practices: semantic HTML with proper heading hierarchy, keyboard-navigable controls with visible focus indicators, contrast 4.5:1 normal text and 3:1 large text, alt text on meaningful images and null alt on decorative, form labels and error messages associated with inputs, ARIA landmarks where semantic HTML is insufficient, responsive layout at 400% zoom without horizontal scroll; known limitations: older blog posts, third-party embeds (YouTube, maps, analytics iframes), PDFs older than the effective-date year; feedback: email with page URL, issue description and preferred format or assistive technology, response within 5 business days; tested with current NVDA, JAWS, VoiceOver, keyboard-only navigation and browser zoom up to 400%; stack phrase 'a modern web stack' for SaaS, otherwise 'standards-compliant HTML, CSS, and JavaScript'; regulations: ADA Title III and the September 2024 DOJ rule, EN 301 549 / European Accessibility Act, UK Public Sector Bodies (Websites and Mobile Applications) Accessibility Regulations 2018. - Why: A statement that names a target, admits known gaps and offers a working contact is documented good faith, which matters if a demand letter arrives. - Fix: Generate the statement with the Legal Pages Generator, then make the site actually meet each listed practice before publishing it. - Verify: [Legal Pages Generator](https://jwatte.com/tools/legal-pages-generator/). Standard: WCAG 2.2 AA; ADA Title III; DOJ September 2024 rule; EN 301 549; European Accessibility Act; UK PSBAR 2018. - [ ] **9.3 Accessibility overlay widget installed: `<vendor>`** - Pass: No third-party accessibility overlay widget is loaded on the page. - Warn: ADA Litigation Risk warns when an overlay is detected and reports 'No accessibility overlay detected' as information otherwise. - Fail: Mega Analyzer fails the page when any vendor signature matches in the first 250,000 characters of HTML. - Numbers and lists the tool uses: Mega Analyzer signatures: accessiBe /acsbapp\.com|acsbap\.com|acsb\.js|data-acsb|acsbJS/i; UserWay /cdn\.userway\.org|userway\.js|userwayApp|data-account[^>]{0,60}userway/i; AudioEye /wsmcdn\.audioeye\.com|audioeye_dom|ae-handle|window\.AudioEye|audioeye\.com\/ae\.js/i; EqualWeb /aacdn\.nagich|equalweb\.com\/[^"'\s]*\.js|INDmenu/i; Recite Me /api\.reciteme\.com|reciteme\.com\/[^"'\s]*\.js|Recite\.load/i, scanned in the first 250000 characters; ADA Litigation Risk /accessibe|userway\.org|equalweb|audioeye|accessibly|facilware|accessibility-widget|a11y-widget/i; evidence cited: FTC v. accessiBe consent order finalized April 2025 with a $1M penalty, UsableNet 2024 tracker with 1,023 of about 4,000 ADA Title III suits citing the overlay as a barrier, DOJ March 2022 web-accessibility guidance. - Why: Overlay widgets do not make a site WCAG conformant and are not a legal defense; they were named as a barrier in about a quarter of 2024 ADA Title III complaints. - Fix: Remove the overlay and fix the underlying HTML, CSS and ARIA problems; run the WCAG Accessibility Audit to find them. - Verify: [ADA Litigation Risk Score](https://jwatte.com/tools/ada-litigation-risk/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: WCAG 2.1 / 2.2 AA; ADA Title III; DOJ March 2022 web accessibility guidance; FTC v. accessiBe (April 2025). - [ ] **9.4 `<n>` PDF(s) linked from the homepage** - Pass: No public PDF links are on the page. - Warn: One or more links point to a PDF file. - Numbers and lists the tool uses: selectors a[href$=".pdf"], a[href*=".pdf?"]. - Why: PDFs that were never tagged for accessibility are a heavy ADA exposure because screen readers cannot read them in order. - Fix: Convert public PDFs to HTML where possible; where a PDF must stay, remediate it with tagging software (CommonLook, Axes4, Foxit) so it has tags, reading order and alt text on its images, and remove abandoned PDFs. - Verify: [ADA Litigation Risk Score](https://jwatte.com/tools/ada-litigation-risk/). Standard: ADA Title III. - [ ] **9.5 HTML lang attribute missing (WCAG 3.1.1)** - Pass: The `<html>` element has a non-empty lang attribute. - Fail: Analyzer, WCAG Quick Checks, WCAG Accessibility Audit (critical), ADA Litigation Risk and Migration Analyzer fail a missing lang; Batch Analyzer deducts its 12-point weight. - Numbers and lists the tool uses: lang read from documentElement: trimmed getAttribute in WCAG Quick Checks and WCAG Accessibility Audit, raw truthiness in Analyzer, ADA Litigation Risk, Batch Analyzer and Migration Analyzer; crit:true in WCAG Accessibility Audit; Batch Analyzer weight 12; WCAG Fix Generator sc=3.1.1, lvl=A, impact=serious. - Why: Screen readers use the page language to choose pronunciation rules, so a missing lang gets the content read in the wrong voice. - Fix: Add lang="en" (or the correct BCP-47 code such as en-US) to the `<html>` tag. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [ADA Litigation Risk Score](https://jwatte.com/tools/ada-litigation-risk/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/) and 2 more. Standard: WCAG 2.2 SC 3.1.1 Language of Page (Level A). - [ ] **9.6 Document title missing (WCAG 2.4.2)** - Pass: The page has a `<title>` that names both the page and the site and is at least 5 characters long. - Warn: WCAG Quick Checks warns when the title is shorter than 3 characters as a likely placeholder. - Fail: WCAG Accessibility Audit fails a missing title or one under 5 characters as a critical AA fail; WCAG Quick Checks fails only an empty title. - Numbers and lists the tool uses: minimum 3 characters (WCAG Quick Checks); minimum 5 characters, crit:true (WCAG Accessibility Audit); WCAG Fix Generator sc=2.4.2, lvl=A, impact=serious. - Why: The title is the first thing a screen reader announces and it identifies the page in tabs, history and search results. - Fix: Give every page a unique, descriptive `<title>` that names both the page and the site, such as 'Product Name, Acme', not 'Home' or the site name alone. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 2.4.2 Page Titled (Level A). - [ ] **9.7 Viewport blocks zoom (WCAG 1.4.4)** - Pass: A viewport meta tag is present and does not disable user scaling or cap maximum-scale. - Warn: Mega Analyzer warns when maximum-scale is present but below 5. - Fail: Zoom is blocked by user-scalable=no or 0, or maximum-scale=1 (WCAG Accessibility Audit also fails any maximum-scale below 1); Mega Analyzer and Analyzer also fail a missing viewport meta. - Numbers and lists the tool uses: regexes /user-scalable\s*=\s*(no|0)/ and /maximum-scale\s*=\s*1(?:\.0+)?/ on the lowercased content (WCAG Quick Checks, Batch Analyzer weight 5, Mega Batch weight 6); Migration Analyzer /user-scalable\s*=\s*no/i and /maximum-scale\s*=\s*1[^.0-9]/i on the raw content, passing when no viewport meta exists; Analyzer /maximum-scale\s*=\s*1(?:\.0+)?(?:\s*[,;]|\s*$)/; WCAG Accessibility Audit /maximum-scale\s*=\s*(1(?:\.0+)?|0\.\d+)/ with crit:true; Mega Analyzer fails on /user-scalable\s*=\s*(no|0)/ or /maximum-scale\s*=\s*1(?:\.0+)?\b/ on the lowercased content or a missing viewport, warns when parseFloat(maximum-scale) < 5, and its mobile-overflow scan re-flags /user-scalable\s*=\s*(no|0)|maximum-scale\s*=\s*1(?:\.0)?\b/i as a warning; WCAG Fix Generator sc=1.4.4, lvl=AA, impact=critical, test at 200% zoom at 1280x1024 with no horizontal scroll or cut-off content. - Why: Low-vision visitors need to pinch-zoom to at least 200%, and blocking zoom is one of the easiest accessibility failures for anyone to spot. - Fix: Use `<meta name="viewport" content="width=device-width, initial-scale=1">`, remove user-scalable=no and maximum-scale (or set maximum-scale=5.0), and use rem or em font sizes so the layout survives 200% zoom. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/) and 3 more. Standard: WCAG 2.2 SC 1.4.4 Resize Text and SC 1.4.10 Reflow (Level AA). - [ ] **9.8 color-scheme meta: set / not set** - Pass: The HTML carries `<meta name="color-scheme">` or the CSS declares the color-scheme property. - Warn: Prefers Color Scheme Audit warns when neither is set; Mega SEO Analyzer reports a missing meta as information only. - Numbers and lists the tool uses: HTML regex /<meta[^>]+name=["']color-scheme["']/i (both tools); CSS regex /color-scheme\s*:\s*(light|dark|light dark|dark light)/i (Prefers Color Scheme Audit). - Why: Without color-scheme the browser's native form controls and scrollbars ignore the visitor's light or dark preference. - Fix: Add `<meta name="color-scheme" content="light dark">` and html { color-scheme: light dark }. - Verify: [User Preference Media Queries Audit](https://jwatte.com/tools/prefers-color-scheme-audit/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: CSS color-scheme property; HTML meta name=color-scheme. - [ ] **9.9 prefers-color-scheme dark: `<n>`** - Pass: At least one @media rule targets prefers-color-scheme: dark in the inline styles or the first five linked stylesheets. - Warn: Prefers Color Scheme Audit warns when no dark-mode rule exists; Mega SEO Analyzer only reports a pass when one is found. - Numbers and lists the tool uses: regex /@media[^{]*prefers-color-scheme\s*:\s*dark/gi over every inline `<style>` plus the first 5 link[rel="stylesheet"] files (Prefers Color Scheme Audit); /prefers-color-scheme\s*:\s*dark/i on the HTML (Mega SEO Analyzer). - Why: Dark mode is a system preference visitors set on purpose, and a site that ignores it glares at them at night. - Fix: Define light values as CSS custom properties at :root and override them inside @media (prefers-color-scheme: dark); swap images per scheme with `<picture>``<source media="(prefers-color-scheme: dark)" srcset="dark.png">``<img src="light.png">``</picture>`. - Verify: [User Preference Media Queries Audit](https://jwatte.com/tools/prefers-color-scheme-audit/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: CSS media query prefers-color-scheme. - [ ] **9.10 prefers-reduced-motion guards: `<n>`** - Pass: At least one @media rule targets prefers-reduced-motion. - Warn: No reduced-motion rule is found in the inline styles or the first five linked stylesheets. - Numbers and lists the tool uses: regex /@media[^{]*prefers-reduced-motion/gi over every inline `<style>` plus the first 5 linked stylesheets. - Why: Visitors with vestibular disorders turn on reduced motion, and animations that ignore it can make them dizzy or sick. - Fix: Add @media (prefers-reduced-motion: reduce) { * { animation: none !important; transition: none !important; } } or scope the rule to your animated elements. - Verify: [User Preference Media Queries Audit](https://jwatte.com/tools/prefers-color-scheme-audit/). Standard: CSS media query prefers-reduced-motion. - [ ] **9.11 No `<main>` landmark (WCAG 1.3.1)** - Pass: The page has exactly one `<main>` element or role="main". - Warn: WCAG Quick Checks and Analyzer warn when main is missing, and WCAG Quick Checks also warns when more than one main exists. - Fail: WCAG Accessibility Audit fails a missing main and more than one main as critical fails; Mega Analyzer and Batch Analyzer fail a missing main. - Numbers and lists the tool uses: selector main, [role="main"]; exactly one (WCAG Quick Checks; WCAG Accessibility Audit multiMain > 1 crit:true); Batch Analyzer weight 8; Mega Analyzer reports main, nav, skip link, unique IDs and aria-label count in one block. - Why: Screen-reader users jump straight to the main landmark to skip the header and navigation on every page. - Fix: Wrap the primary content of each page in a single `<main id="main">` element and remove or nest any extras. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/). Standard: WCAG 2.2 SC 1.3.1 Info and Relationships (Level A). - [ ] **9.12 No `<nav>` or role="navigation"** - Pass: Primary navigation is wrapped in `<nav>` or role="navigation", the masthead in `<header>` or role="banner", and the site footer in `<footer>` or role="contentinfo". - Warn: Analyzer warns when the nav landmark is missing; WCAG Accessibility Audit warns when a nav, header or footer landmark is missing; Migration Analyzer warns when fewer than 2 landmarks of any kind are found. - Fail: Mega Analyzer and Batch Analyzer fail a missing navigation landmark. - Numbers and lists the tool uses: selectors nav, [role="navigation"]; header, [role="banner"]; footer, [role="contentinfo"]; Batch Analyzer nav weight 6; Migration Analyzer counts role banner/navigation/main/contentinfo plus main, nav, header, footer and needs at least 2. - Why: Landmarks let assistive-technology users jump to or past whole regions instead of tabbing through every link. - Fix: Use `<header>`, `<nav aria-label="Main navigation">`, `<main>` and `<footer>` for the page regions instead of generic `<div>`s. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/) and 1 more. Standard: WCAG 2.2 SC 1.3.1 Info and Relationships (landmarks). - [ ] **9.13 No skip-to-content link (WCAG 2.4.1)** - Pass: A skip link to the main content is the first focusable element on the page. - Warn: Analyzer, WCAG Quick Checks, ADA Litigation Risk and Migration Analyzer warn when no skip link is found; WCAG Quick Checks only checks pages that have a main landmark. - Fail: WCAG Accessibility Audit fails a missing skip link as a critical fail; Mega Analyzer and Batch Analyzer fail it. - Numbers and lists the tool uses: selectors a.skip-link, a[href="#main"], a[href="#content"] (Mega Analyzer, Analyzer); plus a[href^="#"][class*="skip"] gated on a main landmark (WCAG Quick Checks); plus a[href="#main-content"] or the first a[href^="#"] whose text matches /^\s*(skip|jump)\s+(to|past|link)/i (WCAG Accessibility Audit, crit:true); text /skip (?:to )?(?:main|content|nav)/i or a[href^="#main"], a[href^="#content"], a.skip-link, a.skip-nav (ADA Litigation Risk); a[href^=#main], a[href=#content], a[href=#main-content].skip-link, [class*=skip] (Migration Analyzer); Batch Analyzer weight 15; WCAG Fix Generator sc=2.4.1, lvl=A, impact=serious. - Why: Keyboard and screen-reader users otherwise have to tab through the whole navigation on every single page before reaching the content. - Fix: Add `<a href="#main" class="skip-link">`Skip to main content`</a>` as the first element in `<body>`, point it at `<main id="main">`, and keep it off-screen until it receives focus (.skip-link { position:absolute; top:-100px } .skip-link:focus { top:0 }). - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [ADA Litigation Risk Score](https://jwatte.com/tools/ada-litigation-risk/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/) and 3 more. Standard: WCAG 2.2 SC 2.4.1 Bypass Blocks (Level A). - [ ] **9.14 No H1 on page (WCAG 2.4.6)** - Pass: The page has exactly one `<h1>`. - Warn: More than one `<h1>`; WCAG Quick Checks separates visually-hidden H1s (the logo-as-H1 pattern) from visible ones. - Fail: Zero `<h1>` elements (a critical fail in WCAG Accessibility Audit). - Numbers and lists the tool uses: pass === 1, warn > 1, fail === 0; visually-hidden class regex /\b(visually-hidden|sr-only|screen-reader|visuallyhidden|vh-?hidden)\b/ on the lowercased class (WCAG Quick Checks). - Why: Screen readers and outline tools use the single H1 to tell the visitor what the page is about, and none or several confuses them. - Fix: Use one H1 per page that describes the page content and demote extra H1s (often a reused promo or newsletter section) to `<h2>`; with the logo-as-H1 pattern keep the visually-hidden one. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [ADA Litigation Risk Score](https://jwatte.com/tools/ada-litigation-risk/). Standard: WCAG 2.2 SC 2.4.6 Headings and Labels; SC 1.3.1. - [ ] **9.15 `<n>` skipped heading level(s) (WCAG 1.3.1)** - Pass: Headings follow a sequential order with no level jumping by more than one, and at least one heading exists. - Warn: A heading level jumps more than one step deeper than the previous one, such as H2 to H4. - Fail: Analyzer fails a page with no h1 to h6 headings at all. - Numbers and lists the tool uses: skip rule level[i] > level[i-1] + 1 in document order; WCAG Accessibility Audit lists each jump as h`<n>` -> h`<m>` with the first 40 characters of heading text. - Why: Screen readers build a page outline from heading levels, and a skipped level makes it sound like a section is missing. - Fix: Restore a sequential outline: h1, then h2, then h3, and never jump from h1 to h3 or h2 to h4. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/). Standard: WCAG 2.2 SC 1.3.1 Info and Relationships (Level A). - [ ] **9.16 `<n>` empty heading(s)** - Pass: No h1 to h6 element is empty. - Fail: WCAG Accessibility Audit fails any empty heading as a critical fail (crit:true). - Numbers and lists the tool uses: selector h1,h2,h3,h4,h5,h6; trimmed text length 0; crit:true. - Why: An empty heading is announced as a heading with nothing in it and breaks heading navigation. - Fix: Remove empty headings or fill in real text. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/). Standard: WCAG 2.2 SC 2.4.6 Headings and Labels. - [ ] **9.17 `<n>` heading(s) repeated 3+ times at the same level** - Pass: No heading text is repeated three or more times at one level. - Warn: The same heading text appears 3 or more times at the same level, such as five 'Read more' h3s in a card grid. - Numbers and lists the tool uses: count >= 3 per level plus lowercased text key; empty headings excluded. - Why: Repeated identical headings give screen-reader users an outline where every section sounds the same. - Fix: Make each repeated heading unique and descriptive of its own section. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/). Standard: WCAG 2.2 SC 2.4.6 Headings and Labels. - [ ] **9.18 Headings and labels, descriptive** - Pass: Every section heading and form label describes its content without needing the surrounding context. - Numbers and lists the tool uses: sc=2.4.6; lvl=AA; impact=serious. - Why: A heading that reads 'Form' or 'More' tells a screen-reader user scanning the outline nothing about what follows. - Fix: Rename generic headings and labels so they stand alone: 'Contact form' instead of 'Form'. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 2.4.6 Headings and Labels (Level AA). - [ ] **9.19 Info & relationships, semantic structure** - Pass: Structure that is visible on screen (regions, headings, tables, lists, grouped fields) is also conveyed by semantic HTML. - Numbers and lists the tool uses: sc=1.3.1; lvl=A; impact=serious. - Why: A layout built from styled `<div>`s looks organized but sounds like one long paragraph to a screen reader. - Fix: Use real semantic elements (`<nav>`, `<main>`, `<article>`, `<aside>`, `<header>`, `<footer>`, `<h1>` to `<h6>`) instead of `<div>`; give tables `<th scope="col|row">`, grouped fields `<fieldset>``<legend>`, and lists `<ul>``<li>` instead of ; treat ARIA roles as the last resort. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 1.3.1 Info and Relationships (Level A). - [ ] **9.20 Meaningful sequence, reading order** - Pass: The visual order of content matches the DOM order. - Numbers and lists the tool uses: sc=1.3.2; lvl=A; impact=serious. - Why: Screen readers read the DOM in source order, so content moved around with CSS positioning is read out of sequence. - Fix: Avoid position:absolute or order tricks that rearrange visual content away from the source order; restructure the HTML instead. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 1.3.2 Meaningful Sequence (Level A). - [ ] **9.21 `<n>` data table(s) have no `<th>` / `<thead>`** - Pass: Every table contains a `<th>` or a `<thead>`. - Numbers and lists the tool uses: gated on tables.length > 0; a table with no `<th>` and no `<thead>` fails; crit:true. - Why: Without header cells a screen reader cannot tell the visitor which column or row a value belongs to. - Fix: Give data tables `<th>` header cells and a `<caption>`; if a table is only used for layout, add role="presentation". - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/). Standard: WCAG 2.2 SC 1.3.1 Info and Relationships. - [ ] **9.22 `<n>` list(s) contain non-`<li>` children** - Pass: Every `<ul>` and `<ol>` contains only `<li>` children. - Warn: A list has child elements and every one of them is something other than `<li>`. - Numbers and lists the tool uses: selector ul, ol; children.length > 0 and every child tagName !== 'LI'. - Why: A list that holds `<div>`s instead of items is announced as an empty list and loses its item count. - Fix: Wrap the content inside `<li>` elements or switch the container to `<div>`. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/). Standard: WCAG 2.2 SC 1.3.1 Info and Relationships. - [ ] **9.23 Images missing alt text (`<n>`)** - Pass: Every `<img>` has an alt attribute: descriptive text for content images and alt="" for decorative ones. - Warn: Analyzer, Rendered DOM Paste Audit and ADA Litigation Risk (below 10% of images) report missing alt as a warning, and Migration Analyzer warns at 1 to 3 missing. - Fail: ADA Litigation Risk fails at 10% or more of images missing alt, Migration Analyzer fails at more than 3, Batch Analyzer fails below 80% coverage, and WCAG Accessibility Audit counts any missing alt as a critical AA fail. - Numbers and lists the tool uses: Mega Analyzer, Batch Analyzer prompt and Mega Batch count alt missing or alt === '' (src, data-src or '(no src)' listed, prompt caps 20); WCAG Quick Checks, WCAG Accessibility Audit, ADA Litigation Risk, Rendered DOM Paste Audit and Migration Analyzer count only a missing alt attribute (alt="" passes); Analyzer treats alt plus role="presentation", role="none" or aria-hidden="true" as decorative and lists up to 30; ADA Litigation Risk pct = round(missing / total * 100), warn below 10, fail at 10 or more; Migration Analyzer warn 1 to 3, fail over 3; Batch Analyzer pass when 0 images or withAlt / imgs >= 0.8, weight 15; Mega Batch weight 12; Mega Analyzer emits the itemized fix section when imgsMissingAlt + imgsMissingDims + imgsLegacy + dupIds > 0; WCAG Fix Generator sc=1.1.1, lvl=A, impact=critical. - Why: Missing alt text is the lead complaint in most ADA demand letters and it hides what the image says from screen readers and search engines. - Fix: Add descriptive alt text to every content image and alt="" (optionally with role="presentation" or aria-hidden="true") to decorative ones; give complex graphics a long description through aria-describedby or a `<details>` element. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [ADA Litigation Risk Score](https://jwatte.com/tools/ada-litigation-risk/), [Rendered DOM Paste Audit](https://jwatte.com/tools/rendered-dom-paste-audit/) and 5 more. Standard: WCAG 2.2 SC 1.1.1 Non-text Content (Level A); ADA Title III. - [ ] **9.24 `<n>` image(s) have alt="" but look meaningful (>=64px)** - Pass: No image with an empty alt is 64 pixels or larger unless it is marked decorative. - Warn: An image has alt="", no role="presentation" or aria-hidden="true", and a width or height attribute of 64 or more. - Numbers and lists the tool uses: width >= 64 or height >= 64 from the attributes (default 0); exempt when role="presentation" or aria-hidden="true". - Why: A large image with an empty alt is usually a content image that was marked decorative by mistake, so screen readers skip it. - Fix: Confirm each flagged image is truly ornamental, otherwise write real alt text for it. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/). Standard: WCAG 2.2 SC 1.1.1 Non-text Content. - [ ] **9.25 `<n>` image(s) use a filename / placeholder as alt** - Pass: No alt text is a filename or a generic placeholder word. - Fail: An image's trimmed alt matches the filename or placeholder pattern. - Numbers and lists the tool uses: FILENAME_ALT_RE = /^(image|img|picture|photo|graphic|screenshot)[-_ ]?\d*$|\.(jpg|jpeg|png|gif|webp|svg|bmp|tiff?)$/i on the trimmed alt; severity fail, not flagged crit. - Why: An alt of 'image1.jpg' or 'photo' tells a screen-reader user nothing about what the picture shows. - Fix: Rewrite each flagged alt to describe what the image communicates. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/). Standard: WCAG 2.2 SC 1.1.1 Non-text Content. - [ ] **9.26 `<n>` image(s) have alt >250 chars** - Pass: No alt attribute is longer than 250 characters. - Warn: An alt attribute is longer than 250 characters. - Numbers and lists the tool uses: alt length > 250. - Why: Alt text that long is read in one unbroken stream with no way to pause, and it belongs in a caption or the body text. - Fix: Move the long description into adjacent body text or a caption and keep the alt short. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/). Standard: WCAG 2.2 SC 1.1.1 Non-text Content. - [ ] **9.27 `<n>` image-map area(s) missing alt** - Pass: Every `<area href>` inside a `<map>` has alt text. - Numbers and lists the tool uses: gated on map area count > 0; any area[href] with a missing or empty alt fails. - Why: Image-map hotspots are links, and without alt their destinations have no name for screen readers. - Fix: Give each `<area>` an alt that describes its link target. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/). Standard: WCAG 2.2 SC 1.1.1 Non-text Content. - [ ] **9.28 LCP candidate alt text: "`<alt>`" | (missing)** - Pass: The first image on the page (the likely hero or LCP image) has non-empty alt text. - Warn: The first image has no alt or an empty alt. - Numbers and lists the tool uses: first `<img>` only; alt shown truncated to 60 characters. - Why: The hero image is the most visible image on the page, so a missing alt there is both a WCAG 1.1.1 failure and a lost search signal. - Fix: Add descriptive alt text to the hero image. - Verify: [Image LCP Candidate Audit](https://jwatte.com/tools/image-lcp-candidate-audit/). Standard: WCAG 2.2 SC 1.1.1 Non-text Content. - [ ] **9.29 `<n>` image-only link(s) have no accessible name** - Pass: Every link that wraps only an image has alt text on the image or an aria-label on the link. - Numbers and lists the tool uses: selector a[href] img; link text with whitespace removed has length 0, no aria-label on the anchor, image alt trims to empty; crit:true; each anchor href listed. - Why: Screen readers announce the raw URL or skip the link entirely when a logo or icon link has no name. - Fix: Add alt text to the wrapped image or an aria-label to the anchor. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/). Standard: WCAG 2.2 SC 2.4.4 Link Purpose. - [ ] **9.30 Images of text, replace with real text where possible** - Pass: Text is delivered as HTML text styled with CSS, not baked into image files, apart from logos and essential branding. - Numbers and lists the tool uses: sc=1.4.5; lvl=AA; impact=moderate. - Why: Text inside an image cannot be read by screen readers, translated, or resized cleanly. - Fix: Replace hero banners and headings rendered as images with real HTML text styled with CSS; logos and essential branding are exempt. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 1.4.5 Images of Text (Level AA). - [ ] **9.31 `<n>` generic link text instance(s) ("click here", "read more", etc.)** - Pass: Link text describes the destination on its own, and no links use generic phrases such as 'click here' or 'read more'. - Warn: Analyzer warns on any vague link; Mega Analyzer warns when 10% or more of anchors are generic. - Fail: WCAG Accessibility Audit fails any generic link that has no aria-label, aria-labelledby or title as a critical fail. - Numbers and lists the tool uses: Analyzer regex /^(click here|here|read more|learn more|more|link)$/i on the trimmed text of every `<a>`; Mega Analyzer lowSignalRe = /^\s*(click\s+here|read\s+more|learn\s+more|here|this\s+page|this\s+link|link|more|continue|→|»)\s*$/i on trimmed a[href] text, gate anchorsTotal > 0, lowPct = round(anchorsLowSignal / anchorsTotal * 100), warn when lowPct >= 10; WCAG Accessibility Audit LOW_SIGNAL = /^\s*(click\s+here|read\s+more|learn\s+more|more|here|this\s+page|this\s+link|link|continue|details|info|find\s+out\s+more|→|»|>>?)\s*\.?$/i, links with href matching /^(#|mailto:|tel:|javascript:)/i excluded, list capped at 20 with text sliced to 40 chars, crit:true; WCAG Fix Generator sc=2.4.4, lvl=A, impact=critical, flagged phrases 'click here', 'read more', 'learn more'. - Why: Screen-reader users often navigate by a list of links, and 'click here' repeated ten times gives them nothing to choose from. - Fix: Rewrite each link so the text alone names the destination, for example 'Read the 2026 pricing guide' instead of 'Click here'; where the surrounding context is needed, add an aria-label. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 2.4.4 Link Purpose (In Context) (Level A). - [ ] **9.32 `<n>` link(s) with no accessible name (WCAG 2.4.4, 4.1.2)** - Pass: Every a[href] has a non-empty accessible name from visible text, an image alt, aria-label, aria-labelledby or title. - Numbers and lists the tool uses: WCAG Quick Checks accessible-name order: aria-label; aria-labelledby (visible text of each referenced id, joined); for img, area and input the alt, then value when type is submit or button; visible text with whitespace collapsed; title attribute; WCAG Accessibility Audit: text with whitespace removed has length 0, no aria-label, no aria-labelledby and no img[alt]:not([alt=""]) descendant, links with href matching /^(#|mailto:|tel:|javascript:)/i excluded, list capped at 20, crit:true. - Why: An icon-only link with no name is invisible to screen readers, so social icons and cart links become unusable. - Fix: Give the link visible text, alt text on the wrapped image, or an aria-label. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/). Standard: WCAG 2.2 SC 2.4.4 Link Purpose; SC 4.1.2 Name, Role, Value. - [ ] **9.33 `<n>` button(s) with no accessible name (WCAG 4.1.2)** - Pass: Every button and button-like control has an accessible name from text content, a value, an aria-label, or an image child with alt. - Numbers and lists the tool uses: WCAG Quick Checks selector button, input[type="button"], input[type="submit"], input[type="reset"], [role="button"] with the same accessible-name order as the link check; WCAG Accessibility Audit `<button>` with whitespace-removed text length 0, no aria-label, no aria-labelledby and no img[alt]:not([alt=""]) or svg title descendant, list capped at 20, crit:true; WCAG Fix Generator sub-code 1.1.1b, lvl=A, impact=critical, covers inputs, selects, textareas and buttons. - Why: An unnamed button is announced only as 'button', so the visitor has no idea what pressing it will do. - Fix: Give each button visible text, a value, an aria-label (for example `<button aria-label="Close dialog">`X`</button>`), or an image child with alt. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 4.1.2 Name, Role, Value (Level A). - [ ] **9.34 `<n>` element(s) have onclick but no keyboard handler / role / tabindex** - Pass: Every clickable element is a native control or has a role, a tabindex and a keyboard handler. - Numbers and lists the tool uses: [onclick] elements whose tag is not A, BUTTON, INPUT, SELECT or TEXTAREA and that have no role and no tabindex; list capped at 20; crit:true; WCAG Fix Generator sc=2.1.1, lvl=A, impact=critical. - Why: A `<div onclick>` works with a mouse but cannot be reached or activated from the keyboard, which locks out keyboard and switch users. - Fix: Use a real `<button>`, or add role="button", tabindex="0" and a keydown handler for Enter and Space. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 2.1.1 Keyboard (Level A). - [ ] **9.35 `<n>` modal dialog(s) detected / No modal dialogs detected on homepage** - Pass: Keyboard focus can enter and leave every widget; modal dialogs trap focus while open, close on Escape and return focus to the trigger. - Numbers and lists the tool uses: ADA Litigation Risk counts [role="dialog"], [aria-modal].modal, [class*="modal"], passes at 0 and reports any count as information to verify manually; WCAG Fix Generator sc=2.1.2, lvl=A, impact=critical. - Why: A modal that swallows keyboard focus with no way out is one of the most common and most serious keyboard failures. - Fix: Test each modal by keyboard: Escape closes it, focus returns to the element that opened it, and Tab stays inside while it is open; watch for iframes without focus management and autofocus handlers that loop. - Verify: [ADA Litigation Risk Score](https://jwatte.com/tools/ada-litigation-risk/), [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 2.1.2 No Keyboard Trap (Level A). - [ ] **9.36 Focus order, tab order follows logical sequence** - Pass: Tab order follows the reading order, with no positive tabindex values. - Numbers and lists the tool uses: sc=2.4.3; lvl=A; impact=serious; avoid tabindex>0. - Why: Keyboard users move through the page in DOM order, so a layout that differs from it sends them jumping around the screen. - Fix: Let DOM order set the tab order, never use tabindex greater than 0, and only reorder with CSS Grid or Flexbox where the visual order still matches the reading order. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 2.4.3 Focus Order (Level A). - [ ] **9.37 `<n>` element(s) rely on title attribute alone for their accessible name** - Pass: Fewer than 3 elements depend on the title attribute alone for their name. - Warn: 3 or more elements have a title attribute but no aria-label, no text content and no img[alt] descendant. - Numbers and lists the tool uses: trigger count >= 3; tag names excluded LINK, IFRAME, META, SCRIPT, STYLE, SVG, USE, PATH. - Why: Title tooltips never appear on touch screens and screen readers handle them inconsistently. - Fix: Use visible text, aria-label or aria-labelledby instead of relying on title. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/). Standard: WCAG 2.2 SC 1.4.13 Content on Hover or Focus. - [ ] **9.38 `<n>` element(s) where aria-label does not contain the visible text** - Pass: Every button and link that carries an aria-label includes its visible text in that label. - Warn: Visible text (aria-hidden descendants removed) is longer than 2 characters, the aria-label is longer than 2 characters, and the label does not include the visible text. - Numbers and lists the tool uses: selectors button[aria-label], a[aria-label]; [aria-hidden="true"] descendants removed; whitespace collapsed to one space and lowercased; symbol-only visible text (no /[a-z0-9]/ match) exempt; list capped at 10 with text sliced to 30 chars; WCAG Fix Generator sc=2.5.3, lvl=A, impact=serious. - Why: Voice-control users say the words they see, and if the accessible name is different the command does nothing. - Fix: Make the aria-label start with or contain the visible text; do not set aria-label="Send" on a button that says 'Submit'. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 2.5.3 Label in Name (Level A). - [ ] **9.39 `<n>` element(s) have unrecognized ARIA role(s)** - Pass: Every role attribute uses a valid WAI-ARIA role token. - Numbers and lists the tool uses: VALID_ROLES = alert, alertdialog, application, article, banner, button, cell, checkbox, columnheader, combobox, complementary, contentinfo, definition, dialog, directory, document, feed, figure, form, grid, gridcell, group, heading, img, link, list, listbox, listitem, log, main, marquee, math, menu, menubar, menuitem, menuitemcheckbox, menuitemradio, navigation, none, note, option, presentation, progressbar, radio, radiogroup, region, row, rowgroup, rowheader, scrollbar, search, searchbox, separator, slider, spinbutton, status, switch, tab, table, tablist, tabpanel, term, textbox, timer, toolbar, tooltip, tree, treegrid, treeitem; fails when the role attribute is non-empty and every space-separated token is absent from the list; list capped at 20; crit:true. - Why: A misspelled role is silently ignored, so the element loses the meaning you meant to give it. - Fix: Correct the role to a valid token such as button, link, navigation, main, dialog, alert or region. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/). Standard: WCAG 2.2 SC 4.1.2 Name, Role, Value; WAI-ARIA roles. - [ ] **9.40 `<n>` unknown aria-* attribute(s)** - Pass: Every aria-* attribute is a known WAI-ARIA state or property. - Warn: An attribute name starts with aria- but is not in the known list. - Numbers and lists the tool uses: VALID_ARIA_ATTRS = aria-activedescendant, aria-atomic, aria-autocomplete, aria-busy, aria-checked, aria-colcount, aria-colindex, aria-colspan, aria-controls, aria-current, aria-describedby, aria-details, aria-disabled, aria-dropeffect, aria-errormessage, aria-expanded, aria-flowto, aria-grabbed, aria-haspopup, aria-hidden, aria-invalid, aria-keyshortcuts, aria-label, aria-labelledby, aria-level, aria-live, aria-modal, aria-multiline, aria-multiselectable, aria-orientation, aria-owns, aria-placeholder, aria-posinset, aria-pressed, aria-readonly, aria-relevant, aria-required, aria-roledescription, aria-rowcount, aria-rowindex, aria-rowspan, aria-selected, aria-setsize, aria-sort, aria-valuemax, aria-valuemin, aria-valuenow, aria-valuetext; list capped at 15. - Why: A typo such as aria-labeledby (one L) does nothing, and the control stays unlabeled. - Fix: Correct the attribute to the valid ARIA spelling or remove it. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/). Standard: WCAG 2.2 SC 4.1.2 Name, Role, Value; WAI-ARIA states and properties. - [ ] **9.41 Name, role, value, custom widgets have ARIA** - Pass: Custom components (dropdowns, tabs, modals, tree views) expose a role and their state through ARIA attributes. - Numbers and lists the tool uses: sc=4.1.2; lvl=A; impact=critical; patterns https://www.w3.org/WAI/ARIA/apg/patterns/. - Why: A tab strip or dropdown built from plain `<div>`s has no name, role or state, so a screen reader cannot operate it. - Fix: Add the role plus state attributes for each widget, such as role="tab", aria-selected="true", aria-expanded="false" inside `<ul role="tablist">`, following the WAI-ARIA Authoring Practices pattern for that widget. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 4.1.2 Name, Role, Value (Level A). - [ ] **9.42 ARIA labels: `<n>` elements** - Pass: More than 3 elements carry an aria-label (Analyzer), or at least 3 (Batch Analyzer). - Warn: Analyzer warns at 1 to 3 aria-labels and reports 0 as information. - Fail: Batch Analyzer fails fewer than 3. - Numbers and lists the tool uses: Analyzer pass > 3, warn 1 to 3, info at 0; Batch Analyzer min 3, weight 10; Mega Analyzer reports the count in its landmarks block and passes when ariaLabels > 0. - Why: Icon buttons, search fields and social links usually need aria-labels, so a page with none has probably left its controls unnamed. - Fix: Add aria-label to icon-only controls and to any element whose purpose is not clear from its visible text. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/). - [ ] **9.43 ARIA roles: `<n>` elements** - Pass: More than 3 elements carry a role attribute (Analyzer), or at least 2 (Batch Analyzer). - Fail: Batch Analyzer fails fewer than 2 role attributes; Analyzer reports 3 or fewer as information. - Numbers and lists the tool uses: Analyzer pass > 3, info <= 3; Batch Analyzer min 2, weight 6. - Why: Landmark and widget roles tell assistive technology what each region and control is. - Fix: Prefer semantic HTML landmarks (header, nav, main, footer) and add ARIA roles only where no native element fits. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/). - [ ] **9.44 `<n>` interactive target(s) below 24x24 px (WCAG 2.5.8, 2.2 AA)** - Pass: No link, button or input declares a width or height under 24 CSS pixels. - Warn: WCAG Quick Checks flags interactive elements whose inline style sets both width and height in px with either under 24; WCAG Accessibility Audit flags a width or height attribute or inline style under 24. - Numbers and lists the tool uses: minimum 24x24 CSS px; WCAG Quick Checks selector a, button, input[type="button"], input[type="submit"], input[type="checkbox"], input[type="radio"], [role="button"], style matching both /\bwidth\s*:\s*(\d+)\s*px/i and /\bheight\s*:\s*(\d+)\s*px/i; WCAG Accessibility Audit selectors a[href], button, input[type="button"], input[type="submit"], width or height attribute or inline /width\s*:\s*(\d+)/ and /height\s*:\s*(\d+)/, a dimension of 0 ignored; only inline sizes are inspected, CSS-driven sizes are not measured; the generated-site build spec asks for 44x44 px touch targets (Single Site Gen). - Why: Tiny icon buttons are hard to hit for anyone with a tremor or a large thumb, and WCAG 2.2 now sets a 24 pixel floor. - Fix: Make every click target at least 24x24 CSS pixels, usually by adding padding. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/). Standard: WCAG 2.2 SC 2.5.8 Target Size (Minimum) (Level AA). - [ ] **9.45 Pointer gestures, complex gestures have single-point alternative** - Pass: Every pinch, swipe or multi-point gesture has a single-tap alternative. - Numbers and lists the tool uses: sc=2.5.1; lvl=A; impact=moderate. - Why: Visitors with motor impairments cannot perform complex gestures. - Fix: Add plus and minus buttons for zoom and next and previous buttons for swipe carousels. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 2.5.1 Pointer Gestures (Level A). - [ ] **9.46 Pointer cancellation, down-event triggers action** - Pass: Click actions fire on pointer-up, not pointer-down. - Numbers and lists the tool uses: sc=2.5.2; lvl=A; impact=moderate. - Why: Visitors need to be able to drag off a button to abort a press they started by mistake. - Fix: Handle on:click rather than on:mousedown. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 2.5.2 Pointer Cancellation (Level A). - [ ] **9.47 Motion actuation, shake-to-undo has alternative** - Pass: Any feature triggered by device motion (shake, tilt) has an on-screen alternative. - Numbers and lists the tool uses: sc=2.5.4; lvl=A; impact=moderate. - Why: Visitors with tremor or in motorized wheelchairs trigger motion features by accident. - Fix: Provide a button for anything shake-to-undo or tilt-to-rotate does. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 2.5.4 Motion Actuation (Level A). - [ ] **9.48 Inline scripts attach keyboard listeners** - Pass: Single-character keyboard shortcuts can be turned off, remapped, or only fire while a control has focus. - Numbers and lists the tool uses: WCAG Accessibility Audit reports as information when /addEventListener\s*\(\s*['"](?:keydown|keypress|keyup)['"]/ matches the HTML; WCAG Fix Generator sc=2.1.4, lvl=A, impact=moderate. - Why: Speech-input users dictate words that contain the shortcut letters, so a single-key shortcut fires by accident. - Fix: If you ship single-key shortcuts, add a setting to disable or remap them, or scope them to a focused control, and verify by hand. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 2.1.4 Character Key Shortcuts (Level A). - [ ] **9.49 WCAG 2.4.7: Focus visible** - Pass: The CSS defines a visible focus indicator (a :focus-visible or :focus rule) and never removes the outline without a replacement. - Warn: Analyzer warns when no focus rule is found in the HTML or the first three same-origin stylesheets; WCAG Accessibility Audit warns when outline:none appears but a :focus-visible rule also exists. - Fail: WCAG Accessibility Audit fails as critical when outline:none or outline:0 appears and :focus-visible appears nowhere in the served HTML. - Numbers and lists the tool uses: Analyzer /focus-visible|:focus\s*\{/ on the HTML, then /focus-visible/i on the first 3 same-origin link[rel="stylesheet"] files; WCAG Accessibility Audit counts /outline\s*:\s*(none|0)/gi in the served HTML only and tests /:focus-visible/i, linked stylesheets are not read so a pass means not detected; WCAG Fix Generator sc=2.4.7, lvl=AA, impact=critical, indicator contrast 3:1, forbidden pattern :focus { outline: none } without replacement; the generated-site build spec asks for a focus ring of at least 2px at 3:1 (Single Site Gen). - Why: Keyboard users need to see which element is active, and :focus { outline: none } with no replacement leaves them blind. - Fix: Add :focus-visible { outline: 2px solid #f59e0b; outline-offset: 2px; } to your stylesheet, and never remove an outline without providing a replacement of at least 3:1 contrast. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 2.4.7 Focus Visible (Level AA). - [ ] **9.50 Sticky/fixed elements detected, verify focus ring not hidden behind them** - Pass: When an element receives keyboard focus, no sticky or fixed header or footer hides it. - Numbers and lists the tool uses: WCAG Accessibility Audit reports as information when /position\s*:\s*(sticky|fixed)/i matches the HTML; WCAG Fix Generator sc=2.4.11, lvl=AA, impact=serious, scroll-margin-top: 80px. - Why: A sticky header can cover the link a keyboard user just tabbed to, so they cannot see where they are. - Fix: Tab through the page and confirm focused elements stay visible; add scroll-margin-top: 80px to focusable elements or scroll-padding-top on the scroll container. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 2.4.11 Focus Not Obscured (Minimum) (Level AA). - [ ] **9.51 WCAG 1.4.3: Color contrast** - Pass: Body text reaches 4.5:1 contrast against its background and large text reaches 3:1. - Warn: ADA Litigation Risk warns when an inline color declaration uses a very light hex value; Analyzer always reports contrast as information because it cannot measure it. - Numbers and lists the tool uses: ADA Litigation Risk regex /color\s*:\s*#(?:c|d|e|f)(?:c|d|e|f)(?:c|d|e|f)/i on the HTML (approximation only); WCAG Fix Generator sc=1.4.3, lvl=AA, impact=critical, body text 4.5:1, large text (18pt or 14pt bold and up) 3:1, suggested gold body color #c07400 on cream; the generated-site build spec requires 4.5:1 text and 3:1 large text (Single Site Gen). - Why: Light grey or gold text on a pale background is the most common contrast failure and is unreadable for many low-vision visitors. - Fix: Check colors with the WebAIM contrast checker or WAVE, then darken the text or lighten the background until body text reaches 4.5:1 and large text 3:1. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [ADA Litigation Risk Score](https://jwatte.com/tools/ada-litigation-risk/), [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 1.4.3 Contrast (Minimum) (Level AA). - [ ] **9.52 Non-text contrast, UI components below 3:1** - Pass: Button borders, input borders, focus indicators and meaningful icons reach 3:1 contrast against their adjacent color. - Numbers and lists the tool uses: sc=1.4.11; lvl=AA; impact=serious; 3:1 against the adjacent color. - Why: Thin grey form borders on a white background are the most common failure, and low-vision visitors cannot find the field. - Fix: Darken control borders, focus rings and icons until they reach 3:1 against the surrounding color. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 1.4.11 Non-text Contrast (Level AA). - [ ] **9.53 Use of color, color alone is not the sole indicator** - Pass: Color is never the only way a state, an error or a link is conveyed. - Numbers and lists the tool uses: sc=1.4.1; lvl=A; impact=serious. - Why: Color-blind visitors cannot tell a red error from normal text or a colored link from body copy. - Fix: Pair red error text with a label or icon, pair required-field asterisks with aria-required or explicit labeling, and underline links in body text. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 1.4.1 Use of Color (Level A). - [ ] **9.54 Sensory characteristics, do not rely on shape/color alone** - Pass: Instructions never depend on shape, color or position alone. - Numbers and lists the tool uses: sc=1.3.3; lvl=A; impact=moderate. - Why: 'Click the red button' or 'see the box on the right' means nothing to a visitor who cannot perceive that cue. - Fix: Always include a text label in instructions alongside any shape, color or position reference. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 1.3.3 Sensory Characteristics (Level A). - [ ] **9.55 Text spacing, breaks when user overrides line-height / letter-spacing** - Pass: Content is not cut off and does not overlap when the visitor applies wider text spacing. - Numbers and lists the tool uses: sc=1.4.12; lvl=AA; impact=moderate; line-height 1.5x, paragraph spacing 2x, letter-spacing 0.12x, word-spacing 0.16x. - Why: Dyslexic readers widen spacing with a browser extension, and fixed-height text boxes then clip the words. - Fix: Avoid fixed-height containers for text and prefer min-height so the box grows with the spacing. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 1.4.12 Text Spacing (Level AA). - [ ] **9.56 Hover / focus popups, not dismissable or not hoverable** - Pass: Tooltips and popovers that appear on hover or focus can be dismissed with Escape, can be hovered without vanishing, and stay until dismissed or focus moves. - Numbers and lists the tool uses: sc=1.4.13; lvl=AA; impact=moderate; three requirements: dismissable (Esc), hoverable, persistent. - Why: A dropdown that disappears as the pointer moves toward it is unusable for anyone with unsteady hands or screen magnification. - Fix: Make every hover or focus popup dismissable, hoverable and persistent, and remove on-hover menus that vanish as the visitor moves toward them. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 1.4.13 Content on Hover or Focus (Level AA). - [ ] **9.57 Orientation, content does not require specific orientation** - Pass: The page works in both portrait and landscape unless one orientation is essential. - Numbers and lists the tool uses: sc=1.3.4; lvl=AA; impact=moderate. - Why: Visitors with a device mounted to a wheelchair cannot rotate it to suit the site. - Fix: Remove any CSS rotation lock; only something like a piano app may require one orientation. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 1.3.4 Orientation (Level AA). - [ ] **9.58 `<n>` form control(s) without a label (WCAG 1.3.1, 3.3.2)** - Pass: Every input, select and textarea has a programmatic label: a `<label for>`, a wrapping `<label>`, aria-label or aria-labelledby. - Warn: Analyzer warns on unlabeled inputs and reports a page with no inputs as information. - Fail: WCAG Accessibility Audit, WCAG Quick Checks, ADA Litigation Risk and Form Conversion Audit fail any unlabeled control (critical in WCAG Accessibility Audit). - Numbers and lists the tool uses: Analyzer selector input:not([type="hidden"]):not([type="submit"]):not([type="button"]):not([name="bot-field"]),select,textarea, labeled by aria-label, aria-labelledby, title, label[for=id] or a `<label>` ancestor; WCAG Quick Checks selector input:not([type="button"]):not([type="submit"]):not([type="reset"]):not([type="hidden"]), select, textarea, exempt with aria-label, aria-labelledby, label[for=id], closest('label') or aria-hidden="true"; WCAG Accessibility Audit excludes types hidden, submit, button, reset, image, accepts title, list capped at 20, crit:true; ADA Litigation Risk selector input:not([type="hidden"]):not([type="submit"]):not([type="button"]):not([type="image"]),textarea,select, accepts title; Form Conversion Audit needs a label[for] inside the form, aria-label, aria-labelledby or a wrapping label, placeholder never counts; WCAG Fix Generator sc=3.3.2, lvl=A, impact=critical. - Why: A placeholder disappears the moment someone types, so a field with no real label leaves screen-reader users guessing what to enter, and unlabeled inputs are a top-three ADA demand-letter trigger. - Fix: Add `<label for="email">`Email address`</label>` next to `<input id="email">`, or an aria-label on the input, and mark required fields with visible text or an asterisk plus a legend. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [ADA Litigation Risk Score](https://jwatte.com/tools/ada-litigation-risk/), [Form Conversion Audit](https://jwatte.com/tools/form-conversion-audit/) and 1 more. Standard: WCAG 2.2 SC 1.3.1 Info and Relationships; SC 3.3.2 Labels or Instructions (Level A); ADA Title III. - [ ] **9.59 `<n>` radio group(s) not wrapped in `<fieldset>``<legend>`** - Pass: Every group of two or more related radio buttons sits inside a `<fieldset>` with a `<legend>`. - Numbers and lists the tool uses: input[type="radio"][name] grouped by name; group size >= 2; ancestor test closest('fieldset') on the first radio; crit:true; instance list shows name="`<value>`". - Why: Without a group name a screen reader announces 'Yes' and 'No' with no hint of what question they answer. - Fix: Wrap each set of related radios or checkboxes in `<fieldset>` with a `<legend>` that states the question. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/). Standard: WCAG 2.2 SC 1.3.1 Info and Relationships. - [ ] **9.60 `<n>` personal-data input(s) missing autocomplete attribute** - Pass: Every input that collects personal data carries the matching autocomplete token. - Warn: An email, tel, password, name, phone or address input has no autocomplete attribute (WCAG Accessibility Audit); any text, email, tel, password or url input without one (Form Conversion Audit). - Numbers and lists the tool uses: WCAG Accessibility Audit selector input[type="email"],input[type="tel"],input[type="password"],input[name*="name"],input[name*="email"],input[name*="phone"],input[name*="address"], excluded types hidden, submit, button, reset, image, checkbox, radio, list capped at 20; Form Conversion Audit input types text, email, tel, password, url with an empty autocomplete; tokens email, tel, given-name, family-name, organization, street-address, postal-code, country, bday, new-password / current-password; WCAG Fix Generator sc=1.3.5, lvl=AA, impact=moderate, token list https://www.w3.org/TR/WCAG22/#input-purposes. - Why: Autocomplete tokens let browsers and password managers fill the form, which helps people with motor or memory difficulties and adds roughly 5 to 15% mobile conversion. - Fix: Add autocomplete="email", "tel", "name", "given-name", "family-name", "street-address", "postal-code" and so on to each personal-data field. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [Form Conversion Audit](https://jwatte.com/tools/form-conversion-audit/), [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 1.3.5 Identify Input Purpose (Level AA); HTML autocomplete tokens. - [ ] **9.61 Forms present but no role="status" / aria-live regions** - Pass: Form success and error messages, and other status updates such as 'Cart updated', are announced through a live region. - Numbers and lists the tool uses: WCAG Accessibility Audit reports as information when form count > 0 and the count of [role="status"], [role="alert"], [aria-live] is 0; WCAG Fix Generator sc=4.1.3, lvl=AA, impact=serious. - Why: A message that only appears visually is missed entirely by screen-reader users, who never learn whether the form failed or succeeded. - Fix: Put status messages in an aria-live="polite" region or role="status", and urgent errors in role="alert" or aria-live="assertive". - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 4.1.3 Status Messages (Level AA). - [ ] **9.62 Error identification, invalid fields are announced** - Pass: Invalid fields are flagged in text and ARIA, not only by a red highlight. - Numbers and lists the tool uses: sc=3.3.1; lvl=A; impact=critical. - Why: Screen readers cannot see a red border, so the visitor never learns which field failed. - Fix: Set aria-invalid="true" on failing fields and link the error text with aria-describedby. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 3.3.1 Error Identification (Level A). - [ ] **9.63 Error suggestion, errors offer fix recommendations** - Pass: Every error message tells the visitor how to fix the input. - Numbers and lists the tool uses: sc=3.3.3; lvl=AA; impact=moderate. - Why: 'Email is required' leaves a visitor who typed something wrong with no idea what to change. - Fix: Write errors like 'Please enter a valid email address (e.g., name@example.com)'. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 3.3.3 Error Suggestion (Level AA). - [ ] **9.64 Error prevention, legal/financial forms have review + undo** - Pass: Legal commitments, financial transactions and data deletions offer a review step, a confirmation and an undo window. - Numbers and lists the tool uses: sc=3.3.4; lvl=AA; impact=serious. - Why: A mis-tapped submit on a payment or deletion cannot be taken back without a review step. - Fix: Add a review page and a confirmation before irreversible actions, and require re-confirmation for the truly irreversible ones. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 3.3.4 Error Prevention (Legal, Financial, Data) (Level AA). - [ ] **9.65 Form #`<n>` asks for email in `<n>` fields** - Pass: No form asks for the same information twice, and a multi-step form pre-fills or skips data already entered. - Numbers and lists the tool uses: WCAG Accessibility Audit reports as information when one form has 2 or more input[type="email"], input[name*="email" i] fields; WCAG Fix Generator sc=3.3.7, lvl=A, impact=moderate. - Why: Re-typing an email or address is a real barrier for visitors with motor or memory impairments, and WCAG 2.2 now forbids it. - Fix: Pre-fill repeated fields or offer a 'same as above' option. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 3.3.7 Redundant Entry (Level A). - [ ] **9.66 `<n>` auth-form(s), `<n>` CAPTCHA/cognitive test(s) detected** - Pass: Login and verification flows do not require memorizing strings, solving puzzles or typing a CAPTCHA without an alternative. - Warn: An authentication form is present together with a CAPTCHA or cognitive-test widget; auth forms without one are reported as information. - Numbers and lists the tool uses: auth form = `<form>` containing input[type="password"] or any input or label whose name or text matches AUTH_RE = /(password|passcode|pin|otp|2fa|mfa|captcha|verify)/i; cognitive tests counted with [data-hcaptcha-widget-id].g-recaptcha, [class*="captcha" i]; WCAG Fix Generator sc=3.3.8, lvl=AA, impact=serious. - Why: Distorted-text CAPTCHAs and memory puzzles lock out people with cognitive or visual disabilities, and WCAG 2.2 now prohibits them without an alternative. - Fix: Offer passkeys, OAuth, an email or SMS passcode, or a magic link as an alternative, and confirm password managers can autofill the form. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 3.3.8 Accessible Authentication (Minimum) (Level AA); SC 3.3.9. - [ ] **9.67 `<n>` <select onchange=...> detected** - Pass: Changing a form control's value never navigates or submits without a warning or an explicit button. - Numbers and lists the tool uses: WCAG Accessibility Audit reports as information when select[onchange] count > 0; WCAG Fix Generator sc=3.2.2, lvl=A, impact=serious. - Why: Keyboard users arrow through a `<select>` to read the options, and a select that navigates on change fires before they reach the one they want. - Fix: Add a visible Go or submit button instead of navigating on change, or announce the change through aria-live. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 3.2.2 On Input (Level A). - [ ] **9.68 On focus, no context change on focus** - Pass: Receiving focus never submits a form or navigates. - Numbers and lists the tool uses: sc=3.2.1; lvl=A; impact=serious. - Why: Tabbing through a page must not trigger side effects, or keyboard users set things off just by moving. - Fix: Remove any auto-submit or navigation bound to a field receiving focus; focus is not activation. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 3.2.1 On Focus (Level A). - [ ] **9.69 `<n>` of `<n>` `<video>` elements missing `<track kind="captions">`** - Pass: Every audible video has a captions or subtitles track, and embedded players carry real (not auto-generated) captions. - Warn: WCAG Accessibility Audit warns when only muted videos lack a track; ADA Litigation Risk warns when videos or YouTube, Vimeo or Wistia embeds exist and no caption track is found. - Fail: WCAG Accessibility Audit fails as critical when at least one unmuted video has no track. - Numbers and lists the tool uses: track selectors track[kind="captions"], track[kind="subtitles"]; the muted attribute exempts a video (WCAG Accessibility Audit, crit when audibleNoTrack > 0); ADA Litigation Risk video selectors video, iframe[src*="youtube"], iframe[src*="vimeo"], iframe[src*="wistia"], reports no video as information; WCAG Fix Generator sc=1.2.2, lvl=A, impact=critical. - Why: Deaf and hard-of-hearing visitors get nothing from an uncaptioned video, and YouTube auto-captions do not count as compliant captions. - Fix: Add `<track kind="captions" srclang="en" src="captions.vtt" default>` to each `<video>`, and for YouTube or Vimeo embeds upload your own caption file (Rev.com, 3PlayMedia or Otter at about $1 to $3 per minute); captions inside a third-party player cannot be seen by the scanner, so verify by hand. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [ADA Litigation Risk Score](https://jwatte.com/tools/ada-litigation-risk/), [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 1.2.2 Captions (Prerecorded) (Level A); ADA Title III. - [ ] **9.70 `<n>` `<audio>` element(s) present** - Pass: Every audio-only item has a text transcript nearby, and every video-only item has an audio description or transcript. - Numbers and lists the tool uses: WCAG Accessibility Audit reports as information whenever `<audio>` elements exist, since transcripts cannot be detected; WCAG Fix Generator sc=1.2.1, lvl=A, impact=serious. - Why: A podcast player with no transcript gives deaf visitors nothing at all. - Fix: Add a visible link such as `<a href="/transcripts/episode-12">`Transcript`</a>` next to each audio player, and an audio description or full transcript for video-only content. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 1.2.1 Audio-only and Video-only (Prerecorded) (Level A). - [ ] **9.71 `<n>` unmuted autoplay media (WCAG 1.4.2)** - Pass: No video or audio element autoplays, or any that does is muted and can be paused. - Fail: WCAG Quick Checks fails autoplay media without the muted attribute; WCAG Accessibility Audit fails any autoplay video or audio, muted or not, as critical. - Numbers and lists the tool uses: selector video[autoplay], audio[autoplay]; the muted attribute exempts in WCAG Quick Checks; WCAG Accessibility Audit crit:true for any autoplay, which must be pausable and should auto-pause after 5 seconds unless the user opts in; WCAG Fix Generator sc=1.4.2, lvl=A, impact=moderate, autoplay longer than 3 seconds needs a pause, stop or mute control. - Why: Autoplaying sound talks over a screen reader and cannot be stopped by many visitors. - Fix: Remove autoplay, or add the muted attribute and a pause control that works without moving focus. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 1.4.2 Audio Control; SC 2.2.2 Pause, Stop, Hide (Level A). - [ ] **9.72 Pause, stop, hide, animation or moving content** - Pass: Carousels, tickers, animated GIFs and auto-updating feeds that run longer than 5 seconds have a pause control. - Numbers and lists the tool uses: sc=2.2.2; lvl=A; impact=serious; runs more than 5s. - Why: Moving content distracts readers with attention disorders and can hide text before a slow reader finishes it. - Fix: Add a pause button to carousels and tickers, and a pause or frequency control to live-updating content. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 2.2.2 Pause, Stop, Hide (Level A). - [ ] **9.73 Meta refresh redirect under 20 seconds (WCAG 2.2.1)** - Pass: The page has no meta refresh, or WCAG Quick Checks accepts a delay of 20 seconds or more. - Fail: WCAG Quick Checks fails a delay between 1 and 19 seconds; WCAG Accessibility Audit fails any meta refresh as critical regardless of delay. - Numbers and lists the tool uses: WCAG Quick Checks selector meta[http-equiv="refresh" i], parses the seconds before the first ';' and fails when 0 < sec < 20; WCAG Accessibility Audit selector meta[http-equiv="refresh"] (no i flag), parses /^\s*(\d+)\s*(?:;\s*url=)/i and fails any refresh, crit:true. - Why: A page that reloads or jumps on its own timer disorients visitors and can move them before a screen reader finishes. - Fix: Replace the meta refresh with a server 301 or 302 redirect, or give the visitor 20 seconds or more and a way to stop the timer. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/). Standard: WCAG 2.2 SC 2.2.1 Timing Adjustable (Level A); SC 3.2.5. - [ ] **9.74 Timing adjustable, session / form timeouts** - Pass: Auto-logouts, carousel auto-advance and form timeouts can be extended or turned off. - Numbers and lists the tool uses: sc=2.2.1; lvl=A; impact=serious; warn 20s before expiry; real-time content such as sports scores is exempt. - Why: A slow typist or screen-reader user loses a whole form when a session expires without warning. - Fix: Warn 20 seconds before a timeout, offer an extend button, and let visitors disable auto-advance. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 2.2.1 Timing Adjustable (Level A). - [ ] **9.75 Three flashes or below, seizure risk** - Pass: Nothing on the page, including video, ads and loading spinners, flashes more than 3 times per second. - Numbers and lists the tool uses: sc=2.3.1; lvl=A; impact=critical; 3 flashes per second; test tool https://trace.umd.edu/peat/. - Why: Flashing content can trigger seizures in photosensitive visitors. - Fix: Remove or slow any flashing element and test video with the PEAT tool. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 2.3.1 Three Flashes or Below Threshold (Level A). - [ ] **9.76 `<n>` mobile-presentation issue(s), fix to prevent horizontal page scroll + unreadable nav on phones** - Pass: Content reflows at 320 CSS pixels wide with no horizontal scroll, and none of the mobile overflow checks below fire. - Fail: Mega Analyzer renders a fail row (renderChk false) whenever one or more mobile-presentation issues are found, listing each issue as a bullet. - Numbers and lists the tool uses: Mega Analyzer _mobileScaleIssues list: viewport meta missing; viewport blocks zoom (user-scalable=no or maximum-scale=1); viewport caps zoom with maximum-scale below 5; inline width:Npx over 480 with no inline max-width; tables with no horizontal-scroll wrapper (class no-mobile-scroll, table-responsive or scrollable, inline overflow-x auto or scroll or display:block on the table, or a parent with inline overflow-x auto or scroll or class table-responsive, scrollable, table-wrap or table-scroll); iframe, video, embed or object with width attribute over 480 or inline width of 3 or more digits px and no max-width; inline `<style>` rules with grid-template-columns:1fr or repeat(N,1fr) not matched by minmax(0,1fr) or minmax(auto,1fr); mailto or tel links whose text is over 22 characters with no spaces, flagged only when no inline overflow-wrap or word-break rule exists and the page has no link rel=stylesheet; primary nav (header nav, nav[aria-label*=primary or main], nav#mainNav, nav.mainNav) with more than 5 top-level links or buttons outside [role=menu].nav-dropdown.submenu and no toggle button (button[aria-controls], button.nav-toggle, button.hamburger, button.menu-toggle, button[aria-label*=menu or navigation], [class*=hamburger]); WCAG 1.4.4 reflow target 320x256; fix prompt rules: grid 1fr to minmax(0,1fr) plus min-width:0, nav toggle at @media(max-width:880px), width:Npx over 480 becomes width:100%;max-width:Npx, tables get an overflow-x wrapper or the @media(max-width:768px) pattern, retest at 344, 375, 390, 412, 768 and 1024 px; WCAG Fix Generator sc=1.4.10, lvl=AA, impact=serious, test at 320x600, tables and maps excepted. - Why: Horizontal scrolling on a phone hides content off-screen and makes text impossible to read without panning. - Fix: Apply the drop-in CSS html,body{overflow-x:hidden;max-width:100%}img,iframe,video,svg{max-width:100%;height:auto}a[href^="mailto:"],a[href^="tel:"]{overflow-wrap:anywhere;word-break:break-word}@media(max-width:768px){table{display:block;overflow-x:auto;white-space:nowrap}table th,table td{white-space:normal}}, use responsive units (%, vw, rem), keep existing class names, and treat body{overflow-x:hidden;max-width:100vw} inside the mobile media query as containment rather than a fix. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 1.4.4 Resize Text; SC 1.4.10 Reflow (Level AA). - [ ] **9.77 Mobile overflow: inline fixed widths over 480 px** - Pass: No element sets an inline pixel width wider than a phone screen without a max-width. - Warn: WCAG Accessibility Audit warns when 5 or more elements set width or min-width over 400px. - Fail: Mega Analyzer lists any inline width over 480px with no inline max-width as a bullet in the mobile-presentation fail row (renderChk false). - Numbers and lists the tool uses: Mega Analyzer lowercases the inline style then matches /(?:^|;|\s)width\s*:\s*(\d+)\s*px/ with parseInt > 480 and no max-width in the style, any count fires; WCAG Accessibility Audit width > 400 via /(?:^|[;\s])(?:min-)?width\s*:\s*(\d+)px/i after stripping /max-width\s*:\s*[^;]+/gi, skips elements inside an inline overflow(-x): auto or scroll wrapper, trigger count >= 5. - Why: A fixed 600px block forces the whole page wider than the phone and breaks reflow at 320px. - Fix: Replace fixed widths with width:100%; max-width:Npx, percentages, grid or flex. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: WCAG 2.2 SC 1.4.10 Reflow (Level AA). - [ ] **9.78 Mobile overflow: tables without a horizontal-scroll wrapper** - Pass: Every table is wrapped in a scrolling container or is itself scrollable. - Warn: One or more tables have no scroll wrapper (reported as N of M tables). - Numbers and lists the tool uses: a table passes with class /(no-mobile-scroll|table-responsive|scrollable)/i, inline /overflow[\s-]*x\s*:\s*(auto|scroll)/ or /display\s*:\s*block/, a parent with inline overflow-x auto or scroll, or a parent class /(table-responsive|scrollable|table-wrap|table-scroll)/i. - Why: A wide table row stretches the whole page on a phone. - Fix: Wrap each table in a `<div style="overflow-x:auto">`. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: WCAG 2.2 SC 1.4.10 Reflow. - [ ] **9.79 Mobile overflow: iframes/videos/embeds with fixed width** - Pass: No iframe, video, embed or object is wider than 480px without a max-width. - Warn: One or more embeds are wider than 480px with no max-width. - Numbers and lists the tool uses: width attribute > 480 and no max-width, or inline /width\s*:\s*\d{3,}px/ and no max-width. - Why: A fixed-width embed overflows the phone viewport. - Fix: Add max-width:100% to embeds and an aspect-ratio wrapper for video. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: WCAG 2.2 SC 1.4.10 Reflow. - [ ] **9.80 Mobile overflow: CSS grid 1fr min-content trap** - Pass: No inline `<style>` grid uses 1fr or repeat(N,1fr) columns without a matching minmax(0,1fr) or minmax(auto,1fr). - Warn: One or more inline grid rules use the 1fr shorthand with no minmax guard. - Numbers and lists the tool uses: gridTrapPattern /grid-template-columns\s*:\s*(?:repeat\s*$\s*\d+\s*,\s*)?1fr/gi minus minmaxPattern /minmax\s*\(\s*(?:0|auto)\s*,\s*1fr\s*$/gi per style block; only inline styles are scanned because external stylesheets cannot be read. - Why: 1fr is shorthand for minmax(auto,1fr), so one wide child inflates the grid and pushes the page past the viewport. - Fix: Use minmax(0,1fr) for the columns and min-width:0 on the grid items. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **9.81 Mobile overflow: long mailto/tel links without a wrap rule** - Pass: No mailto or tel link has more than 22 unbroken characters, or a wrap rule for them exists, or external stylesheets are present so the rule cannot be ruled out. - Warn: A mailto or tel link exceeds 22 characters with no whitespace, all CSS is inline, and no overflow-wrap or word-break rule targets mailto links. - Numbers and lists the tool uses: text length > 22 and no /\s/; wrap rule regex /a\[href\^=[\"']mailto:[\"']\][^{]*\{[^}]*(?:overflow-wrap|word-break)\s*:/i; skipped when link[rel=stylesheet] is present. - Why: A 30-character email address inside a narrow card widens the whole page on a phone. - Fix: Add a[href^="mailto:"],a[href^="tel:"]{overflow-wrap:anywhere;word-break:break-word}. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **9.82 Mobile overflow: many nav items with no hamburger toggle** - Pass: The primary nav has 5 or fewer top-level items, or a visible toggle button exists in the header. - Warn: The primary nav has more than 5 top-level links or buttons and no toggle. - Numbers and lists the tool uses: primary nav selector: header nav, nav[aria-label*="primary" i], nav[aria-label*="main" i], nav#mainNav, nav.mainNav; items exclude descendants of [role="menu"].nav-dropdown.submenu; toggle selector: button[aria-controls], button.nav-toggle, button.hamburger, button.menu-toggle, button[aria-label*="menu" i], button[aria-label*="navigation" i], [class*="hamburger"]; threshold > 5 items. - Why: At phone widths six or more nav items wrap to several lines or overflow the header. - Fix: Add a `<button class="nav-toggle">` shown at @media(max-width:880px) and collapse the nav into a drawer. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **9.83 No visible help/contact link found** - Pass: A help, contact, support or FAQ link is present and appears in the same relative place on every page. - Warn: No anchor text matches contact, help, support, faq or get help. - Numbers and lists the tool uses: regex /^\s*(contact|help|support|faq|get\s+help)\s*$/i on trimmed anchor text; WCAG Fix Generator sc=3.2.6, lvl=A, impact=moderate. - Why: WCAG 2.2 says that when a site offers help it must sit in a consistent location so visitors do not have to hunt for it. - Fix: Expose a help or contact link (usually in the footer) and keep it in the same relative order on every page that has one. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 3.2.6 Consistent Help. - [ ] **9.84 Consistent navigation, nav order same across pages** - Pass: Main navigation, breadcrumbs and the search box sit in the same place and order on every page. - Numbers and lists the tool uses: sc=3.2.3; lvl=AA; impact=moderate. - Why: Visitors learn the layout once and expect it everywhere, and a nav that moves is disorienting for screen-reader and cognitive-disability users. - Fix: Use one shared header and footer template across the site. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 3.2.3 Consistent Navigation (Level AA). - [ ] **9.85 Consistent identification, same function named consistently** - Pass: The same function uses the same label and icon on every page. - Numbers and lists the tool uses: sc=3.2.4; lvl=AA; impact=moderate. - Why: A button called 'Submit' on one page and 'Send' on another reads as two different actions. - Fix: Standardize labels and icons for repeated actions site-wide. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 3.2.4 Consistent Identification (Level AA). - [ ] **9.86 Multiple ways, site search or sitemap** - Pass: A multi-page site offers at least two ways to find any page. - Numbers and lists the tool uses: sc=2.4.5; lvl=AA; impact=moderate; at least two of: sitemap, search box, table of contents, navigation menu listing all pages; single-page apps exempt. - Why: Visitors who cannot use the main menu need a second route, such as search or a sitemap page. - Fix: Add an HTML sitemap page or a site search alongside the navigation menu. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 2.4.5 Multiple Ways (Level AA). - [ ] **9.87 Language of parts, inline language switches** - Pass: Foreign-language phrases inside body text carry an inline lang attribute. - Numbers and lists the tool uses: sc=3.1.2; lvl=AA; impact=moderate; applies to real phrases, not loan words that are part of English. - Why: A screen reader reads a French phrase with English pronunciation unless the span says otherwise. - Fix: Wrap foreign phrases like a la carte. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 3.1.2 Language of Parts (Level AA). - [ ] **9.88 Flesch-Kincaid grade ~`<n>`** - Pass: Body text reads at grade 11 or below. - Warn: Grade is above 11 and up to 14. - Fail: Grade is above 14. - Numbers and lists the tool uses: only run when word count >= 150; body clone with script, style, nav, header, footer, aside, noscript, form removed; sentences split on /[.!?]+\s+/; syllables per word = count of /[aeiouy]+/ groups after lowercasing, stripping non-letters and a trailing e, minimum 1; grade = 0.39*(words/sentences) + 11.8*(syllables/words) - 15.59, shown to 1 decimal; pass <= 11, warn <= 14, fail > 14; WCAG 3.0 draft targets grade 9 or below for general audiences. - Why: Long sentences and rare words shut out readers with cognitive disabilities and everyone reading in a hurry on a phone. - Fix: Shorten sentences and prefer common words. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/). Standard: WCAG 3.0 draft Clear Words / Readable outcome. - [ ] **9.89 `<n>` duplicate id attribute(s) (WCAG 4.1.1)** - Pass: No id value is used by more than one element. - Warn: Analyzer, WCAG Quick Checks and WCAG Accessibility Audit (for duplicates nothing references yet) report duplicates as warnings. - Fail: Mega Analyzer, Batch Analyzer and Mega Batch fail any duplicate id. - Numbers and lists the tool uses: id count > 1; Mega Analyzer lists the first 10; WCAG Quick Checks lists the first 5; Batch Analyzer weight 5; Mega Batch weight 10; WCAG Fix Generator sc=4.1.1, lvl=A, impact=moderate, validator https://validator.w3.org/. - Why: A duplicated id makes labels, ARIA references and anchor links attach to the wrong element, because the browser silently picks the first one. - Fix: Rename the duplicates so every id on the page is unique, then validate the HTML. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/) and 2 more. Standard: WCAG 2.1 SC 4.1.1 Parsing (retired in WCAG 2.2 but still invalid HTML); SC 1.3.1. - [ ] **9.90 `<n>` duplicate id(s) are referenced and resolve to the wrong element** - Pass: No duplicated id is referenced by a label, an ARIA relationship attribute or an in-page link. - Numbers and lists the tool uses: duplicate = id count > 1; reference sources: label[for]; space-split tokens of aria-labelledby, aria-describedby, aria-controls, aria-owns, aria-details, aria-errormessage, aria-flowto, headers, list, form; decoded fragments of a[href^="#"] and area[href^="#"]; crit:true. - Why: When something points at a duplicated id it lands on the first match, so a label or skip link silently attaches to the wrong element. - Fix: Make every referenced id unique so each label, ARIA relationship and skip link resolves to the intended element. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/). Standard: WCAG 2.2 SC 4.1.2 Name, Role, Value; SC 1.3.1. - [ ] **9.91 prefers-color-scheme light: `<n>`** - Pass: At least one @media rule targets prefers-color-scheme: light. - Numbers and lists the tool uses: regex /@media[^{]*prefers-color-scheme\s*:\s*light/gi over inline styles and the first 5 linked stylesheets; reported as information when the count is 0. - Why: An explicit light-scheme block shows the site handles both schemes on purpose rather than by accident. - Fix: Define light values at :root and override them in the dark media query. - Verify: [User Preference Media Queries Audit](https://jwatte.com/tools/prefers-color-scheme-audit/). Standard: CSS media query prefers-color-scheme. - [ ] **9.92 prefers-contrast: `<n>`** - Pass: At least one @media rule targets prefers-contrast. - Numbers and lists the tool uses: regex /@media[^{]*prefers-contrast/gi over inline styles and the first 5 linked stylesheets; reported as information when the count is 0. - Why: Visitors who ask their system for more contrast get it only if the site listens to the query. - Fix: Add a @media (prefers-contrast: more) block that raises text and border contrast. - Verify: [User Preference Media Queries Audit](https://jwatte.com/tools/prefers-color-scheme-audit/). Standard: CSS media query prefers-contrast. - [ ] **9.93 forced-colors: `<n>`** - Pass: At least one @media rule targets forced-colors. - Numbers and lists the tool uses: regex /@media[^{]*forced-colors/gi over inline styles and the first 5 linked stylesheets; reported as information when the count is 0. - Why: Windows High Contrast mode strips backgrounds, so buttons and cards without borders disappear. - Fix: Test with Windows Contrast Themes and use system colors inside @media (forced-colors: active). - Verify: [User Preference Media Queries Audit](https://jwatte.com/tools/prefers-color-scheme-audit/). Standard: CSS media query forced-colors (Windows High Contrast / Contrast Themes). - [ ] **9.94 prefers-reduced-data: `<n>`** - Pass: At least one @media rule targets prefers-reduced-data. - Numbers and lists the tool uses: regex /@media[^{]*prefers-reduced-data/gi over inline styles and the first 5 linked stylesheets; reported as information when the count is 0. - Why: Visitors on metered connections can ask for lighter pages through this query. - Fix: Serve lighter images and skip non-essential fonts inside @media (prefers-reduced-data: reduce). - Verify: [User Preference Media Queries Audit](https://jwatte.com/tools/prefers-color-scheme-audit/). Standard: CSS media query prefers-reduced-data. - [ ] **9.95 Manual dark toggle: yes / no** - Pass: The CSS contains a class or data-attribute hook for a user-controlled dark theme. - Numbers and lists the tool uses: regex /\.dark\s*[\{,:]|\[data-theme=["']dark["']\]|html\.dark\b/i on the collected CSS; reported as information when it does not match. - Why: A manual toggle lets a visitor override the system scheme for this one site. - Fix: Add a light/dark/system toggle stored in localStorage and set the theme class before render with an inline script to avoid a flash. - Verify: [User Preference Media Queries Audit](https://jwatte.com/tools/prefers-color-scheme-audit/). Standard: CSS media query prefers-color-scheme (user override pattern). - [ ] **9.96 ACCESSIBILITY, WCAG 2.2 Level AA (generated-site build spec)** - Pass: A generated or migrated site ships with a skip link first in the tab order, semantic landmarks, alt (or alt="") plus width and height on every image, ARIA labels on icon-only controls, focus-visible styles, 4.5:1 text and 3:1 large-text and UI contrast, a label for every input, keyboard reachability, a prefers-reduced-motion guard, unique ids, no skipped heading levels, srcset and sizes on images, no mobile-only hidden images or collapsed primary content, and 44x44 px touch targets. - Numbers and lists the tool uses: skip link a.skip-link href=#main first; landmarks main, nav, header, footer, article, section, aside; alt attribute never omitted; width+height on every img; focus-visible >= 2px and >= 3:1; contrast 4.5:1 text, 3:1 large text and UI; touch targets >= 44x44 px; viewport must not include user-scalable=no or maximum-scale=1; placeholder is not a label; The $20 Dollar Agency, Ch 26. - Why: These are the requirements the jwatte.com site generators build to, so a site that meets them starts at WCAG 2.2 AA instead of needing a retrofit. - Fix: Build or migrate the templates against this list, then run the WCAG Accessibility Audit on the output. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/), [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/). Standard: WCAG 2.2 AA (SC 1.1.1, 1.4.3, 1.4.4, 1.4.11, 2.4.1, 2.4.7). - [ ] **9.97 `<n>` element(s) with draggable="true"** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: [draggable="true"] count > 0 reported as information; WCAG 2.2 badge. - Why: Drag-only interactions exclude visitors who cannot make precise pointer movements. - Fix: If the UI relies on drag to reorder or move items, add a non-drag alternative such as arrow buttons or keyboard shortcuts, and verify by hand. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/). Standard: WCAG 2.2 SC 2.5.7 Dragging Movements (Level AA). - [ ] **9.98 State jurisdiction risk lens: California Unruh Act fail, NY / FL / PA warn, other states baseline federal ADA risk** - Pass: - Warn: State is NY (state and NYC Human Rights Law both apply, frequent SMB plaintiff circuit, fix WCAG fails within 30 days of a demand letter), FL (the number 2 filing state, fix fails fast and publish /accessibility/ with a last-updated date) or PA (well-established plaintiff bar). - Fail: State is CA: California treats ADA Title III violations as per-se Unruh Act violations, minimum $4,000 statutory damages per visit, no cure period, plaintiffs can stack visits. - Numbers and lists the tool uses: select#state options: empty, CA, NY, FL, PA, TX, IL, MA, OTHER; CA = fail; NY, FL, PA = warn; any other non-empty value (TX, IL, MA, OTHER) = info '`<state>`, baseline federal ADA risk'; empty = info 'State not specified'. The fail and warn rows count toward the composite ADA litigation risk: HIGH when fails >= 2 or (fails >= 1 and warns >= 3), MODERATE when fails >= 1 or warns >= 2, otherwise LOW. - Why: ADA Title III applies nationwide, and California, New York, Florida and Pennsylvania add state-law exposure and active plaintiff firms on top. - Fix: Select your state for jurisdiction-weighted scoring; in the high-risk states fix the failing checks fast and publish /accessibility/ with a last-updated date. - Verify: [ADA Litigation Risk Score](https://jwatte.com/tools/ada-litigation-risk/). Standard: ADA Title III; California Unruh Civil Rights Act; New York State and NYC Human Rights Law. - [ ] **9.99 Date and time inputs not normalized for WebKit (iPhone Safari and every iPhone browser): `<k>` of `<n>` fields** - Pass: Every date, time, datetime-local, month and week input on the page gets appearance: none or -webkit-appearance: none from a rule that applies at both 375 and 430 px wide, or from its own style attribute. A date field that is never drawn (the hidden attribute, aria-hidden="true", display: none, visibility: hidden, opacity: 0, or 1px by 1px) is left out. The pass row adds a note when nothing sets text-align or a height on ::-webkit-date-and-time-value (iOS then keeps the value centered, and an empty field can shrink to a thin bar, WebKit bug 198959). - Fail: The page's own CSS sets a width, min-width, height, min-height (or inline-size and block-size), padding or border with a value other than 0, none or auto on one or more of those inputs, from a selector that is not a page-wide universal reset (*, html *, body *; a scoped one such as .row > * counts), no appearance: none wins on them at 375 and at 430 px wide, and every stylesheet the HTML links was read. - Numbers and lists the tool uses: input types date, time, datetime-local, month and week outside noscript, the first 40 judged; the cascade resolved by !important, cascade layer (unlayered beats layered for normal declarations, later layers beat earlier ones), specificity, source order and the style attribute; appearance and -webkit-appearance treated as one property; all: unset or all: initial counts as none; a selector list holding a selector the browser rejects is dropped whole, as browsers do; media queries are evaluated at phone widths from 360 to 480 px (min-width, max-width, the range syntax such as (768px <= width <= 1200px), not, and the media type; any other feature counts as matching), and rules for print, (hover: hover), (pointer: fine) or (orientation: landscape) do not count; the media attribute of a link or style element and the media of an @import apply to every rule in that file; a brace inside a quoted string (content: "{", an SVG data URI) does not end a rule; CSS read: inline style blocks (400,000 characters), the first two same-origin stylesheets, and when the page has date or time inputs up to four more (later same-origin files, files on other hosts, one level of @import), 600,000 characters per file; a link with media="print" and an onload that switches media counts as screen CSS, and rel=preload as=style counts as a stylesheet; font, icon and animation libraries (Google Fonts, Bunny Fonts, Typekit, Font Awesome, Bootstrap Icons, Material Icons, Ionicons, Remix Icon, Boxicons, Line Awesome, IcoMoon, animate.css, AOS) are not counted as unread; info row "Date and time inputs: WebKit normalization not verified (`<k>` stylesheets not read)" when no appearance: none is found and a linked file was not read (not fetched, another host, an HTTP error, HTML instead of CSS, an empty reply, cut off at the size limit); info row "Date and time inputs use the native iPhone control, unstyled (`<n>` fields)" when no rule sets a width, padding or border on the field; no row when the page has no date or time input; not scored. - Why: Every browser on an iPhone runs WebKit. On iOS it draws these inputs as buttons and, after the page's CSS, sets box-sizing: content-box, padding of 0.5em a side, a minimum width equal to the longest date in the visitor's language (the width and box-sizing step is skipped only for a fixed pixel width) and a minimum height of 20/11 of the font size, and it centers the value, so a field set to width: 100% runs past its container while desktop Chrome shows nothing wrong. - Fix: input[type="date"], input[type="time"], input[type="datetime-local"], input[type="month"], input[type="week"] { -webkit-appearance: none; appearance: none; box-sizing: border-box; width: 100%; min-width: 0; } plus input::-webkit-date-and-time-value { text-align: left; min-height: 1.5em; margin: 0; }. The native picker still opens on tap. If the fields sit in a flex row or a 1fr grid column, give that cell min-width: 0 as well. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: WebKit source, RenderThemeIOS.mm adjustInputElementButtonStyle and adjustMenuListButtonStyle, RenderTheme.cpp adjustStyle, html.css; CSS Basic User Interface Module Level 4, appearance. - [ ] **9.100 Text fields below 16px: iPhone zooms the page when one is tapped (`<k>` of `<n>` fields)** - Pass: Every text field whose size the tool can resolve comes out at 16px or more at phone width, and at least one could be resolved. The pass row notes any field it could not resolve. - Warn: One or more fields come out under 16px at 375 px or at 430 px wide (each width zooms on the phones of that width), or have no font size of their own (11px on iOS) while the page's CSS sets their width, padding or border, and every stylesheet the HTML links was read. - Numbers and lists the tool uses: input types text, email, tel, url, search, password and number, an input with no type, and textarea; readonly, disabled and tabindex="-1" fields skipped, and so is a field that is hidden (the hidden attribute, aria-hidden="true", display: none or visibility: hidden on it or an ancestor); the first 60 judged; sizes resolved through inheritance, rem against the root (16px when the root sets none), em and %, var() with its fallback, min(), max(), clamp() and single-value calc(), every rule, variable and vw unit resolved at 375 px and at 430 px wide separately, and the keywords (small 13px, medium 16px, large 18px and the rest); ch, ex, multi-term calc() and system font keywords are left unresolved; :focus, :hover and :active rules count, so a focus rule that raises the size to 16px passes; the same phone-width rule filter and the same CSS reach as 9.99; shown only when the viewport meta has width=device-width and does not block zoom; info row "Text field font size not verified: `<k>` fields look below 16px, `<n>` stylesheets not read" when a linked file was not read; advisory (warn), not scored. - Why: WebKit on iPhone zooms the page to 16 divided by the focused field's font size (a 14px field about 1.14 times, an 11px one about 1.45 times), and the page stays zoomed after the keyboard closes. Chrome, Firefox and in-app browsers on iPhone use the same WebKit view. - Fix: Give input, select and textarea a font size of at least 16px at phone width, for example font-size: max(16px, 1rem). Do not add maximum-scale=1 to the viewport tag instead: it also blocks pinch zoom in in-app browsers and on Android. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: WebKit source, WKWebViewIOS.mm _zoomToFocusRect and html.css (the 11px form control font on iOS); WCAG 2.2 SC 1.4.4 Resize Text. ## 10. Security headers, TLS and the email your domain sends A missing header is a finding on every audit, a certificate problem is a warning in the visitor's browser, and a missing DMARC record lets anyone send mail as you. This section is the response headers, the certificate, DNS, and the records that protect your domain's email. **Verify this section with:** [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Trust Signal Surface](https://jwatte.com/tools/trust-signal-surface-audit/), [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/), [SSL Grade](https://jwatte.com/tools/ssl-grade/), [Uptime + Response-Time Diagnostic](https://jwatte.com/tools/uptime-check/), [DIY Uptime Alert Generator](https://jwatte.com/tools/diy-uptime-alert-generator/), [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [Security Headers](https://jwatte.com/tools/security-headers-audit/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/), [Competitor Gap Matrix](https://jwatte.com/tools/competitor-gap-matrix/), [Mega Batch](https://jwatte.com/tools/mega-batch/), [DNS / Email Auth Audit](https://jwatte.com/tools/dns-email-audit/), [Platform Audit](https://jwatte.com/tools/platform-audit/), [Migration Analyzer](https://jwatte.com/tools/migration-analyzer/), [Mega AEO Analyzer](https://jwatte.com/tools/mega-aeo-analyzer/). - [ ] **10.1 Site served over HTTPS** - Pass: The URL being audited starts with https. Each tool tests the entered URL after normalization (a bare domain is given https:// automatically), not the post-redirect final URL; Mega Analyzer retries over http:// when the https fetch fails with status 0 or 502 and then reports that. - Numbers and lists the tool uses: regex /^https:/ on the normalized input in Trust Signal Surface Audit; url.startsWith('https:') in Mega Analyzer; url.startsWith('https') in E-E-A-T Analyzer; a URL typed without a scheme is prefixed with https:// in all three tools before the check runs. - Why: Plain HTTP lets anyone on the network read or alter what your visitors see, and browsers flag the site as not secure. - Fix: Serve the whole site over HTTPS and redirect every http:// URL to its https:// version. - Verify: [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Trust Signal Surface](https://jwatte.com/tools/trust-signal-surface-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **10.2 TLS protocol: `<protocol>`** - Pass: The server negotiates TLS 1.3. - Warn: TLS 1.2 is negotiated in SSL Grade (deducts 10); any protocol older than TLS 1.2 in Uptime Check (warn only). Uptime Check passes both TLS 1.3 and TLS 1.2. - Fail: Any protocol other than TLSv1.3 in Mega Security Analyzer (TLS 1.2 included); any protocol older than TLS 1.2 in SSL Grade (deducts 40). - Numbers and lists the tool uses: exact match TLSv1.3 to pass in Mega Security Analyzer and SSL Grade; TLSv1.3 or TLSv1.2 accepted in Uptime Check; Mega Security Analyzer has no warn tier (pass or fail); SSL Grade deductions 10 for TLS 1.2 and 40 for anything older; Uptime Check warns, never fails, on a legacy protocol; MITRE TA0009 Collection, T1040 Network Sniffing; CWE-319. - Why: Older TLS versions can be downgraded and sniffed, so the connection is not as private as the padlock suggests. - Fix: Enable TLS 1.3 on the server, load balancer or CDN that terminates TLS, and disable TLS 1.0 and 1.1. - Verify: [SSL Grade](https://jwatte.com/tools/ssl-grade/), [Uptime + Response-Time Diagnostic](https://jwatte.com/tools/uptime-check/), [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). Standard: TLS 1.3 RFC 8446; CWE-319; MITRE ATT&CK T1040. - [ ] **10.3 Cipher: `<cipher>`** - Pass: The negotiated cipher suite is an AEAD cipher (AES-GCM or ChaCha20-Poly1305). - Warn: The negotiated cipher is not AEAD (SSL Grade deducts 15). - Numbers and lists the tool uses: cipher name must match /GCM|CHACHA20/i (Mega Security Analyzer, SSL Grade); cipher read from cipher_standard_name or cipher_name; SSL Grade deduction 15; SSL Grade emits no row when the cipher string is empty, Mega Security Analyzer emits the row and warns on an empty cipher. - Why: Non-AEAD ciphers lack built-in integrity checks, which leaves room for tampering attacks. - Fix: Prefer AES-GCM or ChaCha20-Poly1305 suites in the TLS configuration and drop CBC suites. - Verify: [SSL Grade](https://jwatte.com/tools/ssl-grade/), [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). - [ ] **10.4 Certificate expiry: `<n>` days remaining** - Pass: The certificate has 30 or more days of validity left. - Warn: The certificate expires in 14 to 29 days. - Fail: The certificate is expired or expires in under 14 days. - Numbers and lists the tool uses: 30 and 14 days (Mega Security Analyzer, SSL Grade, Uptime Check); expired = days_until_expiry below 0; SSL Grade deductions 50 expired, 15 under 14 days, 5 under 30 days; Uptime Check computes days as floor((valid_to - now) / 86400000); DIY Uptime Alert Generator templates: Gatus fails when [CERTIFICATE_EXPIRATION] is under 48h (alert after failure-threshold 2), Prometheus TLSExpiringSoon fires when probe_ssl_earliest_cert_expiry - time() is under 86400 * 14 seconds for 10m. - Why: An expired certificate blocks the site for every visitor with a full-page browser warning. - Fix: Renew the certificate now and turn on automatic renewal (ACME or your host's managed certificates), then add a monitor that alerts at least 14 days before expiry. - Verify: [SSL Grade](https://jwatte.com/tools/ssl-grade/), [Uptime + Response-Time Diagnostic](https://jwatte.com/tools/uptime-check/), [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/), [DIY Uptime Alert Generator](https://jwatte.com/tools/diy-uptime-alert-generator/). - [ ] **10.5 Certificate chain valid** - Pass: The certificate chain verifies against a trusted root during the handshake. - Warn: Chain not verified (Mega Security Analyzer reports warn with the authorization error). - Fail: Chain not verified (SSL Grade deducts 20). - Numbers and lists the tool uses: tls.standard.authorized must be truthy; SSL Grade deduction 20. - Why: A chain that does not verify produces browser warnings even when the certificate itself is valid. - Fix: Install the full intermediate chain from your certificate authority alongside the leaf certificate. - Verify: [SSL Grade](https://jwatte.com/tools/ssl-grade/), [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). - [ ] **10.6 Key: `<bits>`-bit `<type>`** - Pass: The certificate key is ECDSA or RSA of 2048 bits or more. - Fail: The key is RSA below 2048 bits (SSL Grade deducts 30). - Numbers and lists the tool uses: 2048 bits minimum for RSA; ECDSA of any size passes (/ECDSA/i); SSL Grade deduction 30. - Why: Small RSA keys are within reach of modern attackers and are rejected by current browsers. - Fix: Reissue the certificate with RSA 2048 or larger, or with ECDSA P-256. - Verify: [SSL Grade](https://jwatte.com/tools/ssl-grade/). - [ ] **10.7 HSTS header (Strict-Transport-Security)** - Pass: The Strict-Transport-Security header is present with max-age of at least one year and includeSubDomains. - Warn: Header present but max-age is under 31536000 or includeSubDomains is missing (Analyzer, Security Headers Audit, SSL Grade); header missing entirely in Mega Analyzer, Analyzer, Mega SEO Analyzer and SSL Grade. - Fail: Header missing entirely in Mega Security Analyzer, Security Headers Audit and Batch Analyzer. - Numbers and lists the tool uses: header name strict-transport-security; presence only in Mega Analyzer, Mega SEO Analyzer, Mega Security Analyzer, Batch Analyzer (weight 8); Analyzer requires max-age >= 31536000 and includeSubDomains (regexes /max-age=(\d+)/i, /includeSubDomains/i, /preload/i); Security Headers Audit expects /max-age=\d+/ and warns without /includeSubDomains/i, preload eligible when max-age >= 31536000 (weight 15); SSL Grade parses /max-age=(\d+)/i and deducts 5 under 31536000 and 10 when missing; recommended value max-age=63072000; includeSubDomains; preload (Mega Analyzer, Analyzer) or max-age=31536000; includeSubDomains; preload (Mega Security Analyzer, Security Headers Audit, SSL Grade, Single-Site Generator); MITRE TA0009, T1557; CWE-319. - Why: HSTS tells browsers to always use HTTPS, which blocks downgrade attacks and removes the http to https redirect hop. - Fix: Add Strict-Transport-Security: max-age=31536000; includeSubDomains; preload at the host or CDN layer (netlify.toml, vercel.json, Cloudflare _headers.htaccess or nginx add_header), confirm there is no mixed content or plain-HTTP entry point first, and only submit to hstspreload.org once you are sure, because preload is hard to undo. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Security Headers](https://jwatte.com/tools/security-headers-audit/), [SSL Grade](https://jwatte.com/tools/ssl-grade/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/) and 3 more. Standard: HSTS RFC 6797; CWE-319; MITRE ATT&CK T1557. - [ ] **10.8 Content-Security-Policy header present** - Pass: A Content-Security-Policy is delivered as a response header (or, in Analyzer, as a meta http-equiv tag). - Warn: No CSP found (Mega Analyzer, Analyzer, Mega SEO Analyzer, Mega Security Analyzer). - Fail: No CSP found (Security Headers Audit, Batch Analyzer). - Numbers and lists the tool uses: header names content-security-policy and content-security-policy-report-only; Analyzer also accepts meta[http-equiv="Content-Security-Policy"]; Security Headers Audit weight 15; Batch Analyzer weight 8; MITRE TA0001, T1190; CWE-79; baseline policy emitted by Security Headers Audit: default-src 'self'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; script-src 'self'; font-src 'self' data:; connect-src 'self' https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self'; Single-Site Generator locked mode: default-src self; base-uri self; form-action self; frame-ancestors none; object-src none; img-src self data:; style-src self; script-src self; connect-src self, with self-inline adding style-src unsafe-inline and custom adding only exact analytics, font and CDN origins. - Why: A CSP is the strongest defense against cross-site scripting because it limits which scripts and resources the browser will run on your pages. - Fix: Add a Content-Security-Policy header that at minimum sets default-src, script-src and frame-ancestors, built from the third-party scripts your site actually uses, and stage it in report-only mode first because a strict policy can break embeds and inline scripts. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Security Headers](https://jwatte.com/tools/security-headers-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/) and 2 more. Standard: CSP Level 3 (W3C); CWE-79; MITRE ATT&CK T1190. - [ ] **10.9 Content-Security-Policy quality: <strict-dynamic / nonce or hash / unsafe-inline / basic>** - Pass: Mega Security Analyzer: the policy is enforced (not report-only), has no 'unsafe-eval', no bare * in script-src or default-src, and any 'unsafe-inline' is paired with a nonce, hash or 'strict-dynamic' (a plain policy with none of these also passes). Mega SEO Analyzer: the enforced policy contains a nonce, hash or 'strict-dynamic'. - Warn: The policy is report-only, allows 'unsafe-inline' without a nonce, hash or 'strict-dynamic', allows 'unsafe-eval', or has a bare * in script-src or default-src. - Numbers and lists the tool uses: nonce or hash regex /'nonce-|'sha(256|384|512)-/i; strict-dynamic regex /['"]strict-dynamic['"]/i; unsafe-inline /'unsafe-inline'/i; unsafe-eval /'unsafe-eval'/i (Analyzer warns on /unsafe-eval/i alone); wildcard test /(^|\s)\*(\s|$)/ on the value of /(?:^|;)\s*(?:script-src|default-src)\s+([^;]*)/gi; report-only header without an enforced header counts as weak; Security Headers Audit warns on /unsafe-inline|unsafe-eval/ (score 70 percent of weight 15); Mega SEO Analyzer reports a policy with none of these as basic (info); only evaluated when a CSP exists. - Why: A policy that allows unsafe-inline or unsafe-eval scores like a real CSP but leaves inline script injection wide open. - Fix: Enforce the policy rather than report-only, replace 'unsafe-inline' with nonces or hashes plus 'strict-dynamic', remove 'unsafe-eval', and remove bare * from script-src and default-src. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Security Headers](https://jwatte.com/tools/security-headers-audit/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). Standard: CSP Level 3 (W3C); CWE-79. - [ ] **10.10 CSP includes default-src** - Pass: The policy contains a default-src directive. - Warn: The policy has no default-src directive. - Numbers and lists the tool uses: regex /default-src/i on the CSP string; only evaluated when a CSP exists. - Why: Without default-src, any resource type you did not name explicitly has no restriction at all. - Fix: Add default-src 'self' as the baseline and then loosen specific directives as needed. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **10.11 CSP script-src covers all external scripts** - Pass: Every external script host on the page is allowed by script-src (or default-src). - Warn: One or more external script origins are not allow-listed (lists up to 5 hosts). - Numbers and lists the tool uses: directive regex (?:^|;)\s*`<directive>`\b([^;]*); 'none' denies, * allows, 'self' and other quoted tokens are skipped, scheme is stripped, *.example.com matches by suffix, a bare https: or http: token allows all hosts on that scheme; only evaluated when script-src or default-src exists and the page has at least one external script. - Why: Scripts that the policy does not allow are silently blocked in strict browsers, so features break without an obvious error. - Fix: Add each external script origin the page uses to script-src. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **10.12 Clickjacking defense (X-Frame-Options or CSP frame-ancestors)** - Pass: An X-Frame-Options header is present (any value in Mega Analyzer, Analyzer, Mega Security Analyzer and Batch Analyzer; DENY or SAMEORIGIN in Security Headers Audit), or the CSP contains frame-ancestors (accepted by Mega Analyzer on the enforced header and by Mega Security Analyzer on the enforced or report-only header; Analyzer, Security Headers Audit and Batch Analyzer do not credit frame-ancestors). - Warn: Neither is set (Mega Analyzer, Analyzer); X-Frame-Options present with a value other than DENY or SAMEORIGIN (Security Headers Audit). - Fail: Neither is set (Mega Security Analyzer, Security Headers Audit, Batch Analyzer). - Numbers and lists the tool uses: header name x-frame-options; frame-ancestors regex /frame-ancestors/i on the enforced CSP (Mega Analyzer) or the enforced or report-only CSP (Mega Security Analyzer); Analyzer also accepts meta http-equiv="x-frame-options" and does not read frame-ancestors; Security Headers Audit expects /DENY|SAMEORIGIN/i (weight 8, other values warn at 40 percent); Batch Analyzer weight 5; recommended SAMEORIGIN (Security Headers Audit generated config) or DENY (Single-Site Generator, Site Migration Generator, Monoclone Generator); MITRE TA0001; CWE-1021. - Why: Without a framing restriction another site can load your page inside an invisible frame and trick visitors into clicking things they cannot see. - Fix: Add X-Frame-Options: SAMEORIGIN (or DENY) or a CSP frame-ancestors directive at the host or CDN layer. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Security Headers](https://jwatte.com/tools/security-headers-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/) and 1 more. Standard: RFC 7034; CSP frame-ancestors; CWE-1021; MITRE ATT&CK TA0001. - [ ] **10.13 X-Content-Type-Options: nosniff** - Pass: The X-Content-Type-Options header is present with the value nosniff. - Warn: Header missing (Mega Analyzer, Analyzer, Mega SEO Analyzer, Mega Security Analyzer); header present without nosniff (Security Headers Audit). - Fail: Header missing (Security Headers Audit, Batch Analyzer). - Numbers and lists the tool uses: header name x-content-type-options; value regex /nosniff/i (Mega Analyzer, Analyzer, Security Headers Audit); presence only in Mega SEO Analyzer, Mega Security Analyzer and Batch Analyzer (weight 5); Analyzer also accepts meta http-equiv; Security Headers Audit weight 5; CWE-16. - Why: It stops browsers from guessing a file type, which blocks a class of attacks where an upload is treated as a script. - Fix: Add X-Content-Type-Options: nosniff at the host or CDN layer. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Security Headers](https://jwatte.com/tools/security-headers-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/) and 2 more. Standard: X-Content-Type-Options (WHATWG Fetch); CWE-16. - [ ] **10.14 Referrer-Policy set: `<value>`** - Pass: A Referrer-Policy header (or meta name=referrer in Analyzer) is present and does not use a leaky value. - Warn: Header missing (Mega Analyzer, Analyzer, Mega SEO Analyzer, Mega Security Analyzer); header present with unsafe-url or no-referrer-when-downgrade (Security Headers Audit). - Fail: Header missing (Security Headers Audit, Batch Analyzer). - Numbers and lists the tool uses: header name referrer-policy; Analyzer also accepts meta[name="referrer"]; Security Headers Audit warns on /unsafe-url|no-referrer-when-downgrade/i (weight 5); Batch Analyzer weight 5; recommended value strict-origin-when-cross-origin (Mega Analyzer, Analyzer, Mega Security Analyzer, Security Headers Audit, Single-Site Generator); Single-Site Generator Cloudflare block allows no-referrer as an alternative. - Why: It controls how much of your URL is sent to other sites when visitors click away, which protects private page paths and query strings. - Fix: Add Referrer-Policy: strict-origin-when-cross-origin at the host or CDN layer, or as a meta name=referrer tag. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Security Headers](https://jwatte.com/tools/security-headers-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/) and 2 more. Standard: Referrer Policy (W3C). - [ ] **10.15 Permissions-Policy header set** - Pass: A Permissions-Policy (or legacy Feature-Policy) header is present and does not grant camera, microphone, geolocation, payment or usb to all origins. - Warn: Header missing (Mega Analyzer, Analyzer, Mega SEO Analyzer); header present but grants a sensitive feature to * (Mega Security Analyzer). - Fail: Header missing (Security Headers Audit, Batch Analyzer). - Numbers and lists the tool uses: header names permissions-policy and feature-policy (Mega SEO Analyzer checks permissions-policy only; Analyzer line 2211 checks permissions-policy or meta http-equiv="permissions-policy", line 2807 adds feature-policy); Mega Security Analyzer open-feature list camera, microphone, geolocation, payment, usb with per-feature regex `<feature>`\s*=\s*\*, missing header is info; Security Headers Audit weight 5; Batch Analyzer weight 4; recommended value camera=(), microphone=(), geolocation=() (Mega Analyzer, Analyzer, Security Headers Audit missing message, Monoclone Generator), geolocation=(), microphone=(), camera=(), interest-cohort=(), payment=(), usb=() (Security Headers Audit generated config), or camera=(), microphone=(), geolocation=(), interest-cohort=() (Single-Site Generator, Site Migration Generator). - Why: It switches off browser features like camera, microphone and location by default so an injected script cannot use them. - Fix: Add Permissions-Policy: camera=(), microphone=(), geolocation=() at the host or CDN layer and scope any feature you do need to self. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Security Headers](https://jwatte.com/tools/security-headers-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/) and 2 more. Standard: Permissions Policy (W3C). - [ ] **10.16 Cross-Origin-Opener-Policy: `<value>`** - Pass: The Cross-Origin-Opener-Policy header is present with same-origin. - Warn: Header present with unsafe-none (Mega Security Analyzer) or any value other than same-origin (Security Headers Audit). - Fail: Header missing (Security Headers Audit); missing is info in Mega SEO Analyzer and Mega Security Analyzer. - Numbers and lists the tool uses: header name cross-origin-opener-policy; Mega Security Analyzer warns on /unsafe-none/i; Security Headers Audit expects /same-origin/i (weight 4); recommended value same-origin. - Why: It isolates your pages from windows that opened them, which closes a channel other sites can use to poke at your page. - Fix: Add Cross-Origin-Opener-Policy: same-origin at the host or CDN layer. - Verify: [Security Headers](https://jwatte.com/tools/security-headers-audit/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). - [ ] **10.17 Cross-Origin-Embedder-Policy: `<value>`** - Pass: The Cross-Origin-Embedder-Policy header is present with require-corp or credentialless. - Warn: Header present with another value (Security Headers Audit). - Fail: Header missing (Security Headers Audit); missing is info in Mega SEO Analyzer, which only reports it when COOP or COEP is present. - Numbers and lists the tool uses: header name cross-origin-embedder-policy; Security Headers Audit expects /require-corp|credentialless/i (weight 3); Mega SEO Analyzer gate coop || coep; generated config value credentialless. - Why: Together with COOP it gives the page cross-origin isolation, which some powerful browser features require. - Fix: Add Cross-Origin-Embedder-Policy: credentialless (or require-corp if you control every embedded resource) alongside COOP. - Verify: [Security Headers](https://jwatte.com/tools/security-headers-audit/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). - [ ] **10.18 Cross-Origin-Resource-Policy: `<value>`** - Pass: The Cross-Origin-Resource-Policy header is present with same-origin, same-site or cross-origin. - Warn: Header present with an unrecognized value (Security Headers Audit). - Fail: Header missing (Security Headers Audit); missing is info in Mega Security Analyzer. - Numbers and lists the tool uses: header name cross-origin-resource-policy; Security Headers Audit expects /same-origin|same-site|cross-origin/i (weight 3); recommended same-origin (Mega Security Analyzer, Single-Site Generator) or same-site (Security Headers Audit generated config). - Why: It limits which other sites may load your files directly, which keeps your assets from being pulled into someone else's page. - Fix: Add Cross-Origin-Resource-Policy: same-site (or same-origin) at the host or CDN layer. - Verify: [Security Headers](https://jwatte.com/tools/security-headers-audit/), [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). - [ ] **10.19 Security header set scored against competitors** - Pass: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, Referrer-Policy and Permissions-Policy are all present on your page, so the Competitor Gap Matrix Security dimension scores 100. - Fail: A competitor's Security dimension is higher than yours; the Competitor Gap Matrix lists it as a gap row with the point difference. - Numbers and lists the tool uses: Competitor Gap Matrix Security dimension = round(100 * present / 5) over strict-transport-security, content-security-policy, x-content-type-options, referrer-policy, permissions-policy (X-Frame-Options is not scored); Analyzer AI prompt inventory lists HTTPS, HSTS value, CSP source (header or meta) with the first 80 chars, Permissions-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy value, SRI count and mixed content count as Detected or NOT FOUND without scoring them; Analyzer scaffold prompt asks for HSTS with preload, Content-Security-Policy, X-Frame-Options DENY, X-Content-Type-Options nosniff, Referrer-Policy strict-origin-when-cross-origin, Permissions-Policy; Single-Site Generator and Site Migration Generator scaffolds emit Strict-Transport-Security max-age=31536000; includeSubDomains; preload, Content-Security-Policy default-src 'self'; script-src 'self' plus explicit external origins only; object-src 'none'; base-uri 'self'; frame-ancestors 'none', X-Frame-Options DENY, X-Content-Type-Options nosniff, Referrer-Policy strict-origin-when-cross-origin, Permissions-Policy camera=(), microphone=(), geolocation=(), interest-cohort=(); Single-Site Generator Cloudflare public/_headers block adds Cross-Origin-Opener-Policy same-origin, Cross-Origin-Resource-Policy same-origin, /api/* X-Robots-Tag noindex plus Cache-Control no-store, and SSL mode Full (Strict); Monoclone Generator writes [[headers]] for = "/*" into dist/<site.id>/netlify.toml with publish = "." carrying only X-Frame-Options DENY, X-Content-Type-Options nosniff, Referrer-Policy strict-origin-when-cross-origin and Permissions-Policy camera=(), microphone=(), geolocation=(); host equivalents named by Monoclone Generator: netlify.toml, vercel.json or next.config.js headers(), Cloudflare _headers, Amplify customHeaders in amplify.yml, Azure staticwebapp.config.json, Firebase firebase.json, Render dashboard or _headers; Security Headers Audit emitters cover Netlify and Cloudflare Pages _headers, a Cloudflare Worker, vercel.json, nginx add_header, Apache .htaccess, Caddy and a CloudFront response-headers policy. - Why: Headers are set at the host or CDN layer, not in the HTML, so a site can look fine in the source and still ship none of them. - Fix: Emit the whole header block from the hosting config (netlify.toml, vercel.json, Cloudflare _headers.htaccess or nginx) for every path, then confirm in production with curl -I because a staging build can differ. - Verify: [Competitor Gap Matrix](https://jwatte.com/tools/competitor-gap-matrix/). Standard: RFC 6797; CSP Level 3; W3C Subresource Integrity. - [ ] **10.20 security.txt (/.well-known/security.txt) served** - Pass: A file is served at /.well-known/security.txt (HTTP 2xx in Mega Security Analyzer; fetched content in the other tools). No tool verifies that it contains a Contact: line. - Warn: File missing (Mega Analyzer, Batch Analyzer, Mega Batch); platform-limited hosts downgrade to info in Mega Analyzer. - Fail: File missing (E-E-A-T Analyzer); missing is info in Analyzer and Mega Security Analyzer. - Numbers and lists the tool uses: path /.well-known/security.txt; Mega Security Analyzer defines a /^Contact:/im content pattern for this probe but passes on a 2xx status alone; Single-Site Generator scaffold fields Contact, Expires, Policy, Preferred-Languages, Canonical, served as application/json or text/plain (not text/html). - Why: It gives security researchers a published way to report a problem to you instead of posting it publicly. - Fix: Publish /.well-known/security.txt with Contact: and Expires: lines. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/) and 2 more. Standard: RFC 9116. - [ ] **10.21 No secret, state or backup files reachable at the web root** - Pass: None of the probed secret-bearing paths returns a 2xx response with matching content. - Fail: Any probed path returns 200 to 299 and its body matches the content signature (existence alone for the binary backup.zip). - Numbers and lists the tool uses: /.env matches /^[A-Z_][A-Z0-9_]*=/m; /.git/HEAD matches /^ref:\s+refs\//; /terraform.tfstate matches /"terraform_version"|"resources":\s*\[/; /terraform.tfstate.backup matches /"terraform_version"/; /backup.sql and /db.sql match /CREATE TABLE|INSERT INTO/i; /backup.zip existence only (binary); /web.config matches /`<configuration>`|`<connectionStrings>`/i; /appsettings.json matches /"Logging"|"ConnectionStrings"/; probe timeout 6000 ms; signal file_exposure. - Why: These files hold passwords, API keys, database dumps and cloud credentials, and anyone who guesses the URL can download them. - Fix: Remove each file from the publish directory or block it at the server, then rotate every secret it contained. - Verify: [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). - [ ] **10.22 No dependency manifests or lockfiles reachable at the web root** - Pass: None of /package.json, /package-lock.json, /yarn.lock or /composer.json returns a 2xx response with matching content. - Numbers and lists the tool uses: /package.json matches /"dependencies"\s*:/; /package-lock.json matches /"lockfileVersion"\s*:/; /yarn.lock matches /# yarn lockfile/; /composer.json matches /"require"\s*:/; signal file_exposure. - Why: A public manifest tells an attacker exactly which libraries and versions you run, which makes finding a known hole much faster. - Fix: Move manifests and lockfiles out of the publish directory or block them at the server. - Verify: [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). - [ ] **10.23 No build, deploy, CI or container config reachable at the web root** - Pass: None of the probed build or CI config paths returns a 2xx response with matching content. - Numbers and lists the tool uses: /netlify.toml matches /\[\[?(build|headers|redirects|functions)/; /deploy-site.mjs matches /import |require\(|netlify deploy/; /eleventy.config.js matches /module\.exports|export default|eleventyConfig/; /vite.config.js matches /defineConfig|export default/; /next.config.js matches /module\.exports|nextConfig/; /CLAUDE.md matches /^#\s|##\s/m; /.gitlab-ci.yml matches /stages:|variables:|script:/; /.github/workflows/deploy.yml matches /name:|on:|jobs:/; /.travis.yml matches /language:|script:/; /.circleci/config.yml matches /version:\s*2/; /Dockerfile matches /^FROM\s+/im; /docker-compose.yml and /docker-compose.yaml match /services:|version:\s*["']\d/; signal file_exposure. - Why: On a static host the publish directory is the web root, so build scripts, CI files and project notes left next to index.html are served to anyone, and they reveal secret names, redirects and site structure. - Fix: Keep build and CI files out of the publish directory (or block them at the server) and list your own publish root for any site-specific script names. - Verify: [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). - [ ] **10.24 No debug pages, error logs or OS metadata reachable at the web root** - Pass: None of /phpinfo.php, /error_log or /.DS_Store is served. - Numbers and lists the tool uses: /phpinfo.php matches /PHP Version|phpinfo/; /error_log matches /PHP (Warning|Error|Fatal|Notice):|\[error\]/i; /.DS_Store existence only (binary, 2xx status); signal file_exposure. - Why: Debug pages and logs leak server paths, versions and stack details, and .DS_Store leaks directory listings. - Fix: Delete these files from the web root and block them at the server. - Verify: [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). - [ ] **10.25 Exposed package.json declares `<n>` dependency range(s) that permit known-vulnerable releases** - Pass: No publicly served package.json entry has a version range whose lower bound is below a known security floor. - Warn: A served package.json lists a dependency or devDependency whose first version number is below the library's security floor (first 10 flagged entries listed). - Numbers and lists the tool uses: only runs when /package.json returns 200 to 299 with parseable JSON; version parsed with /(\d+\.\d+(?:\.\d+)?)/ and compared to the LIB_DB floor for that key (floors listed under the JavaScript library check); CWE-1104. - Why: The declared range may allow a vulnerable release to be installed, and the file itself should not be public in the first place. - Fix: Raise each minimum version above the floor and, separately, move package.json out of the web root. - Verify: [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). Standard: CWE-1104. - [ ] **10.26 Server / X-Powered-By header does not disclose software versions** - Pass: Server and X-Powered-By headers are absent or carry no product version or framework name. - Warn: Server names Apache, nginx or Microsoft-IIS with a version number, or names Oracle, IBM WebSphere or IBM HTTP Server; X-Powered-By is present (Express or any other value); X-AspNet-Version or X-AspNetMvc-Version is present alongside a Microsoft-IIS Server header. - Numbers and lists the tool uses: Apache /apache/i with version /Apache\/?(\d+\.\d+(?:\.\d+)?)/i; nginx /nginx/i with /nginx\/(\d+\.\d+(?:\.\d+)?)/i; IIS /microsoft-iis/i with /Microsoft-IIS\/(\d+\.\d+)/i; Oracle /oracle/i on Server or headers x-oracle-dms-ecid, x-oracle-dms-rid; IBM /websphere|ibm.http/i; Express /express/i on x-powered-by; headers x-aspnet-version, x-aspnetmvc-version checked only when Server matches /microsoft-iis/i; a hidden version renders info (Apache detected (version hidden, good), nginx (version hidden), IIS detected); distribution names in an Apache Server header render info: /red hat|rhel/i, /ubuntu/i, /debian/i; Caddy /caddy/i renders pass (no version disclosure by default); any non-empty Server or X-Powered-By is listed as info (Server / X-Powered-By header leak, CWE-200); Uptime Check shows Server as info; CWE-200. - Why: A version string lets an attacker look up the exact known holes for that release instead of guessing. - Fix: Hide the version at the server: ServerTokens Prod and ServerSignature Off (Apache, IBM HTTP Server), server_tokens off (nginx), removeServerHeader in web.config or the URL Rewrite module (IIS), app.disable('x-powered-by') (Express), `<httpRuntime enableVersionHeader="false" />` and MvcHandler.DisableMvcResponseHeader = true (ASP.NET), or strip Server, X-Powered-By and X-Oracle-* headers at the reverse fetch. - Verify: [Uptime + Response-Time Diagnostic](https://jwatte.com/tools/uptime-check/), [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). Standard: CWE-200. - [ ] **10.27 Server operating system is still under security support** - Pass: The Server header does not fingerprint an end-of-life operating system. - Warn: Server header names CentOS (end of life December 2021). - Fail: Server header shows Microsoft-IIS/8.5 (Windows Server 2012 R2) or Microsoft-IIS/8.0 (Windows Server 2012), both out of extended support since October 10, 2023. - Numbers and lists the tool uses: /centos/i on an Apache Server header; /Microsoft-IIS\/8\.5/ and /Microsoft-IIS\/8\.0/; /Microsoft-IIS\/10\.0/ renders info (Windows Server 2016, 2019, 2022 or 2025; Server 2019 mainstream support ended January 9, 2024 with extended support through January 9, 2029; Server 2022 mainstream support ends October 13, 2026); RHEL patching cadence is quarterly. - Why: An operating system past end of life gets no security patches, so every new hole stays open. - Fix: Migrate CentOS to Rocky Linux, AlmaLinux or RHEL, and Windows Server 2012 or 2012 R2 to Server 2022 or 2025. - Verify: [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). - [ ] **10.28 SPF record** - Pass: One TXT record at the apex starts with v=spf1, ends in -all or ~all, and needs 8 or fewer DNS lookups. - Warn: The record ends in ?all, or needs 9 or 10 lookups (DNS Email Audit). - Fail: No v=spf1 TXT record at the apex, no all mechanism, +all, or more than 10 lookups. - Numbers and lists the tool uses: detection regex /^v=spf1\b/i on TXT answers; policy regex /[~\-+?]all\b/; lookup mechanisms /\b(include|a|mx|ptr|exists|redirect)\s*[:=]\s*([^\s"]+)/gi counted recursively through include and redirect to depth 4; warn above 8 lookups, fail above 10; BEC posture points: -all 20, ~all 15, ?all or +all 5, missing 0 (max 20); Mega Security Analyzer checks presence only (fail when missing, CWE-290); DNS Records Generator emits v=spf1 `<provider include>` -all with TTL 3600, or v=spf1 -all when the provider is custom (no include); DNS Email Audit recommends v=spf1 -all for a non-sending domain; Cloudflare Workers sending alert mail through MailChannels need v=spf1 a mx include:relay.mailchannels.net ~all (DIY Uptime Alert Generator). - Why: SPF names the servers allowed to send mail as your domain, so without it anyone can send invoices or password resets that look like they came from you. - Fix: Publish one TXT record such as v=spf1 include:_spf.google.com ~all adapted to your mail provider (or v=spf1 -all for a domain that never sends), change +all or ?all to -all or ~all, and consolidate or flatten includes when the lookup count nears 10. - Verify: [DNS / Email Auth Audit](https://jwatte.com/tools/dns-email-audit/), [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). Standard: SPF RFC 7208 (section 4.6.4, 10-lookup limit); CWE-290. - [ ] **10.29 DMARC record** - Pass: A TXT record at _dmarc.`<domain>` starts with v=DMARC1 and sets p=reject without t=y, or p=quarantine with adkim=s and aspf=s. - Warn: The record carries t=y, sets p=quarantine without strict alignment, or sets p=none (monitor only). - Fail: No v=DMARC1 record at _dmarc.`<domain>`, or a p= value other than none, quarantine or reject. - Numbers and lists the tool uses: record regex /^v=dmarc1\b/i; p= /\bp=(none|quarantine|reject)/i; sp= /\bsp=(none|quarantine|reject)/i; np= /\bnp=(none|quarantine|reject)/i; psd= /\bpsd=([ynu])\b/i; testing /\bt=y\b/i; adkim /\badkim=s\b/i; aspf /\baspf=s\b/i; BEC posture points: p=reject without t=y 35, p=quarantine with adkim=s and aspf=s 30, p=quarantine without strict alignment 20, p=none or any record with t=y 5, missing 0 (max 35); Mega Security Analyzer checks presence only with starter value v=DMARC1; p=none; rua=... (CWE-290); DNS Records Generator emits v=DMARC1; p=`<none or reject>`; sp=`<same>`; rua=mailto:`<address>`; ruf=mailto:`<same>`; fo=1; adkim=s; aspf=s; pct=100 at _dmarc with TTL 3600; rollout order: MX, SPF and DKIM first (wait 30 to 60 minutes), test to a Gmail inbox for SPF=PASS and DKIM=PASS, DMARC p=none for 2 to 4 weeks of rua reports, then p=quarantine for another 2 weeks, then p=reject. - Why: DMARC tells receiving mail servers what to do with mail that fails SPF and DKIM, and at p=none it only watches, so forged mail still lands. - Fix: Start with v=DMARC1; p=none; rua=mailto:dmarc@`<domain>` on a sending domain, use t=y rather than pct to test, and move to p=quarantine with adkim=s and aspf=s, then p=reject, once reports show every legitimate sender aligned; a non-sending domain goes straight to v=DMARC1; p=reject; sp=reject; np=reject; adkim=s; aspf=s. - Verify: [DNS / Email Auth Audit](https://jwatte.com/tools/dns-email-audit/), [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). Standard: DMARCbis (2026 revision replacing RFC 7489); CWE-290. - [ ] **10.30 DKIM selector found** - Pass: At least one TXT record matching v=DKIM1 exists at `<selector>`._domainkey.`<domain>` across the common selector list plus any selector you supply. - Warn: No DKIM record on any scanned selector and the domain is not classified as non-sending. - Numbers and lists the tool uses: DKIM regex /v=dkim1/i on TXT answers; typed selector normalized with .replace(/\._domainkey.*$/,'').toLowerCase(); COMMON_SELECTORS: default, google, k1, k2, k3, s1, s2, s3, s4, selector1, selector2, dkim, dkim1, dkim2, dkim3, dkim4, dkim5, s5, s6, s7, s8, s9, s10, amazonses, scph0820, scph0123, scph1024, mandrill, everlytic, mailgun, mg, smtpapi, sendgrid, em, em1, em2, em3, pm, pmsvc1, pmsvc2, mailjet, sparkpost, zoho, zm1, zm2, protonmail1, protonmail2, protonmail3, fm1, fm2, fm3, sig1, mail, smtp, mxvault, sm, mta, relay, server, auth, postfix, exim, cm, `<currentYear>`, `<currentYear-1>`, `<currentYear-2>`, s`<currentYear>`, s`<currentYear-1>`, one, two, main, key1, key2, private, public, _domainkey; Mega Security Analyzer scans about 24 common selectors and names Postmark pm, SendGrid s1 and em, Mailjet mailjet as non-standard; no hits on a non-sending domain renders info (not applicable); a typed selector that does not resolve while others do renders info; DNS Records Generator emits `<selector>`._domainkey TXT v=DKIM1; k=rsa; p=`<key from provider dashboard>` with provider selectors google, selector1 (Microsoft 365), fm1, zoho, protonmail, k1 (Mailgun), s1 (SendGrid), 20240101pm (Postmark), abc123._domainkey (SES), resend. - Why: DKIM signs your outgoing mail so receivers can prove it was not altered, and a missing signature hurts both deliverability and spoofing resistance. - Fix: Enable DKIM in your mail provider's admin console and publish the record it gives you at `<selector>`._domainkey; if your provider uses a custom or date-stamped selector, re-run the audit with that selector instead of creating a record at the wrong name. - Verify: [DNS / Email Auth Audit](https://jwatte.com/tools/dns-email-audit/), [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). Standard: DKIM RFC 6376. - [ ] **10.31 DKIM key strength** - Pass: The first DKIM key found is k=ed25519, or k=rsa with an estimated 2048 bits or more. - Warn: K=rsa between 1024 and 2047 bits, or an algorithm other than rsa or ed25519. - Fail: K=rsa below 1024 bits. - Numbers and lists the tool uses: evaluated on the first DKIM hit only; kTag regex /\bk=([a-z0-9]+)/i default rsa; p= regex /\bp=([A-Za-z0-9+\/=]+)/; algorithm test /^(rsa|ed25519)$/i; bits estimated from the whitespace-stripped p= length: >= 680 chars gives 4096, >= 370 gives 2048, >= 190 gives 1024, > 0 gives 512; BEC posture points: ed25519 or RSA >= 2048 20, RSA 1024 to 2047 15, RSA under 1024 5, no DKIM 0 (max 20). - Why: A short RSA key can be forged, which lets an attacker sign mail as you. - Fix: Rotate to a 2048-bit RSA or Ed25519 DKIM key at your mail provider and publish the new record. - Verify: [DNS / Email Auth Audit](https://jwatte.com/tools/dns-email-audit/). - [ ] **10.32 MX records** - Pass: The apex has at least one MX record. - Warn: No MX record and the domain is not classified as non-sending. - Numbers and lists the tool uses: MX query on the apex; first 3 records shown; no MX on a non-sending domain renders info; DNS Records Generator presets: google 1 smtp.google.com; microsoft365 0 `<domain-with-dashes>`.mail.protection.outlook.com; fastmail 10 in1-smtp.messagingengine.com and 20 in2-smtp.messagingengine.com; zoho 10 mx.zoho.com, 20 mx2.zoho.com, 50 mx3.zoho.com; protonmail 10 mail.protonmail.ch and 20 mailsec.protonmail.ch; TTL 3600. - Why: Without MX records the domain cannot receive email, which is fine for a web-only domain but a silent outage for one that should. - Fix: Add the MX records your mail provider specifies if the domain is meant to receive mail. - Verify: [DNS / Email Auth Audit](https://jwatte.com/tools/dns-email-audit/). - [ ] **10.33 Parked / non-sending domain locked against spoofing** - Pass: A domain with no MX, no DKIM hit and no sender-authorizing SPF mechanism publishes SPF -all and DMARC p=reject. - Warn: The domain is non-sending but either the SPF -all lock or DMARC p=reject is missing. - Numbers and lists the tool uses: nonSending = no MX answers and no DKIM hits and SPF has no /(?:include:|redirect=|exists:|ip4:|ip6:|\+all)/i mechanism; spfLocked regex /(?:^|\s)-all\b/; dmarcReject regex /\bp=reject\b/i; row only rendered when nonSending is true; BEC posture rescored as round(100 * (DMARC points + SPF points) / 55) with DKIM, MTA-STS, BIMI and TLS-RPT marked N/A. - Why: A domain that never sends mail is still a favorite for forgery, and only an explicit lock tells receivers to reject anything claiming to be from it. - Fix: Publish SPF v=spf1 -all and DMARC v=DMARC1; p=reject; sp=reject; np=reject; adkim=s; aspf=s with no p=none ramp, no sender includes and no DKIM key. - Verify: [DNS / Email Auth Audit](https://jwatte.com/tools/dns-email-audit/). Standard: DMARCbis (np tag). - [ ] **10.34 CAA record** - Pass: The apex has at least one CAA record. - Warn: No CAA records (DNS Email Audit); missing renders info in Mega Security Analyzer. - Numbers and lists the tool uses: CAA query on the apex; first 3 records shown; DNS Records Generator emits 0 issue "letsencrypt.org", 0 issue "sectigo.com", 0 issuewild "letsencrypt.org", 0 iodef "mailto:security@`<domain>`" with TTL 3600. - Why: Without CAA any certificate authority in the world can issue a certificate for your domain, which makes impersonation easier. - Fix: Add CAA records such as 0 issue "letsencrypt.org" and 0 iodef "mailto:security@`<domain>`" naming only the authorities you use. - Verify: [DNS / Email Auth Audit](https://jwatte.com/tools/dns-email-audit/), [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). Standard: CAA RFC 8659. - [ ] **10.35 MTA-STS** - Pass: A TXT record at _mta-sts.`<domain>` contains v=STSv1 (the id= tag is reported when present; the policy file at https://mta-sts.`<domain>`/.well-known/mta-sts.txt is not fetched). - Warn: No record while the domain has MX (info when there is no MX). - Numbers and lists the tool uses: query _mta-sts.`<domain>` TXT; regex /v=stsv1\b/i; id regex /\bid=([a-z0-9]+)/i; policy file at https://mta-sts.`<domain>`/.well-known/mta-sts.txt with version: STSv1, mode: enforce, mx: *.example.com, max_age: 604800; BEC posture points: MTA-STS with TLS-RPT 15, MTA-STS alone 10, missing with MX 0 (max 15); DNS Records Generator emits v=STSv1; id=`<UTC date YYYYMMDD>` with TTL 3600. - Why: Without MTA-STS an attacker on the network can strip encryption from mail delivered to you, and Gmail and Yahoo are moving toward requiring it for bulk senders. - Fix: Publish TXT _mta-sts.`<domain>` with v=STSv1; id=YYYYMMDD01 and host the policy file at https://mta-sts.`<domain>`/.well-known/mta-sts.txt with mode enforce, paired with a TLS-RPT record. - Verify: [DNS / Email Auth Audit](https://jwatte.com/tools/dns-email-audit/). - [ ] **10.36 TLS-RPT** - Pass: A TXT record at _smtp._tls.`<domain>` starts with v=TLSRPTv1. - Fail: Missing while the domain has MX renders info; no row when there is no MX. - Numbers and lists the tool uses: query _smtp._tls.`<domain>` TXT; regex /v=tlsrptv1\b/i; BEC posture solo bonus 5 points when TLS-RPT exists without MTA-STS, otherwise counted inside the MTA-STS row; generator value v=TLSRPTv1; rua=mailto:tls-reports@`<domain>` with TTL 3600. - Why: It is where other mail servers report failed encrypted deliveries to you, so without it you never learn that MTA-STS enforcement is failing. - Fix: Add TXT _smtp._tls.`<domain>` with v=TLSRPTv1; rua=mailto:tls-rpt@`<domain>`. - Verify: [DNS / Email Auth Audit](https://jwatte.com/tools/dns-email-audit/). - [ ] **10.37 BIMI** - Pass: A TXT record at default._bimi.`<domain>` contains v=BIMI1; the l= logo URL and a= VMC URL are reported when present but neither is required to pass. - Fail: Missing renders info; optional. - Numbers and lists the tool uses: query default._bimi.`<domain>` TXT; regex /v=bimi1\b/i; l= regex /\bl=(https?:\/\/[^\s;"]+)/i; a= regex /\ba=(https?:\/\/[^\s;"]+)/i; requires DMARC at p=quarantine or p=reject; BEC posture points 5 when present (max 5); DNS Records Generator emits v=BIMI1; l=https://`<domain>`/bimi-logo.svg; a=https://`<domain>`/bimi-vmc.pem with TTL 3600; a VMC (paid, from Entrust or DigiCert) is required for Gmail's blue check. - Why: It shows your logo next to your mail in Gmail, Apple Mail and Yahoo, which is a trust signal, but only after DMARC is enforced. - Fix: Once DMARC is at quarantine or reject, publish TXT default._bimi.`<domain>` with v=BIMI1; l=https://your.domain/logo.svg and optionally a VMC. - Verify: [DNS / Email Auth Audit](https://jwatte.com/tools/dns-email-audit/). - [ ] **10.38 Mail-server blacklist (RBL) status** - Pass: No IPv4 address of the domain's MX hosts is listed on any of the five checked DNS blacklists. - Fail: At least one MX host IP is listed on at least one RBL zone. - Numbers and lists the tool uses: only runs when MX records exist; RBL zones zen.spamhaus.org (Spamhaus ZEN), bl.spamcop.net (SpamCop), b.barracudacentral.org (Barracuda), dnsbl.sorbs.net (SORBS), dnsbl-1.uceprotect.net (UCEPROTECT L1); first 3 MX hosts, first 2 A records per host, IPv4 only /^\d+\.\d+\.\d+\.\d+$/; listed when an A query for `<reversed ip>`.`<zone>` returns any answer. - Why: Mail from a blacklisted server is rejected or sent to spam by receivers that honor these lists, and on shared hosting the listing may belong to a neighbor. - Fix: Request delisting from each RBL that lists you and allow 24 to 72 hours for it to clear. - Verify: [DNS / Email Auth Audit](https://jwatte.com/tools/dns-email-audit/). - [ ] **10.39 BEC posture, Business Email Compromise resistance** - Pass: The composite score across DMARC, SPF, DKIM, MTA-STS, BIMI and TLS-RPT is 85 or higher (STRONG). - Warn: Score 65 to 84 (MODERATE, some attack paths remain). - Fail: Score below 65 (WEAK, the domain is easily spoofed for invoice or wire fraud). - Numbers and lists the tool uses: becScore = min(100, sum of layer points); layer maxima DMARC 35, SPF 20, DKIM 20, MTA-STS 15, BIMI 5, TLS-RPT solo bonus 5; non-sending domains rescored as round(100 * (DMARC + SPF) / 55); verdict cutoffs 85 and 65; Security Headers Audit links every result to /tools/dns-email-audit/?domain=`<host>`&autorun=1 and names the DMARC, SPF, DKIM, MTA-STS, BIMI and TLS-RPT layers; FBI IC3 reports BEC losses crossed $3 billion in the U.S. in 2024; Analyzer cannot query DNS from the browser and points to mxtoolbox.com/SuperTool.aspx. - Why: HTTP security headers stop attacks on your pages but do nothing to stop someone sending fake invoices from your domain, which is the most common and most expensive small-business fraud. - Fix: Raise the lowest-scoring layer first: enforce DMARC, publish SPF ending in -all, sign with a 2048-bit RSA or Ed25519 DKIM key, add MTA-STS paired with TLS-RPT, and optionally BIMI. - Verify: [DNS / Email Auth Audit](https://jwatte.com/tools/dns-email-audit/), [Security Headers](https://jwatte.com/tools/security-headers-audit/), [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **10.40 DNS zone signed with DNSSEC** - Pass: The zone publishes DNSKEY records, or it publishes no SVCB agent-discovery record that would need signing. - Warn: An SVCB record is published but the zone is unsigned; otherwise advisory. - Numbers and lists the tool uses: Mega Analyzer row only rendered when the DNS-AID probe resolved and either an SVCB record at _index._agents is published or the site is an agent target; pass gate: dnssec OR no SVCB record; row title DNS-AID discovery zone signed with DNSSEC; DNS Records Generator enablement notes: Cloudflare Dashboard > DNS > Settings > DNSSEC > Enable then copy Digest, KeyTag, Algorithm and DigestType to the registrar; DigitalOcean does not sign natively; AWS Route53 aws route53 enable-hosted-zone-dnssec then get-dnssec; Google Cloud DNS gcloud dns managed-zones update `<zone>` --dnssec-state on; BIND dnssec-keygen -a RSASHA256 -b 2048 -n ZONE then dnssec-signzone -A -3 <16-hex salt> -N INCREMENT; the DS record always goes to the registrar; allow 24 to 48 hours for propagation. - Why: Without DNSSEC a resolver cannot tell your real DNS answers from forged ones, which matters most once agents read discovery records from your zone. - Fix: Turn on DNSSEC signing at your DNS host, paste the generated DS record at your registrar, and confirm your DNS host supports both SVCB and DNSSEC. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: DNSSEC; DNS-AID. - [ ] **10.41 No mixed content** - Pass: An https page references no http:// subresources or form actions. - Warn: Passive mixed content (http:// img, video, audio or source) is present, which triggers a browser warning (Mega SEO Analyzer); a form posts to http:// (Mega Security Analyzer CWE-319 pattern). - Fail: Active mixed content (http:// script, iframe, link, object, embed or form) is present and blocked by browsers (Mega SEO Analyzer); any http:// subresource on an https page (Analyzer, lists up to 4 samples). - Numbers and lists the tool uses: Analyzer selectors img[src], script[src], iframe[src], source[src], video[src], audio[src], link[href][rel="stylesheet"], link[href][rel~="icon"] with raw attribute /^http:\/\//i, only on https pages; Mega SEO Analyzer active regex /<(script|iframe|link|object|embed|form)[^>]+(?:src|href|action|data)\s*=\s*["']http:\/\//i and passive regex /<(img|video|audio|source)[^>]+src\s*=\s*["']http:\/\//i; Mega Security Analyzer form regex /<form[^>]*action=["']http:\/\//i (OWASP A02:2021). - Why: Browsers block http:// scripts and frames on an https page and warn on http:// images, so parts of the page silently break or lose the padlock, and a form posting to http:// sends visitor data in the clear. - Fix: Serve every subresource and form action over https:// (or use protocol-relative or relative URLs). - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). Standard: W3C Mixed Content; CWE-319; OWASP Top 10 2021 A02. - [ ] **10.42 SRI (Subresource Integrity) on eligible external scripts (`<n>`/`<n>`)** - Pass: Every SRI-eligible external script carries an integrity attribute (Analyzer, Mega SEO Analyzer at 100 percent); at least 80 percent of eligible scripts carry one (Mega Analyzer). - Warn: Coverage below 80 percent (Mega Analyzer); some or no eligible scripts covered (Analyzer); coverage 50 to 99 percent of all cross-origin scripts (Mega SEO Analyzer). - Fail: Coverage below 50 percent of all cross-origin scripts (Mega SEO Analyzer); coverage below 80 percent in the Mega Analyzer header bucket. - Numbers and lists the tool uses: Mega Analyzer: eligible src regex /^(?:https?:)?\/\//i, data: and javascript: excluded, threshold 0.8 of eligible, row hidden when there are no external scripts, all-exempt renders pass; SRI_HOSTILE exempt hosts googletagmanager.com, google-analytics.com, googleadservices.com, pagead2.googlesyndication.com, tpc.googlesyndication.com, adservice.google.com, cdn.tailwindcss.com, connect.facebook.net, static.hotjar.com, cdn.heapanalytics.com, js.hs-scripts.com, js.hs-analytics.net, js.intercomcdn.com, cdn.segment.com, static.zdassets.com, embed.tawk.to, cdn.amplitude.com, plausible.io, www.clarity.ms, snap.licdn.com, analytics.tiktok.com, static.ads-twitter.com, sc-static.net, js-na1.hs-scripts.com, cdn.jsdelivr.net/npm/@stripe, js.stripe.com, checkout.stripe.com, m.stripe.network, paypal.com, paypalobjects.com, wp.com/_static, ajax.googleapis.com, apis.google.com, accounts.google.com, news.google.com, fonts.googleapis.com, fonts.gstatic.com; Analyzer: requires all eligible scripts covered, DYNAMIC_SCRIPT_ORIGINS excluded (exact or same registrable domain) www.googletagmanager.com, www.google-analytics.com, googleadservices.com, pagead2.googlesyndication.com, tpc.googlesyndication.com, adservice.google.com, cdn.tailwindcss.com, www.clarity.ms, clarity.ms, connect.facebook.net, www.facebook.com, static.hotjar.com, script.hotjar.com, cdn.matomo.cloud, plausible.io, cdn.heapanalytics.com, platform.twitter.com, js.stripe.com, checkout.stripe.com, m.stripe.network, static.zdassets.com, embed.tawk.to, cdn.amplitude.com, js.intercomcdn.com, cdn.segment.com, js.hs-scripts.com, js.hs-analytics.net, snap.licdn.com, analytics.tiktok.com, static.ads-twitter.com, sc-static.net, paypal.com, paypalobjects.com, ajax.googleapis.com, apis.google.com, accounts.google.com; Mega SEO Analyzer: no exemptions, script regex /<script\b[^>]+src\s*=\s*["'][^"']+["'][^>]*>/gi, cross-origin /^https?:\/\//i, integrity /\bintegrity\s*=\s*["']/i, pass 100, warn 50 to 99, fail below 50; Single-Site Generator scaffold uses integrity sha384 plus crossorigin anonymous. - Why: If a CDN serving one of your scripts is compromised, the integrity hash makes the browser refuse the altered file instead of running it. - Fix: Add integrity="sha384-..." and crossorigin="anonymous" to static CDN scripts such as jQuery, Bootstrap and Font Awesome (generate the hash with openssl dgst -sha384 -binary file.js | openssl base64 -A or srihash.org); rolling analytics bundles from Google, Meta, Hotjar and Stripe cannot take a hash and are exempt. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: W3C Subresource Integrity. - [ ] **10.43 All external links have rel="noopener"** - Pass: Every a[target=_blank] link carries rel noopener or noreferrer. - Warn: `<n>` target=_blank links lack both noopener and noreferrer. - Numbers and lists the tool uses: selector a[target="_blank"]; rel must include noopener or noreferrer. - Why: A new-tab link without noopener lets the opened page take control of your tab and swap it for a phishing page. - Fix: Add rel="noopener noreferrer" to every link that uses target="_blank". - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **10.44 No inline event handlers** - Pass: The HTML contains no inline on* event handler attributes. - Warn: `<n>` inline event handlers found (a CSP blocker). - Numbers and lists the tool uses: regex /\son(click|change|submit|error|load|mouseover|focus|blur|input)\s*=/gi. - Why: Inline handlers only work if the CSP allows unsafe-inline, so they keep you from deploying a strict policy. - Fix: Move inline handlers to addEventListener calls in an external script. - Verify: [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). - [ ] **10.45 No API keys, tokens or private keys in page source** - Pass: The HTML matches none of the secret-shaped patterns. - Warn: An API-key-shaped literal appears in inline JS or a data attribute (Mega Security Analyzer CWE-798 pattern). - Fail: The HTML contains an AWS key, Stripe live key, Anthropic key, GitHub token or PEM private key pattern (Mega SEO Analyzer); a Sanity write-token-shaped string or a Contentful preview or access token appears (Platform Audit). - Numbers and lists the tool uses: Mega SEO Analyzer regex /AKIA[0-9A-Z]{16}|sk_live_[A-Za-z0-9]{24,}|sk-ant-[A-Za-z0-9_\-]{80,}|ghp_[A-Za-z0-9]{36}|-----BEGIN (RSA |EC )?PRIVATE KEY-----/; Mega Security Analyzer regex /api[_-]?key\s*[:=]\s*["'][A-Za-z0-9_-]{20,}/i (OWASP A07:2021); Platform Audit: Sanity sk followed by 40 or more [A-Za-z0-9_-], Contentful ?preview=true or ?access_token= with 10 or more alphanumerics; Single-Site Generator keeps secrets out of [vars] and generates them with crypto.randomBytes(48) hex via wrangler secret put and .dev.vars. - Why: Anything in the HTML is public, so a key there can be used by anyone to run up your bill, read draft content or change your data. - Fix: Remove the secret from the page, rotate it immediately, and keep keys server-side (environment variables or a secret store) with public tokens scoped read-only. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). Standard: CWE-798; OWASP Top 10 2021 A07. - [ ] **10.46 No inline eval, document.write or unescape patterns (CWE-79)** - Pass: No inline script uses eval(), document.write() or unescape(). - Warn: An inline script matches the XSS or cloaked-payload pattern. - Numbers and lists the tool uses: regex /<script[^>]*>[^<]*eval\(|<script[^>]*>[^<]*document\.write\(|unescape\(/i; OWASP A03:2021. - Why: These constructs are the classic shape of injected or hidden malicious code and they also block a strict CSP. - Fix: Remove eval and document.write(unescape(...)) constructs and pair the cleanup with a strict CSP. - Verify: [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). Standard: CWE-79; OWASP Top 10 2021 A03. - [ ] **10.47 POST forms carry a CSRF token (CWE-352)** - Pass: Every POST form has a visible CSRF token field nearby. - Warn: A POST form has no csrf, _token or authenticity_token within 2000 characters. - Numbers and lists the tool uses: regex /<form[^>]*method=["']post["'][^>]*>(?![\s\S]{0,2000}csrf|_token|authenticity_token)/i; lookahead window 2000 chars; OWASP A01:2021. - Why: Without a token another site can submit your forms on behalf of a logged-in visitor. - Fix: Add a hidden _token or csrf-token input to every POST form and validate it server-side. - Verify: [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). Standard: CWE-352; OWASP Top 10 2021 A01. - [ ] **10.48 No http: or relative iframe targets (CWE-1021)** - Pass: The page has no frame tags and every iframe src is an absolute https URL. - Warn: A frame tag, an http: iframe src or a relative iframe src is present. - Numbers and lists the tool uses: regex /<frame|<iframe[^>]*src=["']http:|<iframe[^>]*src=["'](?!https?:\/\/)/i; OWASP A05:2021. - Why: Embeddable frame targets combined with a missing framing header are the setup for a clickjacking attack. - Fix: Use https iframe sources and set X-Frame-Options or CSP frame-ancestors. - Verify: [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). Standard: CWE-1021; OWASP Top 10 2021 A05. - [ ] **10.49 No framework fingerprint in meta tags (CWE-16)** - Pass: The page has no X-UA-Compatible meta and no generator meta naming the CMS or its version. - Warn: A generator meta names WordPress, Drupal or Joomla (Mega Security Analyzer), or exposes a Joomla version number (Platform Audit); an X-UA-Compatible meta is present. - Numbers and lists the tool uses: regex /<meta\s+http-equiv=["']?X-UA-Compatible["']?|<meta\s+name=["']?generator["']?\s+content=["'](?:WordPress|Drupal|Joomla)/i (OWASP A05:2021); Platform Audit reads generator Joomla! `<version>` (warn) and TYPO3 `<version>` (info, LTS supported 3 years). - Why: A version in the generator tag helps attackers match your site to known holes for that release. - Fix: Strip the generator meta tag and the X-UA-Compatible meta from the template. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/), [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). Standard: CWE-16; OWASP Top 10 2021 A05. - [ ] **10.50 Source maps not referenced in production bundle** - Pass: No //# sourceMappingURL=...map reference appears in the HTML. - Warn: A source map reference is found (Next.js). - Numbers and lists the tool uses: //# sourceMappingURL=...map in HTML. - Why: Shipping source maps hands your original source code to anyone who looks. - Fix: Set productionBrowserSourceMaps: false in next.config.js (or the equivalent in your bundler). - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **10.51 No stack trace or internal path leaked in the response** - Pass: The response body contains no JS stack-frame pattern or internal server path. - Fail: The body matches a stack-frame pattern or an internal path. - Numbers and lists the tool uses: regex /at\s+\S+\s+$.+:\d+:\d+$/; regex /\/var\/task\/|file:\/\/\/|\/home\/runner\//i. - Why: A leaked stack trace maps your server's internals for an attacker. - Fix: Catch errors server-side and return only a generic message such as {"error":"internal"}. - Verify: [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). Standard: CWE-209. - [ ] **10.52 No debug flags or internal comments in production HTML (CWE-200)** - Pass: The HTML has no debug=true flag, error_reporting() call or internal HTML comment. - Warn: The page matches the debug or internal-comment pattern. - Numbers and lists the tool uses: regex /debug\s*=\s*true|error_reporting\s*\(|<!--\s*(?:debug|staging|internal|todo)/i; OWASP A01:2021. - Why: Debug flags and internal notes tell outsiders how the site is built and what is unfinished. - Fix: Strip debug flags and internal comments from the production build. - Verify: [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). Standard: CWE-200; OWASP Top 10 2021 A01. - [ ] **10.53 Dependency & framework versions: `<n>` librar(y|ies) fingerprinted** - Pass: Every fingerprinted JavaScript library is at or above the latest known release, or above its security floor with no end-of-life flag. - Warn: A library is behind the latest release but above its floor, is marked unmaintained (Moment.js, Slick Carousel, Owl Carousel 2), or its major version is end of life (Vue below 3). - Fail: A library is below its security floor (known CVEs), or is end of life at any version (AngularJS 1.x, Prototype.js, MooTools). - Numbers and lists the tool uses: detection from script[src] and link[href] URLs: /\/ajax\/libs\/([A-Za-z0-9._-]+)\/(\d+\.\d+(?:\.\d+)?(?:-[A-Za-z0-9.]+)?)\//, /(?:\/npm\/|unpkg\.com\/)((?:@[A-Za-z0-9._-]+\/)?[A-Za-z0-9._-]+)@(\d+\.\d+(?:\.\d+)?(?:-[A-Za-z0-9.]+)?)/, /jquery-ui-(\d+\.\d+\.\d+)/i, /jquery-migrate-(\d+\.\d+\.\d+)/i, /jquery[.-](\d+\.\d+\.\d+)(?:\.slim)?(?:\.min)?\.js/i, /\/bootstrap\/(\d+\.\d+\.\d+)\//i, /\/((?:@[A-Za-z0-9._-]+\/)?[A-Za-z0-9._-]+)@(\d+\.\d+(?:\.\d+)?)/, WordPress ?ver= /\/([A-Za-z0-9._-]+?)\.(?:js|css)\?[^"']*\bver=v?(\d+\.\d+(?:\.\d+)?)/i, /\/([A-Za-z0-9._]+?)[-.](\d+\.\d+(?:\.\d+)?)(?:\.slim)?(?:\.min)?\.(?:js|css)/i; license banners jQuery /jQuery (?:JavaScript Library )?v?(\d+\.\d+\.\d+)/, jQuery UI /jQuery UI(?: -)? v?(\d+\.\d+\.\d+)/, Bootstrap /Bootstrap v(\d+\.\d+\.\d+)/, Lodash /[Ll]odash (\d+\.\d+\.\d+)/, moment /moment[\s\S]{0,120}?version\s*:\s*(\d+\.\d+\.\d+)/i, Vue /Vue\.js v(\d+\.\d+\.\d+)/, Swiper /Swiper (\d+\.\d+\.\d+)/, Modernizr /Modernizr (\d+\.\d+\.\d+)/; lowest detected version per library is evaluated; cmpVer strips a leading non-digit prefix, drops any -prerelease suffix and compares dot-separated integers; LIB_DB (floor / latest / CVEs): jquery 3.5.0 / 4.0.0 / CVE-2020-11022, CVE-2020-11023; jquery-ui 1.13.2 / 1.14.2 / CVE-2022-31160, CVE-2021-41182, CVE-2021-41183, CVE-2021-41184; jquery-migrate none / 4.0.2; bootstrap floors by major 3: 3.4.1, 4: 4.3.1, 5: 0.0.0 / latest 5.3.8 / CVE-2019-8331, CVE-2018-14041, CVE-2018-14042; lodash 4.17.21 / 4.18.1 / CVE-2021-23337, CVE-2019-10744; underscore 1.13.2 / 1.13.8 / CVE-2021-23358; moment 2.29.4 / 2.30.1 / CVE-2022-31129, CVE-2022-24785 (eol); angularjs none / 1.8.3 / CVE-2024-21490, CVE-2022-25844, CVE-2020-7676 (anyVersionFail, eol January 2022); angular none / 22.0.0; vue none / 3.5.35 (eolBelowMajor 3, Vue 2 end of life 2023-12-31); react 16.0.0 / 19.2.7; d3 none / 7.9.0; handlebars 4.7.7 / 4.7.9 / CVE-2021-23369, CVE-2021-23383; axios 1.8.2 / 1.17.0 / CVE-2025-27152, CVE-2024-39338, CVE-2023-45857; chart.js 2.9.4 / 4.5.1 / CVE-2020-7746; swiper none / 12.2.0; slick-carousel none / 1.8.1 (eol, last release 2017); owl.carousel none / 2.3.4 (eol); select2 4.0.6 / 4.1.0 / CVE-2016-10744; popper 2.0.0 / 2.11.8; font-awesome none / 7.2.0; gsap 3.6.0 / 3.15.0 / CVE-2020-28478; three 0.125.0 / 0.184.0 / CVE-2020-28496; modernizr none / 3.13.1; tailwindcss none / 4.3.0; alpinejs none / 3.15.12; marked 4.0.10 / 18.0.5 / CVE-2022-21680, CVE-2022-21681; dompurify 3.1.3 / 3.4.8 / CVE-2024-45801, CVE-2024-47875; backbone none / 1.6.1; prismjs 1.27.0 / 1.30.0 / CVE-2022-23647, CVE-2021-32723; highlight.js 10.1.2 / 11.11.1 / CVE-2020-26237; prototype none / 1.7.3 (anyVersionFail, eol); mootools none / 1.6.0 (anyVersionFail, eol); npm-only keys glob 9.0.0 / 13.0.6; minimatch 3.0.5 / 10.2.5 / CVE-2022-3517; semver 7.5.2 / 7.8.3 / CVE-2022-25883; ws 8.17.1 / 8.21.0 / CVE-2024-37890; node-fetch 2.6.7 / 3.3.2 / CVE-2022-0235; ejs 3.1.10 / 6.0.1 / CVE-2022-29078, CVE-2024-33883; jsonwebtoken 9.0.0 / 9.0.3 / CVE-2022-23529, CVE-2022-23539, CVE-2022-23540, CVE-2022-23541; express 4.21.2 / 5.2.1 / CVE-2024-45296, CVE-2024-52798, CVE-2024-29041; minimist 1.2.6 / 1.2.8 / CVE-2021-44906; ansi-regex 5.0.1 / 6.2.2 / CVE-2021-3807; baseline latest refreshed 2026-06-09, CVEs verified 2026-05-29; no fingerprintable library renders info (a clean result is not proof you are current); CWE-1104. - Why: Outdated front-end libraries carry published, easily exploited holes, and they are the most common finding on small-business sites. - Fix: Upgrade each flagged library to the current release (with a sha384 integrity hash if self-hosted), plan a migration for any end-of-life major version, and replace end-of-life libraries (AngularJS, Prototype.js, MooTools, Moment.js, Slick, Owl) with a maintained alternative rather than upgrading them. - Verify: [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). Standard: OWASP Top 10 2021 A06; CWE-1104. - [ ] **10.54 CMS major version is still supported** - Pass: Drupal is at major version 10 or higher (Magento 2.x era signals, a possible 1.x install and PWA Studio detection all render info only). - Warn: Drupal major version below 10 (Drupal 9 reached end of life November 2023). - Numbers and lists the tool uses: Drupal regex /Drupal\s+(\d+)/ on the HTML, pass at major 10 or higher, warn below 10, info when no version is found; Magento 2.x signals /mage-init|_staticversion|X-Magento-Cache-Debug/i (info either way, Magento 1.x end of life June 2020); PWA Studio /magento-storefront-pwa|pwa-studio/i (info). - Why: A CMS past end of life stops receiving security patches, and store platforms are a prime target. - Fix: Upgrade Drupal to 10 or 11; migrate Magento 1.x to Adobe Commerce 2.x. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **10.55 `<n>` custom-code block(s) inline (Framer)** - Pass: No inline script blocks start with /* Custom code */. - Warn: One or more Framer custom-code blocks are inlined. - Numbers and lists the tool uses: count of script blocks starting with /* Custom code */. - Why: Pasted custom code is the usual place where a site builder page picks up an injection hole or a slow script. - Fix: Review each custom-code block for cross-site scripting risk and remove what is not needed. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **10.56 GraphQL introspection disabled and CMS project references scoped** - Pass: No Hygraph introspection markers appear in the HTML. - Warn: Hygraph introspection markers (__schema or introspectionQuery) are found in the HTML. - Numbers and lists the tool uses: Hygraph introspection regex /__schema|introspectionQuery/i (warn); Sanity projectId regex /['"]projectId['"]\s*:\s*['"][a-z0-9]{8}['"]/gi and Studio regex /\.sanity\.studio|sanity-studio/i render info only (projectId is expected on public sites). - Why: Introspection left on in production lets anyone read your whole content schema. - Fix: Disable GraphQL introspection in production and keep Studio references and project IDs off public pages where possible. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **10.57 `<n>` third-party tracker(s) detected** - Pass: None of the 22 known tracker fingerprints appears in the HTML. - Warn: No Tier 1 tracker but at least one Tier 2 advertising pixel is present. - Fail: At least one Tier 1 session-replay tracker is present; Tier 3 or 4 only renders info. - Numbers and lists the tool uses: Tier 1: FullStory /fullstory\.com|fs\.js/i, Hotjar /static\.hotjar\.com|hotjar-/i, LogRocket /logrocket\.com|lr-\.js/i, Mouseflow /mouseflow\.com|mf\.js/i, Inspectlet /inspectlet\.com/i, Smartlook /smartlook\.com/i; Tier 2: Facebook Pixel /connect\.facebook\.net|fbq\(|facebook\.com\/tr/i, TikTok Pixel /analytics\.tiktok\.com/i, LinkedIn Insight /snap\.licdn\.com|linkedin\.com\/px/i, X (Twitter) Pixel /static\.ads-twitter\.com|twq\(/i, Pinterest Tag /ct\.pinterest\.com/i, Snap Pixel /sc-static\.net|snap\.licdn/i, Reddit Pixel /redditstatic\.com\/ads|reddit\.com\/conversion/i; Tier 3: Google Analytics 4 /googletagmanager\.com\/gtag\/js|google-analytics\.com\/g\/collect/i, Adobe Analytics /omtrdc\.net|demdex\.net/i, Mixpanel /api-js\.mixpanel\.com|mixpanel\.com\/track/i, Amplitude /cdn\.amplitude\.com|api\.amplitude\.com/i, Segment /cdn\.segment\.com|api\.segment\.io/i, Heap /heapanalytics\.com/i; Tier 4: Intercom /widget\.intercom\.io|intercomcdn\.com/i, Drift /js\.driftt\.com|drift\.com\/chat/i, Cloudflare RUM /static\.cloudflareinsights\.com/i. - Why: Every tracker must be disclosed under GDPR, CCPA and CPRA, and session-replay tools record keystrokes, so a misconfiguration can export personal data. - Fix: Remove trackers you do not use, disclose the rest in the privacy policy, and run the third-party data leakage audit for the full breakdown. - Verify: [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). Standard: CWE-200. - [ ] **10.58 Trackers load only behind a consent management platform** - Pass: A consent management platform marker is present (Mega Security Analyzer emits no row when neither a CMP marker nor inline tracker calls are found). - Warn: Squarespace cookie banner missing (Platform Audit). - Fail: Inline tracker calls are present with no consent platform marker in the HTML. - Numbers and lists the tool uses: CMP regex /cookiebot|onetrust|iubenda|quantcast|trustarc|klaro|cookie-consent|usercentrics|didomi/i; inline tracker regex /fbq\(|gtag\(|_hsq|ga\(/i (Mega Security Analyzer, CWE-359); Mega Analyzer next-step signals hasTrackingPixels /googletagmanager|gtag\(|connect\.facebook\.net|hotjar|clarity\.ms/i and hasConsentVendor /cookiebot|onetrust|cookieyes|complianz|borlabs|iubenda|termly/i; Migration Analyzer consent signatures Cookiebot, OneTrust, CookieYes, Complianz, Borlabs, Iubenda, Termly, Cookie Script, Osano and tracking signatures GTM, GA4, Meta Pixel, Hotjar, Clarity, AdSense, Google Ads, Segment, Mixpanel, Amplitude; Squarespace markers cookie-banner-v2 or sqs-cookie-banner. - Why: Firing trackers before consent is a lawful-basis violation under GDPR the moment an EU visitor loads the page, and a similar duty applies under UK and California rules. - Fix: Gate every non-essential tracker behind a consent banner (Squarespace: Settings > Cookies & Visitor Data) and confirm by inspection that declining actually stops the tags from firing. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/), [Migration Analyzer](https://jwatte.com/tools/migration-analyzer/). Standard: CWE-359. - [ ] **10.59 CORS: Access-Control-Allow-Origin not wildcard with credentials** - Pass: Access-Control-Allow-Origin is set to an explicit origin rather than * (Mega SEO Analyzer reports CORS: ACAO scoped to that origin); an absent header produces no finding. - Fail: Access-Control-Allow-Origin is * and Access-Control-Allow-Credentials is true. - Numbers and lists the tool uses: acao === '*'; /true/i on access-control-allow-credentials; no finding when ACAO is absent or * without credentials (Mega SEO Analyzer); CWE-942. - Why: Browsers refuse the combination, but a fetch rewrite can turn it into a leak of one user's data to any site. - Fix: Replace the wildcard with an explicit origin allowlist whenever credentials are allowed. - Verify: [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). Standard: Fetch Standard CORS; CWE-942. - [ ] **10.60 CORS wildcard on user-scoped responses** - Pass: Access-Control-Allow-Origin is not a bare *. - Warn: Access-Control-Allow-Origin is * (without credentials). - Numbers and lists the tool uses: exact '*'. - Why: Any site can read a wildcard response in a browser, which is fine for public data and unacceptable for anything tied to a user. - Fix: Scope Access-Control-Allow-Origin to known origins for any response that depends on a session or user. - Verify: [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). - [ ] **10.61 Cache-Control set on JSON or XML responses** - Pass: A JSON or XML response carries a Cache-Control header. - Warn: Content-Type matches json or xml and Cache-Control is absent. - Numbers and lists the tool uses: /json|xml/i on content-type; header name cache-control; adjacent info row 'Public cache on JSON' when cache-control matches /public/i and content-type matches /json/i. - Why: Without a cache directive a CDN may store one user's data and serve it to another. - Fix: Add Cache-Control: private, no-store to any response tied to a session. - Verify: [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). - [ ] **10.62 Retry-After sent on throttled responses** - Pass: A 429 or 503 response includes a Retry-After header. - Warn: The response status is 429 or 503 and Retry-After is absent. - Numbers and lists the tool uses: status /^429|^503/; header name retry-after; suggested value Retry-After: 60. - Why: Without it clients and crawlers do not know when to back off, so they keep hammering the site. - Fix: Add Retry-After: 60 to rate-limit and maintenance responses. - Verify: [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). - [ ] **10.63 Reporting endpoint: <v2 / legacy Report-To / none>** - Pass: A Reporting-Endpoints header is present. - Warn: Only the legacy Report-To header is present. - Fail: Neither header is present (info). - Numbers and lists the tool uses: header names reporting-endpoints, report-to. - Why: A reporting endpoint is how browsers tell you when your CSP or other policies block something on a real visitor's page. - Fix: Send a Reporting-Endpoints header pointing at a collector and reference it from the CSP report-to directive. - Verify: [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: W3C Reporting API. - [ ] **10.64 Post-quantum hybrid key exchange** - Pass: The TLS handshake negotiates a post-quantum hybrid key-exchange group. - Warn: Not supported (Mega Security Analyzer flags harvest-now-decrypt-later exposure); SSL Grade reports it as info with no deduction. - Numbers and lists the tool uses: tls.pqc.supported truthy; recommended group X25519MLKEM768; MITRE TA0009 Collection; CWE-327. - Why: Traffic recorded today can be decrypted later by a quantum-capable attacker unless the key exchange already resists that. - Fix: Enable the hybrid X25519MLKEM768 group on the TLS terminator (most CDNs offer it as a setting) and verify with openssl s_client. - Verify: [SSL Grade](https://jwatte.com/tools/ssl-grade/), [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). Standard: ML-KEM NIST FIPS 203; CWE-327. - [ ] **10.65 Prompt-injection defense** - Pass: The page source contains 0 or 1 prompt-injection-shaped patterns (score 100 or 80). - Warn: 2 hits (score 60). - Fail: 3 or more hits (score 40 or below). - Numbers and lists the tool uses: patterns /ignore (all |the )?(previous|above|prior) instructions/i, /you are now/i, /system prompt/i, /jailbreak/i, /<!--\s*assistant/i, Unicode direction-override characters U+202D and U+202E in raw, HTML entity (‭ ‮) or escape (‭ ‮) form; score = 100 - hits * 20, floor 0; severity score >= 80 pass, >= 60 warn, else fail. - Why: Hidden instruction-shaped text in your pages (often pasted into comments or reviews) can hijack the AI assistants that read your site on a customer's behalf. - Fix: Audit content for accidentally embedded prompt-shaped strings and sanitize user-generated content (comments, reviews) for hidden Unicode and instruction patterns. - Verify: [Mega AEO Analyzer](https://jwatte.com/tools/mega-aeo-analyzer/). - [ ] **10.66 OAuth / OIDC discovery metadata (RFC 8414)** - Pass: Authorization-server or OpenID configuration metadata is published, or the site is not an agent target. - Warn: The site is an agent target and publishes neither document. - Numbers and lists the tool uses: paths /.well-known/oauth-authorization-server, /.well-known/openid-configuration; gate _isAgentTarget. - Why: It lets AI agents and MCP clients discover how to authenticate to your service without manual setup. - Fix: Publish issuer, authorization_endpoint, token_endpoint, jwks_uri and grant_types_supported at the well-known path. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: RFC 8414; OpenID Connect Discovery; Cloudflare Agent Readiness Score (https://isitagentready.com/). - [ ] **10.67 OAuth Protected Resource Metadata (RFC 9728)** - Pass: /.well-known/oauth-protected-resource exists, or the site is not an agent target. - Warn: The site is an agent target and the document is missing. - Numbers and lists the tool uses: path /.well-known/oauth-protected-resource; gate _isAgentTarget. - Why: It tells agents which authorization servers and scopes they need to obtain an access token for your resource. - Fix: Publish resource, authorization_servers and scopes_supported at the well-known path. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: RFC 9728; Cloudflare Agent Readiness Score (https://isitagentready.com/). - [ ] **10.68 OAuth Resource Server Link header on 401 (RFC 9728)** - Pass: When oauth-protected-resource metadata exists, the Link header advertises it. - Warn: The metadata exists but the Link header is missing. - Numbers and lists the tool uses: regex /rel\s*=\s*"?oauth-protected-resource"?/i on the Link header; gate aux.oauthPR. - Why: Many MCP clients only learn that OAuth is required from this header on the 401 response. - Fix: Add Link: </.well-known/oauth-protected-resource>; rel="oauth-protected-resource" to 401 responses. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: RFC 9728. - [ ] **10.69 .well-known/change-password found** - Pass: The file at /.well-known/change-password resolves; a pass row is rendered and counts 10 of 10 points in the section score. When it is absent no row is rendered. - Numbers and lists the tool uses: path /.well-known/change-password; pass only, absence is not reported. - Why: Browsers and password managers use this URL to send users straight to your password-change page. - Fix: Serve /.well-known/change-password as a redirect to your account password page. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). Standard: RFC 8615. - [ ] **10.70 Trusted Types directive enabled** - Pass: The Content-Security-Policy header matches /require-trusted-types-for|trusted-types\s+/i; the pass finding counts toward the Security dimension score (pass findings divided by all findings). No finding is added otherwise, and nothing is evaluated without a CSP. - Numbers and lists the tool uses: regex /require-trusted-types-for|trusted-types\s+/i on the CSP; pass only, no finding otherwise; only evaluated when a CSP exists. - Why: Trusted Types stops scripts from writing raw HTML into the page, which removes a whole class of DOM injection. - Fix: Add require-trusted-types-for 'script' to the CSP once your scripts are compatible. - Verify: [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: W3C Trusted Types. - [ ] **10.71 OCSP stapling active** - Pass: Tls.standard.ocsp_stapled is truthy; the pass row 'OCSP stapling active' adds no points to the SSL grade but counts in the scorecard pass rate. When not stapled an info row 'OCSP stapling not detected' is shown with no deduction. - Numbers and lists the tool uses: tls.standard.ocsp_stapled truthy; not stapled renders info with no deduction. - Why: Stapling saves every visitor a certificate-revocation round trip. - Fix: Enable OCSP stapling on the TLS terminator. - Verify: [SSL Grade](https://jwatte.com/tools/ssl-grade/). - [ ] **10.72 Product/service-specific legal pages: Refund, Shipping, DPA, FTC affiliate, medical, financial, legal disclaimers** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: gated by schema type: Refund for Product, OfferCatalog or Service; Shipping for Product; DPA for SoftwareApplication or Service; FTC affiliate disclosure for Article, BlogPosting or Review; Medical disclaimer for Medical, HealthTopicContent or Physician; Financial disclaimer for FinancialService, InvestmentOrDeposit or BankOrCreditUnion; Legal disclaimer for LegalService or Attorney. - Why: FTC rules, Google Merchant Center, GDPR Article 28, 16 CFR 255, YMYL expectations and state bar rules each expect a specific page or disclaimer for that kind of business. - Fix: Add the page or disclaimer that matches the schema types your site publishes. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: GDPR Art. 28; 16 CFR 255. - [ ] **10.73 without a browser window / self-hosted CMS admin paths gated and write keys kept server-side** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: admin paths Strapi /admin, Payload /admin, Craft /admin (cpTrigger), Kirby /panel, MODX /manager/, OpenCart /admin, Decap /admin/index.html, Statamic /content/; advisories for Storyblok visual editor bridge, Prismic preview toolbar, Builder.io key scope, Sitecore token scope, Commerce.js key, Saleor tokens, Snipcart webhooks, SFCC API scope, PrestaShop modules, Hydrogen Oxygen, Mailchimp GDPR. - Why: A guessable admin URL and a write-capable key in the front end are the two easiest ways into a without a browser window CMS. - Fix: Auth-gate, IP-allowlist or rename the admin path, keep write keys server-side and scope public tokens read-only. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **10.74 Bot-protection markers present** - Pass: Response body matches /challenge-platform|__cf_chl|turnstile|hcaptcha|recaptcha/i or the cf-mitigated header is set; the pass row 'Bot-protection markers present' (Posture category) counts in the scorecard pass rate. On a Cloudflare-fronted site with no marker an info row is shown instead, which the scorecard excludes. - Numbers and lists the tool uses: regex /challenge-platform|__cf_chl|turnstile|hcaptcha|recaptcha/i or header cf-mitigated; a Cloudflare-fronted site with no marker renders info; Single-Site Generator modes none (default), turnstile (server-side siteverify), access-rl (constant-time compare, KV rate limit keyed rl:`<bucket>`:`<ip>` with expirationTtl = window, fail open on KV error, fail closed on the gate), waf-managed (managed challenge plus Bot Fight Mode plus rate limiting rule); client IP from CF-Connecting-IP. - Why: Public write endpoints without a challenge get scraped and spammed, and on Cloudflare the fix is a free one-click setting. - Fix: Enable Bot Fight Mode or Turnstile on public forms and API endpoints, and keep the challenge scoped so your own UI calls still pass. - Verify: [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). - [ ] **10.75 DMARC pct= is obsolete (DMARCbis)** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: regex /\bpct=\d+/i; value from /\bpct=(\d+)/i, default 100; DNS Records Generator still emits pct=100. - Why: DMARCbis removes the pct tag, so receivers on the new spec ignore it while older ones may still honor it. - Fix: Delete the pct tag and use t=y to test, then move p through none, quarantine and reject as sources align. - Verify: [DNS / Email Auth Audit](https://jwatte.com/tools/dns-email-audit/). Standard: DMARCbis. - [ ] **10.76 DMARC np= (non-existent subdomains)** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: regex /\bnp=(none|quarantine|reject)/i; row rendered when np is empty and the domain sends mail. - Why: Subdomains that were never created inherit no policy, which makes them a favorite for spoofers. - Fix: Add np=reject to the DMARC record to reject forged mail from any non-existent subdomain without changing how real subdomains are handled. - Verify: [DNS / Email Auth Audit](https://jwatte.com/tools/dns-email-audit/). Standard: DMARCbis (np tag). - [ ] **10.77 DMARC monitoring (rua=)** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: regex /\brua=mailto:/i; a missing rua never demotes the DMARC pass. - Why: Without an aggregate-report address you have no stream of reports to spot abuse or misaligned senders. - Fix: Add rua=mailto:dmarc@`<domain>`; managed services such as Valimail, dmarcian and Postmark DMARC Digests ingest and chart these reports for free. - Verify: [DNS / Email Auth Audit](https://jwatte.com/tools/dns-email-audit/). Standard: DMARCbis. ## 11. Content, keywords and what the top ten already do The checks on the words themselves: thin pages, keyword placement, readability, the voice tells that read as generated, and the gaps between your page and the pages that already rank for the same question. **Verify this section with:** [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [SGE Readiness Audit](https://jwatte.com/tools/sge-readiness-audit/), [Mega Batch](https://jwatte.com/tools/mega-batch/), [Rendered DOM Paste Audit](https://jwatte.com/tools/rendered-dom-paste-audit/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/), [Keyword Inspection](https://jwatte.com/tools/keyword-inspection/), [Monoclone Gen.](https://jwatte.com/tools/monoclone-generator/), [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/), [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [About-Page Conversion Audit](https://jwatte.com/tools/about-page-conversion-audit/), [Heading Gap Audit](https://jwatte.com/tools/heading-gap-audit/), [Content Gap TF-IDF Analyzer](https://jwatte.com/tools/content-gap-tfidf/), [SERP Feature Opportunity Matrix](https://jwatte.com/tools/serp-feature-opportunity-matrix/), [SERP Features](https://jwatte.com/tools/serp-features/), [Content Velocity](https://jwatte.com/tools/content-velocity/). - [ ] **11.1 ads.txt found** - Pass: An ads.txt file is served at /ads.txt. - Numbers and lists the tool uses: /ads.txt; only presence is reported, absence is not flagged (Analyzer). - Why: The Authorized Digital Sellers file controls who is allowed to sell your ad inventory. - Fix: If you run display ads, publish /ads.txt listing your authorized sellers. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). Standard: IAB ads.txt. - [ ] **11.2 Content depth: `<n>` words** - Pass: The main body holds at least 800 words after navigation, header, footer and scripts are removed. - Warn: Between 300 and 799 words is flagged as thin; the SGE audit warns below 1,200 and the Rendered DOM audit warns below 300. - Fail: Under 300 words is very thin content; the SGE audit fails below 600 and the Rendered DOM audit fails below 100. - Numbers and lists the tool uses: Analyzer: pass >= 800, warn 300 to 799, fail < 300; body text excludes script, style, nav, header, footer, aside, noscript. Mega Analyzer: >= 800 words on expertise pages; Voice score adds 10 points at >= 800; writing-framework score adds 20 points at >= 600; body text strips script, style, nav, header, footer, aside, noscript, form.site-footer.footer, [role=contentinfo].legal.disclaimer.terms.footer-disclaimer.footer-bottom.cookie-consent, #cookie-consent, with footer text kept separately and tables and definition lists removed from prose text; wordCount = body text split on whitespace. Mega SEO Analyzer: pass >= 600, warn 300 to 599, fail < 300; strips script, style, nav, header, footer blocks; only words longer than one character count. SGE Readiness Audit: pass >= 1200, warn 600 to 1199 (thin for SGE), fail < 600 (insufficient); words from the main element text. Mega Batch: >= 800 words earns the E-E-A-T bucket weight 10 and 20 Voice points; excludes script, style, nav, header, footer, aside, noscript, form. Rendered DOM Paste Audit: pass >= 300, warn 100 to 299, fail < 100; words in main, article, role=main or body. Single Site Generator: at least 3 minutes of reading on pillar pages (about 675 words). - Why: Short pages rarely rank for competitive queries, pages under 300 words are treated as thin, and pages above 1,200 words are included in AI answers more often. - Fix: Expand key pages with substantive content: 600 words minimum for competitive queries, 800 or more for expertise pages, and 1,200 or more where you want AI answer inclusion. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [SGE Readiness Audit](https://jwatte.com/tools/sge-readiness-audit/), [Rendered DOM Paste Audit](https://jwatte.com/tools/rendered-dom-paste-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/) and 3 more. Standard: Google Helpful Content System self-assessment (developers.google.com/search/docs/fundamentals/creating-helpful-content). - [ ] **11.3 Thin page (`<n>` chars) and still indexable** - Pass: Body text is at least 1,500 characters, or the page is noindex, or its canonical points to a fuller page. - Fail: Body text is under 1,500 characters on a page that is indexable and canonical to itself. - Numbers and lists the tool uses: 1500 characters of body innerText; applies only when the page is indexable and has no canonical or a canonical whose path equals its own (Mega Analyzer). - Why: Thin pages that are still indexable dilute the site in search. - Fix: Expand the page to 1,500 or more characters, or add noindex,follow, or set the canonical to a fuller page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **11.4 GEO bucket: body text over 2000 characters with at least three H2** - Pass: Body text exceeds 2,000 characters and the page has three or more H2 headings. - Numbers and lists the tool uses: doc.body.textContent length > 2000; H2 count >= 3; weight 10 (Batch Analyzer). - Why: Long, sectioned content is easier for AI systems to read and quote. - Fix: Expand the copy and break it into sections with descriptive H2 headings. - Verify: [Batch Compare](https://jwatte.com/tools/batch-analyzer/). - [ ] **11.5 `<n>` paragraphs found** - Pass: The page has at least five paragraph elements. - Warn: Fewer than five paragraphs. - Numbers and lists the tool uses: 5 p elements (Analyzer); the Keyword Inspection rewrite prompt targets 40 to 150 words per paragraph so each paragraph is its own retrieval chunk. - Why: Well-structured content has several paragraphs with clear topics, each short enough to be quoted on its own. - Fix: Break the copy into five or more paragraphs of roughly 40 to 150 words each. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Keyword Inspection](https://jwatte.com/tools/keyword-inspection/). - [ ] **11.6 Dev-placeholder text detected in production (`<n>` locations)** - Pass: No placeholder text appears in the title, meta description, H1 or the first 4,000 body characters. - Numbers and lists the tool uses: patterns: gwapo, pogi, guapo, lorem ipsum, placeholder text, [enter X], TBD (case-sensitive), coming soon, under construction, sample text, your text here, tagline goes here; slots: title, meta description, H1, first 4000 body characters (Mega Analyzer). Monoclone Generator rule: realistic placeholder content for the niche, no lorem ipsum. - Why: Leftover developer text ships to production and shows up in search results, for example a meta description reading 'Case studies listing gwapo'. - Fix: Search the site for the patterns and replace every one with real copy before deploying. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Monoclone Gen.](https://jwatte.com/tools/monoclone-generator/). - [ ] **11.7 Font-glyph-collision typo suspected (`<n>` instances)** - Pass: No 'Al', 'A1', 'Il' or 'I1' tokens appear in the title, H1 or H2 text. - Numbers and lists the tool uses: regex /\b(?:A[l1]|I[l1])\b/g over title + H1 + H2 text (first 6000 characters); up to 3 examples shown (Mega Analyzer). - Why: In sans-serif fonts lowercase L and capital I look identical, so 'Al' reads as 'AI' to people but search engines see the wrong characters. - Fix: Check the token in DevTools and retype it as 'AI' where that was the intent. Learn more: /blog/blog-ai-mode-binding-bugs-validators-miss/. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **11.8 Potential duplicate content with `<path>`** - Pass: No sampled inner page shares more than 80 percent of its word set with the analyzed page. - Warn: A compared page exceeds 80 percent text similarity. - Numbers and lists the tool uses: fingerprint strips script, style, nav, header, footer, lowercases, keeps words longer than 3 characters, takes the first 200 of those words and deduplicates them into a set; main fingerprint needs >= 20 words; candidates are sitemap.xml loc values excluding the input and final URL (trailing slash ignored); 5 random pages; fetched HTML must be >= 200 characters; pages that redirect back to the analyzed page are skipped; Jaccard = intersection / union; threshold > 0.8 (Analyzer). Monoclone Generator rule: keep articles unique across sites by using relatedArticles to filter which articles show on which site. - Why: Near-identical pages compete with each other in search and split ranking signals. - Fix: Differentiate the copy on each page or point the duplicates at one canonical URL. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Monoclone Gen.](https://jwatte.com/tools/monoclone-generator/). - [ ] **11.9 Brand-name mentions on page: `<n>`** - Pass: The brand name appears at least five times in the page HTML. - Warn: Fewer than five mentions is thin brand presence. - Numbers and lists the tool uses: 5; brand stem = hostname with leading www. removed and the final .tld stripped, regex metacharacters escaped, matched case-insensitive and global (Mega SEO Analyzer). - Why: Pages that barely name the brand give search and AI systems little to connect the content to the business. - Fix: Mention the brand name in the page copy at least five times where it reads naturally. - Verify: [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). - [ ] **11.10 In title tag** - Pass: The target keyword appears in the page title. - Numbers and lists the tool uses: case-insensitive substring match of the entered keyword (lowercased, trimmed) against the title text; requires a keyword in the keyword field (Analyzer). - Why: The title tag is the first place search engines look for the topic of the page. - Fix: Add the target keyword to the title tag. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **11.11 In H1** - Pass: At least one H1 heading contains the target keyword. - Numbers and lists the tool uses: substring match across all H1 texts, case-insensitive; requires an entered keyword (Analyzer). - Why: The H1 tells readers and search engines what the page is about. - Fix: Add the keyword to the H1 heading. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **11.12 In H2 headings** - Pass: At least one H2 heading contains the target keyword. - Numbers and lists the tool uses: substring match across all H2 texts, case-insensitive; requires an entered keyword (Analyzer). - Why: Subheadings that repeat the topic help search engines confirm what each section covers. - Fix: Include the keyword in an H2 subheading. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **11.13 In meta description** - Pass: The meta description contains the target keyword. - Numbers and lists the tool uses: case-insensitive substring match; requires an entered keyword (Analyzer). - Why: A keyword in the meta description is bolded in search results and lifts click-through. - Fix: Add the keyword to the meta description. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **11.14 In URL** - Pass: The page URL contains the target keyword. - Numbers and lists the tool uses: case-insensitive substring match on the full URL string; requires an entered keyword (Analyzer). - Why: A descriptive slug is a small ranking signal and reads better in results. - Fix: Consider including the keyword in the URL slug. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **11.15 Density optimal (0.5-2.5%)** - Pass: Keyword density is between 0.5 and 2.5 percent of body words. - Fail: Below 0.5 percent is under-optimized; above 2.5 percent is over-optimized and risks a keyword-stuffing penalty. - Numbers and lists the tool uses: occurrences = whole-word regex new RegExp('\\b' + escaped keyword + '\\b', 'gi') over document.body.textContent lowercased; words split on /\s+/; density = (kwCount / totalWords) * 100 to two decimals; optimal band 0.5 to 2.5 percent; also renders Occurrences, Density and Total Words stats (Analyzer). - Why: Using the keyword too rarely leaves the topic unclear; using it too often looks like stuffing. - Fix: Use the keyword more naturally when under 0.5 percent and reduce it when over 2.5 percent. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **11.16 Flesch reading ease (target >= `<n>`)** - Pass: Flesch reading ease is at or above the floor for the page type: 60 for normal pages, 50 for landing pages, 35 for data-dominant pages. - Warn: On publication or application sites the row is informational; a score of 45 to 59 earns partial Voice points. - Fail: Below the floor; under 45 earns the minimum Voice points. - Numbers and lists the tool uses: flesch = 206.835 - 1.015 * (words / sentences) - 84.6 * (syllables / words); sentences split on /(?<=[.!?])\s+(?=[A-Z0-9])/ keeping sentences longer than 3 characters; syllables: words of 3 or fewer letters count 1, trailing (?:[^laeiouy]es|ed|[^laeiouy]e) and leading y stripped, then /[aeiouy]{1,2}/g groups counted (minimum 1); voice analysis runs on prose text (tables and definition lists removed) and returns null when text is under 50 characters. Floors: 60 default, 50 landing-page context, 35 data-dominant; landing-page context = LocalBusiness-family schema on the page, FAQPage schema, a tool or data gallery, or a data-dominant page; data-dominant = tables + dl >= 3 and >= 0.4 times the paragraph count; gallery pages are >= 8 links matching /\/tools?\/[a-z0-9\-]+\/?$/i or >= 8 matching /\/(states?|counties|metros?|zips?|cities)\/[a-z0-9\-]+\/?$/i; publication types NewsMediaOrganization, WebApplication, SoftwareApplication, Dataset, DataCatalog, Periodical downgrade the row to info. Voice score: >= 60 earns 20 points, >= 45 earns 12, else 5 (Mega Analyzer). Mega Batch: >= 60 adds 30 points, >= 45 adds 15, else 0; computed only when body text exceeds 200 characters. Single Site Generator and Site Migration Generator target: Flesch >= 60. Mega AI fix prompt target: >= 60. - Why: Lower scores mean denser prose that readers and AI systems find harder to quote. - Fix: Shorten sentences and use simpler words until the score clears the floor. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega Batch](https://jwatte.com/tools/mega-batch/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/), [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/). Standard: Flesch Reading Ease. - [ ] **11.17 Reading grade level (target 8-12)** - Pass: Flesch-Kincaid grade level is between 8 and 12. - Warn: On publication or application sites the row is informational; the stat tile shows ok up to grade 12 and good at 9 or below. - Fail: Outside 8 to 12; above 12 earns no Voice points. - Numbers and lists the tool uses: grade = 0.39 * (words / sentences) + 11.8 * (syllables / words) - 15.59; pass band 8 to 12; stat tile good <= 9, ok <= 12; Voice score: grade <= 9 earns 15 points, <= 12 earns 8 (Mega Analyzer). Mega Batch: grade <= 9 adds 25 points, <= 12 adds 10, above 12 adds 0. Single Site Generator, Site Migration Generator and Mega AI fix prompt target: grade 8 to 12. - Why: Copy pitched at a high-school reading level is understood by the widest audience and quoted more readily. - Fix: Lower the reading grade with shorter sentences and everyday words; do not go below grade 8 on expert topics. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega Batch](https://jwatte.com/tools/mega-batch/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/), [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/). Standard: Flesch-Kincaid Grade. - [ ] **11.18 Passive voice ratio (target <= 10%)** - Pass: No more than 10 percent of sentences are passive. - Warn: On publication or application sites the row is informational; 11 to 20 percent earns partial Voice points and shows ok on the stat tile. - Fail: Above 10 percent; above 20 percent earns no Voice points. - Numbers and lists the tool uses: PASSIVE_RE = /\b(?:am|is|are|was|were|be|been|being)\s+(?:\w+ly\s+)?(\w+ed|written|taken|seen|done|made|given|shown|known|held|told|found|built|grown|drawn|thrown|sent|lost|kept|left|set|put|cut|hit|run)\b/gi; passivePct = passive matches / sentences * 100; pass <= 10; stat tile ok <= 20; Voice score: <= 10 earns 15 points, <= 20 earns 8 (Mega Analyzer). Mega Batch: <= 10 adds 25 points, <= 20 adds 10, above 20 adds 0. Single Site Generator, Site Migration Generator and Mega AI fix prompt target: passive <= 10 percent. - Why: Active voice reads with more confidence and lifts retrieval confidence in AI answers. - Fix: Rewrite passive sentences in active voice with a clear subject doing the action. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega Batch](https://jwatte.com/tools/mega-batch/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/), [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/). - [ ] **11.19 Mean sentence length (target 12-22 words)** - Pass: Average sentence length is between 12 and 22 words. - Warn: On publication or application sites the row is informational. - Numbers and lists the tool uses: 12 to 22 words per sentence; sentences split on /(?<=[.!?])\s+(?=[A-Z0-9])/ keeping sentences longer than 3 characters (Mega Analyzer). - Why: Very short sentences read as choppy and very long ones lose the reader. - Fix: Split sentences over 22 words and combine fragments under 12 where they belong together. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **11.20 Sentence length variance (std dev 6-`<n>`)** - Pass: The standard deviation of sentence length is between 6 and 12 words, or between 6 and 18 on landing pages. - Warn: On publication or application sites the row is informational. - Numbers and lists the tool uses: std dev >= 6 and <= stdMax; stdMax = 18 on landing pages, else 12; Voice score awards 10 points when std dev is between 5 and 14 (Mega Analyzer). Single Site Generator, Site Migration Generator and Mega AI fix prompt target: std dev 6 to 12. - Why: Too little variation reads as monotonous and too much reads as chaotic. - Fix: Mix short and medium sentences deliberately instead of writing every sentence at the same length. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/), [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/). - [ ] **11.21 Hedge word density (target <= 3 per 1K words)** - Pass: Hedging words appear no more than 3 times per 1,000 words. - Fail: Above 3 per 1,000 words; above 6 earns no Voice points. - Numbers and lists the tool uses: HEDGES = /\b(?:very|really|quite|somewhat|rather|(?<!not\s)(?<!n['’]t\s)just|maybe|perhaps|probably|basically|actually|literally|honestly|arguably|essentially)\b/gi; per1k = count / (words / 1000); pass <= 3; Voice score: <= 3 earns 10 points, <= 6 earns 5; writing-framework score adds 20 points at <= 3 (Mega Analyzer). Single Site Generator target: hedge density <= 3 per 1000 words (basically, really, very, somewhat, arguably). Site Migration Generator target: hedge density <= 3 per 1000 words. Mega AI fix prompt target: <= 3 per 1K. - Why: Hedges dilute confident copy and reduce how often answer engines cite the page. - Fix: Cut hedges such as perhaps, basically and very, or replace them with a specific claim. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/), [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/). - [ ] **11.22 Marketing-jargon density (target <= 1 per 1K words)** - Pass: Marketing buzzwords appear no more than once per 1,000 words. - Warn: On long-form article pages the AI-citation panel warns when the rate exceeds 1 per 1,000 words. - Fail: Above 1 per 1,000 words on the Voice tab; above 3 earns no Voice points. - Numbers and lists the tool uses: JARGON = /\b(?:revolutionary|best-in-class|industry-leading|next-generation|world-class|cutting-edge|state-of-the-art|game-chang(?:er|ing)|disruptive|synerg(?:y|istic|ize)|paradigm shift|holistic|seamless(?:ly)?|robust|bespoke|turnkey|best-of-breed|unparalleled|premier)\b/gi; per1k = count / (words / 1000); pass <= 1; Voice score: <= 1 earns 10 points, <= 3 earns 5; writing-framework score adds 20 points at <= 1; the AI-citation warn row runs only on article pages with >= 800 words (Mega Analyzer). Mega AI fix prompt target: <= 1 per 1K. - Why: Buzzwords read as unspecific marketing copy and retrieval systems discount jargon-heavy pages. - Fix: Replace each buzzword with a concrete claim about what the product or service does; see /tools/ai-citation-specificity-audit/. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **11.23 Vague-claim density (target <= 1 per 1K words)** - Pass: Vague quantity phrases appear no more than once per 1,000 words. - Warn: On long-form article pages the AI-citation panel warns when the rate exceeds 1 per 1,000 words. - Fail: Above 1 per 1,000 words on the Voice tab; above 3 earns no Voice points. - Numbers and lists the tool uses: VAGUE = /\b(?:many (?:businesses|companies|organizations|customers|users|people)|most (?:businesses|companies|organizations)|several (?:businesses|companies|organizations)|a lot of|lots of|numerous|countless|a variety of|various|plenty of)\b/gi; per1k = count / (words / 1000); pass <= 1; Voice score: <= 1 earns 10 points, <= 3 earns 5; writing-framework score adds 20 points at <= 1; the AI-citation warn row runs only on article pages with >= 800 words (Mega Analyzer). Mega AI fix prompt target: <= 1 per 1K. - Why: Vague quantifiers signal unsupported claims and are the phrases answer engines skip. - Fix: Replace 'many businesses' style phrases with a real number and its source. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **11.24 CTA density (target 1-`<n>` per 1K words)** - Pass: Call-to-action verbs appear at least once per 1,000 words and no more than the ceiling for the page type: 5 on normal pages, 15 on landing pages, 30 on tool or data galleries. - Numbers and lists the tool uses: CTAS = /\b(?:buy|sign up|subscribe|register|download|get started|try|start|join|learn more|contact|book|schedule|apply|request|click|tap|call|order|shop|reserve|claim)\b/gi; per1k = count / (words / 1000); floor 1; ceiling 5 default, 15 landing page, 30 tool or data gallery (>= 8 links matching /\/tools?\/[a-z0-9\-]+\/?$/i or /\/(states?|counties|metros?|zips?|cities)\/[a-z0-9\-]+\/?$/i) (Mega Analyzer). Single Site Generator and Site Migration Generator target: at least 1 CTA per 500 words. - Why: Readers need an explicit next step, but conversion pages are CTA-dense by design so the ceiling widens for them. - Fix: Add a clear call to action near the top and the end of the page; trim repeated CTAs on prose pages. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/), [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/). - [ ] **11.25 Definition in the first 100 words (writing-framework signal)** - Pass: The first 100 words of the body contain a definition of the page topic. - Numbers and lists the tool uses: firstChunkHasDefinition checks the first 100 words; it is one of five 20-point signals in the writing-framework score (hedges <= 3 per 1K, jargon <= 1 per 1K, vague claims <= 1 per 1K, definitional opener, word count >= 600); score >= 80 green, >= 60 amber, below 60 red (Mega Analyzer). - Why: Opening with a plain definition gives readers and answer engines the quotable answer before the detail. - Fix: Start the body with one or two sentences that define the topic in plain words. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **11.26 Quantified claims** - Pass: The copy contains at least two numbers paired with real units such as customers, years in business, revenue or percentages. - Numbers and lists the tool uses: QUANTIFIED_RE /\b\d{2,}(?:,\d{3})*\+?\s*(?:customers|users|subscribers|clients|companies|cities|states|countries|projects|permits|installations|transactions|employees|team\s+members|years\s+(?:in\s+business|of\s+experience)|patients|students|downloads|deployments)\b|\$\d{1,3}(?:[.]\d{3})*[MBK]?\+?\s*(?:in|ARR|MRR|raised|revenue|saved|funding)|\b\d{1,2}(?:\.\d)?x\s+(?:faster|cheaper|more|better|growth)|\b\d{1,3}%\s+(?:faster|cheaper|smaller|of\s+)/i counted globally; pass at count >= 2 (Mega Analyzer). - Why: High-trust sites make specific, checkable claims instead of vague marketing copy. - Fix: Add at least two specific, verifiable numbers such as years in business, customers served or a measured result. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **11.27 `<n>` first-party-experience markers ("I tested", "we measured", etc.), HCU rewards demonstrated experience** - Pass: At least two distinct first-person experience patterns appear in the body (Mega SEO Analyzer), or first-person pronouns appear at least five times (E-E-A-T Analyzer). - Warn: Exactly one experience pattern (Mega SEO Analyzer), or one to four first-person pronouns (E-E-A-T Analyzer). - Fail: No experience pattern and no first-person pronoun at all. - Numbers and lists the tool uses: Mega SEO Analyzer patterns, each counted at most once: /\bI (tested|tried|measured|ran|built|wrote|saw|photographed|filmed)\b/i, /\bwhen I\b/i, /\bin my experience\b/i, /\bour team (tested|tried|measured|ran)\b/i, /\bwe (tested|tried|measured|ran|built)\b/i; pass >= 2, warn 1, fail 0. E-E-A-T Analyzer: /\b(i |my |we |our )/gi on lower-cased body text; pass >= 5, warn 1 to 4, fail 0. - Why: Google's helpful-content self-assessment asks whether the content clearly demonstrates first-hand experience. - Fix: Write in first person about what you tested, measured or built, and say what happened. - Verify: [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: Google Helpful Content self-assessment. - [ ] **11.28 `<n>` AI-boilerplate phrases detected, rewrite in concrete, named-tradeoff voice** - Pass: No AI-boilerplate phrase appears in the body. - Warn: One or two occurrences. - Fail: More than two occurrences. - Numbers and lists the tool uses: patterns /\bin today's fast-paced\b/i, /\bin the ever-evolving landscape\b/i, /\bnavigate the complexities\b/i, /\bdelve into\b/i, /\bin the realm of\b/i, /\bseamlessly integrate\b/i, /\bleverage (cutting-edge|state-of-the-art)\b/i, /\bunlock the (full )?potential\b/i, /\bharness the power\b/i, /\bplethora of\b/i, /\btestament to\b/i, /\bcornerstone of\b/i, /\bmultifaceted approach\b/i, /\bholistic (view|approach)\b/i, /\bparadigm shift\b/i; pass 0, warn 1 to 2, fail > 2 (Mega SEO Analyzer). - Why: These phrases are over-represented in pages demoted by Google's helpful-content updates. - Fix: Rewrite each flagged sentence in concrete language that names a real trade-off or fact. - Verify: [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). - [ ] **11.29 Ideal Customer Profile declared (industry + audience schema)** - Pass: The title, meta description, H1 or the first 3000 body characters name at least one target industry, or the JSON-LD declares an audience. - Warn: Neither an industry term nor audience schema is found. - Numbers and lists the tool uses: ICP_INDUSTRY = /\b(?:manufacturing|healthcare|legal|finance|accounting|retail|e-?commerce|saas|b2b|b2c|automotive|dealership|hospitality|restaurant|real estate|construction|agriculture|energy|utilities|insurance|pharmaceutical|biotech|government|nonprofit|education|logistics|aerospace|defense|consulting|law firm|medical practice|self-storage|property management|dental|veterinary|fitness|salon|spa)\b/gi on the lower-cased title, meta description, H1s and the first 3000 body characters, up to 5 distinct industries; audience schema when any JSON-LD block stringified matches /"audience"/i, /"Audience"/i or /"targetAudience"/i; severity warn; runs only on article pages: wordCount >= 800, looksLikeArticle (Article, BlogPosting or NewsArticle schema, or URL /\/blog\/|\/articles?\/|\/posts?\/|\/news\/|\/guides?\//, or >= 5 H2 with >= 1500 words and < 10 images) and not looksLikeLanding (path '/', or WebSite plus ItemList or CollectionPage, or >= 10 images with >= 3 H2) (Mega Analyzer). - Why: AI agents cannot route a query to your page unless it says who the page is for. - Fix: State 'for [industry] [size] in [geography]' in the copy and add schema.org/Audience; see /tools/ideal-customer-declaration-audit/. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org Audience. - [ ] **11.30 Audience-split navigation** - Pass: Two or more navigation links take the form 'For X' or 'I'm a X'. - Numbers and lists the tool uses: nav a, header a, [role="navigation"] a text matching /^(for\s+|i[' ]m\s+a|i\s+am\s+a)\s+\w+/i; pass at >= 2 matches (Mega Analyzer). - Why: Persona-based navigation makes clear who the product serves when the site speaks to distinct audiences. - Fix: Add 'For [audience]' navigation links when you serve more than one distinct audience. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **11.31 Human-in-the-loop / AI safety messaging** - Pass: The copy states that a human reviews or oversees AI output. - Numbers and lists the tool uses: /\b(human[- ]in[- ]the[- ]loop|human\s+review|nothing\s+(?:goes\s+out|ships)\s+without|human\s+oversight|reviewed\s+by\s+(?:a\s+)?human)\b/i (Mega Analyzer). - Why: Buyers of AI products want to know how humans check the output; the signal matters on AI product pages. - Fix: State plainly how humans review AI output before it reaches customers. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **11.32 Rich Image Content / Few Images / No Images Found** - Pass: The page has at least three images. - Warn: One or two images. - Fail: No images at all. - Numbers and lists the tool uses: img element count; pass >= 3, warn 1 to 2, fail 0 (E-E-A-T Analyzer). Keyword Inspection reports your img count next to the rounded competitor average with no threshold. - Why: Pages with no images usually lack the first-hand experience signals readers and raters look for. - Fix: Add original photos that show the work, the product or the place. - Verify: [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Keyword Inspection](https://jwatte.com/tools/keyword-inspection/). - [ ] **11.33 Video intro <embedded|absent>** - Pass: The page contains a video element or an embedded video from YouTube, Vimeo, Wistia or Loom. - Numbers and lists the tool uses: video element or /youtube\.com\/embed|vimeo\.com|wistia\.com|loom\.com/ in the HTML; absence is reported as info (About Page Conversion Audit). Keyword Inspection counts video, iframe[src*="youtube"] and iframe[src*="vimeo"] elements against the rounded competitor average with no threshold. - Why: A 30 to 60 second founder intro lifts About page conversion 10 to 20 percent. - Fix: Embed a 30 to 60 second intro video if you can produce one. - Verify: [About-Page Conversion Audit](https://jwatte.com/tools/about-page-conversion-audit/), [Keyword Inspection](https://jwatte.com/tools/keyword-inspection/). - [ ] **11.34 Has data tables** - Pass: The page contains at least one HTML table. - Numbers and lists the tool uses: table count > 0 (Keyword Inspection). - Why: Tables are a rich-content signal that competing pages often use. - Fix: Add a table where competitors use one and you do not, for example a comparison or pricing table. - Verify: [Keyword Inspection](https://jwatte.com/tools/keyword-inspection/). - [ ] **11.35 Has 3plus lists** - Pass: The page contains three or more ul or ol lists. - Numbers and lists the tool uses: ul + ol count >= 3 (Keyword Inspection). - Why: Lists are a rich-content signal that competing pages often use. - Fix: Add lists where competitors use them and you do not. - Verify: [Keyword Inspection](https://jwatte.com/tools/keyword-inspection/). - [ ] **11.36 Email capture detected** - Pass: The HTML contains an email input, newsletter, subscribe or signup marker. - Warn: No email capture detected. - Numbers and lists the tool uses: /type=.email.|newsletter|subscribe|signup/i on the HTML (Analyzer). - Why: An email signup is one of the highest-return elements on any page. - Fix: Add a newsletter signup or email capture form. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **11.37 Primary CTA detected <near top|not in upper page area>** - Pass: A button or call-to-action link exists in the main, hero or first section of the page. - Warn: No CTA in the upper page area. - Numbers and lists the tool uses: selector 'main button, main a.btn, main .cta.hero a.hero button, header+section a' (About Page Conversion Audit). - Why: About pages should route visitors to the next step such as booking a call or seeing case studies, not just tell a story. - Fix: Place a clear CTA at the bottom of the first screen: 'Book a call', 'Start trial' or 'See case studies'. - Verify: [About-Page Conversion Audit](https://jwatte.com/tools/about-page-conversion-audit/). - [ ] **11.38 Origin story / mission <present|missing>** - Pass: The page contains origin-story or mission language. - Warn: No origin story or mission language found. - Numbers and lists the tool uses: /my story|our story|why (i|we) started|it began|origin|founded to|mission/i (About Page Conversion Audit). - Why: Narrative builds affinity, and the specific reason you started lands better than a generic mission statement. - Fix: Add a two-paragraph origin story about the specific reason you started. - Verify: [About-Page Conversion Audit](https://jwatte.com/tools/about-page-conversion-audit/). - [ ] **11.39 Values / principles section <present|absent>** - Pass: The page contains a values or principles section. - Numbers and lists the tool uses: /our values|our principles|what we believe|we.{0,8}believe/i; absence is reported as info (About Page Conversion Audit). - Why: Optional, but a values section converts well for buyers who choose on shared principles. - Fix: Add a short values or principles section. - Verify: [About-Page Conversion Audit](https://jwatte.com/tools/about-page-conversion-audit/). - [ ] **11.40 Affiliate density `<n>`% of all links (`<n>` affiliate / `<n>` total), HCU-demoted pattern when paired with thin insight** - Pass: Fewer than three affiliate-tagged links on the page. - Warn: Three or more affiliate links, each of which needs original 'why this over the alternative' reasoning. - Fail: Five or more affiliate links that make up more than 25 percent of all links. - Numbers and lists the tool uses: Mega SEO Analyzer: affiliate patterns /amazon\.com[^"'<>\s]+tag=/gi and /href=["'][^"']*[?&](?:aff_id|affid|affiliate|ref_tag|partner_id|tag=|a_aid=|clickref=|tid=|referrer_id=)[^"']*["']/gi; link count /<a [^>]+href=/gi; pass < 3, warn >= 3, fail >= 5 with density > 0.25. Analyzer: presence only, /amzn\.to|amazon\.com.*tag=|cj\.com|awin|impact\.com/i, reported as info either way. - Why: High affiliate density without original insight is a classic pattern in pages demoted by Google's helpful-content updates. - Fix: Pair each affiliate link with your own reasoning on why this product over the alternative, and cut links that add nothing. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). - [ ] **11.41 Your homepage is a login wall (about `<n>` words, `<n>` link(s), an auth form, and no marketing page)** - Pass: The homepage is a public marketing page, not just an authentication form. - Fail: The homepage has an auth form, under 180 words, six or fewer links and no marketing links. - Numbers and lists the tool uses: hasAuthForm = a password input, or signup and login wording with a form; word count < 180; link count <= 6; marketingLinks = /\b(pricing|features?|how[ -]it[ -]works|use[ -]cases?|customers?|testimonials?|about(?:[ -]us)?|our story|blog|docs?|documentation|contact)\b/i; applies to the homepage only (Mega Analyzer). - Why: A login-only homepage gives search engines and AI nothing to index or cite, so the product is invisible. - Fix: Build a public landing surface (home, how it works, features, pricing, FAQ, about, contact) and keep the app behind /app. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **11.42 Keyword Gaps** - Pass: No single word or two-word phrase used in the headings of enough competitor pages is missing from your title, H1, H2 and H3 headings. - Fail: A term is used in the headings of at least max(2, ceil(0.3 x competitors)) competitor pages and is absent from your headings; it is listed as 'body only' when it exists in your body text and 'missing entirely' otherwise. - Numbers and lists the tool uses: competitorsUsing >= Math.max(2, Math.ceil(comps.length * 0.3)); up to 40 single words and 40 phrases, combined table capped at 60 rows with phrases first; priority HIGH when the share of competitors using the term is >= 0.6, MED >= 0.4, LOW otherwise; shared strengths = terms in the headings of at least ceil(0.5 x competitors) that you already use, up to 20; heading text = title + H1s + H2s + H3s; tokenizer: lowercase, replace /[^a-z0-9\s-]/g with a space, split on /\s+/, keep tokens 3 to 40 characters that are not purely digits and not in STOP; bigrams from adjacent tokens, skipped when either token is a stop word; STOP = a about above after again against all also am an and any are aren as at be because been before being below between both but by can cant cannot could couldnt did didnt do does doesnt doing dont down during each few for from further had hadnt has hasnt have havent having he her here hers herself him himself his how however i ie if in into is isnt it its itself just lets me more most mustnt my myself no nor not of off on once only or other ought our ours ourselves out over own same shant she should shouldnt so some such than that thats the their theirs them themselves then there theres these they this those through to too under until up very was wasnt we well were werent weve what whats when where which while who whos whom why will with wont would wouldnt you your yours yourself yourselves one two three four five six seven eight nine ten use used using get got like make made new best top good great many much way ways thing things need needs really right first (Keyword Inspection). - Why: Terms that most of the top-ranking pages share in their headings are the ones search engines treat as core to the query. - Fix: Weave every HIGH-priority gap term naturally into your H1, H2, H3 and body without stuffing, then work down to MED and LOW. - Verify: [Keyword Inspection](https://jwatte.com/tools/keyword-inspection/). - [ ] **11.43 Heading Topics Your Page Is Missing** - Pass: Every competitor heading topic is matched by at least one of your H2 or H3 headings. - Fail: A competitor H2 uses topic tokens absent from every one of your H2s (Keyword Inspection), or a competitor topic cluster has no heading of yours with Jaccard similarity of 0.45 or higher (Heading Gap Audit). - Numbers and lists the tool uses: Keyword Inspection: competitor H2 headings whose tokens include at least one token not in your H2 token set, deduped by lowercased text, up to 30 rows with up to 6 novel tokens each. Heading Gap Audit: competitor H2 and H3 headings are grouped into clusters (a heading joins the first cluster whose canonical heading has Jaccard >= 0.5 with it, else starts a new cluster); headings normalized to lowercase with /[^a-z0-9 ]+/g replaced by a space; similarity is Jaccard over tokens longer than 2 characters; a cluster is covered when any of your headings has Jaccard >= 0.45 with its canonical heading; coverage percent = covered / clusters x 100 (100 when no clusters); the fix prompt lists the first 20 missing clusters and prioritizes those with >= 50 percent competitor coverage; up to 5 competitors. - Why: Subtopics the ranking pages all cover and you do not are the cheapest sections to add. - Fix: Add a new H2 with a one-paragraph, answer-shaped body for each missing topic that at least half the competitors cover; combine three or four related gaps into one deeper section where they overlap. - Verify: [Keyword Inspection](https://jwatte.com/tools/keyword-inspection/), [Heading Gap Audit](https://jwatte.com/tools/heading-gap-audit/). - [ ] **11.44 Unique to you** - Pass: No heading on your page sits outside every competitor topic cluster. - Warn: One of your H2 or H3 headings matches no competitor topic cluster; review it for differentiation versus tangent. - Numbers and lists the tool uses: uniqueMine = your headings where no cluster canonical has Jaccard >= 0.45; the fix prompt lists the first 10 (Heading Gap Audit). - Why: Unique topics are either genuine differentiation worth keeping or tangents that dilute the page. - Fix: Keep unique sections that serve the query and prune the ones that do not. - Verify: [Heading Gap Audit](https://jwatte.com/tools/heading-gap-audit/). - [ ] **11.45 `<n>` top-ranking phrases are completely missing from your page** - Pass: No term that several top-ranking pages use with meaningful weight is absent from your page. - Warn: One to ten missing terms, or any term you use at a lower rate than the competitor average. - Fail: More than ten missing terms. - Numbers and lists the tool uses: tokenizer /[a-z][a-z'-]{2,24}/g on lowercased text, length >= 3, not purely digits, not in STOPWORDS; bigrams from adjacent non-stopword tokens; tf = count / total tokens; idf = ln((N + 1) / (df + 1)) + 1 over competitor docs plus yours; tfidf = tfAvg x idf; a term counts only when >= 2 competitor docs contain it; missing = tfMy === 0, sorted by tfidf, top 25; thin = tfMy > 0 and tfAvg - tfMy > 0.002, top 15; your edge = tfMy > tfAvg, top 10; competitor pages come from the top DuckDuckGo results for the query, 3 to 10 documents (default 8), excluding your own host, text from main, article or [role="main"] else body with script, style, nav, footer, header, aside, noscript, iframe, svg, form removed, pages need > 200 characters; STOPWORDS = a, about, above, after, again, against, all, am, an, and, any, are, aren, as, at, be, because, been, before, being, below, between, both, but, by, can, cannot, could, couldn, did, didn, do, does, doesn, doing, don, down, during, each, few, for, from, further, had, hadn, has, hasn, have, haven, having, he, her, here, hers, herself, him, himself, his, how, i, if, in, into, is, isn, it, its, itself, just, me, might, more, most, must, my, myself, need, no, nor, not, now, of, off, on, once, only, or, other, ought, our, ours, ourselves, out, over, own, same, shall, shan, she, should, shouldn, so, some, such, than, that, the, their, theirs, them, themselves, then, there, these, they, this, those, through, to, too, under, until, up, very, was, wasn, we, were, weren, what, when, where, which, while, who, whom, why, will, with, won, would, wouldn, you, your, yours, yourself, yourselves, also, however, therefore, thus, hence, moreover, indeed, rather, perhaps, quite, even, still, yet, well, okay, get, got, getting, make, makes, making, made, one, two, three, four, five, many, much, like, likes, liked, liking, see, sees, seen, saw, want, wants, wanting, wanted, use, uses, used, using (Content Gap TF-IDF). - Why: The vocabulary gap between your page and the top-ranking set is the strongest predictor of which pages gain rank after publication. - Fix: Judge each missing phrase for relevance, drop boilerplate, weave the remaining 15 to 20 terms in naturally, add H2 or H3 sections for the topics they imply, and expand the sections behind thin terms. - Verify: [Content Gap TF-IDF Analyzer](https://jwatte.com/tools/content-gap-tfidf/). - [ ] **11.46 Word Count vs Avg** - Pass: Your body word count meets or exceeds the competitor average. - Warn: Shorter than the average by up to 500 words (Keyword Inspection), or between 70 and 100 percent of the average meaningful-token count (Content Gap TF-IDF). - Fail: Shorter than the average by more than 500 words (Keyword Inspection), or under 70 percent of the competitor average token count (Content Gap TF-IDF). - Numbers and lists the tool uses: Keyword Inspection: body text = body with script, style, nav, header, footer, aside, noscript, form removed; wordCount = split(/\s+/).length; avgWc = round(sum of competitor word counts / competitors), minimum and maximum also shown; depthGap = avgWc - yours; pass <= 0, warn 1 to 500, fail > 500; rewrite target ~max(avgWc, yours) words. Content Gap TF-IDF: avgWords = mean of post-stopword unigram token counts across parsed competitor pages; your count = your unigram plus bigram token count; ABOVE at >= 100 percent, within range at >= 70 percent, BELOW under 70 percent; emitted as an info finding, not scored. - Why: Ranking pages tend to be longer; the comparison shows how far you are from the average, minimum and maximum competitor length. - Fix: Extend the page toward the competitor average with genuine, relevant content, closing at least half the gap without padding. - Verify: [Keyword Inspection](https://jwatte.com/tools/keyword-inspection/), [Content Gap TF-IDF Analyzer](https://jwatte.com/tools/content-gap-tfidf/). - [ ] **11.47 Your domain present** - Pass: Your domain appears among the URLs extracted from the Bing results page for the query, shown as rank #n (SERP Feature Opportunity Matrix), or among the top 30 hostnames in the pasted Google SERP (SERP Features). - Fail: Not found in any URL extracted from the Bing results page (labelled 'not in top 10'), or absent from the top 30 hostnames, which the strategy prompt calls the first problem to solve. - Numbers and lists the tool uses: SERP Feature Opportunity Matrix: domain lowercased with https?:// stripped and only the first path segment kept; result URLs from a.result__url, a.result__a and a[href] in the Bing search HTML (https://www.bing.com/search?q=) with the uddg redirect parameter decoded and only http(s) kept; youRank = index of the first extracted URL whose hostname minus leading www. equals the domain, searched over the whole extracted list (only the first 10 URLs are stored, the rank search is not limited to them); rank shown as #index+1, otherwise 'not in top 10'; up to 6 queries. SERP Features: hostnames from /\/url\?(?:q|esrc)=(https?:\/\/[^&"<\s]+)/ig and /href="(https?:\/\/[^"]+)"/ig, leading www. stripped, excluding /^(google\.|googleusercontent|gstatic|googleadservices|googletag|doubleclick|youtube-nocookie|schema\.org|w3\.org|policies\.google|support\.google|accounts\.google|translate\.google|lens\.google|news\.google|maps\.google|docs\.google)/i, ranked by count, top 30 shown with your domain highlighted gold and tracked competitors blue; your domain normalized (trim, lowercase, strip scheme, www., path and trailing commas or whitespace); only evaluated when a domain is entered. - Why: If you do not appear in the results at all, no SERP feature is winnable until the page ranks. - Fix: Get the page into the top 10 organic results for the query before targeting its SERP features; the strategy prompt names the weakest competitor to displace in 90 days. - Verify: [SERP Feature Opportunity Matrix](https://jwatte.com/tools/serp-feature-opportunity-matrix/), [SERP Features](https://jwatte.com/tools/serp-features/). - [ ] **11.48 `<n>` competitor feature gap(s)** - Pass: You appear next to every SERP feature your tracked competitors appear next to. - Numbers and lists the tool uses: competitors split on /[\n,]+/, normalized, up to 10; window of 4000 characters on each side of every hostname match (regex '(?:www\.)?' + host with dots escaped, flags gi); feature presence tested with the 14 SERP feature signatures inside the window; gaps = union of competitor-adjacent features minus your adjacent features; only evaluated when your domain is entered; quick-fill presets: seo = ahrefs.com, semrush.com, moz.com, searchengineland.com, searchenginejournal.com; finance = nerdwallet.com, bankrate.com, investopedia.com, thepennyhoarder.com, smartasset.com; realestate = zillow.com, redfin.com, realtor.com, trulia.com, movoto.com; ecommerce = amazon.com, etsy.com, walmart.com, target.com, ebay.com; creator = substack.com, medium.com, linkedin.com, ghost.org, beehiiv.com (SERP Features). - Why: Sitting next to a feature is not proof of owning it, but it is a strong signal that a competitor holds the featured snippet, AI Overview citation or PAA answer you do not. - Fix: For each feature a competitor owns and you do not, write a one-paragraph content brief (title, H2 outline, word count, schema, CTA) and build it. - Verify: [SERP Features](https://jwatte.com/tools/serp-features/). - [ ] **11.49 Google Analytics detected** - Pass: GA4 or gtag markers appear in the HTML. - Warn: No Google Analytics detected. - Numbers and lists the tool uses: /gtag|GA4|G-[A-Z0-9]+|google-analytics|googletagmanager/i (Analyzer). - Why: GA4 is free and shows which pages and traffic sources actually work. - Fix: Add gtag.js: `<script async src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXXXXX">``</script>` plus gtag('config','G-XXXXXXXXXX'). - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **11.50 Behavior analytics detected** - Pass: Microsoft Clarity or Hotjar markers appear in the HTML. - Numbers and lists the tool uses: /clarity\.ms|clarity/i; /hotjar/i; absence is reported as info (Analyzer). - Why: Clarity (free) or Hotjar give heatmaps and session recordings that show where visitors get stuck. - Fix: Add Microsoft Clarity or Hotjar if you want behavior recordings. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **11.51 Payment/commerce integration detected** - Pass: A payment or commerce marker appears in the HTML. - Numbers and lists the tool uses: /stripe|paypal|gumroad|lemonsqueezy|shopify|woocommerce|buy.*button|add.*cart/i; absence is reported as info (Analyzer). - Why: If you sell products or services, a payment integration lets visitors buy without leaving the site. - Fix: Add a payment integration such as Stripe, Gumroad or Lemon Squeezy if you sell online. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **11.52 AdSense detected** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: /pagead|adsense|ca-pub/i; both presence and absence are reported as info (Analyzer). - Why: Display advertising is one of the revenue streams the tool checks for. - Fix: No action required; add display ads only if they fit your revenue model. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **11.53 AI-content disclosure marker detected, transparency signal for high-AI-content pages** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: /ai-?generated|written with (the help of |assistance of )?(AI|chatgpt|claude|gemini)|aiGenerated|"aiSource"/i (Mega SEO Analyzer). - Why: Disclosing AI-generated content is a transparency signal Google encourages but does not require. - Fix: No fix required; disclose AI assistance where it is material. - Verify: [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). - [ ] **11.54 Average external links** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: for each a[href]: new URL(a.href, pageUrl).hostname differs from the page hostname and the protocol matches /^https?:$/; competitor value = round(sum / competitors); no threshold (Keyword Inspection). - Why: Links to authoritative outside sources are compared as a content-quality signal. - Fix: Add citations to authoritative outside sources where competitors link out and you do not. - Verify: [Keyword Inspection](https://jwatte.com/tools/keyword-inspection/). - [ ] **11.55 `<funnel>` `<intent>` intent** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: nav = /\blogin\b|\bsign[- ]in\b|\bcontact\b|\bhomepage\b|\bwebsite\b/ or /^\s*[a-z][a-z0-9._-]{2,}\s*$/; trans = /\b(buy|price|pricing|cost|cheap|discount|coupon|promo|deal|near me|order|book|subscribe|download|free trial|sign up|checkout|demo)\b/; commercial = /\b(vs\.?|versus|compare|comparison|review(s)?|best|top|cheapest|alternative|alternatives)\b/; info = /^\s*(what|how|why|when|where|who|which|is|can|does|do|are|should|will)\b/ or /\b(guide|tutorial|example|explain(ed|ing)?|definition|meaning|learn)\b/; precedence: trans = Transactional, else commercial = Commercial Investigation, else info = Informational, else nav = Navigational, else Informational; funnel: Transactional = BOFU, Commercial Investigation = MOFU, otherwise TOFU (Keyword Inspection). - Why: Top-of-funnel searchers want depth and definitions, mid-funnel searchers want comparisons, and bottom-of-funnel searchers want pricing, features and a way to act. - Fix: Match the page to the stage: BOFU pages lead with pricing, features, CTAs and trust signals; MOFU pages lead with side-by-side tables, pros and cons and alternatives; TOFU pages lead with definitions, mechanism, examples and FAQ and save conversion CTAs for the end. - Verify: [Keyword Inspection](https://jwatte.com/tools/keyword-inspection/). - [ ] **11.56 Word count Δ** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: wd = to.words - from.words between two snapshots of the same URL; green when > 0, red when < 0, grey when 0; each snapshot records title, meta description, H1s, H2s, body word count (script, style, nav, header, footer, aside, noscript, form removed), distinct JSON-LD @type values, publish date (article:published_time, else meta name=date, else time[datetime]) and modified date (article:modified_time), stored under localStorage key 'cvm-history-v1' (Content Velocity). - Why: Word-count deltas between snapshots show when a page was expanded or trimmed. - Fix: Snapshot key pages on a schedule and review what changed in word count, headings, schema and dates. - Verify: [Content Velocity](https://jwatte.com/tools/content-velocity/). - [ ] **11.57 Features detected** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: SERP Features: presentCount out of 14 signatures in the pasted Google SERP; 8 or more features = feature-heavy where blue-link click-through drops sharply; 3 or fewer favors a link-click strategy; approximate organic results = distinct cite elements matching /^https?:|^[a-z0-9-]+\.[a-z]{2,}/i. SERP Feature Opportunity Matrix: up to 6 queries; a feature is green when it fires on at least half the queries, amber when on some, 'none' when on zero; features firing on ceil(queries / 2) or more are listed as opportunities to fix first. - Why: A feature-heavy results page leaves little room for classic links, but it is exactly where AI and GEO visibility is won. - Fix: Fix the features that fire on half or more of your target queries first; try question-shaped queries for PAA, product queries for Shopping and local queries for the Local Pack. - Verify: [SERP Features](https://jwatte.com/tools/serp-features/), [SERP Feature Opportunity Matrix](https://jwatte.com/tools/serp-feature-opportunity-matrix/). - [ ] **11.58 Featured Snippet** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: SERP Feature Opportunity Matrix (Bing preferred, DuckDuckGo fallback): /class="[^"]*b_snippet|class="[^"]*kp-wholepage|result--snippet|zCubwf|xpd/i. SERP Features (pasted Google HTML): /class="[^"]*\b(?:V3FYCf|g mnr-c|xpdopen|kno-rdesc)\b|data-md="0\b"|"featuredSnippet"|aria-level="2"[^>]*>Featured snippet/i. - Why: The position-zero box appears for the query, so a concise answer can win it. - Fix: Write a 40 to 60 word answer paragraph directly below the question H2, use list or table formatting when it fits, and add FAQPage, HowTo or Article schema with a speakable selector. - Verify: [SERP Feature Opportunity Matrix](https://jwatte.com/tools/serp-feature-opportunity-matrix/), [SERP Features](https://jwatte.com/tools/serp-features/). - [ ] **11.59 People Also Ask** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: /people also ask|related-questions-pair|\bPAA\b/i on the SERP HTML (SERP Feature Opportunity Matrix). - Why: The query triggers a People Also Ask box, so question-shaped headings can earn a slot. - Fix: Use H2 question headings that match real searches, answer in the first paragraph below each, and add FAQPage schema with 3 to 8 questions. - Verify: [SERP Feature Opportunity Matrix](https://jwatte.com/tools/serp-feature-opportunity-matrix/). - [ ] **11.60 Knowledge Panel** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: /class="[^"]*knowledge-panel|kp-header|b_ans/i on the SERP HTML (SERP Feature Opportunity Matrix). - Why: The query shows a knowledge panel, which entity schema and linked profiles can claim. - Fix: Publish Organization schema with a sameAs array to Wikipedia, Wikidata, LinkedIn and Crunchbase, and full identity on Organization, Person, Place or Event schema. - Verify: [SERP Feature Opportunity Matrix](https://jwatte.com/tools/serp-feature-opportunity-matrix/). - [ ] **11.61 Video Carousel** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: SERP Feature Opportunity Matrix: /video-carousel|VideoObject|thumbnail-div|class="[^"]*b_videoCluster/i. SERP Features: /class="[^"]*\bRzdJxc\b|"videoCarousel"|aria-label="Videos"/i. - Why: Google prefers video answers for the query, and a matching video tends to take half the attention. - Fix: Embed a YouTube video with a clear title, description and chapter markers on your own channel, and add VideoObject schema with thumbnailUrl, uploadDate, duration, description and contentUrl. - Verify: [SERP Feature Opportunity Matrix](https://jwatte.com/tools/serp-feature-opportunity-matrix/), [SERP Features](https://jwatte.com/tools/serp-features/). - [ ] **11.62 Image Pack** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: SERP Feature Opportunity Matrix: /class="[^"]*image-pack|isv-r|b_imgTbl|imagepack/i. SERP Features: /class="[^"]*\bezO2md\b|"imageResultGroup"|aria-label="Images"/i. - Why: The query returns an image-heavy results page. - Fix: Publish original images of 1,200px or more with descriptive alt text and file names next to a matching heading, add ImageObject schema and an image sitemap. - Verify: [SERP Feature Opportunity Matrix](https://jwatte.com/tools/serp-feature-opportunity-matrix/), [SERP Features](https://jwatte.com/tools/serp-features/). - [ ] **11.63 Local Pack** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: /class="[^"]*local-pack|maps-search-result|b_localPoi|local-results/i on the SERP HTML (SERP Feature Opportunity Matrix). - Why: The query shows a map pack, which a complete business profile and local schema can enter. - Fix: Claim and complete the Google Business Profile with regular posts and photos, and add LocalBusiness schema with address, telephone, openingHours and geo. - Verify: [SERP Feature Opportunity Matrix](https://jwatte.com/tools/serp-feature-opportunity-matrix/). - [ ] **11.64 Top Stories** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: SERP Feature Opportunity Matrix: /top-stories|topStories|class="[^"]*newsvertical|b_newsDisplay/i. SERP Features: /aria-label="Top stories"|data-hveid="CAA?QAA"|"topStoriesCarousel"/i. - Why: The query is treated as news, and only Google News publishers with NewsArticle markup appear in the box. - Fix: Register in Google News Publisher Center, publish daily, and use NewsArticle schema with datePublished, author and image. - Verify: [SERP Feature Opportunity Matrix](https://jwatte.com/tools/serp-feature-opportunity-matrix/), [SERP Features](https://jwatte.com/tools/serp-features/). Standard: schema.org NewsArticle. - [ ] **11.65 Shopping** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: SERP Feature Opportunity Matrix: /class="[^"]*shopping|product-carousel|sh-pr|b_commerceAds/i. SERP Features: /aria-label="(?:Shopping|Products?)"|"shoppingRelatedResults"|"productResultsGroup"/i. - Why: The query is commercial and shows product listings. - Fix: Set up a Google Merchant Center feed and Product schema with offers, price, availability, shippingDetails and hasMerchantReturnPolicy. - Verify: [SERP Feature Opportunity Matrix](https://jwatte.com/tools/serp-feature-opportunity-matrix/), [SERP Features](https://jwatte.com/tools/serp-features/). Standard: schema.org Product. - [ ] **11.66 Sitelinks** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: /sitelinks|b_jotop|sub-links|class="[^"]*site-link-container/i on the SERP HTML (SERP Feature Opportunity Matrix). - Why: Sitelinks appear for brands with a clear structure and strong brand signal. - Fix: Build a strong brand signal, clear site architecture and well-named internal pages, with BreadcrumbList and WebSite schema carrying a SearchAction. - Verify: [SERP Feature Opportunity Matrix](https://jwatte.com/tools/serp-feature-opportunity-matrix/). - [ ] **11.67 Twitter/X Carousel** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: SERP Feature Opportunity Matrix: /twitter-carousel|b_social|tweet-result|g-section-with-header/i. SERP Features: /aria-label="(?:Tweets|Posts)"|"twitterCarousel"/i. - Why: The query shows a social freshness carousel that an active account can fill. - Fix: Keep an active official X account matching the brand name, link it with rel=me and list it in Organization sameAs. - Verify: [SERP Feature Opportunity Matrix](https://jwatte.com/tools/serp-feature-opportunity-matrix/), [SERP Features](https://jwatte.com/tools/serp-features/). - [ ] **11.68 Podcasts** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: /podcast-badge|class="[^"]*podcasts/i on the SERP HTML (SERP Feature Opportunity Matrix). - Why: The query surfaces podcast results. - Fix: Submit the show to Apple Podcasts, Spotify and Google Podcasts, publish an RSS feed, and add PodcastSeries and PodcastEpisode schema. - Verify: [SERP Feature Opportunity Matrix](https://jwatte.com/tools/serp-feature-opportunity-matrix/). - [ ] **11.69 Recipes** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: /recipe-card|class="[^"]*recipe-result/i on the SERP HTML (SERP Feature Opportunity Matrix). - Why: The query returns recipe cards. - Fix: Publish a recipe card with ingredients, instructions, nutrition and rating, and add Recipe schema with recipeIngredient, recipeInstructions, nutrition and aggregateRating. - Verify: [SERP Feature Opportunity Matrix](https://jwatte.com/tools/serp-feature-opportunity-matrix/). - [ ] **11.70 AI Overview / Search Generative Experience** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: /data-sgrd=|data-async-context="query.+?aiOverview|aria-label="AI Overview"|"xpdOpen":true.*?hveid.*?"SGE"|data-md="AIOverview"|"sge_overview"|"aiOverview":\{/i on the pasted Google SERP HTML (SERP Features). - Why: An AI summary at the top of the results cuts traditional click-through 30 to 60 percent on queries where it fires. - Fix: Write clear factual claims, dense named entities, direct question-and-answer prose, structured data, a dateModified stamp, citation markup and llms.txt so the page is cited as a source. - Verify: [SERP Features](https://jwatte.com/tools/serp-features/). - [ ] **11.71 Things to know / Refine** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: /"thingsToKnow"|aria-label="Things to know"|"refineQueryList"/i on the pasted Google SERP HTML (SERP Features). - Why: Google surfaces multiple subtopics for explorer-style queries. - Fix: Cover the breadth of subtopics rather than going deep on one. - Verify: [SERP Features](https://jwatte.com/tools/serp-features/). - [ ] **11.72 Related searches** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: /Related searches|class="[^"]*\bK6fYtd\b|"relatedSearches"/i on the pasted Google SERP HTML (SERP Features). - Why: Bottom-of-page query expansions show what else searchers want. - Fix: Use the related searches as candidate H2 topics and related pages to build. - Verify: [SERP Features](https://jwatte.com/tools/serp-features/). - [ ] **11.73 Discussions and forums** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: /aria-label="Discussions and forums"|"discussionsAndForums"/i on the pasted Google SERP HTML (SERP Features). - Why: Google increasingly favors community discussion for these terms. - Fix: No remedy in the tool; the signal shows the query favors forum-style content. - Verify: [SERP Features](https://jwatte.com/tools/serp-features/). - [ ] **11.74 Business vertical detected** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: Order of evaluation: schema types first, then title, meta description and the first 5000 body characters; a schema match returns immediately; keyword-only YMYL-Health, YMYL-Legal and YMYL-Finance matches on editorial or tool sites (Blog, NewsArticle, BlogPosting, Article, Newsletter, TechArticle, ScholarlyArticle, Periodical, SoftwareApplication, WebApplication, NewsMediaOrganization, Dataset, DataCatalog, or a CollectionPage, ItemList or SearchResultsPage type with >= 3 schema types) need >= 5 keyword hits; restaurant keyword-only needs >= 3 hits; a keyword-derived YMYL, Local or E-commerce vertical is reset to SaaS-B2B or General when the schema declares NewsMediaOrganization, WebApplication, SoftwareApplication, Dataset, DataCatalog, Periodical, or ProfilePage plus Person, with no business-vertical schema present. Specialty sections scan the first 8000 (legal, CPA), 12000 (defense, home inspection, aviation, RIA), 14000 (homebuilder, restaurant), 16000 (laundromat, self-storage, car wash, e-commerce, butcher, HVAC, electrician, handyman) or 18000 (men's health clinic, B2B SaaS, hotel) body characters. Legal, CPA, defense, homebuilder, home inspection, aviation, RIA, laundromat, self-storage, car wash, handyman and men's health clinic fire when strong signals >= 2, or strong >= 1 and support >= 2; restaurant fires on a Restaurant-class schema type or strong >= 2; e-commerce on Product plus Offer schema or the same strong/support rule; butcher on >= 2 meat signals plus a commerce signal and not restaurant-only; HVAC and electrician on the trade schema type plus a trade keyword, or strong >= 2, or a trade title plus support >= 2, or a trade phrase plus >= 2 detected services; B2B SaaS on strong >= 2, or strong >= 1 and support >= 3, or a SoftwareApplication type plus support >= 2; hotel on a lodging schema type, or strong >= 2, or lodging plus booking keywords plus night, rate or stay in the body. Later sections stand down when an earlier one matched. Selectable verticals: General, E-commerce, SaaS-B2B, Local-Service, YMYL-Health, YMYL-Health-Dental, YMYL-Health-MentalHealth, YMYL-Health-Chiropractic, YMYL-Health-Optometry, YMYL-Health-Podiatry, YMYL-Health-MensClinic, YMYL-Legal, YMYL-Finance, YMYL-Finance-CPA, YMYL-Finance-RIA, Local-Restaurant, Local-RealEstate, Local-Storage, Local-SpecialtyInstaller, Local-Trades, Local-HVAC, Local-Electrician, Local-Handyman, Local-Homebuilder, Local-HomeInspection, Local-EventVenue, Local-Hospitality, Local-Fitness, Local-BeautyWellness, Local-Auto, Local-CarWash, Local-Laundromat, Local-OutdoorGuide, Local-Photography, Local-Pharmacy, Local-PetVet, Local-EducationInstitutional, Local-Education, Local-Cultural, Local-FuneralService, Local-Florist, Local-Childcare, Local-Tax, Local-CreativeServices, Local-Audiology, Local-PoolService, Local-EscapeGame, Local-TobaccoCigar, Local-CraftServices, Local-Retail, Local-ButcherDTC, Local-Religious, Local-Nonprofit, Local-Industrial, Local-SeniorCare, B2B-DefenseContractor, B2B-AviationLessor, B2B-Services-CX-BPO, YMYL-Insurance, B2B-FoodProcessor; the user override is stored per host under localStorage key jw-vertical-override:`<host>` (Mega Analyzer). The full per-vertical keyword and schema regex lists live in the tool source. - Why: The detected vertical decides which industry-specific checks, trust signals and fix prompts apply, so a wrong guess produces wrong advice. - Fix: Declare the specific schema.org business subtype so classification is driven by your markup rather than keywords, and pick the correct vertical in the Audit alignment bar when detection is wrong. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **11.75 README.md: Disclaimers** - Pass: Affiliate, sponsored or AI-generated content carries the required FTC disclosure, and traffic beyond host free tiers is budgeted. - Numbers and lists the tool uses: FTC 16 CFR Part 255; free-tier limits are per site (Netlify) or per project (other hosts); identity graph via ORCID, Amazon Author, Goodreads and LinkedIn rather than Wikidata. - Why: Cross-promoting sponsored content, affiliate offers or AI-generated text without disclosure breaks FTC rules, platform policies and consumer-protection law. - Fix: Add affiliate disclosures where required and budget for traffic that exceeds free tiers. - Verify: [Monoclone Gen.](https://jwatte.com/tools/monoclone-generator/). Standard: FTC 16 CFR Part 255. ## 12. Hosting, deployment and moving a site Where the files live decides several checks before you write a line. HTTPS on your own domain, cache headers that do not freeze a stale page, an uptime check that tells you before a customer does, and the rules for moving a site without losing what it had earned. **Verify this section with:** [Uptime + Response-Time Diagnostic](https://jwatte.com/tools/uptime-check/), [Site Analyzer](https://jwatte.com/tools/analyzer/), [SGE Readiness Audit](https://jwatte.com/tools/sge-readiness-audit/), [Mega Batch](https://jwatte.com/tools/mega-batch/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/), [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/), [Security Headers](https://jwatte.com/tools/security-headers-audit/), [AI Bot Policy Generator](https://jwatte.com/tools/ai-bot-policy-gen/), [Image Alt Audit](https://jwatte.com/tools/image-alt-audit/), [Migration Analyzer](https://jwatte.com/tools/migration-analyzer/), [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/), [Monoclone Gen.](https://jwatte.com/tools/monoclone-generator/), [DIY Uptime Alert Generator](https://jwatte.com/tools/diy-uptime-alert-generator/), [DNS Records Gen.](https://jwatte.com/tools/dns-records-generator/), [Platform Audit](https://jwatte.com/tools/platform-audit/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). - [ ] **12.1 HTTP status `<n>`** - Pass: The URL returns a 200 to 299 status. - Fail: The URL returns 400 to 499 (404 not found, 403 forbidden, 401 authentication required), 500 or higher, or cannot be reached; 300 to 399 renders info with the final URL. - Numbers and lists the tool uses: status buckets 200 to 299, 300 to 399, 400 to 499, 500 and above; special-cased 401, 403, 404. - Why: This is what a visitor sees right now, and a 5xx or no connection means the site is down for everyone. - Fix: For a persistent 5xx contact your host; for no connection check DNS and firewall rules. - Verify: [Uptime + Response-Time Diagnostic](https://jwatte.com/tools/uptime-check/). - [ ] **12.2 HTTPS enabled** - Pass: The page URL uses https:// and plain http:// requests redirect to the https:// version. - Fail: The https:// address does not answer at all (connection failure or 502) even though http:// does, or the URL is served over plain http. - Numbers and lists the tool uses: URL starts with https (Analyzer url.startsWith('https'); SGE Readiness Audit /^https:/i; Mega Batch isHttps); http:// must redirect to https:// at the hosting layer (Single Site Gen); Mega Analyzer treats a status of 0 or 502 on the https:// address of a bare domain as HTTPS unavailable and reports the http:// copy instead, while real 4xx or 5xx responses are reported as they are. - Why: HTTPS is a baseline trust signal for browsers, Google and AI answer engines, and non-secure pages are deprioritized by every AI answer system. - Fix: Turn on Force HTTPS in the hosting dashboard (Netlify, Vercel and Cloudflare offer one-click certificates) and redirect http to https. Netlify example: netlify.toml [[headers]] for = "/*" Strict-Transport-Security = "max-age=63072000; includeSubDomains; preload". - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [SGE Readiness Audit](https://jwatte.com/tools/sge-readiness-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega Batch](https://jwatte.com/tools/mega-batch/) and 1 more. - [ ] **12.3 `<n>`-hop redirect chain (`<label>`)** - Pass: Each tested variant (http://, the other www form, and /index.html) reaches the final page with no redirect or a single 301 to 308 redirect. - Warn: A variant takes more than one redirect hop before reaching the final page. - Numbers and lists the tool uses: Variants: http:// when the URL is https://, the non-www host when the hostname starts with www. (else the www host), /index.html when the path is /; redirect statuses 301 to 308; pass when the chain is 2 hops with a first status of 301 to 308 (label 'Single redirect for `<label>`') or 1 hop with a 2xx status ('No redirect needed for `<label>`'); warn when more than 2 hops; at most 5 hops followed; URLs displayed truncated to 50 characters. - Why: Every extra redirect hop slows the first response and wastes crawl budget. - Fix: Consolidate each chain into a single 301 redirect straight to the final URL. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **12.4 Canonical hostname matches served hostname** - Pass: The hostname in the canonical link equals the hostname of the final URL after redirects. - Numbers and lists the tool uses: Canonical hostname compared with the final URL hostname after redirects; provisional hosts exempt: /\.(netlify\.app|vercel\.app|pages\.dev|web\.app|firebaseapp\.com|github\.io|onrender\.com|fly\.dev)$/i. - Why: A canonical that points at a different host than the one actually serving the page tells search engines to index a different site. - Fix: Point the canonical at the served hostname (the www or non-www form the redirect lands on), not the address you typed; provisional hosts are not penalized during a DNS cutover. - Verify: [Batch Compare](https://jwatte.com/tools/batch-analyzer/). - [ ] **12.5 www preference consistent** - Pass: The canonical URL and the final served URL agree on whether the hostname starts with www. - Fail: The canonical uses one form (www or non-www) and the served URL uses the other; the Analyzer reports 'www redirect missing, canonical/URL conflict' as a fail and the Batch Analyzer docks the 15-point item. - Numbers and lists the tool uses: hostname.startsWith('www.') compared between canonical and served URL (Analyzer, Batch Analyzer); Analyzer runs this only when a canonical is present and the host is not provisional, and labels a redirected input 'www redirect working as intended'; Batch Analyzer exempts provisional hosts. - Why: When both www and non-www versions answer without a redirect, Google treats them as separate sites and splits your ranking signals, and Search Console reports 'Page with redirect' errors. - Fix: Pick one form and 301 redirect the other. Netlify: netlify.toml [[redirects]] from = "https://example.com/*" to = "https://www.example.com/:splat" status = 301 force = true (and the reverse for the other choice); Apache: RewriteCond %{HTTP_HOST} ^www\.example\.com [NC] then RewriteRule ^(.*)$ https://example.com/$1 [R=301,L]; Nginx: return 301; Vercel: host-based redirect in vercel.json; Cloudflare: _redirects. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/). - [ ] **12.6 Canonical uses HTTPS** - Pass: The canonical link's URL begins with https://. - Fail: The canonical href begins with http://; the Analyzer reports 'Canonical uses HTTP (not HTTPS)' as a fail and the Batch Analyzer docks the 10-point item. - Numbers and lists the tool uses: canonical protocol === 'https:' (Analyzer, Batch Analyzer). - Why: A canonical that names the http:// address while the page is served over HTTPS points search engines at the insecure copy. - Fix: Update the canonical href to https://. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/). - [ ] **12.7 Hosting config file carries headers, redirects and caching** - Pass: The site ships a hosting configuration file that sets security headers, redirects and caching rules for the platform it runs on. - Numbers and lists the tool uses: Config files by host in the generators (HOST_CFGS): Netlify netlify.toml; Vercel vercel.json; Cloudflare _headers + _redirects; GitHub Actions .github/workflows/deploy.yml; the deliverable is that file 'with headers, redirects, and caching rules'. The Analyzer hosting fix prompt asks for fixes for Netlify (netlify.toml), Vercel (vercel.json), Cloudflare Pages (_redirects/_headers), Apache (.htaccess) and Nginx (nginx.conf), and its AI fix prompt requires every warning to be checked against the deployment stack first because the audit reads static HTML plus a handful of aux files and cannot see CDN/origin headers, server-side redirects, edge middleware or environment-specific configs (headers set via _headers / netlify.toml / vercel.json / .htaccess / Cloudflare Rules / nginx.conf; robots/sitemap generated by the SSG build). - Why: Security headers, redirects and cache rules live at the hosting layer, so without a config file nobody is setting them. - Fix: Add the config file for your host (netlify.toml, vercel.json, _headers plus _redirects.htaccess or nginx.conf) and keep headers, redirects and caching in it; when an AI writes a fix, tell it which stack you run first. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/), [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/). - [ ] **12.8 Cache-Control** - Pass: The main page response includes a Cache-Control header. - Numbers and lists the tool uses: Header present (Security Headers Audit); Uptime Check reports the value or '(none)' as info. - Why: Explicit cache directives keep browsers and CDNs from caching pages in ways you did not intend. - Fix: Add a Cache-Control header, for example Cache-Control: public, max-age=3600, must-revalidate. - Verify: [Security Headers](https://jwatte.com/tools/security-headers-audit/), [Uptime + Response-Time Diagnostic](https://jwatte.com/tools/uptime-check/). - [ ] **12.9 Content-Type: `<type>`** - Pass: The final response's Content-Type header starts with text/html. - Numbers and lists the tool uses: /^text\/html/i; a non-HTML type is reported as info, not failed; no row when the header is empty. - Why: A page that is not served as HTML may be an API endpoint, feed or file, which browsers and crawlers treat differently. - Fix: Confirm the URL is meant to serve non-HTML; otherwise correct the server's Content-Type for the page to text/html. - Verify: [Uptime + Response-Time Diagnostic](https://jwatte.com/tools/uptime-check/). - [ ] **12.10 Web app manifest served** - Pass: A manifest file is served at /site.webmanifest or /manifest.json. - Warn: Neither /site.webmanifest nor /manifest.json is served. - Numbers and lists the tool uses: /site.webmanifest, /manifest.json. - Why: A manifest makes the site installable, adds Android home-screen shortcuts and helps Google Discover eligibility. - Fix: Ship /site.webmanifest (or manifest.json) and reference it with `<link rel="manifest">`. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **12.11 Web App Manifest found** - Pass: The HTML head contains link[rel="manifest"]. - Numbers and lists the tool uses: link[rel="manifest"]; a missing link is reported as info 'No Web App Manifest'. - Why: The link is what tells browsers where the manifest lives, so the file alone is not enough. - Fix: Add `<link rel="manifest" href="/site.webmanifest">` and fill the manifest with the app name, icons and theme color. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **12.12 Verification commands confirm robots.txt, ai.txt and /.well-known/ai.txt are live with expected per-bot content** - Pass: After deploy, /robots.txt, /ai.txt and (when the mirror is enabled) /.well-known/ai.txt return 200 and contain the expected per-bot rules. - Numbers and lists the tool uses: curl -sI `<origin>`/robots.txt | head -1; curl -s `<origin>`/robots.txt | head -5; the same pair for /ai.txt; curl -sI `<origin>`/.well-known/ai.txt | head -1 when the mirror is enabled; curl -s `<origin>`/robots.txt | grep -A2 "`<bot>`" for the first 5 bots in the catalog. - Why: A policy file that was generated but never deployed, or that the platform silently drops, does nothing. - Fix: Run the curl commands after deploying, then run the AI Posture Audit at https://jwatte.com/tools/ai-posture-audit/ to confirm every source agrees per bot. - Verify: [AI Bot Policy Generator](https://jwatte.com/tools/ai-bot-policy-gen/). - [ ] **12.13 Platform cannot host root files** - Pass: The site's platform can publish arbitrary files at the domain root, so the root-file checks apply normally. - Fail: The site runs on a platform that blocks arbitrary root files, so ai.txt, llms-full.txt, the /.well-known llms mirror, humans.txt, security.txt and AGENTS.md cannot be published and their checks are downgraded to 'platform limitation'. - Numbers and lists the tool uses: Platforms that cannot host root files: /^(Wix|Weebly|Linktree|Carrd|Substack|Beehiiv|ChamberMaster|Townsuite|Etsy Storefront|Bandzoogle|Constant Contact Landing|SmugMug|Pixieset|Spacecrafted|eCatholic|LPi WeConnect|OSV $Our Sunday Visitor$|Square Online)$/i; Pixieset fallback when nothing else matched: robots.txt names at least 6 of AhrefsBot, BLEXBot, BUbiNG, dotbot, MJ12bot, PetalBot, SemrushBot, SiteAuditBot, SMTBot and has a wildcard Crawl-delay 1 matching /user-agent\s*:\s*\*\s*\n\s*crawl-delay\s*:\s*1\b/im. - Why: On these platforms a missing root file is a limitation of the platform, not a choice you made, and no amount of editing will fix it. - Fix: Migrate to a static host (Netlify, Cloudflare Pages or Vercel) if you need to publish root files. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **12.14 Server Content-Type matches expected image type (`<ct>`)** - Pass: A direct image URL is served with a Content-Type that begins with image/. - Warn: The image URL returns a Content-Type that is present but is not an image type (label: URL ends in .`<ext>` but server returned Content-Type "`<ct>`"). - Numbers and lists the tool uses: Content-Type ^image\/. - Why: When the host labels an image file with the wrong type, browsers may refuse to render it. - Fix: Correct the MIME type mapping on the host for that image extension. - Verify: [Image Alt Audit](https://jwatte.com/tools/image-alt-audit/). - [ ] **12.15 Abandoned-site technology fingerprints** - Pass: The HTML contains none of the legacy shims and library versions in the list. - Fail: The HTML matches at least one fingerprint (html5shiv, selectivizr, respond.js, IE conditional comments, jQuery 1.x or 2.0, Bootstrap 2.x or 3.x, AngularJS 1.x); reported as a critical fail listing the detected fingerprints. - Numbers and lists the tool uses: html5shiv|html5shim; selectivizr; respond(.min).js; IE conditional comments /<!--\s*\[if\s+(lt\s+)?IE/i; jQuery /jquery[\/.-](1\.\d+|2\.0)/i; Bootstrap /bootstrap[\/.-](2\.\d+|3\.\d+)/i; AngularJS /angular\.js\/1\.|angularjs\/1\./i. - Why: Legacy shims for Internet Explorer and old library versions signal a site nobody maintains. - Fix: Remove the IE shims and upgrade jQuery, Bootstrap and AngularJS to current versions. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **12.16 Site appears hand-rolled and predates HTML5 + JSON-LD** - Pass: The site is not flagged as a pre-2015 hand-rolled build. - Warn: An XHTML 1.0 or HTML 4 doctype is combined with jQuery 1.x or 2.0 or a nested layout table, and the page has no JSON-LD script; reported as a warn advisory. - Numbers and lists the tool uses: Doctype in the first 500 characters /<!DOCTYPE\s+html\s+PUBLIC\s+["']-\/\/W3C\/\/DTD\s+(?:XHTML\s+1\.0|HTML\s+4)/i AND (jQuery version /^[12]\./ taken from the /jquery[\/.-](1\.\d+|2\.0)/i match OR a nested `<table>` /<table[^>]*>[\s\S]*<table/i in the first 8000 characters) AND no `<script type="application/ld+json">`; the 'no recognized CMS' condition appears only in the code comment and the advisory text, not in the boolean. - Why: When the stack itself is that old, most other failures are downstream of it and patching them one by one is not worth the effort. - Fix: Rebuild on a modern static generator (Eleventy, Astro, Hugo or Jekyll); see /tools/static-site-rebuild-guide/. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **12.17 Vendor-locked platform: `<value>` (`<vertical>`)** - Pass: The site does not run on an industry-specific vendor platform. - Warn: The site runs on a vendor platform built for one industry, so content export may require the vendor's cooperation and proprietary widgets will not transfer. - Numbers and lists the tool uses: Migration Analyzer: Dental ProSites, Officite, Sesame Communications, PBHS, Smile Marketing, Dental Branding; Legal FindLaw, Justia, Scorpion, Mockingbird; Restaurant BentoBox, Toast, Popmenu, ChowNow; Real estate Placester, Real Geeks, Sierra Interactive, IDX Broker. Site Migration Gen: vendor-dental ProSites, Officite; vendor-legal FindLaw, Justia, Scorpion; vendor-restaurant BentoBox, Toast; vendor-realestate Placester, Real Geeks. - Why: Industry vendors hold your content and widgets inside their platform, which makes leaving expensive. - Fix: Before any migration, ask the vendor for a content export and plan replacements for widgets that will not move with you. - Verify: [Migration Analyzer](https://jwatte.com/tools/migration-analyzer/), [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/). - [ ] **12.18 Double-CDN detected: `<cdn>` → `<cdn>`** - Pass: At most one CDN request-id header appears on the response. - Warn: Two or more CDN request-id headers appear on one response, meaning one CDN is fronting another. - Numbers and lists the tool uses: >= 2 of: cf-ray (Cloudflare), x-nf-request-id (Netlify), x-vercel-id (Vercel), x-amz-cf-id (AWS CloudFront), fly-request-id (Fly.io). - Why: Stacking one CDN in front of another adds cache-coherence problems, doubles the IP-trust chain and can hide rate limiting. - Fix: Confirm the layering is intentional (for example Cloudflare for bot protection in front of Netlify as origin) and that both layers' cache rules agree; see /blog/blog-netlify-waf-vs-cloudflare-double-cdn/. - Verify: [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). - [ ] **12.19 301 REDIRECT MAP** - Pass: Every old URL maps to its new URL in the host's native redirect format, every redirect returns 301 (not 302 or 307), and a catch-all sends unknown old paths to the homepage. - Numbers and lists the tool uses: First 15 internal links listed in the map; wildcard rule for /blog/YYYY/MM/slug patterns; status 301 only; formats: _redirects or [[redirects]] in netlify.toml, vercel.json, _redirects (Cloudflare).htaccess or Actions (GitHub). - Why: A migration without a complete 301 map breaks inbound links and throws away the ranking equity the old URLs earned. - Fix: Write the old-to-new map in the host's redirect file before cutover and make every entry a 301. - Verify: [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/). - [ ] **12.20 WordPress plugins detected: `<n>`** - Pass: Five or fewer distinct plugins are referenced from /wp-content/plugins/. - Warn: More than 5 distinct plugins are detected. - Numbers and lists the tool uses: Distinct /wp-content/plugins/`<name>`/ paths; warn when > 5. - Why: Every plugin is code someone else maintains and a feature that has to be rebuilt if you leave WordPress. - Fix: Remove plugins you do not use and note which remaining ones would need a replacement in a migration. - Verify: [Migration Analyzer](https://jwatte.com/tools/migration-analyzer/). - [ ] **12.21 Portable assets: `<n>` / `<n>`** - Pass: At least 60 percent of detected assets are portable to another platform. - Warn: Between 40 and 59 percent of assets are portable. - Fail: Under 40 percent of assets are portable. - Numbers and lists the tool uses: contentPortability = portable / total * 100; pass >= 60, warn 40 to 59, fail < 40. - Why: The share of images, styles and content you can take with you decides how painful a platform move would be. - Fix: Export with the platform's native path: WordPress WXR export plus /wp-content/uploads/ (wp2md, ACF to frontmatter); Squarespace WXR export plus /s/ assets; Webflow Export Code zip plus the API for CMS items; Shopify Storefront API plus CDN images (checkout cannot be static); Wix has no native export so pull from static.wixstatic.com; unknown platforms via wget --mirror or httrack; convert images to WebP or AVIF, preserve alt text and keep a slug map. - Verify: [Migration Analyzer](https://jwatte.com/tools/migration-analyzer/), [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/). - [ ] **12.22 Vendor-locked assets: `<n>`** - Pass: No asset is classified vendor-locked. - Warn: 1 to 3 vendor-locked assets are detected. - Fail: More than 3 vendor-locked assets are detected. - Numbers and lists the tool uses: A detected vertical vendor platform (ProSites, Officite, Sesame Communications, PBHS, Smile Marketing, Dental Branding, FindLaw, Justia, Scorpion, Mockingbird, BentoBox, Toast, Popmenu, ChowNow, Placester, Real Geeks, Sierra Interactive, IDX Broker) counts as one; external scripts matching shopify|squarespace|wix|webflow|hubspot; iframes other than google.com/maps, maps.google, youtube, vimeo or wistia; forms whose action matches wufoo|typeform|jotform|formspree|hubspot|salesforce|pardot; warn 1 to 3, fail > 3. - Why: Vendor-locked scripts, embeds and forms stop working the day you leave the vendor. - Fix: Replace locked features with open equivalents: forms with Netlify Forms or Formspree; analytics with GA4, Plausible or Umami; image CDN with Cloudinary or imgix; booking with Cal.com or Calendly; chat with Tawk.to or Crisp; maps with Google Maps or Leaflet plus OpenStreetMap; reviews as static cards with Review schema; food ordering as a static menu plus DoorDash or UberEats links; property search via an IDX iframe. - Verify: [Migration Analyzer](https://jwatte.com/tools/migration-analyzer/), [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/). - [ ] **12.23 Platform-dependent assets: `<n>`** - Pass: No asset is classified platform-dependent. - Warn: 1 to 5 platform-dependent assets are detected. - Fail: More than 5 platform-dependent assets are detected. - Numbers and lists the tool uses: Images hosted on squarespace-cdn|wixstatic|cdn.shopify|webflow; external scripts that match neither the vendor widget list shopify|squarespace|wix|webflow|hubspot nor the tracking list google|facebook|hotjar|clarity|segment|mixpanel|amplitude; stylesheets matching squarespace|wix|webflow|shopify|hubspot; every WordPress plugin; the WordPress theme; forms whose action does not match wufoo|typeform|jotform|formspree|hubspot|salesforce|pardot (shown as (inline) when the action is empty); warn 1 to 5, fail > 5. - Why: Platform-dependent assets can be moved but each one needs rework during a migration. - Fix: Copy vendor-CDN images and CSS into your own repo and rebuild plugin-driven features as static equivalents. - Verify: [Migration Analyzer](https://jwatte.com/tools/migration-analyzer/). - [ ] **12.24 Vendor lock-in score: `<n>` / 100** - Pass: The lock-in score is 20 or below. - Warn: The lock-in score is 21 to 50. - Fail: The lock-in score is above 50. - Numbers and lists the tool uses: (vendorLocked*3 + platformDep*1.5) / (total*3) * 100; pass <= 20, warn 21 to 50, fail > 50; gauge red >= 60, amber >= 30. - Why: A single number for how much of the site would have to be rebuilt to leave the current platform. - Fix: Reduce the vendor-locked and platform-dependent asset counts above; the score follows them. - Verify: [Migration Analyzer](https://jwatte.com/tools/migration-analyzer/). - [ ] **12.25 Overall migration readiness: `<n>` / 100** - Pass: The readiness score is 70 or above. - Warn: The readiness score is 45 to 69. - Fail: The readiness score is below 45. - Numbers and lists the tool uses: contentPortability*0.25 + urlRiskScore*0.2 + seoEquity*0.2 + (100 - vendorLock)*0.2 + techComplexity*0.15; pass >= 70, warn 45 to 69, fail < 45; gauge red < 40, amber < 70; technical simplicity starts at 85 with deductions: -15 when WordPress plugins > 5 (else -8 when > 2), -10 when iframes > 3, -10 when forms > 2, -10 when external scripts > 10, -20 for a vendor platform, -15 for e-commerce, clamped 0 to 100. - Why: Combines portability, URL risk, SEO equity, lock-in and technical complexity into one readiness figure. - Fix: Plan a phased migration with a redirect map, starting with the components that drag the score down. - Verify: [Migration Analyzer](https://jwatte.com/tools/migration-analyzer/). - [ ] **12.26 Content type: `<value>`** - Pass: The site is classified static or dynamic. - Warn: The site is classified e-commerce, the most complex kind of migration. - Numbers and lists the tool uses: ecommerce when the platform family is ecom; dynamic when forms > 1 or WordPress plugins > 3; otherwise static. - Why: E-commerce migrations carry checkout, inventory and customer data that a static rebuild cannot hold. - Fix: Informational; treat an e-commerce site as its own migration project. - Verify: [Migration Analyzer](https://jwatte.com/tools/migration-analyzer/). - [ ] **12.27 Ads & Consent Mode v2** - Pass: Consent Mode loads before any Google tag, and AdSense, Mediavine or Ezoic ad scripts are gated on the consent dialog. - Fail: A Google tag or ad script loads before Consent Mode. - Numbers and lists the tool uses: Per-site adsenseId, gaId, clarityId fields drive the tags (Monoclone Generator). - Why: Tags that fire before consent is recorded collect data you may not be allowed to collect. - Fix: Insert the Consent Mode default call ahead of gtag and wrap ad loaders in the consent callback. - Verify: [Monoclone Gen.](https://jwatte.com/tools/monoclone-generator/). Standard: Google Consent Mode v2. - [ ] **12.28 .gitignore** - Pass: The repo's .gitignore excludes build output, caches and secret files. - Numbers and lists the tool uses: node_modules/, dist/, _site/.DS_Store.env.env.local.netlify/.vercel/.wrangler/.cache/.eleventy.cache/.astro/.next/, public/, resources/. - Why: Build output and .env secrets must never be committed. - Fix: Copy the list into .gitignore at the repo root. - Verify: [Monoclone Gen.](https://jwatte.com/tools/monoclone-generator/). - [ ] **12.29 Continuous uptime monitoring with alerts** - Pass: A monitor requests the site on a fixed interval and alerts a person by email, Slack or push when the response is an error or a timeout, then reports recovery. - Numbers and lists the tool uses: Interval default 5 minutes, allowed 1 to 60 (DIY Uptime Alert Generator; Uptime Check suggests every 5 minutes and names UptimeRobot (free), StatusCake (free tier), BetterUptime, Pingdom); Netlify scheduled function and Vercel cron fetch with AbortSignal.timeout(10000) and alert when HTTP status >= 400; Cloudflare Worker fetches with cf: { cacheTtl: 0 } and no timeout, alerting on status >= 400 or a fetch exception; curl -fsS --max-time 10 in GitHub Actions and shell; Netlify netlify.toml [functions."uptime-check"] schedule = "*/`<interval>` * * * *" with node_bundler esbuild; Vercel vercel.json crons path /api/uptime-check, requires the Pro plan ($20/mo); Cloudflare Worker scheduled() on a */`<interval>` * * * * cron trigger with MailChannels https://api.mailchannels.net/tx/v1/send from alerts@yoursite.com (SPF TXT v=spf1 a mx include:relay.mailchannels.net ~all); GitHub Actions cron */`<interval>` * * * * or 0 */`<hours>` * * * when interval >= 60, about 5 to 10 minute real granularity, actions/github-script@v7 opens an issue '[ALERT] `<url>` is down', dawidd6/action-send-mail@v3 via smtp.gmail.com:465 with secrets SMTP_USERNAME and SMTP_PASSWORD; shell script /usr/local/bin/uptime-check.sh alerts only on state change using /var/tmp/uptime-state-`<md5 of URL>` (LAST_STATE defaults to up), logs to /var/log/uptime-check.log, needs mailutils or mailx plus an SMTP relay (Mailgun free 100/day, AWS SES $0.10/1000, postfix to smtp.gmail.com); Uptime Kuma louislam/uptime-kuma:1 on port 3001, HTTP(s) monitor with heartbeat interval*60 seconds and Retries 2, status page behind Caddy reverse_proxy localhost:3001; Gatus twinproduction/gatus:latest on port 8080, endpoint interval `<interval>`m with conditions [STATUS] == 200, [RESPONSE_TIME] < 2000 and [CERTIFICATE_EXPIRATION] > 48h, failure-threshold 2, send-on-resolved true, sqlite /data/data.db, SMTP port 587, under 20MB memory; Prometheus prom/prometheus (9090) + prom/alertmanager (9093) + prom/blackbox-exporter (9115), module http_2xx, scrape and evaluation interval `<interval>`m, rule group interval 1m with alerts SiteDown (probe_success == 0 for 2m, severity critical), TLSExpiringSoon (probe_ssl_earliest_cert_expiry - time() < 86400 * 14 for 10m, severity warning) and SlowResponse (probe_http_duration_seconds > 3 for 5m, severity warning), Alertmanager group_wait 30s, group_interval 5m, repeat_interval 4h, Slack channel #alerts, Grafana dashboard 7587, minimum 1GB RAM; Monit daemon cycle interval*60 seconds with start delay 10, httpd port 2812 localhost only, check host port 443 protocol https timeout 10 seconds for 2 cycles, about 2MB RAM; ntfy push with headers Title, Priority urgent, Tags warning,red_circle to https://ntfy.sh/`<topic>`, self-host with binwiederhier/ntfy; recommended hybrid: shell+cron on a $5/mo VPS plus native deploy notifications. - Why: A one-shot diagnostic tells you the site was up at that moment; only a monitor tells you when it goes down. - Fix: Set up a monitor (a hosted service, a scheduled function on your host, a GitHub Actions workflow or a cron script on a small VPS) that checks every 5 minutes and alerts on a non-200 response; require two consecutive failures before paging to avoid single-blip alerts. - Verify: [Uptime + Response-Time Diagnostic](https://jwatte.com/tools/uptime-check/), [DIY Uptime Alert Generator](https://jwatte.com/tools/diy-uptime-alert-generator/). - [ ] **12.30 Deploy failure notifications** - Pass: The host emails (and optionally Slacks) on failed deploys, and form submissions notify you. - Numbers and lists the tool uses: Netlify: Deploy succeeded and Deploy failed events to the alert email, outgoing webhook on Deploy failed to /.netlify/functions/alert-on-deploy-failure, form notifications on every submission; Vercel: Failed deployments email, deployment.failed webhook to /api/alert-on-deploy-failure; free on both hosts' free tiers. - Why: A broken deploy can leave the old build live or the site down without anyone noticing. - Fix: Netlify: Site settings, Build & deploy, Deploy notifications, Add notification, and Site settings, Forms, Form notifications. Vercel: Project settings, Notifications, and Project settings, Git, Deployment Notifications. - Verify: [DIY Uptime Alert Generator](https://jwatte.com/tools/diy-uptime-alert-generator/). - [ ] **12.31 Scheduled jobs report to a dead-man's switch** - Pass: Each cron job (backups, batch jobs, sitemap pings, certificate renewals) pings a Healthchecks check on success and its /fail endpoint on failure, and a missed ping raises an alert. - Numbers and lists the tool uses: curl -fsS -m 10 --retry 3 https://healthchecks.yoursite.com/ping/`<uuid>` (and /ping/`<uuid>`/fail); example crontab 0 3 * * * /usr/local/bin/nightly-backup.sh; self-hosted image healthchecks/healthchecks:latest on port 8000, EMAIL_PORT 587, SECRET_KEY from openssl rand -hex 32, 512MB+ VPS (~$5/mo); hosted healthchecks.io free tier 20 checks. - Why: Things that should keep running fail silently, so a missed ping is treated as a real incident. - Fix: Create a check per job and append the ping curl to each job; use shell+cron or Gatus alongside it for active HTTP checks of the site itself. - Verify: [DIY Uptime Alert Generator](https://jwatte.com/tools/diy-uptime-alert-generator/). - [ ] **12.32 Monit (classic Unix): filesystem and system checks** - Pass: On a self-hosted server, root filesystem usage stays at or below 90 percent, the 5-minute load average at or below 4 and memory usage at or below 90 percent. - Numbers and lists the tool uses: space usage > 90% on /; loadavg (5min) > 4; memory usage > 90%. - Why: A full disk or exhausted memory takes the site down before an HTTP check notices. - Fix: Free disk space or add capacity when the alert fires. - Verify: [DIY Uptime Alert Generator](https://jwatte.com/tools/diy-uptime-alert-generator/). - [ ] **12.33 DNS records applied at the provider** - Pass: Records are entered in the provider's native format with TXT values quoted, long TXT values split into strings of at most 255 characters, Cloudflare proxying off for TXT, MX and CAA, and the SOA serial incremented after every zone change. - Numbers and lists the tool uses: BIND: name padded to 24 columns, TTL default 3600, TXT values over 257 characters split into 250-character quoted chunks in parentheses (255 character per-string limit), inner quotes escaped, CAA rendered as flag tag "value", increment the SOA serial; Cloudflare Terraform provider v4+ with proxied = false (must be false for TXT, MX, CAA), MX split into host without trailing dot plus priority, CAA parsed with /^(\d+)\s+(\S+)\s+"(.*)"$/; DigitalOcean doctl compute domain records create with --record-type, --record-name, --record-data, --record-priority (MX), --record-flags and --record-tag (CAA), --record-ttl, after doctl auth init with a PAT that has write on domains; DigitalOcean does not sign DNSSEC natively; AWS Route53 change batch with Action UPSERT and names ending in a trailing dot, applied with aws route53 change-resource-record-sets --hosted-zone-id `<id>` --change-batch file://changes.json; Google Cloud DNS gcloud dns record-sets transaction start, add and execute with --zone after gcloud dns managed-zones create. - Why: A DNS record typed in the wrong format, or proxied when it must not be, silently breaks email authentication and certificate issuance. - Fix: Use the generator's output for your provider, keep Cloudflare proxying off for TXT, MX and CAA, and bump the SOA serial after every change. - Verify: [DNS Records Gen.](https://jwatte.com/tools/dns-records-generator/). - [ ] **12.34 Cloudflare deployment model and bindings (wrangler.toml)** - Pass: Wrangler.toml declares either pages_build_output_dir (Pages) or main (Worker), never both, pins compatibility_date, adds the nodejs_compat flag if needed, and every secret change is followed by a redeploy. - Numbers and lists the tool uses: cf-model: pages (default), pages-worker, worker; bindings D1 and KV default on, R2, Durable Objects, Queues, Workers AI / Vectorize default off; D1 parameterized queries, additive migrations, migrations list --remote before deploy; KV eventually consistent (~60s, ~1 write/sec per key), fail open; Durable Objects SQLite-backed 10GB per object; deploy order: deploy, set secrets, deploy again; Worker first then Pages vars; ALTER TABLE migrations snapshot first and guard backfills WHERE IS NULL; custom domain via dashboard with proxied DNS; README documents order, var names and post-deploy checks; Cloudflare projects add wrangler.toml, _headers, _redirects.dev.vars.example, migrations/. - Why: Secrets are not live until a deploy after they are set, and mixing Pages and Worker settings in one config breaks the build. - Fix: Pick one deployment model, pin compatibility_date, and redeploy after setting secrets. - Verify: [Single Site Gen](https://jwatte.com/tools/single-site-gen/). Standard: Cloudflare Workers/Pages docs. - [ ] **12.35 Site MUST pass jwatte.com audit suite on first deploy** - Pass: After launch or migration the site scores mega-analyzer >= 90, analyzer >= 90, eeat-analyzer >= 85, ai-citation-readiness 14/14, mobile-parity 100 percent, and link-graph shows no orphans or dead ends. - Numbers and lists the tool uses: 90, 90, 85, 14/14, 100%; migration: run site-migration-capture on the new site against the source manifest (every page, image, heading and schema block in the manifest must appear), spot-check 5 old URLs for a 301, compare Google cache old vs new; the build prompt lists which jwatte.com/tools/ audits to run. - Why: Score targets turn 'the site is live' into 'the site is verified'. - Fix: Run the named audits after deploy and fix anything below target before announcing the site. - Verify: [Single Site Gen](https://jwatte.com/tools/single-site-gen/), [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/). - [ ] **12.36 Multi-site network: varied HTML shells, registrars and launch timing** - Pass: Sites in a network rotate three header and footer skins with visibly different HTML structure, spread domains across registrars and registration dates, and stagger deploys over the first 30 to 90 days. - Fail: All domains registered at one registrar in one sitting, all sites deployed the same day, or every site sharing one identical HTML shell. - Numbers and lists the tool uses: skins ['a','b','c'] rotated (i-1)%3, recommended for 10+ sites; registrars named: Porkbun, Cloudflare Registrar, Namecheap, Google Domains successor; registrations spread across several weeks; deploys across the first 30 to 90 days. - Why: Template, IP, registrar and burst-publishing fingerprints are what identify a network to search engines. - Fix: Build one site, ship it, measure, then expand; create three header and footer variants and rotate them per site; rotate registrars and stagger launches. - Verify: [Monoclone Gen.](https://jwatte.com/tools/monoclone-generator/). - [ ] **12.37 Online Store 2.0 JSON templates + section groups** - Pass: The Shopify theme uses templates/*.json, section groups or {% sections %}. - Warn: None of the Online Store 2.0 markers are found, indicating a Vintage (pre-2021) theme. - Numbers and lists the tool uses: templates/*.json, section_groups or {% sections %}. - Why: Section groups and JSON templates let you edit the header and footer without touching code. - Fix: Upgrade to an Online Store 2.0 theme. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **12.38 Shop Pay button present** - Pass: The Shopify storefront HTML references shop-pay, shop_pay or shopify_pay. - Numbers and lists the tool uses: shop-pay|shop_pay|shopify_pay. - Why: Shop Pay typically lifts mobile conversion by 10 to 15 percent. - Fix: Admin > Settings > Payments > Shop Pay. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **12.39 Multi-currency / country selector** - Pass: The Shopify storefront references /cdn/shop/files/flag, country_selector or enabled_currencies. - Numbers and lists the tool uses: /cdn/shop/files/flag|country_selector|enabled_currencies. - Why: Signals whether Shopify Markets is switched on for international buyers. - Fix: Turn on Shopify Markets. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **12.40 Checkout Extensibility** - Pass: Checkout_extensibility or extensions/checkout appears in the Shopify storefront HTML. - Numbers and lists the tool uses: checkout_extensibility or extensions/checkout. - Why: Checkout.liquid is deprecated for Shopify Plus. - Fix: Verify checkout extensibility in the admin. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **12.41 Eleventy version `<n>`** - Pass: The generator meta reports Eleventy major version 3 or higher. - Warn: The Eleventy major version is below 3. - Numbers and lists the tool uses: generator meta Eleventy v<major.minor>; warn when major < 3. - Why: 3.x is the modern ESM-first line. - Fix: Upgrade to Eleventy 3.x. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **12.42 Gatsby page-data prefetch / webpack-runtime** - Pass: /page-data/*.json prefetch is found. - Numbers and lists the tool uses: /page-data/*.json; webpack-runtime-`<hash>`.js. - Why: Missing page-data may indicate Gatsby v1 or v2, which are end of life. - Fix: Migrate to Gatsby 5 or later. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **12.43 Astro Islands / View Transitions** - Pass: Astro-island markers are found; view transitions are reported when present. - Numbers and lists the tool uses: astro-island; view-transition|astro-view-transitions. - Why: Confirms the site uses Astro's island architecture. - Fix: Informational; no fix. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **12.44 Ghost theme / Members portal / Koenig cards / Portal signup CTA** - Pass: The members portal and a portal signup CTA are found; theme and Koenig card markers are reported as info. - Numbers and lists the tool uses: casper.theme|/content/themes/casper/; portal.min.js|ghost-portal|data-members-signin|/members/; kg-card|koenig-card|kg-bookmark|kg-gallery; data-portal="signup"|ghost-portal-button. - Why: Shows whether the Ghost membership and signup features are switched on. - Fix: Settings > Membership; Settings > Portal. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **12.45 HubSpot portal meta / Forms / CTAs / tracking script** - Pass: The HubSpot tracking script is found; portal meta, forms and CTAs are reported. - Numbers and lists the tool uses: data-hs-meta-data; js.hsforms.net|hs-form; js.hs-cta.com|hs-cta-wrapper; js.hs-analytics.net. - Why: Confirms which HubSpot features the site actually loads. - Fix: Informational; confirm the features you pay for are the ones loaded. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **12.46 Platform detected: `<name>` (`<type>`), `<detected via>`** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: Mega Analyzer VENDOR_FP ordered list, first match wins, hosts rank above widgets: ProSites, Officite, Sesame Communications, PBHS, Smile Marketing, Dental Branding, FindLaw, Justia, Scorpion, Mockingbird, BentoBox, Toast, Popmenu, ChowNow, Owner.com, SpotHopper, Tambourine, Placester, Real Geeks, Sierra Interactive, WordPress, Squarespace, Wix, Shopify, Webflow, GoDaddy Builder, Weebly, Spacecrafted, Pixieset, SmugMug, Carrd, Linktree, Substack, Beehiiv, Townsuite, ChamberMaster, Constant Contact Landing, Etsy Storefront, Bandzoogle, HubSpot CMS, Duda, Framer, Square Online, eCatholic, LPi WeConnect, OSV (Our Sunday Visitor), Tithe.ly, Pushpay, Givelify, EasyTithe, Subsplash, Clover Sites, Sharefaith, Planning Center, Ekklesia 360, Finalsite, SchoolBlocks, Blackbaud, A Place for Mom referral, Enquire (senior CRM), HoneyBook, Aisle Planner, Perfect Venue, Tripleseat, HubSpot (marketing embed), GoHighLevel, Mindbody, Housecall Pro, ServiceTitan, Jobber, Vagaro, Boulevard, BLOX CMS (TownNews), Adobe Experience Manager, Sitecore, Drupal, Sanity, Contentful, Optimizely CMS (Episerver), Townsquare Interactive, Vendasta Website Pro, Neighborly (franchise platform), CPA Site Solutions, Equisolve (investor relations), Parish Solutions Co, HungerRush / Menufy (hosted ordering), Homefiniti, Kentico, DotNetNuke (DNN), Umbraco, Hugo, Jekyll, Eleventy, Statamic, Astro, Microsoft IIS / ASP.NET, Next.js, Nuxt, Gatsby, Expo / React Native Web, Vite SPA, SolidJS; widget tier: Podium, CallRail, Juvo Leads, ZyraTalk, Broadly, Contractor Commerce, BidClips, Text Request, Lasso CRM, NoviHome, BDX / NewHomeSource, Lotvue, BankingBridge, Corrigo warranty portal, Matterport 3D tour, Citrix ShareFile portal, Aiwyn payment portal, Thomson Reuters NetClient CS, Envestnet Tamarac portal, Addepar portal, Fiduciary Briefcase, Marketo, Oracle Eloqua, Salesforce Pardot, ActiveCampaign form, Vuture, Usercentrics CMP, Consentmo GDPR, Yext, ATS careers embed, Spectora, Vanco Giving, Faith Direct, ParishSOFT Giving / WeShare, SecureGive, RebelGive, Blackbaud Luminate Online, Flocknote, BoxCast livestream, Ministry Scheduler Pro, We Adore Him adoration, MassIntentions.com, Church Community Builder, Ministry Forms, Elfsight, 123FormBuilder, Eventbrite, TableUp, inKind, Appstle Subscriptions, MultiShip, GoAffPro, Storage Commander; footer credit fallback /(?:created|powered|designed|built|developed|made)\s+(?:by|with)\s+([\w][\w &.']+?)(?:\.|,|<|$)/i; owner override list JW_PLATFORMS adds Cloudflare Pages, Cloudflare Workers, Netlify, Vercel and 'None / custom-built', stored per host as jw-platform-override:`<host>`. Mega Analyzer next-step tool recommender detection on the full raw HTML, first match wins (only the body text sample handed to the recommender is capped at 40000 characters): /wp-content|wp-json|WordPress/i WordPress; /cdn\.shopify\.com|Shopify\.theme/i Shopify; /Static\.SQUARESPACE_CONTEXT|squarespace-cdn/i Squarespace; /static\.wixstatic\.com|_wixCIDX/i Wix; /assets\.website-files\.com|data-wf-page/i Webflow; /ghost-url|casper\.theme/i Ghost; /cdn11\.bigcommerce\.com/i BigCommerce; /hs-scripts\.com|__hs_(?:cos|cta)/i HubSpot CMS; /framerusercontent\.com/i Framer. Mega SEO Analyzer: WordPress /wp-content|wp-includes|\/wp-json\/|generator.*WordPress/i; WooCommerce /woocommerce|wc-ajax/i; Shopify /cdn\.shopify\.com|shopify\.com\/s|Shopify\.theme/i; Squarespace /static1\.squarespace|squarespace-cdn/i; Wix /static\.wixstatic\.com|wix\.com|_wixCIDX/i; Webflow /assets-global\.website-files\.com|webflow\.js|data-wf-/i; Next.js /__NEXT_DATA__|_next\//i; Nuxt /__NUXT__|_nuxt\//i; Gatsby /___gatsby|__GATSBY/i; SvelteKit /sveltekit-|\+layout\.svelte/i; Astro /astro-[a-z0-9]+|data-astro-/i; Ghost /ghost\.io|\/ghost\/api\/|data-ghost/i; Drupal /sites\/default\/files|drupal|Drupal\.settings/i; HubSpot CMS /hs-scripts\.com|hsforms|hubspot/i; Contentful /ctfassets\.net|contentful\.com/i; Sanity /cdn\.sanity\.io/i; Eleventy /\<\!--.*eleventy|11ty/i; Jekyll /jekyll-/i; Magento /mage\/cookies|magento/i; BigCommerce /bigcommerce\.com|cdn11\.bigcommerce/i; then headers Netlify (/netlify/i on server or x-nf-request-id), Vercel (/vercel|Vercel/ on server or x-vercel-id), Cloudflare Pages (/cloudflare pages/i on server or cf-ray). Platform Audit body signatures ranked by KIND_RANK commerce 1, commerce-overlay 2, sitebuilder 3, cms 4, without a browser window-cms 5, framework 6, all matches kept and the lowest rank is primary: shopify (cdn.shopify.com|Shopify.theme|myshopify.com|shopify-section|/cdn/shop/files/), shopify-hydrogen, bigcommerce (cdn11.bigcommerce.com|bigcommerce.com/s-|Stencil.|__STENCIL__), magento, salesforce-cc, prestashop, opencart, oroCommerce, saleor, vendure, snipcart, foxy, commercejs, squarespace (static1.squarespace.com|squarespace-cdn|Static.SQUARESPACE_CONTEXT|sqs-block), wix (static.wixstatic.com|_wixCIDX|wix-code|wix.com/_functions), webflow (assets.website-files.com|webflow.com|w-nav|data-wf-page|data-wf-site), framer, mailchimp-sites, carrd, wordpress (wp-content|wp-includes|wp-json), drupal, joomla, typo3, concrete5, modx, craft, statamic, kirby, plone, ghost, hubspot-cms, sanity, contentful, strapi, payload, hygraph, storyblok, prismic, builderio, umbraco, sitecore, decap, tina, next.js (__NEXT_DATA__|_next/static|/_next/image), nuxt, gatsby, astro, remix, svelte/kit, qwik, solid-start, eleventy, hugo, jekyll (generator meta); when no platform check function was dispatched it renders 'No platform signature matched'; a WordPress primary stops the Platform Audit and routes to the WordPress + WooCommerce and WordPress security audits. Migration Analyzer signatures: WordPress, WooCommerce, Shopify, BigCommerce, Squarespace, Wix, Webflow, Ghost, Drupal, Joomla, Magento, HubSpot CMS, Framer, Next.js, Nuxt, Gatsby, Astro, Eleventy, Hugo, Jekyll, Svelte/Kit, Contentful, Sanity, Weebly, GoDaddy Builder, Duda in families cms, ecom, builder, jamstack, ssg, without a browser window (warn when nothing matches). Fix tags: [OWNER] content edits and body schema you can apply; [PLATFORM] CMS or hosting config (CDN headers, redirects, server settings); [VENDOR-CONTACT-REQUIRED] locked at template level, needs a vendor ticket; [INFRASTRUCTURE] DNS, TLS, registrar. - Why: Knowing the platform tells you which fixes you can make yourself, which need a hosting config change, and which need a vendor ticket. - Fix: Confirm the detected platform (override it when the fingerprint grabbed an agency's 'designed by' credit or a white-label embed) and route each fix to the surface that platform exposes: WordPress head and schema via Yoast, Rank Math or AIOSEO plus Site Health; Netlify headers via _headers; Vercel headers via the vercel.json headers block; WordPress sites continue in the dedicated WordPress + WooCommerce audit. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [Migration Analyzer](https://jwatte.com/tools/migration-analyzer/). - [ ] **12.47 Edge/serverless platform(s) detected** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: Mega Security Analyzer: Netlify (/\bnetlify\b/i on server or x-nf-request-id); Cloudflare (/cloudflare/i on server, cf-ray, cf-worker); Vercel (/vercel/i on server, x-vercel-id, x-vercel-cache); AWS API Gateway / Lambda (x-amz-apigw-id, x-amzn-requestid); AWS CloudFront (x-amz-cf-id); Fly.io (fly-request-id, /\bfly\/[\d.]+/i on server, fly-region); Deno Deploy (/deno/i on server, x-deno-deployment-id); Render (x-render-origin-server, rndr-id); Railway (x-railway-edge, x-railway-request-id); DigitalOcean App Platform (x-do-app-origin, x-do-orig-host). Platform Audit hosting headers (HOSTING_RULES): Netlify x-nf-request-id or server netlify; Vercel x-vercel-id, x-vercel-cache or server vercel; Cloudflare cf-ray, cf-cache-status or server cloudflare; Cloudflare Pages cf-ray plus server pages; AWS CloudFront x-amz-cf-id or via cloudfront; AWS Amplify x-amz-meta-amplifyapp; Fastly x-served-by or via fastly; Akamai server akamai or x-akamai-request-id; Fly.io fly-request-id, fly-region or server fly/`<version>`; Render x-render-origin-server, rndr-id; Railway x-railway-edge, x-railway-request-id; Firebase Hosting x-firebase-cache-status or server firebase; GitHub Pages github.com in x-served-by or server github; DigitalOcean App Platform x-do-app-origin or server digitalocean. Platform Audit platform headers (HEADER_RULES): Shopify x-shopid, x-shopify-stage or server shopify; Wix server wix or x-wix-request-id; Webflow server webflow or x-wf-cache; WP Engine server wpengine or x-cache-group; Kinsta server kinsta or x-kinsta-cache; Pantheon x-pantheon-styx-hostname or server pantheon; WordPress VIP x-vip-cache or x-vip-go-edge; Shopify CDN x-shopify-edge-ip or via shopify-cdn; Magento Cloud x-magento-cache-debug or x-magento-tags. - Why: The hosting platform decides which posture checks apply and where headers and redirects get configured. - Fix: Note the host; for a deeper look run the Serverless Posture Audit at /tools/serverless-posture-audit/. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/), [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). - [ ] **12.48 CDN / fetch markers present** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: x-served-by or x-cache response header present; the value is shown. - Why: Identifies a CDN or caching layer in front of the origin. - Fix: Informational only. - Verify: [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). - [ ] **12.49 Public cache on JSON** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: cache-control matches /public/i AND content-type matches /json/i. - Why: A public cache directive on user-specific JSON can serve one visitor's data to another. - Fix: Confirm the endpoint returns no user-scoped data before leaving it publicly cacheable. - Verify: [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). - [ ] **12.50 Images detected: `<n>` / CSS files: `<n>` / Web fonts: `<value>`** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: img src plus CSS url() images; stylesheet links; fonts.googleapis.com families. - Why: The counts size a migration, and Google Fonts are portable. - Fix: Informational only. - Verify: [Migration Analyzer](https://jwatte.com/tools/migration-analyzer/). - [ ] **12.51 Active theme id / handle; Shopify Polaris UI assets detected / No Polaris assets** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: "theme_id": digits or /themes/`<handle>`/assets/; polaris-icons|@shopify/polaris. - Why: Names the live Shopify theme and whether Polaris UI assets are loaded. - Fix: Check theme.liquid in the admin. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **12.52 Squarespace 7.1 (Fluid Engine era) / 7.0 / version unclear** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: templateVersion 7.1, sqs-layout|sqs-row|fluid-engine, or template-`<name>`. - Why: 7.0 sites cannot move to 7.1 without a rebuild. - Fix: Informational only. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **12.53 Squarespace Commerce signals** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: squarespace-commerce|/commerce-orders|product-gallery|add-to-cart-button. - Why: Shows whether Squarespace Commerce is in use on the site. - Fix: Informational only. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **12.54 Editor X detected / Classic Wix Editor** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: editor-x|editorx|wix.com/editor.x. - Why: Names which Wix editor built the site. - Fix: Informational only. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **12.55 Wix Stores / Wix Velo / Wix SEO Wiz / Wix Analytics presence** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: wix-stores|product-gallery-v2|data-hook="add-to-cart-button"; wix-code|_wixCodeRuntime|/_api/cloud-data/; "isSEOReady"|seoWiz|siteIndexStatus; _frog.wixpress.com|static.wixstatic.com/media/analytics. - Why: Shows which Wix features the site loads, including whether the SEO Wiz has been run. - Fix: Complete the 8-step SEO Wiz if it is not detected. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **12.56 Webflow CMS / Ecommerce / interactions.js / Lottie presence** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: w-dyn-list|data-wf-collection|collection-item; w-commerce|/product-category/|data-wf-commerce; webflow.`<hex hash>`.js|js.webflow.com/interactions; lottiefiles.com|lottie-player|.lottie; audit any Lottie above 500KB. - Why: Shows which Webflow features the site loads and flags heavy animation files. - Fix: Dequeue interactions.js if IX2 is unused. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **12.57 Stencil theme framework / Blueprint (legacy) theme; without a browser window API; Optimized One-Page Checkout** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: __STENCIL__|stencil-utils|theme_settings; bigcommerce.com/api/storefront|/graphql; checkout.js|bigcommerce-checkout. - Why: Blueprint themes are pre-2016 legacy. - Fix: Upgrade to Stencil; Advanced Settings > Checkout. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **12.58 Drupal page cache signals / CSRF token scaffolding** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: page_cache|internal_page_cache; csrf-token|X-CSRF-Token. - Why: Shows whether Drupal's page cache and CSRF protection are present in the output. - Fix: Informational only. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **12.59 Framer Forms / Framer CMS presence** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: framer-form|form-submit-button-framer; framer-cms|data-framer-cms-id. - Why: Shows which Framer features the site loads. - Fix: Informational only. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **12.60 Next.js render mode / API routes referenced** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: __NEXT_DATA__[^<]*"isFallback":false; /api/[a-z0-9_-]+ (case-insensitive). - Why: Next.js adds no auth or rate limiting to API routes by default. - Fix: Add authentication and rate limiting to any /api/ route the page references. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **12.61 Nuxt 3 signals present / Nuxt 2 or 3 unclear** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: __NUXT__ "ssr": or _nuxt/builds. - Why: Nuxt 2 is end of life as of June 2024. - Fix: Migrate to Nuxt 3. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **12.62 Build output directory (Eleventy) / Hugo deployment / Hugo version `<n>`** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: Hugo version major >= 0 always passes. - Why: The wrong publish directory leaks /src/*.md files as-is. - Fix: The publish directory must be _site (Eleventy) or /public (Hugo). - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **12.63 Jekyll GitHub Pages likely / SvelteKit SSR markers + adapter / Remix context / Qwik resumability / SolidStart** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: github.io|GitHub.com/.*jekyll; %sveltekit.head%|__sveltekit_, /_app/immutable/chunks; __remixContext "basename":; Qwik detected by q:container|q:slot|qwikloader then Resumability pattern always pass; SolidStart detected by solid-start|solid-js. - Why: Names the framework markers found for the less common stacks. - Fix: Informational only. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). ## Appendix A. Checks that apply to one kind of business The tools gate these on a detected industry so a bakery is not marked down for having no bar number. If one of these is your business, the checks are as binding as the general list. A heading that names several industries means the tools apply that check to each of them. ### Apps behind a login - [ ] **A1.1 The page is missing `<list>` (meta description, Open Graph, canonical, favicon)** - Pass: The login page has a meta description, og:title, canonical and favicon. - Numbers and lists the tool uses: hasMetaDesc; og:title; canonical; favicon regex /<link[^>]+rel=["'][^"']*icon/i. - Why: Links to the app shared in chat and email render broken. - Fix: Add meta description, og:* with twitter:card, canonical and favicon to the login page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A1.2 Make the auth flow accessible** - Pass: - Fail: Pushed unconditionally as a login-wall issue whenever the homepage is detected as a login wall; the markup is not inspected for live regions, landmarks or labels, so the row cannot pass. - Numbers and lists the tool uses: isLoginWall = home path and an auth form (a password input, or sign-up plus log-in text plus a `<form>`) and word count under 180 and 6 or fewer links and no marketing-link keywords (pricing, features, how it works, use cases, customers, testimonials, about, our story, blog, docs, documentation, contact), optionally overridden by the login-wall / app-shell / pre-marketing vertical override; the recommendation names role=alert / aria-live=assertive for errors, a single `<main>`, a `<footer>` and a programmatic label on every input, but none of those is checked. - Why: An error message toggled in a hidden div is never announced to screen readers, so the visitor does not know the login failed. - Fix: Render errors in a live region, add landmarks, and label every input. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: WCAG. - [ ] **A1.3 Account-based app: invite, sign-up and password-reset email is authenticated** - Pass: - Warn: Advisory whenever a sign-up flow exists. - Numbers and lists the tool uses: gate hasSignup; SPF -all; DMARC p=quarantine or p=reject with rua. - Why: An app that grows through invite and reset emails is only as reliable as its SPF, DKIM and DMARC alignment. - Fix: Run the DNS + Email audit and confirm SPF -all, a DKIM selector and a DMARC policy at quarantine or reject. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: SPF; DKIM; DMARC. - [ ] **A1.4 Login page ships transport and framing protection** - Pass: - Warn: Advisory always raised on a login wall. - Numbers and lists the tool uses: headers HSTS, Content-Security-Policy, X-Frame-Options or frame-ancestors, X-Content-Type-Options, Referrer-Policy. - Why: A password form with no framing restriction can be embedded and clickjacked. - Fix: Verify the header set with the Mega Security Analyzer and add the headers at the host or CDN (_headers file). - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). ### Authors and creators - [ ] **A2.1 Amazon Author Page** - Pass: An amazon.com/author URL appears in sameAs or the body text. - Fail: E-E-A-T Analyzer reports a missing Amazon author reference as informational. - Numbers and lists the tool uses: /amazon\.com\/author/i on sameAs or substring 'amazon.com/author' in body text; Author Central: claim the books, add biography, author photo, blog RSS feed, website and social links; snippet "sameAs": "https://www.amazon.com/author/yourname"; E-E-A-T Generator shows the field only for the author industry. - Why: Authors need entity convergence across Amazon, Goodreads and their own site. - Fix: Set up Amazon Author Central and add the author page URL to sameAs. - Verify: [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [E-E-A-T Generator](https://jwatte.com/tools/eeat-generator/). ### Aviation asset management - [ ] **A3.1 Leadership / dealmaker bio page carries no Person schema** - Pass: Bio pages carry Person schema. - Numbers and lists the tool uses: gated on a bio page. - Why: The firm's authority is its named principals. - Fix: Emit Person with jobTitle, worksFor, knowsAbout and sameAs. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org Person. - [ ] **A3.2 No ISTAT (International Society of Transport Aircraft Trading) membership/affiliation referenced** - Pass: The About page mentions ISTAT membership. - Numbers and lists the tool uses: /\bistat\b|international society of transport aircraft trading/i. - Why: ISTAT is the canonical industry body and a B2B authority anchor. - Fix: State the membership and add the ISTAT reference to sameAs or memberOf. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A3.3 The site references funds / ABS / JVs / institutional capital but no securities-marketing disclaimer was detected** - Pass: Pages that mention funds, securitizations, joint ventures or institutional capital carry a no-offer disclaimer. - Numbers and lists the tool uses: fund-raising /\bfund\b|\babs\b|asset-backed|securitization|capital partners|institutional (?:investors?|capital)|raise(?:d|s)? capital|joint venture|\bjv\b/i; disclaimer /this (?:is not|does not constitute) an offer|not an offer to (?:sell|buy)|for institutional investors only|accredited investors?|regulation d|private placement|no offer or solicitation/i. - Why: Investor-facing pages should carry a no-offer notice; the tool flags rather than assumes. - Fix: Add the notice and route the wording through securities counsel. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A3.4 `<n>` aviation-asset-management-readiness issue(s)** - Pass: No aviation-asset-management-readiness issue is detected across bio, portfolio, capabilities, news, contact and About contexts. - Numbers and lists the tool uses: ISTAT and AWG anchors; prompt rules: firm ['FinancialService','Organization'] with parentOrganization Corporation and tickerSymbol, sameAs LinkedIn and ISTAT, areaServed Worldwide; Person bios with knowsAbout and memberOf ISTAT; fleet as ItemList; NewsArticle with author, datePublished and publisher; securities-marketing disclaimer on investor-facing pages; validate; never assert ISTAT or AWG membership, AUM or fleet counts unverified. - Why: Citeability as an aircraft lessor to AI search and B2B counterparties depends on these signals. - Fix: Work through the listed issues with the prompt rules above, never asserting unverified memberships, AUM or fleet counts. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A3.5 No dedicated capabilities / portfolio / fleet page detected** - Pass: The site has a portfolio, fleet or capabilities page. - Fail: The About page is standing in for a capabilities surface. - Numbers and lists the tool uses: portfolio page /\/(fleet|portfolio|aircraft|assets?|our-fleet|aircraft-portfolio)(\/|$)/; capabilities page /\/(services|capabilities|what-we-do|solutions|asset-management|trading|leasing|expertise)(\/|$)/; flagged when the current page is an About page (or the home page) and its path matches neither the portfolio nor the capabilities pattern (Mega Analyzer). - Why: Without a structured what-we-do page the site has a topical-authority gap and a B2B credibility gap. - Fix: Add a structured capabilities or fleet page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). ### B2B SaaS - [ ] **A4.1 This page has no Open Graph tags (og:title / og:description / og:image)** - Pass: An inner route has og:title and a twitter:card. - Fail: An inner route (path depth of 1 or more, not the home page) that has a title but no og:title; or, on any page, Open Graph is present but there is no twitter:card meta. Both go to the same issues list. - Numbers and lists the tool uses: hasOg = og:title present; depth = path segments >= 1; not the home page. - Why: Shares on LinkedIn, X, Slack and iMessage render as bare links. - Fix: Set per-route og:* tags and twitter:card summary_large_image. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: Open Graph; Twitter Cards. - [ ] **A4.2 This page's `<title>` is a generic section label rather than this page's actual topic** - Pass: The title is specific to the page, or the first H1 is short. - Fail: An inner page whose title starts with a generic label while the first H1 is 25 or more characters. - Numbers and lists the tool uses: generic regex /^\s*(?:blog|news|customer stor(?:y|ies)|case stud(?:y|ies)|resources?|article|press|updates?|changelog)\b/i; specific H1 = first H1 length >= 25; not the home page. - Why: The title is the strongest per-page topic signal and the label AI answers cite. - Fix: Set the title to '`<H1>` | `<Brand>`'. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A4.3 No SoftwareApplication / WebApplication JSON-LD on a product / pricing / home page** - Pass: Home, product and pricing pages carry a SoftwareApplication or WebApplication node. - Numbers and lists the tool uses: applicationCategory BusinessApplication, operatingSystem Web, offers, featureList, provider @id (Mega Analyzer). - Why: It tells AI engines there is a product to recommend. - Fix: Emit SoftwareApplication with applicationCategory, operatingSystem, offers, featureList and provider @id. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org SoftwareApplication. - [ ] **A4.4 `<n>` SaaS-readiness issue(s)** - Pass: No SaaS readiness issues are reported for the machine-readable product layer. - Numbers and lists the tool uses: gate: SoftwareApplication schema, or product plus demo or trial plus login or pricing signals; signals covered: SoftwareApplication or WebApplication typing, Organization entity graph with sameAs and founder, WebSite node, FAQPage over the visible FAQ, per-page Open Graph, unique titles, BreadcrumbList on nested routes, self-referencing canonical; FTC 16 CFR Part 465 for ratings (Mega Analyzer). - Why: Fixing the layer lets AI answer engines recommend the product, search show distinct pages, and shared links render as cards. - Fix: SoftwareApplication on home, product and pricing pages with @id `<site>`#software, applicationCategory BusinessApplication, operatingSystem Web, offers, featureList and provider @id; one global Organization with founder and sameAs plus a WebSite node; FAQPage matching visible text; BreadcrumbList on nested routes; validate every block; never invent a founder, review count, rating or feature. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org SoftwareApplication, WebApplication, Organization, WebSite, FAQPage, BreadcrumbList; FTC 16 CFR Part 465. - [ ] **A4.5 There is a visible FAQ on the page but no FAQPage schema** - Pass: FAQPage schema is present. - Fail: A visible FAQ section with three or more question marks has no FAQPage schema. - Numbers and lists the tool uses: visibleFaq = (/frequently asked questions/i or /(^|[\s>(])FAQs?([\s<):.]|$)/) and question marks >= 3 (mega-analyzer). - Why: Question and answer pairs are the atomic shape AI Overviews, ChatGPT and Perplexity lift. - Fix: Wrap each Q&A in FAQPage and keep the schema text identical to the visible text. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org FAQPage. - [ ] **A4.6 SaaS-B2B: Fewer than 2 dev-surface links visible (/docs /api /changelog /status /security)** - Pass: At least 2 developer-surface paths are linked from the page. - Numbers and lists the tool uses: paths /docs, /api, /api-reference, /api-docs, /developers, /changelog, /status, /security; threshold 2. - Why: A visible developer surface signals an integrable product to agents and buyers. - Fix: Link /docs, /api, /changelog, /status and /security from the site. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A4.7 SaaS-B2B: No customer logos / case studies / G2 / Capterra outbound link** - Pass: Social-proof wording or a link to a software review site is present. - Numbers and lists the tool uses: /(?:customer\s+logos?|trusted\s+by|case\s+stud(?:y|ies)|customers?\s+(?:say|love))/i; links /g2\.com\/products|capterra\.com\/p\/|trustradius\.com|gartner\.com\/reviews|producthunt\.com/i. - Why: Social proof is the trust signal B2B buyers expect. - Fix: Add customer logos, case studies or G2 and Capterra links. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A4.8 Organization node names no founder** - Pass: The Organization node carries a founder or founders property. - Numbers and lists the tool uses: /"founder"\s*:|"founders"\s*:/i; gated on an Organization node on the About or home page. - Why: Founders are a strong entity and trust signal. - Fix: Add founder Person entries with jobTitle and a LinkedIn sameAs. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org founder. - [ ] **A4.9 Data Processing Addendum: scope through termination** - Pass: A SaaS business publishes a DPA covering scope, processor obligations, sub-processors, international transfers, data-subject requests, audits and termination, plus a subscription and billing clause in its terms. - Numbers and lists the tool uses: generated only for the saas business type; governs GDPR, UK-GDPR, CCPA/CPRA; processor acts on documented instructions only, duration = term of the Agreement plus the Privacy Policy retention, data subjects = end users of the Controller's account, no special-category data required; seven processor duties (a) to (g) with technical and organizational measures per Article 32 GDPR (documented instructions, confidentiality, technical and organizational measures, authorized sub-processors, assistance with requests and DPIAs, delete or return at end of Service, compliance information); sub-processor list at `<siteUrl>`/subprocessors/ with 30 days' notice of additions and a right to object; EU Standard Contractual Clauses (Decision 2021/914) and UK IDTA; Art. 15 to 22 requests forwarded within 5 business days; audit once annually on 30 days' written notice at the Controller's expense, SOC 2 or ISO 27001 reports accepted; deletion within 30 days of termination with certification on request; terms of service subscription clause: auto-renewal at the selected interval, cancel any time effective at period end, no pro-rated refunds except where required by law. - Why: SaaS buyers expect a DPA, a sub-processor list and clear billing terms before they sign. - Fix: Publish the DPA and a sub-processor list at /subprocessors/, and add the subscription clause to the terms. - Verify: [Legal Pages Generator](https://jwatte.com/tools/legal-pages-generator/). Standard: GDPR Article 32; EU SCC Decision 2021/914; UK IDTA; SOC 2; ISO 27001. - [ ] **A4.10 Data Processing Addendum states security measures and a breach-notification deadline** - Pass: The DPA commits to TLS 1.3 in transit, encryption at rest, least-privilege access with quarterly reviews, admin logging, annual penetration testing, documented incident response and background checks, and to notifying the controller within 48 hours of a breach. - Numbers and lists the tool uses: TLS 1.3; quarterly access reviews; annual penetration testing; breach notification within 48 hours with Article 33(3) information. - Why: Business customers in the EU need these commitments in writing before they can lawfully hand you personal data. - Fix: Publish the DPA only if the business actually operates each listed control. - Verify: [Legal Pages Generator](https://jwatte.com/tools/legal-pages-generator/). Standard: GDPR Article 32; GDPR Article 33(3). - [ ] **A4.11 SaaS-B2B: No visible pricing tier or /pricing page link** - Pass: A price-per-unit string appears in the body or schema, or a /pricing link exists. - Numbers and lists the tool uses: /\$\d+(?:[.,]\d{2})?\s*(?:\/|per)\s*(?:mo|month|seat|user|api|request|event|gb)/i on body plus schema; link /\/pricing\/?$/i (Mega Analyzer). - Why: Pricing transparency is a trust signal for software buyers. - Fix: Publish pricing tiers or link a /pricing page from the navigation. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A4.12 SaaS-B2B: security compliance badge mentioned** - Pass: The body or schema mentions SOC 2, ISO 27001, ISO 27017, HIPAA, GDPR, PCI DSS, FedRAMP or HITRUST. - Fail: The SaaS-B2B trust signals line lists the item in red: No SOC 2 / ISO 27001 / HIPAA / GDPR / PCI / FedRAMP / HITRUST mention. - Numbers and lists the tool uses: regex /(?:SOC\s*2(?:\s+type\s+(?:i|ii))?|ISO[- ]?27001|ISO\s*27017|HIPAA\s+(?:compliant|covered)|GDPR\s+(?:compliant|ready)|PCI[- ]DSS|FedRAMP|HITRUST)/i. - Why: B2B buyers treat a published security attestation as a gate before they will talk to sales. - Fix: Publish your compliance attestations on a security or trust page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). ### Butchers and meat markets - [ ] **A5.1 You ship perishable meat but the cold-chain logistics are invisible to machines** - Pass: Shipping pages and product pages carry OfferShippingDetails with a ShippingDeliveryTime. - Numbers and lists the tool uses: deliveryTime /"deliveryTime"|"ShippingDeliveryTime"|"handlingTime"|"transitTime"/i; gated on nationwide shipping on product, shipping or home pages (Mega Analyzer). - Why: 'Will it arrive frozen and what days do you ship' is the top pre-purchase question for shipped food. - Fix: Encode shippingDestination and ShippingDeliveryTime with handlingTime, transitTime, cutoffTime and businessDays. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org OfferShippingDetails, ShippingDeliveryTime. - [ ] **A5.2 There is a recipes section but no Recipe JSON-LD** - Pass: Every recipe page carries Recipe schema. - Numbers and lists the tool uses: recipes linked /\/recipes?\b|>\s*recipes?\s*</i or a recipe page or index (Mega Analyzer). - Why: Recipe is the biggest answer-engine lane for a food brand. - Fix: Emit Recipe per page and link each recipeIngredient to the shop Product. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org Recipe. - [ ] **A5.3 The page sells provenance ("`<value>`") in prose, but the Product schema carries none of it** - Pass: Provenance claims in the copy are encoded as additionalProperty or countryOfOrigin on the Product. - Numbers and lists the tool uses: claim regex /\b(grass[- ]?fed|grass[- ]?finished|pasture[- ]?raised|dry[- ]?aged|\d+[- ]?day aged|aged beef|heritage breed|heirloom breed|berkshire|duroc|wagyu|angus|regenerative|locally (?:raised|sourced)|northwest (?:raised|produced|grown)|family (?:ranch|farm)|raised without (?:antibiotics|hormones)|no (?:added )?hormones)\b/i on the title plus first 6000 characters of the body (Mega Analyzer). - Why: The premium attribute is invisible to AI shoppers unless it is structured. - Fix: Add additionalProperty PropertyValue entries (raising practice, breed, aging, source) and countryOfOrigin, only for what you can substantiate. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org additionalProperty. - [ ] **A5.4 No per-unit price (UnitPriceSpecification / referenceQuantity) in the offer** - Pass: Product offers carry a UnitPriceSpecification per pound. - Numbers and lists the tool uses: regex /"UnitPriceSpecification"|"referenceQuantity"/i; unitCode LBR; skipped on bundle pages (Mega Analyzer). - Why: Meat shoppers compare on price per pound. - Fix: Add UnitPriceSpecification with referenceQuantity value 1 and unitCode LBR. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org UnitPriceSpecification. - [ ] **A5.5 This is a processed / multi-ingredient item but there is no nutrition (NutritionInformation) in schema** - Pass: Processed or multi-ingredient items carry NutritionInformation. - Numbers and lists the tool uses: processed title regex /\b(sausage|bacon|chorizo|bratwurst|bologna|frank|wiener|hot ?dog|jerky|marinated|seasoned|cured|smoked|breaded|seafood|salmon|shrimp|crab|patties|links?|brats?|kielbasa|pepperoni|salami)\b/i on the title; nutrition /"nutrition"\s*:|"NutritionInformation"/i; skipped on bundle pages (Mega Analyzer). - Why: Processed foods carry Nutrition Facts and allergen statements; single-ingredient raw cuts are exempt. - Fix: Add nutrition NutritionInformation plus an ingredient and allergen line. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FDA Nutrition Facts. - [ ] **A5.6 This freezer pack / bundle is modelled as a single bare Product with no contents** - Pass: Bundle pages itemize contents with hasPart, isRelatedTo, OfferCatalog or itemListElement. - Numbers and lists the tool uses: regex /"hasPart"|"isRelatedTo"|"OfferCatalog"|"itemListElement"/i; bundle page = product page with freezer terms or /\b(pack|bundle|box|sampler|variety|assortment|lovers? pack)\b/i in the title (Mega Analyzer). - Why: Shoppers need the cuts, total weight and per-portion value. - Fix: Model hasPart or isRelatedTo entries with total weight and a per-pound UnitPriceSpecification. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org hasPart. - [ ] **A5.7 No perishable-correct return / guarantee language for shipped meat** - Pass: Shipping, product and FAQ pages state a replacement guarantee and encode MerchantReturnNotPermitted. - Numbers and lists the tool uses: regex /MerchantReturnNotPermitted|not (?:eligible|accepted) for return|cannot be returned|no returns? (?:on|for) (?:food|perishable|meat)|all sales final|satisfaction guarantee|replace(?:d|ment)? (?:it|your order)|arrive(?:s|d)? (?:thawed|spoiled)/i; gated on nationwide shipping (Mega Analyzer). - Why: Food is non-returnable, so a standard 30-day return policy is the wrong model. - Fix: State a replacement guarantee in copy and encode returnPolicyCategory MerchantReturnNotPermitted. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org MerchantReturnPolicy. - [ ] **A5.8 `<n>` craft-butcher / meat-DTC-readiness issue(s)** - Pass: No craft-butcher or meat-DTC readiness issues are reported; when issues exist an AI fix prompt lists them. - Numbers and lists the tool uses: USDA FSIS; USDA NOP 7 CFR 205; USDA Product of USA (2026); FTC Made in USA 16 CFR Part 323; FDA FALCPA allergens; FSMA Sanitary Transportation; USDA Safe Handling Instructions; shop node additionalType Wikidata Q1338910 (Mega Analyzer). - Why: Machine-readable claims carry the same liability as visible copy, so USDA, FTC and FDA label and shipping claims must be defensible. - Fix: Add a second [GroceryStore, LocalBusiness] shop node with @id `<site>`#shop, address, geo, hours, areaServed and parentOrganization; perishable OfferShippingDetails with a ship-day window; Recipe schema; provenance as additionalProperty and countryOfOrigin; per-pound UnitPriceSpecification and NutritionInformation on processed items; itemized bundles; MerchantReturnNotPermitted with a replacement guarantee; food-safety guidance; substantiate every claim and never invent prices, weights, ranches, practices, nutrition values or origin facts. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: USDA FSIS; USDA NOP 7 CFR 205; 16 CFR Part 323; FALCPA; FSMA. - [ ] **A5.9 This is a hybrid bricks-and-clicks butcher but the only business entity in schema is the online brand** - Pass: A local storefront business node (GroceryStore, LocalBusiness, Store or FoodEstablishment) is detected. - Fail: Home, about or local page mentions a storefront or local delivery but no local business node exists; sub-issues when that node lacks PostalAddress, geo, openingHoursSpecification or areaServed. - Numbers and lists the tool uses: hasLocalBiz types /LocalBusiness|Store|GroceryStore|FoodEstablishment/i; localDelivery /\b(local delivery|same-?day delivery|deliver (?:locally|in town)|free local|local pickup|curbside)\b/i; additionalType https://www.wikidata.org/wiki/Q1338910. - Why: Without a local node, "butcher near me" and the local pack cannot place the shop. - Fix: Emit a GroceryStore plus LocalBusiness node with address, geo, telephone, hours, areaServed and parentOrganization. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org GroceryStore. - [ ] **A5.10 No storage / thawing / safe-handling guidance for raw meat** - Pass: Handling guidance is present. - Fail: A product, FAQ or shipping page on a store that ships nationwide has no handling guidance. - Numbers and lists the tool uses: /\b(safe handling|keep (?:frozen|refrigerated)|thaw|defrost|store (?:frozen|in the freezer)|refrigerate|cook to (?:an internal|\d+)|internal temperature|shelf life|use by|best (?:by|within))\b/i (Mega Analyzer). - Why: USDA mandates safe-handling instructions on the package, and online guidance cuts returns. - Fix: Add a storage and handling section and a matching FAQPage entry. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: USDA Safe Handling Instructions. - [ ] **A5.11 Regulated meat-label claim detected ("`<value>`")** - Pass: No regulated label claim appears on product, about or home pages. - Warn: A claim such as grass-fed, organic, all-natural, no hormones, antibiotic-free, pasture-raised, free-range, humanely raised or non-GMO is flagged as an advisory to verify. - Numbers and lists the tool uses: /\b(grass[- ]?fed|grass[- ]?finished|organic|all[- ]?natural|\bnatural\b|no (?:added )?hormones|hormone[- ]?free|raised without antibiotics|no antibiotics|antibiotic[- ]?free|pasture[- ]?raised|free[- ]?range|humanely raised|non[- ]?gmo)\b/i on product, about and home pages; reported as an informational issue (Mega Analyzer). - Why: Label claims must be documented and truthful in both copy and schema. - Fix: Confirm each claim with the USDA-inspected processor or an FSIS-approved label. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FSIS-GD-2024-0006; 7 CFR Part 205; 9 CFR 317.8. - [ ] **A5.12 Premium breed / grade claim detected ("`<value>`")** - Pass: No breed or USDA grade claim appears on product pages. - Warn: A claim such as wagyu, Angus, USDA Prime or Choice is flagged as an advisory to verify. - Numbers and lists the tool uses: /\b(wagyu|kobe|akaushi|certified angus|\bangus\b|usda (?:prime|choice|select)|prime grade|choice grade)\b/i on product pages; reported as an informational issue (Mega Analyzer). - Why: An unsubstantiated grade or breed claim is FSIS misbranding and an FTC Section 5 risk. - Fix: Keep the documentation and add the verified grade or breed to Product.additionalProperty. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: 7 CFR Part 54; 9 CFR 317.8; FTC Section 5. - [ ] **A5.13 Origin claim detected ("`<value>`")** - Pass: No origin claim appears on product, about or home pages. - Warn: A Product of USA, Made in USA, American-raised or locally raised claim is flagged as an advisory to verify. - Numbers and lists the tool uses: /\b(product of (?:the )?usa|made in (?:the )?usa|american(?:-raised| beef| pork| made)?|raised in (?:the )?(?:usa|america|idaho)|u\.s\.a\.|locally (?:raised|sourced|produced)|northwest (?:raised|produced))\b/i on product, about and home pages; USDA rule compliance date January 1, 2026 (Mega Analyzer). - Why: USDA requires the animal to be born, raised, slaughtered and processed in the US, and the FTC applies 'all or virtually all'. - Fix: Make the claim substantiable and name the region or ranches behind 'locally raised'. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: USDA Product of USA rule (2026); FTC 16 CFR Part 323. - [ ] **A5.14 Processed or seafood items are sold but no allergen information is surfaced** - Pass: An allergen statement accompanies processed or seafood products. - Numbers and lists the tool uses: /\b(allergen|contains:?\s|major allergen|may contain|shellfish|crustacean|processed in a facility)\b/i on product pages that sell seafood or processed items (Mega Analyzer). - Why: Major food allergens must be declared. - Fix: Add a Contains line and an ingredient statement to each affected product. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FDA FALCPA, 21 U.S.C. 343(w). - [ ] **A5.15 Shipping perishable food but the cold-chain method is not disclosed** - Pass: The cold-chain shipping method is disclosed. - Numbers and lists the tool uses: /\b(dry ice|gel pack|gel-?pack|insulated|cooler|temperature-?controlled|stays? frozen|arrive(?:s)? frozen|cold chain|refrigerated shipping)\b/i on shipping and home pages when the store ships nationwide (Mega Analyzer). - Why: Shoppers will not buy frozen meat without knowing how it travels. - Fix: State the packing and shipping method prominently. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FDA FSMA Sanitary Transportation rule, 21 CFR Part 1 Subpart O. - [ ] **A5.16 On Shopify, most of the above is theme JSON-LD + metafields + an app, not a rebuild** - Pass: The site is not on Shopify, or it has no open issues. - Warn: The site is on Shopify and has open issues; the fixes are theme JSON-LD, metafields and an app rather than a rebuild. - Numbers and lists the tool uses: platform === 'Shopify' with at least one issue. - Why: Theme-level fixes apply across every product at once. - Fix: Request the fixes by name from the theme maintainer. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). ### Car washes - [ ] **A6.1 Reads as Q&A but no FAQPage JSON-LD** - Pass: The FAQ page carries FAQPage schema. - Fail: A home, FAQ or service page contains question marks in the body but has no FAQPage schema. - Numbers and lists the tool uses: Pages: home, FAQ, service; /\?(?:\s|$)/ on the full body (mega-analyzer). - Why: Cancel-anytime and scratch or touchless questions are high-intent for a car wash. - Fix: Wrap the real questions in FAQPage. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org FAQPage. - [ ] **A6.2 Business node has no amenityFeature** - Pass: The car wash business node has amenityFeature on the homepage. - Numbers and lists the tool uses: amenities: free vacuums, touchless or brushless, ceramic coating, tunnel or express, self-serve bays, detailing, dog wash. - Why: Feature filters in the map pack depend on amenityFeature. - Fix: Add amenityFeature entries for the features you offer (free vacuums, touchless, ceramic, tunnel, self-serve, detailing, dog wash). - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org LocalBusiness. - [ ] **A6.3 `<n>` car-wash-readiness issue(s)** - Pass: No car-wash-readiness issues detected. - Numbers and lists the tool uses: gate: car wash, express, touchless, self-serve, detailing or unlimited-wash-club signals, or AutoWash schema; signals: unlimited monthly membership auto-renewal (ROSCA and California, New York, Colorado Automatic Renewal Laws: clear renewal terms, express consent, easy online cancellation; the FTC Click-to-Cancel rule was vacated July 2025 but the obligations remain), AutoWash schema, packages as Offer, AggregateRating or Review (FTC 16 CFR Part 465), GBP, FAQ, app plus license-plate recognition, FTC Green Guides and substantiation, accessibility, Spanish and hreflang; context flags: homepage, packages or menu, membership, FAQ, contact, hasMembership; reference /blog/blog-mega-analyzer-car-wash-readiness/. - Why: Fixing these wins "car wash near me", makes the wash-club auto-renewal compliant, and keeps review, green and superiority claims substantiable. - Fix: If you sell a membership, state the recurring price, frequency and "automatically renews until canceled" next to the join button, require express consent with no pre-checked box, and offer online cancellation matching the signup channel. Emit one AutoWash node per location (@id `<site>`/#autowash with NAP, geo, hours, priceRange, paymentAccepted, sameAs to GBP, Yelp, Facebook and Instagram, and amenityFeature), publish wash tiers as an OfferCatalog of Offers with the unlimited plan as an Offer with a monthly UnitPriceSpecification, disclose plate-data handling in the privacy policy, use only real reviews, make eco and superiority claims specific, add FAQPage, an accessibility statement and Spanish hreflang for membership pages, and validate every JSON-LD block. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: ROSCA; California / New York / Colorado Automatic Renewal Laws; FTC 16 CFR Part 465; FTC Green Guides; schema.org AutoWash, OfferCatalog, Offer, UnitPriceSpecification, FAQPage; WCAG 2.1 AA. - [ ] **A6.4 Ratings shown/claimed but no machine-readable AggregateRating / Review schema** - Pass: Rating claims or review widgets on the home or contact page are backed by AggregateRating or Review schema, or the page makes no rating claim. - Warn: When schema is present the tool asks you to confirm it reconciles with the real platform total. - Numbers and lists the tool uses: claims /\b5-?star|highly rated|top-?rated|best car wash|voted best\b/i; widget /yelp|google review|\b\d(?:\.\d)?\s*(?:out of|\/)\s*5\s*star/i; gated on the home or contact page; FTC penalty up to $51,744 per violation. - Why: A 'voted best' claim must be substantiated. - Fix: Emit AggregateRating from real reviews. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FTC 16 CFR Part 465. - [ ] **A6.5 No accessibility statement or signal** - Pass: Any audited page where the signal regex matches the raw HTML, or that is the accessibility page, gets the pass row 'Accessibility / ADA signal present'. - Fail: The homepage matches none of the signal phrases. - Numbers and lists the tool uses: /accessibility statement|web content accessibility|wcag|ada compliant|ada accessible|wheelchair accessible/i tested on the raw HTML, or isAccessibilityPage; the fail fires on the homepage only; the pass fires on any page where the signal matches. - Why: Car washes are ADA Title III public accommodations, and an inaccessible membership cancel flow compounds auto-renewal risk. - Fix: Publish a statement, conform to WCAG 2.1 AA, and keep the cancel flow accessible. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: ADA Title III; WCAG 2.1 AA. - [ ] **A6.6 MEMBERSHIP / UNLIMITED PLAN with NO clear auto-renewal disclosure** - Pass: Auto-renewal disclosure language appears near the membership offer. - Numbers and lists the tool uses: membership /\bunlimited\b|wash club|membership|monthly (?:plan|wash|membership)|\/month|per month|auto[ -]?renew|recurring|join (?:now|today|the club)/i; disclosure /auto(?:matically)?[ -]?renew|recurring (?:monthly|billing|charge)|until (?:you )?cancel|renews monthly|monthly recurring/i; state law effective dates CA 7/1/2025, NY 11/5/2025, CO 2/16/2026 (Mega Analyzer). - Why: ROSCA and state automatic-renewal laws require the price, frequency and 'renews until canceled' next to signup. - Fix: Put the disclosure in plain text immediately above the join button. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: ROSCA; California, New York, Colorado Automatic Renewal Laws. - [ ] **A6.7 Auto-renewal is mentioned but the recurring price + frequency are not clearly stated as "$X/month" near the signup** - Pass: A recurring price string such as $X/month appears near the signup. - Numbers and lists the tool uses: /\$\d[\d.,]*\s*(?:\/|per )\s*mo|\/month/i; checked on membership and home pages when a renewal disclosure exists (Mega Analyzer). - Why: The exact recurring amount must be stated at the point of consent. - Fix: State the recurring amount and billing interval next to the signup button. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: ROSCA. - [ ] **A6.8 MEMBERSHIP with no findable cancellation path** - Pass: A cancellation path is findable. - Numbers and lists the tool uses: /cancel (?:your )?membership|cancel (?:online|anytime)|manage (?:your )?membership|cancellation/i (Mega Analyzer). - Why: ROSCA requires a simple cancel mechanism, and California, Colorado and New York require online cancellation for online signups. - Fix: Add a clear Cancel Membership link or portal that matches the signup medium. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: ROSCA. - [ ] **A6.9 Membership offered but no explanation of how members enter (app + license-plate recognition)** - Pass: The page explains app or license-plate entry. - Numbers and lists the tool uses: /license plate|no sticker|app|scan|auto-?detected|plate recognition/i (Mega Analyzer). - Why: Members need to know how entry works, and plate-data handling belongs in the privacy policy. - Fix: Add a 'how membership works' section and disclose plate-data handling. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A6.10 Environmental claim ("`<value>`") with no specific basis** - Pass: Any eco or water claim carries a percentage, reclaim or ENERGY STAR basis. - Numbers and lists the tool uses: green claim /\b(eco-?friendly|green|environmentally friendly|water saving|water reclamation|water recycling|biodegradable|sustainable)\b/i; basis /\b\d+%\b|reclaim|energy star/i (Mega Analyzer). - Why: The Green Guides require specific substantiation, and 'biodegradable' needs a complete-breakdown basis. - Fix: Qualify the claim with the number behind it or drop it. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FTC Green Guides. - [ ] **A6.11 Unqualified superiority / finish claim ("`<value>`")** - Pass: No unqualified superiority or finish-safety claim appears. - Numbers and lists the tool uses: /\b(best car wash|#1|cheapest|spot-?free|scratch-?free|100% safe|won'?t scratch|guaranteed)\b/i (Mega Analyzer). - Why: Objective claims need a reasonable basis before they are published. - Fix: Qualify the claim, back it with a guarantee policy, or soften it. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FTC substantiation. - [ ] **A6.12 No Spanish-language signal** - Pass: Spanish content or an es hreflang exists. - Numbers and lists the tool uses: /hreflang=["']es|lang=["']es|\/es\/|espa[nñ]ol|lavado de autos/i; checked on the home page (Mega Analyzer). - Why: Auto-renewal disclosures are most defensible in the customer's own language. - Fix: Add Spanish core and membership pages with reciprocal hreflang. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). ### Churches and parishes - [ ] **A7.1 Church / Place schema present** - Pass: A place of worship declares Church, CatholicChurch, PlaceOfWorship, ReligiousOrganization or a tradition-specific subtype. - Warn: Missing on a page that looks Catholic (Mega Analyzer warn). - Fail: No Church or Place schema is found (analyzer). - Numbers and lists the tool uses: regex /Church|ReligiousOrganization|PlaceOfWorship|Synagogue|Mosque|HinduTemple|BuddhistTemple/i (Mega Analyzer religious); /CatholicChurch|PlaceOfWorship|^Church$/i with gate on Catholic links /\/(mass|parish|sacrament|confession|reconciliation|baptism|rcia|ocia|misa|diocese)(\/|$|-|\?)/i or copy /catholic|parish|\bdiocese\b|mass times/i (Mega Analyzer Catholic); /CatholicChurch|PlaceOfWorship|"@type"\s*:\s*"Church"/i with a Catholic-vocabulary gate on the HTML (analyzer). - Why: It is the entity anchor Google and AI bind 'church near me' answers to, and almost no parish in a 16-site audit had it. - Fix: Add CatholicChurch or Church JSON-LD with name, full address, geo, telephone and sameAs. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org Church, CatholicChurch, PlaceOfWorship. - [ ] **A7.2 Mass times marked up as Event / openingHours** - Pass: Recurring services are marked up as Event, EventSeries or OpeningHoursSpecification. - Fail: No Event or OpeningHoursSpecification is found (critical on Catholic parish pages). - Numbers and lists the tool uses: regex /Event|OpeningHoursSpecification/i (Mega Analyzer religious); /^Event$|OpeningHoursSpecification|EventSeries/i (Mega Analyzer Catholic). - Why: Without machine-readable service times AI answers Mass times from stale aggregators. - Fix: Mark each service as an Event with startTime or eventSchedule and inLanguage, or add OpeningHoursSpecification. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org Event, OpeningHoursSpecification. - [ ] **A7.3 Local-Religious: Service times rendered as text** - Pass: Service or Mass times appear as readable HTML text. - Warn: Mega Analyzer lists 'Service times rendered as text + OpeningHoursSpecification block' under Religious-org signals as a yellow opportunity (not a fail) when the lowercased body text has no service-time phrase; the parish analyzer warns 'No Mass times found as readable text' when no clock-time pattern is found anywhere in the HTML. - Numbers and lists the tool uses: Mega Analyzer, only when ymylVertical is Local-Religious: /(sunday\s+(?:service|worship)|saturday\s+(?:service|worship|shabbat)|friday\s+(?:prayer|jumu)|mass\s+times|service\s+times|worship\s+times)/i on lowercased body text, rendered as a religiousMissing opportunity; parish analyzer, only when the page looks Catholic: /\b\d{1,2}:\d{2}\s?(a\.?m\.?|p\.?m\.?)/i or /\b\d{1,2}\s?(a\.?m\.?|p\.?m\.?)\b/i anywhere in the HTML. - Why: Service times are the top query for worship sites, and times that live only in a PDF bulletin or an image cannot be read by search engines or AI. - Fix: Publish service times as HTML text at a stable URL such as /mass-times and add OpeningHoursSpecification. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org OpeningHoursSpecification. - [ ] **A7.4 Mass-time structured data present (Event / openingHours)** - Pass: Event, openingHoursSpecification or eventSchedule markup appears in the HTML. - Fail: No match renders 'Mass times are not machine-readable (no Event/openingHours schema)'. - Numbers and lists the tool uses: /"@type"\s*:\s*"Event"|openingHoursSpecification|eventSchedule/i. - Why: With no Event or openingHours markup, AI assistants fall back on stale third-party aggregators with the wrong times or the wrong diocese. - Fix: Mark each Mass as an Event with startDate or eventSchedule and tag inLanguage for Spanish or Latin Masses. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). Standard: schema.org Event / openingHoursSpecification. - [ ] **A7.5 Local-Religious: visible "Give / Donate / Tithe" link in main nav (primary conversion signal)** - Pass: At least one link points to a giving page or giving platform. - Numbers and lists the tool uses: href matches /\/(give|giving|donate|donation|tithe|offering|stewardship|generosity|pushpay|tithe\.ly|givelify|easytithe)\/?(?:$|\?|#)/i (Mega Analyzer). - Why: Giving is the primary conversion for a congregation site. - Fix: Add a Give or Donate link in the main navigation. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A7.6 FAQPage schema for common parish questions** - Pass: A FAQPage node is present on the parish site. - Fail: A missing FAQPage is reported as information only, not scored. - Numbers and lists the tool uses: schemaTypes matches /^FAQPage$/i (mega-analyzer). - Why: Parish questions such as Mass times, confession and registration are exactly what answer engines get asked. - Fix: Add FAQPage JSON-LD covering Mass times, confession, Spanish Mass, registration, OCIA and parking. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org FAQPage. ### CPA and accounting firms - [ ] **A8.1 No AICPA membership statement on the About / homepage** - Pass: The About page or homepage mentions AICPA membership. - Numbers and lists the tool uses: /aicpa|american institute of cpas|american institute of certified public accountants/i on body and footer; gated on an About page (/about, /about-us, /about-the-firm, /our-firm, /history, /who-we-are) or the homepage (/). - Why: AICPA membership is the canonical authority anchor for US CPA firms. - Fix: Add a 'Member of the American Institute of CPAs' line and memberOf on the firm JSON-LD. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A8.2 No AICPA Peer Review status referenced on the audit / assurance page** - Pass: Audit and assurance pages mention the firm's peer review status. - Numbers and lists the tool uses: /peer review/i; firms are peer-reviewed every 3 years; gated on an audit page. - Why: Peer review is the CPA equivalent of being verified by an independent reviewer. - Fix: State the review status and link the firm's public file at peerreview.aicpa.org. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: AICPA Peer Review. - [ ] **A8.3 No independence statement on the audit page** - Pass: Audit pages carry an independence statement. - Numbers and lists the tool uses: /\bindependence (rule|standards|policy|requirements)|independence in fact and appearance|yellow book/i; gated on an audit page. - Why: AICPA independence rules apply to all attest engagements. - Fix: Add a one-line statement of independence, citing the Yellow Book where applicable. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: AICPA Code of Professional Conduct. - [ ] **A8.4 No IRS Circular 230 acknowledgment on tax-services page** - Pass: Tax pages reference Circular 230 or practice before the IRS. - Numbers and lists the tool uses: /circular\s*230|irs (?:practice|representation|enrolled agent)/i; gated on a tax page. - Why: Circular 230 section 10.30 governs how tax practitioners advertise. - Fix: Add a footer line acknowledging practice before the IRS under Circular 230. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: Treasury Circular 230 section 10.30. - [ ] **A8.5 No tax outcomes depend on facts disclaimer on the tax page** - Pass: Tax pages carry a results disclaimer. - Numbers and lists the tool uses: /tax outcomes? depend on|no representations? as to results|outcomes? depend.{0,50}facts|results.{0,30}depend.{0,30}facts/i; gated on a tax page. - Why: This is the tax analog of 'prior results do not guarantee a similar outcome'. - Fix: Add: 'Tax outcomes depend on the specific facts of each engagement; no representations as to results are made in this material.'. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A8.6 `<n>` CPA-firm-readiness issue(s)** - Pass: No CPA-firm-readiness issue is detected across bio, practice, office, tax, audit and About contexts. - Numbers and lists the tool uses: IRS Circular 230 10.30; 16 CFR Part 314 (FTC Safeguards Rule, effective 2023-06-09); GLBA; prompt rules: fix invalid ['Person','Organization'] typing (Rank Math Local SEO set to Company or AccountingService); ProfilePage plus ['Person','Accountant'] with honorificSuffix CPA, hasCredential recognizedBy the State Board of Accountancy, memberOf AICPA and the state society; AccountingService per service page; firm ['AccountingService','Organization'] with memberOf AICPA; office PostalAddress and openingHoursSpecification (08:00 to 17:00 example); 'Member of the American Institute of CPAs' statement; Peer Review status with peerreview.aicpa.org link (verify first); Circular 230 footer line on tax pages; FTC Safeguards Rule / GLBA statement naming a Qualified Individual; independence statement (AICPA Code, GAO Yellow Book); validate; never invent ratings, memberships or license numbers. - Why: AICPA, state-board and Circular 230 expectations decide whether a CPA firm reads as credible and compliant. - Fix: Work through the listed issues with the prompt rules above, verifying peer review status first and never inventing memberships or license numbers. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: IRS Circular 230; 16 CFR Part 314. - [ ] **A8.7 CPA: FTC Safeguards Rule / GLBA compliance referenced** - Pass: The About, Privacy or Security page references GLBA, the Safeguards Rule or a written information security program. - Fail: No match on an About page or a path matching /privacy or /security. - Numbers and lists the tool uses: regex /\bglba\b|gramm[\s-]*leach[\s-]*bliley|safeguards rule|ftc safeguards|written information security|\bwisp\b/i; rule effective June 9, 2023; May 13, 2024 amendment requires notifying the FTC within 30 days of a breach involving unencrypted information of 500 or more consumers. - Why: CPA firms count as financial institutions under 16 CFR Part 314 and must maintain a written information security program with a Qualified Individual. - Fix: Add a short visible reference to your Safeguards Rule program on the Privacy or About page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: 16 CFR Part 314 (FTC Safeguards Rule); GLBA. ### Defense contractors - [ ] **A9.1 No ITAR / EAR / export-control statement on a hardware / cryptography / defense-article context page** - Pass: About or capabilities pages that discuss export, munitions, defense articles or cryptography carry an ITAR or EAR reference. - Numbers and lists the tool uses: ITAR /\bitar\b|international traffic in arms|22 cfr (?:120|121|122|123|124|125|126|127|128|129|130)/i on body and footer; EAR /\bear\s+(?:compliance|controlled|registered)\b|export administration regulations|15 cfr\s*7[3-7]\d|bureau of industry and security|\bbis\b\s+(?:license|registered)/i on body and footer; export context /\b(?:export|munitions|defense article|cryptograph|encryption|controlled item)\b/i on the first 12000 characters of body text; gated on an About or capabilities page. - Why: Defense-article registration and export licensing govern the work. - Fix: Add a statement of ITAR or EAR compliance without listing license numbers. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: 22 CFR 120-130 (ITAR); 15 CFR 730-774 (EAR). - [ ] **A9.2 No SAM.gov registration reference** - Pass: About or capabilities pages mention SAM.gov registration. - Numbers and lists the tool uses: /\bsam\.gov\b|system for award management|sam[\s-]?registered/i. - Why: All federal contractors must register at SAM.gov to receive awards. - Fix: State the registration status visibly with the verified CAGE code and UEI. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: SAM.gov. - [ ] **A9.3 No CAGE code disclosure on Capabilities / About** - Pass: The CAGE code is disclosed on the capabilities or About page. - Numbers and lists the tool uses: /\bcage\s*code\s*[:\-]?\s*[a-z0-9]/i; CAGE codes are 5 characters. - Why: CAGE is the lookup key in SAM.gov and DSBS. - Fix: Display the CAGE code on the capabilities page and in the footer. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A9.4 No UEI (Unique Entity Identifier) disclosure** - Pass: The UEI is disclosed on the capabilities or About page. - Numbers and lists the tool uses: /\buei\s*[:\-]?\s*[a-z0-9]|unique entity identifier/i; UEI is 12 characters and replaced DUNS in April 2022. - Why: The UEI is the canonical federal entity identifier. - Fix: Display the UEI alongside the CAGE code. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A9.5 No NAICS code disclosure on Capabilities / About** - Pass: Primary NAICS codes are listed on the capabilities or About page. - Numbers and lists the tool uses: /\bnaics\s*(?:code)?\s*[:\-]?\s*\d{4,6}|naics\s+\d{4,6}/i; typical codes 541330, 541512, 541714, 336411, 541715. - Why: NAICS codes drive set-aside qualification and procurement filtering. - Fix: List the firm's primary NAICS codes publicly. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A9.6 No Section 889 compliance reference** - Pass: The capabilities or About page references Section 889 or FAR 52.204-25 compliance. - Numbers and lists the tool uses: /section\s*889|huawei prohibition|ban on covered telecom|far\s*52\.204[\s-]?25/i. - Why: FAR 52.204-25 prohibits covered Chinese telecom equipment (Huawei, ZTE, Hytera, Hikvision, Dahua) in federal contracts. - Fix: Publish a Section 889 representation on the capabilities or compliance page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FAR 52.204-25; FY19 NDAA Section 889. - [ ] **A9.7 Hardware / manufacturing / materiel context without Buy American Act / Berry Amendment reference** - Pass: About, homepage or Capabilities pages that describe hardware, manufacturing or fabrication reference Buy American, the Berry Amendment or the Trade Agreements Act. - Numbers and lists the tool uses: /buy american|berry amendment|10\s*u\.s\.c\.\s*4862|trade agreements act/i on body plus footer; hardware context /\b(?:hardware|manufactur|fabricat|defense article|cryptograph|systems integrat)\b/i on the first 12000 characters of body; gated on the About page (homepage counts as About) or the Capabilities page. - Why: Domestic-content requirements govern federal procurement of materiel. - Fix: Add a compliance statement. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: 41 USC 8302 (Buy American Act); 10 USC 4862 (Berry Amendment). - [ ] **A9.8 Engineering / manufacturing / aerospace posture without ISO 9001 / AS9100 reference** - Pass: About, homepage or Capabilities pages that describe engineering, manufacturing or aerospace work reference ISO 9001, AS9100, ISO 27001 or ISO 20000. - Numbers and lists the tool uses: /\biso\s*9001\b|\bas9100\b|\biso\s*27001\b|\biso\s*20000\b/i on body plus footer; context /(?:engineering|manufactur|hardware|systems integrat|aerospace)/i on the first 12000 characters of body; gated on the About page (homepage counts as About) or the Capabilities page. - Why: Defense engineering and aerospace work typically requires ISO 9001 and/or AS9100. - Fix: State the certification status or target. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: ISO 9001; AS9100. - [ ] **A9.9 DCAA-compliance language detected** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: /\bdcaa\b/i (pass-only signal). - Why: DCAA compliance is a cost-accounting signal for federal contracts. - Fix: State DCAA-compliant accounting where it is true. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: DCAA. - [ ] **A9.10 Small-business set-aside identity (SDVOSB / WOSB / 8(a) / HUBZone) disclosed** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: /\bsdvosb\b|\bwosb\b|service[\s-]?disabled veteran[\s-]?owned|woman[\s-]?owned small business|hubzone|\b8$a$\b/i (pass-only signal). - Why: Set-aside identity drives eligibility for federal awards. - Fix: Disclose any verified set-aside status on the capabilities page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A9.11 Defense: CMMC level referenced on Capabilities / About** - Pass: The body or footer mentions CMMC or Cybersecurity Maturity Model Certification. - Fail: No match on a Capabilities or About page. - Numbers and lists the tool uses: regex /\bcmmc\b(?:\s*level\s*\d)?|cybersecurity maturity model certification/i; 32 CFR Part 170 effective December 16, 2024; DFARS acquisition rule effective November 10, 2025. - Why: CMMC requirements appear in live solicitations, so contracting officers look for it. Since July 13, 2026 CMMC Phase 2 is suspended, so solicitations ask only for a Level 1 (Self) or Level 2 (Self) assessment. - Fix: State your current CMMC level and self-assessment status on the Capabilities or About page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: 32 CFR Part 170 (CMMC 2.0). - [ ] **A9.12 Defense: DFARS 252.204-7012 or NIST SP 800-171 referenced** - Pass: The page references DFARS 252.204-7012 or NIST SP 800-171 (a separate pass line reports NIST SP 800-172, but it does not satisfy this check). - Fail: Neither appears on a Capabilities or About page. - Numbers and lists the tool uses: regexes /dfars\s*252\.204[\s-]?7012|252\.204[\s-]?7012/i and /nist\s*sp?\s*800[\s-]?171|nist\s*800[\s-]?171|sp\s*800[\s-]?171/i; NIST SP 800-171 has 110 controls. - Why: DFARS 252.204-7012 is the foundational DoD clause for handling controlled unclassified information. - Fix: Reference compliance with both on the Capabilities, About or Security page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: DFARS 252.204-7012; NIST SP 800-171. - [ ] **A9.13 Defense: cloud / SaaS offering references FedRAMP authorization** - Pass: FedRAMP is mentioned, or the page has no cloud context. - Fail: A Capabilities or About page has cloud context and no FedRAMP mention. - Numbers and lists the tool uses: regex /\bfedramp\b/i; cloud context /\b(?:cloud|saas|paas|iaas|platform|hosting|software-as-a-service)\b/i. - Why: Federal agencies can only buy cloud services that hold a FedRAMP authorization. - Fix: State the authorization level (Low, Moderate, High, DoD IL2, IL4, IL5, IL6, GovCloud) or the target you are pursuing. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FedRAMP. - [ ] **A9.14 Defense: cloud / SaaS context references SOC 2** - Pass: SOC 2 is mentioned, or the page has no cloud or managed-service context. - Fail: A Capabilities or About page matches cloud, saas, managed service, hosting or data platform and has no SOC 2 mention. - Numbers and lists the tool uses: regex /\bsoc\s*2\b|soc 2 type i{1,2}/i; context regex /(?:cloud|saas|managed service|hosting|data platform)/i. - Why: SOC 2 is the baseline customers expect before trusting a cloud service with their data. - Fix: State your SOC 2 audit status on the Capabilities or About page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: SOC 2. - [ ] **A9.15 Careers page does not mention security-clearance requirements** - Pass: Security-clearance language is present on the careers page. - Numbers and lists the tool uses: /security clearance|cleared (?:personnel|engineers|workforce|staff|employees)|ts\/sci|top\s*secret|active clearance/i; applies to careers pages matching /\/(careers|jobs|join-?us|opportunities|work-?at|hiring)(\/|$)/ (Mega Analyzer). - Why: Clearance language positions the company for defense work and doubles as an ITAR-related US-persons signal. - Fix: State the clearance level per role and the US citizenship baseline. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A9.16 No Capability Statement PDF on the Capabilities page** - Pass: The capabilities page references a capability statement. - Numbers and lists the tool uses: /capability statement|\bcap statement\b|capability brief/i; applies to capabilities pages matching /\/(capabilities|services|solutions|what-we-do|expertise|offerings|products|practice-areas?)(\/|$)/ (Mega Analyzer). - Why: The one-page capability statement is the standard hand-off document during government procurement. - Fix: Publish a Capability Statement PDF with CAGE, UEI, NAICS codes, past performance, set-asides and certifications. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). ### E-commerce - [ ] **A10.1 Store with international selling intent ships hreflang and multi-currency** - Pass: Hreflang or localized routing is detected on a store that signals international selling. - Fail: International intent is detected on the home or a product page with no hreflang. - Numbers and lists the tool uses: Intent regex /gdpr|popia|lgpd|pdpa|appi|international shipping|worldwide shipping|ships? (?:worldwide|internationally)|duties|customs|\beu\b|united kingdom/i; multi-currency regex /shopify-payment-button|currency.{0,10}(?:selector|switcher)|data-currency|money-format|\bcurrencies\b/i; evaluated on home and product pages (Mega Analyzer). - Why: Prices shown in the wrong currency are a top cause of international cart abandonment, and a single locale hides the store from regional search. - Fix: Publish localized URLs with hreflang plus x-default and enable multi-currency. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A10.2 Product has no brand** - Pass: The Product carries a brand. - Fail: A Product node on a product page has no brand (Mega Analyzer e-commerce issue). - Numbers and lists the tool uses: regex /"brand"\s*:/i on the JSON-LD text; runs only when the page is a product page (path matches /\/products?\//i, or Product plus Offer schema, or og:type product) and a Product or ProductGroup node is present (Mega Analyzer e-commerce module). - Why: Brand attributes the offer to the brand entity. - Fix: Add brand {"@type":"Brand","name":...} linked to the Organization @id. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org brand. - [ ] **A10.3 The page makes a country-of-origin claim ("`<value>`") in prose but the Product schema has no countryOfOrigin** - Pass: A made-in claim in the copy is matched by countryOfOrigin on the Product. - Numbers and lists the tool uses: claim regex /\b(made|handcrafted|hand-?made|crafted|manufactured|woven|tailored|sewn)\s+in\s+(italy|france|spain|portugal|england|the uk|japan|usa|the usa|america|u\.s\.a\.|switzerland|germany|turkey|mexico|peru|morocco|india|scotland)\b/i (Mega Analyzer). - Why: The provenance premium is invisible to machines, and origin claims must be truthful. - Fix: Add countryOfOrigin (and material) to the Product and qualify split-country production. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: 15 U.S.C. 45a. - [ ] **A10.4 Product describes a material (leather / silk / wool / metal etc.) in prose but has no material field** - Pass: The Product carries material when the copy names one. - Numbers and lists the tool uses: regex /\b(leather|cotton|silk|wool|cashmere|linen|suede|canvas|nylon|gold|silver|sterling|brass|steel|ceramic|wood)\b/i on the body (Mega Analyzer). - Why: Material-based filters and AI answers match on the field. - Fix: Add material to the Product. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org material. - [ ] **A10.5 A color appears in the product title/variant but the Product has no color field** - Pass: The Product carries color when a color appears in the title or variant. - Numbers and lists the tool uses: regex /\b(black|white|brown|tan|camel|navy|merlot|burgundy|beige|cream|red|blue|green|pink|gold|silver)\b/i on the title (Mega Analyzer). - Why: Color powers variant disambiguation in shopping surfaces. - Fix: Add color per variant or use ProductGroup with variesBy color. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org color. - [ ] **A10.6 The Product.image array has only `<n>` image while the page renders `<n>` product images** - Pass: The Product.image array carries the gallery images. - Fail: The schema has only one image while the page renders four or more product images. - Numbers and lists the tool uses: image match /"image"\s*:\s*("[^"]+"|\[[^\]]*\])/i; schema count < 2 and page images >= 4 (Mega Analyzer). - Why: Shopping surfaces reward multiple angles. - Fix: Put all gallery images in the image array. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org image. - [ ] **A10.7 Two or more WebSite nodes are emitted on this page (`<n>` found)** - Pass: Exactly one WebSite node is emitted. - Numbers and lists the tool uses: count /"@type"\s*:\s*"WebSite"/gi; fail at 2 or more (Mega Analyzer). - Why: Duplicate top-level entities confuse reconciliation and the sitelinks search box. - Fix: De-duplicate to one WebSite node with SearchAction. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org WebSite. - [ ] **A10.8 `<n>` e-commerce-readiness issue(s) (online store + AI shopping)** - Pass: No e-commerce readiness issues are reported across platform, product, collection, cart, policy, FAQ, about and home contexts. - Numbers and lists the tool uses: 16 CFR Part 465 (consumer reviews); 15 U.S.C. 45a (country of origin); 16 CFR Part 233 (reference pricing); CAN-SPAM and TCPA; WCAG 1.1.1 (Mega Analyzer). - Why: The aggregate covers citeability to AI shopping agents plus FTC review, origin and pricing rules. - Fix: One [OnlineStore, Organization] brand node with founder and sameAs; Product offers with price, priceCurrency, availability, itemCondition, priceValidUntil, seller @id, sku, gtin or mpn and all gallery images; shippingDetails and hasMerchantReturnPolicy; countryOfOrigin and material; color per variant; verified reviews only; FAQPage, CollectionPage, ItemList and BreadcrumbList; exactly one WebSite node on https://schema.org; compare-at prices must be bona fide. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: 16 CFR Part 465; 16 CFR Part 233. - [ ] **A10.9 This FAQ / shipping / returns / care page reads as Q&A but carries no FAQPage JSON-LD** - Pass: The FAQ page carries FAQPage schema. - Fail: The FAQ page, or a policy page with question-shaped copy, has no FAQPage schema. - Numbers and lists the tool uses: isPolicyPage /\/(policies|policy|shipping|returns?|refund|exchange|terms|privacy)(\/|$|-)/i with body /\b(how|what|when|do you|can i|return|exchange|ship|track|care|warranty)\b\?/i (mega-analyzer). - Why: This is one of the biggest AEO wins for a store, and most direct-to-consumer competitors skip it. - Fix: Wrap the questions in FAQPage and keep the answers factual. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org FAQPage. - [ ] **A10.10 Product page ships `<n>` of `<n>` images with no alt text** - Pass: A product page with 4 or more images has zero images missing alt. - Fail: IsProductPage && imgsMissingAlt > 3. - Numbers and lists the tool uses: fail when more than 3 missing; pass needs 0 missing and at least 4 images. - Why: A repeating product-page template turns one missing-alt pattern into a site-wide Level A failure and an ADA demand-letter target. - Fix: Set a descriptive alt from the product name plus the view (front, side, detail). - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: WCAG 1.1.1 (Level A); ADA Title III. - [ ] **A10.11 Reference / strike-through pricing detected ("was $X", "compare at", crossed-out price)** - Pass: No reference-price pattern appears. - Numbers and lists the tool uses: /\b(was|reg\.?|regular|compare at|originally|retail|msrp)\b\s*[:.]?\s*[\$€£]\s?\d/i on body text, or /`<s>`|`<del>`|line-through/i on the HTML (Mega Analyzer). - Why: A was or compare-at price must be a genuine former price. - Fix: Keep former-price claims honest and time-bounded. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FTC 16 CFR Part 233. - [ ] **A10.12 SMS / text-marketing capture detected** - Pass: Only an email capture is present (verify the CAN-SPAM footer and one-click unsubscribe on sends). - Fail: An SMS or text-marketing capture is present. - Numbers and lists the tool uses: SMS /\b(text|sms).{0,30}(?:offer|sign ?up|join|opt-?in)|by (?:submitting|signing up).{0,60}(?:text|sms|messages)|mobile (?:number|phone).{0,30}(?:offer|updates)/i; email /newsletter|sign ?up|subscribe|email.{0,20}(?:offer|discount|10% off|15% off|first order)|join (?:the )?(?:list|club)/i or a type=email input (Mega Analyzer). - Why: The TCPA requires prior express written consent before marketing texts. - Fix: Add an adjacent opt-in disclosure with message rates, frequency, STOP and HELP instructions and an unchecked consent box. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: TCPA; CAN-SPAM. - [ ] **A10.13 `<platform>` platform detected** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: Mega Analyzer: Shopify /cdn\.shopify\.com|\.myshopify\.com|shopify-section|x-shopify|window\.Shopify/i; WooCommerce /woocommerce|wc-|wp-content\/plugins\/woocommerce/i; BigCommerce /cdn\d*\.bigcommerce\.com|bigcommerce/i; Salesforce Commerce /demandware|dwstatic|commercecloud/i; Magento /magento|mage\/|static\/version/i; Centra /centra|centraqa/i. Mega SEO Analyzer Shopify storefront gate: /cdn\.shopify\.com/i, /shopify\.com\/s\//i, /Shopify\.theme/i, /data-shopify-/i, /<header-component\b/i, /<predictive-search\b/i, /\bShopify\.shop\b/i, or /shopify/i in the powered-by, x-shopid or x-shopify-stage header; theme version from /data-theme-version=["']([^"']+)["']/i. - Why: Naming the commerce platform switches on the platform-specific rule pack (Vendor field hygiene, Product schema completeness, empty-landing-page detection, theme-color, favicon, agent-readiness and Shopify-aware H1 hierarchy). - Fix: No fix; confirm the detected platform is right so the platform-specific checks apply. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). - [ ] **A10.14 Theme-color meta is present but empty** - Pass: The theme-color meta has a value. - Warn: A theme-color meta with empty content. - Numbers and lists the tool uses: regex /<meta[^>]+name=["']theme-color["'][^>]+content=["']\s*["']/i. - Why: An empty value fails to brand the mobile browser chrome. - Fix: Set a brand color in Shopify Admin, Online Store, Themes, Customize, Theme settings, Colors. - Verify: [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). - [ ] **A10.15 No `<link rel="icon">` in `<head>`** - Pass: A link rel=icon or shortcut icon exists. - Warn: No icon link in the head. - Numbers and lists the tool uses: regex /<link[^>]+rel=["'](?:icon|shortcut icon)["']/i. - Why: Shopify only emits the icon link when a favicon has been uploaded in theme settings. - Fix: Upload a favicon at Shopify Admin, Online Store, Themes, Customize, Theme settings, Favicon. - Verify: [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). - [ ] **A10.16 `<n>` H1 elements on page** - Pass: Exactly one H1, even when it is the visually hidden logo H1 that Shopify themes emit. - Warn: 2 or more H1s; when one is the hidden brand H1, the other (often a newsletter or banner section) should be demoted; otherwise pick the most important one as the H1. - Numbers and lists the tool uses: h1 regex /<h1\b[\s\S]*?<\/h1>/gi; hidden class regex /class=["'][^"']*(visually-hidden|sr-only|screen-reader)/i; warn at 2 or more. - Why: The duplicate appears on every page that includes that section. - Fix: Demote the extra H1 to H2 in the section template. - Verify: [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). - [ ] **A10.17 Product Offer is Out-of-Stock at $0.00, empty product landing page** - Pass: No Offer is OutOfStock at a zero price. - Numbers and lists the tool uses: availability /OutOfStock/i and price /^0(?:\.0+)?$/; fallback within 400 characters after the first Offer type (Mega SEO Analyzer). - Why: Customers land on a broken result. - Fix: Unpublish the product or set up a 301 redirect in Shopify Admin under Online Store, Navigation, URL Redirects. - Verify: [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: schema.org Offer. - [ ] **A10.18 Product schema brand.name is a real brand string ("`<brand>`"), not the bare domain** - Pass: Brand.name is a real brand string. - Fail: Brand.name is hostname-shaped or equals the page host. - Numbers and lists the tool uses: extract /"brand"\s*:\s*\{[^}]*?"name"\s*:\s*"([^"]+)"/i; domain shape /^[a-z0-9-]+(\.[a-z0-9-]+){1,}$/i or equal to the host (Mega SEO Analyzer). - Why: A Vendor field set to the domain propagates across every Product schema on the store. - Fix: Fix the Vendor field in Shopify Admin under Products with a bulk edit. - Verify: [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: schema.org Brand. - [ ] **A10.19 Product schema has empty "description", Shopify emits "" when the product description field is blank** - Pass: No Product has an empty description or an empty category. - Warn: A Product has category equal to an empty string. - Fail: A Product has description equal to an empty string. - Numbers and lists the tool uses: description === '' (fallback /"description"\s*:\s*""/) and category === '' (fallback /"category"\s*:\s*""/) within 1500 characters after the first Product type (Mega SEO Analyzer). - Why: Validators accept empty strings but Google Merchant Center rejects them. - Fix: Fill the product description and set the Google Product Category in Shopify Admin under Products. - Verify: [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: schema.org Product; Google Merchant Center; Google product taxonomy. - [ ] **A10.20 UCP capability profile served at /.well-known/ucp** - Pass: /.well-known/ucp is served (Agent-Ready Audit requires a 200 with parseable JSON; Mega Analyzer accepts any 2xx body over 5 chars that is not an HTML error page), or the page is not a commerce surface. - Warn: A commerce surface has no profile (Mega Analyzer warn; Mega SEO Analyzer impact 2; Mega AEO Analyzer: UCP is worth 50 of the agent-commerce dimension's 100 points, ACP eligibility the other 50); Agent-Ready Audit reports absence as informational. - Numbers and lists the tool uses: path /.well-known/ucp; Mega Analyzer commerce surface = Stripe script[src*=js.stripe.com|checkout.stripe.com|@stripe] or Shop Pay script[src*=shop.app|shopify|cdn.shopify.com] or a checkout CTA /(?:add to cart|add-to-cart|buy now|checkout|complete purchase|proceed to checkout)/i in the first 50000 chars, AND no service-family schema (Service, SelfStorageFacility, SelfStorage, LocalBusiness, LodgingBusiness, Hotel, MedicalBusiness, ProfessionalService, HomeAndConstructionBusiness, RealEstateAgent, AutomotiveBusiness, FoodEstablishment, Restaurant, Dentist, LegalService, FinancialService, InsuranceAgency, TravelAgency, MovingCompany, ChildCare, Physician, HealthAndBeautyBusiness), AND not every Offer url off-origin with no payment SDK; Mega SEO Analyzer and Mega AEO Analyzer gate on /js\.stripe\.com|checkout\.stripe\.com|cdn\.jsdelivr\.net\/npm\/@stripe|shop\.app|cdn\.shopify\.com|checkout\.shopify/i or /(?:add to cart|add-to-cart|buy now|checkout|complete purchase)/i over the whole HTML with the same service-schema list and no off-origin Offer rule; Shopify note markers /\/agents\.md|agentic_discovery|\/\.well-known\/ucp|\/api\/ucp\/mcp|universal commerce protocol/i and /\/llms\.txt|\/pages\/llms|"llms"/i. - Why: UCP is the Google plus Shopify discovery path (NRF 2026, about 20 launch partners) that tells shopping agents what your store supports; a brochure or service site has no reason to publish one. - Fix: Publish a JSON capability profile at /.well-known/ucp covering discovery, checkout and post-purchase; modern Shopify storefronts emit it automatically. - Verify: [Agent Ready Audit](https://jwatte.com/tools/agent-ready-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [Mega AEO Analyzer](https://jwatte.com/tools/mega-aeo-analyzer/). Standard: Universal Commerce Protocol (Google + Shopify); Cloudflare Agent Readiness Score (https://isitagentready.com/). - [ ] **A10.21 ACP eligibility (OpenAI + Stripe Agentic Commerce Protocol)** - Pass: The page loads the Stripe SDK, declares Product (or Offer/AggregateOffer) schema and is served over HTTPS, and is not a SaaS subscription page; not applicable off a commerce surface. - Warn: A commerce surface is missing one or more of the three (partial eligibility). - Numbers and lists the tool uses: Stripe /js\.stripe\.com|checkout\.stripe\.com|cdn\.jsdelivr\.net\/npm\/@stripe/i; Product schema /"@type"\s*:\s*"(?:Product|Offer|AggregateOffer)"/i; HTTPS /^https:/i on the URL; SaaS shape excluded: path /\/pricing\/?$/i, SoftwareApplication type, or /applicationCategory[^,]*DeveloperTools|applicationCategory[^,]*BusinessApplication/i; Mega SEO Analyzer evaluates only when Stripe or Product schema is present. - Why: ACP routes agent-driven checkout through Stripe, so all three signals must be present for ChatGPT to buy from you. - Fix: Serve over HTTPS, load the Stripe SDK and publish Product schema on product pages. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [Mega AEO Analyzer](https://jwatte.com/tools/mega-aeo-analyzer/). Standard: Agentic Commerce Protocol (OpenAI + Stripe). - [ ] **A10.22 ACP discovery document at /.well-known/acp.json** - Pass: /.well-known/acp.json is served on a commerce surface (Agent-Ready Audit requires parsed JSON with a protocol object; Mega Analyzer requires only a 2xx non-HTML body). - Warn: Missing on a commerce surface (Mega Analyzer); Agent-Ready Audit reports absence as informational. - Numbers and lists the tool uses: path /.well-known/acp.json; Agent-Ready Audit: parsed JSON with a protocol object; Mega Analyzer: any 2xx body that is not an HTML error page, gated on a commerce surface; the fields protocol.name 'acp', protocol.version, api_base_url, transports and capabilities.services are named only in the fix text and are not verified. - Why: Agents find the commerce API without opening a checkout session. - Fix: Publish acp.json with protocol.name 'acp', protocol.version, api_base_url, transports and capabilities.services; skip unless you sell via Stripe/OpenAI ACP. - Verify: [Agent Ready Audit](https://jwatte.com/tools/agent-ready-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: Agentic Commerce Protocol; Cloudflare Agent Readiness Score (https://isitagentready.com/). - [ ] **A10.23 MPP /openapi.json with x-payment-info extensions** - Pass: /openapi.json returns 200, parses as JSON and declares x-payment-info on payable operations. - Warn: Missing on a commerce surface (Mega Analyzer); Agent-Ready Audit reports absence as informational. - Numbers and lists the tool uses: path /openapi.json; /["']x-payment-info["']/. - Why: Declares payable operations to agents. - Fix: Add x-payment-info (intent, method, amount, currency) to payable operations via mppx or pympp middleware; skip unless you sell agent-callable services. - Verify: [Agent Ready Audit](https://jwatte.com/tools/agent-ready-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: MPP (Machine Payment Protocol); Cloudflare Agent Readiness Score (https://isitagentready.com/). - [ ] **A10.24 x402 v2 advertisement (Coinbase-led HTTP 402 protocol)** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: Mega Analyzer: Link header matching /\bpayment-required\b/i or an Accept-Payment header matching /x402/i, on commerce or developer surfaces; Agent-Ready Audit: /api or /api/v1 responds with HTTP 402. - Why: Per-request agent payments over HTTP 402; only relevant if you charge agents per request. - Fix: Add @x402/express, @x402/hono or @x402/next middleware if you sell per-request access. - Verify: [Agent Ready Audit](https://jwatte.com/tools/agent-ready-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: x402 v2; Cloudflare Agent Readiness Score (https://isitagentready.com/). - [ ] **A10.25 Shopify agentic-discovery sitemap present at /sitemap_agentic_discovery.xml** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: path /sitemap_agentic_discovery.xml, referenced only from /sitemap.xml; reported only when present. - Why: Modern Shopify storefronts expose their agentic surface through this sitemap. - Fix: Shopify emits this automatically on modern storefronts; no manual fix. - Verify: [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). - [ ] **A10.26 Brand Organization node has no founder Person** - Pass: The brand Organization node names a founder. - Numbers and lists the tool uses: /"founder"\s*:/i; gated on an Organization node on the About or home page. - Why: AI answer engines cite people, and a brand with no named founder forfeits 'who started `<brand>`' queries. - Fix: Add a founder Person with sameAs and ship a ProfilePage for the founder. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org founder. - [ ] **A10.27 A sameAs value uses a short link / vanity redirect (pin.it, bit.ly, linktr.ee, etc.) instead of the canonical profile URL** - Pass: Every sameAs value and Pinterest link is a full canonical profile URL. - Fail: SameAs contains pin.it, bit.ly, linktr.ee, lnk.to or instagr.am, or the Pinterest link is a pin.it short link with no pinterest.com profile. - Numbers and lists the tool uses: /"sameAs"[\s\S]{0,200}?(pin\.it|bit\.ly|linktr\.ee|lnk\.to|instagr\.am)\//i; /\bpin\.it\//i without /pinterest\.com\//i. - Why: Redirects are weak, breakable entity anchors. - Fix: Replace short links with full canonical profile URLs and add LinkedIn, wholesale marketplaces and founder profiles. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A10.28 The underlying Shopify store domain ("`<value>`.myshopify.com") does not match the current brand name** - Pass: The myshopify subdomain matches the brand name. - Numbers and lists the tool uses: brandToken = og:site_name or title lowercased with non-alphanumerics stripped; pass when brandToken contains the myshopify name, the name contains the first 6 chars of brandToken, or the name is 'shop'. - Why: A rebrand leaves stranded legacy citations under the old name. - Fix: 301 the old domain, add alternateName, and point sameAs and canonicals to the current domain. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A10.29 Customer reviews appear on the page but no machine-readable AggregateRating / Review schema was found** - Pass: A review widget on a product or home page is backed by AggregateRating inside the Product node. - Warn: When schema is present the tool asks you to confirm ratingValue and reviewCount reflect a real, current, non-incentivized total. - Numbers and lists the tool uses: widget /judge\.me|loox|okendo|yotpo|stamped\.io|reviews\.io|junip|fera\.ai|trustpilot|\bstars?\b.*\d(?:\.\d)?\s*(?:out of|\/)\s*5/i. - Why: Visible stars are invisible to AI search and the review snippet without schema. - Fix: Have the review app emit aggregateRating inside the Product node. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FTC 16 CFR Part 465. - [ ] **A10.30 No customer-review system detected and no AggregateRating / Review schema** - Pass: A product or home page has a review system or review schema. - Numbers and lists the tool uses: gated on a product or home page with no review widget and no schema. - Why: Social proof is the biggest DTC conversion and AI-trust signal. - Fix: Install a verified-review app, request post-purchase reviews, then emit AggregateRating; never fabricate. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FTC 16 CFR Part 465. - [ ] **A10.31 Thin cross-platform brand presence** - Pass: Fewer than three of the seven channels are missing from the home or About page links. - Numbers and lists the tool uses: channels Instagram /instagram\.com\//i, Pinterest /pinterest\.com\/|\bpin\.it\//i, TikTok /tiktok\.com\//i, Facebook /facebook\.com\//i, YouTube /youtube\.com\/|youtu\.be\//i, LinkedIn /linkedin\.com\//i, a Google Business / Maps profile /g\.page\/|business\.google\.|maps\.google\.|goo\.gl\/maps|\/maps\/place\//i; scanned over the page HTML plus JSON-LD text on the home or About page; fail at 3 or more missing. - Why: Profiles double as sameAs anchors, and few channels reads as a less established brand. - Fix: Create and link the missing channels and list them in Organization sameAs. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A10.32 Refund / Return Policy: eligibility, request, processing, defects, exchanges** - Pass: An ecommerce store publishes a refund or return policy with the eligibility window, request procedure, processing time, defect claims and exchange process, linked from every product page and the footer. - Numbers and lists the tool uses: digital goods 14-day money-back where required by law including the EU 14-day withdrawal under Directive 2011/83/EU unless waived for immediate download; physical goods returns within 30 days of delivery for unused items in original condition; final-sale, custom and personalized items not returnable unless defective; request by email with order number and reason, photographs of damage for physical goods, response within 2 business days; refund to the original payment method within 5 to 10 business days of approval, excluding original shipping unless the return is the seller's error; defective or damaged items reported within 7 days for replacement or full refund; exchanges via a return and a new order; terms of service purchases clause: prices subject to change, taxes may apply. - Why: Shoppers and regulators expect a stated return window and refund process before purchase. - Fix: Publish the refund or return policy with the windows above and link it from every product page and the footer. - Verify: [Legal Pages Generator](https://jwatte.com/tools/legal-pages-generator/). Standard: Directive 2011/83/EU. ### Electricians - [ ] **A11.1 This page reads as Q and A but has no FAQPage JSON-LD** - Pass: The FAQ page carries FAQPage schema. - Fail: A service or FAQ page contains question marks in the body but has no FAQPage schema. - Numbers and lists the tool uses: Pages: service, FAQ; /\?(?:\s|$)/ on the full body (mega-analyzer). - Why: Service questions already written on the page are what answer engines quote, and the schema makes them eligible. - Fix: Wrap the questions in FAQPage. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org FAQPage. - [ ] **A11.2 `<n>` electrician-readiness issue(s)** - Pass: No electrician-readiness issues detected. - Numbers and lists the tool uses: gate: an Electrician schema type, an 'electrical contractor' or 'Master Electrician' signal, panel-upgrade, generator, EV-charger or rewiring services, or 'licensed / free estimate / service area' copy; signals: Electrician LocalBusiness type, canonical @context, firm node with telephone, areaServed, geo, openingHoursSpecification, sameAs, per-service Service schema, Person node for the Master Electrician, BreadcrumbList on inner pages, AggregateRating or Review (FTC consumer-review rule), FAQPage, Google Business Profile or map signal, state-license-number trust signal, EV-charger growth-category opportunity, permit and NEC code-compliance signal; context flags: homepage, service page, about, contact, gallery, FAQ; reference /blog/blog-mega-analyzer-electrician-contractor-readiness/. - Why: Fixing these makes you findable in the Google map pack and citable to AI for "electrician near me", and turns your license and reviews into trust signals search can read. - Fix: Emit one global Electrician node (@id `<site>`#org with name, image, telephone, url, areaServed, PostalAddress, GeoCoordinates, openingHoursSpecification, priceRange and sameAs to Google Business Profile, Facebook, Yelp, BBB, HomeAdvisor and Nextdoor) referenced by @id on every page, plus per-service Service schema, a Person node for the owner, FAQPage and BreadcrumbList. Display the state electrical license number in the footer and About or Contact and on the business node, use only real reviews (FTC 16 CFR Part 465), verify and fill the Google Business Profile with matching NAP, state that you pull permits and build to the NEC where accurate, and validate every JSON-LD block. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org Electrician, Service, Person, BreadcrumbList, FAQPage, AggregateRating, Review; FTC 16 CFR Part 465; National Electrical Code (NEC); WCAG 1.1.1. - [ ] **A11.3 No license number is displayed** - Pass: Home, About, contact or service pages display the state electrical license number. - Warn: The site advertises being licensed, a Master Electrician or an electrical contractor but shows no license number. - Numbers and lists the tool uses: /\b(?:lic(?:ense)?\.?\s*#|license\s*(?:no\.?|number)|state license|electrical license|contractor (?:license|registration|reg)|\bec\s*#|master(?:s)? license)\b[^.\n]{0,30}\d{3,}/i or /\blicense\s*#?\s*\d{3,}/i. - Why: Electrical work is state-licensed, and the number is a top trust signal. - Fix: Display the license number in the footer, About and contact pages and in schema (identifier or hasCredential). - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FTC substantiation. - [ ] **A11.4 No AggregateRating / Review schema** - Pass: Home, contact and About pages carry AggregateRating or Review schema with a confirmed real total. - Warn: When schema is present the tool asks you to confirm the total; when reviews are referenced without schema it reports that variant. - Numbers and lists the tool uses: widget /google review|yelp|angi|thumbtack|nextdoor|birdeye|homeadvisor|\b\d(?:\.\d)?\s*(?:out of|\/)\s*5\s*star/i on raw HTML plus body; claims /\b5-?star|highly rated|top-?rated|hundreds of (?:happy )?customers|\d+\s*(?:\+\s*)?(?:5-?star\s*)?reviews/i on body; no-schema branch gated on home, contact or About page. - Why: Reviews are the top trust signal for a local trade. - Fix: Confirm the real total and emit aggregateRating; never seed. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FTC 16 CFR Part 465. - [ ] **A11.5 About page tells the owner or experience story but has no Person schema** - Pass: An About page with owner or experience wording carries a Person node. - Numbers and lists the tool uses: /\b(owner|founder|master electrician|started|family-?owned|years? of experience|meet)\b/i on the About page. - Why: The owner is the brand. - Fix: Emit Person with jobTitle Master Electrician and worksFor referencing the business @id. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org Person. - [ ] **A11.6 No EV-charger / Level 2 / Tesla Wall Connector service is mentioned** - Pass: EV-charger service is mentioned on the home page. - Numbers and lists the tool uses: /ev charg|ev[ -]?charging|electric vehicle charg|tesla (?:wall connector|charger)|\bevse\b|level 2 charg/i on the home page (Mega Analyzer). - Why: EV charger installation is the fastest-growing residential electrical category. - Fix: Add an EV-charger service page with Service schema. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A11.7 No mention of permits, inspections, or code compliance** - Pass: Permit, inspection or NEC language is present on home or service pages. - Numbers and lists the tool uses: /\bpermit|\binspection\b|\bnec\b|national electrical code|code-?compliant|up to code|to code\b/i (Mega Analyzer). - Why: Permit and code language is a trust signal AI answers cite for licensed trades. - Fix: Add permit, inspection and code-compliance language where it is accurate. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: NEC. ### Financial services - [ ] **A12.1 YMYL-Finance: FinancialService schema** - Pass: A finance site declares FinancialService, BankOrCreditUnion or InsuranceAgency. - Numbers and lists the tool uses: regex /FinancialService|BankOrCreditUnion|InsuranceAgency/i (Mega Analyzer). - Why: Finance queries get tighter source-quality filters. - Fix: Add FinancialService JSON-LD. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org FinancialService. - [ ] **A12.2 YMYL-Finance: FINRA/CFP/CPA/BrokerCheck credential disclosure** - Pass: A finance credential, BrokerCheck or CRD reference, or a license marker appears in the body text. - Numbers and lists the tool uses: /\b(finra|cfp|cpa|series\s*\d+|registered investment|brokercheck|sec\.gov.*adv|investment adviser representative|\biar\b|crd\s*#?\s*\d+)/i. - Why: BrokerCheck is the FINRA-mandated disclosure for investment adviser representatives. - Fix: Publish FINRA, CFP or CPA credentials, a BrokerCheck link or the CRD number. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FINRA BrokerCheck. - [ ] **A12.3 YMYL-Finance: financial disclaimer (or visible /disclosure link)** - Pass: A financial disclaimer is present on the page or a disclaimer-class page is linked. - Numbers and lists the tool uses: /\b(not\s+(?:financial|investment|tax)\s+advice|past\s+performance\s+(?:does\s+not|is\s+not)|informational\s+purposes?\s+only|your\s+capital\s+is\s+at\s+risk)\b/i on body text; or any link href matching /\/(disclaimer|legal-notice|notice|terms-?(?:of-)?(?:use|service)?|privacy(?:-policy)?|disclosure|aboutus|legal)\/?(?:$|\?|#)/i. - Why: A disclosure is required for financial advice content. - Fix: Add a financial disclaimer or a /disclosure link. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). ### Government offices - [ ] **A13.1 Government or tribal-sovereignty domain detected** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: host /\.(?:gov|mil|nsn\.us|nsn\.gov)$/i; body /\b(?:tribal|nation|pueblo|nsn-)\b/i on the first 6000 characters. - Why: Government and tribal sites are bound by Section 508, WCAG 2.1 AA and the 21st Century IDEA Act as legal requirements, not best practice. - Fix: Run the WCAG Accessibility Audit (/tools/wcag-accessibility-audit/) and a plain-language review. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: Section 508; WCAG 2.1 AA; 21st Century IDEA Act. ### Handyman services - [ ] **A14.1 This service / FAQ page reads as Q&A but has no FAQPage JSON-LD** - Pass: The FAQ page carries FAQPage schema. - Fail: A service or FAQ page contains question marks in the body but has no FAQPage schema. - Numbers and lists the tool uses: Pages: service, FAQ; /\?(?:\s|$)/ on the full body (mega-analyzer). - Why: Service questions already written on the page are what answer engines quote, and the schema makes them eligible. - Fix: Wrap the questions in FAQPage. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org FAQPage. - [ ] **A14.2 `<n>` handyman-readiness issue(s)** - Pass: No handyman-readiness issues detected. - Numbers and lists the tool uses: gate: handyman, plumbing, electrical, painting, drywall, carpentry or HVAC signals, 'licensed bonded insured', 'free quote', a service area, or HomeAndConstructionBusiness or LocalBusiness schema; signals: LocalBusiness or HomeAndConstructionBusiness node with telephone, address or areaServed, geo, openingHoursSpecification, per-trade Service schema, Person for the owner, AggregateRating or Review (FTC), FAQPage, Google Business Profile or map presence, the placeholder-phone (555-01xx) trap, the client-rendered-SPA invisibility trap, Open Graph, a sitemap signal, a state-licensed-trade advertising guardrail; context flags: homepage, service page, about, contact, book or quote, FAQ; reference /blog/blog-mega-analyzer-handyman-local-service-readiness/. - Why: Fixing these makes you findable in the Google map pack and citable to AI for "handyman near me", and keeps trust and licensing claims substantiable. - Fix: Make sure services, phone and service area ship in the initial HTML (prerender or SSR a client-rendered app), then emit one global node typed ['HomeAndConstructionBusiness','LocalBusiness'] (@id `<site>`#org with name, image, telephone, url, areaServed, PostalAddress if published, GeoCoordinates, openingHoursSpecification, priceRange and sameAs to Google Business Profile, Facebook, Yelp or Angi), Service schema per trade, a Person node for the owner and FAQPage. Replace any 555 placeholder phone with the real number everywhere, create and fill the Google Business Profile with matching NAP, use only real reviews (FTC 16 CFR Part 465), limit plumbing, electrical and HVAC pages to the scope your state license allows, and validate every JSON-LD block. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org HomeAndConstructionBusiness, LocalBusiness, Service, Person, FAQPage, AggregateRating; FTC 16 CFR Part 465. - [ ] **A14.3 About page tells the owner story but has no Person schema** - Pass: An About page with owner wording carries a Person node. - Numbers and lists the tool uses: /\b(owner|founder|meet (?:tim|the owner|our)|started|i started|my name is)\b/i on the About page. - Why: The owner is the brand. - Fix: Emit Person with jobTitle Owner, worksFor referencing the business @id, and a photo. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org Person. - [ ] **A14.4 No reviews and no AggregateRating schema** - Pass: Home and contact pages carry AggregateRating or Review schema backed by real reviews. - Warn: When schema is present the tool asks you to confirm the total; when strong ratings are claimed without schema it reports that variant. - Numbers and lists the tool uses: widget /yelp|google review|angi|thumbtack|nextdoor|birdeye|nicejob|\b\d(?:\.\d)?\s*(?:out of|\/)\s*5\s*star/i; claims /\b5-?star|highly rated|top-?rated|hundreds of (?:happy )?customers\b/i. - Why: Reviews are the number one trust and ranking signal for a local trade. - Fix: Stand up the Business Profile, collect reviews, then emit AggregateRating. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FTC 16 CFR Part 465. - [ ] **A14.5 "Licensed, bonded, and insured" is advertised alongside state-regulated trades** - Pass: No licensed, bonded and insured claim is made. - Warn: The claim is made without a regulated trade listed; make sure each part is true and substantiable before launch. - Fail: The claim is made and plumbing, electrical or HVAC work is also advertised. - Numbers and lists the tool uses: /\blicensed,?\s*bonded,?\s*(?:and\s*)?insured\b|\bfully licensed\b/i; regulated trades = plumbing, electrical, hvac (Mega Analyzer). - Why: A general handyman license does not cover separately licensed trades. - Fix: Confirm which licenses you hold, name the license number, and limit the scope or add a disclaimer. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FTC substantiation. ### Health and medical - [ ] **A15.1 YMYL-Health: Practitioner or MedicalBusiness schema** - Pass: A health site declares a medical practice type (Physician, MedicalBusiness, Dentist, MentalHealthService, Chiropractor and so on). - Fail: No medical or practitioner type is found, which is reported as critical for health sites. - Numbers and lists the tool uses: gate /^YMYL-Health(?!-MentalHealth)/i: no schema type matches /MedicalBusiness|Physician|MedicalClinic|Hospital|PrimaryCare|Internist|FamilyPractice|Pediatric|MentalHealthService|Dermatology|Optometric|Optician|EmergencyService|Physiotherapy|CovidTestingFacility|Chiropractor|Geriatric|Surgical|MedicalOrganization|MedicalSpecialty|CommunityHealth/i or /Dentist|DentalClinic/i; mental health (ymylVertical === 'YMYL-Health-MentalHealth') /MentalHealthService|Psychotherapy|MedicalBusiness|Person/i; chiropractic, optometry and podiatry gate /^YMYL-Health-(Chiropractic|Optometry|Podiatry)$/ with /Chiropractor|Optometric|Optician|Podiatric|MedicalBusiness|MedicalClinic|Person/i; reported as critical under 'YMYL vertical (`<vertical>`) missing required trust signals' (Mega Analyzer). - Why: AI Overviews apply tighter source-quality filters to health queries, so the practice needs a recognized medical entity anchor. - Fix: Add Physician, MedicalBusiness, Dentist, MentalHealthService or the specific practice-type JSON-LD with the practitioner's credentials. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org MedicalBusiness; Google Search Quality Rater Guidelines section 3.4. - [ ] **A15.2 YMYL-Health: license or credential disclosure** - Pass: The body text carries an NPI, MD or DO, board-certified or state-license phrase, or a license marker. - Numbers and lists the tool uses: /\b(npi|md\b|do\b|nurse practitioner|board[- ]certified|licensed in\b|state license)/i or the general license marker. - Why: Health sources need visible credentials to pass YMYL filters. - Fix: Publish the NPI, license and board certification in visible copy. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: Google SQRG v2024 3.4. - [ ] **A15.3 YMYL-Health: HIPAA notice or link** - Pass: The word HIPAA appears in the body text or in a link. - Numbers and lists the tool uses: /hipaa/i on body text and link hrefs. - Why: Covered entities must publish a Notice of Privacy Practices. - Fix: Add a HIPAA notice page and link it. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: HIPAA. - [ ] **A15.4 YMYL-Health: medical disclaimer (or visible /disclaimer link)** - Pass: A medical disclaimer is present on the page or a disclaimer-class page is linked. - Numbers and lists the tool uses: medical disclaimer /\b(not\s+(?:medical|professional)\s+advice|consult\s+(?:your|a)\s+(?:doctor|physician|healthcare)|for\s+informational\s+purposes\s+only)\b/i on lowercased body text, or a link matching /\/(disclaimer|legal-notice|notice|terms-?(?:of-)?(?:use|service)?|privacy(?:-policy)?|disclosure|aboutus|legal)\/?(?:$|\?|#)/i; gate /^YMYL-Health(?!-MentalHealth)/i. - Why: A regulated disclaimer is expected on health sites. - Fix: Add a medical disclaimer or link a /disclaimer page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). ### Home and property inspection - [ ] **A16.1 FAQ page carries no FAQPage JSON-LD** - Pass: The FAQ page carries FAQPage schema. - Numbers and lists the tool uses: Page gate: isFaqPage (mega-analyzer). - Why: AI Overviews and People Also Ask preferentially lift schema-wrapped question and answer content. - Fix: Wrap the Q&A in FAQPage > Question > acceptedAnswer. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org FAQPage. - [ ] **A16.2 `<n>` property-inspection-readiness issue(s)** - Pass: No property-inspection-readiness issues detected across the service, FAQ, reviews, booking, sample-report, contact and about contexts. - Numbers and lists the tool uses: contexts: service, FAQ, reviews, booking, sample report, contact, about; references InterNACHI and ASHI Standards of Practice, NRPP and AARST radon, Texas TREC licensing. - Why: Citeability as a home inspector depends on InterNACHI or ASHI, FTC and ADA expectations being visible on the site. - Fix: Replace an invalid ['Person','Organization'] type with ['HomeAndConstructionBusiness','LocalBusiness'] @id #org, give the firm node telephone, PostalAddress, areaServed, memberOf InterNACHI and sameAs (GBP cid, Yelp, BBB, InterNACHI find-an-inspector, Facebook), add a Service node per service page, FAQPage and caption-based alt text on report pages. State the SOP, Code of Ethics, E&O insurance, NRPP or AARST and license number, validate the JSON-LD, and keep every superlative or guarantee claim FTC-substantiable. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A16.3 No machine-readable AggregateRating / Review schema on the reviews / firm node** - Pass: The reviews or About page carries AggregateRating or Review schema. - Numbers and lists the tool uses: gated on a reviews or About page. - Why: AI search cannot cite 'rated X by N customers' unless it is structured, and FTC substantiation applies. - Fix: Show the platform rating and a few reviews as text that links to the source. Do not copy them into aggregateRating on the firm node: Google allows no ratings from other sites and shows no stars for a business's own reviews. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FTC substantiation. - [ ] **A16.4 No InterNACHI or ASHI membership statement on the About / homepage** - Pass: The About page mentions InterNACHI or ASHI membership. - Numbers and lists the tool uses: /internachi|nachi\.org|certified master inspector|certified professional inspector/i or /\bashi\b|american society of home inspectors/i. - Why: Colorado and several other states do not license inspectors, so association membership is the credential. - Fix: Add a visible 'InterNACHI Certified' or 'ASHI Member' line, memberOf on the JSON-LD and the find-an-inspector URL in sameAs. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A16.5 No reference to the InterNACHI/ASHI Standards of Practice, Code of Ethics, or a pre-inspection agreement** - Pass: Service or About pages name the Standards of Practice, Code of Ethics or a pre-inspection agreement. - Numbers and lists the tool uses: /standards of practice|code of ethics|inspection agreement|pre-inspection agreement/i. - Why: Naming the Standards of Practice is a primary trust and scope-limiting signal. - Fix: Add 'Inspections performed to the InterNACHI Standards of Practice' with a link. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: InterNACHI / ASHI Standards of Practice. - [ ] **A16.6 No errors-and-omissions / general-liability insurance statement** - Pass: The About page states E&O and general liability insurance. - Numbers and lists the tool uses: /errors (?:and|&) omissions|\be&o\b|general liability|fully insured|insured and bonded/i. - Why: Insurance is a standard trust signal agents and buyers look for. - Fix: Add a visible 'E&O and general liability insured' line. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A16.7 Radon page without an NRPP / AARST certification reference** - Pass: Radon pages state an NRPP or AARST certification. - Numbers and lists the tool uses: /\bnrpp\b|\baarst\b|national radon proficiency|radon (?:measurement|mitigation) (?:certified|professional)/i; gated on /radon/i in the path or title. - Why: Radon claims are health (YMYL) claims. - Fix: State the NRPP or AARST certification and the state registration. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: AARST-NRPP. - [ ] **A16.8 Texas market referenced but no TREC license disclosure detected** - Pass: Pages that mention Texas markets disclose the TREC license number. - Numbers and lists the tool uses: /trec|texas real estate commission|tx license|license\s*#?\s*\d{3,}/i; Texas market /\b(texas|dallas|fort worth|houston|austin|san antonio|dfw)\b/i. - Why: Texas licenses home inspectors and requires the license number in advertising. - Fix: Disclose the TREC license number on Texas-market pages. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: Texas Real Estate Commission. - [ ] **A16.9 Photo-heavy report/sample page ships `<n>` images with no alt text** - Pass: A sample-report page has 3 or fewer images missing alt. - Fail: IsSampleReportPage && imgsMissingAlt > 3. - Numbers and lists the tool uses: > 3 missing on a sample-report page. - Why: One missing-alt pattern multiplies across every auto-generated inspection report page. - Fix: Set the alt from the existing caption or finding label. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: WCAG 1.1.1 (Level A). - [ ] **A16.10 Superlative / guarantee / review-count claim detected (`<claims>`)** - Pass: No superlative, review-count or guarantee claim appears in the title or opening copy. - Fail: A superlative, a numeric review claim or a guarantee claim matches. - Numbers and lists the tool uses: claim text = title + first 6000 characters of body and footer; superlatives /\b(largest|most-? ?referred|#?1\b|number one|best|most trusted)\b/i; review claim /(\d[\d,]{2,})\s*\+?\s*(?:5-?star|five-?star|reviews?)/i; guarantee claim /\b(\d{2,3}%|money-?back|satisfaction)\s*guarantee/i (Mega Analyzer). - Why: These are advertising claims that FTC substantiation rules require you to back with evidence. - Fix: Keep a dated, verifiable source for each claim and tie review counts to an auditable platform total. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FTC substantiation. ### Hotels and motels - [ ] **A17.1 This rooms/accommodations page has no HotelRoom / Suite schema** - Pass: Room pages model each room as HotelRoom or Suite with an Offer. - Numbers and lists the tool uses: rooms page /\/(rooms?|suites?|accommodations?|stay|book(?:ing)?|reservations?)(\/|$|-)/; room node type /(^|\b)(HotelRoom|Suite|Room)(\b|$)/ or /"@type"\s*:\s*"(?:HotelRoom|Suite)"/i (Mega Analyzer). - Why: Room types and rates become eligible for Google Hotels. - Fix: Model each room as HotelRoom with occupancy, bed, amenityFeature and an Offer. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org HotelRoom. - [ ] **A17.2 A visible FAQ exists but there is no FAQPage schema** - Pass: FAQPage schema is present. - Fail: A visible FAQ with three or more question marks has no FAQPage schema. - Numbers and lists the tool uses: /frequently asked|(^|[\s>(])FAQs?([\s<):.]|$)/ and question marks >= 3 (mega-analyzer). - Why: Guest questions about parking, check-in, pets and cancellation are what answer engines get asked about a hotel. - Fix: Wrap guest Q&A (parking, check-in, pets, amenities, cancellation) in FAQPage. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org FAQPage. - [ ] **A17.3 Hotel node NAP fields (PostalAddress, geo, telephone, checkinTime/checkoutTime, priceRange/starRating)** - Pass: The Hotel node has PostalAddress, geo, telephone, checkinTime and checkoutTime, and priceRange or starRating. - Fail: Missing PostalAddress; missing geo on the home or contact page; missing telephone; missing checkinTime or checkoutTime on the home or rooms page; or neither priceRange nor starRating on the homepage. - Numbers and lists the tool uses: gate hasHotelType || hasOrg; hasPostal /"PostalAddress"|"streetAddress"/i; hasGeo /"geo"\s*:\s*\{|"GeoCoordinates"|"latitude"/i (home or contact page); hasTel /"telephone"\s*:/i; hasCheckin /"checkinTime"|"checkoutTime"/i (home or rooms page); hasPriceRange /"priceRange"/i and hasStar /"starRating"/i (homepage). - Why: These fields feed Google and Apple pins and Google Hotels. - Fix: Add checkinTime (for example 15:00), checkoutTime (for example 11:00) and priceRange or a starRating Rating to the Hotel node. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org Hotel. - [ ] **A17.4 `<n>` hotel-readiness issue(s)** - Pass: No hotel-readiness issues detected. - Numbers and lists the tool uses: gate: Hotel or LodgingBusiness schema, or lodging plus booking signals; signals: Hotel or LodgingBusiness typing, NAP, geo, telephone, check-in and check-out, priceRange or starRating on the hotel node, per-room HotelRoom and Offer, FAQPage, FTC-aware reviews, and the local-listing sameAs graph: Google (Business Profile or Maps to Google Hotels), Apple Maps (Apple Business Connect), Yelp, TripAdvisor, the OTAs; context flags: homepage, rooms or booking, dining, contact or location, FAQ; reference /blog/blog-mega-analyzer-hotel-lodging-readiness/. - Why: Most hotel sites ship the on-page schema but forget to bind it to their listings, and that listing graph drifts out of date, so fixing it keeps the property bookable, map-pack-visible and citable in AI travel answers. - Fix: Emit a Hotel node (@id `<site>`#hotel with name, PostalAddress, GeoCoordinates, telephone, priceRange, starRating, checkinTime 15:00, checkoutTime 11:00) referenced by @id on every page, each room type as HotelRoom with occupancy, bed, amenityFeature and an Offer with price, priceCurrency and availability, and FAQPage over the visible guest FAQ. Add sameAs to Google Business Profile or Maps, Apple Maps, Yelp, TripAdvisor and OTA listings, audit each listing for hours, phone, photos, amenities and cancellation policy, merge or redirect duplicate pins, keep NAP identical everywhere, use only real reviews, and validate every JSON-LD block. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org Hotel, LodgingBusiness, HotelRoom, Offer, QuantitativeValue, Rating, FAQPage, sameAs; Apple Business Connect; FTC 16 CFR Part 465. - [ ] **A17.5 Guest reviews/ratings are referenced but there is no machine-readable AggregateRating / Review schema** - Pass: Home and contact pages that reference guest ratings carry AggregateRating or Review schema. - Numbers and lists the tool uses: /\b\d(?:\.\d)?\s*(?:out of|\/)\s*5\b|guest reviews|\btripadvisor\b|\d+\s*reviews/i. - Why: Referenced ratings that are not structured cannot be cited or shown as stars. - Fix: Emit aggregateRating from the real current total. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FTC 16 CFR Part 465. ### HVAC contractors - [ ] **A18.1 This page reads as Q and A but has no FAQPage JSON-LD** - Pass: The FAQ page carries FAQPage schema. - Fail: A service or FAQ page contains question marks in the body but has no FAQPage schema. - Numbers and lists the tool uses: Pages: service, FAQ; /\?(?:\s|$)/ on the full body (mega-analyzer). - Why: Service questions already written on the page are what answer engines quote, and the schema makes them eligible. - Fix: Wrap the questions in FAQPage. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org FAQPage. - [ ] **A18.2 `<n>` HVAC-readiness issue(s)** - Pass: No HVAC-readiness issues detected, with the list of expected signals satisfied. - Numbers and lists the tool uses: gate: an HVACBusiness schema type, a 'heating and cooling' or 'HVAC' signal, AC, furnace, heat-pump, tune-up or ductwork services, or 'licensed / free estimate / 24/7 emergency' copy; signals: HVACBusiness LocalBusiness type, canonical https://schema.org @context (flags http://www.schema.org), firm node with top-level telephone, areaServed, geo, openingHoursSpecification, sameAs, per-service Service schema, Person node for the owner or lead tech, BreadcrumbList on inner pages, AggregateRating or Review under the FTC consumer-review rule, FAQPage, Google Business Profile or map signal, EPA 608 plus NATE plus state HVAC-license credential trifecta, heat-pump category, mechanical-permit and combustion or carbon-monoxide safety signal, factory-authorized-dealer or brands-serviced signal, maintenance-plan signal, consumer-financing signal, SEER2 / AFUE / A2L refrigerant / 25C rebate literacy; context flags: homepage, service page, about, contact, gallery, FAQ; reference /blog/blog-mega-analyzer-hvac-contractor-readiness/. - Why: Fixing these makes you findable in the Google map pack and citable to AI for "AC, furnace or heat-pump repair near me", and turns your EPA 608 and NATE credentials, reviews and brands into trust signals search can read. - Fix: Emit one global HVACBusiness node (@id `<site>`#org with name, image, telephone, url, areaServed, PostalAddress, GeoCoordinates, openingHoursSpecification, priceRange and sameAs to Google Business Profile, Facebook, Yelp and the manufacturer dealer page) referenced by @id on every page, plus per-service Service schema, a Person node for the owner, FAQPage and BreadcrumbList. Display EPA Section 608, NATE and the state license in the footer and About or Contact as hasCredential, use only real reviews (FTC 16 CFR Part 465), verify and fill the Google Business Profile with matching NAP, and validate every JSON-LD block. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org HVACBusiness, Service, Person, EducationalOccupationalCredential, AggregateRating, Review, FAQPage, BreadcrumbList; FTC 16 CFR Part 465; TILA / Reg Z; WCAG 1.1.1. - [ ] **A18.3 No HVAC credential is displayed (EPA 608 / NATE / state license)** - Pass: Home, About, contact or service pages display an EPA 608 type, NATE certification or a state license number, ideally also as hasCredential schema. - Warn: The site advertises being licensed or certified but shows no HVAC credential. - Numbers and lists the tool uses: EPA 608 /\bepa\b[^.\n]{0,20}(?:608|section\s*608|certified|certification)|section\s*608|\b608[- ]certified\b/i; NATE /\bnate[- ]?certified\b|\bnate\b[^.\n]{0,20}(?:certified|certification|technician)|north american technician excellence/i; license number /\b(?:lic(?:ense)?\.?\s*#|license\s*(?:no\.?|number)|state license|hvac license|mechanical (?:license|contractor)|contractor (?:license|registration|reg)|reg(?:istration)?\s*#)\b[^.\n]{0,30}[a-z]?\d{3,}/i or /\blicense\s*#?\s*[a-z]?\d{3,}/i; the licensed-or-certified warn variant fires on /\blicensed\b|\bbonded\b|\binsured\b|\bcertified\b|\bnate\b|epa (?:608|certified|section 608)|mechanical contractor|hvac contractor/i; all tested on body plus footer text on home, About, contact or service pages. - Why: EPA 608 certification is federally required to handle refrigerant. - Fix: Display the EPA 608 type, NATE and state license number in the footer, About and contact pages and as hasCredential. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: Clean Air Act Section 608; NATE. - [ ] **A18.4 No AggregateRating / Review schema** - Pass: Home, contact and About pages carry AggregateRating or Review schema with a confirmed real total. - Warn: When schema is present the tool asks you to confirm the count and value; when reviews or ratings are referenced without schema it reports that variant. - Numbers and lists the tool uses: widget /google review|yelp|angi|thumbtack|nextdoor|birdeye|homeadvisor|\b\d(?:\.\d)?\s*(?:out of|\/)\s*5\s*star/i; claims /\b5-?star|highly rated|top-?rated|hundreds of (?:happy )?customers|\d+\s*(?:\+\s*)?(?:5-?star\s*)?reviews/i. - Why: Almost no HVAC competitor ships review schema, so a real one stands out. - Fix: Confirm the real current total, emit aggregateRating, and never seed reviews. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FTC 16 CFR Part 465. - [ ] **A18.5 About page tells the owner or experience story but has no Person schema** - Pass: An About page with owner or experience wording carries a Person node. - Numbers and lists the tool uses: /\b(owner|founder|lead tech|technician|started|family-?owned|years? of experience|meet)\b/i on the About page. - Why: The owner is the brand. - Fix: Emit Person with jobTitle, worksFor, photo and hasCredential. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org Person. - [ ] **A18.6 No heat-pump / ductless mini-split service is mentioned** - Pass: Heat-pump or ductless service is mentioned on the home page. - Numbers and lists the tool uses: /heat pump|mini-?split|ductless|dual fuel|cold-?climate heat pump/i on the home page (Mega Analyzer). - Why: Heat pumps are the fastest-growing HVAC category and the focus of the federal 25C credit and IRA rebates. - Fix: Add a heat-pump service page with Service schema. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A18.7 No mention of permits, mechanical code, or combustion / carbon-monoxide safety** - Pass: Permit, mechanical-code or combustion safety language is present on home or service pages. - Numbers and lists the tool uses: /\bpermit|\binspection\b|mechanical code|\bimc\b|to code\b|up to code|code-?compliant/i; /carbon monoxide|\bco\b alarm|combustion (?:analysis|safety|test)|flue|heat exchanger (?:crack|inspection)|gas leak/i (Mega Analyzer). - Why: Permit and combustion-safety language is a genuine trust signal for a licensed trade. - Fix: Add permit, code and carbon-monoxide safety language where it is accurate. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A18.8 No equipment brands or dealer status mentioned** - Pass: Brand names, a 'we service all major brands' statement, or dealer authorization appear on home or about pages. - Numbers and lists the tool uses: brands /carrier|trane|lennox|goodman|rheem|ruud|bryant|amana|york|daikin|mitsubishi|fujitsu|bosch|coleman|payne|american standard|heil|tempstar/i or /all (?:major )?brands|any (?:make|brand)|service all (?:makes|brands)/i; dealer /factory[- ]authorized|authorized dealer|certified dealer|preferred dealer|comfort specialist|elite dealer/i; checked on home and about pages (Mega Analyzer). - Why: Buyers search by brand. - Fix: State the brands you service and any dealer authorization, and mark it up with hasCredential or sameAs. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A18.9 No maintenance plan / membership is offered** - Pass: A maintenance plan or membership is mentioned on home or service pages. - Numbers and lists the tool uses: /maintenance (?:plan|agreement|program|membership)|service (?:plan|agreement)|comfort club|membership|annual (?:plan|agreement)|priority (?:service|scheduling)|tune-?up (?:plan|membership)/i (Mega Analyzer). - Why: Maintenance plans are the core recurring-revenue and retention play. - Fix: Give the plan its own page with a Service or Offer schema node. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A18.10 No financing option is mentioned** - Pass: Consumer financing is mentioned on home or service pages. - Numbers and lists the tool uses: /financ|monthly payment|payment plan|\bwisetack\b|\bsynchrony\b|\bgreensky\b|0% apr|pay over time|installment/i (Mega Analyzer). - Why: Financing removes the price objection; a stated APR triggers TILA and Regulation Z disclosures. - Fix: Add a financing mention or page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: TILA / Regulation Z. - [ ] **A18.11 No efficiency-rating, rebate, or tax-credit content (SEER2 / AFUE / HSPF2, ENERGY STAR, 25C, utility rebates)** - Pass: Efficiency, rebate or tax-credit content is present on home or service pages, and refrigerant-transition literacy is reported separately. - Numbers and lists the tool uses: /\bseer2?\b|\bafue\b|\bhspf2?\b|energy[- ]efficient|high[- ]efficiency|25c|inflation reduction|tax credit|rebate|energy star/i; refrigerant /\br-?410a\b|\br-?454b\b|\br-?32\b|\ba2l\b|low-?gwp|r-?22|refrigerant (?:transition|phase)/i (Mega Analyzer). - Why: Efficiency and rebate content is the highest-intent decision-stage content and a surface AI answers draw on. - Fix: Add efficiency-rating, rebate and tax-credit content, plus a note on the R-410A to A2L refrigerant transition. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). ### Industrial and manufacturing - [ ] **A19.1 Local-Industrial: No industry certification badge (AWS / ISO 9001 / AS9100 / ITAR / NIST / ASME) visible** - Pass: An industrial certification appears in the body text. - Numbers and lists the tool uses: /(?:AWS\s+D1\.1|ISO\s*9001|AS9100|ITAR|NIST\s+800-171|ASME|ASTM|UL\s+listed|CE\s+marked)/i. - Why: Certifications are the trust signal industrial buyers look for. - Fix: Display the certification badges the shop actually holds. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A19.2 Local-Industrial: No Capabilities / Industries-Served / Equipment-List page** - Pass: Capabilities language appears in the text or a capabilities-class link exists. - Numbers and lists the tool uses: text /(?:capabilities|industries\s+served|equipment\s+list|certifications?)/i; links /\/(capabilities|industries|equipment|certifications?|quality)\/?$/i (Mega Analyzer). - Why: Buyers who send RFQs judge a shop by its capabilities, industries served and certifications. - Fix: Add a Capabilities or Industries Served page listing equipment and certifications. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A19.3 Local-Industrial: No RFQ / quote-request CTA visible** - Pass: RFQ or quote-request language appears in the body text. - Numbers and lists the tool uses: /(?:RFQ|request\s+(?:for\s+)?(?:a\s+)?quote|get\s+a\s+quote|quote\s+request)/i (Mega Analyzer). - Why: Industrial buyers convert through a quote request, not an online booking. - Fix: Add a visible RFQ or Get a Quote call to action. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). ### Laundromats - [ ] **A20.1 No Spanish-language signal (hreflang=es, an /es/ path, or Spanish content)** - Pass: A Spanish hreflang, lang, /es/ path or Spanish wording is present on the homepage. - Fail: The homepage has no match. - Numbers and lists the tool uses: regex /hreflang=["']es|lang=["']es|\/es\/|en espa[nñ]ol|espa[nñ]ol/i on the raw HTML; gated to the homepage. - Why: Spanish coverage is a real way to reach and convert more customers. - Fix: Add Spanish core pages with reciprocal hreflang en, es and x-default. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: hreflang. - [ ] **A20.2 The page reads as Q&A but has no FAQPage JSON-LD** - Pass: The FAQ page carries FAQPage schema. - Fail: A home, FAQ or service page contains question marks in the body but has no FAQPage schema. - Numbers and lists the tool uses: Pages: home, FAQ, service; /\?(?:\s|$)/ on the full body (mega-analyzer). - Why: Question and answer content is the exact surface AI Overviews lift for laundromat queries. - Fix: Wrap the real questions in FAQPage > Question > acceptedAnswer. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org FAQPage. - [ ] **A20.3 The page claims 24-hour / 24-7 access but there is no openingHoursSpecification to back it** - Pass: A page that claims 24-hour access also has hours schema. - Fail: Home or contact page text matches the 24/7 claim regex and no openingHoursSpecification exists. - Numbers and lists the tool uses: claims247 /\bopen 24 ?hours?\b|24\/7|24-7|\baround the clock\b|always open\b/i on home or contact pages. - Why: The always-open advantage should be machine-readable so "open now" searches can use it. - Fix: Mirror the claim in schema with opens 00:00 and closes 23:59 across all 7 days. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org/OpeningHoursSpecification. - [ ] **A20.4 `<n>` laundromat-readiness issue(s)** - Pass: No laundromat-readiness issues detected. - Numbers and lists the tool uses: gate: laundromat, coin-laundry, wash-and-fold or drop-off signals, washer-dryer plus Speed Queen, Dexter or Huebsch machine brands, or DryCleaningOrLaundry schema; signals: DryCleaningOrLaundry node with NAP, geo, openingHoursSpecification, honest 24/7-vs-staffed hours, paymentAccepted (coin, card, Apple Pay, Google Pay, app), amenityFeature, areaServed for delivery, sameAs (Google Business Profile, Yelp, Facebook), FAQPage, AggregateRating or Review (FTC), Service schema on wash-and-fold and pickup-and-delivery, accessibility or ADA Title III statement, Spanish and hreflang, client-rendered-SPA trap, Open Graph, FTC superlative and Green Guides guardrails; context flags: homepage, service page, location, pricing, contact or hours, FAQ; reference /blog/blog-mega-analyzer-laundromat-readiness/. - Why: Fixing these wins "laundromat near me" and "open now" in the Google map pack and AI answers, and keeps hours, payment and review claims honest. - Fix: Emit one global DryCleaningOrLaundry node (@id `<site>`/#business with name, image, telephone, url, PostalAddress, GeoCoordinates, openingHoursSpecification, paymentAccepted, priceRange, currenciesAccepted, amenityFeature, areaServed and sameAs to GBP, Yelp and Facebook), mirror real hours in schema and state attended hours separately when access is 24/7, list every payment method in copy and schema, and give wash-and-fold and pickup-and-delivery their own pages with Service nodes. Set the Google Business Profile category to Laundromat with matching NAP, use only real reviews (FTC 16 CFR Part 465), add FAQPage, an accessibility statement, Spanish pages with reciprocal hreflang where warranted, make superlative and eco claims specific, and validate every JSON-LD block. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org DryCleaningOrLaundry, LocationFeatureSpecification, Service, FAQPage; FTC 16 CFR Part 465; FTC Green Guides; ADA Title III; WCAG 2.1 AA. - [ ] **A20.5 No sameAs on the business node** - Pass: The home and contact pages' business node links external profiles via sameAs. - Numbers and lists the tool uses: /"sameAs"\s*:/i; gated on the home or contact page. - Why: Engines reconcile the laundromat across the citation graph through its Business Profile, Yelp and Facebook pages. - Fix: Link Google Business Profile, Yelp and Facebook in sameAs. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org sameAs. - [ ] **A20.6 The site claims strong ratings or shows reviews, but there is no machine-readable AggregateRating / Review schema** - Pass: Rating claims or review widgets on the home or contact page are backed by AggregateRating or Review schema. - Warn: When schema is present the tool asks you to confirm the count reflects a real platform total. - Numbers and lists the tool uses: claims /\b5-?star|highly rated|top-?rated|best laundromat\b/i or widget /yelp|google review|\b\d(?:\.\d)?\s*(?:out of|\/)\s*5\s*star/i; FTC penalty up to $51,744 per violation. - Why: Fabricated ratings are an advertising violation, and real ones should be machine-readable. - Fix: Once you have real reviews, emit aggregateRating with the real count. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: 16 CFR Part 465. - [ ] **A20.7 No accessibility statement or accessibility signal** - Pass: Any audited page where the signal regex matches the raw HTML, or that is the accessibility page, gets the pass row 'Accessibility / ADA signal present'. - Fail: The homepage matches none of the signal phrases. - Numbers and lists the tool uses: /accessibility statement|web content accessibility|wcag|ada compliant|ada accessible|wheelchair accessible/i tested on the raw HTML, or isAccessibilityPage; the fail fires on the homepage only; the pass fires on any page where the signal matches; the fail text cites web filings topping 5,100 in 2025. - Why: Laundromats are public accommodations under ADA Title III, so the website is in scope too. - Fix: Publish an accessibility statement, reach WCAG 2.1 AA, and note accessible machines and parking. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: ADA Title III; WCAG 2.1 AA. - [ ] **A20.8 You advertise 24-hour access AND on-site staff/attendant** - Pass: The site does not claim both 24-hour access and on-site staff. - Numbers and lists the tool uses: 24/7 claim /\bopen 24 ?hours?\b|24\/7|24-7|\baround the clock\b|always open\b/i on body plus footer, combined with /\battendant(?:s)?\b|staff(?:ed| on (?:site|duty))|on-?site staff/i on the body (Mega Analyzer). - Why: An overstated staffing claim is a trust problem and an FTC substantiation risk. - Fix: State which hours are self-service and which are attended. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A20.9 Unqualified superlative / comparative claim detected (`<claim>`)** - Pass: Any superlative appears only inside a quoted customer testimonial. - Fail: A superlative such as 'cheapest', 'best laundromat' or 'newest machines' appears outside blockquote or q elements. - Numbers and lists the tool uses: /\b(cheapest|lowest prices?|best laundromat|#1 laundromat|newest machines|largest laundromat|only 24-?hour laundromat)\b/i on body plus footer; quoted scope /<(blockquote|q)\b[^>]*>[\s\S]*?<\/\1>/gi; flagged when the total match count exceeds the count inside blockquote or q elements (any match outside a quote) (Mega Analyzer). - Why: Objective claims must be substantiable under FTC advertising law. - Fix: State the basis for the claim or soften it to non-comparative language. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FTC endorsement guides. - [ ] **A20.10 Environmental claim detected (`<claim>`) with no specific basis** - Pass: Any eco claim is accompanied by a specific basis such as ENERGY STAR, a percentage saving or high-efficiency front-load machines. - Numbers and lists the tool uses: green claim /\b(eco-?friendly|green laundromat|environmentally friendly|energy efficient|water saving|sustainable)\b/i; basis /energy star|\b\d+%\s*(?:less|fewer)\b|high-?efficiency front-?load/i (Mega Analyzer). - Why: The FTC Green Guides require eco, energy and water claims to be specific and substantiated. - Fix: Replace the claim with a concrete fact or drop it. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FTC Green Guides. ### Law firms - [ ] **A21.1 Multi-jurisdiction firm confirms hreflang (offices detected: `<cities>`)** - Pass: Fewer than two distinct global office cities from the list appear in the body text of a legal site (Mega Analyzer). - Fail: Two or more distinct global office cities from the list appear in the body text of a legal site; the tool asks you to confirm self-referential hreflang plus x-default are emitted site-wide (Mega Analyzer). - Numbers and lists the tool uses: Gate: legal site detected; city regex /\b(london|brussels|amsterdam|frankfurt|paris|madrid|milan|dublin|munich|shanghai|beijing|hong kong|singapore|tokyo|seoul|dubai|abu dhabi|sydney|melbourne|toronto|s[aã]o paulo|mexico city|riyadh|doha|geneva|zurich|luxembourg|moscow|johannesburg)\b/gi on the body text; distinct hits 2 or more; up to 6 cities listed; hreflang itself is not inspected (Mega Analyzer). - Why: A global office list on an hreflang-free English site reads as US-only to non-US search and AI engines. - Fix: Emit self-referential hreflang plus x-default site-wide, with localized pages for each jurisdiction where you practise. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: hreflang. - [ ] **A21.2 YMYL-Legal: LegalService schema** - Pass: A legal site declares LegalService, Attorney or Notary. - Numbers and lists the tool uses: regex /LegalService|Attorney|Notary/i (Mega Analyzer). - Why: Legal queries get tighter source-quality filters, so the firm needs a legal entity type. - Fix: Add LegalService or Attorney JSON-LD. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org LegalService. - [ ] **A21.3 Enterprise site-search detected** - Pass: On a large multi-office (BigLaw) legal site, an enterprise search vendor (Coveo, Algolia, Elasticsearch, Swiftype or SearchUnify) is detected, reported as an advisory pass. - Numbers and lists the tool uses: Gate: isLegalSite and looksBig, where looksBig = 2 or more distinct GLOBAL_CITIES matches in the body text, or /\b(over|more than)\s*\d{3,}\s*(lawyers|attorneys)\b/i, or /\bglobal (law )?firm\b|\bmultinational\b|\boffices (around|across) the (world|globe)\b|\bam ?law\b/i on the body text; then /coveo|algolia|elasticsearch|swiftype|searchunify/i on bodyText plus the stringified JSON-LD (mega-analyzer). - Why: Licensed enterprise search is often already able to power retrieval-based answers, so the remaining build is a user interface layer. - Fix: Consider a cited, no-advice generative answering concierge over the firm's own publications. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A21.4 YMYL-Legal: bar number or jurisdiction** - Pass: Bar admission language or a license marker appears in the body text. - Numbers and lists the tool uses: /bar\s*(?:number|#|no|admission|admitted)|state bar of|admitted in\b|jd\b|esq\b/i. - Why: Attorney credential disclosure is expected on legal sites. - Fix: Publish the bar number and jurisdiction. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A21.5 YMYL-Legal: attorney-advertising disclaimer (or visible /disclaimer link)** - Pass: A legal disclaimer is present on the page or a disclaimer-class page is linked. - Numbers and lists the tool uses: /\b(not\s+legal\s+advice|attorney\s+advertising|prior\s+results\s+do\s+not\s+guarantee|attorney[- ]client\s+relationship)\b/i on body text; or any link href matching /\/(disclaimer|legal-notice|notice|terms-?(?:of-)?(?:use|service)?|privacy(?:-policy)?|disclosure|aboutus|legal)\/?(?:$|\?|#)/i. - Why: Attorney advertising rules require a disclaimer. - Fix: Add the disclaimer or link a /disclaimer page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A21.6 Attorney-advertising notice not visible on this page** - Pass: The visible body text contains an attorney advertising notice. - Numbers and lists the tool uses: /attorney advertising/i on body text. - Why: An inline notice on every page is the safer reading of state bar rules. - Fix: Add 'Attorney advertising. Prior results do not guarantee a similar outcome.' inline on every page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: NY 22 NYCRR 1200.7.1 (Rule 7.1); FL Bar 4-7.13; TX Bar 7.02. - [ ] **A21.7 Prior-results disclaimer absent on an attorney bio page** - Pass: Attorney bio pages carry prior-results language. - Numbers and lists the tool uses: /prior results do not guarantee|prior results.{0,40}do not guarantee/i; gated on a Person page. - Why: The disclaimer is required when results are discussed. - Fix: Add 'Prior results do not guarantee a similar outcome.' to each bio page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: NY, FL, TX, NJ bar rules; NY State Bar Opinion 1009. - [ ] **A21.8 No attorney-client-relationship disclaimer on a contact/office page** - Pass: Contact and office pages state that contacting the firm does not create an attorney-client relationship. - Numbers and lists the tool uses: /does not create (?:an )?attorney-client relationship|no attorney-client relationship/i; gated on an office page or a title matching /contact|inquir/i. - Why: Contact forms should not imply representation. - Fix: Add 'Merely contacting [firm] does not create an attorney-client relationship' above or beside the contact form. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A21.9 No do not send confidential information warning on a contact page** - Pass: Contact and office pages warn visitors not to send confidential information. - Numbers and lists the tool uses: /(?:should not send|do not send) confidential|confidential information.{0,80}(?:not be subject|not be treated as confidential|not be confidential)/i; gated on an office page or a title matching /contact|inquir/i. - Why: Best practice is a modal on attorney mailto links and visible footer text on contact pages. - Fix: Add the confidentiality warning next to every contact form and attorney email link. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: ABA Model Rule 1.18. - [ ] **A21.10 NY-office firm without visible Statement of Client's Rights link** - Pass: A firm whose body text mentions New York has the phrase Statement of Client's Rights (or Client's Rights) in its visible body text; a footer link's anchor text counts. - Fail: The body text matches /new york|nyc|manhattan|brooklyn/i and does not match /statement of client.s rights|client.s rights/i. - Numbers and lists the tool uses: /statement of client.s rights|client.s rights/i; /new york|nyc|manhattan|brooklyn/i. - Why: Conspicuous posting is required, and a footer link satisfies the modern interpretation. - Fix: Add a footer link to the Statement of Client's Rights. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: 22 NYCRR 1210.1. - [ ] **A21.11 BigLaw firm with no ranking-directory sameAs in schema** - Pass: A large multi-office firm's JSON-LD includes Chambers, Legal 500, Best Lawyers, Martindale, Super Lawyers, Lawdragon or IFLR1000 URLs. - Numbers and lists the tool uses: /chambers|legal[\s-]?500|best[\s-]?lawyers|martindale|super[\s-]?lawyers|lawdragon|iflr1000/i on the JSON-LD text; looksBig = 2 or more hits from the global cities list (london, brussels, amsterdam, frankfurt, paris, madrid, milan, dublin, munich, shanghai, beijing, hong kong, singapore, tokyo, seoul, dubai, abu dhabi, sydney, melbourne, toronto, sao paulo, mexico city, riyadh, doha, geneva, zurich, luxembourg, moscow, johannesburg) or /\b(over|more than)\s*\d{3,}\s*(lawyers|attorneys)\b/i or /\bglobal (law )?firm\b|\bmultinational\b|\boffices (around|across) the (world|globe)\b|\bam ?law\b/i. - Why: AI engines reconcile large firms through Chambers, Legal 500, Best Lawyers and Martindale rather than Wikipedia. - Fix: Add those directory URLs to the firm Organization and each attorney Person sameAs array. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org sameAs. - [ ] **A21.12 Thought-leadership page with no author binding** - Pass: Article pages on a large firm's site declare an author in JSON-LD. - Fail: A BigLaw article page with no Article type and no author property. - Numbers and lists the tool uses: /"author"/i on the JSON-LD text; gated on looksBig and an article page. - Why: Named-author content is cited materially more often by AI engines than content attributed only to the firm. - Fix: Bind each publication to its author's Attorney or Person node by @id. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org author. - [ ] **A21.13 `<n>` legal-readiness issue(s)** - Pass: No legal-readiness issue is detected across bio, practice, office and firm-level contexts. - Numbers and lists the tool uses: NY 22 NYCRR 1200 and 1210.1, FL Bar 4-7, TX Bar 7.02; prompt rules: footer 'Attorney advertising. Prior results do not guarantee a similar outcome.'; Person plus Attorney schema with hasCredential (Juris Doctor, Licensed Attorney recognizedBy the state bar, bar number); LegalService on practice pages; firm-level ['Organization','LegalService','ProfessionalService'] with @id `<site>`#org; office PostalAddress, telephone and openingHoursSpecification (08:30 to 18:00 Mon to Fri example); no-attorney-client-relationship text above contact forms; NY Statement of Client's Rights link; EU-office consent platform (OneTrust, Usercentrics, Cookiebot) per GDPR Art. 7 and ePrivacy; validate on the Rich Results Test and validator.schema.org; never invent bar admissions or honors. - Why: State-bar advertising rules and citeability as a legal entity both depend on these signals. - Fix: Work through the listed issues with the prompt rules above, validating every schema block and never inventing admissions or honors. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: 22 NYCRR 1200; GDPR Art. 7. - [ ] **A21.14 EU-office firm without a visible cookie / consent banner** - Pass: A cookie notice, policy, preferences, settings or consent-management reference is present when the firm names an EU office city. - Fail: An EU city is mentioned and no cookie notice text is found. - Numbers and lists the tool uses: cookie regex /cookie (?:notice|policy|preferences|settings)|consent management/i; EU city regex /amsterdam|london|brussels|frankfurt|paris|madrid|milan|dublin/i. - Why: A firm with an EU office must collect explicit consent for non-essential cookies before they fire. - Fix: Add a consent banner that blocks non-essential cookies until the visitor agrees. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: GDPR Art. 7; ePrivacy Directive. - [ ] **A21.15 Accessibility-governance tool detected in the stack** - Pass: An accessibility monitoring vendor (Siteimprove, AudioEye, accessiBe, UserWay, Level Access or Monsido) is detected; advisory pass only. - Numbers and lists the tool uses: /siteimprove|audioeye|accessibe|userway|level ?access|monsido/i on the body text plus JSON-LD; advisory pass only; fires only inside the BigLaw layer: isLegalSite and looksBig (2 or more distinct GLOBAL_CITIES hits, or 'over/more than' followed by a 3+ digit number of lawyers/attorneys, or 'global law firm', 'multinational', 'offices around/across the world/globe' or 'Am Law' in the body). - Why: A law firm that pays for an accessibility watchdog yet ships attorney headshots with no alt text is demonstrably on notice in ADA litigation. - Fix: Verify the attorney headshot and bio grid passes WCAG 1.1.1 so the monitoring contract is not evidence against you. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: WCAG 1.1.1. ### Men's health and TRT clinics - [ ] **A22.1 Spanish-language version with hreflang detected** - Pass: The home page declares at least one hreflang alternate. - Fail: Home page has zero hreflang declarations (Mega Analyzer). - Numbers and lists the tool uses: Regex /hreflang=/gi count of 0 on the home page (Mega Analyzer). - Why: The Hispanic male demographic is underserved by clinics with English-only sites. - Fix: Publish Spanish landing pages with bidirectional hreflang es, en and x-default. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A22.2 This symptom / treatment / FAQ page reads as Q&A but has no FAQPage JSON-LD** - Pass: The FAQ page carries FAQPage schema. - Fail: A FAQ or service page with four or more question marks has no FAQPage schema. - Numbers and lists the tool uses: looksQA = /\?(?:\s|$|<)/ with a question-mark count >= 4; pages: FAQ, service (mega-analyzer). - Why: Symptom and treatment questions are what patients ask answer engines, and the schema makes the clinic's answers eligible. - Fix: Wrap the questions in FAQPage and keep the answers clinician-reviewed. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org FAQPage. - [ ] **A22.3 This page collects patient/health information (intake / booking / symptom form)** - Pass: - Warn: A contact or booking page contains a form or health-intake language. - Numbers and lists the tool uses: gate (contact || booking) && /<form|symptom|intake|new patient|book (?:an? )?appointment|schedule (?:an? )?(?:consult|appointment)|date of birth|medical history/i. - Why: Tracking pixels on pages that collect health information have drawn OCR and FTC enforcement actions. - Fix: Sign a BAA with the form vendor, encrypt submissions, post a Notice of Privacy Practices, and keep marketing pixels off any page that handles health data. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: HIPAA. - [ ] **A22.4 Treatment page is typed only as generic WebPage** - Pass: Treatment pages are typed MedicalWebPage with about MedicalProcedure or Drug. - Numbers and lists the tool uses: procedure types /MedicalProcedure|MedicalTherapy|TherapeuticProcedure|Drug|MedicalCondition/; service pages that are not location pages (Mega Analyzer). - Why: Medical typing maps 'how does this treatment work' queries to the page. - Fix: Type the page MedicalWebPage with about MedicalProcedure or Drug plus medicalSpecialty. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org MedicalWebPage. - [ ] **A22.5 medicalSpecialty declared in schema** - Pass: The clinic node declares medicalSpecialty and areaServed. - Numbers and lists the tool uses: regex /"medicalSpecialty"\s*:/i and /"areaServed"/i, pass-only rows (Mega Analyzer). - Why: Specialty and service area tell YMYL systems what the clinic treats and where. - Fix: Add medicalSpecialty and areaServed to the MedicalClinic node. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org medicalSpecialty. - [ ] **A22.6 Brand node has no sameAs / telephone** - Pass: The brand node on the home or contact page carries both sameAs and telephone. - Numbers and lists the tool uses: gated on an Organization node on the home or contact page. - Why: Zero sameAs is an entity-dark signal. - Fix: Link Facebook, Instagram, YouTube, LinkedIn and the Business Profile in sameAs, and add telephone. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org sameAs. - [ ] **A22.7 No medical reviewer (reviewedBy / lastReviewed) on YMYL-health content** - Pass: Blog and service pages declare reviewedBy or lastReviewed and a credentialed clinician (hasCredential or clinical jobTitle) in schema. - Warn: The content has a Person author but it looks like a CMS or agency placeholder. - Numbers and lists the tool uses: /"reviewedBy"\s*:|"lastReviewed"\s*:/i; placeholder author /"author"\s*:\s*\{[^}]*"name"\s*:\s*"(?:admin|editor|staff|content|team|marketing|[a-z]+ content|webmaster|seo)[^"]*"/i. - Why: A named medical reviewer is the primary E-E-A-T trust signal for health content. - Fix: Declare a named credentialed reviewer and date in schema and add a visible 'Medically reviewed by <Clinician, credential> on `<date>`' byline. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: Google YMYL / E-E-A-T. - [ ] **A22.8 No AggregateRating/Review schema** - Pass: Home, location and contact pages carry AggregateRating or Review schema from each clinic's Business Profile with HIPAA authorization for any testimonial. - Warn: When schema is present the tool asks you to confirm the total; when ratings are claimed without schema it reports that variant. - Numbers and lists the tool uses: widget /google review|\btrustpilot\b|birdeye|podium|\b\d(?:\.\d)?\s*(?:out of|\/)\s*5\s*star|patient (?:reviews|testimonials)/i; claims /\b5-?star|highly rated|top-?rated|thousands of (?:happy )?(?:patients|men)|\d[, ]?\d{3}\+? (?:reviews|patients)/i. - Why: A testimonial that reveals treatment is protected health information. - Fix: Drive reviews through each clinic's Business Profile, emit the real AggregateRating, and get written HIPAA authorization before publishing any testimonial. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FTC 16 CFR Part 465; HIPAA. - [ ] **A22.9 Location page has no MedicalClinic / MedicalBusiness node** - Pass: Each location page has a MedicalClinic or MedicalBusiness node with a page-unique @id, a populated address, hours, sameAs and geo. - Fail: Location page without the node; sub-issues when the @id is shared across clinics (pathname / or empty), the address is empty, or PostalAddress, hours, sameAs or geo is missing. - Numbers and lists the tool uses: clinicId /"@id"\s*:\s*"([^"]*#(?:medicalbusiness|localbusiness|clinic|organization)[^"]*)"/i; shared when the @id pathname is '/' or ''; emptyAddress /"streetAddress"\s*:\s*""/ or a PostalAddress with /"addressLocality"\s*:\s*""/. - Why: A shared @id collapses all clinics into one entity and an empty address leaves the location with no NAP. - Fix: Give each location a page-unique @id and a full PostalAddress, hours, geo and its own Google Business Profile in sameAs. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org MedicalClinic. - [ ] **A22.10 "FDA-approved" appears alongside testosterone/TRT** - Pass: No FDA-approved claim appears next to testosterone content. - Numbers and lists the tool uses: /\bfda-?approved\b/i together with /testosterone|trt|low ?t/i (Mega Analyzer). - Why: Testosterone is approved only for classical hypogonadism, not age-related low T; the February 2025 label update removed the boxed warning but did not broaden the indication. - Fix: Make the indication accurate and bounded. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FDA; FTC. - [ ] **A22.11 Anti-aging / age-related framing of testosterone detected** - Pass: No anti-aging framing accompanies TRT or HRT content. - Numbers and lists the tool uses: /anti-?aging|reverse aging|feel (?:20|young) again|fountain of youth|age-?related (?:low ?t|testosterone|decline)|because you'?re getting older/i with TRT or HRT treatment content (Mega Analyzer). - Why: Anti-aging framing is an off-label promotion risk. - Fix: Frame the treatment around diagnosed hypogonadism. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FDA off-label promotion. - [ ] **A22.12 Online/telehealth testosterone-prescribing language detected** - Pass: TRT pages describe an in-clinic model with no online-prescription claim. - Numbers and lists the tool uses: /(?:get|start) (?:trt|testosterone) online|prescription (?:delivered|shipped|online)|online (?:trt|testosterone) (?:prescription|treatment)|no (?:office|in-person) visit/i on any page with TRT treatment content; the in-clinic pass message is reported only on home or service pages with TRT content (Mega Analyzer). - Why: The Ryan Haight Act and DEA rules generally require an in-person evaluation for a Schedule III drug. - Fix: State the in-clinic model, or confirm and cite the DEA exception you rely on. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: Ryan Haight Act; DEA Schedule III. - [ ] **A22.13 Strong weight-loss claims appear with GLP-1 / semaglutide content** - Pass: No guaranteed or numeric weight-loss claim accompanies GLP-1 content. - Numbers and lists the tool uses: GLP-1 content = weight-loss treatment or /semaglutide|tirzepatide|glp-?1/i; claims /(?:lose|drop)\s+\d+\s*(?:lbs?|pounds)|guaranteed weight loss|melt (?:away )?fat|effortless weight/i (Mega Analyzer). - Why: Weight-loss claims must be substantiated, and compounded sourcing faces FDA scrutiny. - Fix: Keep claims substantiated and disclose that results vary. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FTC; FDA. ### Mental health practices - [ ] **A23.1 YMYL-Health-MentalHealth: state-board license signal (LCSW/LMFT/LPC/LMHC/PsyD #)** - Pass: A state-board credential abbreviation or a license marker appears in the body text. - Numbers and lists the tool uses: /\b(lcsw|lmft|lpc|lmhc|lpcc|psy\.?d|psychologist|state[- ]?board|licensed in\b)/i. - Why: The state-board license is the required credential for therapists. - Fix: Publish the license type and number. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A23.2 YMYL-Health-MentalHealth: Good Faith Estimate / Notice of Privacy Practices (or visible /disclaimer link)** - Pass: No Surprises Act or Notice of Privacy Practices language appears, or a disclaimer-class page is linked. - Numbers and lists the tool uses: /good faith estimate|no surprises act|notice of privacy practices|n\.p\.p\.\b/i. - Why: A Good Faith Estimate is required under the No Surprises Act. - Fix: Publish a Good Faith Estimate and Notice of Privacy Practices notice. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: No Surprises Act. ### Newsletters - [ ] **A24.1 CAN-SPAM notice** - Pass: Newsletter, blog and affiliate sites state the CAN-SPAM commitments: an unsubscribe link and the physical mailing address in every message, honest subject lines and unsubscribe processed within 10 business days. - Numbers and lists the tool uses: generated for newsletter, blog and affiliate business types; reply STOP or unsubscribe; unsubscribe processed within 10 business days per 15 U.S.C. 7704. - Why: Commercial email must carry a working unsubscribe and a physical address. - Fix: Put the physical mailing address and an unsubscribe link in every marketing email and state the policy on the site. - Verify: [Legal Pages Generator](https://jwatte.com/tools/legal-pages-generator/). Standard: 15 U.S.C. 7704 (CAN-SPAM). ### Nonprofits - [ ] **A25.1 'nonprofitStatus': 'NonprofitType501c3' in JSON-LD** - Pass: The Organization node declares nonprofitStatus NonprofitType501c3. - Numbers and lists the tool uses: regex /nonprofitStatus[^,}]{0,80}NonprofitType501c3/ (Mega Analyzer). - Why: It is the signal Google uses to confirm U.S. 501(c)(3) status. - Fix: Add 'nonprofitStatus': 'NonprofitType501c3' to the Organization schema. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org nonprofitStatus. - [ ] **A25.2 taxID (EIN) in JSON-LD** - Pass: The Organization node carries taxID. - Numbers and lists the tool uses: regex /"taxID"\s*:/ (Mega Analyzer). - Why: TaxID cross-references your IRS record. - Fix: Add 'taxID': 'XX-XXXXXXX' to the Organization schema. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org taxID. - [ ] **A25.3 DonateAction in Organization.potentialAction** - Pass: The Organization node carries a DonateAction in potentialAction. - Numbers and lists the tool uses: regex /DonateAction/ (Mega Analyzer). - Why: DonateAction makes the Donate button in Google's Knowledge Panel possible. - Fix: Add potentialAction {"@type": "DonateAction", "target": "`<donate URL>`"}. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org DonateAction. - [ ] **A25.4 EIN visible on the site** - Pass: An EIN-shaped number appears in the visible copy. - Numbers and lists the tool uses: Round 11 card: body text matches /\b(?:EIN|Tax ID)[:\s#]*?(\d{2}-?\d{7})\b/i or /\b(\d{2}-\d{7})\b/; Local-Nonprofit vertical check (line 2642): body text matches /EIN[: #]+\d|tax[- ]deductible|501$c$$3$/i as the combined EIN / 501(c)(3) statement. - Why: Donors and foundations look for the EIN before giving. - Fix: Add a footer line: 'EIN XX-XXXXXXX. Donations tax-deductible to the extent allowed by law.'. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A25.5 501(c)(3) status stated** - Pass: The body text matches /\b501\s*$?c$?\s*$?\s*3$?\)?/i (501(c)(3) with optional spaces or parentheses). - Numbers and lists the tool uses: /\b501\s*$?c$?\s*$?\s*3$?\)?/i on body text. - Why: Donors and grant officers confirm status at a glance. - Fix: State the 501(c)(3) status in the footer or About section. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A25.6 Tax-deductibility language present** - Pass: The body says donations are tax-deductible. - Numbers and lists the tool uses: /tax[-\s]?deductible/i. - Why: Fundraising compliance in many states, and a trust signal for major-gift donors. - Fix: Add 'Donations are tax-deductible to the extent allowed by law.'. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A25.7 Local-Nonprofit: No board roster / leadership page reference** - Pass: Board or leadership language appears on the page. - Numbers and lists the tool uses: /board\s+of\s+(?:directors|trustees)|leadership|our\s+board/i. - Why: A board roster is a governance trust signal. - Fix: Add a board or leadership page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A25.8 Candid (GuideStar) profile linked** - Pass: The site links its Candid (GuideStar) profile or references Form 990. - Numbers and lists the tool uses: Round 11 card: /guidestar\.org\/profile\/|candid\.org\/profile\// on the HTML plus JSON-LD text; Local-Nonprofit vertical check (line 2644): body text matches /(?:form\s+990|guidestar|candid\.org|charity\s+navigator)/i or any link href matches /guidestar|candid\.org|charitynavigator|propublica\.org\/nonprofits/i. - Why: Donors doing diligence go to Candid first. - Fix: Link candid.org/profile/`<EIN>` and the Form 990 from the footer or About page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A25.9 Charity Navigator badge / profile linked** - Pass: The site links its Charity Navigator profile. - Numbers and lists the tool uses: /charitynavigator\.org\/(ein|profile|index\.cfm)/i. - Why: A trust signal for major-gift donors and grant officers. - Fix: Apply (free), then embed the badge or link the profile. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A25.10 BBB Wise Giving Alliance badge / profile linked** - Pass: The site links give.org or a bbb.org/charity profile. - Numbers and lists the tool uses: /give\.org|bbb\.org\/charity/i. - Why: Especially trusted by donors over 50. - Fix: Apply at give.org/get-accredited and embed the seal. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A25.11 Donate link present somewhere on the page** - Pass: An anchor on the page links to a donation flow. - Numbers and lists the tool uses: /<a[^>]+href=["'][^"']*(?:donat|give-?now|contribute|sponsor)/i. - Why: Donors should reach the donation flow in one click. - Fix: Add a Donate button to the header on every page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A25.12 Modern donation platform detected (`<platform>`)** - Pass: The page links a modern donation processor. - Fail: Only a PayPal hosted-button flow (/paypal\.com\/donate\/?\?[^"']*hosted_button_id=/i) or no recognizable processor at all. - Numbers and lists the tool uses: donorbox.org, givebutter.com, classy.org, givelively.org, networkforgood.com, bloomerang.co, stripe.com/payment, donorperfect.com, fundraiseup.com. - Why: Hosted PayPal buttons lack recurring giving, donor email capture and automatic receipts. - Fix: Move to Donorbox, Givebutter, Give Lively or Classy. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A25.13 Local-Nonprofit: No visible /donate or /give CTA** - Pass: At least one link points to a donate page or donation platform. - Numbers and lists the tool uses: href matches /\/(donate|donation|give|giving|contribute|support|sponsor|pushpay|donorbox|givebutter|classy\.org|every\.org|paypal\.com\/donate|stripe\.com\/donate)\/?(?:$|\?|#)/i (Mega Analyzer). - Why: A donate call to action is the primary nonprofit conversion. - Fix: Add a /donate or /give link in the main navigation. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). ### Photographers - [ ] **A26.1 Photographer site: ImageObject or Photograph schema with rights metadata** - Pass: A photography site declares ImageObject or Photograph schema for portfolio work. - Warn: Neither type is present. - Numbers and lists the tool uses: vendor gate /^(Pixieset|SmugMug|Format|Pic-Time|ShootProof|Zenfolio)$/i or photographer copy on title, h1 and meta; top 5 to 10 portfolio pieces (Mega Analyzer). - Why: Images are the product, and the markup declares rights to Google Images and AI image search. - Fix: Add ImageObject with copyrightHolder, copyrightNotice, creditText, license and acquireLicensePage for portfolio pieces. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org ImageObject, Photograph. ### Production homebuilders - [ ] **A27.1 No Spanish-language version / hreflang=es detected** - Pass: A Spanish hreflang or /es/ path is detected. - Fail: An about, process or financing page with no Spanish signal. - Numbers and lists the tool uses: hreflangs matching /^es(\b|-)/i, or html /hreflang=["']es/i, or path /\/es(\/|$)/; gated to about, process and financing pages. - Why: First-time-buyer demand skews heavily Hispanic and most peers are English only. - Fix: Add Spanish pages with reciprocal hreflang en, es and x-default, and translate all disclosures. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: hreflang. - [ ] **A27.2 priceRange on the community node is a bare numeric range with no currency symbol** - Pass: PriceRange on a community node starts with a currency symbol. - Numbers and lists the tool uses: bare /"priceRange"\s*:\s*"\s*\d[\d,]*\s*-\s*\d[\d,]*\s*"/i and not /"priceRange"\s*:\s*"\s*\$/i on community pages (Mega Analyzer). - Why: An engine cannot tell dollars from square feet in a bare number range. - Fix: Use a currency-prefixed priceRange and put square footage on floorSize. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org priceRange. - [ ] **A27.3 Home / floor-plan page does not wrap the home in a SingleFamilyResidence / Residence (or Product) node** - Pass: Each floor-plan or inventory page wraps the home in a SingleFamilyResidence, Residence, House, Accommodation or Product node with an Offer. - Numbers and lists the tool uses: types /(^|\b)(SingleFamilyResidence|Residence|House|Accommodation|Product)(\b|$)/ on floor-plan or inventory pages; floorSize QuantitativeValue unitCode FTK (Mega Analyzer). - Why: A bare FloorPlan is not something an engine can price or sell; a Residence plus Offer is a shoppable home. - Fix: Emit SingleFamilyResidence with numberOfBedrooms, numberOfBathroomsTotal, floorSize and offers. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org SingleFamilyResidence. - [ ] **A27.4 floorSize value contains a thousands comma** - Pass: FloorSize.value is a clean number. - Numbers and lists the tool uses: regex /"floorSize"[\s\S]{0,120}?"value"\s*:\s*"\s*\d{1,3},\d{3}/i on the JSON-LD of floor-plan or inventory pages, excluding the about page (Mega Analyzer homebuilder module). - Why: QuantitativeValue.value must be a number without formatting. - Fix: Emit the raw integer with unitCode FTK. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org QuantitativeValue. - [ ] **A27.5 `<n>` production-homebuilder-readiness issue(s)** - Pass: No production-homebuilder readiness issues are reported across community, floor-plan, inventory, process, financing, warranty, FAQ, contact and about contexts. - Numbers and lists the tool uses: Fair Housing Act 42 U.S.C. 3604(c); RESPA Section 8 12 U.S.C. 2607 and Reg X; TILA Reg Z 12 CFR 1026.24; floorSize unitCode FTK (Mega Analyzer). - Why: The aggregate covers citeability as a homebuilder plus Fair Housing, RESPA and Reg Z rules. - Fix: Firm [HomeAndConstructionBusiness, Organization] (Corporation plus tickerSymbol if public); per-community [HomeAndConstructionBusiness, Place] with geo, areaServed and currency-prefixed priceRange; SingleFamilyResidence plus Offer with InStock or LimitedAvailability, priceValidUntil and seller @id; FAQPage on process, financing and warranty; Person for leaders; AggregateRating only from a real platform count; never invent prices or counts. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: 42 U.S.C. 3604(c); 12 U.S.C. 2607; 12 CFR 1026.24. - [ ] **A27.6 High-intent informational page (buying process / financing / warranty / FAQ) carries no FAQPage JSON-LD** - Pass: A buying process, financing or FAQ page carries FAQPage schema (a warranty page with FAQPage records no pass). - Fail: A buying process, financing, warranty or FAQ page carries no FAQPage JSON-LD. - Numbers and lists the tool uses: Fail gate: (isProcessPage or isFinancingPage or isWarrantyPage or isFaqPage) and not hasFaqPage; pass gate: (isProcessPage or isFinancingPage or isFaqPage) and hasFaqPage; hasFaqPage = a schema type matching /FAQPage/i or JSON-LD text matching /"@type"\s*:\s*"FAQPage"/i (mega-analyzer). - Why: This is the single biggest AEO miss for a builder, because AI Overviews lift exactly this question and answer content. - Fix: Extend the FAQPage template to these pages and keep the answers factual and Fair Housing compliant. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org FAQPage. - [ ] **A27.7 Community page has no per-community Place / LocalBusiness node** - Pass: Each community page carries its own Place or LocalBusiness node, or at least a PostalAddress. - Numbers and lists the tool uses: pass condition hasLocalBiz || /"PostalAddress"/i on community pages. - Why: Each community should be a discrete, mappable entity so the map pack can place it. - Fix: Emit {"@type":["HomeAndConstructionBusiness","Place"], name, address, geo, areaServed, parentOrganization} on every community page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org/Place. - [ ] **A27.8 Leadership / team content present but no Person schema** - Pass: An About page with leadership or sales-team wording carries Person schema. - Numbers and lists the tool uses: /\b(leadership|our team|executives?|founder|ceo|president|division president|new home consultant|sales (?:counselor|consultant))\b/i on the About page. - Why: The people who close the sale are invisible to engines without Person schema. - Fix: Emit Person nodes with jobTitle, worksFor, areaServed and sameAs. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org Person. - [ ] **A27.9 No machine-readable AggregateRating / Review schema on the firm node** - Pass: The About or contact page carries AggregateRating or Review schema tied to a verifiable platform total. - Warn: When schema is present the tool asks you to confirm the count is tied to a verifiable platform total. - Numbers and lists the tool uses: /"aggregateRating"\s*:\s*\{/i; /"@type"\s*:\s*"Review"/i; gated on the About or contact page. - Why: AI search cannot cite 'rated X by N buyers' unless it is structured, and under FTC endorsement rules the number must be substantiable. - Fix: Show the platform rating as text that links to the source. Do not copy it into aggregateRating on the firm node: Google allows no ratings from other sites and shows no stars for a business's own reviews. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FTC endorsement rules. - [ ] **A27.10 No Equal Housing Opportunity statement / logo detected** - Pass: About, contact and community pages carry an Equal Housing Opportunity statement or logo. - Numbers and lists the tool uses: /equal housing (?:opportunity|lender)|fair housing|\beho\b|equal-housing/i on body and footer. - Why: The Fair Housing Act governs all housing advertising. - Fix: Add the EHO logo and statement sitewide. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: 42 U.S.C. 3604(c). - [ ] **A27.11 An affiliated / preferred lender or title company is promoted but no RESPA affiliated-business-arrangement (ABA) disclosure was detected** - Pass: Pages that promote an affiliated lender or title company carry a RESPA affiliated-business disclosure. - Numbers and lists the tool uses: lender mention /\b(preferred lender|in-house (?:mortgage|lender)|our (?:mortgage|lending) (?:partner|affiliate|company)|affiliated (?:lender|mortgage|title)|mortgage solutions|home loans?|title (?:company|services)|loandepot)\b/i; disclosure /affiliated business arrangement|respa|you are not required to use|use of (?:the|an) affiliated|no requirement (?:that|to use)|ABA disclosure/i; gated on financing, process, About or contact pages. - Why: RESPA Section 8 requires an affiliated-business disclosure when referring business to an affiliate. - Fix: Add the notice with the nature of the relationship, an estimate of charges and 'You are NOT required to use [affiliate]'. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: 12 U.S.C. 2607 (RESPA Section 8); Regulation X. - [ ] **A27.12 A rate / monthly-payment / no money down claim appears without the paired TILA / Regulation Z advertising disclosures** - Pass: Any rate, monthly-payment or no-money-down claim is accompanied by APR and Regulation Z disclosure language. - Numbers and lists the tool uses: claim /\b(\d\.\d{1,3}\s*%\s*(?:apr|interest|rate)|\$\d[\d,]*\s*\/?\s*(?:mo|month|monthly)|as low as \d|no money down|zero down|\$0 down|down[- ]payment assistance|\d{1,2}%\s*down)\b/i; disclosure /\bapr\b|annual percentage rate|subject to credit approval|terms and conditions apply|see (?:a )?(?:loan officer|lender) for details|rates? subject to change|equal housing lender|nmls\s*#?\s*\d/i. - Why: Once an ad states a specific rate or payment, Regulation Z triggers required disclosures. - Fix: Add APR, terms, 'subject to credit approval' and the lender NMLS number next to the claim. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: 12 CFR 1026.24 (Regulation Z). - [ ] **A27.13 Warranty page without a clear new-home warranty disclosure** - Pass: The warranty page states the coverage terms. - Numbers and lists the tool uses: /\b(\d{1,2})-?year (?:structural |limited )?warranty|limited (?:home |new-?home )?warranty|warranty (?:terms|coverage|administered)|2-?10 home buyers warranty|builder'?s? (?:limited )?warranty/i. - Why: Vague warranty copy is a trust gap and a consumer-protection exposure. - Fix: State the coverage (for example 1-2-10), the administrator, exclusions and the right-to-cure process. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A27.14 Image-dense <floor-plan|community/inventory> page ships `<n>` of `<total>` images with no alt text** - Pass: A community, floor-plan or inventory gallery page with more than 8 images has zero images missing alt. - Fail: The gallery page has more than 3 images missing alt. - Numbers and lists the tool uses: fail when (isCommunityPage || isFloorPlanPage || (isInventoryPage && !isAboutPage)) && imgsMissingAlt > 3; pass needs 0 missing and more than 8 images. - Why: One missing-alt template pattern repeats across every gallery page, which makes it a site-wide WCAG failure and an ADA demand-letter target. - Fix: Set the alt from the existing caption and describe the home, not an occupant. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: WCAG 1.1.1 (Level A); ADA Title III. - [ ] **A27.15 Possible Fair Housing advertising risk** - Pass: No copy expresses a preference by protected class. - Fail: Copy such as 'perfect for young families', 'adults only', 'no children' or 'exclusive community' matches. - Numbers and lists the tool uses: /\b(perfect for (?:a )?(?:young|christian|single|able-bodied)|ideal for families|family-friendly community|adults? only|no children|empty[- ]?nesters? only|safe (?:christian|white) neighborhood|exclusive community)\b/i (Mega Analyzer). - Why: Marketing copy, image alt text and FAQ answers carry the same Fair Housing liability as an advertisement. - Fix: Have counsel review the flagged copy and describe the home, not the occupant. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: 42 U.S.C. 3604(c). ### Registered investment advisers - [ ] **A28.1 Answer-shaped / FAQ content present but no FAQPage schema** - Pass: FAQPage schema is detected. - Fail: An insight page with question-shaped copy has no FAQPage schema. - Numbers and lists the tool uses: isInsightPage and body matches /\?|how |what |when |should |frequently asked/i (mega-analyzer). - Why: This is an open AEO lane for advisers, as long as every answer stays fair and balanced under the Marketing Rule. - Fix: Wrap educational Q&A, not performance or testimonial content, in FAQPage. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org FAQPage. - [ ] **A28.2 Firm node has an empty/absent sameAs** - Pass: The firm node carries at least one sameAs link. - Numbers and lists the tool uses: /"sameAs"/gi count above 0. - Why: AI search computes entity confidence by traversing sameAs. - Fix: Wire the firm to adviserinfo.sec.gov, LinkedIn and ranking profiles. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org sameAs. - [ ] **A28.3 Advisor bio page carries no Person schema** - Pass: Advisor bio pages carry Person schema with a credential. - Numbers and lists the tool uses: gated on an advisor bio page. - Why: For an RIA the advisors are the product. - Fix: Emit Person with jobTitle, worksFor, hasCredential (CFP recognizedBy the CFP Board), memberOf and sameAs (LinkedIn, IAPD or BrokerCheck). - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org Person. - [ ] **A28.4 Advisor bio has Person schema but no hasCredential** - Pass: The advisor Person node carries hasCredential. - Numbers and lists the tool uses: /"hasCredential"|"credentialCategory"/i. - Why: The designation is the wealth-management equivalent of an attorney's bar credential. - Fix: Add the CFP, CFA, CPWA or CIMA designation with recognizedBy. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org EducationalOccupationalCredential. - [ ] **A28.5 Testimonial / Review / aggregateRating schema detected on an RIA site** - Pass: No Review, testimonial or AggregateRating schema is present on the RIA site. - Fail: Review or AggregateRating schema is present, which is a compliance risk under the Marketing Rule. - Numbers and lists the tool uses: /"@type"\s*:\s*"Review"|"aggregateRating"\s*:/i or types /AggregateRating|Review/i; Marketing Rule compliance date Nov 4 2022. - Why: Testimonials and endorsements require clear and prominent disclosures, and the schema claim carries the same liability. - Fix: Do not add or keep client-rating schema without CCO sign-off and the required disclosures. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: SEC Marketing Rule 206(4)-1. - [ ] **A28.6 No visible link to Form ADV (Part 2 brochure) and/or Form CRS detected** - Pass: The About or contact page references Form ADV or Form CRS. - Numbers and lists the tool uses: /form adv|adviserinfo\.sec\.gov|iapd|form crs|adv part 2|disclosure brochure/i or path /form-adv|\/adv|document\/\d+/i. - Why: The SEC requires delivery of Form ADV Part 2 and Form CRS. - Fix: Add a footer or disclosure link to the firm's SEC IAPD page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: SEC Form ADV / Form CRS. - [ ] **A28.7 No fiduciary statement on the About/homepage** - Pass: The About page states that the firm acts as a fiduciary. - Numbers and lists the tool uses: /\bfiduciary\b/i. - Why: The fiduciary statement is the canonical trust and compliance anchor for an RIA. - Fix: Add 'As a registered investment adviser we act as a fiduciary' plus a conflicts acknowledgment. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A28.8 No past performance / investing involves risk disclaimer on a content/strategy page** - Pass: Service and insight pages carry a past-performance disclaimer. - Numbers and lists the tool uses: /past performance (?:is|does)|no(?:t a)? guarantee of future|results are not guaranteed|investing involves risk|not indicative of future/i. - Why: Any performance or strategy discussion must be fair and balanced and present material risks. - Fix: Add 'Past performance is not indicative of future results; investing involves risk including possible loss of principal.'. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: SEC Marketing Rule 206(4)-1. - [ ] **A28.9 Third-party ranking/award claim detected** - Pass: No third-party ranking or award claim appears, or each claim carries its date, criteria and compensation disclosure. - Fail: A Barron's, Forbes, Five Star, Best or Top RIA claim appears. - Numbers and lists the tool uses: /barron'?s|forbes|financial advisor (?:magazine|ria)|five ?star|best (?:wealth|financial|advisor)|top (?:\d+ )?(?:ria|advisor|wealth)/i. - Why: The Marketing Rule treats third-party ratings as testimonials and endorsements. - Fix: Disclose the rating's date, criteria and any compensation with the claim, visibly and in schema. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: SEC Marketing Rule 206(4)-1. - [ ] **A28.10 No SEC-registration statement detected** - Pass: The About page carries the SEC registration statement. - Numbers and lists the tool uses: /registered investment advis(?:e|o)r|registration (?:with the sec )?does not imply|sec[- ]registered/i. - Why: This is standard required disclosure language and an AI-verifiable registration signal. - Fix: Add '`<Firm>` is an investment adviser registered with the SEC. Registration does not imply a certain level of skill or training.'. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A28.11 `<n>` RIA / wealth-management-readiness issue(s)** - Pass: No RIA readiness issue is detected across advisor bio, service, insight, disclosure, contact and About contexts. - Numbers and lists the tool uses: SEC Rule 206(4)-1; Form ADV Part 2; Form CRS; adviserinfo.sec.gov/firm/`<CRD>`; prompt rules: firm ['FinancialService','Organization'] with IAPD sameAs; advisor Person with hasCredential (CFP recognizedBy the CFP Board) and IAPD individual sameAs; FinancialService per offering; FAQPage only on educational Q&A; no Review or testimonial schema without CCO sign-off and Rule 206(4)-1 disclosures (third-party rankings count as testimonials); visible Form ADV and Form CRS links, fiduciary statement, 'Registration does not imply a certain level of skill or training', past-performance disclaimer; validate; never invent CRD numbers or AUM. - Why: Review schema and marketing claims are a compliance risk under the Marketing Rule, and the disclosures are what make the firm citable. - Fix: Work through the listed issues with the prompt rules above, never inventing CRD numbers or AUM. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: SEC Rule 206(4)-1. ### Restaurants - [ ] **A29.1 Menu / MenuItem / MenuSection schema not declared** - Pass: The restaurant declares Menu-family schema, and dietary attributes where relevant. - Fail: A menu page carries neither a Menu node nor Restaurant schema; missing Menu schema is otherwise reported as info. - Numbers and lists the tool uses: Menu types /^(Menu|MenuItem|MenuSection|MenuAddOn|NutritionInformation)$/; diet /suitableForDiet|RestrictedDiet|"diet":/i; menu node /"@type"\s*:\s*"Menu"/i or /"hasMenu"/i (Mega Analyzer). - Why: Menu markup lets AI Overviews pull dishes, prices and dietary attributes, and some platforms place schema only on the homepage. - Fix: Declare Menu > MenuSection > MenuItem with offers and suitableForDiet on every menu page, linked from the Restaurant node via hasMenu. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org Menu. - [ ] **A29.2 A menu link or Menu node exists but there are no MenuSection / MenuItem entries** - Pass: The Menu node is itemized with MenuSection and MenuItem entries. - Numbers and lists the tool uses: /"@type"\s*:\s*"MenuSection"|"hasMenuSection"/i; /"@type"\s*:\s*"MenuItem"|"hasMenuItem"/i (Mega Analyzer). - Why: Shallow menu markup cannot answer what is on the menu or how much a dish costs. - Fix: Add hasMenuSection entries each with hasMenuItem (name, description, Offer price). - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org MenuItem. - [ ] **A29.3 You link a reservation platform (OpenTable, Resy, or Tock) but acceptsReservations is not in your schema** - Pass: The Restaurant node carries acceptsReservations when a reservation platform is linked. - Numbers and lists the tool uses: regex /"acceptsReservations"/i; gated on a reservation-platform link plus Restaurant schema (Mega Analyzer). - Why: AcceptsReservations lets engines surface a Reserve action. - Fix: Add acceptsReservations with the booking URL to the Restaurant node. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org acceptsReservations. - [ ] **A29.4 Health-grade signal (food businesses)** - Pass: The Google listing text shows a letter health grade or health inspection score. - Fail: Reported as informational when no grade is found. - Numbers and lists the tool uses: gate: runs only when the listing text matches /restaurant|food|cafe|pizz|bakery|bar/i; grade regex /(?:^|\s)(?:A|B|C|D|F)\s*(?:rating|grade)|health\s*(?:score|inspection)/i. - Why: Some metros surface the local health inspection grade on the listing. - Fix: Verify the displayed health inspection grade is current. - Verify: [Google Maps](https://jwatte.com/tools/google-maps-audit/). - [ ] **A29.5 Menu uploaded (for food businesses)** - Pass: A menu is uploaded to the Apple Maps listing. - Why: Apple Maps displays the menu inline, a strong conversion signal. - Fix: Upload the menu in Apple Business Connect. - Verify: [Apple Business](https://jwatte.com/tools/apple-business-audit/). - [ ] **A29.6 `<n>` restaurant-readiness issue(s)** - Pass: No restaurant-readiness issues detected across the managed-platform, menu, team or chef, reservations and contact or hours contexts. - Numbers and lists the tool uses: gate: Restaurant-family schema (Restaurant, FoodEstablishment, BarOrPub, CafeOrCoffeeShop, Bakery, Winery, BreweryOrBrewpub) or at least 2 of: a restaurant word (restaurant, gastropub, eatery, bistro, brasserie, steakhouse, trattoria, taqueria, public house) plus 'menu' in the body; a reservation, book a table, dine-in, happy hour, prix fixe, brunch, private dining or catering phrase plus a reservation or ordering link or 'menu'; a reservation link (opentable, resy.com, exploretock, tock.com, sevenrooms, yelp.com/reservations) or ordering link (tbdine, toasttab, chownow, doordash, grubhub, ubereats, gloriafood, squareup.com/online, slicelife); restaurant, menu, reservations, brunch, happy hour, steakhouse, cafe or bistro in the title; managed platform: SpotHopper (spothopper or spotapps), Popmenu, BentoBox (getbento or bentobox); contexts: managed platform, menu page, team or chef page, reservations page, contact or hours page; reference /blog/spothopper-website-checklist-restaurant-owners/. - Why: So Google and AI search can read what you are, your hours and your menu. - Fix: Add Restaurant schema with openingHoursSpecification, hasMenu (MenuSection and MenuItem with price), acceptsReservations and sameAs, a Person node on the team page and a privacy notice when analytics run. Never fake AggregateRating from embedded third-party reviews. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org Restaurant. - [ ] **A29.7 Restaurant stack detected, <platform | reservations | delivery | off-site menu>** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: platform: `<vendorPlatform>` when vendorPlatformType is Restaurant; reservations (first match wins): OpenTable /opentable\.com|opentable\.co|otrest|opentable-button/i, Resy /\bresy\.com|resyembed|resy-button/i, Tock /\b(?:exploretock|tock\.com|tockapi)\b/i, Yelp Reservations /yelp\.com\/reservations|yelp-reservation/i; delivery or ordering (first match wins): DoorDash /doordash\.com|order\.doordash|doordash-button/i, UberEats /ubereats\.com|order\.ubereats/i, Grubhub /grubhub\.com|order\.grubhub/i, Seamless /seamless\.com\/menu/i, Postmates/Caviar /postmates\.com|caviar\.com/i, GloriaFood /gloriafood\.com|gloriafood/i, Menufy /menufy\.com/i, Slice /slicelife\.com/i, Square Online ordering /squareup\.com\/(?:online-store|online|store)|\bsquare\.site\b/i, SpotOn /order\.spoton\.com/i, TouchBistro Dine /(?:order|www)\.tbdine\.com/i; off-site menu /\b(?:toasttab\.com\/local|direct\.chownow\.com|order\.chownow|popmenucloud\.com|popmenu-order|bentobox-customers\.com|getbento\.com\/menu|gloriafood\.com\/restaurant|menufy\.com\/|slicelife\.com\/restaurants|square\.site|order\.spoton\.com|order\.tbdine\.com)/i; all matched against the HTML plus links; the row renders only when ymylVertical is Local-Restaurant, as an info row with pass true, and never fails. - Why: Reservation embeds, off-site ordering and a platform-hosted menu count as valid conversion paths, so recognizing them prevents false "no call to action" or "no menu page" findings. - Fix: No change required; if you use a reservation, ordering or menu platform, keep its embed or link on the page so it is recognized. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A29.8 Team, chef, or owner content is present but there is no Person schema** - Pass: The team page carries Person schema. - Numbers and lists the tool uses: gated on a team page. - Why: The people guests come to see are the most authentic trust signal. - Fix: Add a Person node per key person with name, jobTitle, worksFor and sameAs. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org Person. - [ ] **A29.9 Restaurant schema has no sameAs links** - Pass: The Restaurant node carries a sameAs array. - Numbers and lists the tool uses: /"sameAs"/i; gated on Restaurant schema. - Why: SameAs merges the website, Google Business Profile and social profiles into one trusted business. - Fix: Add a sameAs array with the Business Profile or Maps URL, Instagram and Facebook. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org sameAs. - [ ] **A29.10 Reviews are shown on the page but there is no Review or AggregateRating schema** - Pass: A page that shows reviews carries Review or AggregateRating schema that is first-party and genuine. - Numbers and lists the tool uses: shows reviews /review by|customer reviews|what (?:our )?(?:guests|customers) say|testimonial|star rating/i or /yelp|tripadvisor|google review/i. - Why: Wrapping third-party Google or Yelp reviews in your own AggregateRating can trigger a manual penalty, and fake or self-asserted ratings violate the FTC consumer review rule. - Fix: Let the Business Profile carry the stars or run a genuine first-party review program before adding schema. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: 16 CFR Part 465 (FTC consumer review rule, October 2024). - [ ] **A29.11 Analytics or tracking is loading but no privacy policy is linked** - Pass: A privacy or cookie policy link (or the phrase 'privacy policy') is present when analytics or tracking scripts load. - Fail: Analytics is detected and no privacy link is found. - Numbers and lists the tool uses: hasAnalytics /gtag\(|googletagmanager|G-[A-Z0-9]{8,}|connect\.facebook\.net|fbq\(|clarity\.ms|hotjar/i; privacy link /href=["'][^"']*(privacy|cookie)[^"']*["']/i or /privacy policy/i. - Why: Google requires every site running Analytics to disclose it, and the Colorado Privacy Act applies to Colorado businesses. - Fix: Publish a privacy policy that names analytics, forms and your email list, and link it in the footer. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: Colorado Privacy Act; Google Analytics terms. - [ ] **A29.12 Managed platform detected (`<platform>`)** - Pass: No managed restaurant platform is detected. - Warn: SpotHopper, Popmenu or BentoBox is detected; structured data, security headers and head markup are controlled by the platform template. - Numbers and lists the tool uses: SpotHopper /spothopper|spotapps/i; Popmenu /popmenu/i; BentoBox /getbento|bentobox/i; first match wins, tested on raw HTML plus body text; runs only when the page is detected as a restaurant site. - Why: A subscription does not guarantee the template's schema, headers and head markup stay current. - Fix: Send the platform a by-name request for sitewide Restaurant schema, openingHoursSpecification, hasMenu, sameAs, a privacy policy and security headers. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). ### Self-storage - [ ] **A30.1 Reads as Q&A but no FAQPage JSON-LD** - Pass: The FAQ page carries FAQPage schema. - Fail: A home, FAQ or units page contains question marks in the body but has no FAQPage schema. - Numbers and lists the tool uses: Pages: home, FAQ, units; /\?(?:\s|$)/ on the full body (mega-analyzer). - Why: Storage questions about size, climate control, cost, access, insurance, specials and liens are lifted by answer engines. - Fix: Wrap the real questions in FAQPage > Question > acceptedAnswer. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org FAQPage. - [ ] **A30.2 The page mentions access/gate hours but has only one (or no) openingHoursSpecification** - Pass: At least 2 openingHoursSpecification blocks exist when the page mentions access or gate hours, or there is no access-hours mention. - Numbers and lists the tool uses: /access hours|gate hours|24[ -]?hour access|24\/7 access|gate (?:open|access)/i; hoursCount < 2. - Why: Storage has two schedules, office and gate, and Google's panel holds only one. - Fix: Model both schedules as labeled openingHoursSpecification blocks and state both on the page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A30.3 `<n>` self-storage-readiness issue(s)** - Pass: No self-storage-readiness issues detected. - Numbers and lists the tool uses: gate: self storage, storage units, climate-controlled, drive-up or RV-boat signals, or SelfStorage schema; signals: SelfStorage node with NAP and geo, office-vs-access dual hours, unit inventory as Offer or OfferCatalog, move-in special FTC terms, tenant-insurance or protection-plan disclosure (CA Ins. Code 1758.76), rate-increase and lien or auction policy (state Self-Service Storage Acts), AggregateRating or Review (FTC 16 CFR Part 465), online move-in, size-guide content, Google Business Profile, accessibility (ADA Title III), Spanish and hreflang; context flags: homepage, facility or location, units or pricing, FAQ, contact; reference /blog/blog-mega-analyzer-self-storage-readiness/. - Why: Fixing these wins "storage near me", shows correct office versus access hours, and keeps specials, insurance and review claims compliant. - Fix: Emit one SelfStorage node per facility (@id `<site>`/#facility with NAP, geo, priceRange, paymentAccepted, sameAs to GBP, Yelp and Facebook, and amenityFeature for climate, drive-up, 24hr, gated, elevator, ground-floor, RV and ADA), model office hours and gate hours as two labeled openingHoursSpecification entries stated on the page, and publish unit sizes as an OfferCatalog of Offers with price, priceCurrency and availability. Put clear terms next to any move-in special, disclose the protection plan honestly, publish the rate-increase and lien policy in plain language, surface online move-in and a size guide, use only real reviews, add an accessibility statement and Spanish hreflang where warranted, and validate every JSON-LD block. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org SelfStorage, OfferCatalog, Offer, openingHoursSpecification; FTC 16 CFR Part 465; CA Ins. Code 1758.76; state Self-Service Storage Facility Acts; ADA Title III; WCAG 2.1 AA. - [ ] **A30.4 No sameAs on the business node** - Pass: The home and contact pages' business node links external profiles via sameAs. - Numbers and lists the tool uses: gated on the home or contact page. - Why: Engines reconcile the facility through its Business Profile, Yelp and Facebook, and the Business Profile is the number one lead source. - Fix: Add sameAs linking Google Business Profile, Yelp and Facebook. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org sameAs. - [ ] **A30.5 The site shows or claims ratings but has no machine-readable AggregateRating / Review schema** - Pass: Rating claims or review widgets on the home or contact page are backed by AggregateRating or Review schema, or the page makes no rating claim. - Warn: When schema is present the tool asks you to confirm the count and value reconcile with the real Google or Yelp total. - Numbers and lists the tool uses: claims /\b5-?star|highly rated|top-?rated|best storage\b/i; widget /yelp|google review|\b\d(?:\.\d)?\s*(?:out of|\/)\s*5\s*star/i; FTC penalty up to $51,744 per violation. - Why: Fake, incentivized or suppressed reviews are banned, and real reviews should be machine-readable. - Fix: Emit aggregateRating with the real count and value once genuine reviews exist. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FTC 16 CFR Part 465. - [ ] **A30.6 No accessibility statement or accessible-unit signal** - Pass: Any audited page where the signal regex matches the raw HTML, or that is the accessibility page, gets the pass row 'Accessibility / ADA signal present'. - Fail: The homepage matches none of the signal phrases. - Numbers and lists the tool uses: /accessibility statement|web content accessibility|wcag|ada compliant|ada accessible|wheelchair accessible|ground-floor units?/i tested on the raw HTML, or isAccessibilityPage; the fail fires on the homepage only; the pass fires on any page where the signal matches. - Why: Storage facilities are ADA Title III public accommodations, and the online move-in flow is the top litigation surface. - Fix: Publish an accessibility statement, conform to WCAG 2.1 AA, and note accessible units. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: ADA Title III; WCAG 2.1 AA. - [ ] **A30.7 No online move-in / reserve / pay path found** - Pass: A rent, reserve, move-in online or pay online call to action exists. - Numbers and lists the tool uses: /rent now|reserve|move in online|move-in online|pay online|reserve now|rent online/i; checked on the home page and unit pages /\/(units?|sizes?|unit-sizes?|pricing|rates?|prices)(\/|$)/ (Mega Analyzer). - Why: The modern storage funnel is contactless online move-in. - Fix: Surface Rent, Reserve and Pay Online calls to action plus an autopay or tenant-portal link. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A30.8 Move-in special advertised ("`<value>`") with no adjacent terms** - Pass: No promo headline, or the material terms appear next to it. - Numbers and lists the tool uses: special /first month free|\$1 first month|50% off|half off (?:your )?first|move-?in special|one month free/i; terms /admin(?:istration)? fee|terms apply|see (?:store|details)|required insurance|protection plan|standard rate|then \$/i (Mega Analyzer). - Why: The FTC requires material terms to be clear and conspicuous next to the offer. - Fix: State the admin fee, required insurance, the standard rate after the promo and any minimum stay next to the offer. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FTC clear-and-conspicuous disclosure. - [ ] **A30.9 A protection plan / tenant insurance is referenced but the page does not disclose that buying it is NOT required to rent** - Pass: No insurance mention, or the page says coverage is not required to rent or that existing homeowner or renter coverage may apply. - Numbers and lists the tool uses: insurance mention /protection plan|tenant insurance|storage insurance|insurance is required|coverage is required/i; disclosure /not required to rent|your own (?:insurance|coverage)|existing (?:homeowner|renter)/i (Mega Analyzer). - Why: Several states require disclosing that the protection plan is optional and may duplicate existing coverage. - Fix: Add the disclosure next to every insurance mention and never auto-enroll without separate consent. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: California Ins. Code 1758.76. - [ ] **A30.10 No rate-increase or lien/auction policy language found** - Pass: Rate-change and lien or auction policy language exists on the home or FAQ page. - Numbers and lists the tool uses: /rate (?:increase|change)|lien|auction|past due|default|delinquen/i; checked on the home page and FAQ pages (Mega Analyzer). - Why: Each state's Self-Service Storage Facility Act governs these terms, and renters and AI assistants ask about them. - Fix: Add plain-language rate-change and lien or auction policy text that references the state act. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: state Self-Service Storage Facility Act. - [ ] **A30.11 Unit sizes appear but there is no size guide / estimator** - Pass: A size guide or estimator accompanies the unit sizes. - Numbers and lists the tool uses: sizes /\b(5x5|5x10|10x10|10x15|10x20|10x30)\b/i; guide /size guide|what size|unit size|size estimator|which size/i; checked on the home page (Mega Analyzer). - Why: 'What size storage do I need' is a top-of-funnel question every renter asks. - Fix: Add a size guide (5x5 closet, 10x10 one-bedroom, 10x20 full home) linked from the unit blocks. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A30.12 No Spanish-language signal** - Pass: Spanish content or an es hreflang exists. - Numbers and lists the tool uses: /hreflang=["']es|lang=["']es|\/es\/|espa[nñ]ol|almacenamiento|bodegas/i; checked on the home page (Mega Analyzer). - Why: A large share of storage renters prefer Spanish. - Fix: Add Spanish versions of the core pages with reciprocal hreflang (en, es, x-default). - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A30.13 Unqualified superlative ("`<value>`")** - Pass: Any superlative appears only inside a quoted customer testimonial. - Numbers and lists the tool uses: /\b(cheapest|lowest prices?|largest|biggest|#1|best storage|guaranteed lowest)\b/i on body plus footer; quoted scope /<(blockquote|q)\b[^>]*>[\s\S]*?<\/\1>/gi; flagged when the total match count exceeds the count inside blockquote or q elements (any match outside a quote) (Mega Analyzer). - Why: Objective claims must be substantiable under FTC advertising law. - Fix: Qualify and date the claim, or soften it. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FTC advertising substantiation. - [ ] **A30.14 Environmental claim ("`<value>`") with no specific basis** - Pass: No eco claim, or the claim carries a specific basis such as ENERGY STAR, a percentage or on-site solar. - Numbers and lists the tool uses: green claim /\b(eco-?friendly|green|sustainable|climate friendly|carbon neutral|solar-?powered)\b/i; basis /energy star|\b\d+%\b|on-?site solar/i (Mega Analyzer). - Why: FTC Green Guides require eco claims to be specific and substantiated. - Fix: Make the claim concrete or drop it. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FTC Green Guides. ### Senior care - [ ] **A31.1 Local-SeniorCare: NursingHome / AssistedLivingFacility / LocalBusiness schema** - Pass: A senior-care site declares NursingHome, AssistedLivingFacility, MedicalBusiness, LocalBusiness or LodgingBusiness. - Numbers and lists the tool uses: regex /NursingHome|AssistedLivingFacility|MedicalBusiness|LocalBusiness|LodgingBusiness/i (Mega Analyzer). - Why: Senior-care facilities need a recognized entity type for local and AI answers. - Fix: Add NursingHome or AssistedLivingFacility JSON-LD. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org NursingHome, AssistedLivingFacility. - [ ] **A31.2 Local-SeniorCare: state license number + licensing-agency name** - Pass: State licensing language with the agency name appears in the body text. - Numbers and lists the tool uses: /(state\s+licens|HHSC|DSS|CDPH|RCFE|Type\s+[ABC]\s+(?:assisted|residential)|licensed\s+by|license\s*#)/i. - Why: A state license is mandatory for care facilities. - Fix: Publish the license number and the licensing agency. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A31.3 Local-SeniorCare: Resident's Bill of Rights / admission-agreement disclosure (or visible /disclosure link)** - Pass: Resident-rights or admission-agreement language appears, or a disclaimer-class page is linked. - Numbers and lists the tool uses: /(resident.?s?\s+(?:bill\s+of\s+rights|rights)|admission\s+agreement|disclosure\s+statement|level\s+of\s+care)/i. - Why: This disclosure is required for residents. - Fix: Publish the Resident's Bill of Rights or the admission agreement. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A31.4 Local-SeniorCare: HIPAA notice (Medicare/Medicaid-billing senior-care facility)** - Pass: The facility does not mention skilled nursing, Medicare or Medicaid, or the word HIPAA appears in the body. - Fail: The site matches /skilled\s+nursing|medicare|medicaid\s+(?:certified|provider)|long[- ]term\s+care\s+facility/i and has no HIPAA mention. - Numbers and lists the tool uses: /skilled\s+nursing|medicare|medicaid\s+(?:certified|provider)|long[- ]term\s+care\s+facility/i; /hipaa/i. - Why: A HIPAA notice is only required when the facility bills Medicare or Medicaid. - Fix: Add a HIPAA notice. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: HIPAA. ### Solo practitioners - [ ] **A32.1 Vertical agent type is dual-typed with Person** - Pass: A node typed as a solo-practitioner vertical (RealEstateAgent, Attorney, Dentist and so on) is also typed Person. - Fail: A vertical practitioner type stands alone without Person. - Numbers and lists the tool uses: vertical types RealEstateAgent, Attorney, LegalService, Notary, Dentist, Physician, PhysicalTherapy, MedicalBusiness, FinancialService, InsuranceAgency, AccountingService, Chiropractor, Optometric, Optician, Podiatric, TravelAgency, Photographer, InteriorDesigner; entity types Person, Organization, LocalBusiness, Corporation, OnlineBusiness, NewsMediaOrganization (Mega Analyzer). - Why: Dual-typing keeps worksFor valid on the same node that declares the vertical. - Fix: Use @type: ["Person", "RealEstateAgent"] (or the relevant vertical type) on the practitioner node. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org multi-typing. - [ ] **A32.2 Agent declares employer relationship** - Pass: The practitioner node declares worksFor and/or parentOrganization. - Fail: A vertical practitioner node has neither worksFor nor parentOrganization. - Numbers and lists the tool uses: same vertical type list as the dual-typing check (Mega Analyzer). - Why: WorksFor validates only on Person-typed nodes and parentOrganization only on Organization-typed nodes, and together they tie the agent to the employer in the Knowledge Graph. - Fix: Add worksFor (Person to Organization) and/or parentOrganization (Organization to Organization) on the practitioner node. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org worksFor, parentOrganization. ### Squarespace sites - [ ] **A33.1 SEO site title configured** - Pass: SiteTitle is set in the Squarespace context. - Numbers and lists the tool uses: regex /"siteTitle"\s*:\s*"([^"]+)"/ on the raw HTML (siteTitle must have a non-empty value); pass when matched, info when absent (never warn or fail). - Why: Squarespace uses the site title in page titles and browser tabs. - Fix: Set it under Settings, Marketing, SEO. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). ### Chiropractic, optometry and podiatry - [ ] **A34.1 YMYL-Health-Chiropractic/Optometry/Podiatry: state-board credential (DC / OD / DPM #) visible** - Pass: The practice's credential abbreviation or a license marker appears in the body text. - Numbers and lists the tool uses: chiropractic /\b(d\.?c\.?|chiropractor|chiropractic\s+(?:license|board)|state\s+board\s+of\s+chiropractic|board[- ]?certified\s+chiropractor)\b/i; optometry /\b(o\.?d\.?|optometrist|optometric\s+(?:license|board)|state\s+board\s+of\s+optometry|abo[- ]certified)\b/i; podiatry /\b(d\.?p\.?m\.?|podiatrist|podiatric\s+(?:license|board)|abpm|abps)\b/i. - Why: DC, OD and DPM practitioners are state-board licensed; NPI, HIPAA and Good Faith Estimate rules apply only to MDs and DOs. - Fix: Publish the DC, OD or DPM license number. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A34.2 YMYL-Health-Chiropractic/Optometry/Podiatry: scope-of-practice disclaimer or visible /disclaimer link** - Pass: A scope-of-practice or medical disclaimer is present or a disclaimer-class page is linked. - Numbers and lists the tool uses: medical disclaimer /\b(not\s+(?:medical|professional)\s+advice|consult\s+(?:your|a)\s+(?:doctor|physician|healthcare)|for\s+informational\s+purposes\s+only)\b/i on lowercased body text, or a link matching /\/(disclaimer|legal-notice|notice|terms-?(?:of-)?(?:use|service)?|privacy(?:-policy)?|disclosure|aboutus|legal)\/?(?:$|\?|#)/i; gate /^YMYL-Health-(Chiropractic|Optometry|Podiatry)$/. - Why: A scope-of-practice disclaimer is the required notice for these practices. - Fix: Add a scope-of-practice disclaimer. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). ### CPA and accounting firms, Production homebuilders, Home and property inspection, Aviation asset management, Registered investment advisers - [ ] **A35.1 Invalid @type:[Person, Organization] on the firm node** - Pass: The firm node is not dual-typed Person and Organization. - Fail: The global node declares @type ["Person","Organization"] in either order. - Numbers and lists the tool uses: regex /"@type"\s*:\s*\[\s*"Person"\s*,\s*"Organization"\s*\]|"@type"\s*:\s*\[\s*"Organization"\s*,\s*"Person"\s*\]/ on the JSON-LD text (Mega Analyzer CPA, homebuilder, inspection, aviation and RIA modules). - Why: Rank Math and Yoast emit this when the site is set to Person with a logo, but a firm is an Organization, not a Person. - Fix: Switch the global type to ["`<vertical type>`","Organization"] (AccountingService for CPA, HomeAndConstructionBusiness for homebuilder, FinancialService for aviation and RIA) or ["HomeAndConstructionBusiness","LocalBusiness"] for inspection, and change @id from #person to #org. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org multi-typing. ### Health, legal and money pages (YMYL) - [ ] **A36.1 YMYL-Health: Person schema with credential** - Pass: A health or legal site declares a Person node for the practitioner. - Fail: No Person type is found, which is added to the YMYL missing list. - Numbers and lists the tool uses: regex /Person/i on the collected types (Mega Analyzer). - Why: The practitioner or attorney entity is needed for E-E-A-T binding on high-stakes topics. - Fix: Add Person JSON-LD with hasCredential for the practitioner or attorney. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org Person. - [ ] **A36.2 Missing YMYL trust signals (CRITICAL for AI citation eligibility): `<list>`** - Pass: Every trust signal expected for the detected YMYL vertical is present. - Warn: E-E-A-T Generator shows a YMYL alert for medical, dental, legal and recovery industries. - Fail: Any expected signal missing for a YMYL vertical is critical. - Numbers and lists the tool uses: gate /^YMYL-/i or any non-General vertical; an owner-confirmed vertical override is treated as ground truth over the detected one; E-E-A-T Generator flags ymyl:true for medical, dental, legal, recovery and false for the other 18 industries. - Why: AI Overviews and Google apply much tighter source-quality filters to health, finance and legal content, so missing signals can suppress the site entirely. - Fix: Add each listed missing signal (credentials, disclaimers, notices) through schema and visible bios, and do not generate fixes for a misdetected vertical. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [E-E-A-T Generator](https://jwatte.com/tools/eeat-generator/). Standard: Google Search Quality Rater Guidelines v2024 section 3.4 (YMYL). - [ ] **A36.3 Disclaimer-class page link fallback** - Pass: Some link on the page points to a disclaimer-class path, which soft-passes the vertical's missing on-page disclaimer. - Numbers and lists the tool uses: /\/(disclaimer|legal-notice|notice|terms-?(?:of-)?(?:use|service)?|privacy(?:-policy)?|disclosure|aboutus|legal)\/?(?:$|\?|#)/i. - Why: Solo practitioners host the regulated disclaimer on /disclaimer/, /legal/ or /terms/ rather than the home hero, and failing the home page for that is misleading. - Fix: Link the disclaimer page from the main navigation or footer. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). ### HVAC contractors, Electricians, Handyman services - [ ] **A37.1 Placeholder phone number detected ("`<value>`")** - Pass: No 555-01xx placeholder number appears in the body text. - Fail: Mega Analyzer fails when a 555-01xx placeholder number appears in the body text of an HVAC, electrician or handyman site. - Numbers and lists the tool uses: phones /$?\d{3}$?[-.\s]?\d{3}[-.\s]?\d{4}/g; placeholder /5\s*5\s*5[-.\s)]*01\d\d/ or /\b555[-.\s]?01\d\d\b/; runs when the Mega Analyzer detects an HVAC, electrician or handyman site. - Why: 555-01xx numbers are reserved fakes left over from template data, and a fake phone in text, schema or your listing sends callers nowhere. - Fix: Replace the placeholder everywhere it appears: the tel: link, the schema telephone field and Google Business Profile. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). ### Laundromats, Self-storage - [ ] **A38.1 No paymentAccepted in schema** - Pass: The business node lists paymentAccepted matching the payment methods described on the page. - Fail: PaymentAccepted is absent on the home or pricing page, or payment methods appear in the copy but not in schema. - Numbers and lists the tool uses: regex /"paymentAccepted"/i; payment copy /apple pay|google pay|tap to pay|contactless|credit card|debit card|card reader|payrange|cashless|mobile app|\bcoins?\b|quarters/i on home, pricing or contact pages (Mega Analyzer laundromat module); pass-only row on self-storage sites. - Why: 'Do you take cards or Apple Pay' is a top pre-visit question that answer engines can state from schema. - Fix: Add paymentAccepted listing exactly the methods you take. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org paymentAccepted. - [ ] **A38.2 No amenityFeature in schema** - Pass: Amenities are encoded as amenityFeature LocationFeatureSpecification entries on the homepage business node. - Numbers and lists the tool uses: regex /"amenityFeature"/i on the homepage; storage amenities named: climate control, drive-up, 24-hour access, gated or keypad security, elevator, ground floor, RV or boat, ADA accessible (Mega Analyzer). - Why: Feature filters and AI answers such as 'largest washer', 'WiFi' or 'climate controlled' match on structured amenities. - Fix: Encode each amenity as an amenityFeature LocationFeatureSpecification. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org amenityFeature. ### Laundromats, Self-storage, Car washes, HVAC contractors, Electricians, Handyman services - [ ] **A39.1 No Open Graph tags** - Pass: At least one og: property is present. - Fail: A home or service page (home or facility page for self-storage) with zero og: properties. - Numbers and lists the tool uses: ogCount = count of /property=["']og:/gi; gated to home and service pages (laundromat, car wash, HVAC, electrician, handyman) or home and facility pages (self-storage). - Why: Shares render as a bare URL with no title, image or description. - Fix: Add og:title, og:description, og:image, og:url and twitter:card. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: Open Graph protocol. ### Law firms, CPA and accounting firms - [ ] **A40.1 Attorney bio JSON-LD missing hasCredential** - Pass: The bio's Person JSON-LD carries hasCredential with credentialCategory license. - Numbers and lists the tool uses: regex /"hasCredential"|"credentialCategory"\s*:\s*"license"/i on bio pages (Mega Analyzer legal and CPA modules). - Why: The bar or state-board license is the primary verification hook AI search uses to cite a professional. - Fix: Add hasCredential with credentialCategory license, the jurisdiction or state board as recognizedBy and the license number. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org EducationalOccupationalCredential. - [ ] **A40.2 Attorney bio JSON-LD missing alumniOf** - Pass: The bio's Person JSON-LD carries alumniOf. - Numbers and lists the tool uses: regex /"alumniOf"/i on bio pages (Mega Analyzer legal and CPA modules). - Why: The school is a primary authority anchor and separates two professionals with similar names. - Fix: Add alumniOf with the law school or university. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org alumniOf. - [ ] **A40.3 Attorney bio JSON-LD missing memberOf** - Pass: The bio's Person JSON-LD carries memberOf. - Numbers and lists the tool uses: regex /"memberOf"/i on bio pages; optional but recommended (Mega Analyzer legal and CPA modules). - Why: Bar and professional-society memberships add depth to the authority profile and weigh heavily in verification queries. - Fix: Add memberOf for bar associations, AICPA, the state society or similar bodies. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org memberOf. ### Law firms, CPA and accounting firms, Defense contractors - [ ] **A41.1 Attorney bio page missing [Person, Attorney] JSON-LD** - Pass: Each bio or leadership page carries a Person node typed with the profession (Attorney, Accountant) or a Person block per named executive. - Fail: A bio page has no professionally typed Person node, or a leadership page has no Person node. - Numbers and lists the tool uses: legal: bio page with /Attorney/i; CPA: bio page with /^Accountant$/i; defense: leadership page with /^Person$/ (Mega Analyzer). - Why: Required for AI-search citation, Knowledge Graph reconciliation and verification of experience claims. - Fix: Add ["Person","Attorney"] or ["Person","Accountant"] JSON-LD on each bio, and a Person block per leader with jobTitle, worksFor, alumniOf and hasCredential. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org Attorney, Accountant, Person. ### Production homebuilders, Home and property inspection - [ ] **A42.1 Placeholder / garbled Person node detected (name=`<value>`)** - Pass: Every Person node has a real human name. - Fail: A Person name has no whitespace, is 6 characters or shorter and is not a capitalized word, which looks like a slug or theme default. - Numbers and lists the tool uses: name regex /"@type"\s*:\s*"Person"[^}]*?"name"\s*:\s*"([^"]{1,40})"/gi; flagged when no whitespace, length <= 6 and not /^[A-Z][a-z]+$/ (Mega Analyzer homebuilder and inspection modules). - Why: A non-human value emitted as a Person pollutes the firm's entity graph. - Fix: Replace the placeholder with the real owner or leader, or remove the node. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org Person. ### Self-storage, Car washes - [ ] **A43.1 Unit sizes/prices are shown but there is no Offer / OfferCatalog schema** - Pass: Priced units, wash tiers or memberships are machine-readable as an OfferCatalog of Offers. - Numbers and lists the tool uses: self-storage: hasOffer /"@type"\s*:\s*"(Offer|OfferCatalog|Product|AggregateOffer)"/i on the JSON-LD or a collected type matching /Offer|OfferCatalog|AggregateOffer/, checked on units pages /\/(units?|sizes?|unit-sizes?|pricing|rates?|prices)(\/|$)/ or when the body names a unit size /\b(5x5|5x10|10x10|10x15|10x20|10x30)\b/i; car wash: hasOffer /"@type"\s*:\s*"(Offer|OfferCatalog|Service)"/i on the JSON-LD or a collected type matching /Offer|OfferCatalog/, checked on service or membership pages or when the body shows a dollar price /\$\d/ (Mega Analyzer self-storage and car wash modules). - Why: 'What does a 10x10 cost' or the unlimited-wash price must be machine-readable with availability. - Fix: Emit an OfferCatalog of Offers with price, priceCurrency USD and availability; model memberships as an Offer with a monthly UnitPriceSpecification. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org Offer, OfferCatalog. ## Cross-checks outside jwatte.com These are the second opinions worth getting, all free: - **Google Search Console** (https://search.google.com/search-console/) and **Bing Webmaster Tools** (https://www.bing.com/webmasters/) for what the engines actually indexed, and to submit the sitemap. The Search Console + Bing Importer on jwatte.com reads the CSV exports from both. - **Cloudflare's agent readiness scorer** at https://isitagentready.com/ : enter a URL and it scores five categories, discoverability, content accessibility, bot access control, protocol discovery and commerce, with a shareable report. The Agent Ready Audit on jwatte.com mirrors the same probes; run both and they should agree, and where they disagree the jwatte tool tells you which probe. - **Google Rich Results Test** (https://search.google.com/test/rich-results) and the **Schema Markup Validator** (https://validator.schema.org/) for structured data. Remember that both validate nodes, not the relationship between a node and the page it lives on; section 3 covers what they miss. - **PageSpeed Insights** (https://pagespeed.web.dev/) for lab and field Core Web Vitals on one URL. - **IndexNow** (https://www.indexnow.org/) to tell Bing and its partners about a changed page the same day. Google does not consume it. - **WAVE** (https://wave.webaim.org/) for a second accessibility opinion, in the browser. ## The loop 1. Write or fix the pages with the plan you have, using Prompt A, B or C. 2. Put them on hosting you control, with your own domain and HTTPS (section 12). 3. Run the Mega Analyzer on the homepage, then the section tools for whatever it flags. 4. Paste each tool's fix prompt, with this file, into the AI. Replace the files it hands back. Redeploy. 5. Check what a crawler sees, not what you see: the rendered-DOM and mobile-parity tools exist because the two are routinely different. 6. Submit the sitemap in Search Console and Bing Webmaster Tools, ping IndexNow, and finish the Google Business Profile. 7. Repeat monthly, or whenever you add a page. The tools are free every time. ## Changelog - 1.2, September 24, 2026: added 2.64 to 2.74 (Facebook and WhatsApp link previews: Open Graph placement, og:image size, type and dimensions, compression and the Range request) and 5.54 to 5.59 (Meta's crawler tokens under RFC 9309: Meta-WebIndexer, facebookexternalhit, named groups that drop the * rules, rules stranded below a named group), the scored checks of the new Meta AI Crawler + Link Preview Audit. Meta publishes no Muse crawler, user agent or website standard (checked September 24, 2026), so these cover only what Meta documents. - 1.1, September 23, 2026: added 9.99 and 9.100, the two iPhone form checks the Mega Analyzer gained that day (date and time inputs WebKit redraws after your CSS, and text fields under 16px that make iPhone zoom on focus), each judged at 375 and 430 px wide. The 95 Mega Analyzer rows added on September 21 and 22 are not in this file yet. - 1.0, September 18, 2026: first release. 873 general checks across 12 sections and 290 industry-specific checks, extracted from the source of 78 tools on jwatte.com and then verified check by check against the code that enforces it (898 confirmed as extracted, 265 corrected, 12 dropped). --- Free to use, copy, adapt and redistribute. No warranty. This file is informational, not legal, financial or SEO consulting advice. Product names are mentioned as nominative fair use; no affiliation is implied.

# The Getting Found Checklist Every data point the free audit tools at jwatte.com measure, collected into one file you can hand to the AI plan you already pay for. Version 1.4, October 22, 2026 (review items 3.11, 3.54, 3.67, 3.86, 7.55, A16.2, A16.3 and A27.9 updated to Google's review snippet guidelines; 1.3 updated 5.39 to 5.41 and 5.45 to ARD v0.91). Written by J.A. Watte. Free to copy, adapt and ship. No signup, no email, no tracking, no attribution required. Companion article: https://jwatte.com/blog/bolt-new-seo-aeo-geo-do-it-yourself/ The tools that verify every line below, free and in your browser: https://jwatte.com/tools/ This file, always at its latest version: https://jwatte.com/downloads/getting-found-checklist.md Every check in this file exists as code in a tool on that site. The pass conditions, thresholds and lists were copied from the tool source, not from a best-practices article, so when a line says 170 characters or 2.5 seconds, that is the number the tool will hold you to. Where a tool cites a standard (an RFC, a WCAG success criterion, a schema.org type, a Google document) the line names it. 892 general checks in 12 sections, plus 290 industry-specific ones in the appendix, drawn from 80 tools. --- ## How to use this file There are three ways in. Pick the one that matches where you are. **You already have a site.** Open Claude, ChatGPT or Gemini. The free tier handles a page at a time; the $20 tier does a whole site in a sitting. Paste this file, then paste the page you want checked: in your browser press Ctrl+U (Cmd+Option+U on a Mac), select all, copy. Add your robots.txt and sitemap.xml the same way. Then use Prompt A. **You are building a new site with a coding agent** (Claude Code, Codex, Jules, Cursor, Windsurf, or bolt.new itself). Save this file at the project root as `GETTING-FOUND.md`. If the project has an `AGENTS.md` or `CLAUDE.md`, add one line to it: "Read GETTING-FOUND.md before writing any page, and build to it." Then use Prompt B. **You ran a tool on jwatte.com and it handed you a fix prompt.** That prompt already carries your findings. Paste it, then this file, then use Prompt C, so the fix meets the whole section and not just the one finding. **How much to paste at once.** This is a large file, about 1150 KB, because it holds every check rather than a highlights reel. A coding agent reads it whole from disk. A chat window takes it a section at a time: paste the front matter (everything above section 1) plus the one section you are working on, and start with sections 1 and 2. Section sizes: 1: 90 KB, 2: 63 KB, 3: 107 KB, 4: 51 KB, 5: 76 KB, 6: 60 KB, 7: 100 KB, 8: 60 KB, 9: 100 KB, 10: 88 KB, 11: 69 KB, 12: 57 KB, Appendix A: 218 KB. Whichever way in, the last step is the same: **verify with the tool, not with the AI's own report.** Every section below names the tools that measure it. Most accept a deep link, so `https://jwatte.com/tools//?url=https://yoursite.com&autorun=1` opens the tool with your site filled in and the audit already running. Nothing on that site needs an account, and nothing you enter is stored. ### Prompt A: audit a site that exists ```text You are auditing a website against GETTING-FOUND.md, pasted above. Work through it section by section, in the order the file gives. For every check, report PASS, WARN, FAIL or N/A with one line of evidence from the HTML, robots.txt or sitemap I pasted. Do not guess at anything you cannot see; if a check needs a file or a response header I have not given you, list it under "Needs input" and move on. When you finish a section, give me the fixes for every FAIL and WARN as complete, paste-ready code (a full block, a full JSON-LD block, a full robots.txt), never a fragment with "..." in it. Keep everything that already passes exactly as it is. Mark checks that do not apply to this kind of site as N/A and say why in five words or fewer. At the end, list the jwatte.com tools I should run to confirm each section, taken from the Verify lines in the file. ``` ### Prompt B: build a new site to this file ```text Read GETTING-FOUND.md at the project root before writing anything. Build this site to it: plain HTML and CSS, one file per page, no framework unless I ask for one. The business: [name, what it does, city and state, street address, phone, hours, the three questions customers ask most, and the pages I want]. Every check in the file that applies to this kind of site must pass on the first deploy; where the file gives a number, hit the number. Where a check needs a value only I have (an EIN, a license number, a Google Business Profile link, a Search Console verification), put a FILL: marker in the code and list every marker at the end. When you are done, print the checks you believe pass, the checks you marked N/A with a reason each, and the tools from the Verify lines I should run before I tell anyone the site exists. ``` ### Prompt C: apply a tool's fix prompt against the whole standard ```text Above is a fix prompt generated by a jwatte.com audit tool, with my site's findings inside it, followed by GETTING-FOUND.md. Fix every finding in the prompt. While you are in each file, bring it up to every other check in the same section of GETTING-FOUND.md, so I am not back next week for the neighbor of the thing you just fixed. Give me complete files, not fragments. Change nothing that already passes. List what you changed, check by check, using the numbering in the file. ``` ## How to read a check Each check is a task-list line so you can tick it in any Markdown editor, or let the AI tick it: - [ ] **Number and title**, as the tool labels it on screen. - Pass: the condition that earns full credit. - Warn: where the tool gives half credit (only present when the tool has a warn state). - Fail: the condition that earns none. - Numbers and lists the tool uses: every threshold, user-agent token, header name or file path the check is coded with. - Why: what goes wrong when it fails. - Fix: the remedy the tool's own fix prompt gives. - Verify: the tool or tools that measure it, and the standard the check implements. Scoring, as the Mega Analyzer does it: each section's score is the unweighted average of its checks, a warn counting as half, and the overall average maps to a letter. A is 90 or better, B is 80 to 89, C is 70 to 79, D is 60 to 69, F is below 60. Information-only checks are not scored. In the tool you can mark any check N/A and it leaves both the score and the fix prompt. Checks gated to one kind of business (a nonprofit's EIN, an attorney's bar number) are in Appendix A so the main list stays general. ## The order to do it in If you do nothing else, do the sections in this order, because each one is wasted without the one before it: 1. **What the crawler actually sees** (section 1). An unreachable page scores zero on everything else. 2. **Titles, descriptions and headings** (section 2). The result itself. 3. **Structured data** (section 3) and, if you have a door, **Local** (section 6). 4. **Trust** (section 7). Who you are, in a form a machine can confirm. 5. **Being read by AI** (section 5) and **Answer engines** (section 4). Access first, then quotability. 6. **Speed** (section 8), **Accessibility** (section 9), **Security** (section 10). 7. **Content** (section 11), which is the work that never finishes. 8. **Hosting** (section 12) is decided once, so decide it before section 1 if the site does not exist yet. --- ## 1. What the crawler actually sees Nothing else in this file matters if the crawler cannot reach the page, or reaches a different page than the visitor does. This section is robots.txt, the sitemap and the truth of its dates, canonicals, redirects, indexability and internal links: the plumbing between your files and the index. **Verify this section with:** [Site Analyzer](https://jwatte.com/tools/analyzer/), [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Internal Link Auditor](https://jwatte.com/tools/internal-link-auditor/), [Redirect Chain Audit](https://jwatte.com/tools/redirect-chain-audit/), [Image Alt Audit](https://jwatte.com/tools/image-alt-audit/), [Schema Validator](https://jwatte.com/tools/schema-validator/), [Rich Results Eligibility Audit](https://jwatte.com/tools/rich-results-eligibility-audit/), [FAQ Schema Parity](https://jwatte.com/tools/faq-schema-parity/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [AI Posture Audit](https://jwatte.com/tools/ai-posture-audit/), [Agent Ready Audit](https://jwatte.com/tools/agent-ready-audit/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/), [Mega Batch](https://jwatte.com/tools/mega-batch/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/), [Migration Analyzer](https://jwatte.com/tools/migration-analyzer/), [robots.txt Simulator](https://jwatte.com/tools/robots-txt-simulator/), [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/), [AI Bot Policy Generator](https://jwatte.com/tools/ai-bot-policy-gen/), [Index Coverage Delta](https://jwatte.com/tools/index-coverage-delta/), [Duplicate Title / Meta Description Audit](https://jwatte.com/tools/duplicate-title-meta-audit/), [Sitemap Audit](https://jwatte.com/tools/sitemap-audit/), [Search Console + Bing Importer](https://jwatte.com/tools/search-console-importer/), [Link Graph](https://jwatte.com/tools/link-graph/), [Mega AEO Analyzer](https://jwatte.com/tools/mega-aeo-analyzer/), [Rendered DOM Paste Audit](https://jwatte.com/tools/rendered-dom-paste-audit/), [Uptime + Response-Time Diagnostic](https://jwatte.com/tools/uptime-check/), [Meta + OG Inspector](https://jwatte.com/tools/meta-og-inspector/), [Featured-Snippet Extractability Audit](https://jwatte.com/tools/featured-snippet-extractability/), [SGE Readiness Audit](https://jwatte.com/tools/sge-readiness-audit/), [Platform Audit](https://jwatte.com/tools/platform-audit/), [Monoclone Gen.](https://jwatte.com/tools/monoclone-generator/). - [ ] **1.1 Site serves a real page (not a parked domain, error page or empty response)** - Pass: The URL returns a page with real content and a title, not a parking page, DNS error or empty body. - Numbers and lists the tool uses: HTML shorter than 100 chars fails; first 2000 chars must not match /domain is for sale|buy this domain|parked|not found|dns.*error|this site can|no server|unable to connect/i; HTML under 500 chars must contain `Just a moment|challenges\.cloudflare\.com|Sorry, you have been blocked|Incapsula incident ID|aws-waf-token|Akamai bot manager|enable javascript and cookies to continue/i (Mega Analyzer); a challenge is suspected after a status of 0, 403, 405, 429 or 503 (Internal Link Auditor); retrievers to allowlist: Googlebot-Image, GPTBot-User, ClaudeBot, PerplexityBot, Applebot (Image Alt Audit). - Why: Search engine and AI crawlers hit the same wall as any automated visitor, so a challenge page means they see nothing to index or cite. - Fix: Exempt verified crawlers and static discovery files (robots.txt, sitemap.xml, images) from bot challenges at the WAF or CDN, and verify the pages in a real browser. - Verify: [Internal Link Auditor](https://jwatte.com/tools/internal-link-auditor/), [Redirect Chain Audit](https://jwatte.com/tools/redirect-chain-audit/), [Image Alt Audit](https://jwatte.com/tools/image-alt-audit/), [Schema Validator](https://jwatte.com/tools/schema-validator/) and 3 more. - [ ] **1.3 robots.txt served at the site root** - Pass: GET /robots.txt returns HTTP 200 with plain-text content. - Numbers and lists the tool uses: Path /robots.txt; body must be non-HTML text longer than 5 chars with upstream status under 400 (Batch Analyzer) or longer than 10 chars (E-E-A-T Analyzer); status 200 and at least one User-agent: directive matching /user-agent\s*:/i, with text/plain named only in the fix text and not checked (Agent-Ready Audit); status 200 (Migration Analyzer); recommended content User-agent: *, Allow: /, a Sitemap: line and Unix line endings (Single-Site Generator); missing file is a critical crawl fail (Mega Analyzer, Batch Analyzer, Mega Batch) with impact 4 (Mega SEO Analyzer), a warn in the Analyzer network checks and a fail in AI Posture Audit. - Why: It is the first file every crawler reads; Google crawls without one, but AI crawlers need explicit rules and fall back to per-bot defaults when it is missing. - Fix: Publish /robots.txt at the origin root with at least 'User-agent: *' and 'Allow: /' plus a Sitemap: line, served as text/plain. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [AI Posture Audit](https://jwatte.com/tools/ai-posture-audit/), [Agent Ready Audit](https://jwatte.com/tools/agent-ready-audit/), [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/) and 6 more. Standard: RFC 9309. - [ ] **1.4 robots.txt rules are grouped under User-agent lines** - Pass: Every Allow and Disallow line sits directly below the User-agent line(s) it applies to, so each bot resolves to exactly one rule group. - Fail: A rule that appears before any User-agent line is ignored, and lines that are not user-agent, allow or disallow (such as Crawl-delay) carry no crawl effect. - Numbers and lists the tool uses: Directive syntax /^([a-z-]+):\s*(.*)$/i after stripping comments /#.*$/; recognized keys user-agent, disallow, allow; a bot matches a group only by exact token equality (Googlebot-Image does not inherit Googlebot), falls back to the * group, and when several groups name the same token the last one wins (Robots.txt Simulator). - Why: A misplaced rule silently does nothing, so a block you think is in place may not be, or a bot you meant to allow may fall through to a stricter group. - Fix: Put each User-agent line directly above its Allow and Disallow lines, name each bot token exactly, and keep one group per bot. - Verify: [robots.txt Simulator](https://jwatte.com/tools/robots-txt-simulator/). Standard: RFC 9309. - [ ] **1.5 Page path is not blocked by a robots.txt Disallow rule** - Pass: No Disallow rule in the User-agent: * group (or the group for the bot you care about) equals / or matches the page path. - Numbers and lists the tool uses: Groups split on blank lines; comments stripped with /#.*$/; only groups whose User-agent includes * are evaluated; a rule blocks when it equals / or the path starts with it (Mega Analyzer, Analyzer, E-E-A-T Analyzer, Batch Analyzer, Mega Batch); per-bot simulation uses longest-match precedence over pathname plus query, * as wildcard and $ as end anchor, and on equal pattern length the rule listed first in the group wins (Robots.txt Simulator); severity critical. - Why: A blocked path is never crawled, so the page cannot be indexed no matter how good it is. - Fix: Remove or narrow the Disallow rule, or add an Allow rule at least as long as the blocking pattern for paths that should be crawled. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [robots.txt Simulator](https://jwatte.com/tools/robots-txt-simulator/), [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/) and 4 more. Standard: RFC 9309. - [ ] **1.6 robots.txt declares a Sitemap: line** - Pass: Robots.txt contains at least one line starting with Sitemap: followed by the absolute sitemap URL. - Warn: Missing Sitemap: line (warn in every tool that checks it). - Numbers and lists the tool uses: Regex /^\s*sitemap\s*:/mi (Mega Analyzer, Analyzer, E-E-A-T Analyzer, Batch Analyzer); /^\s*sitemap\s*:\s*(\S+)/mi (Mega Batch); /^\s*Sitemap\s*:\s*(\S+)/gim, first 3 listed (Agent-Ready Audit); severity warn; generated form 'Sitemap: ``/sitemap.xml' with an optional commented sitemap-image.xml line (AI Bot Policy Generator). - Why: Crawlers and AI bots find the sitemap directly from the file they read first instead of guessing paths. - Fix: Add 'Sitemap: https://yourdomain.com/sitemap.xml' (absolute URL on the canonical host) to robots.txt. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Agent Ready Audit](https://jwatte.com/tools/agent-ready-audit/), [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/) and 5 more. Standard: sitemaps.org robots.txt Sitemap directive. - [ ] **1.7 robots.txt Sitemap: URL uses the canonical domain** - Pass: The hostname in the Sitemap: URL equals the site's canonical hostname. - Numbers and lists the tool uses: Sitemap URL parsed with /Sitemap:\s*(https?:\/\/\S+)/i; hostname compared with the canonical hostname, falling back to the page hostname when no canonical is set (Analyzer); compared with the canonical hostname only when a canonical is present (Batch Analyzer). - Why: Google follows this URL first; if it lands on a redirect the sitemap may not be processed at all. - Fix: Write the Sitemap: line as https://example.com/sitemap.xml on the canonical host, not a www or http variant. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/). - [ ] **1.8 Sitemap declared in robots.txt is reachable and valid** - Pass: The file that the Sitemap: line points at returns a urlset or sitemapindex document. - Fail: Robots.txt points at a /sitemap.xml that returns a 404 or a body without a urlset or sitemapindex root (critical). - Numbers and lists the tool uses: Gate: declared URL matches /\/sitemap\.xml\/?$/i so custom paths like /wp-sitemap.xml are not evaluated; body must match urlset or sitemapindex; severity critical (Mega Batch). - Why: A declared but broken sitemap is worse than none, because every crawler follows the declaration straight into a dead file. - Fix: Fix the declared sitemap so it returns valid XML, or point the Sitemap: line at the file that actually exists. - Verify: [Mega Batch](https://jwatte.com/tools/mega-batch/). Standard: sitemaps.org. - [ ] **1.9 XML sitemap served at a standard path** - Pass: A sitemap answers with HTTP 200 at /sitemap.xml or another standard path, or at the URL declared in robots.txt. - Fail: No sitemap at any probed path and none declared in robots.txt (critical). - Numbers and lists the tool uses: Paths probed: /sitemap.xml, /sitemap_index.xml, /wp-sitemap.xml, /sitemap-index.xml, /sitemap1.xml, /sitemap.xml.gz, plus any robots.txt Sitemap: line including cross-origin ones (Mega Analyzer); /sitemap.xml, /sitemap_index.xml, /sitemap-index.xml, /sitemaps.xml (Mega SEO Analyzer); /sitemap.xml, /sitemap_index.xml, /sitemap-index.xml with a body whose first 500 chars do not match /not found|404/i (Index Coverage Delta); /sitemap.xml only (Analyzer, E-E-A-T Analyzer, Duplicate Title/Meta Audit, Migration Analyzer, Batch Analyzer, Mega Batch); body must be non-HTML text, capped at 50000 chars (Batch Analyzer); missing is a critical crawl fail with impact 3 (Mega SEO Analyzer). - Why: The sitemap is the most reliable way to hand every URL to Google, Bing and IndexNow; without it, deep pages depend on link discovery alone. - Fix: Publish a sitemap at /sitemap.xml (or a sitemap index there) and declare it in robots.txt; submit it in Google Search Console and Bing Webmaster Tools after every deploy that changes the URL set. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Index Coverage Delta](https://jwatte.com/tools/index-coverage-delta/), [Duplicate Title / Meta Description Audit](https://jwatte.com/tools/duplicate-title-meta-audit/), [Agent Ready Audit](https://jwatte.com/tools/agent-ready-audit/) and 6 more. Standard: sitemaps.org. - [ ] **1.10 Sitemap is valid XML with a urlset or sitemapindex root** - Pass: The sitemap parses as XML and its root element is urlset or sitemapindex. - Fail: File is served but has no urlset or sitemapindex root, or the XML has a parse error (critical). - Numbers and lists the tool uses: Root regex /<(urlset|sitemapindex)\b/i (Mega Analyzer, Analyzer, E-E-A-T Analyzer, Batch Analyzer, Mega Batch); /``` entries. - Fail: Sitemap parses but contains no ```` entries, so tools that read it find nothing to crawl. - Numbers and lists the tool uses: `` regex /``\s*([^<\s]+)\s*<\/loc>/gi with duplicates removed (Search Console Importer); only http(s) locs kept (Mega SEO Analyzer); sitemap-index children walked: first 3 (Duplicate Title/Meta Audit, Mega SEO Analyzer), first 5 (Sitemap Audit), first 12 (Index Coverage Delta), first 20 (Link Graph); more than 500 URLs flagged as a large site (Migration Analyzer). - Why: An empty sitemap advertises nothing and reads as an unmaintained site. - Fix: Generate the sitemap from the real page list at build time so every indexable page appears as a ```` entry. - Verify: [Search Console + Bing Importer](https://jwatte.com/tools/search-console-importer/), [Sitemap Audit](https://jwatte.com/tools/sitemap-audit/), [Duplicate Title / Meta Description Audit](https://jwatte.com/tools/duplicate-title-meta-audit/), [Link Graph](https://jwatte.com/tools/link-graph/) and 2 more. Standard: sitemaps.org. - [ ] **1.12 Sitemap index references child sitemaps** - Pass: A sitemapindex lists one or more child sitemap `` entries. - Warn: Index contains zero child .xml locs (Mega Analyzer); children beyond the fifth are not audited (Sitemap Audit). - Numbers and lists the tool uses: Gate /`([^<]+\.xml)<\/loc>/gi (Mega Analyzer); first 5 children expanded (Sitemap Audit). - Why: An empty index feeds nothing to crawlers, and unused children waste crawl budget. - Fix: List every child sitemap loc in the index and prune children that no longer contain indexed pages. - Verify: [Sitemap Audit](https://jwatte.com/tools/sitemap-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: sitemaps.org. - [ ] **1.13 Sitemap URLs use the canonical domain** - Pass: The hostname of the sitemap's `` entries equals the canonical hostname. - Numbers and lists the tool uses: First `` hostname compared with the canonical (or page) hostname via /``(.*?)<\/loc>/gi; requires a canonical to be present (Analyzer, Batch Analyzer). - Why: Google follows each sitemap URL, hits the redirect to the real host, and reports 'Page with redirect' instead of indexing. - Fix: Regenerate the sitemap with canonical hostnames (find and replace across sitemap.xml or fix the site domain in the sitemap template). - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/). - [ ] **1.14 No /index.html URLs in the sitemap** - Pass: No sitemap entry path ends in /index.html or /index.htm. - Numbers and lists the tool uses: Regex /\/index\.html/i (Analyzer, Batch Analyzer); /\/index\.html?$/i (Sitemap Audit, Index Coverage Delta); listed as a GSC 'Page with redirect' risk pattern. - Why: If / and /index.html both serve the same content, Google reports 'Duplicate without user-selected canonical' or 'Page with redirect' for every one of them. - Fix: Strip the filename so entries read /path/, and 301 /index.html to / (netlify.toml redirect with force=true, vercel.json redirect, Cloudflare _redirects, Apache RewriteRule or Nginx return 301). - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Sitemap Audit](https://jwatte.com/tools/sitemap-audit/), [Index Coverage Delta](https://jwatte.com/tools/index-coverage-delta/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/). Standard: Google Search Console 'Page with redirect' report. - [ ] **1.15 Sitemap uses one host (no www and apex mix)** - Pass: Every sitemap entry shares one hostname. - Fail: More than one hostname appears and the minority host is the www or apex twin of the dominant host. - Numbers and lists the tool uses: Hostnames lowercased; dominant host = most entries; apex derived with .replace(/^www\./, ''); listed up to 50 (Sitemap Audit). - Why: The non-canonical host family always 301s, so GSC flags every such entry as 'Page with redirect'. - Fix: Pick one canonical host and normalize every sitemap entry to it. - Verify: [Sitemap Audit](https://jwatte.com/tools/sitemap-audit/). Standard: Google Search Console 'Page with redirect' report. - [ ] **1.16 Sitemap uses one trailing-slash convention** - Pass: Inner-page entries all end with a slash or all end without one, and no path appears in both forms. - Warn: Inner pages mix with-slash and without-slash forms (Analyzer). - Fail: The same origin plus path appears in both slash variants (Sitemap Audit). - Numbers and lists the tool uses: Inner pages = pathname not / with length over 1; URLs ending in a 2 to 5 char file extension /\.\w{2,5}$/ are excluded (Analyzer); extension exclusion /\.[a-z0-9]{2,6}$/i, key = origin plus pathname without trailing slash, listed up to 50 (Sitemap Audit). - Why: Hosts 301 between /foo and /foo/, so mixed forms guarantee redirect hops and 'Redirect error' reports in Search Console. - Fix: Pick one pattern site-wide and redirect the other (netlify.toml 301, vercel.json trailingSlash, Cloudflare Transform Rules, Apache RewriteRule or Nginx rewrite). - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Sitemap Audit](https://jwatte.com/tools/sitemap-audit/). Standard: Google Search Console 'Page with redirect' report. - [ ] **1.17 Sitemap lastmod values are recent and accurate** - Pass: A healthy share of sitemap entries carry a lastmod within the last 90 days. - Warn: Fewer than 30% of entries updated within 90 days (Mega Analyzer); any entry older than 90 days (Sitemap Audit). - Numbers and lists the tool uses: Window 90 days (90*86400*1000 ms); pass ratio 30% or more; gate 3 or more url entries (Mega Analyzer); stale = Date.parse(lastmod) older than now minus 90*24*3600*1000 ms (Sitemap Audit); newest and oldest lastmod reported as info via /``(.*?)<\/lastmod>/gi (Analyzer). - Why: Bing and Yandex use lastmod to decide what to re-crawl first, so stale dates push your pages down the queue. - Fix: Have the build write lastmod from the real content change date, never from the build time, so dates move only when content does. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Sitemap Audit](https://jwatte.com/tools/sitemap-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: sitemaps.org lastmod. - [ ] **1.18 Every sitemap entry has a lastmod** - Pass: Each `` node carries a `` element. - Warn: One or more entries have no lastmod (Sitemap Audit). - Numbers and lists the tool uses: Any `` without `` counts as missing (Sitemap Audit); expected format ISO 8601 with timezone on every indexable page (Single-Site Generator). - Why: Without lastmod, crawlers cannot prioritize changed pages and treat the whole sitemap as unknown age. - Fix: Emit lastmod in ISO 8601 with timezone for every entry, written automatically by the build when content changes. - Verify: [Sitemap Audit](https://jwatte.com/tools/sitemap-audit/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/), [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/). Standard: sitemaps.org lastmod; ISO 8601. - [ ] **1.19 No future-dated lastmod in the sitemap** - Pass: No lastmod is later than the current time. - Warn: Any lastmod more than one day in the future (Sitemap Audit). - Numbers and lists the tool uses: future = Date.parse(lastmod) greater than now plus 24*3600*1000 ms (Sitemap Audit). - Why: Future dates tell crawlers the sitemap is unreliable, which undermines every other lastmod. - Fix: Remove or correct future-dated lastmod values and fix the timezone handling that produced them. - Verify: [Sitemap Audit](https://jwatte.com/tools/sitemap-audit/). Standard: sitemaps.org lastmod. - [ ] **1.20 Sitemap URLs return HTTP 200 (no 4xx or 5xx)** - Pass: Every probed sitemap URL responds with a 2xx status. - Fail: Any sitemap URL returns a status of 400 or higher, or fails to respond (status 0). - Numbers and lists the tool uses: Broken = status 400 or higher or status 0 (Analyzer site crawl, first 50 sitemap URLs); status 400 or higher only, status 0 not counted (Index Coverage Delta); stat counts 404 while the list holds any status 400 or higher, first 200 probed by default, up to 900 (Sitemap Audit); status 400 or higher or status 0 with classes 4xx and 5xx, on pasted URLs up to 200 rather than sitemap entries (Redirect Chain Audit). - Why: Google de-trusts a sitemap that lists broken URLs and reports each as 'Submitted URL not found (404)' within a week. - Fix: Restore each broken page or remove it from the sitemap, then regenerate and resubmit the sitemap. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Index Coverage Delta](https://jwatte.com/tools/index-coverage-delta/), [Sitemap Audit](https://jwatte.com/tools/sitemap-audit/), [Redirect Chain Audit](https://jwatte.com/tools/redirect-chain-audit/). - [ ] **1.21 Sitemap URLs do not redirect** - Pass: Every sitemap URL responds 2xx directly rather than with a 3xx. - Warn: Any sitemap entry answers 301 or 302 (Analyzer site crawl, Index Coverage Delta, Sitemap Audit). - Numbers and lists the tool uses: Redirect band 300 to 399 (Analyzer, Index Coverage Delta); stat counts 301 plus 302 while the list holds any 3xx, listed up to 200 (Sitemap Audit); flagged as a GSC 'Page with redirect' pattern (Index Coverage Delta). - Why: Sitemaps should name terminal URLs; each redirecting entry becomes a 'Page with redirect' report and a wasted crawl. - Fix: Replace each redirecting entry with its final destination URL. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Index Coverage Delta](https://jwatte.com/tools/index-coverage-delta/), [Sitemap Audit](https://jwatte.com/tools/sitemap-audit/). Standard: Google Search Console 'Page with redirect' report. - [ ] **1.22 Sitemap pages are self-canonical** - Pass: Each sitemap page's resolves to its own URL (trailing-slash variants tolerated). - Warn: A page's canonical points to a different URL (Analyzer site crawl, Index Coverage Delta). - Fail: The fetched page declares a canonical that, resolved against the final URL, differs from it, whether or not a redirect occurred (Redirect Chain Audit fail flag canonical!=final). - Numbers and lists the tool uses: canonical must equal the URL with or without one trailing slash (Analyzer); canonical resolved against the page and normalized (hash stripped, trailing slash removed) must equal the page URL (Index Coverage Delta); canonical regex /]*rel=["']?canonical["']?[^>]*href=["']?([^"'>\s]+)/i on the first 10000 chars, resolved against the final URL (Redirect Chain Audit). - Why: A sitemap URL whose canonical points elsewhere is asking Google not to index it; one of the two signals is wrong. - Fix: Make each listed page self-canonical, or drop the non-canonical URL from the sitemap; when the canonical is right, redirect to it instead. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Index Coverage Delta](https://jwatte.com/tools/index-coverage-delta/), [Redirect Chain Audit](https://jwatte.com/tools/redirect-chain-audit/). - [ ] **1.23 No noindex pages listed in the sitemap** - Pass: No sitemap URL carries a meta robots noindex. - Numbers and lists the tool uses: Regex /noindex/ on the lowercased meta[name=robots] content of pages in the sitemap (Index Coverage Delta). - Why: The sitemap asks Google to index the page while the tag asks it not to; the conflict wastes crawl budget and confuses coverage reports. - Fix: Remove the URL from the sitemap or remove the noindex tag; the same URL cannot do both. - Verify: [Index Coverage Delta](https://jwatte.com/tools/index-coverage-delta/). - [ ] **1.24 No CMS-default placeholder pages in the sitemap** - Pass: No sitemap URL has an unmodified CMS default slug such as hello-world or sample-page. - Fail: Any placeholder slug is listed (critical). - Numbers and lists the tool uses: Regex /\/(?:hello[-_]world|sample[-_]page|sample[-_]post|untitled[-_]?(?:post|page|draft)?|blog[-_]post[-_]title[-_]?(?:one|two|three|four|five|[0-9]+)|coming[-_]?soon|placeholder[-_]?(?:page|post)?|lorem[-_]ipsum|new[-_]page|new[-_]post|test[-_]?(?:page|post|123)|page[-_]title|my[-_]first[-_](?:post|page)|default[-_]?(?:page|post))(?:-[a-z0-9]{4,8}){0,3}\/?$/i (Mega Analyzer). - Why: Placeholder pages tell site: queries and AI engines the site is unmaintained. - Fix: Delete, replace or unpublish the placeholder posts, then resubmit the sitemap in Search Console. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **1.25 No republished-draft random-suffix URL tails in the sitemap** - Pass: No sitemap URL ends in two or more random 5-character groups appended on re-publish. - Warn: Any such URL is listed (Mega Analyzer). - Numbers and lists the tool uses: Regex /\/[a-z0-9]+(?:-[a-z0-9]{2,})*(?:-(?=[a-z]*\d)[a-z0-9]{5}){2,}\/?$/i; Google displays roughly 70 chars of a URL (Mega Analyzer). - Why: Squarespace and similar builders append a suffix on every re-publish, leaving unstable URLs that lose backlinks. - Fix: Rename the slug to a clean form and add a 301 URL mapping from the suffixed version. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **1.26 No duplicate home-page aliases in the sitemap** - Pass: The sitemap lists / once with no alias paths such as /home or /welcome. - Warn: Root plus one or more aliases, or 2 or more aliases with no root (Mega Analyzer). - Numbers and lists the tool uses: Alias regex /\/(home(?:[-_][0-9a-z]+)?|welcome|index(?:[-_]old)?|landing(?:[-_]old)?|start[-_]here[-_](?:old|copy)|home[-_](?:copy|old|new|test))\/?$/i; threshold 2 aliases when no root is present (Mega Analyzer). - Why: Link equity splits across the aliases instead of consolidating on /. - Fix: Delete or noindex the aliases, 301 them to /, and resubmit the sitemap. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **1.27 Image sitemap served** - Pass: A /sitemap-image.xml file is served at the site root. - Warn: Missing on an image-heavy or editorial site (Mega Analyzer, Analyzer). - Numbers and lists the tool uses: Path /sitemap-image.xml; gate 10 or more images, or schema type matching /^(ImageGallery|Photograph|VisualArtwork|Painting|Sculpture)$/, or editorial context (Mega Analyzer); gate 5 or more images on the page (Analyzer); scored but never fetched (Batch Analyzer); hero images on Article and Recipe pages recommended because Google Discover prefers them (Sitemap Audit). - Why: Google Images and multimodal AI retrieval read image sitemaps to find and rank your pictures. - Fix: Publish sitemap-image.xml listing hero and gallery images and reference it from the main sitemap index. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Sitemap Audit](https://jwatte.com/tools/sitemap-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/). Standard: Google image sitemap. - [ ] **1.28 X-Robots-Tag header does not force noindex** - Pass: The X-Robots-Tag response header is absent or does not contain noindex. - Fail: Header contains noindex (critical). - Numbers and lists the tool uses: Header keys x-robots-tag / X-Robots-Tag; regex /noindex/i; check only runs when the header exists (Analyzer, Batch Analyzer); binary score 0 or 100 combined with meta robots (Mega AEO Analyzer); severity critical. - Why: A header-level noindex overrides the page markup and blocks indexing site-wide without anything visible in the HTML. - Fix: Remove the noindex directive from the server or CDN header configuration on pages that should rank. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega AEO Analyzer](https://jwatte.com/tools/mega-aeo-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/) and 2 more. Standard: Google X-Robots-Tag. - [ ] **1.29 Missing URLs return a real HTTP 404 (no soft 404)** - Pass: A request for a nonexistent path returns HTTP 404 with a helpful 404 page. - Warn: The probe redirects (3xx) instead of returning 404, or the 404 page body is under 200 characters (Analyzer, Indexing Hygiene Checks). - Fail: The nonexistent path returns HTTP 200 (soft 404; fail in Indexing Hygiene Checks, warn 'Possible soft 404' in the Analyzer). - Numbers and lists the tool uses: Probe path origin + /__jw-probe-<6 random base-36 chars>/ (Indexing Hygiene Checks) or origin + /this-page-should-not-exist-404-test-`` (Analyzer); Indexing Hygiene Checks: 200 = soft 404 fail, 300 to 399 = warn, any other non-404 status = info; Analyzer: expected status 404 or 0, body over 200 chars = pass, body under 200 chars = warn minimal page, any other status with a longer body = warn possible soft 404. - Why: Soft 404s make Google treat every phantom URL as indexable, bloating the crawl queue, and redirect-to-home patterns produce 'Page with redirect' reports. - Fix: Configure the server or framework to return a real 404 status for missing pages, and give the 404 template navigation and search so visitors can recover. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). Standard: Google Search Console 'Page with redirect' report. - [ ] **1.30 404 template is marked noindex** - Pass: The 404 page carries `` whose content includes noindex. - Warn: The 404 template has no robots meta at all (Analyzer, Indexing Hygiene Checks). - Fail: A robots meta is present but its content lacks noindex, or a page whose title or H1 reads like a not-found page is not noindexed. - Numbers and lists the tool uses: Robots meta regex /]*name=["']robots["'][^>]*content=["']([^"']+)["'][^>]*>/i tested with /noindex/; warn gate status 404 and HTML longer than 200 chars; 404-language regex /404|not\s*found|page\s*missing|can(?:['’]|no)t\s*find/i on lowercased title plus first H1 (Indexing Hygiene Checks). - Why: Without noindex, Google treats every missing URL as an indexable page. - Fix: Add `` to the 404 template. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **1.31 404 template emits no canonical tag** - Pass: The HTML served for a missing URL contains no . - Warn: A canonical tag with any href, even a self-canonical, is present on the 404 template (Analyzer, Indexing Hygiene Checks). - Numbers and lists the tool uses: Canonical regex /]*rel=["']canonical["'][^>]*>/i with href from /href=["']([^"']+)["']/i; the /404 self-canonical case is the separate canonical-bleed check (Indexing Hygiene Checks). - Why: Even a self-canonical tells Google the missing URL is a real, indexable page. - Fix: Wrap the canonical output in an 'if not noindex' condition in the template so 404 pages never emit it. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **1.32 No canonical pointing at /404.html** - Pass: Neither the page nor the 404 template declares a canonical whose href is the 404 page. - Fail: The canonical href matches the /404 pattern (fail in the Analyzer probe and in both Indexing Hygiene Checks entry points). - Numbers and lists the tool uses: Self-404 regex /\/404(?:\.html?|\/)?(?:[?#]|$)/i on the canonical href (Analyzer, Indexing Hygiene Checks). - Why: Google reads it as '/404.html is the canonical version of this URL', which is the number one cause of the 'Alternate page with proper canonical tag' report. - Fix: Wrap canonical and hreflang output in 'if not noindex' in the template and set noindex on the 404 page. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). Standard: Google Search Console 'Alternate page with proper canonical tag' report. - [ ] **1.33 404 template emits no hreflang links** - Pass: The 404 page contains zero tags. - Warn: One or more hreflang links appear on the 404 template or on a page that reads like a 404 (Analyzer, Indexing Hygiene Checks). - Numbers and lists the tool uses: Regex /]*rel=["']alternate["'][^>]*hreflang=/gi, count over 0 (Analyzer, Indexing Hygiene Checks). - Why: Every missing URL would claim international alternates, confusing Google's indexing. - Fix: Wrap hreflang output in 'if not noindex' in the template. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **1.34 Server-rendered HTML contains the page content (not a blank app shell)** - Pass: The raw HTML delivered by the server already contains the headings, copy and JSON-LD; it is not an empty mount point waiting for JavaScript. - Warn: A known client-rendered platform fingerprint, a noscript message about needing JavaScript, or a thin shell (HTML over 30000 bytes with under 200 visible words) is detected on a 2xx response and a banner points to the rendered-DOM workflow (Mega Analyzer via waf-detect.js detectSpaShell, informational, skipped in paste mode). - Fail: Raw HTML contains a known SPA mount div and lacks either an H1 or 150 words (critical, Mega Analyzer not_spa_shell); in the laundromat, self-storage, auto-wash and handyman vertical modules, SPA markers with under 120 raw words while the rendered page has over 250 add a client-rendered SPA issue. - Numbers and lists the tool uses: Mount ids root, app, __next, __nuxt, __svelte, gatsby-focus-wrapper, ___gatsby, __remix; shell = mount present and not (H1 count over 0 and word count 150 or more) (Mega Analyzer); when a bot-challenge page is returned the row is downgraded to warn; vertical modules: SPA markers /]+id=["'](?:root|app|__next|__nuxt)["'][^>]*>\s*<\/div>|__NEXT_DATA__|window\.__NUXT__|data-reactroot|ng-version|` is critical; a page with a title and under 200 chars of body text is critical (audit-toolkit.js jwScanForJSInjectedShells, surfaced by Mega Analyzer). - Why: AI crawlers and non-JS fetchers miss whatever is injected into an empty container. - Fix: Render the container server-side so its content is present in the initial HTML. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **1.36 Rendered DOM matches server HTML (no checks that only pass after hydration)** - Pass: No check changes severity between the server HTML and the rendered DOM. - Warn: One or more checks are changed or rendered-only (Rendered DOM Paste Audit). - Numbers and lists the tool uses: Compared only when a URL is supplied with the pasted DOM; the same 10 checks run on both documents: title present, meta description present, H1 count (1 pass, 0 fail, 2 or more warn), canonical present (else warn), html lang present (else fail), JSON-LD block count over 0 (else warn), every img has alt (else warn), main-content word count (300 or more pass, 100 to 299 warn, under 100 fail), internal links 3 or more (else warn); a diff row is 'changed' when the severity differs between static and rendered and 'rendered-only' when the static side has no such check (Rendered DOM Paste Audit). - Why: Googlebot's first pass reads the static HTML, so anything that only appears after hydration is missed on that pass. - Fix: Move the differing elements (schema, headings, canonical, links) into the server-rendered HTML. - Verify: [Rendered DOM Paste Audit](https://jwatte.com/tools/rendered-dom-paste-audit/). - [ ] **1.37 Mobile version is not thinner than desktop** - Pass: The mobile version of the page has the same word count, H2s and schema types as the desktop version. - Fail: Desktop exceeds mobile by more than 200 words, or desktop has more H2s or more schema types than mobile (flagged as PARITY ISSUE DETECTED in the AI fix prompt). - Numbers and lists the tool uses: AI prompt flag: desktop word count minus mobile over 200, or desktop H2 count minus mobile over 0, or desktop schema-type count minus mobile over 0; Mobile parity score starts at 100: absolute word gap over 200 = minus 25, over 50 = minus 10; H2 overlap below 90 percent = minus 25; schema-type overlap below 100 percent = minus 20; HTML size gap over 30 KB = minus 10; only evaluated when a mobile fetch exists (Mega Analyzer). - Why: Mobile-first indexing means Google ranks the thinner mobile version. - Fix: Serve the same content, headings and schema to mobile visitors as to desktop. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: Google mobile-first indexing. - [ ] **1.38 Page URL resolves without a redirect** - Pass: The requested URL is the final URL, or differs only by trailing slash or http to https on the same host; a www to apex flip is also tolerated by Mega Analyzer (and marked expected-canonical by Redirect Chain Audit) but not by Batch Analyzer, Mega Batch or Analyzer. - Warn: Cross-domain redirect, path rename, consolidation to the homepage, or a query or protocol change (Mega Analyzer, Batch Analyzer, Mega Batch, Analyzer, Redirect Chain Audit). - Numbers and lists the tool uses: Mega Analyzer: trivial = same host, same path after stripping trailing slashes and same query; or http to https on the same host, path and query; or apex to www (hosts compared after stripping /^www\./i) with the same path and query; otherwise warn. Batch Analyzer and Mega Batch: trivial = same lowercased host, same path after stripping trailing slashes and same query, or http to https on the same host, path and query; a www flip is reported as a cross-domain redirect; warn. Analyzer: warn when the hostname or the exact pathname differs; consolidation pattern dst.pathname === '/' or /^\/(research|articles|archive|category|tag)\/?$/. Uptime Check: info when the final URL differs from the input, pass 'No redirects' otherwise. Redirect Chain Audit: redirected = final URL differs from the start URL, cross-origin flag when the hostname differs, expected-canonical info flag when hosts match after stripping www and the path is unchanged for a www flip or http upgrade. - Why: Every hop costs a crawl and leaks a little authority, and external links to the old path bleed on every visit. - Fix: Update internal links, canonical and sitemap entries to the final URL and ask linking sites to re-point backlinks. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Uptime + Response-Time Diagnostic](https://jwatte.com/tools/uptime-check/), [Redirect Chain Audit](https://jwatte.com/tools/redirect-chain-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/) and 2 more. - [ ] **1.39 Redirect chains are one hop at most** - Pass: Any redirect reaches its final URL in a single hop. - Warn: A chain records more than 2 entries (Redirect Chain Audit). - Numbers and lists the tool uses: Chain entries over 2 (Redirect Chain Audit KPI 'Long chains (>2)' and prompt rows with hops over 2); the chain is approximated as the start URL plus the fetch's auto-followed final URL, so intermediate hops are not recorded; redirect loops (final URL equals an intermediate hop) appear only as a task in the AI fix prompt. - Why: Chains longer than two hops leak PageRank and exhaust AI-crawler retry budgets. - Fix: Collapse each chain with a single 301 from the first URL to the final URL in your Netlify _redirects, Apache .htaccess or nginx config, fixing loops first. - Verify: [Redirect Chain Audit](https://jwatte.com/tools/redirect-chain-audit/). - [ ] **1.40 No https-to-http redirect downgrade** - Pass: A URL that starts on https never redirects to http. - Fail: The start URL is https: and the final URL is http: (flag 'https->http (DOWNGRADE)', rendered as a fail flag). - Numbers and lists the tool uses: Start protocol https: and final protocol http: (Redirect Chain Audit). - Why: A downgrade drops visitors and crawlers onto an insecure page. - Fix: Fix the server config so HTTPS stays HTTPS through every redirect. - Verify: [Redirect Chain Audit](https://jwatte.com/tools/redirect-chain-audit/). - [ ] **1.41 Links point at https directly (no http-to-https upgrade hop)** - Pass: The traced URL starts on https, so no upgrade redirect is needed. - Warn: Start protocol is http and the final is https (Redirect Chain Audit). - Numbers and lists the tool uses: Start protocol http: and final protocol https: (Redirect Chain Audit). - Why: The upgrade hop is harmless for the site but wasted for every link that still uses http. - Fix: Link to the https URL directly in internal links, the sitemap and outreach. - Verify: [Redirect Chain Audit](https://jwatte.com/tools/redirect-chain-audit/). - [ ] **1.42 No meta refresh redirects** - Pass: The final page does not redirect with ``. - Warn: A meta refresh tag appears in the first 4000 characters (Redirect Chain Audit). - Numbers and lists the tool uses: Regex /]+name=["']robots["'][^>]+content=["'][^"']*noindex/i (Featured Snippet Extractability); /noindex/i on the X-Robots-Tag header or /]+name=["']robots["'][^>]+noindex/i on the HTML, binary score 0 or 100 (Mega AEO Analyzer); expected default index,follow on canonical pages (Single-Site Generator, Site Migration Generator). - Why: A noindex page is invisible to search and AI crawlers, cannot win featured snippets, and is a dead end for link authority. - Fix: Remove noindex from any page that should rank; keep it only on pages you deliberately hide. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Meta + OG Inspector](https://jwatte.com/tools/meta-og-inspector/), [Featured-Snippet Extractability Audit](https://jwatte.com/tools/featured-snippet-extractability/), [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/) and 6 more. Standard: Google robots meta tag. - [ ] **1.44 Meta robots declared explicitly** - Pass: The page carries a `` tag with an explicit directive. - Warn: No meta robots tag; the browser default of index,follow applies (Meta OG Inspector warns, AI Posture Audit reports as info). - Numbers and lists the tool uses: Recommended value max-snippet:-1, max-image-preview:large (AI Posture Audit). - Why: Not required, but an explicit declaration removes ambiguity for AI engines and lets you open up snippet and image-preview limits. - Fix: Add `` to indexable pages. - Verify: [Meta + OG Inspector](https://jwatte.com/tools/meta-og-inspector/), [AI Posture Audit](https://jwatte.com/tools/ai-posture-audit/). Standard: Google robots meta tag. - [ ] **1.45 Page does not set max-snippet:0** - Pass: No robots meta tag sets max-snippet to 0. - Fail: A robots meta sets max-snippet:0 (Featured Snippet Extractability). - Numbers and lists the tool uses: Regex /]+name=["']robots["'][^>]+content=["'][^"']*max-snippet:\s*0/i (Featured Snippet Extractability). - Why: Max-snippet:0 opts the page out of snippets, so it can never be quoted in a featured snippet or AI answer. - Fix: Remove the max-snippet:0 directive (or set max-snippet:-1) on pages you want quoted. - Verify: [Featured-Snippet Extractability Audit](https://jwatte.com/tools/featured-snippet-extractability/). Standard: Google robots meta tag max-snippet directive. - [ ] **1.46 Canonical URL set** - Pass: The page declares a `` with an absolute https href pointing at itself. - Warn: Missing canonical (Analyzer, Mega SEO Analyzer, SGE Readiness Audit, Platform Audit, Rendered DOM Paste Audit). - Fail: Missing canonical (Mega Analyzer, Meta OG Inspector); missing canonical forfeits 10 of the SEO bucket points in Batch Analyzer and 12 in Mega Batch. - Numbers and lists the tool uses: Regex /]+rel=["']canonical["']/i (Mega SEO Analyzer); href must be non-empty (SGE Readiness Audit); link[rel="canonical"] present, weight 10 in the SEO bucket (Batch Analyzer) and 12 (Mega Batch); expected self-referencing absolute https form on every page (Single-Site Generator); canonical present is a pre-deploy quality gate (Monoclone Generator). - Why: Without a canonical, Google has to guess the preferred URL among www, trailing-slash and query variants, and AI Overviews may attribute the wrong version. - Fix: Add `` with the page's own preferred URL. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Meta + OG Inspector](https://jwatte.com/tools/meta-og-inspector/), [SGE Readiness Audit](https://jwatte.com/tools/sge-readiness-audit/), [Platform Audit](https://jwatte.com/tools/platform-audit/) and 7 more. Standard: RFC 6596 (rel=canonical). - [ ] **1.47 Canonical points at this site's own domain** - Pass: The canonical hostname equals the page's final served hostname, or at least the same registrable domain. - Warn: Canonical is on a different host or registrable domain, or fails to parse (Mega Analyzer, Analyzer). - Fail: Canonical hostname differs from the final served hostname on a non-provisional host (Analyzer). - Numbers and lists the tool uses: Hostnames compared after stripping /^www\./i (Mega Analyzer); compared against the post-redirect final URL (Analyzer); provisional hosts /\.(netlify\.app|vercel\.app|pages\.dev|web\.app|firebaseapp\.com|github\.io|onrender\.com|fly\.dev)$/i are reported as info during DNS cutover (Analyzer); canonicals must resolve to the same origin (Single-Site Generator). - Why: A canonical on another domain hands your authority to that domain and produces 'Alternate page with proper canonical tag' in Search Console. - Fix: Make the canonical match your live preferred URL exactly, then update sitemap.xml and robots.txt to the same domain; only keep a cross-domain canonical for deliberately republished content. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/). - [ ] **1.48 Canonical trailing slash matches the served URL** - Pass: The canonical path and the served path are identical, including the trailing slash. - Fail: Canonical path differs from the page path only by a trailing slash (Mega Analyzer). - Why: The two forms split ranking signals between them. - Fix: Confirm which form returns 200 and align the canonical to that form. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **1.49 Canonical URL does not use a non-standard port** - Pass: The canonical URL has no port, or uses 80 or 443. - Fail: Any other port (critical). - Numbers and lists the tool uses: Allowed ports 80 and 443 (Mega Analyzer). - Why: Googlebot does not crawl alternate ports; a port in the canonical usually means a staging URL leaked into production. - Fix: Emit the live origin in the canonical, without a port. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **1.50 Canonical URL resolves with HTTP 2xx** - Pass: A request to the declared canonical URL returns 2xx. - Warn: Canonical redirects (3xx); could not be verified (status 0 or unknown) is reported as info (Analyzer). - Fail: Canonical returns 400 or higher (Analyzer). - Numbers and lists the tool uses: 2xx pass; 300 to 399 warn; 400 or higher fail; status 0 info (Analyzer). - Why: A canonical that redirects or 404s is treated by Google as no canonical at all. - Fix: Update the canonical to the final destination URL that returns 2xx. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **1.51 This URL is listed in the sitemap** - Pass: The page URL (or its trailing-slash or www variant) appears in the sitemap, or the sitemap is an index. - Warn: URL not found in the sitemap (Mega Analyzer, Analyzer, E-E-A-T Analyzer, Batch Analyzer, Mega Batch). - Numbers and lists the tool uses: Variants checked: hostname and its www/apex twin, with and without trailing slash; a sitemapindex passes (Mega Analyzer); exact href and trailing-slash toggle only (Analyzer, E-E-A-T Analyzer, Batch Analyzer, Mega Batch); severity warn. - Why: A page missing from the sitemap is discoverable only through internal links and gets no direct indexing signal. - Fix: Add the URL to the sitemap and resubmit it. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/) and 1 more. Standard: sitemaps.org. - [ ] **1.52 Thank-you and confirmation pages are noindex** - Pass: Any funnel or confirmation page carries a noindex directive. - Fail: A page whose path or title reads as a thank-you or confirmation page is indexable. - Numbers and lists the tool uses: Path regex /\/(thank[-_]?you|ty[-_]|confirmation|thanks|booked|meeting[-_]?booked)(\/|$)/; title patterns thank you, confirmation, meeting (is) booked, submission received (Mega Analyzer). - Why: An indexed thank-you page competes with the real conversion page for the same query and pollutes site: results. - Fix: Add `` to funnel and confirmation pages. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **1.53 URL slugs are clean kebab-case with no query parameters for content** - Pass: Content URLs use lowercase, hyphen-separated, keyword-aware slugs and never rely on query strings. - Why: Clean slugs are readable in results, stable across redesigns and easy for crawlers to canonicalize. - Fix: Rewrite content URLs as /section/keyword-slug/ and 301 the old forms. - Verify: [Single Site Gen](https://jwatte.com/tools/single-site-gen/). - [ ] **1.54 Page has followable internal outbound links (not a dead end)** - Pass: The page links to other pages on the same host without rel=nofollow, ideally several. - Warn: Zero followable internal links (Mega Analyzer, Batch Analyzer, Mega Batch); fewer than 5 (Analyzer); 3 to 7 outside nav (SGE Readiness Audit); fewer than 3 (Rendered DOM Paste Audit). - Fail: Zero internal outbound links (Analyzer crawl validation, E-E-A-T Analyzer, Link Graph dead-end tag); fewer than 3 outside nav (SGE Readiness Audit). - Numbers and lists the tool uses: Dead end = 0 anchors that resolve to the page hostname without rel nofollow (Mega Analyzer, Analyzer crawl validation, E-E-A-T Analyzer, Batch Analyzer, Mega Batch); Link Graph dead end = 0 same-host links after skipping mailto:, tel:, javascript:, sms: and data: hrefs, nofollow links still counted; at least 5 internal http(s) links after skipping tel:, mailto:, sms:, javascript: and data: hrefs (Analyzer, Batch Analyzer SEO bucket); tiers 10, 5 and 1 for full, partial and minimal credit, plus total links (internal plus external) 15 or more full and 8 or more partial (Batch Analyzer links bucket); 8 or more pass, 3 to 7 warn, under 3 fail, counted inside the content area and excluding links inside `

` (SGE Readiness Audit); at least 3 hrefs not starting with http, #, mailto: or tel: (Rendered DOM Paste Audit); at least 2 per page (Single-Site Generator, Site Migration Generator); the Analyzer link-topology listing skips tel:, mailto:, javascript:, sms:, data: and # hrefs plus asset paths matching /\.(xml|txt|json|xsl|rss|atom|pdf|zip|png|jpe?g|gif|svg|webp|avif|css|js)(\?|#|$)/i, and the Mega Analyzer listing skips tel:, mailto:, javascript: and # hrefs. - Why: A dead-end page stops crawlers and passes no authority forward, and thin internal linking reads as weak topical depth to AI Overviews. - Fix: Add 2 to 3 (better, 5 or more) contextual internal links to related pages with descriptive anchor text, using real destinations on the site. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [SGE Readiness Audit](https://jwatte.com/tools/sge-readiness-audit/), [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Link Graph](https://jwatte.com/tools/link-graph/) and 6 more. - [ ] **1.55 Anchor text is descriptive (few generic anchors)** - Pass: Fewer than 10% of anchors use generic text such as click here or read more. - Fail: Generic anchors make up 10% or more of all anchors (Mega Analyzer). - Numbers and lists the tool uses: Generic regex /^\s*(click\s+here|read\s+more|learn\s+more|here|this\s+page|this\s+link|link|more|continue|→|»)\s*$/i; ceiling 0.1 of total anchors (Mega Analyzer). - Why: Generic anchors carry no relevance signal about the linked page for crawlers or screen readers. - Fix: Rewrite generic anchors as descriptive text that names the destination. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: WCAG 2.x SC 2.4.4. - [ ] **1.56 Links on the page resolve (no broken destinations)** - Pass: Every checked link returns a 2xx or 3xx status, or the host is a known bot-shielded domain marked unverifiable rather than broken. - Warn: Redirected links (301, 302) and unverifiable challenged hosts are listed for review (Analyzer). - Fail: Any link on a non-challenged host returns a status outside 200 to 399, times out (status 0) or errors (Analyzer); an internal destination that is not WAF-challenged answers 400 or higher (Internal Link Auditor). - Numbers and lists the tool uses: Up to 50 unique http(s) links per page; skips tel:, mailto:, sms:, javascript:, data: and # hrefs; challenge statuses 0, 401, 403, 429, 503, 999; CHALLENGED_HOSTS by suffix: amazon.com, amazon.co.uk, amazon.ca, amazon.de, amazon.fr, amazon.it, amazon.es, amazon.com.au, amazon.co.jp, amazon.in, amazon.com.mx, linkedin.com, instagram.com, facebook.com, fb.com, x.com, twitter.com, tiktok.com, reddit.com, quora.com, pinterest.com, threads.net, ewg.org, nytimes.com, wsj.com, ft.com, washingtonpost.com, bloomberg.com, economist.com, newyorker.com, theatlantic.com, nature.com, science.org, sciencedirect.com, springer.com, wiley.com, jstor.org, acs.org, ieee.org, ncbi.nlm.nih.gov, pubmed.ncbi.nlm.nih.gov, sec.gov, irs.gov, cdc.gov, nih.gov, fda.gov, uspto.gov, indeed.com, glassdoor.com, zillow.com, realtor.com, redfin.com, yelp.com, tripadvisor.com, booking.com, expedia.com, crunchbase.com, producthunt.com, angel.co, semrush.com, ahrefs.com (Analyzer); internal destinations with status 400 or higher, crawl limit default 30 pages and at most 150, probes capped at 5 times the page limit or 100, whichever is larger (Internal Link Auditor). - Why: Broken links send visitors and crawlers to errors and waste crawl budget; links into bot-shielded hosts only look broken to automated checkers. - Fix: Repair or remove links that return 4xx or 5xx, point redirected links at their final URL, and verify challenged hosts in a real browser. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Internal Link Auditor](https://jwatte.com/tools/internal-link-auditor/). - [ ] **1.57 Internal links point directly at the final URL (no redirect hops)** - Pass: No internal link destination redirects to a different final URL. - Warn: An internal link destination answers 3xx and lands elsewhere (Internal Link Auditor). - Numbers and lists the tool uses: Status 300 to 399 with a final URL different from the linked URL; suggested rewrite = pathname plus search of the final URL for root-relative hrefs, else the absolute final URL (Internal Link Auditor). - Why: Each redirecting link costs a hop on every crawl and every click. - Fix: Rewrite each redirecting href to its final path across the source tree, then commit and review the diff. - Verify: [Internal Link Auditor](https://jwatte.com/tools/internal-link-auditor/). - [ ] **1.58 Every page has inbound internal links (no orphans or unlinked sitemap entries)** - Pass: Each page is reachable from the home page through internal links and has at least one inbound link from another page. - Warn: A sitemap URL is never reached by the crawl from the home page (Index Coverage Delta ghost). - Fail: A page has zero inbound internal links (Link Graph orphan, Link Graph sitemap-only); a sitemap page that no other crawled page links to (Analyzer). - Numbers and lists the tool uses: In-degree 0 excluding the seed (Link Graph); ghost = sitemap URL not in the crawled set, crawl default 300 pages to depth 4 (Index Coverage Delta); URL, URL plus slash and URL minus slash all absent from the collected link set, across the first 50 sitemap URLs crawled (Analyzer); every URL reachable within 3 clicks of home (Single-Site Generator, Site Migration Generator); requests for 2 or more inbound links each (Link Graph). - Why: Pages with no internal links receive no authority and usually end up as 'Discovered, currently not indexed' in Search Console. - Fix: Link each orphan from a relevant hub page (2 to 3 inbound links with descriptive anchors), or remove it from the sitemap if it is obsolete or 404s. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Index Coverage Delta](https://jwatte.com/tools/index-coverage-delta/), [Link Graph](https://jwatte.com/tools/link-graph/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/) and 1 more. Standard: Google Search Console 'Discovered, currently not indexed' status. - [ ] **1.59 Every crawlable page is listed in the sitemap (no crawl-only pages)** - Pass: No page reachable from the home page is missing from the sitemap. - Warn: A crawled URL is absent from every sitemap URL (Index Coverage Delta). - Fail: Crawl-only URL count is above zero (Link Graph). - Numbers and lists the tool uses: Orphan bucket = crawled and not in sitemap; first 50 orphans placed in the IndexNow payload (Index Coverage Delta); only rendered when the sitemap has at least one URL, listed up to 120 (Link Graph). - Why: Bing, Yandex, Kagi and AI crawlers lean on the sitemap, so pages missing from it rely on link discovery alone. - Fix: Add each missing URL as a ````...````YYYY-MM-DD```` entry, resubmit the sitemap, and ping IndexNow; or noindex the page if it should not rank. - Verify: [Index Coverage Delta](https://jwatte.com/tools/index-coverage-delta/), [Link Graph](https://jwatte.com/tools/link-graph/). - [ ] **1.60 No unintended noindex pages across the crawl** - Pass: Every crawled page that should rank is free of meta robots noindex. - Warn: A crawled page outside the sitemap carries noindex (Index Coverage Delta row tag). - Fail: A crawled page carries noindex (Link Graph). - Numbers and lists the tool uses: Regex /noindex/i on meta[name=robots] content; every noindex page listed in the results and up to 20 in the AI fix prompt (Link Graph); regex /noindex/ on the lowercased meta[name=robots] content, tagged noindex when the URL is outside the sitemap and noindex-in-sitemap when it is listed (Index Coverage Delta). - Why: Search engines will not list these pages; staging leftovers and forgotten tags are the usual cause. - Fix: If intentional (staging, thank-you pages) ignore; otherwise remove the tag and resubmit the URL in Search Console. - Verify: [Index Coverage Delta](https://jwatte.com/tools/index-coverage-delta/), [Link Graph](https://jwatte.com/tools/link-graph/). - [ ] **1.61 No thin pages with few inbound links (Crawled, currently not indexed risk)** - Pass: Every indexable page has 300 or more words of main content or more than 2 inbound internal links. - Warn: An indexable page has under 300 words and 2 or fewer inbound links (Index Coverage Delta). - Numbers and lists the tool uses: Word count over 0 and under 300 in main, else article, else body with script, style, nav, footer, aside and header removed; inbound internal links 2 or fewer; indexable = no noindex and status 200 to 299 (Index Coverage Delta). - Why: This is exactly the profile Google scores as not worth indexing. - Fix: Expand the page to 500 or more words of useful copy and add 3 or more contextual inbound links from related hubs, tag pages or adjacent posts. - Verify: [Index Coverage Delta](https://jwatte.com/tools/index-coverage-delta/). Standard: Google Search Console 'Crawled, currently not indexed' status. - [ ] **1.62 hreflang set includes x-default (when hreflang is used)** - Pass: Either no hreflang is declared (single-language site, reported as info) or the declared set includes an x-default alternate. - Warn: Hreflang tags exist but no x-default (Mega Analyzer, Analyzer, AEO/GEO Checks). - Fail: Hreflang tags exist but no x-default (Mega Analyzer full report). - Numbers and lists the tool uses: Selector link[rel=alternate][hreflang]; exact value x-default; gate hreflangs.length over 0; a site with no hreflang is info, not a fail, with advice to add hreflang only when the same content is published in 2 or more locales (Mega Analyzer). - Why: X-default is the fallback for locales you do not target, and without it Google may guess the wrong language. - Fix: When you publish multiple locales, add `` alongside the language alternates. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: Google hreflang documentation. - [ ] **1.63 hreflang set includes a self-referencing entry** - Pass: One of the page's hreflang alternates points at the page itself. - Warn: No declared alternate resolves to the current URL (Analyzer, AEO/GEO Checks). - Numbers and lists the tool uses: Analyzer matches by pathname equality only; AEO/GEO Checks matches by full href equality or pathname equality; only evaluated when at least one link[rel=alternate][hreflang] exists (Analyzer, AEO/GEO Checks). - Why: Every page in an hreflang cluster must list itself or Google ignores the cluster. - Fix: Add `` to each page. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). Standard: Google hreflang documentation. - [ ] **1.64 hreflang codes are valid language or language-region codes** - Pass: Every hreflang value is a two-letter language code, a language-region pair or x-default. - Warn: Any value fails the pattern (Analyzer). - Numbers and lists the tool uses: Regex /^[a-z]{2}(-[A-Za-z]{2,})?$|^x-default$/ (Analyzer). - Why: Invalid codes are ignored, silently breaking the whole cluster. - Fix: Use ISO 639-1 codes (en, es) or language-region pairs (en-US). - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). Standard: ISO 639-1. - [ ] **1.65 hreflang alternates link back (bidirectional)** - Pass: Every checked alternate page declares an hreflang link pointing back to this page. - Warn: One or more alternates do not point back (Analyzer). - Fail: An alternate returns no response, errors, or contains no reverse link (AEO/GEO Checks). - Numbers and lists the tool uses: Requires 2 or more hreflang tags, excludes x-default and self; first 3 alternates checked, an alternate whose body is under 200 chars is skipped rather than flagged (Analyzer); first 6 alternates checked, reverse-link regex /]*rel=["']alternate["'][^>]*hreflang=["']([^"']+)["'][^>]*href=["']([^"']+)["']/gi, reasons no response, no reverse link or fetch error (AEO/GEO Checks). - Why: Google requires bidirectional hreflang; a one-way link is a silent dead signal. - Fix: Add the full self-referencing hreflang cluster to every alternate page so each one links back. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). Standard: Google hreflang return links. - [ ] **1.66 RSS/Atom and JSON Feed links declared in ``** - Pass: The page carries `` entries for an RSS or Atom feed and a JSON Feed. - Warn: RSS/Atom link missing on an editorial site (Mega Analyzer, Analyzer); JSON Feed missing on an editorial site (Mega Analyzer); JSON Feed missing is reported as info (Analyzer). - Numbers and lists the tool uses: link[type=application/rss+xml] or application/atom+xml and link[type=application/feed+json] (Mega Analyzer); rel=alternate type containing xml, rss, atom or json (Analyzer); gate editorial context or the feed already declared (Mega Analyzer); spec: Atom /feed.xml with atom:link rel=self matching its own URL, JSON Feed /feed.json version https://jsonfeed.org/version/1.1 (Single-Site Generator, Site Migration Generator); consider a WebSub hub (Single-Site Generator); sitemap plus IndexNow plus WebSub pings on every deploy (Monoclone Generator). - Why: Feeds are how feed readers, aggregators and AI retrieval bots discover new content quickly. - Fix: Publish /feed.xml and /feed.json and link both in ``: `` and ``. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/), [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/) and 1 more. Standard: RSS / Atom; JSON Feed 1.1. - [ ] **1.67 Feed's atom:link rel="self" matches the URL it is served at** - Pass: The self href inside /feed.xml equals the feed's final served URL (origin plus path). - Warn: They differ (Analyzer). - Numbers and lists the tool uses: Feed body 40 or more chars; regexes /]*rel=["']self["'][^>]*href=["']([^"']+)["']/i or the href-first variant; compared as origin plus pathname without trailing slash or query (Analyzer). - Why: After a domain change, aggregators dedupe on the self link and can drop or duplicate the feed. - Fix: Point atom:link rel="self" at the post-redirect URL where the feed actually lives. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **1.68 IndexNow key published and pinged on publish** - Pass: An IndexNow key is referenced in the HTML or robots.txt, hosted at /``.txt, and the site pings the IndexNow endpoint when content changes. - Warn: No IndexNow implementation found (Analyzer). - Fail: Peer sites have it and this site does not (Batch Analyzer gap table). - Numbers and lists the tool uses: Key regexes /indexnow[- _]?key["'\s]*(?:content=["']|:["'\s]*)([a-zA-Z0-9_-]+)/i and /indexnow.*?["']([a-f0-9]{16,})['"]/i in HTML, /([a-f0-9]{32,64})\.txt/i and /indexnow[^a-f0-9]{0,40}([a-f0-9]{16,64})/i in robots.txt, presence fallback /indexnow/i (Analyzer); /[0-9a-f]{32}\.txt/i on the body or /indexnow/i in robots or meta robots, gated to editorial sites (Mega Analyzer); /[a-f0-9]{32,64}\.txt/i (Batch Analyzer); 32-char hex key; endpoint https://api.indexnow.org/indexnow with body {host, key, keyLocation, urlList}, success = ok or 202 (Single-Site Generator, Monoclone Generator, Index Coverage Delta payload). - Why: Bing, Yandex and the engines behind ChatGPT and Perplexity re-crawl within seconds of a ping instead of waiting for the next scheduled visit. - Fix: Generate a key at indexnow.org, host it at /``.txt, add ``, and POST new, changed and deleted URLs to https://api.indexnow.org/indexnow after every deploy. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Index Coverage Delta](https://jwatte.com/tools/index-coverage-delta/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/) and 3 more. Standard: IndexNow. - [ ] **1.69 IndexNow key file resolves and matches the key** - Pass: Exactly one candidate key resolves at /``.txt with a body equal to the key. - Warn: No candidate key file resolves with a matching body, or more than one key file is live (Analyzer). - Numbers and lists the tool uses: Candidates from the meta tag plus robots.txt matches of /([a-f0-9]{16,64})\.txt|indexnow[- ]?key[^a-f0-9]{0,40}([a-f0-9]{16,64})/gi; at most 5 probed; body trimmed and lowercased must equal the key (Analyzer). - Why: Pings fail silently without a valid key file, and engines accept the first key they find, so stale keys cause confusion. - Fix: Publish /``.txt whose body is exactly the key and delete unused key files. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). Standard: IndexNow key file verification. - [ ] **1.70 Search engine verification meta tags present** - Pass: The page carries google-site-verification, msvalidate.01 (Bing) or yandex-verification. - Warn: None of the verification metas present (Mega Analyzer). - Fail: None of the three present (Mega Analyzer full report). - Numbers and lists the tool uses: Tags checked: meta name google-site-verification, msvalidate.01, yandex-verification; any one present passes (Mega Analyzer). - Why: Verification shows the site is claimed in Search Console and Bing Webmaster Tools, which is where indexing data and error reports live. - Fix: Verify the site in each console and add its meta tag (or verify by DNS record instead). - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **1.71 Image URLs are publicly reachable** - Pass: Each image URL loads in a browser with readable dimensions and the server answers with an image content type and a 2xx status. - Warn: The server reports a live image but the browser cannot read its pixels, which points at hot-link protection, CORS or Referer rules (Image Alt Audit). - Fail: The image URL returns 400 or higher (403 = hot-link protection or WAF, 404 = file not found), the origin returns a bot/WAF challenge instead of image bytes (single-URL mode), or neither the browser nor the server returns anything usable. - Numbers and lists the tool uses: Browser load timeout 12000 ms; content type ^image\/; status 200 to 399 live; status 400 or higher fail; batch mode up to 25 URLs (Image Alt Audit). - Why: An image that browsers or crawlers cannot fetch cannot rank in image search or be read by multimodal AI. - Fix: Fix the URL, relax hot-link protection, CORS and Referer rules for image requests, and confirm the host is online. - Verify: [Image Alt Audit](https://jwatte.com/tools/image-alt-audit/). - [ ] **1.72 No sitemap URLs reported as not indexed in Google Search Console** - Pass: No GSC row for a sitemap URL carries a not-indexed status. - Warn: A not-indexed status outside the specifically handled groups (Soft 404, Blocked by robots.txt, Excluded by noindex tag) is reported as info (Search Console Importer). - Fail: Any sitemap URL whose GSC status classifies as not indexed. - Numbers and lists the tool uses: Indexed = status matching /indexed|success|valid/ and not /not indexed/; not indexed = /discovered.*not indexed/i, /crawled.*not indexed/i, /duplicate.*without.*canonical/i, /alternate page.*proper canonical/i, /page with redirect/i, /not found $404$/i, /soft 404/i, /blocked by robots/i, /excluded.*noindex/i, /server error/i, /redirect error/i; URLs compared as origin plus pathname without trailing slash plus search (Search Console Importer). - Why: These are the pages you asked Google to index that it declined; each status names a root cause. - Fix: Export the GSC Pages report, group the flagged URLs by status, fix the root cause for each group (template patch, redirect rule, robots.txt edit), then request indexing. - Verify: [Search Console + Bing Importer](https://jwatte.com/tools/search-console-importer/). Standard: Google Search Console Page indexing report status names. - [ ] **1.73 Every sitemap URL appears in Google Search Console data** - Pass: Every sitemap URL is present in the GSC export. - Warn: One or more sitemap URLs are absent from the GSC CSV (Search Console Importer). - Numbers and lists the tool uses: First 8 listed in the finding, up to 200 in the section, first 30 in the fix prompt (Search Console Importer). - Why: Google has not discovered these URLs yet (recently published, no backlinks) or they were filtered from the export. - Fix: Ping them via IndexNow or use GSC URL Inspection, Request Indexing to force discovery. - Verify: [Search Console + Bing Importer](https://jwatte.com/tools/search-console-importer/). - [ ] **1.74 Google Search Console knows no URLs that are missing from the sitemap** - Pass: Every URL in the GSC export is also in the sitemap. - Warn: GSC rows exist whose URL is not in the sitemap (Search Console Importer). - Numbers and lists the tool uses: Section lists up to 200 with each row's GSC status; first 20 in the fix prompt (Search Console Importer). - Why: These are either stale URLs that should return 410 or real pages you forgot to add to the sitemap. - Fix: Review each URL: add it to the sitemap if it is real, or serve 410 if it is gone. - Verify: [Search Console + Bing Importer](https://jwatte.com/tools/search-console-importer/). - [ ] **1.75 No GSC 'Alternate page with proper canonical tag' URLs** - Pass: No GSC row carries a status matching alternate page. - Warn: Status matches /alternate page|duplicate/i (Search Console Importer). - Numbers and lists the tool uses: Status regex /alternate page/i; first 8 URLs listed (Search Console Importer). - Why: The number one cause is a 404 template whose canonical bleeds to /404.html, so Google treats missing URLs as alternates of the 404 page. - Fix: Run the indexing hygiene checks on the flagged URLs and fix the canonical that bleeds to the 404 template. - Verify: [Search Console + Bing Importer](https://jwatte.com/tools/search-console-importer/). Standard: Google Search Console Page indexing status Alternate page with proper canonical tag. - [ ] **1.76 No GSC 'Discovered, currently not indexed' URLs** - Pass: No GSC row carries a discovered status. - Warn: Status matches /discovered/i (Search Console Importer). - Numbers and lists the tool uses: Status regex /discovered/i; first 8 URLs listed (Search Console Importer). - Why: Google chose not to crawl these, usually because of thin content or too few internal links. - Fix: Increase internal links to the page and deepen its content, then request indexing via URL Inspection. - Verify: [Search Console + Bing Importer](https://jwatte.com/tools/search-console-importer/). Standard: Google Search Console Page indexing status Discovered, currently not indexed. - [ ] **1.77 No GSC 'Crawled, currently not indexed' URLs** - Pass: No GSC row carries a crawled-not-indexed status. - Warn: Status matches /crawled/i (Search Console Importer). - Numbers and lists the tool uses: Status regex /crawled/i, excluding alternate page and discovered; first 8 URLs listed (Search Console Importer). - Why: Google crawled the page and judged it not worth indexing, a quality signal; a burst of new pages can also trip a velocity throttle that clears gradually. - Fix: Improve the page's E-E-A-T (schema, sameAs, author entity), content depth and freshness. - Verify: [Search Console + Bing Importer](https://jwatte.com/tools/search-console-importer/). Standard: Google Search Console Page indexing status Crawled, currently not indexed. - [ ] **1.78 No GSC 'Duplicate without user-selected canonical' URLs** - Pass: No GSC row carries a duplicate status. - Warn: Status matches /duplicate/i (Search Console Importer). - Numbers and lists the tool uses: Status regex /duplicate/i; first 8 URLs listed (Search Console Importer). - Why: Google found a different canonical for the page than the one you meant. - Fix: Set an explicit self-referencing `` on the URL that should be the primary version. - Verify: [Search Console + Bing Importer](https://jwatte.com/tools/search-console-importer/). Standard: Google Search Console Page indexing status Duplicate without user-selected canonical. - [ ] **1.79 No GSC 'Not found (404)' URLs** - Pass: No GSC row carries a not-found status. - Fail: Status matches /not found/i (Search Console Importer). - Numbers and lists the tool uses: Status regex /not found|server error/i classifies as fail; first 8 URLs listed (Search Console Importer). - Why: Google keeps requesting URLs that no longer exist, usually because the sitemap or internal links still reference them. - Fix: Restore the page or remove the URL from the sitemap and internal links. - Verify: [Search Console + Bing Importer](https://jwatte.com/tools/search-console-importer/). Standard: Google Search Console Page indexing status Not found (404). - [ ] **1.80 No GSC 'Server error (5xx)' URLs** - Pass: No GSC row carries a server-error status. - Fail: Status matches /server error/i (Search Console Importer). - Numbers and lists the tool uses: Status regex /not found|server error/i classifies as fail; first 8 URLs listed (Search Console Importer). - Why: Server errors stop indexing entirely and, if persistent, cause Google to drop the URLs. - Fix: Fix the origin error so the URL returns 200, then request re-indexing. - Verify: [Search Console + Bing Importer](https://jwatte.com/tools/search-console-importer/). Standard: Google Search Console Page indexing status Server error (5xx). - [ ] **1.81 No GSC 'Page with redirect' URLs beyond www/https canonicalization** - Pass: Every redirect-status GSC row shares the sitemap hostname after stripping www, so it is reported as an expected canonical redirect (Search Console Importer). - Warn: A redirect-status GSC row is on a hostname that does not match the sitemap hostname after stripping www, or its URL cannot be parsed (Search Console Importer). - Numbers and lists the tool uses: Status regex /page with redirect|redirect error/i; hostname compared after .replace(/^www\./, '') against the sitemap URL hostname; path and protocol are not compared; first 8 URLs listed (Search Console Importer). - Why: These redirects are not standard domain canonicalization, so each one is a link or sitemap entry pointing at a stale URL. - Fix: Trace the full hop path for each URL, confirm it ends at a live 200 page, and rewrite the sources that point at the old URL. - Verify: [Search Console + Bing Importer](https://jwatte.com/tools/search-console-importer/). Standard: Google Search Console Page indexing status Page with redirect. - [ ] **1.82 URL structure migration risk** - Pass: URL structure is simple (no query parameters or date paths in internal links), so a migration needs few redirects. - Warn: Medium risk: WordPress or complex URL patterns (Migration Analyzer). - Fail: High risk: e-commerce URL structures (Migration Analyzer). - Numbers and lists the tool uses: Complex = query parameter or /YYYY/MM/ in internal links; scores low 90, WordPress 65, complex 60, WordPress plus complex 55, e-commerce 30 (Migration Analyzer). - Why: The more URL patterns a site has, the more redirect mapping a migration needs to avoid losing rankings. - Fix: Build a comprehensive one-to-one redirect map before migrating, and simplify URL patterns where possible. - Verify: [Migration Analyzer](https://jwatte.com/tools/migration-analyzer/). - [ ] **1.83 Homepage is a public marketing surface, not a login wall** - Pass: The homepage exposes public marketing content rather than only an auth form. - Fail: The homepage is essentially a log-in or sign-up form with few visible words, few links and no schema. - Numbers and lists the tool uses: Gate (all required): URL path is / or empty; auth form = an ``, or sign-up wording (sign up, create account, get started) plus log-in wording (log in, sign in, forgot password) with a `

` present; visible word count under 180; 6 or fewer links; no marketing-link keyword in the HTML (pricing, feature, how it works, use case, customer, testimonial, about, our story, blog, docs, documentation, contact); vertical override keys login-wall, app-shell, pre-marketing can force the gate; reported fields visible word count, link count, schema present or absent (Mega Analyzer). - Why: When the front door is an auth wall, search engines and AI assistants have nothing to read, index or cite, and every other fix has nowhere to attach. - Fix: Put a real marketing site in front of the app (home, how it works, features, pricing, FAQ, about, contact, privacy, terms) and keep the app behind /app or app.``, with Organization, SoftwareApplication and WebSite schema on the new home page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org Organization, SoftwareApplication, WebSite; Open Graph; SPF / DKIM / DMARC; HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy; WAI-ARIA role=alert; FTC 16 CFR Part 465. - [ ] **1.84 www and http redirects reported by GSC are expected canonicalization** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: Start and final share the same www-stripped hostname and pathname and differ only by www or http-to-https (Redirect Chain Audit); GSC redirect rows whose host is a www/apex twin of the sitemap host, first 8 listed (Search Console Importer). - Why: GSC reports every redirecting URL as 'Page with redirect' even when the redirect is deliberate domain canonicalization. - Fix: No action needed; do not request Validate Fix for these, they settle as Google consolidates on the canonical URLs. - Verify: [Search Console + Bing Importer](https://jwatte.com/tools/search-console-importer/), [Redirect Chain Audit](https://jwatte.com/tools/redirect-chain-audit/). Standard: Google Search Console Page indexing status Page with redirect. - [ ] **1.85 Pages present in both the crawl and the sitemap** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: Matched = reached by the crawl from the home page and listed in the sitemap (Index Coverage Delta); inBoth = crawled URLs intersect sitemap URLs (Link Graph). - Why: The overlap count is the healthy baseline against which orphans and unlinked sitemap entries are measured. - Verify: [Index Coverage Delta](https://jwatte.com/tools/index-coverage-delta/), [Link Graph](https://jwatte.com/tools/link-graph/). - [ ] **1.86 Internal link topology: hubs, mid pages and average in-links** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: Hub = in-degree 3 or more; mid = in-degree 1 to 2; orphan = 0; average in-links = sum of in-degree divided by page count (Link Graph). - Why: Hubs concentrate authority, so they are the best source pages when you add links to orphans. - Fix: Use hub pages as the source for new internal links and avoid single-hub dependency or clusters deeper than 3 clicks. - Verify: [Link Graph](https://jwatte.com/tools/link-graph/). - [ ] **1.87 X-Robots-Tag header presence** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: Info row when neither x-robots-tag nor X-Robots-Tag header is present (AI Posture Audit). - Why: The header is optional and site-wide; meta robots covers per-page rules. - Fix: Only add it if you want to enforce indexing rules at the server or CDN layer. - Verify: [AI Posture Audit](https://jwatte.com/tools/ai-posture-audit/). Standard: Google X-Robots-Tag. - [ ] **1.88 404 template carries `` when the host cannot send a real 404** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: Regex /]*http-equiv=["']Status["'][^>]*content=["'][^"']*404/i; only evaluated when the probe status is not 404 (Analyzer, Indexing Hygiene Checks). - Why: Some hosts cannot send an HTTP 404 status, and the meta tag is a fallback signal for those. - Fix: Add `` to the 404 template body. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **1.89 Feed file served at /feed.xml or /feed.json** - Pass: Feed.xml (Atom or RSS) or feed.json is served at the site root (Analyzer); absence is reported as an info row, not a failure. - Numbers and lists the tool uses: Paths /feed.xml and /feed.json (Analyzer); Atom /feed.xml with self link and JSON Feed /feed.json 1.1 (Single-Site Generator). - Why: A feed at the standard root path is found even by readers that never parse the HTML head. - Fix: Serve the feed at /feed.xml (Atom or RSS) and /feed.json, or check whether it lives at /feed/, /rss/ or /blog/feed.xml and link that path instead. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/). Standard: JSON Feed 1.1, Atom. - [ ] **1.90 Google Search Console registered and reviewed (manual)** - Pass: Informational; reported, not scored. - Why: Search Console is where indexing coverage and structured data errors are reported. - Fix: Confirm the site is registered at search.google.com/search-console, that all pages are indexed, and review structured data errors under Enhancements. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **1.91 ABANDONED-SITE FINGERPRINTS: Detected: ``** - Pass: No IE-era polyfills or outdated libraries are detected. - Fail: One or more fingerprints are detected; the crawl-validation check 'No abandoned-site tech fingerprints detected' fails at critical severity and the Cross-Validation Layer and the AI fix prompt list every fingerprint found. - Numbers and lists the tool uses: fingerprints: html5shiv (/html5shiv|html5shim/i), selectivizr (/selectivizr/i), respond.js (/respond\.min\.js|respond\.js/i), IE conditional comments (//i; the next 400 characters must match /]+application\/ld\+json/i (Mega Analyzer, FAQ Schema Parity). - Why: A template marker left in the source without a real block is the most common cause of 'zero schema, N visible FAQs', so the visible FAQs have no rich-result eligibility. - Fix: Insert a populated FAQPage JSON-LD block immediately after the comment, or remove the comment. - Verify: [FAQ Schema Parity](https://jwatte.com/tools/faq-schema-parity/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: Google FAQPage structured data. - [ ] **3.70 FAQPage: mainEntity.length = `` (needs >= 2)** - Pass: The FAQPage has a mainEntity array of at least two Question nodes, each with name and acceptedAnswer.text. - Warn: The FAQPage has fewer than two Question nodes (Mega SEO Analyzer). - Fail: MainEntity is missing, a Question lacks name or acceptedAnswer, or the array has fewer than two entries. - Numbers and lists the tool uses: required mainEntity on FAQPage; required name, acceptedAnswer on Question (Schema Validator); mainEntity[].name and mainEntity[].acceptedAnswer.text on the first element, minItems 2, null or empty string counts as missing (Rich Results Eligibility Audit); count /"@type"\s*:\s*"Question"/g, minimum 2 (Mega SEO Analyzer); FAQPage >= 4 questions (Site Migration Gen); Schema Fix Bundle preset emits 3 Question placeholders. - Why: FAQ rich results are built from the mainEntity Question array and Google filters thin or placeholder FAQs silently. - Fix: Write mainEntity as an array of Question {name, acceptedAnswer {@type Answer, text}} with real prose answers, at least two questions. - Verify: [Schema Validator](https://jwatte.com/tools/schema-validator/), [Rich Results Eligibility Audit](https://jwatte.com/tools/rich-results-eligibility-audit/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [Schema Fix Bundle](https://jwatte.com/tools/schema-fix-bundle/) and 1 more. Standard: Google FAQPage structured data; schema.org FAQPage, Question, Answer. - [ ] **3.71 Ghost schema entries detected / Schema-only questions (``)** - Pass: Every Question in the FAQPage schema also appears as a visible question on the page. - Warn: One or more schema Questions are not found in the visible copy. - Numbers and lists the tool uses: match key = normalized question (curly quotes to straight, lowercase, non-alphanumerics to spaces, whitespace collapsed); Question nodes found anywhere in any block where @type matches /\bQuestion\b/, question = name or text, answer = acceptedAnswer or suggestedAnswer text with tags stripped (FAQ Schema Parity). - Why: Google treats schema-only questions as mismatched content and may suppress the entire FAQPage rich result. - Fix: For each schema-only question either add a matching visible block to the page or remove the schema entry. - Verify: [FAQ Schema Parity](https://jwatte.com/tools/faq-schema-parity/). Standard: Google FAQPage content policy. - [ ] **3.72 Incomplete schema coverage / Visible-only questions (``)** - Pass: Every visible FAQ is present in the FAQPage schema with no ghost entries and no material answer drift (parity clean). - Warn: One or more visible questions have no matching schema Question. - Numbers and lists the tool uses: visible-only = visible question with no normalized match in schema; up to 30 listed (FAQ Schema Parity). - Why: Every FAQ left out of JSON-LD forfeits People Also Ask, AI Overview and answer-engine citation eligibility. - Fix: Add each visible-only question to the FAQPage mainEntity using the visible answer text. - Verify: [FAQ Schema Parity](https://jwatte.com/tools/faq-schema-parity/). Standard: Google FAQPage structured data. - [ ] **3.73 Answer-text drift / drift ``%** - Pass: Every matched question's schema answer stays within 30% token drift of the visible answer. - Warn: A matched question's schema answer diverges from the visible answer by more than 30%. - Numbers and lists the tool uses: drift = 1 - (shared tokens / max token-set size) over normalized words longer than 2 characters; flagged when > 0.3; answers shown truncated to 600 characters; up to 15 drifted questions listed; no HTML inside schema answer text except , `

`, `

` (needs >= 2)** - Pass: The HowTo has name and a step array of at least two HowToStep entries plus totalTime and image. - Warn: TotalTime or image is missing (Schema Validator). - Fail: Name or step is missing, or fewer than two steps. - Numbers and lists the tool uses: required name, step; recommended totalTime, image (Schema Validator); required name, step, minItems 2; recommended image, totalTime, tool, supply, estimatedCost (Rich Results Eligibility Audit); Schema Fix Bundle preset totalTime PT30M with 2 steps each with text, image and url. - Why: HowTo rich results need the step array, and totalTime and image enrich the card. - Fix: Add at least two HowToStep entries with text and image, plus totalTime, tool, supply and estimatedCost when honest. - Verify: [Schema Validator](https://jwatte.com/tools/schema-validator/), [Rich Results Eligibility Audit](https://jwatte.com/tools/rich-results-eligibility-audit/), [Schema Fix Bundle](https://jwatte.com/tools/schema-fix-bundle/). Standard: Google HowTo structured data; schema.org HowTo, HowToStep. - [ ] **3.76 @type: Recipe, ``** - Pass: The Recipe has name, image, recipeIngredient and recipeInstructions plus author, timing, yield, nutrition and rating. - Warn: A recommended field (image, author, prepTime, cookTime and so on) is missing (Schema Validator). - Fail: Name, recipeIngredient or recipeInstructions is missing (Schema Validator), or name, image, recipeIngredient or recipeInstructions is missing (Rich Results Eligibility Audit). - Numbers and lists the tool uses: required name, recipeIngredient, recipeInstructions; recommended image, author, prepTime, cookTime (Schema Validator); required name, image, recipeIngredient, recipeInstructions; recommended author, datePublished, prepTime, cookTime, totalTime, recipeYield, nutrition, aggregateRating (Rich Results Eligibility Audit); Schema Fix Bundle preset prepTime PT15M, cookTime PT30M, totalTime PT45M, HowToStep instructions. - Why: Recipe cards require ingredients and instructions. - Fix: Add the missing field; pull ingredients and steps from the visible content and add timing, yield, nutrition and rating when honest. - Verify: [Schema Validator](https://jwatte.com/tools/schema-validator/), [Rich Results Eligibility Audit](https://jwatte.com/tools/rich-results-eligibility-audit/), [Schema Fix Bundle](https://jwatte.com/tools/schema-fix-bundle/). Standard: Google Recipe structured data; schema.org Recipe. - [ ] **3.77 Event schema present** - Pass: Event pages carry an Event node. - Warn: Event is absent (Mega Analyzer info). - Fail: An events, webinar, CLE or seminar page has no Event node (Mega Analyzer legal module); no Event, VideoObject or DefinedTerm type (batch-analyzer). - Numbers and lists the tool uses: types /^Event$|BusinessEvent|EducationEvent|Webinar/i on paths /\/(events?|webinars?|cle|seminars?|programs?)(\/|$)/ (Mega Analyzer legal module); Event, VideoObject or DefinedTerm (batch-analyzer weight 4). - Why: Event markup earns the event carousel and events are high-intent content. - Fix: Emit Event with startDate, eventAttendanceMode, location, organizer pointing at the firm @id and performer pointing at speaker bios. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/). Standard: schema.org Event. - [ ] **3.78 @type: Event, ``** - Pass: The Event has name, startDate and location plus endDate, image, description, offers, performer and organizer. - Warn: A recommended field (endDate, image, description, offers) is missing. - Fail: Name, startDate or location is missing. - Numbers and lists the tool uses: required name, startDate, location; recommended endDate, image, description, offers (Schema Validator), plus performer, organizer (Rich Results Eligibility Audit); Schema Fix Bundle preset eventAttendanceMode OfflineEventAttendanceMode, eventStatus EventScheduled, ISO 8601 datetimes with offset. - Why: Event rich results are gated on name, start date and location. - Fix: Add the missing field with real ISO 8601 datetimes including offset, the venue address and the real ticket price. - Verify: [Schema Validator](https://jwatte.com/tools/schema-validator/), [Rich Results Eligibility Audit](https://jwatte.com/tools/rich-results-eligibility-audit/), [Schema Fix Bundle](https://jwatte.com/tools/schema-fix-bundle/). Standard: Google Event structured data; schema.org Event. - [ ] **3.79 VideoObject schema present** - Pass: Pages with video or podcast content carry a VideoObject (or PodcastEpisode, AudioObject, MediaObject) node. - Warn: VideoObject is absent (Mega Analyzer info). - Fail: A podcast, video or media page has no media schema (Mega Analyzer legal module). - Numbers and lists the tool uses: types /VideoObject|PodcastEpisode|PodcastSeries|AudioObject|MediaObject/i on paths /\/(podcasts?|videos?|media|multimedia)(\/|$)/ (Mega Analyzer legal module); 'VideoObject' in types (Mega Analyzer info); Event, VideoObject or DefinedTerm (batch-analyzer weight 4). - Why: Video markup earns the video thumbnail and makes multimedia content citable; without it plus a transcript the content is invisible. - Fix: Add VideoObject or PodcastEpisode schema and publish a searchable transcript. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/). Standard: schema.org VideoObject. - [ ] **3.80 VideoObject schema has required fields** - Pass: The VideoObject has name, thumbnailUrl and uploadDate plus description, duration and contentUrl or embedUrl. - Warn: A recommended or required video field is missing (Mega Analyzer warns). - Fail: Name, thumbnailUrl or uploadDate is missing (Schema Validator), or name, description, thumbnailUrl or uploadDate is missing (Rich Results Eligibility Audit). - Numbers and lists the tool uses: required name, thumbnailUrl, uploadDate; recommended description, duration, contentUrl (Schema Validator); required name, description, thumbnailUrl, uploadDate; recommended duration, contentUrl, embedUrl, interactionStatistic (Rich Results Eligibility Audit); thumbnailUrl, uploadDate, duration, contentUrl or embedUrl on the first VideoObject (Mega Analyzer); Schema Fix Bundle preset duration PT3M30S. - Why: Google requires a thumbnail and an upload date for video rich results. - Fix: Add the missing fields, with either contentUrl or embedUrl. - Verify: [Schema Validator](https://jwatte.com/tools/schema-validator/), [Rich Results Eligibility Audit](https://jwatte.com/tools/rich-results-eligibility-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Schema Fix Bundle](https://jwatte.com/tools/schema-fix-bundle/). Standard: Google Video structured data; schema.org VideoObject. - [ ] **3.81 ImageObject IPTC rights fields** - Pass: Every ImageObject carries contentUrl plus copyrightNotice, license, acquireLicensePage, creditText and caption. - Warn: A rights field is missing (Mega Analyzer info, WCAG audit, Schema Validator). - Fail: ContentUrl is missing (Schema Validator). - Numbers and lists the tool uses: required contentUrl; recommended caption, license, creditText, copyrightNotice, acquireLicensePage, creator (Schema Validator); fields copyrightNotice, license, acquireLicensePage, creditText; ImageObject detected when the joined @type matches /\bImageObject\b/ (Mega Analyzer) or /ImageObject/ (WCAG Accessibility Audit). - Why: Search Console reports these as non-critical Image Metadata issues, but they block the Licensable badge in Google Images. - Fix: Add copyrightNotice, a license URL, acquireLicensePage and creditText to each ImageObject. - Verify: [Schema Validator](https://jwatte.com/tools/schema-validator/), [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: Google Image Metadata structured data; IPTC photo metadata; schema.org ImageObject. - [ ] **3.82 creator is a typed object, not a bare string** - Pass: ImageObject.creator is a Person or Organization object with @type and name. - Warn: WCAG Accessibility Audit counts an invalid creator type inside its warn-level Image rights fields missing check. - Fail: Creator is a plain string. - Numbers and lists the tool uses: typeof node.creator === 'string' on an ImageObject node (Schema Validator, Mega Analyzer, WCAG Accessibility Audit). - Why: Search Console flags 'Invalid object type for field creator' for a bare string. - Fix: Replace the string with {"@type":"Person","name":"..."} or an Organization object. - Verify: [Schema Validator](https://jwatte.com/tools/schema-validator/), [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: Google Search Console Image Metadata validation; schema.org ImageObject creator. - [ ] **3.83 Book schema (for book/author pages only)** - Pass: Book and author pages carry a Book node with isbn, author, publisher and datePublished, one per title. - Warn: Book is absent (Mega Analyzer, analyzer and E-E-A-T Analyzer report it as info). - Numbers and lists the tool uses: 'Book' in types (analyzer, Mega Analyzer); /^book$/i (E-E-A-T Analyzer); two or more book-typed nodes signal a body of work (E-E-A-T Analyzer, /book/i, pass >= 2); Book, Product, Service or Offer (batch-analyzer weight 5); Schema Fix Bundle preset requires name, author, isbn, bookFormat (default Paperback). - Why: Book schema signals a published author and can earn the book carousel and author attribution. - Fix: Declare a Book node per publication with name, isbn, bookFormat, author @id, publisher, datePublished and image. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/) and 1 more. Standard: schema.org Book. - [ ] **3.84 Course: all required fields present (has 3)** - Pass: The Course has name, description and provider plus offers and hasCourseInstance. - Fail: Name, description or provider is missing. - Numbers and lists the tool uses: required name, description, provider; recommended offers, hasCourseInstance (Rich Results Eligibility Audit); Schema Fix Bundle preset CourseInstance courseMode Online, endDate today + 30 days, offers.category Paid. - Why: The course carousel requires name, description and provider. - Fix: Add the missing field; add offers and hasCourseInstance with real dates and price. - Verify: [Rich Results Eligibility Audit](https://jwatte.com/tools/rich-results-eligibility-audit/), [Schema Fix Bundle](https://jwatte.com/tools/schema-fix-bundle/). Standard: Google Course structured data; schema.org Course, CourseInstance. - [ ] **3.85 JobPosting: all required fields present (has 5)** - Pass: The JobPosting has title, description, datePosted, hiringOrganization and jobLocation plus baseSalary, employmentType and validThrough. - Fail: Any of the five core fields is missing. - Numbers and lists the tool uses: required title, description, datePosted, hiringOrganization, jobLocation; recommended baseSalary, employmentType, validThrough (Rich Results Eligibility Audit); Schema Fix Bundle preset validThrough today + 45 days, employmentType FULL_TIME, salary unitText YEAR. - Why: The Google Jobs rich result requires the five core fields. - Fix: Add the missing field; set validThrough to the real closing date and include a salary range. - Verify: [Rich Results Eligibility Audit](https://jwatte.com/tools/rich-results-eligibility-audit/), [Schema Fix Bundle](https://jwatte.com/tools/schema-fix-bundle/). Standard: Google Job Posting structured data; schema.org JobPosting. - [ ] **3.86 Preset: SoftwareApplication** - Pass: The SoftwareApplication node has name, operatingSystem, applicationCategory, offers and, when real, aggregateRating. - Numbers and lists the tool uses: required name, operatingSystem, applicationCategory, offers, aggregateRating; applicationCategory default BusinessApplication (Schema Fix Bundle preset). - Why: Software rich results and AI recommendations read the app's platform, category and price from this node. - Fix: Fill operatingSystem, applicationCategory, offers and screenshot from the app listing; add aggregateRating only from reviews collected and shown on your own page, not copied from an app store. - Verify: [Schema Fix Bundle](https://jwatte.com/tools/schema-fix-bundle/). Standard: Google Software App structured data; schema.org SoftwareApplication. - [ ] **3.87 DefinedTerm schema present** - Pass: Glossary or jargon pages carry DefinedTerm nodes. - Warn: DefinedTerm is absent (Mega Analyzer info). - Numbers and lists the tool uses: DefinedTerm in types (Mega Analyzer; batch-analyzer counts Event, VideoObject or DefinedTerm, weight 4). - Why: DefinedTerm lets engines resolve your jargon to a definition. - Fix: Add DefinedTerm nodes for glossary entries. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/). Standard: schema.org DefinedTerm. - [ ] **3.88 Schema Types Competitors Use (That You Don't)** - Pass: Every schema type used by a competitor page is also present on your page. - Fail: A competitor uses a schema type that your page lacks. - Numbers and lists the tool uses: types read from top level and @graph of every JSON-LD block; rich-result hint map: FAQPage FAQ accordion, HowTo step card, Recipe carousel, Article and NewsArticle Top Stories, BlogPosting Discover, Product snippet, Review stars, AggregateRating stars, VideoObject carousel, BreadcrumbList navigation, Organization Knowledge Panel, Person author entity, LocalBusiness local pack, Book carousel, Course, Event, JobPosting, Speakable, WebSite sitelinks searchbox (Keyword Inspection); five presence tests /"@type"\s*:\s*"Organization"/i, /"@type"\s*:\s*"BreadcrumbList"/i, /"@type"\s*:\s*"(Article|BlogPosting|Product|LocalBusiness)"/i, /"sameAs"\s*:/i, /"author"\s*:/i scored as percent of 5 (Competitor Gap Matrix); per-site type matrix rendered with 2 or more results (Batch Analyzer). - Why: Every schema type is a chance at a rich result, and a type several competitors carry is a gap worth closing. - Fix: Add JSON-LD for each missing type using your own page content, starting with Organization, BreadcrumbList, the content type, sameAs and author. - Verify: [Keyword Inspection](https://jwatte.com/tools/keyword-inspection/), [Competitor Gap Matrix](https://jwatte.com/tools/competitor-gap-matrix/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/). Standard: schema.org. - [ ] **3.89 Schema portability: ``** - Pass: The site's schema types port cleanly to the new platform. - Warn: Types that need a rewrite on migration are present (Product, Offer, Event, Recipe, FAQPage, HowTo). - Fail: No structured data is present, so migration is the time to add it. - Numbers and lists the tool uses: needs-rewrite types Product, Offer, Event, Recipe, FAQPage, HowTo (Migration Analyzer). - Why: Platform-generated schema does not survive a migration untouched. - Fix: Port every JSON-LD block to the new templates and rebuild the platform-specific types. - Verify: [Migration Analyzer](https://jwatte.com/tools/migration-analyzer/). Standard: schema.org. - [ ] **3.90 JSON-LD blocks: `` · schema nodes: ``** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: counts of parseable blocks and typed nodes (Rich Results Eligibility Audit); node count per @type, array types joined with +, untyped shown as (untyped), raw blocks shown truncated to 5000 characters (Schema Graph Visualizer); types with no validation rules listed for manual review: anything outside Article, NewsArticle, BlogPosting, Person, Organization, WebSite, WebPage, BreadcrumbList, FAQPage, Question, HowTo, Recipe, Product, Offer, AggregateOffer, OfferShippingDetails, MerchantReturnPolicy, Review, AggregateRating, LocalBusiness, Event, VideoObject, ImageObject, Speakable, SpeakableSpecification (Schema Validator) or outside the rich-result template list (Rich Results Eligibility Audit). - Why: A baseline inventory of blocks, nodes and types shows what is on the page before any per-type check runs. - Fix: Review any type with no validation rules manually against Google's documentation for that type. - Verify: [Rich Results Eligibility Audit](https://jwatte.com/tools/rich-results-eligibility-audit/), [JSON-LD Schema Graph Visualizer](https://jwatte.com/tools/schema-graph-visualizer/), [Schema Validator](https://jwatte.com/tools/schema-validator/). - [ ] **3.91 Schema changes** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: set difference of deduplicated @type lists between two snapshots of the URL (Content Velocity). - Why: A change in schema types shows when a competitor starts or stops targeting a rich result. - Fix: Review added and removed types on your own pages after each deploy. - Verify: [Content Velocity](https://jwatte.com/tools/content-velocity/). Standard: schema.org. - [ ] **3.92 Manual: Test with Google Rich Results** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: https://search.google.com/test/rich-results; https://validator.schema.org/; https://search.google.com/search-console (E-E-A-T Generator, analyzer). - Why: Schema must validate to earn rich results, and the test shows which rich result types the page is eligible for. - Fix: Paste the URL into the Rich Results Test and the Schema.org Validator after every schema change. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [E-E-A-T Generator](https://jwatte.com/tools/eeat-generator/). Standard: Google Rich Results Test. - [ ] **3.93 Update schema when business details change** - Pass: Informational; reported, not scored. - Why: Schema must stay consistent with the name, address and phone shown on every platform. - Fix: Regenerate and re-publish the JSON-LD whenever the name, address, phone, ratings or profile URLs change. - Verify: [E-E-A-T Generator](https://jwatte.com/tools/eeat-generator/). ## 4. Answer engines Answer engines quote passages, not pages. This section is what makes a paragraph quotable: question-shaped headings, definition-first openings, FAQ entries that match the visible text word for word, and the markup that marks a passage as speakable. **Verify this section with:** [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Site Analyzer](https://jwatte.com/tools/analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [Competitor Gap Matrix](https://jwatte.com/tools/competitor-gap-matrix/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/), [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/), [FAQ Schema Parity](https://jwatte.com/tools/faq-schema-parity/), [FAQ Extractability](https://jwatte.com/tools/faq-answer-extractability/), [FAQ Harvester](https://jwatte.com/tools/faq-harvester/), [Apple Business](https://jwatte.com/tools/apple-business-audit/), [SGE Readiness Audit](https://jwatte.com/tools/sge-readiness-audit/), [Mega AEO Analyzer](https://jwatte.com/tools/mega-aeo-analyzer/), [Mega Batch](https://jwatte.com/tools/mega-batch/), [Schema Validator](https://jwatte.com/tools/schema-validator/), [Rich Results Eligibility Audit](https://jwatte.com/tools/rich-results-eligibility-audit/), [Speakable Gen.](https://jwatte.com/tools/speakable-generator/), [Featured-Snippet Extractability Audit](https://jwatte.com/tools/featured-snippet-extractability/), [E-E-A-T Generator](https://jwatte.com/tools/eeat-generator/), [SERP Features](https://jwatte.com/tools/serp-features/). - [ ] **4.1 robots meta: max-snippet:-1** - Pass: The page's meta robots tag includes max-snippet:-1. - Warn: The directive is missing, reported as a warning by analyzer and by the mega-analyzer verdict layer. - Numbers and lists the tool uses: Regex /max-snippet:\s*-1/ on the lowercased meta robots content (mega-analyzer, analyzer); /max-snippet:\s*-1/i, weight 8 in both the SEO and AEO buckets (batch-analyzer); without -1 Google caps snippets at 160 characters (mega-analyzer, analyzer). - Why: Without max-snippet:-1 Google caps your snippet at about 160 characters, which cuts off the full answers AI answer boxes want to quote. - Fix: Add `` to the head of every page. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/). Standard: Google robots meta tag documentation. - [ ] **4.2 robots meta: max-image-preview:large** - Pass: The meta robots tag includes max-image-preview:large. - Warn: The directive is missing, reported as a warning by analyzer. - Numbers and lists the tool uses: Regex /max-image-preview:\s*large/ on the lowercased meta robots content (mega-analyzer, analyzer); /max-image-preview:\s*large/i, weight 5 (batch-analyzer). - Why: This directive lets Google and AI engines show a large image thumbnail next to your result instead of a tiny one. - Fix: Pair max-image-preview:large with max-snippet:-1 in the same meta robots tag. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/). Standard: Google robots meta tag documentation. - [ ] **4.3 Server-rendered HTML has content (not a blank SPA shell)** - Pass: The raw HTML has no known SPA mount div, or it has one but the body also renders an H1 and at least 150 words. - Warn: The fetched HTML is a bot-challenge page, so its word count proves nothing; mega-analyzer reports 'Cannot verify server-rendered content' as a warning instead of a verdict. - Fail: A known SPA mount div is present and the raw body has fewer than 150 words or no H1; critical in mega-analyzer, fail in analyzer. - Numbers and lists the tool uses: SPA mount ids: root, app, __next, __nuxt, __svelte, gatsby-focus-wrapper, ___gatsby, __remix; mega-analyzer: shell = mount present and not (h1 count > 0 and wordCount >= 150), severity critical; analyzer: shell = mount present and (h1 count 0 or wordCount < 150), severity fail; mega-analyzer bot-challenge guard /Vercel Security Checkpoint|``Just a moment|challenges\.cloudflare\.com|Sorry, you have been blocked|Incapsula incident ID|aws-waf-token|Akamai bot manager|enable javascript and cookies to continue/i on the first 4000 chars of title plus body text downgrades the row to warn; AI crawlers named in the fix text: GPTBot, ClaudeBot, OAI-SearchBot (mega-analyzer), GPTBot, ClaudeBot, OAI-SearchBot, Googlebot (analyzer). - Why: AI crawlers read the raw HTML and do not run JavaScript, so a page that only renders in the browser is invisible to them no matter how good the content is. - Fix: Server-render or prerender the page so the content is in the HTML response, and do that before any content fix on a JavaScript-only site. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **4.4 JSON-LD blocks on page: `<n>`** - Pass: The page carries at least two application/ld+json blocks. - Warn: Exactly one JSON-LD block is present. - Fail: No JSON-LD block is present. - Numbers and lists the tool uses: Count of /application\/ld\+json/g matches in the HTML; pass >= 2, warn 1, fail 0 (mega-seo-analyzer); >= 2 blocks is one of four AEO tests (competitor-gap-matrix). - Why: AI retrievers and agent commerce surfaces read structured data density as a sign the page is machine-readable. - Fix: Publish at least two JSON-LD blocks, for example an Organization or LocalBusiness node plus a page-type node such as Article, FAQPage or Service. - Verify: [Competitor Gap Matrix](https://jwatte.com/tools/competitor-gap-matrix/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: schema.org JSON-LD. - [ ] **4.5 FAQPage schema present** - Pass: A JSON-LD node typed FAQPage is on the page when the page has question and answer content. - Numbers and lists the tool uses: schemaTypes includes 'FAQPage' (mega-analyzer); /FAQPage/i on the raw HTML, weight 12 in the AEO bucket (batch-analyzer); at least 4 Question/Answer pairs, or details/summary as the alternative (single-site-gen, site-migration-gen); FAQ sections with a clear Q&A format (analyzer site builder scaffold). - Why: FAQPage gives answer engines ready-made question and answer pairs and qualifies the page for FAQ rich results and People Also Ask. - Fix: Add a FAQPage JSON-LD block whose Question names and acceptedAnswer text mirror the visible FAQ on the page, with at least four pairs. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/) and 1 more. Standard: schema.org FAQPage. - [ ] **4.6 FAQ schema parity, all `<n>` visible Q(s) are in JSON-LD** - Pass: Every visible FAQ question has a matching FAQPage Question and there are no schema-only ghost entries. - Fail: Schema-only ghost entries exist, visible FAQs are missing from the schema, or the page has visible questions and zero in JSON-LD, which is often an empty FAQPage placeholder. - Numbers and lists the tool uses: Schema questions: nodes whose @type matches /\bQuestion\b/ with a name. Visible question sources (mega-analyzer): h2/h3/h4/h5 inside [itemtype*="FAQPage" i], [class*="faq" i], [id*="faq" i], section[aria-labelledby*="faq" i], [class*="accordion" i]; details > summary; dt; button[aria-expanded]; [class*="faq-question" i], [class*="accordion-button" i]; a visible question needs normalized length 8 to 250 and either a ? or a start of /^(what|how|when|why|where|who|which|can|do|does|is|are|should|will|may)\b/i and must not start with /^(ready|looking|need|want|tired|interested|curious|wondering|thinking)\b/i; normalization: curly quotes to straight, lowercase, non letter/number removed, whitespace collapsed. Visible question patterns (faq-schema-parity): details > summary; h2 to h5 containing ? and at most 300 chars with the following siblings or the aria-controls panel as the answer; dt with the following dd; button[aria-expanded] with its aria-controls panel; [class*=faq-question i].question.accordion-button with a sibling [class*=faq-answer i].answer.accordion-body.accordion-content; question length 5 to 400 chars and either contains ? or starts with what, how, when, why, where, who, which, can, do, does, is, are, should, will, may; dedupe on normalized text preferring the entry with answer text. Pass needs schemaOnly = 0, visibleOnly = 0 and schemaQs > 0. - Why: A mismatch between the schema and the visible FAQ is the most common silent reason Google suppresses the FAQ rich result, and ghost entries can suppress the whole result. - Fix: Make the FAQPage Question names match the visible FAQ text one to one, remove schema entries that have no visible question, and use standard FAQ markup (details/summary, question headings, dl, aria-expanded accordions) so the questions are detectable. - Verify: [FAQ Schema Parity](https://jwatte.com/tools/faq-schema-parity/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: Google FAQ rich result guidelines. - [ ] **4.7 FAQ content present in a recognizable markup pattern** - Pass: At least one question and answer pair on the page is found as FAQPage JSON-LD, a details/summary block, or a question heading followed by an answer block. - Numbers and lists the tool uses: faq-answer-extractability sources: JSON-LD objects whose @type is or contains 'Question' with name and acceptedAnswer.text; `<details>` with a `<summary>` plus non-summary child text; h2, h3, h4 whose text matches /\?\s*$/ followed by P, UL, OL siblings until the next h1 to h6; dedupe on the lowercased trimmed question. faq-harvester details method: summary text non-empty and under 200 chars, answer = the details body sliced to 500 chars; question-heading method: h2, h3, h4, dt, strong, b with text 6 to 200 chars that ends with ? or matches /^(?:how|what|why|can|is|are|do|does|should|when|where|which|who|will)\b/i, answer collected from the next P, UL, OL, DIV, DD siblings within 3 tries and under 500 chars, stopping at H2, H3, H4, DT. apple-business-audit: manual checkbox for Q&A content Siri can read. - Why: Answer engines, featured snippets and Siri can only quote a question and answer they can find, and custom widgets or JavaScript-only accordions hide the FAQ from them. - Fix: Publish FAQs as FAQPage JSON-LD plus visible details/summary blocks or question headings with the answer paragraph directly below, and keep accordion summaries under 200 characters. - Verify: [FAQ Extractability](https://jwatte.com/tools/faq-answer-extractability/), [FAQ Harvester](https://jwatte.com/tools/faq-harvester/), [Apple Business](https://jwatte.com/tools/apple-business-audit/). Standard: schema.org FAQPage, Question, Answer. - [ ] **4.8 HowTo schema (step-by-step content)** - Pass: Pages whose title or H1 describes a procedure carry HowTo JSON-LD. - Warn: The page is not procedural, so a missing HowTo is reported as optional information. - Fail: An editorial page with a how-to or step-by-step title has no HowTo schema. - Numbers and lists the tool uses: Procedural regex /\bhow\s+to\b|step[- ]by[- ]step|\bstep\s*\d/i on the title plus H1, gated on editorial context (mega-analyzer); /HowTo/i on the raw HTML, weight 8 (batch-analyzer); HowTo steps required by the scaffold (single-site-gen, site-migration-gen), how-to content with step-by-step structure (analyzer site builder). - Why: HowTo markup turns numbered instructions into a step-by-step rich result and gives answer engines the ordered steps. - Fix: Add HowTo JSON-LD with one HowToStep per numbered step, on procedural pages only. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/) and 1 more. Standard: schema.org HowTo. - [ ] **4.9 Speakable schema present** - Pass: A SpeakableSpecification node or a speakable property is present in the page's JSON-LD. - Warn: Missing on a non-editorial site is reported as optional information, and mega-aeo-analyzer scores the missing case 50 instead of 100. - Fail: An editorial page (Article-class type, content-hub path or RSS feed, and not a local-service type) has no speakable markup (mega-analyzer). - Numbers and lists the tool uses: schemaTypes includes 'SpeakableSpecification' or /speakable/i on the HTML (analyzer); /"@type"\s*:\s*"SpeakableSpecification"/i (mega-seo-analyzer); /SpeakableSpecification/i, info row excluded from the score denominator (sge-readiness-audit); /"@type":\s*"Speakable\w*"|"speakable"/i scored 100 present or 50 absent (mega-aeo-analyzer); /speakable/i, weight 10 in the GEO and AEO buckets and 6 in the Schema bucket (batch-analyzer); schemaTypes includes SpeakableSpecification, weight 8 (mega-batch); one of four AEO tests (competitor-gap-matrix); editorial gate (mega-analyzer): Article-class /^(Article|BlogPosting|NewsArticle|TechArticle|ScholarlyArticle|Newsletter|Periodical|Blog)$/ or hub paths blog, articles, insights, resources, learn, guides, news, posts, essays, stories, publications, reports, press, wire, notes, journal; the scaffold puts SpeakableSpecification on the hero and key answer paragraphs (single-site-gen). - Why: Speakable markup tells Google and voice assistants exactly which passages on the page are suitable to read aloud or quote. - Fix: Add a speakable property with a SpeakableSpecification and cssSelector to the WebPage or Article JSON-LD, pointing at the headline and the key answer paragraphs. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [SGE Readiness Audit](https://jwatte.com/tools/sge-readiness-audit/), [Competitor Gap Matrix](https://jwatte.com/tools/competitor-gap-matrix/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/) and 5 more. Standard: schema.org SpeakableSpecification; Google Speakable structured data. - [ ] **4.10 Speakable node names a cssSelector or xpath** - Pass: Each Speakable or SpeakableSpecification node has a cssSelector or an xpath (schema-validator); a node typed Speakable has cssSelector or xpath (rich-results-eligibility-audit). - Warn: Neither is set, and schema-validator reports both recommended fields as missing. - Fail: Neither cssSelector nor xpath is present, which rich-results-eligibility-audit counts as a missing required field. - Numbers and lists the tool uses: Required: cssSelector or xpath, either one satisfies, applied only to nodes whose first @type is Speakable (rich-results-eligibility-audit); recommended pair cssSelector, xpath on Speakable and SpeakableSpecification nodes, with both missing warnings dropped when either is set (schema-validator). - Why: Without a selector the speakable node points at nothing, so the assistant has no passage to read. - Fix: Add cssSelector (preferred) or xpath pointing at the speakable passage. - Verify: [Schema Validator](https://jwatte.com/tools/schema-validator/), [Rich Results Eligibility Audit](https://jwatte.com/tools/rich-results-eligibility-audit/). Standard: Google Speakable structured data; schema.org SpeakableSpecification. - [ ] **4.11 SpeakableSpecification has invalid selector(s) (`<n>`)** - Pass: Every speakable cssSelector points at a visible body element that exists, and no xpath uses the class word-boundary pattern. - Fail: A cssSelector targets meta, link, title or head, a class selector matches no element on the page, or an xpath uses contains(concat(' ', normalize-space(@class), ' ')...). - Numbers and lists the tool uses: Head selectors /^meta\b|^link\b|^title\b|^head\b/i; class selector /^\.([\w-]+)$/ with no matching element in the DOM; xpath /contains\s*$\s*concat\s*\(\s*'\s*'\s*,\s*normalize-space\s*\(\s*@class\s*$/ (mega-analyzer). - Why: Speakable needs visible body content, and Google's validator mangles the XPath word-boundary pattern into phantom tokens and reports no matches. - Fix: Point cssSelector at visible body elements that exist on the page, use plain tag or class selectors, and drop xpath entirely. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: Google Speakable structured data. - [ ] **4.12 Speakable candidate: heading with a direct-answer paragraph** - Pass: The H1 is always a recommended candidate; an H2 or H3 is recommended when the first paragraph after it is 60 to 320 characters. - Warn: An H2 or H3 with no following paragraph, or one shorter than 60 or longer than 320 characters, is shown as info and left unchecked, so only the heading would be marked. - Numbers and lists the tool uses: Headings h1, h2, h3 with text length >= 6; paragraph = first following sibling P, scan stops at UL, OL or H1 to H6; recommended (pre-checked, rendered as pass) when the tag is H1 or the paragraph is 60 to 320 chars, otherwise rendered as info; heading selector '#'+id, else tag+'.'+first class, else tag; paragraph selector '#'+id, else 'p.'+first class, else heading selector+' + p' (speakable-generator). - Why: A speakable selector that lands on a heading alone gives the assistant nothing to read, the answer paragraph is what gets spoken. - Fix: Put a 60 to 320 character direct-answer paragraph right after each heading you want a voice assistant to read. - Verify: [Speakable Gen.](https://jwatte.com/tools/speakable-generator/). Standard: schema.org SpeakableSpecification. - [ ] **4.13 Site identity extractable for AI citation (`<n>`/4 signals)** - Pass: At least two of four sources state who the site is and what it does: a JSON-LD description, a non-generic meta description, a distinct og:description, and a definitional first paragraph. - Warn: Fewer than two of the four signals are present. - Numbers and lists the tool uses: Signal 1: Organization, WebSite, Person or LocalBusiness JSON-LD description >= 40 chars; signal 2: meta description >= 50 chars and not /^(welcome to|home page|official website|site of)/i; signal 3: og:description >= 50 chars and different from the meta description; signal 4: first `<p>` longer than 50 chars with >= 12 words matching /\b(is|are|helps?|provides?|builds?|writes?|covers?|sells?|offers?|teaches?|hosts?|makes?)\b/i; pass needs 2 of 4 (mega-analyzer, analyzer). - Why: An AI model needs a clear sentence it can quote when someone asks what your business is, and it prefers sites that state that plainly. - Fix: Write a first paragraph that says 'X is a Y that does Z' and put a matching description in the meta description, og:description and JSON-LD. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **4.14 Meta description reads as a direct answer** - Pass: The meta description is longer than 50 characters and opens with a definitional phrase. - Numbers and lists the tool uses: Length > 50 and /^(a |the |an |it is|we |this |how |what |why )/i, weight 8 in the AEO bucket (batch-analyzer). - Why: Answer engines lift the description as a candidate answer, so one that opens with a direct statement gets quoted more often than a slogan. - Fix: Rewrite the description to open with a direct definitional sentence such as 'The X is ...' or 'We ...'. - Verify: [Batch Compare](https://jwatte.com/tools/batch-analyzer/). - [ ] **4.15 Definition pattern in the first paragraph** - Pass: The first substantial paragraph opens with a definitional sentence such as 'X is', 'X refers to' or 'X means'. - Warn: No definitional sentence is found, reported as a warning by the mega-analyzer verdict layer and sge-readiness-audit. - Numbers and lists the tool uses: mega-analyzer: first 100 words, chunk longer than 20 chars matching /\b(is|are|means?|refers?\s+to)\b/i, verdict only added when wordCount >= 800 and the page looks like an article (Article schema, a /blog/, /articles/, /posts/, /news/ or /guides/ path, or >= 5 H2s with >= 1500 words and fewer than 10 images) and not like a landing page (root path, WebSite plus ItemList/CollectionPage schema, or >= 10 images with >= 3 H2s); featured-snippet-extractability: first paragraph from 'main p, article p.content p, p' matching /^[A-Z][A-Za-z0-9 -]{2,30} (is|are|refers to|means|describes) /, info when missing; sge-readiness-audit: first paragraph in main, article, [role="main"] or body with >= 10 words matching /^[A-Za-z"'][^.]*\b(is|are|refers?\s+to|means?|describes?|represents?|provides?|enables?)\b[^.]+[.!]/i; definition pattern required by the scaffold (single-site-gen, site-migration-gen). - Why: Featured snippets, People Also Ask and AI Overviews disproportionately quote an opening sentence shaped 'X is Y'. - Fix: Open the page with one sentence that defines or directly answers the topic, 'X is a Y that does Z', within the first 40 words. - Verify: [Featured-Snippet Extractability Audit](https://jwatte.com/tools/featured-snippet-extractability/), [SGE Readiness Audit](https://jwatte.com/tools/sge-readiness-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/) and 1 more. - [ ] **4.16 Answer conciseness, first paragraph is `<n>` words** - Pass: The first paragraph with at least 10 words is 25 to 80 words long. - Warn: The lead paragraph is longer than 80 words. - Fail: The lead paragraph is shorter than 25 words, or no paragraph with at least 10 words exists. - Numbers and lists the tool uses: Content area = main, else article, else [role="main"], else body; candidate paragraph needs >= 10 words; pass window 25 to 80 words (sge-readiness-audit). - Why: AI Overviews prefer a short lead paragraph that answers the page's core question in one breath. - Fix: Make the first substantial paragraph a 25 to 80 word direct answer to the question the page exists for. - Verify: [SGE Readiness Audit](https://jwatte.com/tools/sge-readiness-audit/). - [ ] **4.17 Heading-to-query alignment, `<n>`/`<n>` H2s match question patterns** - Pass: The content area has at least four H2s with at least two phrased as questions (sge-readiness-audit), or at least one H2 is question-shaped (featured-snippet-extractability). - Warn: Three or more H2s but fewer than two question-shaped ones (sge-readiness-audit), or no question-shaped H2 at all (featured-snippet-extractability). - Fail: Fewer than three H2s in the content area (sge-readiness-audit). - Numbers and lists the tool uses: Question H2 = /\?\s*$/ or /^(how|what|why|when|where|which|who|can|does|do|is|are)\s/i, pass >= 1 (featured-snippet-extractability); /\?|^(what|why|how|when|where|who|which|can|does|is|are|should|do)\b/i scoped to main, article, [role=main] or body, pass 4 H2s with 2 questions, warn at 3 H2s (sge-readiness-audit). - Why: Featured snippets and AI Overviews are most often lifted from the paragraph right under a heading that matches the question the user typed. - Fix: Pick three to five queries the page should win and turn an H2 into each one, for example 'How does X work?' or 'What is the difference between Y and Z?'. - Verify: [Featured-Snippet Extractability Audit](https://jwatte.com/tools/featured-snippet-extractability/), [SGE Readiness Audit](https://jwatte.com/tools/sge-readiness-audit/). - [ ] **4.18 Direct-answer paragraph immediately after each H2** - Pass: Question H2s are followed directly by a concise answer paragraph. - Warn: No question H2 is followed by a 30 to 80 word paragraph (featured-snippet-extractability). - Fail: Fewer than two H2s have a paragraph or list as the next element (batch-analyzer). - Numbers and lists the tool uses: featured-snippet-extractability: next sibling scanned until /^(P|UL|OL|DIV|TABLE)$/, only a P counts, 30 to 80 words, pass >= 1, guidance 40 to 60 words; batch-analyzer: h2 whose nextElementSibling is P, UL or OL, pass >= 2, weight 10; scaffold: a 40 to 60 word direct answer after every H2 with concrete numbers and entities (single-site-gen, site-migration-gen), direct answer paragraphs after each H2 (analyzer site builder). - Why: The extractor wants a short paragraph straight after the question, longer ones get truncated and shorter ones do not qualify. - Fix: Right after each question H2, write a 40 to 60 word paragraph whose first sentence answers the question, with no throat-clearing. - Verify: [Featured-Snippet Extractability Audit](https://jwatte.com/tools/featured-snippet-extractability/), [Site Analyzer](https://jwatte.com/tools/analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/) and 1 more. - [ ] **4.19 Long-form article has a Table of Contents** - Pass: A long page has a list near the top made mostly of in-page anchor links. - Warn: A long article has no table of contents, reported as a warning by the mega-analyzer verdict layer. - Numbers and lists the tool uses: mega-analyzer: one of the first 4 ol/ul lists has >= 3 a[href^=#] links and links divided by li count >= 0.7; verdict only added when wordCount >= 800 and the page looks like an article (Article schema, a /blog/, /articles/, /posts/, /news/ or /guides/ path, or >= 5 H2s with >= 1500 words and fewer than 10 images) and not like a landing page (root path, WebSite plus ItemList/CollectionPage schema, or >= 10 images with >= 3 H2s); batch-analyzer: only when body text > 4000 chars, first 4 lists, >= 3 a[href^='#'], weight 5; scaffold: TOC on pages of >= 1500 words (single-site-gen, site-migration-gen), table of contents for long content (analyzer site builder). - Why: A linked table of contents helps voice assistants and AI retrievers jump to the right section of a long page. - Fix: Add an `<ol>` of anchor links to each H2 near the top of any page over about 800 words. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/) and 1 more. - [ ] **4.20 Structured content formats, `<n>` lists + `<n>` table(s)** - Pass: The content area has lists shaped for snippets: at least one ul/ol with 3 to 10 items averaging 20 to 200 characters (featured-snippet-extractability), at least three lists or two lists plus a table (sge-readiness-audit), or at least two lists or tables (batch-analyzer). - Warn: At least one list or one table in the content area but fewer than three lists and not two lists plus a table (sge-readiness-audit). - Fail: No lists and no tables in the content area (sge-readiness-audit). - Numbers and lists the tool uses: featured-snippet-extractability: items 3 to 10 and average li text length 20 to 200 chars, pass >= 1, zero renders as info; sge-readiness-audit: pass lists >= 3 or (lists >= 2 and tables >= 1), warn lists >= 1 or tables >= 1 below that, fail no lists and no tables; batch-analyzer: ul, ol, table count >= 2, weight 10; analyzer site builder scaffold: definition lists for key terms. - Why: Featured list snippets and AI Overviews render lists directly, but skip items that are too short and truncate items that are too long. - Fix: For 'steps to', 'ways to' and 'best' queries, add a 3 to 10 item list where each item is 20 to 200 characters and starts with a verb or noun phrase, and use definition lists for key terms. - Verify: [Featured-Snippet Extractability Audit](https://jwatte.com/tools/featured-snippet-extractability/), [SGE Readiness Audit](https://jwatte.com/tools/sge-readiness-audit/), [Site Analyzer](https://jwatte.com/tools/analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/). - [ ] **4.21 `<n>` properly-headed tables** - Pass: At least one table on the page has a `<thead>` or a `<th>`. - Numbers and lists the tool uses: table.querySelector('thead') || table.querySelector('th'), pass >= 1, zero renders as info (featured-snippet-extractability); comparison tables required by the scaffold (single-site-gen, site-migration-gen). - Why: For comparison and specification questions Google and AI Overviews prefer a table with explicit column headers. - Fix: For comparison queries add a table with a `<thead>` row of `<th>` cells. - Verify: [Featured-Snippet Extractability Audit](https://jwatte.com/tools/featured-snippet-extractability/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/), [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/). - [ ] **4.22 Semantic HTML structure (`<n>` tags in use)** - Pass: At least four of the 18 semantic HTML elements appear on the page. - Warn: Fewer than four structural tags are in use. - Numbers and lists the tool uses: Tags counted: article, section, aside, nav, main, header, footer, time, figure, figcaption, cite, mark, details, summary, abbr, kbd, dfn, blockquote; pass >= 4; first 10 listed (analyzer); the principles name article, section, time, figure, cite, details, main, header, footer as preferred over a generic div (mega-analyzer, analyzer, mega-seo-analyzer). - Why: Semantic tags tell crawlers what each block is and drive how AI models chunk the page for retrieval. - Fix: Replace generic `<div>` containers that play a structural role with article, section, main, header, footer, time, figure, cite and details. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). - [ ] **4.23 `<cite>` / blockquote cite markup used (`<n>`)** - Pass: The page has at least one `<cite>` element or a blockquote or q with a cite attribute. - Warn: No cite or blockquote cite markup is found (analyzer, mega-seo-analyzer). - Numbers and lists the tool uses: /<cite\b/gi plus /<blockquote[^>]*\bcite=/gi, pass >= 1 (analyzer); /<cite\b|<blockquote[^>]+cite=|<q[^>]+cite=/i (mega-seo-analyzer); /<cite|<blockquote[^>]+cite=/i as one of four AEO tests (competitor-gap-matrix). - Why: AI engines weight tagged citations as evidence that your claims trace back to a source. - Fix: Wrap external quotes, statistics and figures in `<cite>`Source Name`</cite>` or `<blockquote cite="URL">`. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Competitor Gap Matrix](https://jwatte.com/tools/competitor-gap-matrix/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). - [ ] **4.24 Attribution coverage** - Pass: Attribution score is 80 or higher, meaning claim-shaped sentences are matched by external links or Claim schema is present. - Warn: Score between 60 and 79. - Fail: Score below 60. - Numbers and lists the tool uses: claims = matches of /\b\d{1,3}(\.\d+)?%|\$\d+|\b(according to|per |based on)\b/g on the lowercased body text; links = count of a[href^="http"]; score = min(100, claims ? round(links / max(1, claims) * 60) : 80); +20 capped at 100 when /"@type":\s*"Claim(Review)?"/i matches (mega-aeo-analyzer). - Why: A page that makes numeric claims without linking to where they came from reads as unverified to an AI answer engine. - Fix: Add inline links to the source of each factual claim and consider schema.org Claim or ClaimReview markup for the top facts. - Verify: [Mega AEO Analyzer](https://jwatte.com/tools/mega-aeo-analyzer/). Standard: schema.org Claim, ClaimReview. - [ ] **4.25 Paragraph lengths optimized for AI retrieval (`<n>` paragraphs)** - Pass: Most main-content paragraphs fall in the retrieval window of about 40 to 150 words, with few stubs and few over-long blocks. - Warn: Too many thin or chunky paragraphs (analyzer, mega-analyzer), some concise paragraphs but long blocks remain (sge-readiness-audit), or a retrievable-share score of 60 to 79 (mega-aeo-analyzer). - Fail: Fewer than three concise paragraphs (sge-readiness-audit), a retrievable-share score under 60 or no `<p>` elements at all (mega-aeo-analyzer), or a passage under 40 or over 250 words scoring zero for length (passage-retrieval). - Numbers and lists the tool uses: analyzer: needs 3+ paragraphs, thin = under 25 words, chunky = over 150, warn when thin >= ceil(0.6 * n) or chunky >= ceil(0.3 * n), target 40 to 150; mega-analyzer: scope main, article or [role="main"] else body, selectors p, [class*="faq-answer" i], [class*="answer-inner" i], [role="region"][aria-labelledby], excluding nav, footer, header, aside, short < 25, long > 150, substantive >= 20, ideal 40 to 150, gate 3 paragraphs, thin = not (median >= 25 or ideal >= 5) and substantive < 5, chunky = long >= ceil(paragraphs * 0.3); passage-retrieval per passage: 40 to 150 words +20 points, 151 to 250 +8, under 40 or over 250 zero; sge-readiness-audit: short = 15 to 60 words, long > 100, pass 5 short and at most 2 long, warn floor 3 short; mega-aeo-analyzer: ideal 40 to 100 words, too long > 120, too short < 20, score = round(ideal / paragraphs * 100), pass >= 80, warn >= 60, no `<p>` at all scores 30; principles: each `<p>` targets 40 to 150 words (mega-analyzer, analyzer, mega-seo-analyzer). - Why: AI retrievers embed each paragraph as its own chunk of about 150 tokens, so a stub carries no answer and an over-long block gets split mid-thought. - Fix: Merge paragraphs under about 25 words into their neighbors and split anything over 150 words, so each paragraph is a self-contained 40 to 150 word answer. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [SGE Readiness Audit](https://jwatte.com/tools/sge-readiness-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega AEO Analyzer](https://jwatte.com/tools/mega-aeo-analyzer/) and 1 more. - [ ] **4.26 Passage extractability (`<n>` IDEAL 134 to 167 word passages)** - Pass: At least three paragraphs of 134 to 167 words on the page; the number that sit directly under an H1, H2 or H3 is reported in the detail but does not gate the verdict. - Warn: One or two paragraphs of 134 to 167 words (amber). - Fail: No paragraph in the 134 to 167 word range, rendered grey (text-light) rather than red. - Numbers and lists the tool uses: Every `<p>` is measured; ideal = word count >= 134 and <= 167; headed when the previous element sibling, after skipping /^(BR|SPAN|EM|STRONG|A|I|B)$/i, matches /^H[123]$/i; green when ideal passages >= 3, amber when >= 1, grey when 0; the headed count is detail only (mega-analyzer). - Why: Since Gemini 3 became Google's default, citation selection favors self-contained 134 to 167 word passages under a heading, and pages need three or more to compete for AI Overview citations. - Fix: Write at least three self-contained 134 to 167 word passages, each directly under a question-intent H2 or H3. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **4.27 Entity density** - Pass: At least 15 recognizable named entities per 1,000 words. - Warn: 8 to 14 entities per 1,000 words. - Fail: Fewer than 8 entities per 1,000 words, rendered grey (text-light) rather than red. - Numbers and lists the tool uses: Phrase regex /\b([A-Z][a-z]+(?:\s+[A-Z][a-z]+)+)\b/g plus single tokens /^[A-Z][a-z]{2,}$/ after dropping the first token of each sentence and excluding I, The, A, An, This, That, These, Those, It, We, He, She, They, You, And, But, Or, So, If, Then, For, To, In, On, At, By, Of; density = round(entityCount / wordCount * 1000, 1 decimal); green >= 15, amber >= 8, grey (text-light) below 8 (mega-analyzer); the scaffold requires concrete numbers, statistics and named entities in the copy (single-site-gen). - Why: Pages that name specific people, organizations, places and products anchor in the model's knowledge graph, and pages with 15 or more entities per 1,000 words see a reported 4.8x citation lift. - Fix: Name the specific people, organizations, places, products and dates in the copy instead of generic nouns. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/). - [ ] **4.28 Tokenizer efficiency** - Pass: Score 80 or higher: the main body has at least 200 words with modest punctuation and numeric density. - Warn: Score 60 to 79, with fixes shown below 70. - Fail: Score below 60. - Numbers and lists the tool uses: nav, footer, script, style, aside, header elements removed first; start at 100; -20 when punctuation density (non-word non-space chars / text length) > 0.18; -15 when numeric density (numbers / words) > 0.15; -20 when words < 200; floor 0 (mega-aeo-analyzer). - Why: Dense punctuation and number tables waste the tokens an AI model spends on your page and blur the meaning it can extract. - Fix: Reduce punctuation clusters and dense numeric tables, prefer prose to markdown-style tables, and make sure the body has at least 200 words. - Verify: [Mega AEO Analyzer](https://jwatte.com/tools/mega-aeo-analyzer/). - [ ] **4.29 `<n>` named entity span(s), anchors retrieval to topics** - Pass: The passage contains at least one multi-word capitalized name, worth 15 points. - Numbers and lists the tool uses: ENTITY_SPAN = /\b([A-Z][a-zA-Z]+(?:\s+[A-Z][a-zA-Z]+){1,3})\b/g; single capitalized words are filtered out; +15 (passage-retrieval). - Why: A retriever matches passages to topic and entity queries, so a passage that names nothing cannot be matched. - Fix: Name the product, company, place or person the passage is about rather than using generic nouns. - [ ] **4.30 First sentence is self-contained** - Pass: The passage's first sentence has subject-verb structure and does not open with an orphan pronoun, worth 15 points plus 10 for the separate no-pronoun rule. - Numbers and lists the tool uses: First sentence = /^[^.!?]+[.!?]/ else the whole text; verb list is|are|was|were|has|have|had|does|do|did|can|will|should|would|could|means|describes|refers|works|provides|offers|contains|requires; ORPHAN_PRONOUNS /^(he|she|they|this|that|these|those|it|its|their|them)\b/i; +15 for a verb plus no pronoun, +10 separately for no orphan pronoun (passage-retrieval). - Why: A passage whose opening sentence leans on something said earlier cannot be quoted on its own. - Fix: Open each paragraph with a complete statement that names its subject instead of a pronoun. - [ ] **4.31 Answer-form structure (definition / Q&A pattern)** - Pass: The passage opens as a definition such as 'The X is ...' or as an explicit Q: / A: pair, worth 15 points. - Numbers and lists the tool uses: ANSWER_FORM = /^(the\s+\w+\s+(is|are|was|were|means|describes|refers|consists|involves))|^\w+\s+(is|are)\s+(a|an|the|one|the)\b|^(q\s*:|question\s*:)/i; +15, no issue string on a miss (passage-retrieval). - Why: Passages shaped 'The X is ...' or 'Q: ... A: ...' answer a question directly, which is what gets quoted. - Fix: Lead with a definition sentence or an explicit question and answer pair. - [ ] **4.32 Specific claim / data point present** - Pass: The passage contains a number, percentage, currency amount, year, multiplier, version or full date, worth 10 points. - Warn: No specific claim in a passage longer than 30 words. - Numbers and lists the tool uses: SPECIFIC_CLAIM = /\b(\d+(\.\d+)?%|\$\d+|€\d+|£\d+|\d{4}\b|\d+x|±\d+|version\s+\d+|v\d+\.\d+)\b|[A-Z][a-z]+\s+\d{1,2},\s+\d{4}/; issue raised only when word count > 30; +10 (passage-retrieval). - Why: Generic prose is rarely cited, a concrete figure gives the answer engine something to quote. - Fix: Add a concrete number, date, price, percentage or version to the passage. - [ ] **4.33 Under heading: "`<value>`"** - Pass: A heading of more than 3 characters precedes the passage within the lookup window, worth 10 points. - Numbers and lists the tool uses: Heading text length > 3; kudos shows the first 60 chars; lookup scans 12 previous siblings, then 8 previous siblings per ancestor level up to the root; +10 (passage-retrieval). - Why: The surrounding heading gives the retriever a topical handle for the passage. - Fix: Put a descriptive H2 or H3 directly above each block of paragraphs. - [ ] **4.34 Internal anchor link in passage (+5)** - Pass: The passage contains an in-page anchor link, worth 5 points. - Numbers and lists the tool uses: /<a [^>]*href="#/ tested against the passage text; +5 (passage-retrieval). - Why: An internal anchor lets a retriever deep-link back to the exact chunk. - Fix: Give sections ids and link to them within the content. - [ ] **4.35 Passage `<n>`, `<n>` words, `<n>`/100** - Pass: The passage scores 70 or higher out of 100. - Warn: Score 50 to 69 (mega-analyzer row); 40 to 69 is neither strong nor weak (passage-retrieval). - Fail: Score below 50 (mega-analyzer row); below 40 counts as weak (passage-retrieval). - Numbers and lists the tool uses: score = min(100, +20 length, +15 entity, +15 first sentence, +15 answer form, +10 specific claim, +10 no orphan pronoun, +10 heading, +5 anchor); strong >= 70, weak < 40, preview first 180 chars (passage-retrieval); mega-analyzer row bands >= 70 pass, 50 to 69 warn, < 50 fail, rows excluded from the Full Summary rollup; candidates: root = main, [role="main"], article, else body; nodes 'p, li > p, blockquote p, figure figcaption' with no NAV, HEADER, FOOTER, ASIDE, FORM, SCRIPT or STYLE ancestor, text longer than 30 chars and at least 12 words; pages built entirely from divs or widgets yield no passages. - Why: A page with a great overall score can still be uncitable if every paragraph is too thin, leans on pronouns or names no entities. - Fix: Merge passages under 40 words with their neighbors, replace a leading pronoun with the named subject, and rework the opening sentence to name the topic. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **4.36 Average passage score `<n>`/100, Strong (>=70) `<n>`, Weak (<40) `<n>`, Total passages `<n>`** - Pass: The average passage score is 70 or higher with no weak passages under 40. - Warn: Average 50 to 69. - Fail: Average below 50, or any passage scoring under 40. - Numbers and lists the tool uses: avg = round(sum of scores / count), 0 with no passages; strong >= 70, ok >= 50, else weak (passage-retrieval); mega-analyzer summary: avg >= 70 good, >= 50 ok, else bad; weak = score < 40 and weak > 0 is bad; target average 70+ with no chunks under 40. - Why: The average summarizes how citable the page's paragraphs are on their own. - Fix: Raise the average by fixing the lowest-scoring passages first. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **4.37 Length 40-300 chars** - Pass: Each FAQ answer is 40 to 300 characters long. - Numbers and lists the tool uses: 40 and 300 characters, inclusive (faq-answer-extractability). - Why: Answer length is one of eight linguistic signals Google's featured snippet selection is known to weight. - Fix: Trim or expand each answer to 40 to 300 characters. - Verify: [FAQ Extractability](https://jwatte.com/tools/faq-answer-extractability/). - [ ] **4.38 First word is a concrete subject** - Pass: The first sentence of the FAQ answer does not start with a pronoun or a transition word. - Numbers and lists the tool uses: pronounStart /^(it|this|that|these|those|they|he|she|we)\b/i; transitionStart /^(however|therefore|moreover|also|but|and|so|in|for|to)\b/ on the lowercased first sentence split on /(?<=[.!?])\s+/ (faq-answer-extractability). - Why: An answer that starts with 'It' or 'However' needs the question for context and extracts poorly as a standalone snippet. - Fix: Open the answer with the question's subject, not a pronoun. - Verify: [FAQ Extractability](https://jwatte.com/tools/faq-answer-extractability/). - [ ] **4.39 Pronoun density < 6%** - Pass: Pronouns make up less than 6% of the FAQ answer's words. - Numbers and lists the tool uses: density = pronouns / words, pass < 0.06, 0 when the word count is 0; pronoun regex /\b(it|this|that|they|them|he|she|we|us|their|its)\b/g on the lowercased answer; words split on /\s+/ (faq-answer-extractability). - Why: Low pronoun density keeps the answer self-contained for snippet and AI-answer extraction. - Fix: Replace pronouns with the concrete noun they refer to so the answer stands alone. - Verify: [FAQ Extractability](https://jwatte.com/tools/faq-answer-extractability/). - [ ] **4.40 Fact-dense (numbers or proper nouns)** - Pass: The FAQ answer has at least two numeric tokens or capitalized proper nouns combined. - Numbers and lists the tool uses: (numbers + properNouns) >= 2; numbers /\b\d+([.,]\d+)?%?\b/g; proper nouns /\b[A-Z][a-z]{2,}/g (faq-answer-extractability). - Why: Fact density is a signal the snippet selector weights. - Fix: Include at least one concrete fact, name or number in the answer. - Verify: [FAQ Extractability](https://jwatte.com/tools/faq-answer-extractability/). - [ ] **4.41 Question subject restated in answer** - Pass: At least two of the question's key words, or all of them when there are fewer than two, appear in the answer. - Numbers and lists the tool uses: Key words longer than 3 letters not in the stop list what, when, where, which, who, why, does, this, that, with; question lowercased with /[^a-z0-9 ]+/g removed; required echoes = min(key word count, 2) (faq-answer-extractability). - Why: Restating the subject lets the answer stand alone without the question. - Fix: Open with the question's subject and echo its key terms in the answer. - Verify: [FAQ Extractability](https://jwatte.com/tools/faq-answer-extractability/). - [ ] **4.42 Answer begins with declarative statement** - Pass: The FAQ answer starts with an article or a capitalized word followed by another word. - Numbers and lists the tool uses: /^(the|a|an|[A-Z][a-z]+)\s+\w+/ (faq-answer-extractability). - Why: A declarative opener is the form the snippet extractor prefers. - Fix: Rewrite the opener as 'The X ...', 'A Y ...' or a capitalized subject followed by a verb phrase. - Verify: [FAQ Extractability](https://jwatte.com/tools/faq-answer-extractability/). - [ ] **4.43 Direct-answer verb in first sentence** - Pass: The first sentence of the FAQ answer contains a direct-answer verb such as is, are or means. - Numbers and lists the tool uses: Verb list is, are, was, were, means, describes, refers, provides, offers, contains, requires, works, takes, includes; first sentence = split on /(?<=[.!?])\s+/ index 0 (faq-answer-extractability). - Why: A direct verb marks the sentence as an answer rather than a preamble. - Fix: Make the first sentence a direct statement using a verb such as is, are, means, provides or includes. - Verify: [FAQ Extractability](https://jwatte.com/tools/faq-answer-extractability/). - [ ] **4.44 First sentence self-contained** - Pass: The first six words of the FAQ answer's first sentence contain no bare 'this' or 'that' without a following noun. - Numbers and lists the tool uses: /\b(this|that)\b(?!\s+\w+)/i applied to the first six words of the first sentence (faq-answer-extractability). - Why: An unresolved 'this' or 'that' makes the answer depend on the question for context. - Fix: Make the first sentence stand alone without the question. - Verify: [FAQ Extractability](https://jwatte.com/tools/faq-answer-extractability/). - [ ] **4.45 FAQ extractability, avg `<n>`%** - Pass: Each FAQ answer passes at least 75% of the eight checks (strong). - Warn: An answer passes 50 to 74% of the checks (mid). - Fail: An answer passes under 50% of the checks (weak). - Numbers and lists the tool uses: pct = round(hits / 8 * 100); strong >= 75, mid >= 50, weak < 50; page average = round(sum(pct) / count); the AI rewrite prompt lists answers under 60%, first 8 after sorting ascending (faq-answer-extractability). - Why: Answer quality decides whether Google actually uses the FAQ as a featured snippet or an AI-answer citation. - Fix: Rewrite each weak answer to satisfy its failed checks: 40 to 300 characters, open with the question's subject, include one fact or number, and make the first sentence stand alone. - Verify: [FAQ Extractability](https://jwatte.com/tools/faq-answer-extractability/). - [ ] **4.46 LLM referral analytics segment** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: Referrer regex chatgpt.com|perplexity.ai|claude.ai|gemini.google.com|copilot.microsoft.com|phind.com|you.com|duckduckgo.com/ai (mega-analyzer); GA4 segment with referrer chatgpt.com|perplexity.ai|claude.ai|gemini.google.com|copilot.microsoft.com|phind.com|you.com (analyzer); chatgpt.com|perplexity.ai|claude.ai|gemini.google.com|copilot.microsoft.com (mega-seo-analyzer); secondary KPI: brand citations from seoClarity, Profound or Bing Webmaster; brand websites earn only about 3% of LLM citations, the other 97% go to Reddit, YouTube, publishers, retailer product pages and Wikipedia. - Why: You cannot tell whether answer-engine work is paying off unless visits referred by AI assistants are tracked separately. - Fix: Create an analytics segment whose referrer matches the AI assistant domains and treat LLM referral visits as the AEO KPI. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). - [ ] **4.47 Google Preferred Sources opt-in widget** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: Deep link https://www.google.com/preferences/source/?source=`<hostname>`; users can save up to 5 publishers; emitted as `<aside class="jw-preferred-sources">` when the Website URL parses to a hostname (eeat-generator). - Why: Google AI Mode and Search let readers mark up to five preferred publishers, and readers who already trust you will do it when asked. - Fix: Add an aside on high-traffic pages inviting readers to add your site to their Google Preferred Sources, linking to the deep link for your hostname. - Verify: [E-E-A-T Generator](https://jwatte.com/tools/eeat-generator/). Standard: Google Preferred Sources (AI Mode + Search). - [ ] **4.48 People Also Ask** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: /data-rhq="PAA"|"peopleAlsoAsk"|class="[^"]*\brelated-question-pair\b|People also ask|aria-label="People also ask"/i on the pasted results-page HTML (serp-features). - Why: When the results page for your query shows a People Also Ask box, those questions are the ones you can win with a heading and a short answer. - Fix: Cover each People Also Ask question as an H2 or H3 with a short answer on your page and pair it with FAQPage schema. - Verify: [SERP Features](https://jwatte.com/tools/serp-features/). Standard: schema.org FAQPage. - [ ] **4.49 Gap analysis feature: RSS Feed** - Pass: The page links an RSS or Atom feed in the head. - Fail: No feed link while another site in the comparison batch has one. - Numbers and lists the tool uses: link[type=application/rss+xml] or link[type=application/atom+xml]; the feature gap table only renders with 2 or more successful results (Batch Analyzer). - Why: A feed lets readers, aggregators and AI systems follow new content without crawling the whole site. - Fix: Publish an RSS or Atom feed and link it in the head of every page. - Verify: [Batch Compare](https://jwatte.com/tools/batch-analyzer/). - [ ] **4.50 Gap analysis feature: JSON Feed** - Pass: The page links a JSON Feed or references /feed.json. - Fail: No JSON Feed while another site in the comparison batch has one. - Numbers and lists the tool uses: link[type=application/feed+json] or /feed\.json/i anywhere in the HTML (Batch Analyzer). - Why: JSON Feed is the machine-friendly feed format newer readers and agents prefer. - Fix: Publish /feed.json and link it in the head. - Verify: [Batch Compare](https://jwatte.com/tools/batch-analyzer/). ## 5. Being read by ChatGPT, Claude, Perplexity and Google's AI Before an AI can cite you it has to be allowed in, and then it has to find the files written for it. This section is the AI crawlers in robots.txt, the host challenge pages that block them without telling anyone, llms.txt and ai.txt, and the agent-facing surfaces that Cloudflare's public readiness score at https://isitagentready.com/ looks for. **Verify this section with:** [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Site Analyzer](https://jwatte.com/tools/analyzer/), [robots.txt Simulator](https://jwatte.com/tools/robots-txt-simulator/), [Agent Ready Audit](https://jwatte.com/tools/agent-ready-audit/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [AI Posture Audit](https://jwatte.com/tools/ai-posture-audit/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/), [Mega Batch](https://jwatte.com/tools/mega-batch/), [Migration Analyzer](https://jwatte.com/tools/migration-analyzer/), [Mega AEO Analyzer](https://jwatte.com/tools/mega-aeo-analyzer/), [Content Velocity](https://jwatte.com/tools/content-velocity/), [AI Bot Allowlist Validator](https://jwatte.com/tools/ai-bot-allowlist-validator/), [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [LLMs.txt Generator](https://jwatte.com/tools/llms-txt-generator/). - [ ] **5.1 AI crawlers blocked in robots.txt: `<list>` / none** - Pass: No AI crawler in the registry is disallowed: its robots.txt group has no Disallow: / line, or no group names it and the wildcard group allows it. - Fail: An AI crawler's own User-agent group contains Disallow: / and no Allow line (Mega Analyzer fails, Analyzer reports it as informational). - Numbers and lists the tool uses: Bot list: registry categories ai-llm, ai-search and data (Mega Analyzer), fallback GPTBot, ChatGPT-User, ClaudeBot, Claude-Web, anthropic-ai, PerplexityBot, Google-Extended, CCBot, Applebot-Extended, Bytespider; Analyzer checks 15 bots: GPTBot, ChatGPT-User, OAI-SearchBot, ClaudeBot, Claude-Web, anthropic-ai, PerplexityBot, Google-Extended, CCBot, Applebot-Extended, Bytespider, DuckAssistBot, cohere-ai, FacebookBot, Amazonbot; Mega Analyzer audit prompt names GPTBot, ClaudeBot, PerplexityBot, Google-Extended, CCBot, Bytespider, Applebot-Extended, Meta-ExternalAgent and the retrieval-stage crawlers GPTBot, OAI-SearchBot, ClaudeBot, anthropic-ai, PerplexityBot; statuses disallowed / explicit-allow / allowed-default; blockedAll = Disallow: / present and no Allow lines; groups split on blank lines (/\n\s*\n/), user-agent lines /^user-agent\s*:/i, disallow lines /^disallow\s*:/i; robots.txt Simulator evaluates Googlebot, Bingbot, GPTBot, ClaudeBot, PerplexityBot, Google-Extended, Applebot-Extended, Bytespider or * per URL, matched case-insensitively against each User-agent line. - Why: An AI answer engine cannot cite a page its crawler is told not to fetch. - Fix: Allow the AI crawlers you want citations from in robots.txt as an allow-list rather than a deny-list, and add an explicit User-agent group for any AI crawler you want to treat differently from *. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [robots.txt Simulator](https://jwatte.com/tools/robots-txt-simulator/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: robots.txt (RFC 9309). - [ ] **5.2 AI bot rules in robots.txt** - Pass: At least one User-agent line in robots.txt names a known AI crawler, whether the rule allows or disallows it. - Fail: No per-bot User-agent directive names any known AI crawler, so every bot falls under User-agent: * (Agent-Ready Audit, the Mega Analyzer parity card and Cloudflare's scorer fail this; Analyzer reports it as informational). - Numbers and lists the tool uses: Agent-Ready Audit KNOWN_AI_BOTS (23, lowercased): gptbot, oai-searchbot, chatgpt-user, claudebot, claude-web, anthropic-ai, perplexitybot, perplexity-user, google-extended, googlebot, applebot-extended, applebot, bytespider, meta-externalagent, facebookbot, ccbot, cohere-ai, amazonbot, youbot, duckassistbot, mistralai-user, diffbot, timpibot; line regex /^\s*user-agent\s*:\s*(.+?)\s*(?:#.*)?$/i; parish audit (Analyzer) matches /GPTBot|ClaudeBot|PerplexityBot|OAI-SearchBot|Google-Extended/i; Mega Analyzer parity card row 'robots.txt AI rules' passes when at least one line matches /^\s*user-agent\s*:\s*(GPTBot|ChatGPT-User|OAI-SearchBot|ClaudeBot|Claude-Web|anthropic-ai|PerplexityBot|Google-Extended|Googlebot-News|CCBot|Applebot-Extended|Bytespider|Amazonbot|Meta-ExternalAgent|FacebookBot|cohere-ai|Diffbot|YouBot|Timpibot|MistralAI-User)\b/gim (20 bots); Single Site Gen and Site Migration Gen expect explicit Allow for GPTBot, ClaudeBot, anthropic-ai, PerplexityBot, Google-Extended, CCBot, Applebot-Extended, ChatGPT-User, OAI-SearchBot, Bytespider, YouBot, Amazonbot; shared bot registry (33 entries) robots.txt tokens by tier: critical GPTBot, OAI-SearchBot, ChatGPT-User, ClaudeBot, PerplexityBot, Googlebot, Google-Extended, bingbot; major Claude-Web, Perplexity-User, Applebot, Bytespider, CCBot, Meta-ExternalAgent (also facebookexternalhit), Amazonbot, MistralAI-User (also mistralai), DuckDuckBot, YandexBot (also yandex), Baiduspider (also baidu); optional anthropic-ai, Applebot-Extended, cohere-ai, Cohere-Training-Data-Crawler, YouBot, Diffbot, Timpibot, omgili (also omgilibot), PetalBot, Slurp (also yahoo! slurp), facebookexternalhit, LinkedInBot, Twitterbot, Slackbot (also slackbot-linkexpanding); anthropic-ai, Applebot-Extended and Google-Extended are policy-only tokens with no live crawler; the AI Bot Policy Generator writes a block for every registry bot except the preview category, adding legacy search bots (Googlebot, bingbot, PetalBot, DuckDuckBot, YandexBot, Slurp, Baiduspider) only when 'Include legacy bots' is checked. - Why: Silence in robots.txt is ambiguous; a named rule tells each AI crawler exactly what you decided, and Cloudflare's scorer counts even an Allow rule. - Fix: Add an explicit User-agent block for each AI crawler you want to allow or disallow (for example GPTBot, ClaudeBot, PerplexityBot, Google-Extended) plus a Sitemap line; the AI Bot Policy Generator at /tools/ai-bot-policy-gen/ writes a paired robots.txt and ai.txt. - Verify: [Agent Ready Audit](https://jwatte.com/tools/agent-ready-audit/), [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: robots.txt (RFC 9309); Cloudflare Agent Readiness Score (https://isitagentready.com/). - [ ] **5.3 Content-Signal directive in robots.txt (contentsignals.org)** - Pass: Robots.txt contains a Content-Signal line declaring search, ai-input and ai-train preferences. - Warn: No Content-Signal line and fewer than 3 named AI bot rules (Mega Analyzer); Mega SEO Analyzer reports absence as informational. - Fail: No Content-Signal directive at all (Agent-Ready Audit scores this as a fail, and Cloudflare's scorer fails a site that has per-bot rules but no Content-Signal line). - Numbers and lists the tool uses: line regex /^\s*content-signal\s*:/mi; Mega Analyzer also passes (as info) when at least 3 named AI bot rules exist from GPTBot, ChatGPT-User, OAI-SearchBot, ClaudeBot, Claude-Web, anthropic-ai, PerplexityBot, Google-Extended, Googlebot-News, CCBot, Applebot-Extended, Bytespider, Amazonbot, Meta-ExternalAgent, FacebookBot, cohere-ai, Diffbot, YouBot, Timpibot, MistralAI-User; Mega SEO Analyzer looks in the page HTML for /content-signals\s*:|<meta[^>]+name=["']content-signals["']/i; tokens search, ai-input, ai-train each yes or no; the AI Bot Policy Generator writes 'Content-Signal: search=<yes|no>, ai-input=<yes|no>, ai-train=<yes|no>' in the User-agent: * block, search=yes and ai-input=yes when any bot has crawl=allow, ai-train=yes only when any bot has train=allow. - Why: It lets you grant or deny AI training, AI answer input and search inclusion separately instead of one blunt Allow or Disallow, and Cloudflare AI Crawl Control adopted it as the default. - Fix: Add 'Content-Signal: search=yes, ai-input=yes, ai-train=yes' (adjust the values to your policy) to the User-agent: * block of robots.txt. - Verify: [Agent Ready Audit](https://jwatte.com/tools/agent-ready-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: contentsignals.org / IETF Content Signals draft; Cloudflare Agent Readiness Score (https://isitagentready.com/). - [ ] **5.4 Content-Signal declared in every robots.txt user-agent group** - Pass: Every User-agent group in robots.txt carries its own Content-Signal line with valid tokens. - Warn: One or more groups lack the line, or a token is not one of search, ai-input, ai-train set to yes or no. - Numbers and lists the tool uses: valid token /^(search|ai-input|ai-train)\s*=\s*(yes|no)$/i; consecutive User-agent lines form one group (RFC 9309). - Why: A crawler obeys exactly one group and a named group replaces the wildcard group, so a Content-Signal placed only under User-agent: * is invisible to named AI crawlers. - Fix: Repeat the Content-Signal directive inside each User-agent group, not just the wildcard block. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: RFC 9309; contentsignals.org. - [ ] **5.5 ai.txt policy served** - Pass: /ai.txt or /.well-known/ai.txt returns HTTP 200 with a body. - Warn: Neither path is served (most tools warn, Mega SEO Analyzer pushes an impact 2 recommendation, Migration Analyzer reports 'ai.txt: not found' as informational); Mega Analyzer reports it as informational on platforms that cannot host root files. - Numbers and lists the tool uses: paths /ai.txt, /.well-known/ai.txt (Analyzer, Mega Analyzer, AI Posture Audit, Batch Analyzer, Mega Batch and Migration Analyzer accept either; the Mega SEO Analyzer recommendation keys on /ai.txt only); Spawning format: 'User-Agent: *' + 'Allow: /', then per bot 'User-Agent: `<name>`' with 'Allow: /' when training is allowed else 'Disallow: /'; reference https://site.spawning.ai/spaces/ai-txt; generator footer names `<origin>`/robots.txt, the /.well-known/ai.txt mirror and `<origin>`/contact/. - Why: Robots.txt governs crawling only; ai.txt is the training-data policy file honored by OpenAI, Anthropic, Google-Extended, Perplexity and CCBot, so without it AI crawlers have no explicit training opt-in or opt-out signal. - Fix: Generate one with the ai.txt Generator at /tools/ai-txt-gen/ and serve the identical file at /ai.txt and /.well-known/ai.txt. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [AI Posture Audit](https://jwatte.com/tools/ai-posture-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/) and 3 more. Standard: Spawning ai.txt; RFC 8615 for the .well-known mirror. - [ ] **5.6 `<n>` AI-crawler(s) have conflicting CRAWL signals across robots.txt / meta robots / X-Robots-Tag** - Pass: For every AI bot, the crawl directive read from robots.txt, the X-Robots-Tag header and the robots meta tag agree, and robots.txt parsed to at least one group. - Warn: At least one bot has two or more non-empty sources that disagree. - Numbers and lists the tool uses: AI_BOTS (22): GPTBot, ChatGPT-User, OAI-SearchBot, ClaudeBot, Claude-Web, anthropic-ai, PerplexityBot, Google-Extended, Googlebot, CCBot, Applebot-Extended, Applebot, Bytespider, Meta-ExternalAgent, FacebookBot, DuckAssistBot, cohere-ai, Amazonbot, YouBot, Diffbot, Timpibot, MistralAI-User; robots.txt groups split on /\n\s*\n/, comments stripped /#.*$/, user-agent lines /^user-agent\s*:/i; a group is disallow if any /^disallow\s*:\s*(.*)$/i has value '/', else allow if any /^allow\s*:\s*(.*)$/i has value '/', else null; a bot-specific group wins over '*'; meta robots /\bnoindex\b/ = disallow, /\bindex\b/ or /\bfollow\b/ = allow; X-Robots-Tag split on ',', a part containing ':' not starting /^\s*max-/i is read as '`<ua>`: `<directive>`', otherwise '*'; the X-Robots-Tag candidate counts only when robots.txt does not disallow the bot and (the header names the bot or robots.txt has no bot-specific group); the meta candidate counts only when robots.txt does not disallow the bot and has no bot-specific group; the AI Posture Audit's own matrix compares robots.txt, X-Robots-Tag and meta robots for every bot without that gating; detail lists at most 6 bots; AI Posture Audit matrix covers registry categories ai-llm, ai-search, data and search (29 bots) with a 'none' cell when a source says nothing about the bot; regenerated files map operators GPTBot/ChatGPT-User/OAI-SearchBot OpenAI, ClaudeBot/Claude-Web/anthropic-ai Anthropic, PerplexityBot Perplexity, Google-Extended/Googlebot Google, CCBot Common Crawl, Applebot-Extended/Applebot Apple, Bytespider ByteDance, Meta-ExternalAgent/FacebookBot Meta, DuckAssistBot DuckDuckGo, cohere-ai Cohere, Amazonbot Amazon, YouBot You.com, Diffbot Diffbot, Timpibot Timpi, MistralAI-User Mistral. - Why: All three sources answer the same question (may this bot fetch the page) and when they disagree for a bot the result is unpredictable, a silent misconfiguration classic audits miss. - Fix: Make robots.txt, the X-Robots-Tag header and the robots meta tag agree per bot; the AI Posture Audit at /tools/ai-posture-audit/ shows the per-bot matrix and can regenerate an aligned robots.txt plus ai.txt (header comments, 'User-agent: *' + 'Allow: /', 'Sitemap: `<origin>`/sitemap.xml', then one block per bot). - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [AI Posture Audit](https://jwatte.com/tools/ai-posture-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: RFC 9309; Google robots meta and X-Robots-Tag documentation. - [ ] **5.7 AI-bot meta posture** - Pass: The robots meta tag carries no noai or noimageai directive. - Numbers and lists the tool uses: /<meta[^>]+name=["']robots["'][^>]+(noai|noimageai)/i; scored 0 or 100. - Why: Noai tells AI engines not to use the page, which removes it from citations. - Fix: Remove noai and noimageai from the robots meta tag if you want AI engines to cite this page. - Verify: [Mega AEO Analyzer](https://jwatte.com/tools/mega-aeo-analyzer/). Standard: noai / noimageai meta directive. - [ ] **5.8 Platform-managed bot challenge blocks AI crawlers, `<vendor>`** - Pass: A non-browser request receives real page content, not a CDN or WAF challenge page, and the body text exceeds 500 characters. - Fail: A challenge marker matches (Cloudflare 'Just a moment', Vercel Security Checkpoint, AWS WAF, Imperva, Akamai) so AI crawlers receive an empty challenge page; Mega Analyzer then grades the AI Crawler View F and flags 499 risk, and Content Velocity counts the URL as 0 words and 0 schema. - Numbers and lists the tool uses: Vercel /Vercel Security Checkpoint|X-Vercel-Challenge-Token|x-vercel-mitigated/i; Cloudflare /cf-mitigated:\s*challenge|`<title>`Just a moment\.{3}<\/title>|challenges\.cloudflare\.com\/cdn-cgi\/challenge-platform|`<title>`Sorry, you have been blocked<\/title>/i; AWS WAF /`<title>`403 Forbidden<\/title>[\s\S]{0,2000}x-amzn-waf|aws-waf-token|x-amzn-trace-id[\s\S]{0,500}403/i; Imperva /imperva|incapsula|Request unsuccessful\. Incapsula incident ID/i; Akamai /Akamai bot manager|reference #\d+\.[a-z0-9]+\.akamai/i; first 4000 chars scanned; body text must exceed 500 chars; TRT clinic audit marker on the home page /challenges\.cloudflare\.com|cf-browser-verification|just a moment|enable javascript and cookies|__cf_chl|turnstile/i; shared isAiBlock rules: 403 + cf-mitigated matching challenge|block; 403 + server cloudflare + challenges.cloudflare.com in body; 403 + CSP referencing challenges.cloudflare.com; cloudflare server + noindex,nofollow + under 50 words; window._cf_chl_opt or cf-challenge-platform in body; cf-mitigated header at any status; any matched vendor (Cloudflare, AWS WAF, Akamai Bot Manager, Imperva / Incapsula, Sucuri, Vercel Firewall) returning 403 or 503 with under 200 words; platform-managed hosts /Pixieset|SmugMug|Squarespace|Format|Showit|Wix|GoDaddy\sBuilder/i; when blocked, content checks fall back to a Wayback or Google Cache copy. - Why: GPTBot, ChatGPT-User, ClaudeBot, PerplexityBot, Google-Extended and OAI-SearchBot all hit the same wall, read a noindex challenge page, time out and walk away, so your robots.txt and ai.txt never matter. - Fix: Vercel: disable Attack Challenge Mode; Cloudflare: enable Verified Bots or write a WAF Skip rule for the AI crawlers and lower Bot Fight Mode; AWS WAF, Imperva, Akamai: reduce sensitivity or allowlist the AI crawlers. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [AI Posture Audit](https://jwatte.com/tools/ai-posture-audit/), [Content Velocity](https://jwatte.com/tools/content-velocity/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **5.9 `<n>` of `<n>` critical AI bots cannot read this page** - Pass: Every probed AI crawler receives HTTP 2xx with real content when the request identifies itself as that crawler. - Fail: Any crawler gets a challenge page (CHALLENGED), HTTP 429 (THROTTLED), HTTP 451 or another 4xx without a challenge (BLOCKED), or a stripped body (PARTIAL); severity critical. - Numbers and lists the tool uses: Mega Analyzer probes the registry critical tier filtered to live-probeable: GPTBot, OAI-SearchBot, ChatGPT-User, ClaudeBot, PerplexityBot, Googlebot, bingbot (fallback when the registry has not loaded: GPTBot, ClaudeBot, PerplexityBot, Googlebot; skipped in ?fast=1 mode); Mega Analyzer verdicts: error when the fetch fails, challenged when the shared isAiBlock rules match, blocked on any HTTP status 400 or higher (no separate THROTTLED), partial when the baseline exceeds 50 words and the body has fewer than max(20, 15% of baseline) words, otherwise allowed; AI Posture Audit and AI Bot Allowlist Validator probe every live-probeable registry bot: GPTBot, OAI-SearchBot, ChatGPT-User, ClaudeBot, Claude-Web, PerplexityBot, Perplexity-User, Applebot, Googlebot, bingbot, Bytespider, CCBot, Meta-ExternalAgent, Amazonbot, MistralAI-User, cohere-ai, Cohere-Training-Data-Crawler, YouBot, Diffbot, Timpibot, omgili, PetalBot, DuckDuckBot, YandexBot, Slurp, Baiduspider, facebookexternalhit, LinkedInBot, Twitterbot, Slackbot (anthropic-ai, Applebot-Extended and Google-Extended have no live identity and show n/a); validator verdicts: ALLOWED = HTTP 2xx with content; CHALLENGED = WAF challenge page per the shared isAiBlock rules; THROTTLED = HTTP 429; BLOCKED = HTTP 451 (unavailable for legal reasons) or any other 400 to 499 without a challenge page; PARTIAL = word count below max(20, 15% of the browser baseline) when the baseline exceeds 50 words; 5xx counts as an origin error, not a block; 350 ms delay between probes; first 12 blocked bots listed. - Why: A CDN can pass browsers but still block specific bots or serve them a stripped page, so a policy file that says allow proves nothing until each crawler actually gets the page. - Fix: In the CDN dashboard enable Verified Bots or write a Skip rule for the retrieval bots (OAI-SearchBot, ClaudeBot, PerplexityBot, Applebot, Googlebot, bingbot); on AWS WAF write the IPSet plus identity rule; on Akamai add a Bot Manager exception; raise or exempt AI crawlers from rate limits; confirm with the AI Bot Allowlist Validator, cross-check server logs, and re-run about 7 days after the fix. - Verify: [AI Posture Audit](https://jwatte.com/tools/ai-posture-audit/), [AI Bot Allowlist Validator](https://jwatte.com/tools/ai-bot-allowlist-validator/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **5.10 PARTIAL: HTTP 200 but body is `<n>` words vs `<n>` baseline** - Pass: Each AI crawler's response carries roughly the same word count as the browser baseline fetch of the page. - Warn: The baseline exceeds 50 words and the crawler's body has fewer than max(20, 15% of baseline) words, or fewer than 20 words (empty). - Fail: The browser baseline itself is a WAF challenge, so bot protection is challenging every visitor that is not allowlisted. - Numbers and lists the tool uses: baseline > 50 words; threshold max(20, baseline * 0.15); empty threshold 20 words; word count strips script and style blocks and tags then splits on whitespace. - Why: A 200 OK with almost no text usually means a dynamic-rendering or prerender setup is handing the bot the app shell instead of the full page, a soft block that never shows up as an error. - Fix: Fix the dynamic-rendering or prerendering configuration so bots receive the fully rendered HTML; if even the browser baseline is challenged, relax the WAF before judging individual bots. - Verify: [AI Bot Allowlist Validator](https://jwatte.com/tools/ai-bot-allowlist-validator/). - [ ] **5.11 Identity + AI-discovery files: `<path>` present (HTTP 200, `<size>`) / missing / HTTP `<n>`** - Pass: Each discovery file returns HTTP 200 with a non-empty text body at its exact path, not an HTML page. - Warn: A path returns a non-404 error such as 403 or 500 (AI Posture Audit). - Fail: The path returns 404 or nothing, or the body is an HTML shell (a soft 404 page served with a 200). - Numbers and lists the tool uses: Presence rule (Analyzer): status 200 to 299, body at least 3 chars, first 400 chars must not match /<!doctype\s+html|<html[\s>]/ unless the first 40 chars match /^(#|user-agent|sitemap|<\?xml)/i, size cap 50000 chars for llms.txt, llms-full.txt.well-known/llms.txt, sitemap-image.xml, sitemap.xml, sitemap-news.xml, feed.xml, feed.json, otherwise 4000; Mega Batch: text longer than 5 chars, no '<!DOCTYPE', no '<html', status under 400; Mega SEO Analyzer: status 200 to 299 only; E-E-A-T Analyzer: body longer than 10 chars; AI Posture Audit paths (23): /robots.txt, /ai.txt, /.well-known/ai.txt, /llms.txt, /llms-full.txt, /.well-known/llms.txt, /llms-ctx.txt, /llms-ctx-full.txt, /humans.txt, /.well-known/security.txt, /.well-known/agent-card.json, /.well-known/ai-plugin.json, /.well-known/mcp/server-card.json, /.well-known/mcp.json, /.well-known/agent-skills/index.json, /.well-known/api-catalog, /.well-known/oauth-authorization-server, /.well-known/oauth-protected-resource, /.well-known/http-message-signatures-directory, /AGENTS.md, /sitemap.xml, /feed.xml, /feed.json; Mega SEO Analyzer (19) adds /.well-known/ucp and /sitemap_agentic_discovery.xml; Mega Analyzer adds /sitemap-image.xml, /sitemap-news.xml, /.well-known/openid-configuration, /.well-known/skills/index.json, /.well-known/acp.json, /openapi.json, /.well-known/ai-catalog.json, /auth.md; Analyzer adds /.well-known/change-password, /.well-known/webfinger, /ads.txt, /site.webmanifest, /manifest.json and reports a count out of 11; Mega Batch probes robots.txt, sitemap.xml, llms.txt, llms-full.txt.well-known/llms.txt, ai.txt.well-known/ai.txt.well-known/security.txt, humans.txt, sitemap-image.xml, site.webmanifest; E-E-A-T Analyzer probes robots.txt.well-known/security.txt, llms.txt, llms-full.txt.well-known/agent-card.json, sitemap.xml; site generators template robots.txt, sitemap.xml, feed.xml, feed.json, llms.txt, llms-full.txt, security.txt, ads.txt, app-ads.txt, humans.txt, agent-card.json, ai-plugin.json and .well-known/* per site; Single Site Gen postures: public (allow crawlers and AI bots, Sitemap line, llms.txt, llms-full.txt, JSON-LD.well-known), api-noindex (Allow / plus Disallow: /api/ and X-Robots-Tag noindex), private (Disallow: /, meta noindex, custom 404, no sitemap or llms.txt). - Why: These files are the machine-readable surface AI engines read to learn your identity, retrieval paths and policies, and a CMS that answers every unknown path with a 200 HTML page makes a missing file look present while feeding the bot garbage. - Fix: Publish each file you need as plain text or JSON at its exact path with the right Content-Type, make unknown paths return a real 404, and write complete content for every missing file rather than a template with TODO placeholders; work in this order: crawl conflicts, then discovery files that improve citation, then llms.txt repairs, then nice-to-haves (security.txt, agent-card.json, humans.txt). - Verify: [AI Posture Audit](https://jwatte.com/tools/ai-posture-audit/), [Site Analyzer](https://jwatte.com/tools/analyzer/), [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/) and 2 more. Standard: RFC 8615 well-known URIs; RFC 9116 security.txt; llmstxt.org; humanstxt.org; RFC 9727; RFC 8414; RFC 9728; MCP SEP-2127; Agent Skills v0.2.0; Google A2A; Web Bot Auth; AGENTS.md; JSON Feed. - [ ] **5.12 llms.txt found** - Pass: /llms.txt (or /.well-known/llms.txt) returns HTTP 200 with a text body. - Warn: Missing: most tools warn ('No llms.txt', 'No llms.txt (open first-mover win)' for parishes), Mega SEO Analyzer pushes an impact 3 recommendation, Migration Analyzer reports 'llms.txt: not found' as informational, and the TRT clinic audit fails the home page without it. - Numbers and lists the tool uses: paths /llms.txt, /.well-known/llms.txt (Mega Analyzer, Mega Batch and the Analyzer parish check accept either); the Analyzer main check, Mega SEO Analyzer, Batch Analyzer and Migration Analyzer check /llms.txt only; TRT clinic audit also accepts a /llms.txt reference in the HTML (/\/llms\.txt/i); size cap 50000 chars when fetched (Analyzer). - Why: Llms.txt is the one-page map that tells ChatGPT, Claude and Perplexity what your site is about and which pages to reference, and AI retrieval engines preferentially cite sites that publish one. - Fix: Publish /llms.txt per llmstxt.org: a '# Site Name' title, a '> one-line description', then '## Pages' style sections with '- [title](https://absolute-url): description' lines; a parish would list Mass schedule and contact, a clinic its conditions, cost and locations. Generators: /tools/llms-txt-generator/ and /tools/ai-txt-gen/. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/) and 2 more. Standard: llmstxt.org. - [ ] **5.13 llms.txt is missing the required H1 title line** - Pass: Exactly one line in llms.txt is a Markdown H1. - Warn: More than one H1 line ('llms.txt has multiple H1 titles'). - Fail: Zero H1 lines. - Numbers and lists the tool uses: H1 regex /^# [^#]/ per line, file split on /\r?\n/ (shared module); Analyzer hasTitle /^#\s+.+/m. - Why: The H1 is the site or project name and the spec allows exactly one; without it the file is not compliant. - Fix: Start the file with '# `<Site or Project Name>`' on the first content line and demote any extra H1 to H2. - Verify: [AI Posture Audit](https://jwatte.com/tools/ai-posture-audit/), [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: llmstxt.org. - [ ] **5.14 llms.txt has no description blockquote** - Pass: At least one line in llms.txt is a Markdown blockquote describing the site. - Warn: Zero blockquote lines. - Numbers and lists the tool uses: regex /^>\s+.+/ (shared module and Analyzer hasDesc /^>\s+.+/m). - Why: AI retrieval uses this line as the canonical summary of the site. - Fix: Add a single-line '> `<description>`' directly under the H1. - Verify: [AI Posture Audit](https://jwatte.com/tools/ai-posture-audit/), [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: llmstxt.org. - [ ] **5.15 llms.txt has no H2 sections** - Pass: At least one Markdown H2 line groups the links. - Warn: Zero H2 lines. - Numbers and lists the tool uses: regex /^## [^#]/; the llms.txt Generator groups links by first path segment with root URLs under 'Core', ordered by URL count descending. - Why: Without sections the file is a flat link dump that retrievers cannot navigate. - Fix: Organize links under H2 sections such as '## Projects', '## Docs', '## Blog', '## About'. - Verify: [AI Posture Audit](https://jwatte.com/tools/ai-posture-audit/), [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: llmstxt.org. - [ ] **5.16 llms.txt has only `<n>` link item(s)** - Pass: At least 3 Markdown list-item links are present ('llms.txt structure valid (`<n>` sections, `<n>` links)'). - Warn: 1 or 2 link items. - Fail: Zero link items ('llms.txt has no link items'). - Numbers and lists the tool uses: link item regex /^\s*-\s+\[.+?\]$.+?$/; 0 fails, under 3 warns, 3 or more passes; typical range 5 to 20 link items; Analyzer requires a ## section with at least 3 lines matching /https?:\/\/\S+/ and hasUrls /https?:\/\//m, sections split on /\n(?=##\s)/; Single Site Gen and Site Migration Gen expect '## Pages' with 3 or more URL lines plus '## Resources'; generator lines are '- [`<title>`](`<url>`): `<description>`' with titles cut to 80 chars and descriptions to 160. - Why: Retrieval engines need somewhere to follow; most retrievable llms.txt files carry 5 to 20 links across Projects, Docs, Blog and About. - Fix: Add '- [name](url): description' link items until each main section lists your key pages. - Verify: [AI Posture Audit](https://jwatte.com/tools/ai-posture-audit/), [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: llmstxt.org. - [ ] **5.17 `<n>` relative link(s) in llms.txt** - Pass: Every link href in llms.txt starts with a URI scheme (https:, tel: and mailto: all count). - Warn: One or more hrefs are scheme-less (/path../path, path). - Numbers and lists the tool uses: href capture /\]$([^)]+)$/; scheme test /^[a-z][a-z0-9+.-]*:/i. - Why: LLMs do not resolve relative paths reliably when they fetch the file directly. - Fix: Use absolute URLs (https://...) for every link. - Verify: [AI Posture Audit](https://jwatte.com/tools/ai-posture-audit/), [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: llmstxt.org. - [ ] **5.18 Diff vs live /llms.txt (`<n>` bytes): `<n>` URL(s) to add, `<n>` URL(s) in live file but not in current sitemap** - Pass: The live /llms.txt link list matches the pages in the current sitemap, nothing to add and nothing stale. - Warn: The live endpoint returns HTML (likely a 404 page) so there is no file to diff. - Numbers and lists the tool uses: link URLs parsed with /^-\s+\[.*?\]$(\S+?)$/gm; a live body matching /<!doctype/i counts as no file; up to 20 URLs shown per list; pages with no `<title>` are dropped. - Why: An llms.txt that drifts from the sitemap sends AI retrievers to pages you removed and hides pages you added. - Fix: Add the listed sitemap URLs, remove the stale ones, or replace the live file with the generated one from /tools/llms-txt-generator/. - Verify: [LLMs.txt Generator](https://jwatte.com/tools/llms-txt-generator/). Standard: llmstxt.org. - [ ] **5.19 llms-full.txt found (`<n>`KB)** - Pass: /llms-full.txt is served and longer than 500 characters. - Warn: Present but 500 characters or fewer ('thin'), or absent (Analyzer; Mega Analyzer on editorial sites, with info on platform-limited sites). - Numbers and lists the tool uses: thin threshold 500 chars, recommendation 2000+ chars (Analyzer); generators require at least 2000 chars of per-page summaries (Single Site Gen, Site Migration Gen); Mega Analyzer checks only on editorial-context sites; path /llms-full.txt. - Why: Llms.txt is the summary; llms-full.txt gives AI models the full picture of your site, and retrieval engines preferentially cite sites that publish one. - Fix: Create /llms-full.txt with full descriptions, About, Pages, Key Content Themes, FAQs and Contact, aiming for 2000+ characters. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/). Standard: llmstxt.org. - [ ] **5.20 /.well-known/llms.txt RFC 8615 mirror served** - Pass: /.well-known/llms.txt is served (presence only; no tool compares its body to /llms.txt). - Warn: Missing ('No /.well-known/llms.txt mirror'); platform-limited sites get info. - Numbers and lists the tool uses: path /.well-known/llms.txt; Content-Type text/plain. - Why: Clients that follow well-known discovery look at the RFC 8615 location first. - Fix: Copy /llms.txt to /.well-known/llms.txt and serve it with Content-Type text/plain. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: RFC 8615. - [ ] **5.21 humans.txt identity file** - Pass: /humans.txt is served. - Warn: /humans.txt is not served (Mega Analyzer warn; downgraded to info when the platform cannot host root files); Batch Analyzer weights it 6 points in the GEO score. - Numbers and lists the tool uses: path /humans.txt. - Why: An identity file that tells people and machines who builds and runs the site. - Fix: Publish /humans.txt naming the team and site details. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: humanstxt.org. - [ ] **5.22 Link response headers (RFC 8288)** - Pass: The homepage response carries a Link header pointing at discovery resources. - Warn: No Link header (Mega Analyzer warns; Agent-Ready Audit scores it as a fail). - Fail: A Link header that uses a relation not registered with IANA is indistinguishable from a typo and does not count (Mega Analyzer fix rule). - Numbers and lists the tool uses: any Link header passes; recommended rel values api-catalog, mcp-server-card, agent-skills, llms-txt, sitemap (Agent-Ready Audit); IANA-registered relations only, api-catalog, service-desc, service-doc, describedby, author, privacy-policy, in one comma-separated header (Mega Analyzer fix rule); display truncated at 200 chars (Mega Analyzer) or 300 chars (Agent-Ready Audit). - Why: Agents that read response headers instead of parsing HTML find your discovery resources only through Link headers. - Fix: Add Link headers at the origin (Netlify _headers or netlify.toml, or your server config), for example </.well-known/api-catalog>; rel="api-catalog"; type="application/linkset+json", using only IANA-registered relations. - Verify: [Agent Ready Audit](https://jwatte.com/tools/agent-ready-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: RFC 8288; Cloudflare Agent Readiness Score (https://isitagentready.com/). - [ ] **5.23 Markdown for Agents declaration** - Pass: The page head declares a Markdown alternate: link rel=alternate with type text/markdown or an href ending in .md. - Numbers and lists the tool uses: selectors link[rel="alternate"][type*="markdown"], link[rel="alternate"][href$=".md"] (Mega Analyzer); regex /<link[^>]+rel=["']alternate["'][^>]+type=["']text\/markdown["']/i or /<link[^>]+rel=["']alternate["'][^>]+href=["'][^"']+\.md["']/i (Mega SEO Analyzer, informational when absent). - Why: Retrievers look for the declaration before negotiating, and Cloudflare's Agent Readiness Score rewards a Markdown alternate so agents can fetch structured text instead of parsing HTML. - Fix: Add `<link rel="alternate" type="text/markdown" href="page.md">` to the head and serve a .md companion; generator at /tools/markdown-for-agents-generator/. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: Markdown for Agents working draft; Cloudflare Agent Readiness Score (https://isitagentready.com/). - [ ] **5.24 Markdown content negotiation** - Pass: A request with Accept: text/markdown returns a Markdown variant of the page ('YES (active+passive)' when the head also declares it). - Warn: The head declares a Markdown alternate but the origin does not answer Accept: text/markdown ('PASSIVE ONLY'); or negotiation works but the Markdown response lacks Vary: Accept, so CDNs collapse the Markdown and HTML variants into one cache entry (Mega Analyzer warn, vary_accept_on_md_response). - Fail: Neither the declaration nor negotiation exists ('NO' in Mega Analyzer); Agent-Ready Audit scores a missing Markdown variant as a fail. - Numbers and lists the tool uses: supported when Content-Type matches /markdown/i, or the body looks like Markdown (/^---\n[\s\S]*?\n---\n/ front matter or /^#\s/m within the first 2000 chars) and is under 70% of the HTML length (body.length < html.length * 0.7); Vary and Content-Signal response headers recorded; Vary check = /\baccept\b/i against the Vary header of the Markdown response, run only when negotiation is supported; fix rule: Vary: Accept on both branches with HTML the default for */*. - Why: When an agent asks for text/markdown and gets it, it reads clean structured text instead of a full HTML page; Cloudflare's Markdown for Agents and equivalent origin negotiation both count. - Fix: Enable Cloudflare Markdown for Agents, or pre-generate Markdown per page and serve it when Accept prefers text/markdown, keeping HTML as the default and sending Vary: Accept on both branches. - Verify: [Agent Ready Audit](https://jwatte.com/tools/agent-ready-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: Markdown for Agents; Cloudflare Agent Readiness Score (https://isitagentready.com/). - [ ] **5.25 Per-page .md companion at `<path>`.md** - Pass: A sibling Markdown file exists at `<path>`.md (or negotiation already works) for content pages. - Warn: A content path has no companion (info when negotiation already works). - Numbers and lists the tool uses: content paths /^\/(blog|posts|articles|insights|news|guides|docs|library)\b/i; companion path = path minus trailing slash and .html plus '.md'; skipped for /; counts as present on status 200 with a /markdown/i Content-Type or /^#\s/m in the first 500 chars. - Why: AI clients can fetch the Markdown twin directly without content negotiation. - Fix: Generate a parallel /`<path>`.md for each post (Eleventy pagination or Astro getStaticPaths). - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **5.26 SPA shell with no server-rendered content** - Pass: The server HTML has no known SPA mount element, or the page renders at least one H1 and 150 or more words without JavaScript. - Warn: Not a shell but fewer than 300 words rendered ('THIN', Mega Analyzer AI Crawler View card). - Fail: A mount id (root, app, __next, __nuxt, __svelte, gatsby-focus-wrapper, ___gatsby, __remix) is present and the page has no H1 or fewer than 150 words. - Numbers and lists the tool uses: mount ids root, app, __next, __nuxt, __svelte, gatsby-focus-wrapper, ___gatsby, __remix; rendered = h1 count > 0 and wordCount >= 150 (Mega Analyzer, Analyzer); AI Crawler View card RENDERED at 300+ words, THIN below 300 with advice to add 200+ words. - Why: GPTBot, ClaudeBot, OAI-SearchBot and Googlebot read the server HTML and do not execute JavaScript, so an empty mount div is an empty page to them. - Fix: Server-render or pre-render the main content: renderToString injected into index.html at build time, a static-site generator (Eleventy, Astro, Next.js static export) or a prerender step. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: Cloudflare Agent Readiness Score (https://isitagentready.com/). - [ ] **5.27 Empty <`<tag>` id="`<id>`">, content injected by JS** - Pass: No known header, footer, main or framework wrapper element is empty in the server-rendered HTML. - Warn: The element with id site-header is effectively empty. - Fail: Site-footer, root, app, __next, gatsby-focus-wrapper, svelte, nuxt or `<main>` is effectively empty (critical); an empty bottom-bar is informational; Batch Analyzer deducts 5 points per critical shell, capped at 20. - Numbers and lists the tool uses: INJECTION_TARGETS: site-footer (critical), site-header (warn), root, app, __next, gatsby-focus-wrapper, svelte, nuxt (critical), bottom-bar (info); `<main>` checked separately; effectively empty = textContent with whitespace removed is 30 chars or fewer AND no descendant matching a,button,p,h1,h2,h3,h4,h5,h6,li,img,input,textarea,iframe. - Why: AI crawlers do not run JavaScript, so a header, footer or main region filled in by script is invisible to them, taking your navigation, contact details and landmarks with it. - Fix: Inline the critical content as static HTML; the script can still overwrite it on DOMContentLoaded for humans, which keeps the UX while fixing AI visibility. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/). - [ ] **5.28 Page is server-rendered, visible to AI retrievers** - Pass: The server HTML carries enough static text: body text of 200 characters or more, and an SSR score of 4 or more. - Warn: SSR score 2 or 3: partial server rendering with weak signals. - Fail: Body text under 200 characters on a page that has a `<title>`, or SSR score under 2 (renders empty without JavaScript, critical for AI eligibility). - Numbers and lists the tool uses: Audit Toolkit: `<title>` non-empty and body textContent (whitespace collapsed) under 200 chars; AI Posture Audit SSR score: +2 body text >= 300 chars, +1 at least 1 h1 and 1 h2, +1 at least 3 p elements, +1 article, main or [itemtype*=schema.org] present, +1 text to HTML ratio > 0.05, +1 a noscript element with more than 200 chars of text, -3 body text < 200 chars with 5 or more script elements; rendered >= 4, partial 2 to 3, shell < 2. - Why: AI retrievers (GPTBot, ClaudeBot, PerplexityBot, OAI-SearchBot, ChatGPT-User) index whatever text is in the HTML before any script runs. - Fix: Server-side render the main content, ship a meaningful noscript fallback, or pre-render at build time (Next.js getStaticProps, Astro, Eleventy, Hugo, plain HTML) so every primary heading and the lead paragraph are in the HTML. - Verify: [AI Posture Audit](https://jwatte.com/tools/ai-posture-audit/). - [ ] **5.29 NLWeb foundation present (RSS/Atom feed + schema)** - Pass: The head links an RSS, Atom or JSON feed and the page carries schema.org markup. - Warn: An editorial site is missing either (Mega Analyzer, Mega SEO Analyzer). - Fail: One or both missing scores 50 or 0 ('NLWeb foundation partial', Mega AEO Analyzer). - Numbers and lists the tool uses: Mega SEO Analyzer regex /<link[^>]+rel=["']alternate["'][^>]+type=["'](?:application\/(?:rss\+xml|atom\+xml|feed\+json))["']/i; Mega AEO Analyzer selectors link[rel="alternate"][type*="rss"], [type*="atom"], [type*="feed+json"] (+50) and script[type=application/ld+json] (+50); Mega Analyzer feed = link[type="application/rss+xml"] or link[type="application/atom+xml"] (a JSON Feed link alone does not count) plus at least one schema type, gated on editorial context or the foundation already being present. - Why: NLWeb-style agents index from a structured feed plus schema rather than the page UI. - Fix: Add `<link rel="alternate" type="application/rss+xml" href="/feed.xml">` to the head and JSON-LD schema.org markup describing the page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [Mega AEO Analyzer](https://jwatte.com/tools/mega-aeo-analyzer/). Standard: NLWeb (Microsoft); RSS/Atom; JSON Feed. - [ ] **5.30 JSON Feed (feed.json) discoverable** - Pass: The head links a JSON Feed or /feed.json is served (editorial sites). - Warn: Missing on an editorial site. - Numbers and lists the tool uses: link type application/feed+json or path /feed.json; gate editorial context. - Why: AI retrieval prefers JSON Feed over RSS. - Fix: Add `<link rel="alternate" type="application/feed+json" href="/feed.json">` and publish the feed. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: JSON Feed. - [ ] **5.31 WebMCP capability declaration present** - Pass: WebMCP markers exist, or the page has no agent-callable call to action (then not applicable, full credit). - Warn: A page with a CTA (book a demo, start trial, sign up, add to cart, checkout) has no WebMCP markers (Mega Analyzer warn; Mega AEO Analyzer score 60); Mega SEO Analyzer reports absence as informational. - Numbers and lists the tool uses: markers meta[name=webmcp], link[rel=webmcp], script[type=application/webmcp+json], [data-webmcp-action] (Mega Analyzer, Mega AEO Analyzer); regex /<meta[^>]+name=["']webmcp["']|<link[^>]+rel=["']webmcp["']|<script[^>]+type=["']application\/webmcp\+json["']|data-webmcp-action/i (Mega SEO Analyzer); agent CTA in Mega Analyzer = commerce surface or /(?:book a demo|start (?:free )?trial|sign up|subscribe|request a quote|get started|contact sales|book now)/i on the first 50000 chars of body text; agent CTA in Mega AEO Analyzer = /(?:add to cart|add-to-cart|buy now|checkout|book a demo|start (?:free )?trial|sign up|subscribe|request a quote|contact sales|book now)/i on the first 50000 chars of body text. - Why: WebMCP lets a site declare its transactional actions so agents call them directly instead of guessing from the UI; pure content pages have nothing to declare. - Fix: Declare actions (add-to-cart, book-demo, start-trial) with `<meta name="webmcp">` or `<script type="application/webmcp+json">`. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [Mega AEO Analyzer](https://jwatte.com/tools/mega-aeo-analyzer/). Standard: W3C WebMCP proposal. - [ ] **5.32 WebMCP tools registered with document.modelContext.registerTool** - Pass: The homepage HTML, or a WebMCP script it loads, calls registerTool( and references modelContext (document.modelContext, or the navigator.modelContext alias); not applicable when the page has no agent CTA. - Warn: Only provideContext( is found (removed from the WebMCP draft on 2026-03-05, pull request 132), a WebMCP marker is present with no registerTool( call, or a CTA page registers nothing (Agent-Ready Audit scores the missing case as a fail and the provideContext-only case as a warning). - Numbers and lists the tool uses: a pass needs both /modelContext/i and /\bregisterTool\s*\(/; legacy /\bprovideContext\s*\(/; markers /(?:navigator|document)\s*\.\s*modelContext/i and /data-webmcp-imperative/i; external scripts with src matching /webmcp|model-?context|agent-tools/i are read (at most 3). The Mega Analyzer tests only inline JavaScript and those scripts, so an article that mentions the API in its text, a code sample or JSON-LD is not counted as a registration. - Why: Chrome's WebMCP documentation and ChatGPT's Site tools describe registering tools one at a time with document.modelContext.registerTool; a page that only calls the removed provideContext() is probably registering nothing, and with a strict script-src 'self' CSP the call lives in an external file. - Fix: Register each tool on page load with document.modelContext.registerTool({name, description, inputSchema, execute}), and call provideContext({tools:[...]}) only as a fallback when registerTool is missing; spec at https://webmachinelearning.github.io/webmcp/. - Verify: [Agent Ready Audit](https://jwatte.com/tools/agent-ready-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: W3C WebMCP Community Draft; Cloudflare Agent Readiness Score (https://isitagentready.com/). - [ ] **5.33 agent-card.json (/.well-known/agent-card.json) served** - Pass: /.well-known/agent-card.json is served, or the site is not an agent target. - Warn: An agent target has no card (Mega Analyzer); Mega SEO Analyzer gives an impact 1 recommendation and Analyzer an info row. - Numbers and lists the tool uses: path /.well-known/agent-card.json; agent target (Mega Analyzer) = a published agent surface (MCP card, ai-catalog, agent skills, api-catalog, agent card, ai-plugin), or schema /SoftwareApplication|WebAPI|APIReference/, or host /^(api|developer|docs|graphql)\./i, or links /\/api\/(v\d+|reference|docs)|\/graphql\b|\/developer\b|\/api-docs\b/i, or copy /\b(api[- ]key|developer (portal|docs|api)|api documentation|generate (an )?api key|gpt action|openai plugin)\b/i in the first 60000 chars; generator expects name, description, capabilities, auth policy and endpoints. - Why: The A2A agent card is the machine-readable identity agent frameworks check first, declaring your capabilities to other agents. - Fix: Publish a small JSON at /.well-known/agent-card.json declaring name, description, capabilities, auth policy and agent-facing endpoints; skip it if you offer no agent-callable surface. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/). Standard: Google A2A Agent Card; Cloudflare Agent Readiness Score (https://isitagentready.com/). - [ ] **5.34 ai-plugin.json (/.well-known/ai-plugin.json) served** - Pass: /.well-known/ai-plugin.json is served, or the site is not an agent target. - Warn: An agent target has no manifest (Mega Analyzer); Analyzer reports presence only. - Numbers and lists the tool uses: path /.well-known/ai-plugin.json; generator expects name_for_model, description_for_model and an API spec. - Why: Older ChatGPT plugin and GPT-action integrations key off this path. - Fix: Publish the manifest if you have a GPT-action integration; otherwise absence is fine. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/). Standard: OpenAI plugin manifest. - [ ] **5.35 API Catalog (RFC 9727) at /.well-known/api-catalog** - Pass: /.well-known/api-catalog returns 200 with JSON whose linkset property is an array (Agent-Ready Audit); Mega Analyzer passes on the file being served, or when the site is not an agent target. - Warn: An agent target has no catalog (Mega Analyzer); Mega SEO Analyzer impact 1 recommendation. - Fail: The linkset array is missing or the path does not return 200 (Agent-Ready Audit); the file has no extension so Content-Type: application/linkset+json must be set explicitly by the server (Mega Analyzer fix rule, not probed). - Numbers and lists the tool uses: path /.well-known/api-catalog; media type application/linkset+json; body shape {"linkset":[{"anchor":"...","service-desc":[{"href":"...","type":"..."}]}]}; relations service-desc, service-doc, status. - Why: Agents discover your OpenAPI spec, docs and status endpoints declaratively without parsing markup. - Fix: Publish a linkset array with anchor and link relations per RFC 9727 Appendix A and set Content-Type: application/linkset+json at the server. - Verify: [Agent Ready Audit](https://jwatte.com/tools/agent-ready-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: RFC 9727; RFC 9264 linkset; Cloudflare Agent Readiness Score (https://isitagentready.com/). - [ ] **5.36 MCP Server Card (SEP-2127) at /.well-known/mcp/server-card.json** - Pass: A server card JSON with serverInfo, tools or transports is served at a known path (or the site is not an agent target). - Warn: An agent target has no card (Mega Analyzer); Mega SEO Analyzer impact 1 recommendation; Agent-Ready Audit scores absence as a fail. - Numbers and lists the tool uses: paths /.well-known/mcp/server-card.json, /.well-known/mcp.json, /.well-known/mcp/server-cards.json (Agent-Ready Audit tries them in that order); required fields serverInfo (name, version), transports (http-stream, websocket, webmcp), capabilities (tools, resources, prompts). - Why: The card advertises your tools to MCP clients; without it agents cannot programmatically discover MCP capabilities. - Fix: If you run an MCP server, publish /.well-known/mcp/server-card.json with serverInfo, transports and capabilities and validate it with /tools/mcp-server-audit/; never publish a card without a real server behind it. - Verify: [Agent Ready Audit](https://jwatte.com/tools/agent-ready-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: MCP SEP-2127 (modelcontextprotocol PR 2127); Cloudflare Agent Readiness Score (https://isitagentready.com/). - [ ] **5.37 MCP Server Card published on BOTH SEP-2127 + Cloudflare paths** - Pass: The card is served at both /.well-known/mcp.json and /.well-known/mcp/server-card.json. - Warn: Only one path is served. - Numbers and lists the tool uses: /.well-known/mcp.json (Cloudflare scorer), /.well-known/mcp/server-card.json (SEP-2127). - Why: Cloudflare's scorer reads one path and the SEP-2127 spec names the other. - Fix: Publish the same card at both paths. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: MCP SEP-2127; Cloudflare Agent Readiness Score (https://isitagentready.com/). - [ ] **5.38 Agent Skills index (v0.2.0) at /.well-known/agent-skills/index.json** - Pass: An index JSON whose skills property is an array is served (or the site is not an agent target). - Warn: An agent target has no index (Mega Analyzer); Mega SEO Analyzer impact 1 recommendation; Agent-Ready Audit scores absence as a fail. - Fail: An entry's sha256 digest does not match the SKILL.md it names, or was hand-computed (Mega Analyzer fix rule). - Numbers and lists the tool uses: paths /.well-known/agent-skills/index.json, legacy /.well-known/skills/index.json; each entry needs name, type, description, url and an optional sha256 that must match the file, computed at build time. - Why: The index lists SKILL.md files describing what an agent can do with your site. - Fix: Publish /.well-known/agent-skills/index.json per the v0.2.0 RFC with name, type, description and url per skill and build-time sha256 digests. - Verify: [Agent Ready Audit](https://jwatte.com/tools/agent-ready-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: Agent Skills Discovery RFC v0.2.0; Cloudflare Agent Readiness Score (https://isitagentready.com/). - [ ] **5.39 ARD manifest (AI catalog) at /.well-known/ard.json or /.well-known/ai-catalog.json** - Pass: A catalog is found the way Lighthouse finds it and parses as a JSON object (or the site is not an agent target and serves nothing there). - Warn: An agent target without a catalog; a file that is not a JSON object; a site that answers either address with a web page (HTTP 200), which Lighthouse reads as a broken catalog and scores 0 even on a site with no catalog. - Info: The fetch was blocked or did not answer, so nothing is concluded. - Numbers and lists the tool uses: Lighthouse 13.5.0 reads the first of robots.txt Agentmap, `<link rel="ai-catalog">`, Link rel="ai-catalog", /.well-known/ai-catalog.json; Lighthouse next (ARD v0.91) tries Agentmap, rel="ard" (tag, then header), /.well-known/ard.json, then the older names. - Why: ARD v0.91 readers must check /.well-known/ard.json and may skip the older path, while Lighthouse 13.5.0 still reads the older path. - Fix: Publish one file at /.well-known/ard.json and the same bytes at /.well-known/ai-catalog.json, as application/json with Access-Control-Allow-Origin: *. Make every /.well-known/ address you do not publish answer 404. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Agent Endpoint Inspector](https://jwatte.com/tools/agent-endpoint-inspector/). Standard: Agentic Resource Discovery (ARD) v0.91, https://agenticresourcediscovery.org/spec/ (read October 13, 2026). - [ ] **5.40 ARD manifest passes Lighthouse's ard-schema audit (13.5 and next)** - Pass: Score 1 with no issues under both Lighthouse 13.5.0 (the current release) and Lighthouse next (ARD v0.91). The tools run Lighthouse's own validator code for both and report two rows. - Warn: Any error (score 0) or warning (score 0.9). Each issue is explained in plain words with Lighthouse's own message under it. - Numbers and lists the tool uses: Lighthouse 13.5.0: top level only specVersion ("1.0"), host and entries; host only displayName (required), identifier, documentationUrl, logoUrl, trustManifest (a host.url or host.description scores 0); entry identifier /^urn:air:[a-zA-Z0-9.-]+(:[a-zA-Z0-9._-]+)+$/, displayName, type, exactly one of url or data, url as a full URI, updatedAt as a date-time, metadata values flat; a warning for any type outside application/ai-catalog+json, application/agent-card+json, application/a2a-agent-card+json, application/mcp-server-card+json, application/agent-skills+zip, application/agent-skills+gzip, text/markdown; profile="urn:air:agent-skills", application/ai-registry, application/ai-registry+json; representativeQueries 2 to 5. Lighthouse next: root and host open, application/* extension types information only, text/plain, text/html and a bare text/markdown still warnings, found only at the older address is a warning. - Why: One extra field in host fails the whole audit, and an entry without representative queries is not found by ARD search. - Fix: Keep host to its allowed fields; list only agent resources as entries (MCP server card, A2A agent card, one entry per SKILL.md) and keep other files (llms.txt, AGENTS.md, sitemaps, data) as flat URLs in an entry's metadata and in /.well-known/api-catalog; give every entry 2 to 5 real questions. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Agent Endpoint Inspector](https://jwatte.com/tools/agent-endpoint-inspector/). Standard: ARD v0.91 sections 3.3, 4 and 5.1; Lighthouse 13.5.0 (npm) ard-schema audit, Agentic Browsing category. - [ ] **5.41 ARD manifest discoverable by more than one route** - Pass: At least 2 of these exist: a catalog at a well-known path, a robots.txt Agentmap line, a `<link rel="ard">` (or rel="ai-catalog") in the head, a Link header with rel="ard" (or rel="ai-catalog"). - Warn: Fewer than 2 routes. - Numbers and lists the tool uses: Agentmap /^\s*Agentmap:\s*(\S+)/im; rel values ard and ai-catalog in a `<link>` tag or the Link header; threshold 2. - Why: Header readers, robots.txt readers and head readers are different clients. - Fix: Add 'Agentmap: https://`<domain>`/.well-known/ard.json' to robots.txt, `<link rel="ard" href="/.well-known/ard.json">` to the head and `</.well-known/ard.json>; rel="ard"` to the Link header (ARD v0.91 section 5.1). - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: ARD v0.91 section 5.1. - [ ] **5.42 auth.md served at site root with a conforming H1** - Pass: /auth.md is served and its H1 contains 'auth.md'. - Warn: Missing, or the H1 lacks the literal 'auth.md' (a heading like '# Authentication' is not recognised). - Numbers and lists the tool uses: H1 /^#\s+(.+)$/m must match /auth\.md/i; Cloudflare's scorer passes auth.md only when /.well-known/oauth-protected-resource also exists (their rule), which the tools reproduce but do not endorse for sites with no authorization server. - Why: The literal H1 is how a scanner tells a real auth.md from other Markdown, and an honest auth.md tells agents whether any auth is required at all. - Fix: Publish /auth.md headed '# auth.md for yourdomain.com' and state 'no auth required' explicitly when that is the case; do not invent OAuth metadata for an authorization server that does not exist. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: OAuth Protected Resource Metadata; MCP; Cloudflare Agent Readiness Score (https://isitagentready.com/). - [ ] **5.43 OAuth / OIDC discovery (RFC 8414)** - Pass: /.well-known/oauth-authorization-server or /.well-known/openid-configuration returns 200. - Warn: Agent-Ready Audit fails when neither path returns 200; Mega SEO Analyzer adds an impact 1 recommendation whenever /.well-known/oauth-authorization-server is absent (it does not probe openid-configuration). - Numbers and lists the tool uses: paths /.well-known/oauth-authorization-server, /.well-known/openid-configuration (Agent-Ready Audit passes on either; Mega SEO Analyzer probes only /.well-known/oauth-authorization-server). - Why: Agents need issuer and endpoint metadata to authenticate against protected APIs; it is intentionally absent on read-only public sites. - Fix: If you have protected APIs, publish issuer and endpoints per RFC 8414; a read-only site can leave this absent and should not fake it. - Verify: [Agent Ready Audit](https://jwatte.com/tools/agent-ready-audit/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: RFC 8414; OpenID Connect Discovery; Cloudflare Agent Readiness Score (https://isitagentready.com/). - [ ] **5.44 OAuth Protected Resource (RFC 9728)** - Pass: /.well-known/oauth-protected-resource returns 200. - Warn: Not served (Mega SEO Analyzer impact 1 recommendation; Agent-Ready Audit scores it as a fail). - Numbers and lists the tool uses: path /.well-known/oauth-protected-resource. - Why: Tells agents which authorization server issues tokens for this resource. - Fix: Required only for protected APIs; publish it when you have one, and leave it absent (a real 404 is correct) on a read-only site. - Verify: [Agent Ready Audit](https://jwatte.com/tools/agent-ready-audit/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: RFC 9728; Cloudflare Agent Readiness Score (https://isitagentready.com/). - [ ] **5.45 DNS-based agent discovery record published** - Pass: The zone publishes an SVCB record at _entries._agents or _search._agents (ARD v0.91), a real _index._agents SVCB record (DNS-AID), or a _catalog._agents TXT record with url=https://`<domain>`/... (an early ARD draft form, still accepted and labeled as such), or the site is not an agent target. - Warn: An agent target has neither record; a wildcard zone that answers a random control name is called out because it gives scanners a false pass; TXT present without SVCB is noted. - Numbers and lists the tool uses: TXT at _catalog._agents.`<domain>` matching /url\s*=\s*https?:\/\//i; SVCB or HTTPS records at _entries._agents, _search._agents, _index._agents, _a2a._agents and _mcp._agents under `<domain>`; DNSSEC = DNSKEY records > 0; every *.netlify.app answers '1 . alpn=h2' at _index._agents so control matches are discarded; Cloudflare's scored value is the SVCB half. - Why: DNS lets agents find your catalog before touching the web server, but several managed DNS providers support neither SVCB nor DNSSEC. - Fix: Where your DNS host supports SVCB, publish one at _entries._agents.`<domain>` pointing at the catalog (ARD v0.91 section 5.1) and sign the zone; otherwise treat DNS as unreachable, since it is optional and Lighthouse does not check it. No ARD version defines a TXT format; an existing _catalog._agents TXT record does no harm and should point at /.well-known/ard.json. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: ARD v0.91 section 5.1; DNS-AID draft; Cloudflare Agent Readiness Score (https://isitagentready.com/). - [ ] **5.46 AGENTS.md (root), Agentic AI Foundation spec** - Pass: /AGENTS.md is served, or the site has no developer surface. - Warn: A site with a developer surface has none (Mega Analyzer; platform-limited sites get info); Mega SEO Analyzer impact 1 recommendation. - Numbers and lists the tool uses: path /AGENTS.md; developer surface = agent target, or an api-catalog, or links /\/(docs|developer|api[\-_]?docs|reference)\b/i, and not a local-service schema site, and not an editorial site whose primary type is /^(NewsArticle|BlogPosting|Article|Newsletter|TechArticle|ScholarlyArticle|Periodical|Blog|CollectionPage|ItemList|WebPage)$/ unless SoftwareApplication, WebApplication, APIReference or WebAPI is also declared. - Why: Read by 35+ AI coding tools (Cursor, Claude Code, Codex, Copilot, Gemini CLI) for setup, conventions and test commands. - Fix: Publish /AGENTS.md with ## Setup, ## Test, ## Conventions and ## Gotchas; skip it if your site has no developer or repo surface (generator at /tools/claude-md-generator/). - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: https://agents.md/. - [ ] **5.47 Root /index.md marker present** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: path /index.md; counts as present on status 200 with a /markdown/i Content-Type or /^#\s/m in the first 500 chars; rendered only when present. - Why: Agents fetch Markdown shortcuts before crawling the site map (the Joost.blog pattern of sibling .md files). - Fix: Publish /index.md as a Markdown twin of the home page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **5.48 llms-ctx.txt (FastHTML llmstxt.org extension)** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: path /llms-ctx.txt; Mega Analyzer checks only docs-like sites (llms-full.txt present, or more than 5 Markdown alternate links, or more than 8000 words, or schema /TechArticle|APIReference|HowTo|LearningResource/); Mega SEO Analyzer impact 1 recommendation when absent. - Why: An XML-tagged reading list that wraps your linked .md pages so a docs or knowledge-base site can be loaded into one prompt. - Fix: Publish /llms-ctx.txt wrapping the linked .md pages in `<doc>` tags (generator at /tools/llms-txt-generator/). - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: llmstxt.org (FastHTML extension). - [ ] **5.49 llms-ctx-full.txt (FastHTML llmstxt.org extension)** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: path /llms-ctx-full.txt; same docs-site gate as llms-ctx.txt. - Why: The full-corpus XML-tagged variant of llms-ctx.txt. - Fix: Publish /llms-ctx-full.txt alongside llms-ctx.txt on docs sites. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: llmstxt.org (FastHTML extension). - [ ] **5.50 JSON Feed v1.1 fields (language, authors[], feed_url)** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: checked only when feed.json exists; version must match /1\.1/ and at least one of authors[] non-empty, language or feed_url must be present; parse errors reported as info. - Why: Author and locale fields give AI retrievers attribution and language signals. - Fix: Set version to https://jsonfeed.org/version/1.1 and add language, authors and feed_url. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: JSON Feed 1.1. - [ ] **5.51 Web Bot Auth signature directory (informational)** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: path /.well-known/http-message-signatures-directory returns 200; neutral in the Agent Readiness Score (Cloudflare treats it as neutral) and unscored in Agent-Ready Audit (pass when 200, info otherwise); Mega Analyzer adds a passing row only when the directory is present and never a failing one; Mega SEO Analyzer impact 1 recommendation when absent. - Why: Public keys for cryptographically signed bot identities; relevant only if you operate friendly bots, and honestly absent on a read-only content site. - Fix: No fix needed on a content site; publish the directory only if you run bots whose identity others should verify. - Verify: [Agent Ready Audit](https://jwatte.com/tools/agent-ready-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: IETF Web Bot Auth / HTTP Message Signatures draft; Cloudflare Agent Readiness Score (https://isitagentready.com/). - [ ] **5.52 `<n>` bot(s) use the "allow crawl, deny training" pattern, this is intentional and not a conflict** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: a bot counts when robots.txt resolves to allow and ai.txt resolves to disallow (bot-specific ai.txt group, else the ai.txt '*' group); up to 10 bots listed; generator presets: open-web all crawl=allow train=allow, closed all disallow, aeo-friendly per bot (crawl/train): GPTBot allow/disallow, OAI-SearchBot allow/allow, ChatGPT-User allow/allow, ClaudeBot allow/disallow, Claude-Web allow/allow, anthropic-ai allow/disallow, Google-Extended allow/disallow, PerplexityBot allow/allow, Meta-ExternalAgent allow/disallow, Applebot-Extended allow/disallow, Bytespider disallow/disallow, Amazonbot allow/disallow, CCBot allow/disallow, cohere-ai allow/disallow, YouBot allow/allow, DuckAssistBot allow/allow, MistralAI-User allow/allow, Diffbot allow/disallow, Timpibot allow/allow, others crawl=allow train=disallow; AI Posture Audit aeo-friendly preset: crawl=disallow only for Bytespider, train=disallow for GPTBot, anthropic-ai, Google-Extended, Applebot-Extended, Meta-ExternalAgent, CCBot, cohere-ai, Amazonbot, Bytespider; intent labels: allow/disallow = 'AEO-friendly, train-hostile', allow/allow = 'Fully open', disallow/disallow = 'Fully closed', disallow/allow = 'Train-allowed but crawl-denied (unusual)'. - Why: Robots.txt governs crawling and ai.txt governs training, so letting a bot fetch pages for answers while refusing training use is the intended AEO-friendly posture, not a misconfiguration; only 'train allowed but crawl denied' is odd because a bot cannot train on pages it cannot crawl. - Fix: No change needed for the allow-crawl, deny-train pattern; re-check any bot labelled unusual. - Verify: [AI Posture Audit](https://jwatte.com/tools/ai-posture-audit/). - [ ] **5.53 Agent Readiness Score** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: reproduces Cloudflare's score: category score = round(passed / (passed + failed) * 100) with neutral rows excluded, overall = round(totalPassed / totalCounted * 100), null when nothing is counted (Agent-Ready Audit reports 0); Mega Analyzer card: 80+ good, 50 to 79 ok, under 50 bad; Agent-Ready Audit levels over 12 scored probes: 80+ Level 5 Agent-Native, 60+ Level 4 Agent-Friendly, 40+ Level 3 Agent-Aware, 20+ Level 2 Discoverable, under 20 Level 1 Basic Web Presence, category pill pass when passed equals total, fail when passed is 0; categories: Discoverability (robots.txt, sitemap.xml, Link header, DNS-AID SVCB), Content (Markdown negotiation), Bot Access Control (AI bot rules, Content-Signal, Web Bot Auth neutral), API / Auth / MCP / Skills (API Catalog, OAuth discovery, OAuth Protected Resource, auth.md plus PRM, MCP Server Card, A2A Agent Card, Agent Skills, WebMCP, ARD manifest), Commerce (x402, MPP, UCP, ACP, AP2 derived from the A2A card) dropped entirely off a commerce surface; Web Bot Auth and the 4 commerce protocols are never counted by Agent-Ready Audit; informational rows are not counted (Agent-Ready Audit rows added with scored=false; Mega Analyzer info-severity rows map to neutral); measured example 7 of 15 = 47; fix-prompt keys: ard_catalog_present, ard_catalog_conformance, ard_alternate_discovery, auth_md_present, content_signal_group_coverage, dns_agent_discovery, dns_aid_dnssec, api_catalog_present, mcp_server_card_present, agent_skills_index_present, content_signal_declared, link_response_header, mcp_card_dual_path, webmcp_capability_declared. - Why: The score explains why a client's site 'says 47' on isitagentready.com and makes disagreements between checkers visible. - Fix: Raise the passing rows in each category using the per-row fixes above, following two rules: never publish a manifest that points at something that 404s (no MCP card without an MCP server, no OAuth metadata when nothing is protected, an honest auth.md), and generate every discovery file from one source of truth at build time; re-run /tools/agent-ready-audit/?url=`<url>`&autorun=1 to confirm. - Verify: [Agent Ready Audit](https://jwatte.com/tools/agent-ready-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: Cloudflare Agent Readiness Score (https://isitagentready.com/). - [ ] **5.54 Meta-WebIndexer allowed by robots.txt (Meta AI citations)** - Pass: robots.txt allows the meta-webindexer token at the page path and at /, through its own group or the * group. - Fail: Either path is disallowed, or robots.txt answers a 5xx or no response, which RFC 9309 treats as complete disallow. - Numbers and lists the tool uses: the RFC 9309 parser shared at /js/rfc9309-robots.js: a group starts at a User-agent line and runs across blank lines, comments and other records until a User-agent line that follows a rule; the product token is the leading run of letters, underscores and hyphens, matched case-insensitively; every group naming the token is combined, else every * group; the longest match in octets wins and Allow wins a tie; * matches any run of characters and a trailing $ anchors; an empty Disallow is no rule; /robots.txt is always allowed; a 4xx robots.txt means allow-all. - Why: Meta says allowing Meta-WebIndexer "helps us cite and link to your content in Meta AI's responses". It is the one documented lever for Meta AI citations. Blocking Meta-ExternalAgent (training) is a separate decision and does not need it. - Fix: Allow meta-webindexer on the pages you want cited. If it has its own group, remove the blocking Disallow there; if it falls to *, narrow the * rule. - Verify: [Meta AI Crawler + Link Preview Audit](https://jwatte.com/tools/meta-ai-crawler-audit/). Standard: RFC 9309 (https://www.rfc-editor.org/rfc/rfc9309); Meta Web Crawlers, Updated May 21, 2026 (https://developers.facebook.com/docs/sharing/webmasters/web-crawlers/). - [ ] **5.55 facebookexternalhit allowed by robots.txt at this path (link previews)** - Pass: facebookexternalhit is allowed at the page path. - Warn: It is disallowed, so link previews on Facebook, Instagram and Messenger will be blank. - Numbers and lists the tool uses: the parser from the check above; a table beside it gives, for facebookexternalhit, meta-webindexer, meta-externalagent, meta-externalfetcher and meta-externalads, the group each obeys, the verdict with the deciding rule, and any Content-Signal line in that group (informational: a contentsignals.org convention Meta does not document reading); Meta-ExternalFetcher disallowed is informational because Meta says it "may bypass robots.txt rules"; FacebookBot and facebookcatalog groups are reported as legacy and harmless. - Why: facebookexternalhit builds the title, description and image of every shared link, and Meta's crawler page names a robots.txt Disallow as the way to block its crawlers. - Fix: Allow facebookexternalhit on every page people share. - Verify: [Meta AI Crawler + Link Preview Audit](https://jwatte.com/tools/meta-ai-crawler-audit/). Standard: RFC 9309; Meta Web Crawlers, Updated May 21, 2026 (https://developers.facebook.com/docs/sharing/webmasters/web-crawlers/). - [ ] **5.56 Named Meta groups keep the * Disallow rules** - Pass: The * group has no Disallow lines, or every group naming a Meta token also blocks each path the * group disallows. - Warn: A group naming facebookexternalhit, meta-webindexer, meta-externalagent, meta-externalfetcher or meta-externalads can fetch a path the * group disallows. Named groups for other crawlers with the same gap are listed as informational. - Numbers and lists the tool uses: each * Disallow pattern becomes a sample path (* turns into x and a trailing $ is dropped), is confirmed blocked for *, then is tested through the parser for the named token. - Why: A crawler obeys only the group that names it (RFC 9309 section 2.2.1), so a named group with Allow: / quietly reopens /admin/, /thank-you/ and everything else the * group closed. - Fix: Repeat every * Disallow line inside each named group, or delete a named group that only says Allow: /. - Verify: [Meta AI Crawler + Link Preview Audit](https://jwatte.com/tools/meta-ai-crawler-audit/). Standard: RFC 9309 section 2.2.1. - [ ] **5.57 No robots.txt rules stranded below a named group** - Pass: No Allow or Disallow line sits below a blank line or a comment inside a named group. - Warn: One or more rules below a blank line or comment bind to the named group above them; the tool gives the line numbers and the group. The same layout inside the * group is informational, because those rules still bind to *. - Numbers and lists the tool uses: a rule is stranded when its group already has rules and a blank or comment-only line comes between; every later rule of that group belongs to the same stranded run until the next User-agent line. - Why: Blank lines and comments do not end a group; only a User-agent line does. A Disallow meant for everyone, written below the last named group, applies to that one crawler. - Fix: Move rules meant for everyone under User-agent: * and repeat them in each named group. - Verify: [Meta AI Crawler + Link Preview Audit](https://jwatte.com/tools/meta-ai-crawler-audit/). Standard: RFC 9309. - [ ] **5.58 robots.txt answers 200 or 4xx, as text, under 500 KiB** - Pass: robots.txt answers 200 with a text file. - Warn: A 5xx from the site (crawlers must then assume complete disallow), an HTML page in place of a text file, or a file over 512,000 bytes (500 KiB). No answer to the audit's own request is informational ("not verified"), because it says nothing about what Meta's crawlers get. - Numbers and lists the tool uses: a 4xx is informational (allow-all); HTML is detected from a text/html Content-Type or a body that starts with a doctype or an html tag. - Why: RFC 9309 says a crawler "MUST assume complete disallow" when robots.txt is unreachable because of server or network errors, and requires crawlers to parse at least the first 500 KiB, so rules past that point may be ignored. - Fix: Serve /robots.txt as text/plain with a 200, or a 404 if you want no rules at all. - Verify: [Meta AI Crawler + Link Preview Audit](https://jwatte.com/tools/meta-ai-crawler-audit/). Standard: RFC 9309. - [ ] **5.59 Meta's crawlers and WhatsApp get the page (no 403, 429, 503 or challenge)** - Pass: facebookexternalhit, Meta-WebIndexer and WhatsApp get the page. - Warn: A bare 429 with no vendor challenge header (often the audit's own burst of requests; re-run), any other non-2xx status for facebookexternalhit, Meta-WebIndexer or WhatsApp (named with its status), or Meta-ExternalAgent blocked at the HTTP layer while robots.txt allows it. A user agent the audit could not reach is reported as not verified, never as a pass or a failure. - Fail: facebookexternalhit, Meta-WebIndexer or WhatsApp gets a 403 or 503, a cf-mitigated or x-amzn-waf-action header, or a page titled "Just a moment" or "Attention Required". - Numbers and lists the tool uses: user agents sent: facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php), meta-webindexer/1.1, meta-externalagent/1.1, meta-externalfetcher/1.1, meta-externalads/1.1, WhatsApp/2.22.20.72 A and a stock Chrome 153 on Linux baseline; the comparison with the baseline (title, og:title, og:image, final URL, body within 10%) is labelled INFERRED and the data-center Chrome row REPORTED, and neither is scored. - Why: A firewall rule or bot-fight mode that challenges these user agents blanks every preview and shuts out the crawler Meta names for Meta AI citations, whatever robots.txt says. - Fix: Let the tokens through the CDN or WAF, matching each as a case-insensitive substring of the User-Agent. Do not build IP allowlists: Meta's crawler page no longer explains how to verify its IP addresses; that section is gone from the May 21, 2026 revision. - Verify: [Meta AI Crawler + Link Preview Audit](https://jwatte.com/tools/meta-ai-crawler-audit/). Standard: Meta Web Crawlers, Updated May 21, 2026 (https://developers.facebook.com/docs/sharing/webmasters/web-crawlers/); WhatsApp link previews. ## 6. Local: the Business Profile, the map pin and the directories For a business with a door, the map pin outranks the homepage. This section is the Google Business Profile, name-address-phone consistency across every directory that lists you, the map listing itself, and Apple's equivalent. **Verify this section with:** [Schema Validator](https://jwatte.com/tools/schema-validator/), [Rich Results Eligibility Audit](https://jwatte.com/tools/rich-results-eligibility-audit/), [GBP + Review Signal Audit](https://jwatte.com/tools/gbp-review-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [Trust Signal Surface](https://jwatte.com/tools/trust-signal-surface-audit/), [About-Page Conversion Audit](https://jwatte.com/tools/about-page-conversion-audit/), [Mega GEO Analyzer](https://jwatte.com/tools/mega-geo-analyzer/), [Site Analyzer](https://jwatte.com/tools/analyzer/), [E-E-A-T Generator](https://jwatte.com/tools/eeat-generator/), [Google Maps](https://jwatte.com/tools/google-maps-audit/), [Local Directories](https://jwatte.com/tools/local-directories/), [NAP Consistency](https://jwatte.com/tools/nap-consistency/), [Apple Business](https://jwatte.com/tools/apple-business-audit/), [SERP Features](https://jwatte.com/tools/serp-features/). - [ ] **6.1 LocalBusiness: all required fields present (name, address, telephone)** - Pass: A LocalBusiness node (or a local subtype) carries name, address and telephone, and the name is 2 to 80 characters. - Warn: Schema Validator warns when a recommended field (telephone, openingHours, geo or image) is missing, except that openingHoursSpecification on a local-business subtype satisfies the openingHours recommendation; GBP Review Audit warns when the JSON-LD has no name field. - Fail: Schema Validator fails a node missing name or address; the Rich Results audit fails a node typed exactly LocalBusiness that is missing any of name, address or telephone. - Numbers and lists the tool uses: Required name, address; recommended telephone, openingHours, geo, image, with the openingHours warning suppressed when openingHoursSpecification is set and @type matches /^(LocalBusiness|SelfStorage(?:Facility)?|LodgingBusiness|Hotel|MedicalBusiness|ProfessionalService|HomeAndConstructionBusiness|RealEstateAgent|AutomotiveBusiness|MovingCompany|TravelAgency|FoodEstablishment|HealthAndBeautyBusiness|Plumber|Electrician|HVACBusiness|RoofingContractor|InsuranceAgency|FinancialService|LegalService|Dentist|Physician|Restaurant)$/ (Schema Validator); required name, address, telephone and recommended image, openingHoursSpecification, priceRange, geo, applied only to nodes typed exactly LocalBusiness, subtypes such as Restaurant or Dentist do not match (Rich Results Eligibility Audit); name regex /"name"\s*:\s*"([^"\\]{2,80})"/i, 2 to 80 characters with no double quotes or backslashes inside (GBP Review Audit); the Schema Fix Bundle LocalBusiness preset emits @id `<origin>`#localbusiness, name, image, PostalAddress (streetAddress, addressLocality, addressRegion, postalCode, addressCountry US), telephone, email, url, openingHoursSpecification Monday to Friday 09:00 to 17:00, geo GeoCoordinates, priceRange $$, aggregateRating and sameAs placeholders for Google Maps, Yelp and Facebook, with the required label name, address, telephone, openingHours, geo (optional). - Why: Local rich results and the map pack read your business name, address and phone from this node, and the name must match your Google Business Profile exactly, including punctuation, Inc or LLC, and capitalization. - Fix: Add one LocalBusiness node (or the right subtype) with name, PostalAddress and telephone, then add image, openingHoursSpecification, priceRange and geo when they are true. Where you declare openingHoursSpecification you may also add a short openingHours string such as Mo-Su 08:00-20:00, since both forms are valid and complementary. - Verify: [Schema Validator](https://jwatte.com/tools/schema-validator/), [Rich Results Eligibility Audit](https://jwatte.com/tools/rich-results-eligibility-audit/), [GBP + Review Signal Audit](https://jwatte.com/tools/gbp-review-audit/). Standard: Google Local Business structured data; schema.org LocalBusiness. - [ ] **6.2 Contact: tel/mailto links and visible phone number** - Pass: The page has a clickable tel: link and the phone number spelled out as plain text (the footer counts); the Mega Analyzer also looks for a mailto: link. - Warn: Mega SEO Analyzer warns when neither a tel: link nor a phone pattern is found; GBP Review Audit warns when the phone exists only inside a tel: link or schema and is not spelled out in body text; on pages that are not local-like the Mega Analyzer reports a missing signal as informational. - Fail: Mega Analyzer fails a local-like page (a local-business schema type or a Local- or YMYL- vertical) that lacks the signal; Trust Signal Surface Audit fails when the /contact page has no phone pattern. - Numbers and lists the tool uses: Mega Analyzer: a[href^=tel:], a[href^=mailto:], phone regex /($\d{3}$\s*\d{3}[- .]?\d{4}|\b\d{3}[- .]?\d{3}[- .]?\d{4}\b|\+\d{1,3}[ -]?\d{3}[ -]?\d{3}[ -]?\d{4})/ on body plus footer text; Mega SEO Analyzer regex /tel:\+?\d|[$\[]?\d{3}[$\]]?[\s\-\.]?\d{3}[\s\-\.]?\d{4}/i on the HTML; GBP Review Audit body regex /\b(?:$?\d{3}$?[\s.\-]?\d{3}[\s.\-]?\d{4})\b/ on body text, counted only when the tel: or schema phone check already passed; Trust Signal Surface Audit regex /(\+?\d[\d\s().-]{7,}\d)/ on the /contact page. - Why: Maps, voice assistants and Google Business Profile verification read the phone from visible page text, and a tap-to-call link is how mobile visitors reach you. - Fix: Put the phone number in plain text in the footer and on the contact page, wrap it in an a href="tel:+1..." link, and add a mailto: link for email. - Verify: [GBP + Review Signal Audit](https://jwatte.com/tools/gbp-review-audit/), [Trust Signal Surface](https://jwatte.com/tools/trust-signal-surface-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). - [ ] **6.3 Contact: visible physical address** - Pass: A full street address (or a PO box) appears as plain text on the page, or PostalAddress JSON-LD carries streetAddress, postalCode or addressLocality. - Warn: Trust Signal Surface Audit warns when neither the homepage nor the audited page body shows a street address or PO box; Mega SEO Analyzer and About Page Conversion Audit report a missing address signal as informational. - Fail: Mega Analyzer fails a local-like page without an address; Trust Signal Surface Audit fails when the /contact page has no street address or PO box. - Numbers and lists the tool uses: Mega Analyzer: addrFull /\b\d{1,5}\s+[A-Z][a-zA-Z.]+(?:\s+[A-Z][a-zA-Z.]+)*,?\s+[A-Z][a-zA-Z.\s]+,\s*[A-Z]{2}\s+\d{5}/, or streetLine /\b\d{1,5}\s+[A-Z][a-zA-Z.']{2,30}(?:\s+[A-Z][a-zA-Z.']{2,30})*\s+(Street|St\.?|Avenue|Ave\.?|Boulevard|Blvd\.?|Road|Rd\.?|Drive|Dr\.?|Lane|Ln\.?|Way|Highway|Hwy\.?|Parkway|Pkwy\.?|Court|Ct\.?|Place|Pl\.?|Circle|Cir\.?|Terrace|Ter\.?|Trail|Trl\.?|Square|Sq\.?)\b/i plus a ZIP /\b\d{5}(?:-\d{4})?\b/ nearby or a state name (the 50 US states plus D.C., Ontario, Quebec, British Columbia, Alberta), or PostalAddress JSON-LD; Mega SEO Analyzer /\b(street|ave|avenue|blvd|road|drive|lane|highway)\b|<address/i; Trust Signal Surface Audit on the /contact page /\b\d{1,5}\s+[A-Z][a-z]+\s+(St|Ave|Blvd|Rd|Way|Lane|Dr|Ct|Pl)\b|PO\s*Box\s+\d+/ and on home plus page body ADDR_RE /\b\d{1,5}\s+[A-Z][a-zA-Z.]+(?:\s+[A-Z][a-zA-Z.]+)*\s+(Street|St|Avenue|Ave|Boulevard|Blvd|Road|Rd|Way|Lane|Ln|Drive|Dr|Court|Ct|Place|Pl|Parkway|Pkwy|Highway|Hwy|Terrace|Ter|Circle|Cir)\b\.?/ or /PO\s*Box\s+\d+/i; About Page Conversion Audit /\b\d{1,5}\s+[\w\s]+(street|st\.|avenue|ave\.|blvd|road|rd\.|drive|dr\.|way|lane|ln\.),/i or ZIP /\b\d{5}(-\d{4})?\b/. - Why: Google Maps and Apple Maps parse the address from plain text, and a consistent visible address is a core local ranking and trust signal. - Fix: Print the full street address (street, city, state, ZIP) in the footer and on the contact page inside an address element, and mirror it in PostalAddress inside your LocalBusiness JSON-LD. - Verify: [Trust Signal Surface](https://jwatte.com/tools/trust-signal-surface-audit/), [About-Page Conversion Audit](https://jwatte.com/tools/about-page-conversion-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: schema.org PostalAddress. - [ ] **6.4 Contact: visible business hours** - Pass: Hours appear as plain text: day-prefixed ranges, a time range, 24/7 wording or "by appointment" (Mega Analyzer), or a day range plus time range or an always-open phrase (Trust Signal Surface Audit). - Warn: Trust Signal Surface Audit warns when no hours pattern is found in the home and page body; on pages that are not local-like the Mega Analyzer reports the gap as informational. - Fail: Mega Analyzer fails a local-like page with no visible hours. - Numbers and lists the tool uses: Mega Analyzer: hoursDayPrefix /\b(mon|monday|tue|tuesday|wed|wednesday|thu|thursday|fri|friday|sat|saturday|sun|sunday|weekdays|weekends)\b[^.<]{0,30}\d{1,2}(:\d{2})?\s?(am|pm)?\s?[-`<en dash>`to]{1,3}\s?\d{1,2}(:\d{2})?\s?(am|pm)?/i, hoursNoDay /\b\d{1,2}(:\d{2})?\s?(am|pm)\s?(?:to|-|`<en dash>`|)\s?\d{1,2}(:\d{2})?\s?(am|pm)\b/i, hoursAlways /\b(24\s?\/?\s?7|24\s?hours|open\s+(all\s+)?(day|night|24|7\s+days))/i, hoursByAppt /\bby\s+appointment(\s+only)?\b/i, or openingHours / openingHoursSpecification anywhere in the HTML; Trust Signal Surface Audit: DAY (?:Mon|Tue|Tues|Wed|Thu|Thur|Thurs|Fri|Sat|Sun|Monday|Tuesday|Wednesday|Thursday|Friday|Saturday|Sunday), TIME \d{1,2}(?::\d{2})?\s*(?:am|pm|AM|PM), hoursRe DAY(?:\s*[`<en dash>`\-to]+\s*DAY)?\s*[:\-`<en dash>`]?\s*TIME\s*[`<en dash>`\-to]+\s*TIME, hoursAlways as above. - Why: Hours in body text feed Google Business Profile and voice questions like "are they open now", and "by appointment only" is a legitimate model that counts. - Fix: Render hours in body text, for example "Mon to Fri 9am to 5pm" or "By appointment only", and add openingHoursSpecification in schema. - Verify: [Trust Signal Surface](https://jwatte.com/tools/trust-signal-surface-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org OpeningHoursSpecification. - [ ] **6.5 NAP consistency** - Pass: Score 80 or more: at least one real phone number and one street address on the page, plus either a business-name marker or one phone number repeated consistently. - Warn: Score 60 to 79, for example phones and addresses found but no name marker and no repeated phone. - Fail: Score under 60. - Numbers and lists the tool uses: phone regex /$\d{3}$\s?\d{3}-\d{4}|\b\d{3}-\d{3}-\d{4}\b/g, dropping any match of the placeholder regex /555[- .]?01\d{2}|^$?(\d)\1{2}$?[- .]?\1{3}[- .]?\1{4}$|123[- .]?456[- .]?7890/; email regex /[a-z0-9._-]+@[a-z0-9.-]+\.[a-z]{2,}/gi dropping /example\.(com|org|net)$|yourdomain|yoursite|email@/i (emails are counted in the detail only and do not score); address regex /\b\d{1,5}\s+[A-Z][a-zA-Z]+\s+(St|Ave|Rd|Blvd|Dr|Ln|Way|Ct|Pl)\b/g; name regex /\borganizationname|companyname|"name":\s*"/i; +30 if any phone, +30 if any address, +20 if name marker, +20 if every phone found is the same number and there is more than one, capped at 100; pass 80 or more, warn 60 to 79, fail under 60. - Why: Name, address and phone shown the same way on every page is the first thing local search checks against your listings. - Fix: Display name, address and phone prominently in the footer and on the contact page, and use one phone and address format on every page. - Verify: [Mega GEO Analyzer](https://jwatte.com/tools/mega-geo-analyzer/). - [ ] **6.6 Phone number in tel: link + schema** - Pass: The business node (LocalBusiness or Organization) has a telephone field; GBP Review Audit also accepts an a[href^="tel:"] link on the page. - Warn: Schema Validator warns when a LocalBusiness node lacks the recommended telephone. - Fail: Rich Results audit fails a node typed exactly LocalBusiness without telephone; Mega Analyzer fails when a LocalBusiness or Organization node exists without telephone on laundromat, self-storage, car wash, HVAC, electrician, handyman and hotel sites. - Numbers and lists the tool uses: Mega Analyzer regex /"telephone"\s*:/i inside a LocalBusiness or Organization node; HVAC sites expect E.164 format; GBP Review Audit /"telephone"/i on the JSON-LD text or selector a[href^="tel:"]. - Why: Click-to-call in the map pack and mobile listing clicks come from this field, and a missing phone is the biggest friction point for mobile visitors. - Fix: Add telephone in E.164 form (+1XXXXXXXXXX) to the business node and keep a visible tel: link on the page. - Verify: [GBP + Review Signal Audit](https://jwatte.com/tools/gbp-review-audit/), [Schema Validator](https://jwatte.com/tools/schema-validator/), [Rich Results Eligibility Audit](https://jwatte.com/tools/rich-results-eligibility-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org telephone. - [ ] **6.7 Street address in schema** - Pass: The business JSON-LD has a PostalAddress with streetAddress. - Fail: Mega Analyzer fails on home, contact, location, office or facility pages of its gated verticals; men's health clinic location pages also fail when streetAddress or addressLocality is an empty string; HVAC, electrician and handyman nodes fail only when neither PostalAddress nor areaServed is present. - Numbers and lists the tool uses: GBP Review Audit /"address"\s*:\s*\{[^}]*"streetAddress"/i; Mega Analyzer /"PostalAddress"/i on legal and CPA office pages and home-inspection contact pages, /"PostalAddress"|"streetAddress"/i on laundromat and self-storage home, contact, location or facility pages, car wash home or contact pages, hotel nodes and butcher storefront nodes; HVAC, electrician and handyman fail condition !hasPostal && !hasAreaServed; clinic emptyAddress /"streetAddress"\s*:\s*""/ or /"addressLocality"\s*:\s*""/; required by the Rich Results audit (nodes typed exactly LocalBusiness) and Schema Validator. - Why: Without a structured address the map pack cannot place you, and "near me" results and Google Business Profile parity depend on it. - Fix: Add address as a PostalAddress with streetAddress, addressLocality, addressRegion, postalCode and addressCountry to the business node. A service-area business with no storefront should declare areaServed instead. - Verify: [GBP + Review Signal Audit](https://jwatte.com/tools/gbp-review-audit/), [Schema Validator](https://jwatte.com/tools/schema-validator/), [Rich Results Eligibility Audit](https://jwatte.com/tools/rich-results-eligibility-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org PostalAddress. - [ ] **6.8 Address present but no geo (GeoCoordinates)** - Pass: The business node has geo with GeoCoordinates latitude and longitude. - Warn: Schema Validator warns when geo is missing from a LocalBusiness node. - Fail: Mega Analyzer fails when a PostalAddress exists without geo (laundromat, self-storage, car wash, HVAC, electrician, handyman), when a butcher storefront node has no geo, on homebuilder community pages that have a business or Place node, on hotel home or contact pages, and on men's health clinic location pages. - Numbers and lists the tool uses: regex /"geo"\s*:\s*\{|"GeoCoordinates"|"latitude"/i; recommended field geo (Schema Validator, Rich Results audit). - Why: Latitude and longitude let the map pack pin the exact spot instead of guessing from the address. - Fix: Add geo: {"@type":"GeoCoordinates","latitude":..,"longitude":..} to the business node. - Verify: [Schema Validator](https://jwatte.com/tools/schema-validator/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org GeoCoordinates. - [ ] **6.9 Hours in schema + body** - Pass: The business node declares openingHoursSpecification (or openingHours). - Warn: Hours found only in page copy: GBP Review Audit warns when body text has day names but schema has none; GEO Analyzer scores 60 when hours appear only in copy; Schema Validator warns when openingHours is missing unless openingHoursSpecification is present on a local-business subtype. - Fail: GBP Review Audit fails when there are no hours anywhere; GEO Analyzer scores 30 when neither schema nor copy has hours; Mega Analyzer fails when hours schema is missing on legal and CPA office pages, home-inspection contact pages, laundromat and self-storage home, contact, location or facility pages, car wash, HVAC, electrician and handyman home or contact pages, restaurant pages that carry Restaurant schema, men's health clinic location pages and butcher storefront nodes. - Numbers and lists the tool uses: schema regex /"openingHoursSpecification"|"openingHours"/i (GBP Review Audit, Mega Analyzer laundromat and self-storage), /"openingHours(?:Specification)?"/i (Mega Analyzer legal, CPA, inspection), /"openingHoursSpecification"/i (Mega Analyzer restaurant); GBP Review Audit body regex /(monday|tuesday|wednesday|thursday|friday|saturday|sunday|mon[\-`<en dash>`]fri|mon[\-`<en dash>`]sat|24\s*hours|open\s*24)/i; GEO Analyzer checks the first LocalBusiness, Restaurant, Store or Service node, copy regex /\bhours of operation|business hours|open (mon|tue|wed|thu|fri|sat|sun)/i, scores 95 / 60 / 30. - Why: "Open now" answers in Google, Maps, voice assistants and AI come from structured hours, and they must match your Google Business Profile exactly. - Fix: Add openingHoursSpecification with dayOfWeek, opens and closes for every block (full Monday to Sunday), identical to the hours on your Google Business Profile. - Verify: [GBP + Review Signal Audit](https://jwatte.com/tools/gbp-review-audit/), [Schema Validator](https://jwatte.com/tools/schema-validator/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega GEO Analyzer](https://jwatte.com/tools/mega-geo-analyzer/). Standard: schema.org OpeningHoursSpecification. - [ ] **6.10 Service-area coverage** - Pass: The LocalBusiness or Service node declares areaServed (or serviceArea), or the page uses service-area language. - Fail: GEO Analyzer scores 30 when there is no LocalBusiness or Service node or the node has no areaServed; GBP Review Audit reports a missing signal as informational (optional for storefront-only businesses); Mega Analyzer fails on homebuilder community nodes, home-inspection contact and service pages, laundromat pages that offer pickup-and-delivery, butcher storefront nodes, HVAC, electrician and handyman nodes that have neither PostalAddress nor areaServed, and HVAC, electrician and handyman home or contact pages that have an address but no areaServed. - Numbers and lists the tool uses: GEO Analyzer: first LocalBusiness or Service node, score 90 declared, 30 missing; GBP Review Audit regex /"areaServed"|serving\s+(?:all\s+of\s+)?[A-Z][a-z]+|we serve|service\s+area/i; Mega Analyzer /"areaServed"/i, laundromat /"areaServed"|"serviceArea"/i gated on the services list including pickup-delivery. - Why: Searches from surrounding towns match on areaServed, so a business that travels to customers or serves several markets is invisible there without it. - Fix: Declare areaServed as a City, State, GeoCircle or Place array listing the metro, county and nearby cities you serve, and show the same list on the page. - Verify: [GBP + Review Signal Audit](https://jwatte.com/tools/gbp-review-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega GEO Analyzer](https://jwatte.com/tools/mega-geo-analyzer/). Standard: schema.org areaServed. - [ ] **6.11 sameAs citation links present** - Pass: The business node has a sameAs array linking your listing profiles (Google Business Profile, Yelp, Facebook and the platforms for your trade). - Warn: Parish analyzer warns when no sameAs appears anywhere in the HTML. - Fail: Mega Analyzer fails when sameAs is missing on car wash home or contact pages, HVAC, electrician and handyman business nodes and men's health clinic location pages; CPA office pages and home-inspection contact pages fail with fewer than 3 citation anchors found in sameAs plus body and footer, listing the missing ones (Yelp and Better Business Bureau each raise their own issue on CPA pages); hotel home or contact pages fail when 3 or more of the 5 listing platforms are missing. - Numbers and lists the tool uses: CPA anchors (7): Google Business Profile /maps\.google\.com[^"\s]*cid=|google\.com\/maps[^"\s]*cid=|g\.page\/[a-z0-9-]+|business\.google\.com\/(?:dashboard|n\/)/i, Yelp /yelp\.com\/biz\//i, BBB /bbb\.org\/(?:us|en|[a-z]{2})\//i or /bbb\.org\/business-reviews/i, LinkedIn /linkedin\.com\/company\//i, Facebook /facebook\.com\/[A-Za-z0-9.\-_]+\b/i, Apple Maps /maps\.apple\.com|place\.apple/i, ClearlyRated /clearlyrated\.com/i, pass at 3 or more, gated to office pages or path /contact|location|office/i; inspection anchors (6): Google Business Profile, Yelp, BBB /bbb\.org\//i, InterNACHI /internachi\.org\/(?:inspector|find)/i or /nachi\.org\//i, Facebook, Google reviews /search\.google\.com\/local\/reviews|google\.com\/maps[^"\s]*reviews/i, pass at 3 or more, gated to contact pages or path /contact|location|service-area/i; hotel platforms (5): google /google\.com\/maps|maps\.google|g\.page|business\.google|"https?:\/\/[^"]*google[^"]*"/i, apple /maps\.apple\.com|mapsconnect\.apple/i, yelp /yelp\.com\/biz/i, tripadvisor /tripadvisor\.[a-z.]+\/(Hotel_Review|Restaurant_Review|Tourism)/i, ota /booking\.com\/hotel|expedia\.com|hotels\.com|marriott\.com|hilton\.com/i, pass when at most 1 missing, fail at 3 or more missing; suggested targets: car wash GBP, Yelp, Facebook, Instagram; HVAC GBP, Facebook, Yelp, BBB, Nextdoor, manufacturer dealer-locator; electrician GBP, Facebook, Yelp, BBB, HomeAdvisor, Nextdoor; handyman GBP, Facebook, Yelp, Angi, Thumbtack; parish analyzer /sameAs/i anywhere in the HTML. - Why: Each linked profile is an authority anchor that Google's local reconciler and AI search use to confirm you are one real business, and for hotels the listing surface is the booking surface. - Fix: Add a sameAs array to the business node with the Google Business Profile or Maps URL, Yelp, Facebook, BBB and the directories for your trade, claiming any profile you do not yet have. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org sameAs. - [ ] **6.12 Google Maps canonical URL in sameAs** - Pass: SameAs includes the canonical Google Maps URL https://www.google.com/maps?cid=`<n>`. - Fail: Reported as informational when absent on a general local-business node (Mega Analyzer, Schema Validator); fails on CPA office pages and home-inspection contact pages (Mega Analyzer). - Numbers and lists the tool uses: format https://www.google.com/maps?cid=<19-digit-id>; the Mega Analyzer general row also accepts maps.app.goo.gl; Schema Validator regex /google\.com\/maps\?cid=\d+/i on sameAs strings, gated to a node typed one of LocalBusiness, RealEstateAgent, Attorney, Dentist, Physician, InsuranceAgency, AccountingService, SelfStorage, LodgingBusiness, Hotel, Restaurant, MovingCompany, TravelAgency with a non-empty sameAs; on CPA and inspection pages the Mega Analyzer accepts maps.google.com or google.com/maps with cid=, g.page/`<slug>`, or business.google.com/dashboard or /n/. - Why: The Maps cid URL is the verified Maps entity reference and the second strongest Knowledge Graph anchor after the kgmid, so it ties your site to your place pin. - Fix: In Google Maps click your pin, choose Share and copy the link (https://maps.app.goo.gl/`<token>`), follow its redirect with curl -sI `<share-url>`, convert the hex CID after the colon in the 0x...:0x... segment of the Location header to decimal, and add https://www.google.com/maps?cid=`<decimal>` to sameAs. - Verify: [Schema Validator](https://jwatte.com/tools/schema-validator/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **6.13 Google Business Profile share URL in sameAs** - Pass: SameAs includes a Google Business Profile URL (share.google, g.page or business.google.com). - Fail: Reported as informational when absent. - Numbers and lists the tool uses: regexes /share\.google\//, /g\.page\//, /business\.google\.com\// on the joined sameAs strings; the pass row renders when one of those is present and no Maps cid URL (google.com/maps?cid= or maps.app.goo.gl) is present; the informational row renders when none of the five patterns is found; nothing renders when a Maps cid URL is present. - Why: The share URL pairs with the Maps cid URL as a second pointer to the same Google listing. - Fix: Add the profile share URL (share.google, g.page or business.google.com) to sameAs next to the Maps cid URL. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **6.14 Local-business entity is missing a Google Knowledge Graph kgmid** - Pass: The local-business node declares its kgmid either as a sameAs URL https://www.google.com/search?kgmid=/g/`<id>` or as a PropertyValue identifier. - Fail: Reported as informational when a local-ish node with a non-empty sameAs has neither form. - Numbers and lists the tool uses: URL regex /google\.com\/search\?kgmid=\/[gm]\/[\w-]+/i; identifier propertyID regex /kgmid|googleKgmid|knowledgeGraph/i (identifier may be an object or an array of objects); local-ish gate as for the Maps cid check. - Why: The kgmid is the strongest single signal you can publish to reconcile your business with its Google Knowledge Graph entity. - Fix: Take the %2Fg%2F`<base32>` segment from the resolved Maps share URL redirect (it decodes to /g/`<base32>`) and add both https://www.google.com/search?kgmid=/g/`<base32>` in sameAs and identifier {"@type":"PropertyValue","propertyID":"googleKgmid","value":"/g/`<base32>`"}. - Verify: [Schema Validator](https://jwatte.com/tools/schema-validator/). Standard: Google Knowledge Graph. - [ ] **6.15 Local-business entity is missing a Google Place ID** - Pass: The local-business node declares its Google Place ID as a PropertyValue identifier. - Fail: Reported as informational when a local-ish node with a non-empty sameAs has no identifier whose propertyID matches the Place ID regex. - Numbers and lists the tool uses: propertyID regex /googlePlaceId|placeId/i; local-ish gate as for the Maps cid check. - Why: The Place ID binds your entity to its Google Business Profile, and the FtId hex in the Maps share URL redirect is that Place ID. - Fix: From the same Maps share URL redirect take the FtId hex (for example 0x54aca3f245411dd5 in the !1s0x... segment) and add identifier {"@type":"PropertyValue","propertyID":"googlePlaceId","value":"0x..."}. - Verify: [Schema Validator](https://jwatte.com/tools/schema-validator/). Standard: Google Places API Place ID. - [ ] **6.16 Payment methods disclosed** - Pass: PaymentAccepted is in the schema or the body text states the accepted payment types. - Fail: Reported as informational when neither is found. - Numbers and lists the tool uses: /"paymentAccepted"/i on the JSON-LD; body regex /(accept|accepted).*(visa|mastercard|amex|american express|discover|cash|apple pay|google pay|venmo|zelle|hsa|fsa|insurance)/i; Mega Analyzer car wash pass row 'paymentAccepted present.'. - Why: Accepted payment types are a common qualifier people search for on Google Business Profile. - Fix: List accepted payment types in paymentAccepted on the business node and in the footer. - Verify: [GBP + Review Signal Audit](https://jwatte.com/tools/gbp-review-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org paymentAccepted. - [ ] **6.17 Services / products listed** - Pass: The business node itemizes services with makesOffer, hasOfferCatalog or offers, or the site has a services, menu, treatments, products or pricing page. - Warn: GEO Analyzer scores 70 when the offer catalog exists but the copy has no services-page language; GBP Review Audit warns when neither schema offers nor a services path is found. - Fail: GEO Analyzer scores 30 or 50 when the LocalBusiness node has no makesOffer or hasOfferCatalog. - Numbers and lists the tool uses: GBP Review Audit /"hasOfferCatalog"|"offers"\s*:/i or path /\/(services|menu|treatments|products|pricing)/i; GEO Analyzer base 30, +40 makesOffer or hasOfferCatalog, +20 services-page regex /\b(our services|services we offer|what we do)\b/i on the lowercased HTML, cap 100, pass at 80 or more, warn 60 to 79, fail under 60. - Why: Itemized services feed featured snippets and must mirror the Services tab on your Google Business Profile. - Fix: Declare makesOffer or hasOfferCatalog on the LocalBusiness node with each service, and keep a Services page with each service as its own H2 and paragraph matching the GBP Services tab. - Verify: [GBP + Review Signal Audit](https://jwatte.com/tools/gbp-review-audit/), [Mega GEO Analyzer](https://jwatte.com/tools/mega-geo-analyzer/). Standard: schema.org hasOfferCatalog; schema.org makesOffer. - [ ] **6.18 Multi-location structure** - Pass: Score 90 when more than one LocalBusiness-family node is found; a single node scores 80 (single-location structure). - Fail: Score 30 when no LocalBusiness or Organization node exists. - Numbers and lists the tool uses: a node counts when @type is LocalBusiness or its string @type matches /LocalBusiness|Plumber|Restaurant|Store/; more than one node = 90, one = 80, none = 30. - Why: Each location needs its own page and its own business node so the map pack can rank every branch, while a single-location site still passes. - Fix: Add LocalBusiness schema; if you have several locations, give each its own URL with a unique LocalBusiness node and NAP on that page. - Verify: [Mega GEO Analyzer](https://jwatte.com/tools/mega-geo-analyzer/). Standard: schema.org LocalBusiness. - [ ] **6.19 Geo meta triplet (geo.position, geo.region, geo.placename)** - Pass: The page has geo.position, geo.region and geo.placename meta tags (any of the three counts). - Warn: Missing on a local-business page renders as a warning in the vertical readiness rows. - Fail: Fails on a page whose schema type matches the local-business list; on any other page a missing triplet is informational only (not a failure on author, SaaS, blog or portfolio pages). - Numbers and lists the tool uses: metas geo.position, geo.region, geo.placename; local-business gate /LocalBusiness|Restaurant|Store|AutoRepair|DryCleaningOrLaundry|LodgingBusiness|RealEstateAgent|SelfStorage|Laundromat|HomeAndConstructionBusiness/i tested on the schema types joined by comma; formats geo.position LAT;LNG, geo.region US-XX, geo.placename City. - Why: Apple Maps, Bing and voice assistants read these tags as a strong signal of where a local business sits. - Fix: On local-business pages add meta name="geo.position" content="LAT;LNG", meta name="geo.region" content="US-XX" and meta name="geo.placename" content="City". - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **6.20 Embedded or linked Google Map** - Pass: The page embeds or links your Google Map or Google Business Profile. - Warn: GBP Review Audit warns when no Google Map link or embed is found. - Fail: Mega Analyzer fails home, contact, location or facility pages of laundromat, self-storage, car wash, HVAC, electrician, handyman and men's health clinic sites that have no Google Business Profile or Maps link. - Numbers and lists the tool uses: GBP Review Audit /maps\.google|google\.com\/maps|maps\.app\.goo\.gl|embed\/.*google/i; Mega Analyzer /g\.page\/|business\.google\.|maps\.google\.|goo\.gl\/maps|\/maps\/place\/|google\.com\/maps/i on the raw HTML. - Why: A map embed or profile link on your own site reinforces the location match with your Google Business Profile, which is the biggest lead source for most local businesses. - Fix: Create and verify the Google Business Profile with the right category (for example Laundromat, Self-storage facility, Car wash), match NAP exactly, embed the Google Map iframe on the contact page, link the profile and add it to sameAs. - Verify: [GBP + Review Signal Audit](https://jwatte.com/tools/gbp-review-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **6.21 Hyperlocal content** - Pass: Score 80 (the cap) from "near / in / serving / located in `<City>`" phrases and ZIP codes in the page text. - Warn: Score 60 to 79. - Fail: Score under 60. - Numbers and lists the tool uses: city regex /\b(near|in|serving|located in)\s+[A-Z][a-z]+(?:\s+[A-Z][a-z]+)?/g run against the lowercased HTML (the capital-letter class is tested on lowercased text); ZIP regex /\b\d{5}(-\d{4})?\b/g; score = min(80, cityMatches*15 + zipMatches*5); pass 80 or more, warn 60 to 79, fail under 60. - Why: Naming the cities, neighborhoods and ZIP codes you serve in body copy is how search ties your pages to local queries. - Fix: Mention the specific cities, neighborhoods and ZIP codes you serve in body copy, and build a landing page for each service area. - Verify: [Mega GEO Analyzer](https://jwatte.com/tools/mega-geo-analyzer/). - [ ] **6.22 Visual proof signal (gallery or ≥ 8 images)** - Pass: The page links a gallery, photos, our-work, portfolio or before-after page or heading, or carries at least 8 images. - Warn: Fewer than 8 images and no gallery page. - Numbers and lists the tool uses: path regex /\/(gallery|photos|our-work|portfolio|before-after)/i on the raw HTML; heading regex /<h\d[^>]*>(gallery|photos|our work|portfolio)/i; image count doc.querySelectorAll('img').length >= 8; fix prompt: if the business has fewer than 20 GBP photos, add 10 priority photos (exterior, interior, team, work samples, product, logo, signage). - Why: Google Business Profile favors businesses that show their work in photos. - Fix: Add a gallery or photos page with real images of the exterior, interior, team and work samples, and upload the same set to your Google Business Profile. - Verify: [GBP + Review Signal Audit](https://jwatte.com/tools/gbp-review-audit/). - [ ] **6.23 Booking / appointment widget** - Pass: The page has booking language or a known booking or live-chat vendor embed. - Fail: GBP Review Audit reports a missing booking signal as informational; Mega Analyzer counts chat and booking as contact signals without failing. - Numbers and lists the tool uses: GBP Review Audit /book (?:now|online|an appointment)|schedule (?:now|online|an appointment)|reserve|reservation|calendly|acuity|setmore|vagaro|boulevard|mindbody|opentable|resy|tock/i; Mega Analyzer BOOKING_RE /(calendly\.com|cal\.com\/embed|savvycal\.com|app\.acuityscheduling|hubspot\.com\/meetings|chilipiper|oncehub\.com|book\.stripe|square\.site\/book)/i and CHAT_RE /(intercom\.io|widget\.intercom|static\.zdassets|zopim|tawk\.to|drift\.com|tidio|crisp\.chat|helpscout\.net|js\.hs-scripts|olark\.com|livechatinc)/i; contactSignals = count of tel link, mailto link, visible phone, visible address, visible hours, live chat, booking widget. - Why: Online booking makes the site conversion-ready and raises eligibility for the Book button on your Google Business Profile. - Fix: Add an online booking link or embed (or live chat) where it fits the business. - Verify: [GBP + Review Signal Audit](https://jwatte.com/tools/gbp-review-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **6.24 Create or claim your Google Business Profile** - Pass: A Google Business Profile exists, is verified, and is filled with name, category, address or service area, phone, website, description, hours, at least 5 photos, products or services with pricing and at least one post. - Numbers and lists the tool uses: photos at least 5 (logo, storefront or office, team, products, action shots); at least one post; the business name must match the website and Wikidata exactly; verification by postcard PIN, phone or email; add the profile URL to schema sameAs ("sameAs": "https://business.google.com/your-profile-url"). - Why: A verified, active Google Business Profile with consistent name, address and phone is what powers the local pack and is a Knowledge Panel trigger. - Fix: Go to business.google.com, add your business with the exact name, category, address or service area, phone and website, complete verification, then fill the description (same as Wikidata), hours, photos, products or services with pricing and a first post, and add the profile URL to sameAs. - Verify: [E-E-A-T Generator](https://jwatte.com/tools/eeat-generator/). - [ ] **6.25 Listing accessible** - Pass: The public Google Maps place page for the listing loads signed out and carries a title (og:title or the title tag). - Fail: Critical severity when no title can be read from the listing page. - Numbers and lists the tool uses: title from meta[property="og:title"] content, else the title tag text; severity critical. - Why: If your listing does not load publicly, customers and graders cannot see any of the other listing signals. - Fix: Confirm the Maps share URL resolves to your live, verified listing. - Verify: [Google Maps](https://jwatte.com/tools/google-maps-audit/). - [ ] **6.26 Description / category present** - Pass: The listing has accurate primary and secondary categories and a description of at least 40 characters. - Fail: Google Maps Audit reports a short or missing description as informational. - Numbers and lists the tool uses: og:description length >= 40 characters (Google Maps Audit); categories chosen during GBP setup, proxied by the profile URL field being filled (E-E-A-T Generator). - Why: The local pack is powered by profile category and description data, so the wrong category or an empty description hides you from the searches you want. - Fix: Select the accurate primary and secondary categories in Google Business Profile and write a description of at least 40 characters that matches the one on your site. - Verify: [Google Maps](https://jwatte.com/tools/google-maps-audit/), [E-E-A-T Generator](https://jwatte.com/tools/eeat-generator/). - [ ] **6.27 Phone visible** - Pass: The Google listing shows a North American phone number. - Warn: No phone number found on the listing. - Numbers and lists the tool uses: regex /(\+?1?[ -]?$?\d{3}$?[ -]?\d{3}[ -]?\d{4})/ on the listing text. - Why: Phone is one of the three NAP fields the map pack shows and calls from. - Fix: Add the phone number to the Google Business Profile, matching the website exactly. - Verify: [Google Maps](https://jwatte.com/tools/google-maps-audit/). - [ ] **6.28 Address visible** - Pass: The Google listing shows a street address with a recognized suffix. - Warn: No street address found on the listing. - Numbers and lists the tool uses: regex /\b(\d+\s+[\w .,]+(?:St|Ave|Blvd|Rd|Way|Dr|Ln|Pl|Pkwy))/ on the listing text. - Why: Address is one of the three NAP fields the map pack uses to place and rank you. - Fix: Add the street address to the Google Business Profile, matching the website exactly. - Verify: [Google Maps](https://jwatte.com/tools/google-maps-audit/). - [ ] **6.29 Hours of operation visible** - Pass: The Google listing shows open or closed status or day names. - Warn: No hours found on the listing. - Numbers and lists the tool uses: regex /Open (?:now|today|24 hours?)|Closed|hours of operation|Monday|Tuesday|Wednesday|Thursday|Friday|Saturday|Sunday/i on the listing text. - Why: Missing hours on the listing strongly suppresses rank. - Fix: Add hours to the Google Business Profile, identical to the hours on your site. - Verify: [Google Maps](https://jwatte.com/tools/google-maps-audit/). - [ ] **6.30 Website link present** - Pass: The Google listing shows a website link. - Warn: No website link found on the listing. - Numbers and lists the tool uses: regex /(?:Website|website link|visit (?:our )?website)|<a[^>]+https?:\/\//i run on the listing body text. - Why: A website URL on the listing is a graded signal and the path from the map pack to your site. - Fix: Add the website URL to the Google Business Profile. - Verify: [Google Maps](https://jwatte.com/tools/google-maps-audit/). - [ ] **6.31 Photos count signal** - Pass: The Google listing exposes a hero image (og:image) and shows a photo count. - Warn: No og:image on the listing, or no photo count shown. - Numbers and lists the tool uses: og:image content non-empty; photo count regex /\d+\s*photos?/i; target 20 or more photos (Google Maps Audit); at least 5 photos to start: logo, storefront or office, team, products, action shots (E-E-A-T Generator). - Why: Photo volume is a graded map-pack signal and the first thing a customer sees on your card. - Fix: Upload at least 5 photos to start and aim for 20 or more: exterior, interior, team, products or services. - Verify: [Google Maps](https://jwatte.com/tools/google-maps-audit/), [E-E-A-T Generator](https://jwatte.com/tools/eeat-generator/). - [ ] **6.32 Services / products listed (Google listing)** - Pass: The Google listing text mentions services, products, menu, treatments or offerings. - Warn: No services or products found on the listing. - Numbers and lists the tool uses: regex /services|products|menu|treatments|offerings/i on the listing text. - Why: The Services tab on Google Business Profile feeds long-tail intent matching. - Fix: Mirror your services in the GBP Services tab. - Verify: [Google Maps](https://jwatte.com/tools/google-maps-audit/). - [ ] **6.33 Products / Services Pricing signal** - Pass: The Google listing shows product or pricing cues. - Fail: Reported as informational when no pricing cue is found. - Numbers and lists the tool uses: regex /product|pricing|\$\d+|starting at|from \$/i on the listing text. - Why: Products and priced services are graded listing-completeness signals. - Fix: Add Products with photos and price for retail, or a Service list with price bands for service businesses. - Verify: [Google Maps](https://jwatte.com/tools/google-maps-audit/). - [ ] **6.34 Business attributes set** - Pass: The Google listing shows ownership, accessibility, amenity or payment attributes. - Fail: Reported as informational when no attribute token is found. - Numbers and lists the tool uses: attribute tokens: women-owned, veteran-owned, black-owned, lgbtq, family-owned, locally owned, wheelchair, accessible, free wi-fi or wifi, accepts credit cards. - Why: Attributes feed the filter panel on Google Business Profile. - Fix: Set attributes for ownership, accessibility, amenities and payments in the profile. - Verify: [Google Maps](https://jwatte.com/tools/google-maps-audit/). - [ ] **6.35 Booking / quote / reservation action** - Pass: The Google listing shows a book, reserve or quote action. - Warn: No booking, reservation or quote action found on the listing. - Numbers and lists the tool uses: regex /book (?:now|online|appointment)|reserve|reservation|request a quote|request an estimate/i on the listing text. - Why: A Book, Reserve or Quote button raises click-through and lead capture from the map pack. - Fix: Enable the Book, Reserve or Quote button in Google Business Profile. - Verify: [Google Maps](https://jwatte.com/tools/google-maps-audit/). - [ ] **6.36 Messaging enabled** - Pass: The Google listing shows a chat or message action. - Fail: Reported as informational when no messaging cue is found. - Numbers and lists the tool uses: regex /chat|message (?:us|the business)|send a message/i on the listing text; response SLA 24 hours. - Why: Messaging on Google Business Profile captures inquiries but only works if you can answer within 24 hours. - Fix: Turn on GBP messaging and commit to answering within 24 hours. - Verify: [Google Maps](https://jwatte.com/tools/google-maps-audit/). - [ ] **6.37 Questions & Answers tab populated** - Pass: The Google listing text mentions questions, FAQ, Q&A or people also ask. - Fail: Reported as informational when no Q&A cue is found. - Numbers and lists the tool uses: regex /questions?|frequently asked|q&a|people also ask/i on the listing text; advice 5 to 10 owner Q&As. - Why: A populated Q&A tab answers common pre-purchase questions right on the listing. - Fix: Proactively add 5 to 10 owner Q&As covering the questions people ask before buying. - Verify: [Google Maps](https://jwatte.com/tools/google-maps-audit/). - [ ] **6.38 Recent Posts / Updates signal** - Pass: The Google listing text mentions posts or updates. - Fail: Reported as informational when no post or update cue is found. - Numbers and lists the tool uses: regex /update|post|latest (?:post|update)/i on the listing text; cadence every 7 days. - Why: Posts expire and rank drops without a steady cadence. - Fix: Publish a GBP Post every 7 days. - Verify: [Google Maps](https://jwatte.com/tools/google-maps-audit/). - [ ] **6.39 Directory listings present (Yelp, BBB, Bing Places, Yellow Pages, Foursquare, Nextdoor, Apple Maps, Facebook Page, Angi, HomeAdvisor, Thumbtack, TripAdvisor)** - Pass: The business has a listing in each directory that applies to it, confirmed by searching the directory and ticking its box. - Fail: An unticked directory is named as missing in the submission prompt. - Numbers and lists the tool uses: 12 directories with search URLs: Yelp https://yelp.com/search?find_desc=<business name + city>; BBB https://bbb.org/search?find_text=`<query>`; Bing Places https://bing.com/maps?q=`<query>`; Yellow Pages https://yellowpages.com/search?search_terms=`<query>`; Foursquare https://foursquare.com/explore?q=`<query>`; Nextdoor https://nextdoor.com/search/?query=`<query>`; Apple Maps https://maps.apple.com/?q=`<query>`; Facebook Page https://facebook.com/search/pages/?q=`<query>`; Angi https://angi.com/companylist.htm?SearchTerm=`<query>`; HomeAdvisor https://homeadvisor.com/cs/search.aspx?q=`<query>`; Thumbtack https://thumbtack.com/search?query=`<query>`; TripAdvisor https://tripadvisor.com/Search?q=`<query>`. - Why: Yelp carries top citation weight, BBB is a trust signal customers still check, Bing feeds the Microsoft and LinkedIn ecosystem, Yellow Pages is still crawled, Foursquare feeds other directory APIs, Nextdoor is hyperlocal, Apple Maps covers about 30 percent of US users, Facebook is one of the largest review platforms, and Angi, HomeAdvisor, Thumbtack and TripAdvisor cover home services and hospitality. - Fix: For each missing directory, use its add-a-business page, meet its requirements (categories, photos, ownership verification), and start with the directories that carry the most citation weight for your trade. - Verify: [Local Directories](https://jwatte.com/tools/local-directories/). - [ ] **6.40 `<listing>`: NAP fields match canonical** - Pass: All three fields (name, phone, address) on the listing match the canonical NAP after normalization, and the same name, website URL, description, logo, phone and address are used on every platform. - Warn: 1 or 2 mismatched fields on a listing (partial drift), each shown as `<Field>`: `<variant>` ≠ `<canon>`. - Fail: All 3 fields differ (major drift). - Numbers and lists the tool uses: input lines in the form Listing name | Name | Phone | Address, split on newlines then on | with trim, a missing listing name becomes (unknown); buckets 0 issues pass, 1 to 2 warn, 3 fail; summary tiles Exact match = 0 issues, Partial = 1 or 2, Major drift = 3; all three canonical fields are required and at least one variant line; five fields to keep identical across platforms: business name (exact spelling, capitalization, punctuation), website URL (choose www or non-www and stick with it), the same core description sentence, the same logo or profile photo file, phone and address (E-E-A-T Generator). - Why: Spacing, abbreviation and phone-format mismatches across listings hurt local rank, and a phone or address mismatch can mean a duplicate listing exists. - Fix: Correct each mismatched listing in its own admin in priority order Google, Apple, Bing, Yelp, Facebook, BBB, Foursquare, then industry directories, merge or claim-and-update any duplicate, and re-audit monthly. - Verify: [NAP Consistency](https://jwatte.com/tools/nap-consistency/), [E-E-A-T Generator](https://jwatte.com/tools/eeat-generator/). - [ ] **6.41 Name: `<variant>` ≠ `<canon>`** - Pass: The listing's business name equals the canonical name after normalization. - Numbers and lists the tool uses: normName: lowercase, trim, strip a trailing legal suffix matching /\s+(llc|inc|ltd|corp|co\.?)\s*$/i, collapse runs of whitespace, hyphen, underscore, comma or period (/[\s\-_.]+/g) to one space, trim. - Why: Business-name drift in suffix, punctuation or spacing is one of the three mismatch classes that weaken your citations. - Fix: Edit the listing's business name in that platform's admin to match the canonical name exactly. - Verify: [NAP Consistency](https://jwatte.com/tools/nap-consistency/). - [ ] **6.42 Phone: `<variant>` ≠ `<canon>`** - Pass: The listing's phone equals the canonical phone after stripping formatting and a leading country code 1. - Numbers and lists the tool uses: normPhone: remove all non-digits (/\D/g), then strip a leading 1 from an 11-digit number (/^1(\d{10})$/ to $1). - Why: Phone-format mismatches hurt local rank, and a different phone may mean a duplicate listing. - Fix: Correct the listing phone in the platform admin; if the mismatch points to a duplicate listing, merge it or claim and update it. - Verify: [NAP Consistency](https://jwatte.com/tools/nap-consistency/). - [ ] **6.43 Address: `<variant>` ≠ `<canon>`** - Pass: The listing's address equals the canonical address after abbreviation and punctuation normalization. - Numbers and lists the tool uses: normAddr: lowercase, trim; word replacements street to st, avenue to ave, boulevard to blvd, road to rd, drive to dr, lane to ln, place to pl, court to ct, suite to ste, apartment to apt, north to n, south to s, east to e, west to w; collapse /[\s\-_.]+/g to one space; state names idaho to id, california to ca; trim. - Why: Abbreviation and spacing differences (Street vs St., Idaho vs ID) are normalized away, so anything still flagged is real address drift. - Fix: Correct the listing address in the platform admin; if the mismatch points to a duplicate listing, merge it or claim and update it. - Verify: [NAP Consistency](https://jwatte.com/tools/nap-consistency/). - [ ] **6.44 Primary category exact (Apple Business Connect)** - Pass: The Apple Business Connect primary category matches the Apple Maps taxonomy, ticked in the worksheet. - Why: Apple categories differ from Google, so the category must be picked from the Apple Maps taxonomy to match the right searches. - Fix: In Apple Business Connect choose the primary category that matches the Apple Maps taxonomy for your business. - Verify: [Apple Business](https://jwatte.com/tools/apple-business-audit/). - [ ] **6.45 Business name clean (no keyword stuffing)** - Pass: The Apple Maps listing name is the real business name with no added keywords, ticked in the worksheet. - Why: Apple penalizes keyword stuffing in the name harder than Google does. - Fix: Set the Apple Business Connect name to the exact business name and remove any added service or city keywords. - Verify: [Apple Business](https://jwatte.com/tools/apple-business-audit/). - [ ] **6.46 Logo uploaded (square, ≥ 512px)** - Pass: A square logo of at least 512px is uploaded to Apple Business Connect. - Numbers and lists the tool uses: square, >= 512px. - Why: The logo shows in the Apple Maps pin card. - Fix: Upload a square logo of at least 512px in Apple Business Connect. - Verify: [Apple Business](https://jwatte.com/tools/apple-business-audit/). - [ ] **6.47 Hero image (landscape, ≥ 1200px)** - Pass: A landscape hero image of at least 1200px is uploaded to Apple Business Connect. - Numbers and lists the tool uses: landscape, >= 1200px. - Why: The hero image shows in the Apple Maps place card carousel. - Fix: Upload a landscape hero image of at least 1200px in Apple Business Connect. - Verify: [Apple Business](https://jwatte.com/tools/apple-business-audit/). - [ ] **6.48 Photos ≥ 10 (recent)** - Pass: At least 10 recent photos are uploaded to the Apple Maps listing. - Numbers and lists the tool uses: >= 10 photos. - Why: Apple Maps rotates these photos in the place card carousel. - Fix: Upload at least 10 recent photos to Apple Business Connect and refresh them as the business changes. - Verify: [Apple Business](https://jwatte.com/tools/apple-business-audit/). - [ ] **6.49 Hours accurate + holiday hours** - Pass: Regular hours and holiday hours on the Apple Maps listing are accurate. - Why: Apple Maps pulls these hours into Siri answers. - Fix: Set regular hours and holiday hours in Apple Business Connect and keep them identical to your site and Google Business Profile. - Verify: [Apple Business](https://jwatte.com/tools/apple-business-audit/). - [ ] **6.50 Phone + website + email verified** - Pass: Phone, website and email are all verified on the Apple Maps listing. - Why: All three feed Siri responses. - Fix: Verify the phone, website and email in Apple Business Connect. - Verify: [Apple Business](https://jwatte.com/tools/apple-business-audit/). - [ ] **6.51 Business description 40-300 chars** - Pass: The Apple Business Connect description is between 40 and 300 characters. - Numbers and lists the tool uses: 40 to 300 characters. - Why: The description appears below the hero on the place card and should mirror your Google Business Profile description for consistency. - Fix: Write a 40 to 300 character description in Apple Business Connect that mirrors your GBP description. - Verify: [Apple Business](https://jwatte.com/tools/apple-business-audit/). - [ ] **6.52 Attributes: accessibility, takeout, Wi-Fi, parking, curbside, drive-thru** - Pass: The accessibility, takeout and Wi-Fi attributes and the parking, curbside and drive-thru attributes are filled on the Apple Maps listing. - Numbers and lists the tool uses: attributes: accessibility, takeout, Wi-Fi; newer attributes: parking, curbside, drive-thru. - Why: Every attribute powers a filter search in Apple Maps. - Fix: Fill every attribute in Apple Business Connect, including the newer parking, curbside and drive-thru fields. - Verify: [Apple Business](https://jwatte.com/tools/apple-business-audit/). - [ ] **6.53 Action items configured** - Pass: The Order, Menu, Reserve and Gift Card action buttons are configured on the Apple Maps listing. - Numbers and lists the tool uses: buttons: Order, Menu, Reserve, Gift Card. - Why: Each action button triggers a native iOS handoff straight from the place card. - Fix: Configure the Order, Menu, Reserve and Gift Card actions that apply to you in Apple Business Connect. - Verify: [Apple Business](https://jwatte.com/tools/apple-business-audit/). - [ ] **6.54 Reservations integration (OpenTable / Resy)** - Pass: A reservations provider is integrated with the Apple Maps listing. - Numbers and lists the tool uses: providers named: OpenTable, Resy. - Why: Integration enables one-tap booking from Apple Maps. - Fix: Connect your OpenTable or Resy account in Apple Business Connect. - Verify: [Apple Business](https://jwatte.com/tools/apple-business-audit/). - [ ] **6.55 Appointment slots visible (services)** - Pass: Bookable appointment slots show on the Apple Maps listing. - Why: For trades, dental, medical and salons, Apple pulls open slots from your booking platform onto the listing. - Fix: Connect your booking platform in Apple Business Connect so appointment slots appear on the listing. - Verify: [Apple Business](https://jwatte.com/tools/apple-business-audit/). - [ ] **6.56 Apple Pay + Express Menu enabled** - Pass: Apple Pay and Express Menu are enabled on the Apple Maps listing. - Why: They give iOS users native checkout where it applies. - Fix: Enable Apple Pay and Express Menu in Apple Business Connect where they apply to your business. - Verify: [Apple Business](https://jwatte.com/tools/apple-business-audit/). - [ ] **6.57 Tipping enabled (where applicable)** - Pass: Apple Pay Tipping is enabled on the Apple Maps listing. - Why: Apple Pay Tipping shows for restaurants, salons and trades that opt in. - Fix: Opt in to Apple Pay Tipping in Apple Business Connect if you accept tips. - Verify: [Apple Business](https://jwatte.com/tools/apple-business-audit/). - [ ] **6.58 Gift cards enabled (Apple Wallet)** - Pass: Apple Wallet gift cards are enabled on the Apple Maps listing. - Why: For retail and restaurants, Apple Wallet integration reduces purchase friction. - Fix: Enable Apple Wallet gift cards in Apple Business Connect. - Verify: [Apple Business](https://jwatte.com/tools/apple-business-audit/). - [ ] **6.59 Showcase promotions active** - Pass: Showcase promotions are running on the Apple Maps listing. - Why: Showcases are Apple's version of Google Business Profile Posts and drive place-card clicks. - Fix: Publish a Showcase promotion in Apple Business Connect and keep one active. - Verify: [Apple Business](https://jwatte.com/tools/apple-business-audit/). - [ ] **6.60 Indoor Maps (if applicable)** - Pass: Indoor floor plans are provided for a large venue. - Why: Apple supports indoor floor plans for large venues. - Fix: If you run a large venue, submit indoor floor plans through Apple Business Connect. - Verify: [Apple Business](https://jwatte.com/tools/apple-business-audit/). - [ ] **6.61 Look Around imagery accurate (if in city)** - Pass: Apple's ground-level Look Around imagery shows the current storefront. - Why: Look Around is Apple's ground-level imagery, and an outdated storefront confuses visitors. - Fix: If your storefront changed, request an imagery update through Apple Business Connect. - Verify: [Apple Business](https://jwatte.com/tools/apple-business-audit/). - [ ] **6.62 Business Connect updates monthly** - Pass: The Apple Business Connect profile receives at least one meaningful edit per month. - Numbers and lists the tool uses: one meaningful edit per month; Apple deprioritizes profiles untouched for 6 or more months; the worksheet accepts up to 5 competitor URLs and lists 24 signals. - Why: Apple deprioritizes profiles untouched for 6 or more months. - Fix: Make one meaningful edit to the Apple Business Connect profile every month. - Verify: [Apple Business](https://jwatte.com/tools/apple-business-audit/). - [ ] **6.63 Apple Search Ads Maps placement (optional)** - Pass: Paid Apple Maps search placement has been tested. - Why: Paid placement inside Apple Maps search is an opt-in test worth running for higher-ticket categories. - Fix: If your category is higher-ticket, run a test of Apple Search Ads placement in Maps. - Verify: [Apple Business](https://jwatte.com/tools/apple-business-audit/). - [ ] **6.64 Google Posts cadence (process check)** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: one Google Business Profile Post every 7 days (weekly); Posts expire after 7 days; fix prompt calendar: 12 posts over 90 days across Offer, Event and Update types, each at most 1,500 characters with one call to action. - Why: Posts expire after 7 days and relevance drops fast without a steady cadence, while an active profile is a Knowledge Panel trigger. - Fix: Publish a Google Business Profile Post every week, planned as a 90-day calendar of 12 posts across Offer, Event and Update types, each under 1,500 characters with one call to action. - Verify: [GBP + Review Signal Audit](https://jwatte.com/tools/gbp-review-audit/), [E-E-A-T Generator](https://jwatte.com/tools/eeat-generator/). - [ ] **6.65 Local pack / Map** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: SERP HTML regex /data-async-context="query.*?local_pack|aria-label="(?:Map|Businesses in .*)"|"localPack":/i, reported as yes or no. - Why: A local pack on the results page means the query has geo intent, and a Google Business Profile with consistent NAP, categories and reviews dominates that space. - Fix: For queries that show a local pack, invest in the Google Business Profile first: consistent NAP, accurate categories and steady reviews. - Verify: [SERP Features](https://jwatte.com/tools/serp-features/). ## 7. Trust: who is behind this site, and can a machine confirm it Author bylines, dates that are true, an about page and a way to make contact, the sameAs links that tie a name to its profiles, and the legal pages that say the business is real. Search engines call this E-E-A-T; an AI answer engine calls it whether to cite you. **Verify this section with:** [Batch Compare](https://jwatte.com/tools/batch-analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Trust Signal Surface](https://jwatte.com/tools/trust-signal-surface-audit/), [Competitor Gap Matrix](https://jwatte.com/tools/competitor-gap-matrix/), [Migration Analyzer](https://jwatte.com/tools/migration-analyzer/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/), [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/), [Legal Pages Generator](https://jwatte.com/tools/legal-pages-generator/), [About-Page Conversion Audit](https://jwatte.com/tools/about-page-conversion-audit/), [Mega Batch](https://jwatte.com/tools/mega-batch/), [E-E-A-T Author Entity Graph](https://jwatte.com/tools/e-e-a-t-author-entity-graph/), [SGE Readiness Audit](https://jwatte.com/tools/sge-readiness-audit/), [Schema Fix Bundle](https://jwatte.com/tools/schema-fix-bundle/), [Author Authority per Article](https://jwatte.com/tools/author-authority-per-article/), [Mega AEO Analyzer](https://jwatte.com/tools/mega-aeo-analyzer/), [Mega GEO Analyzer](https://jwatte.com/tools/mega-geo-analyzer/), [E-E-A-T Generator](https://jwatte.com/tools/eeat-generator/), [Schema Validator](https://jwatte.com/tools/schema-validator/), [Monoclone Gen.](https://jwatte.com/tools/monoclone-generator/), [GBP + Review Signal Audit](https://jwatte.com/tools/gbp-review-audit/), [Google Maps](https://jwatte.com/tools/google-maps-audit/), [SERP Features](https://jwatte.com/tools/serp-features/), [Apple Business](https://jwatte.com/tools/apple-business-audit/). - [ ] **7.1 Page cites external sources** - Pass: The page links out to one or more authoritative external sites. - Fail: Zero external links earn no credit (Batch Analyzer). - Numbers and lists the tool uses: Tiers 5, 2 and 1 external links for full, partial and minimal credit (Batch Analyzer). - Why: Outbound citations to authoritative sources are a trust signal for readers and AI engines. - Fix: Cite external authoritative sources where claims are made. - Verify: [Batch Compare](https://jwatte.com/tools/batch-analyzer/). - [ ] **7.2 humans.txt identity file served** - Pass: A /humans.txt file is served listing team names, roles and a contact. - Warn: A missing humans.txt is a warning in Mega Analyzer and Analyzer (Analyzer also repeats it as an informational 'No humans.txt' row in its aux-file section); on a platform that cannot serve root files Mega Analyzer reports it as informational. - Numbers and lists the tool uses: path /humans.txt; Batch Analyzer lists humans.txt with weight 6 but does not fetch it, so that point is never earned. - Why: AI citation engines and IndieWeb tools read humans.txt as a sign that named people stand behind the site. - Fix: Publish /humans.txt at the site root with the team, their roles and a contact, following humanstxt.org. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/). Standard: humanstxt.org. - [ ] **7.3 Privacy policy link found** - Pass: Every page links to a published privacy policy page. - Warn: Analyzer reports a missing privacy link as a warning; Mega SEO Analyzer warns only when fewer than 2 of its 3 policy links (privacy, terms, cookies) are present; Migration Analyzer warns when only 1 to 2 of its 4 legal pages are linked. - Fail: Mega Analyzer fails its 'Privacy Policy linked from landing page' row when no href matches its regex; E-E-A-T Analyzer fails when no href matches /privacy/i; Trust Signal Surface Audit fails when /privacy does not return a page; Migration Analyzer fails when none of its 4 legal pages are linked. - Numbers and lists the tool uses: Mega Analyzer href /\/privacy(\/|$|-policy|-notice|_policy)|\/pp\/?$/i; Analyzer href /privacy|datenschutz|politica[- ]?privacidad/i or link text /privacy policy|datenschutz/i; Mega SEO Analyzer /href=["'](?:[^"']*\/)?(?:privacy(?:-policy)?|policies\/privacy(?:-policy)?)\b/i counted toward 2 of 3 policy links (Shopify /policies/* accepted); E-E-A-T Analyzer any href /privacy/i; Batch Analyzer any href /privacy/i (weight 5); Trust Signal Surface Audit fetches /privacy; Competitor Gap Matrix href="/privacy; Migration Analyzer paths /privacy /terms /disclaimer /accessibility /cookies /cookie-policy /tos /legal /gdpr (privacy slot satisfied by /privacy, /gdpr, /cookies or /cookie-policy), pass at 3 or more of 4 pages, warn 1 to 2, fail 0; Single Site Gen lists /privacy among its required trust signals; Site Migration Gen requires /privacy/ linked from the footer of every page. - Why: Any site that collects data, even through analytics, needs a privacy policy, and if the page does not link to one it is effectively missing. - Fix: Publish a privacy policy page at /privacy and link it from the footer of every page. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Trust Signal Surface](https://jwatte.com/tools/trust-signal-surface-audit/), [Competitor Gap Matrix](https://jwatte.com/tools/competitor-gap-matrix/) and 6 more. Standard: GDPR; CCPA. - [ ] **7.4 Terms of service page** - Pass: The page links to a published terms of service or terms of use page. - Warn: Mega SEO Analyzer warns when fewer than 2 of the 3 policy links (privacy, terms, cookies) are present; Migration Analyzer warns when only 1 to 2 of its 4 legal pages are linked. - Fail: Trust Signal Surface Audit fails when /terms does not return a page; E-E-A-T Analyzer fails when no href matches /disclaimer|terms/i; Mega Analyzer fails its 'Terms of Use / Terms of Service page linked' row when no href matches its regex. - Numbers and lists the tool uses: Mega Analyzer href /\/(terms|tos|tou|legal|terms-of-service|terms-of-use|terms-and-conditions|disclaimer)(\/|$|\.html)/i; Mega SEO Analyzer href /(?:[^"']*\/)?(?:terms(?:-of-(?:service|use))?|policies\/terms(?:-of-(?:service|use))?)\b/i; E-E-A-T Analyzer href /disclaimer|terms/i; Trust Signal Surface Audit fetches /terms; Competitor Gap Matrix href="/terms; Migration Analyzer paths /terms /tos /legal among its 4 legal pages; Site Migration Gen requires /terms/ in the footer of every page. - Why: A missing terms page reads as an amateur operation and leaves the rules for using the site unstated. - Fix: Publish a terms of service page at /terms and link it from the footer of every page. - Verify: [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Trust Signal Surface](https://jwatte.com/tools/trust-signal-surface-audit/), [Competitor Gap Matrix](https://jwatte.com/tools/competitor-gap-matrix/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/) and 3 more. - [ ] **7.5 Cookie Policy Detected** - Pass: The page links to a cookie policy page (a /privacy#cookies anchor is accepted). - Warn: E-E-A-T Analyzer reports a missing cookie policy link as a warning; Mega SEO Analyzer warns only when fewer than 2 of its 3 policy links (privacy, terms, cookies) are present; Migration Analyzer does not report cookies separately, it counts /cookies or /cookie-policy toward its privacy slot. - Fail: Mega Analyzer fails its 'Cookie Policy linked (separate from Privacy Policy)' row when no href matches /[\/#]cookies?/i. - Numbers and lists the tool uses: Mega Analyzer href /[\/#]cookies?/i; Mega SEO Analyzer /href=["'](?:[^"']*\/)?(?:cookies?(?:-policy)?|policies\/cookies?(?:-policy)?)\b/i; E-E-A-T Analyzer href /cookie/i or body text 'cookie policy'; Migration Analyzer paths /cookies /cookie-policy count toward its privacy slot; Legal Pages Generator links /cookies/ from the privacy policy; Site Migration Gen requires /cookies/ or a cookie disclosure by category (essential, analytics, marketing) with purpose and retention. - Why: If the site sets cookies or runs tracking, visitors need a page that names the cookies and how to control them. - Fix: Publish the cookie policy at /cookies and link it from the footer and from the privacy policy. - Verify: [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [Migration Analyzer](https://jwatte.com/tools/migration-analyzer/) and 2 more. - [ ] **7.6 Legal pages linked: `<n>` / 4** - Pass: The site publishes and links /disclaimer and /accessibility pages alongside privacy and terms. - Warn: Migration Analyzer warns when only 1 to 2 of the 4 legal pages (privacy, terms, disclaimer, accessibility) are linked. - Fail: Migration Analyzer fails when none of the 4 legal pages are linked. - Numbers and lists the tool uses: Migration Analyzer counts 4 slots via paths /privacy /terms /disclaimer /accessibility /cookies /cookie-policy /tos /legal /gdpr (privacy slot = /privacy, /gdpr, /cookies or /cookie-policy; terms slot = /terms, /tos or /legal), pass at 3 or more, warn 1 to 2, fail 0; Single Site Gen and Site Migration Gen list /privacy /contact /disclaimer /accessibility as required trust signals; Site Migration Gen additionally requires the accessibility statement to name a WCAG 2.2 Level AA target, known issues and a contact, and all legal pages linked from the footer on every page. - Why: Disclaimer and accessibility pages round out the trust pages that show a real organization operates the site. - Fix: Publish a disclaimer page and an accessibility statement (WCAG 2.2 AA target, known issues, a contact for problems) and link both from the footer. - Verify: [Migration Analyzer](https://jwatte.com/tools/migration-analyzer/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/), [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/). Standard: WCAG 2.2 AA. - [ ] **7.7 Refund, shipping and DPA policy links** - Pass: Where they apply, the page links to refund or return, shipping or delivery, and data-processing-agreement pages. - Warn: Mega Analyzer reports a missing refund, shipping or DPA link as informational, and only when the matching schema type is on the page. - Numbers and lists the tool uses: refund /\/(refunds?|returns?|refund-policy|return-policy|exchanges?)(\/|$)/i, flagged only when the page carries Product, OfferCatalog or Service schema; shipping /\/(shipping|shipping-policy|delivery)(\/|$)/i, only with Product schema; dpa /\/(dpa|data-processing|subprocessors?|gdpr-dpa)(\/|$)/i, only with SoftwareApplication or Service schema; all three are informational rows in the Mega Analyzer depth section. - Why: Product sellers and software vendors are expected to publish these business-specific policy pages. - Fix: Publish the applicable policy pages and link them from the footer. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **7.8 Cookie preference center and consent banner** - Pass: A consent banner is actually rendered on the page and a cookie preference center link is present. - Warn: Analyzer and Mega SEO Analyzer report a missing consent mechanism as a warning; Mega Analyzer reports both the rendered banner element and the preference center link as informational rows. - Numbers and lists the tool uses: Mega Analyzer preference links /\/(cookie-settings|cookie-preferences|privacy-settings|manage-cookies|cookie-manage|opt-out|do-not-sell)(\/|$)/i or body /(cookie\s+(settings|preferences)|manage\s+cookies|do\s+not\s+sell|privacy\s+preferences)/i; banner selectors [id*="cookie" i], [class*="cookie" i][class*="banner" i], [class*="consent" i][class*="banner" i], [id*="onetrust" i], [id*="cookiebot" i], [role="dialog"][aria-label*="cookie" i], [aria-describedby*="cookie" i] or body /\b(we\s+use\s+cookies|this\s+(?:site|website)\s+uses\s+cookies|by\s+clicking\s+(?:accept|agree))/i; Analyzer /cookie.?consent|cookie.?banner|onetrust|cookiebot|osano|quantcast|trustarc|cookie.?policy|gdpr|site_cookie_consent|siteConsent/i with platform marker /OneTrust|CookieConsent|cookie_consent|Osano|TrustArc/i; Mega SEO Analyzer /cookie(consent|bar|banner)|cookieyes|osano|onetrust|cookiebot|termly|iubenda|borlabs|complianz/i; Legal Pages Generator footer link labelled 'Manage cookies' or 'Privacy Settings', no non-essential cookies before consent for EU or UK visitors, withdrawal as easy as consent. - Why: If analytics or ads fire before consent, EU and UK visitors are tracked without permission, and loading a vendor script is not the same as showing the banner. - Fix: Install a consent platform that renders a banner and gates analytics and ads until consent, and add a 'Manage cookies' preference link in the footer. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [Legal Pages Generator](https://jwatte.com/tools/legal-pages-generator/). Standard: GDPR / ePrivacy Directive. - [ ] **7.9 Privacy Policy: sections 1 to 10 plus changes clause** - Pass: The privacy policy names the data collected, the purposes, every embedded third-party service with its purpose and policy link, retention periods, the rights for each jurisdiction served with a response time, transfer safeguards, a children clause, a health clause where health data is collected, and a changes clause. - Numbers and lists the tool uses: data categories: email address, name, physical address, payment information (processed by the payment provider, full card numbers never stored), IP address and device identifiers, analytics cookies, advertising cookies and pixels, uploaded content, health-related information, information about children under 13 (COPPA); defaults email, ip, analytics; collection moments: visit, form, subscribe, account, purchase, interact; five purposes: operate and improve the Site, communicate (marketing with consent where required), process transactions, detect fraud and abuse, comply with law; third-party services library: Google Analytics 4, Google Ads, Meta (Facebook) Pixel, Stripe, PayPal, Mailchimp / Mailjet, SendGrid / Postmark, Cloudflare, Netlify, Vercel, Intercom / Crisp, Microsoft Clarity, HubSpot, YouTube / Vimeo, each listed as name, purpose and policy link, default GA4; statement 'We do not sell personal information to third parties'; 'Do Not Sell or Share My Personal Information' footer link when California is served; retention: account data for the life of the account plus 90 days, anonymized analytics up to 26 months; jurisdictions us, ca, eu, uk, canada, au, br (defaults us, ca, eu), each with its own rights paragraph (GDPR: access, rectify, erase, restrict, object, port, withdraw consent, complain; CCPA: know, delete, correct, limit sensitive PI, opt out, non-discrimination; PIPEDA and Quebec Law 25; Australian APPs with OAIC escalation; LGPD); 'We respond within 30 days'; Standard Contractual Clauses for transfers; age 13 children clause, COPPA commitments when children's data is collected; HIPAA paragraph only when health data is collected, PHI handled under a separate Notice of Privacy Practices; material changes announced at least 30 days before taking effect; 'Last updated' date. - Why: Different laws require different clauses, and a policy that names each vendor, retention period and regional right is what regulators and careful visitors look for. - Fix: Generate or rewrite the privacy policy so every section above is present, checking every data category actually collected, every embedded vendor and every region visitors come from. - Verify: [Legal Pages Generator](https://jwatte.com/tools/legal-pages-generator/). Standard: GDPR; UK-GDPR; CCPA / CPRA; PIPEDA; Quebec Law 25; Australian Privacy Act; LGPD; COPPA; HIPAA; EU Standard Contractual Clauses. - [ ] **7.10 Cookie Policy: categories, control and consent sections** - Pass: The cookie policy defines cookies and similar technologies, lists each cookie category with its vendors and lifetimes, explains how to control cookies, and states the consent commitments for GDPR users and Do-Not-Track. - Numbers and lists the tool uses: definition covers localStorage, session storage, pixels and SDKs; strictly necessary: session, consent-preference, CSRF-protection and load-balancer cookies, cannot be turned off; functional: theme and language preferences, optional; analytics section when GA4 or Microsoft Clarity is used (GA4 retention up to 26 months, policy links https://policies.google.com/privacy and https://privacy.microsoft.com/privacystatement); advertising section when Google Ads or Meta Pixel is used (links https://policies.google.com/privacy and https://www.facebook.com/privacy/policy/); browser control via https://www.allaboutcookies.org/; GDPR and UK users: no non-essential cookies until consent, withdrawal via the Preference Center; Do-Not-Track honored where technically feasible; California residents pointed to 'Do Not Sell or Share My Personal Information'. - Why: Naming each service, its purpose and cookie lifetime is what makes a cookie policy useful rather than boilerplate. - Fix: Write the cookie policy by category, name every vendor with its purpose and retention, and state that no non-essential cookies are set before consent. - Verify: [Legal Pages Generator](https://jwatte.com/tools/legal-pages-generator/). Standard: GDPR; UK-GDPR; CCPA / CPRA. - [ ] **7.11 Terms of Service: eligibility through changes clauses** - Pass: The terms cover eligibility, account responsibility, acceptable use, intellectual property, user-submitted content, third-party links, disclaimer of warranties, limitation of liability, indemnification, governing law and a changes clause. - Numbers and lists the tool uses: eligibility age 13, age 18 for transactions, SaaS adds a representation of authority to bind the organization; account clause: keep credentials secure, SaaS variant adds notify immediately of unauthorized use; seven acceptable-use prohibitions: violate law, bypass rate limits or authentication, scrape or mirror except per robots.txt and ai.txt, interfere with users, upload malware or infringing content, impersonate, spam; IP: viewing and link-sharing allowed, redistribution, re-hosting, automated scraping beyond allow-lists and re-packaging prohibited without written permission; e-commerce types add a Purchases clause (refund or return policy linked from every product page and the footer, prices subject to change, taxes may apply); SaaS adds a Subscription + billing clause (automatic renewal, cancel any time effective at the end of the billing period, no pro-rated refunds for partial periods except where required by law); UGC: worldwide royalty-free license to host, display and distribute, user keeps ownership; third-party links disclaimer; 'as is' and 'as available' warranty disclaimer; liability cap $100 or the amount paid in the preceding 12 months, whichever is greater; indemnification; governing law without regard to conflict-of-law principles, venue in that jurisdiction; material changes announced at least 30 days ahead. - Why: Complete terms set the rules for using the site and limit the business's exposure. - Fix: Draft terms of service that include every clause above and enter the governing-law state or country before publishing. - Verify: [Legal Pages Generator](https://jwatte.com/tools/legal-pages-generator/). - [ ] **7.12 Business + site basics and contact section on every generated document** - Pass: Every legal document states the legal business name, site URL, effective date, contact email, mailing address and governing law, ends with a contact block, and has been reviewed by an attorney before publishing. - Fail: A bracketed placeholder such as '[Your Business Name]' or '[Your mailing address]' left in a published document. - Numbers and lists the tool uses: placeholders '[Your Business Name]', 'https://yoursite.com', 'privacy@yoursite.com', '[Your mailing address]', '[Your state / country]'; effective date as YYYY-MM-DD; every document opens with 'Effective date' and the privacy policy also 'Last updated'; contact block at the end of the Privacy Policy, Terms, Refund Policy and DPA with email, business name and mailing address, the DPA labelling it 'DPO / Privacy contact'; drafting rules: plain language, each clause cites its law (GDPR Art. X, CCPA section X, FTC 16 CFR 255), 30-day notice for material changes, paragraphs of 3 to 5 sentences, a closing 'Attorney review recommendations' section flagging HIPAA, FINRA and state-bar requirements, output labelled 'template draft, for attorney review'. - Why: A physical mailing address is a CAN-SPAM and CCPA requirement and the contact email is where legal and privacy requests arrive. - Fix: Fill in every identity field, replace any leftover placeholder, and have a licensed attorney review before publishing, especially with sensitive data, several regions or meaningful revenue. - Verify: [Legal Pages Generator](https://jwatte.com/tools/legal-pages-generator/). Standard: CAN-SPAM; CCPA. - [ ] **7.13 Disclaimers: FTC affiliate, medical, financial, legal** - Pass: The page carries the disclaimer that matches its content type: affiliate, medical, financial or legal. - Fail: E-E-A-T Analyzer reports a missing affiliate or sponsorship disclosure as informational only. - Numbers and lists the tool uses: Mega Analyzer FTC /\b(as\s+an\s+amazon\s+associate|affiliate\s+disclosure|we\s+(?:may\s+)?earn\s+(?:a\s+)?commission|this\s+post\s+contains\s+affiliate|compensated\s+affiliate)\b/i, informational and only when Article, BlogPosting or Review schema is present; medical /\b(not\s+(?:medical|professional)\s+advice|consult\s+(?:your|a)\s+(?:doctor|physician|healthcare)|for\s+informational\s+purposes\s+only)\b/i, only with Medical*, HealthTopicContent or Physician schema; financial /\b(not\s+(?:financial|investment|tax)\s+advice|past\s+performance\s+(?:does\s+not|is\s+not)|informational\s+purposes?\s+only|your\s+capital\s+is\s+at\s+risk)\b/i, only with FinancialService, InvestmentOrDeposit or BankOrCreditUnion schema; legal /\b(not\s+legal\s+advice|attorney\s+advertising|prior\s+results\s+do\s+not\s+guarantee|attorney[- ]client\s+relationship)\b/i, only with LegalService or Attorney schema; E-E-A-T Analyzer body substrings affiliate, sponsored, disclosure (informational); Legal Pages Generator business types blog, affiliate, newsletter, ecom-physical, ecom-digital, saas, consulting, local-service, medical, financial, legal; generated wording: medical (general information only, not medical advice, not intended to diagnose, treat, cure or prevent any disease, consult a qualified provider); financial (not financial, investment, tax or legal advice, past performance does not guarantee future results, risk of loss of principal, not a registered investment adviser, no solicitation or offer); legal (may constitute attorney advertising, not legal advice, no attorney-client relationship formed, do not send confidential information until a relationship exists in writing, prior results do not guarantee similar outcomes); affiliate for affiliate or blog types (commission at no additional cost, 'As an Amazon Associate, `<business>` earns from qualifying purchases', 16 CFR 255); general fallback for ecommerce, saas and consulting (no warranties of accuracy, use at your own risk). - Why: YMYL and monetized content needs an explicit disclaimer so readers know the limits of the advice and how the site earns money. - Fix: Add the disclaimer matching the content type in the footer or near the content, using the wording above. - Verify: [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Legal Pages Generator](https://jwatte.com/tools/legal-pages-generator/). Standard: FTC Endorsement Guides, 16 CFR 255; state bar attorney-advertising rules. - [ ] **7.14 Site-purpose links in HTML: about=<yes/no>** - Pass: The page links to an About page. - Warn: Mega SEO Analyzer warns when only one of the about and contact links is present. - Fail: Mega SEO Analyzer fails when neither about nor contact is linked; E-E-A-T Analyzer fails when no href matches /about|author|bio|team/i; Mega Analyzer fails its 'Link to an about page' row when no href matches /\/about/i; Batch Analyzer requires both about and contact links for its point. - Numbers and lists the tool uses: Mega Analyzer /\/about/i; Mega SEO Analyzer href /href=["'][^"']*\/about(?:\/|["'?#])/i; Batch Analyzer any raw href /about/i and /contact/i (weight 8); E-E-A-T Analyzer any href /about|author|bio|team/i; Mega Analyzer depth row fails when the about link is absent. - Why: The About page is a top E-E-A-T signal and answers Google's question of who is behind the site and why it exists. - Fix: Publish an About page at /about and link it from the header or footer of every page. - Verify: [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/). Standard: Google Helpful Content self-assessment; Google Quality Rater Guidelines. - [ ] **7.15 About page substantive** - Pass: The /about page HTML is longer than 1,500 characters. - Warn: An About page under 1,500 characters is reported as thin. - Fail: No /about page at all (length 0) is reported as missing. - Numbers and lists the tool uses: path /about; length over 3,000 chars reported as robust, over 1,500 adequate, 1 to 1,500 thin, 0 missing; detail rounds to hundreds of chars. - Why: A thin or missing About page undermines the credibility infrastructure that readers and engines check first. - Fix: Expand the About page with who runs the business, its history, credentials and how to reach you. - Verify: [Trust Signal Surface](https://jwatte.com/tools/trust-signal-surface-audit/). Standard: Google News Initiative trust-project model. - [ ] **7.16 mailto: link or /contact page** - Pass: The page links to a contact page or carries a mailto link. - Warn: Mega SEO Analyzer warns when only one of the about and contact links is present. - Fail: Mega Analyzer fails its 'mailto: link or /contact page' row when neither is present; E-E-A-T Analyzer fails when no href matches /contact/i; Mega SEO Analyzer fails when neither about nor contact is linked. - Numbers and lists the tool uses: Mega Analyzer /\/contact/i or a mailto link; Mega SEO Analyzer href /href=["'][^"']*\/contact(?:\/|["'?#])/i; Batch Analyzer any raw href /contact/i together with /about/i (weight 8); E-E-A-T Analyzer any href /contact/i. - Why: Visitors, journalists and engines cannot verify or reach a business that has no contact route. - Fix: Publish a contact page at /contact with an email address and link it from every page. - Verify: [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/). Standard: Google Helpful Content self-assessment. - [ ] **7.17 Contact path: `<email>` `<phone>` `<booking link>`** - Pass: An email address or a phone number is visible on the page, ideally with a calendar booking link. - Warn: About Page Conversion Audit warns when neither email nor phone is visible and again when no booking link is present; Mega Analyzer rates 1 to 2 of 7 contact signals as ok. - Fail: Mega Analyzer rates 0 of 7 contact signals as bad. - Numbers and lists the tool uses: email /\bmailto:|\b[\w.%+-]+@[\w.-]+\.[a-z]{2,}\b/i; phone /\btel:|$\d{3}$\s*\d{3}|\b\d{3}[-.\s]\d{3}[-.\s]\d{4}\b/; booking link /calendly|cal\.com|savvycal|tidycal|acuityscheduling|scheduleonce|youcanbookme|hubspot\.com\/meetings/i (a booking link alone does not pass); Competitor Gap Matrix /tel:\+?\d/i and /<address|\b(street|avenue|blvd)\b/i; Mega Analyzer contact signals out of 7, 3 or more good, 1 ok, 0 bad; live-chat vendors Intercom, Zendesk, Drift, Tidio, Crisp, HelpScout, Tawk, Olark, LiveChat, HubSpot; booking vendors Calendly, Cal.com, SavvyCal, Acuity, HubSpot Meetings, Chili Piper, OnceHub, Stripe Payment Links (both reported as informational). - Why: High-intent visitors who reach the About or contact page need a direct route, and a booking link converts 2 to 3 times better than a bare contact form. - Fix: Show an email address, a tel: phone link and a postal address, and add a calendar booking link for consultations. - Verify: [About-Page Conversion Audit](https://jwatte.com/tools/about-page-conversion-audit/), [Competitor Gap Matrix](https://jwatte.com/tools/competitor-gap-matrix/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **7.18 Contact Info in Schema** - Pass: Any JSON-LD block carries contactPoint, email or telephone. - Fail: E-E-A-T Analyzer fails when none of contactPoint, email or telephone appears in any JSON-LD block. - Numbers and lists the tool uses: keys contactPoint, email, telephone searched recursively through all JSON-LD blocks; Single Site Gen and Site Migration Gen require Organization contactPoint alongside the /contact page. - Why: Structured contact data lets engines confirm the business is reachable without parsing the page. - Fix: Add contactPoint, email or telephone to the Organization node. - Verify: [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/), [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/). Standard: schema.org Organization contactPoint / email / telephone. - [ ] **7.19 Authors or team page** - Pass: The site links to a team, people or authors page. - Fail: Trust Signal Surface Audit fails when neither /authors nor /team returns a page; Mega Analyzer fails its team-link row unless the page carries NewsMediaOrganization, WebApplication, SoftwareApplication, Dataset, DataCatalog or Periodical schema or ProfilePage plus Person, where it is informational; About Page Conversion Audit reports an absent team link as informational. - Numbers and lists the tool uses: Mega Analyzer /\/team|\/people|\/staff|\/leadership|\/founders?/i; Trust Signal Surface Audit fetches /authors and /team; About Page Conversion Audit /\/team|\/people|our team|meet the team/i. - Why: Multi-author publications and businesses with staff should show the people behind the work, each with their own bio. - Fix: Publish a team or authors page and give each person a bio with Person schema and sameAs links. - Verify: [Trust Signal Surface](https://jwatte.com/tools/trust-signal-surface-audit/), [About-Page Conversion Audit](https://jwatte.com/tools/about-page-conversion-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: Google News Initiative trust-project model. - [ ] **7.20 Editorial policy page** - Pass: An editorial policy page exists and is linked. - Warn: E-E-A-T Analyzer reports a missing editorial policy as a warning. - Fail: Trust Signal Surface Audit fails when neither /editorial-policy nor /policies/editorial returns a page. - Numbers and lists the tool uses: Trust Signal Surface Audit paths /editorial-policy, /policies/editorial; E-E-A-T Analyzer href /editorial/i or body text 'editorial policy'. - Why: Without documented editorial standards a site reads as an opinion site rather than an edited publication. - Fix: Publish a one-page editorial policy describing how content is researched, reviewed and updated, and link it from the footer. - Verify: [Trust Signal Surface](https://jwatte.com/tools/trust-signal-surface-audit/), [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/). Standard: Google News Initiative trust-project model. - [ ] **7.21 Corrections policy page** - Pass: A corrections policy page exists at /corrections or /policies/corrections. - Fail: Trust Signal Surface Audit fails when neither /corrections nor /policies/corrections returns a page. - Numbers and lists the tool uses: paths /corrections, /policies/corrections. - Why: News and authority sites are expected to say how errors are reported and fixed. - Fix: Publish a one-page corrections policy and link it from the footer. - Verify: [Trust Signal Surface](https://jwatte.com/tools/trust-signal-surface-audit/). Standard: Google News Initiative trust-project model. - [ ] **7.22 Internal links: pricing, FAQ and content hub** - Pass: The page links to pricing, an FAQ (or carries FAQPage schema) and a blog or content hub. - Warn: Mega Analyzer reports the pricing link as informational only. - Fail: A missing FAQ link (or FAQPage schema) or a missing blog / resources / guides link renders as a failed check in the Mega Analyzer depth rows. - Numbers and lists the tool uses: pricing /\/pric(?:e|ing)|\/plans?|\/cost|\/quote/i; faq /\/faq|\/frequently[- ]asked/i or FAQPage schema; blog href /\/(blog|articles?|insights?|resources|learn|guides?|news|desks?|coverage|briefs?|publications?|stories|topics?|sections?|categor(?:y|ies)|reports?|wire|posts?|essays?|notes?|journal)(\/|$|\?|#)/i or schema type /^(BlogPosting|NewsArticle|Article|Newsletter|TechArticle|ScholarlyArticle|Periodical)$/ or a rel=alternate feed link of type rss+xml, atom+xml or feed+json or links matching /[?&#](?:view|desk|section|topic|category|tab)=/i. - Why: FAQ pages are among the most citable content for answer engines, and a content hub shows ongoing expertise even when it is not at /blog/. - Fix: Link pricing, an FAQ and the content hub from the landing page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: Google Quality Rater Guidelines. - [ ] **7.23 Internal links: careers** - Pass: The page links to a careers page (careers, jobs, hiring or work-with-us path). - Warn: The Mega Analyzer depth row reports the careers link as informational only. - Numbers and lists the tool uses: careers /\/careers|\/jobs|\/hiring|\/work[- ]with[- ]us/i, rendered as informational only. - Why: Open roles are a secondary sign of an established, operating business. - Fix: Add and link a careers page where the business has open roles. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **7.24 Person schema on the page** - Pass: A Person node for the author or owner is present in the JSON-LD. - Warn: SGE Readiness Audit warns when only one of Person schema, Organization schema or a meta[name=author] / [rel=author] element is present (Organization plus a meta author or rel=author passes without Person); E-E-A-T Author Entity Graph warns with 1 to 2 distinct Person entities. - Fail: Mega Analyzer E-E-A-T tab renders a missing Person node as a failed check; E-E-A-T Author Entity Graph fails with 0 Person entities, meaning every article is bylined to an anonymous identity from Google's perspective; SGE Readiness Audit fails with no Person schema, no Organization schema and no meta author. - Numbers and lists the tool uses: E-E-A-T Author Entity Graph counts distinct Persons deduplicated by lowercased name across the root page and crawled author pages, 3 or more good, 1 to 2 warn, 0 fail, falling back to the first rel=author link; captured fields name, url, jobTitle, affiliation, knowsAbout, hasCredential, sameAs, alumniOf, worksFor; Batch Analyzer passes on a Person with name, an organization-subtype node with name, or any author field (weight 12); Mega Batch weight 15; SGE Readiness any schema type /Person/i; Single Site Gen Person fields name, jobTitle, knowsAbout, sameAs, url, image; Schema Fix Bundle emits the author Person as {@type: Person, @id: `<page url>`#author, name, url: `<origin>`/author/`<slug>`/, sameAs: [Wikidata, ORCID, LinkedIn]} referenced by Article, BlogPosting, Recipe, Book and Course. - Why: Google and AI engines resolve bylines to entities; a byline without Person schema is invisible to the E-E-A-T signal chain, and author is a required field for Article-family rich results. - Fix: Add a Person node for the author or owner with name, jobTitle, url, image, knowsAbout and sameAs, and reference it as author on every article. - Verify: [E-E-A-T Author Entity Graph](https://jwatte.com/tools/e-e-a-t-author-entity-graph/), [SGE Readiness Audit](https://jwatte.com/tools/sge-readiness-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega Batch](https://jwatte.com/tools/mega-batch/) and 3 more. Standard: schema.org Person. - [ ] **7.25 Organization schema on the page** - Pass: An Organization node for the publisher or business is present in the JSON-LD. - Warn: SGE Readiness Audit warns when only one of Person schema, Organization schema or a meta[name=author] / [rel=author] element is present; Organization plus a meta author or rel=author passes. - Fail: Mega Analyzer E-E-A-T tab renders a missing Organization node as a failed check; SGE Readiness Audit fails with no Person schema, no Organization schema and no meta author. - Numbers and lists the tool uses: SGE Readiness any schema type /Organization/i, with meta[name="author"] or [rel="author"] counted as author attribution; Mega Batch weight 15. - Why: The Organization node is the publisher identity that engines use to score source credibility. - Fix: Add an Organization node with name, url, logo, sameAs and contact details and reference it as publisher. - Verify: [SGE Readiness Audit](https://jwatte.com/tools/sge-readiness-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega Batch](https://jwatte.com/tools/mega-batch/). Standard: schema.org Organization. - [ ] **7.26 Author byline / authorship: `<n>` of 3 signals** - Pass: At least two of the three authorship signals are present: a visible 'By Firstname Lastname' byline, a rel=author link and a Person author in schema. - Warn: Mega SEO Analyzer warns with exactly one signal; Author Authority per Article warns when no byline element is detected. - Fail: Mega SEO Analyzer fails with zero signals; Mega AEO Analyzer scores 40 out of 100 when no Person schema, meta author or rel=author is found; Trust Signal Surface Audit fails 'Author byline on page' when none of rel=author, itemprop=author or an author class is found. - Numbers and lists the tool uses: Mega SEO Analyzer rel=author /<[^>]+rel=["']?author["']?/i, Person-schema author /"@type"\s*:\s*"Person"/i together with /"author"\s*:/i, byline /\bby\s+[A-Z][a-z]+(?:\s+[A-Z][a-z]+){1,2}\b/ on body text, pass 2, warn 1; Trust Signal Surface Audit /<(?:a|div|span)[^>]*rel=["']author["']|itemprop=["']author["']|class=["'][^"']*author/i; Author Authority per Article selectors [class*="byline"], [class*="author"], [rel="author"], [itemprop="author"] with text under 200 chars, preferring /^by\s/i; Mega AEO Analyzer /"@type":\s*"Person"|<meta[^>]+name=["']author["']|rel=["']author["']/i scores 100 or 40; Single Site Gen bylines link to /about or /author/`<slug>` with Person schema. - Why: Readers and engines need to see who wrote the page; the Quality Rater Guidelines section 2.5.2 asks for clarity of authorship. - Fix: Add a visible 'By [Name] · [Role] · [Date]' line near the headline, link the name to the author page with rel=author, and declare the Person as author in the Article schema. - Verify: [Trust Signal Surface](https://jwatte.com/tools/trust-signal-surface-audit/), [Author Authority per Article](https://jwatte.com/tools/author-authority-per-article/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [Mega AEO Analyzer](https://jwatte.com/tools/mega-aeo-analyzer/) and 1 more. Standard: Google Search Quality Rater Guidelines Section 2.5.2. - [ ] **7.27 rel=author or author-profile link present** - Pass: The byline (or a link element in the head) carries rel=author pointing at the author's profile page. - Warn: Analyzer, Mega Analyzer and Author Authority per Article report a missing rel=author as a warning. - Fail: Mega Analyzer E-E-A-T tab renders a missing rel=author or author-profile link as a failed check on every page. - Numbers and lists the tool uses: selectors link[rel="author"], a[rel="author"], a[rel~=author]; Analyzer /rel=["']?author/gi; Author Authority per Article also accepts a[href*="/author/"], a[href*="/authors/"], a[href*="/contributor"] with non-empty text; Batch Analyzer weight 6; Mega Analyzer editorial-context gate; author page requirements from Author Authority per Article: dedicated /author/`<slug>`/ page with Person schema, sameAs to LinkedIn or an academic profile, a 200+ word bio with credentials and a list of recent posts; its 8-point score buckets at 6 (strong) and 4 (mid-tier). - Why: The rel=author link connects each article to a verified person, which Google E-E-A-T and AI citation engines use to attribute content. - Fix: Link the byline name to a per-author page with rel=author (or add `<link rel="author">` in the head) and give that page Person schema, sameAs links, a 200+ word bio and recent posts. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Author Authority per Article](https://jwatte.com/tools/author-authority-per-article/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/). - [ ] **7.28 Author looks like a CMS default placeholder** - Pass: The article author is a named person or the organization, not a CMS default account. - Fail: The author name matches admin, administrator, webmaster, default, wp-admin, wp_admin, wpadmin, root, test, user or owner. - Numbers and lists the tool uses: author.name /^(?:admin|administrator|webmaster|default|wp[-_]?admin|root|test|user|owner)$/i. - Why: A WordPress or HubSpot factory default author tells engines nobody real is credited. - Fix: Set the author to a real person or to the Organization. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **7.29 article:author, article:published_time, article:modified_time meta** - Pass: Article pages carry the Open Graph article:author, article:published_time and article:modified_time meta tags. - Warn: Mega Analyzer reports a missing article:author as a warning, and a missing article:published_time or article:modified_time (both required) as a separate warning, on pages with Article schema or og:type article. - Numbers and lists the tool uses: meta property article:author, article:published_time, article:modified_time; gate hasArticle or ogType == article. - Why: Social networks and AI crawlers read the article:* meta to attribute authorship and judge freshness. - Fix: Add `<meta property="article:author" content="profile URL">` plus the published and modified time meta on article pages. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: Open Graph article object. - [ ] **7.30 Date apparatus: datePublished=<yes/no>, dateModified=<yes/no>** - Pass: The page's JSON-LD carries both datePublished and dateModified. - Warn: Mega SEO Analyzer warns when only one of the two dates is present; Mega Analyzer marks a missing dateModified as a warning on editorial sites and optional on service-business sites; Mega AEO Analyzer scores dateModified alone at 65 (warn band 60 to 79); SGE Readiness Audit warns when time elements exist but none holds a parseable date. - Fail: Mega SEO Analyzer fails with neither date; E-E-A-T Analyzer fails when no datePublished exists; SGE Readiness Audit fails with no schema date, itemprop date or time[datetime]; Mega Analyzer fails an editorial or Article page with neither date and its E-E-A-T tab renders a missing dateModified as a failed check on every page. - Numbers and lists the tool uses: Mega Analyzer reads the first datePublished, dateModified and author.url on nodes typed /Article|BlogPosting|NewsArticle|FAQPage|WebPage|ProfilePage|AboutPage|ContactPage|CollectionPage|WebSite|Organization/ (first element when author is an array; author.url is extracted but not checked); Mega SEO Analyzer /"datePublished"\s*:/i and /"dateModified"\s*:/i; Analyzer /"dateModified"/ in any block; SGE Readiness /"date(Published|Modified|Created)"/ or [itemprop="datePublished"], [itemprop="dateModified"] or time[datetime] with ISO prefix /^\d{4}-\d{2}/; Author Authority per Article reads [itemprop="datePublished"], meta[property="article:published_time"], time[datetime] (missing = warn) and [itemprop="dateModified"], meta[property="article:modified_time"] (missing = info); Mega AEO Analyzer base 30, +35 for /"dateModified":\s*"([^"]+)"/i, +15 for datePublished, +20 for body /\bas of \d{4}|updated [A-Z][a-z]+ \d{4}|last updated/i, pass at 80; Batch Analyzer /"dateModified"/ weight 6 (GEO and AEO buckets) and 5 (E-E-A-T bucket), both dates weight 6 (schema bucket). - Why: Discover, AI Overviews and answer engines rank fresh content higher and need machine-readable dates to judge it. - Fix: Add datePublished and dateModified (ISO dates) and an author with url to the Article or WebPage node, and keep dateModified current when the page changes. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [SGE Readiness Audit](https://jwatte.com/tools/sge-readiness-audit/), [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Author Authority per Article](https://jwatte.com/tools/author-authority-per-article/) and 4 more. Standard: schema.org datePublished / dateModified. - [ ] **7.31 Visible "Updated on [date]" stamp in page body** - Pass: The visible page text (including the footer) carries an updated, last updated, last modified or reviewed phrase followed by a date. - Warn: Mega Analyzer crawl check (editorial context only), E-E-A-T Analyzer and Trust Signal Surface Audit report a missing stamp as a warning. - Fail: Mega Analyzer E-E-A-T tab renders a missing stamp as a failed check on every page; Trust Signal Surface Audit's separate 'dateModified visible on page' row fails when neither a `<time datetime>` nor a class containing date, updated or modified is present. - Numbers and lists the tool uses: regex /\b(updated|last\s+updated|last\s+modified|reviewed)\s*(on|:)?\s*([A-Z][a-z]+\s+\d{1,2},?\s+20\d{2}|\d{4}-\d{2}-\d{2})\b/i (Batch Analyzer E-E-A-T bucket omits 'reviewed', weight 4; AEO bucket weight 5); Trust Signal Surface Audit separate row 'dateModified visible on page' /<time[^>]*datetime|class=["'][^"']*(date|updated|modified)/i (fail when missing); Mega AEO Analyzer adds 20 points for /\bas of \d{4}|updated [A-Z][a-z]+ \d{4}|last updated/i; Mega Analyzer crawl check editorial-context gate, E-E-A-T tab row ungated. - Why: Crawlers that extract text without parsing JSON-LD still pick up a visible freshness cue. - Fix: Render a visible 'Last updated: Month DD, YYYY' line at the top or bottom of evergreen pages and keep it in sync with dateModified. - Verify: [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Trust Signal Surface](https://jwatte.com/tools/trust-signal-surface-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/) and 1 more. - [ ] **7.32 Content is fresh** - Pass: The page was updated within the last 90 days according to its modified or published date. - Warn: 91 to 365 days since the date is reported as possibly stale; over 365 days as outdated. - Fail: No parseable date at all is reported as informational (no freshness signal). - Numbers and lists the tool uses: 90 days pass; 365 days stale boundary; date sources meta[property=article:modified_time], meta[name=article:modified_time], meta[property=article:published_time], then the first time[datetime]. - Why: Google may deprioritize content that has not been touched in a year. - Fix: Review and update evergreen pages, then bump article:modified_time and dateModified. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **7.33 HTML `<cite>` or `<blockquote cite="...">` markup used (`<n>`)** - Pass: At least one `<cite>` element or blockquote with a cite attribute is present (Mega SEO Analyzer wants 2 or more). - Warn: Mega Analyzer warns when blockquotes exist but none is cited; Mega SEO Analyzer warns with exactly one cite marker. - Fail: Mega Analyzer E-E-A-T tab fails when blockquotes exist but none is cited; when the page has no blockquotes at all, a missing cite is reported as informational, not a failure. - Numbers and lists the tool uses: Mega Analyzer and Batch Analyzer citeElements + blockquoteCited >= 1 (Batch weight 6 AEO bucket, 4 E-E-A-T bucket); Mega SEO Analyzer /<cite\b|<blockquote[^>]+cite=/gi, pass 2, warn 1, info 0, alongside outbound link count /<a [^>]+href=["']https?:\/\/[^"']+["']/gi. - Why: Machine-readable citation markup makes claims verifiable and raises source-quality scores in answer engines. - Fix: Wrap source names in `<cite>` and add cite="`<url>`" on every blockquote. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/). Standard: HTML cite element. - [ ] **7.34 Data-source attribution** - Pass: Statistics on the page are introduced with explicit sourcing phrases such as 'according to' or 'source:'. - Warn: The Mega Analyzer specificity row reports a missing attribution as informational. - Numbers and lists the tool uses: /\b(according\s+to|source\s*:|data\s+from|as\s+reported\s+(?:by|in)|cited\s+(?:by|in)|per\s+(?:the\s+)?(?:\w+\s+){1,3}report)\b/i. - Why: Transparent sourcing supports trustworthiness and makes numbers citable. - Fix: Say where each number comes from next to the number. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **7.35 Authoritative Data Sources Cited** - Pass: The body text references authoritative research or government data sources at least twice. - Warn: Exactly one such reference is reported as few data citations. - Fail: No such reference at all is reported as No Data Source Citations (fail). - Numbers and lists the tool uses: /(pubmed|doi\.org|census\.gov|bls\.gov|harvard|stanford|ncbi|\.edu\/|research\.)/gi on body text; pass 2 or more, warn 1. - Why: Citing primary research and government data shows the expertise behind the claims. - Fix: Cite PubMed, DOI.gov or .edu sources for the facts on the page. - Verify: [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/). - [ ] **7.36 Links to Authoritative Domains** - Pass: The page links to .gov.edu, DOI or PubMed sources at least three times. - Warn: One or two such links are reported as few authoritative outbound links. - Fail: No links to .gov.edu, DOI or PubMed is reported as No Links to Authoritative Domains (fail). - Numbers and lists the tool uses: /\.(gov|edu)\b|doi\.org|pubmed/i on hrefs; pass 3 or more, warn 1 to 2. - Why: Outbound links to authoritative domains build the page's own authoritativeness. - Fix: Link the claims on the page to their .gov.edu, DOI or PubMed sources. - Verify: [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/). - [ ] **7.37 Citation density, `<n>` outbound links to external sources** - Pass: The page has at least five outbound links to hostnames other than its own (Analyzer accepts one). - Warn: SGE Readiness Audit warns with 2 to 4 outbound links. - Fail: SGE Readiness Audit fails with fewer than 2 outbound links; Analyzer reports 0 external links as informational. - Numbers and lists the tool uses: SGE Readiness a[href^="http"] whose hostname differs from the page, pass 5, warn floor 2; Analyzer external http(s) anchors to other hostnames, pass 1. - Why: Pages that cite external sources show research depth, which AI systems treat as a credibility signal. - Fix: Add outbound citations to primary and authoritative sources. - Verify: [SGE Readiness Audit](https://jwatte.com/tools/sge-readiness-audit/), [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **7.38 Credentials Mentioned** - Pass: The visible text mentions degrees, certifications or licenses at least twice. - Warn: One credential term is reported as minimal; About Page Conversion Audit warns when no credential is detected. - Fail: E-E-A-T Analyzer fails with no credential term at all. - Numbers and lists the tool uses: E-E-A-T Analyzer /(phd|ph\.d|m\.s\.|mba|certified|licensed|accredited|board.certified)/gi on lowercased body text, pass 2, warn 1, fail 0; About Page Conversion Audit /\b(phd|ph\.d|mba|md|jd|bs|ba|ms|ma|cfa|cpa|cissp|cism|cissp|pe|license|certification|certified|accredited|alumni|graduate|attended)\b/i on raw HTML, pass or warn. - Why: Qualifications shown in the copy are how readers and raters judge expertise. - Fix: Name relevant degrees, certifications and licenses near the author's photo or in the bio, leaving out filler credentials. - Verify: [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [About-Page Conversion Audit](https://jwatte.com/tools/about-page-conversion-audit/). - [ ] **7.39 Credentials (hasCredential on Person)** - Pass: At least one Person entity carries a hasCredential entry. - Warn: Zero credentials across all Person entities is reported as a warning. - Numbers and lists the tool uses: any hasCredential entry; +5 author-entity score per credential; Single Site Gen credential properties alumniOf, worksFor, educationalCredentialAwarded, award. - Why: Credentials on the Person entity feed the E-E-A-T signal chain in machine-readable form. - Fix: Add hasCredential (EducationalOccupationalCredential or Certification) with recognizedBy, plus alumniOf, worksFor and award, to each author's Person node. - Verify: [E-E-A-T Author Entity Graph](https://jwatte.com/tools/e-e-a-t-author-entity-graph/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/). Standard: schema.org hasCredential, EducationalOccupationalCredential. - [ ] **7.40 Person Schema with jobTitle** - Pass: A jobTitle value exists somewhere in the JSON-LD. - Fail: No jobTitle anywhere in the JSON-LD is reported as No jobTitle in Schema (fail). - Numbers and lists the tool uses: key jobTitle searched recursively; first value shown. - Why: A job title on the Person node states the professional role behind the content. - Fix: Add jobTitle to the Person schema. - Verify: [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/). Standard: schema.org Person jobTitle. - [ ] **7.41 knowsAbout Topics Listed** - Pass: The Person schema lists at least three knowsAbout topics. - Warn: E-E-A-T Analyzer warns with 1 to 2 topics; E-E-A-T Author Entity Graph warns with 0 topics across all Person entities. - Fail: E-E-A-T Analyzer fails with no knowsAbout in the schema. - Numbers and lists the tool uses: E-E-A-T Analyzer flattened knowsAbout values, pass 3, warn 1, detail shows first 5; E-E-A-T Author Entity Graph any topic, shows first 6 at 40 chars. - Why: Breadth of declared topics shows depth of expertise, and topics that match the article subject are the stronger signal. - Fix: Add a knowsAbout array to the Person schema listing the expert topics that match what the site writes about. - Verify: [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [E-E-A-T Author Entity Graph](https://jwatte.com/tools/e-e-a-t-author-entity-graph/). Standard: schema.org Person knowsAbout. - [ ] **7.42 `<n>` sameAs URLs (>=3 recommended)** - Pass: The Person or Organization schema carries a sameAs array with at least three off-site profile URLs. - Warn: E-E-A-T Analyzer warns with 1 to 2 sameAs URLs; Mega Analyzer reports fewer than 3 as informational; Mega GEO Analyzer scores exactly 3 links at 75 (warn); E-E-A-T Author Entity Graph warns when the total across all Person entities is below 6; Analyzer and Mega SEO Analyzer warn when no sameAs exists at all. - Fail: E-E-A-T Analyzer fails with 0 sameAs; Mega GEO Analyzer scores 0 to 2 links at 0, 25 or 50 (fail under 60). - Numbers and lists the tool uses: Analyzer any JSON-LD block containing 'sameAs'; Mega SEO Analyzer /"sameAs"\s*:\s*\[/i; Batch Analyzer /sameAs/i weight 12, 3 or more links weight 8, 6 or more weight 4; Mega Batch unique sameAs from a JSON-LD walk, 3 or more weight 15, 6 or more weight 5; E-E-A-T Analyzer flattened sameAs pass 3, warn 1; Mega Analyzer 3, showing up to 8; Mega GEO Analyzer counts sameAs on the first LocalBusiness or Organization node, score = count x 25 capped at 100, 4 or more passes; E-E-A-T Author Entity Graph total sameAs across Person entities 6, persons with 2 or more sameAs counted as externally bound; Single Site Gen and Site Migration Gen 3 or more of LinkedIn, Wikidata, ORCID, GitHub, X, Crunchbase; E-E-A-T Generator universal profiles: Google Business Profile, LinkedIn personal, LinkedIn company, Facebook, Instagram, X / Twitter, YouTube, Wikidata QID, Bing Places, Yelp, BBB; industry-gated: Amazon Author Central and Goodreads (author), ORCID (author, medical, education), Zillow and Realtor.com (real estate), TripAdvisor (hotel, restaurant), Booking.com (hotel), OpenTable (restaurant), Healthgrades and Zocdoc (medical, dental), Avvo and Justia (legal), SpareFoot (storage), Houzz and Thumbtack (home services), Psychology Today (recovery, medical), SAMHSA (recovery). - Why: SameAs tells engines the entity on the site is the same entity on LinkedIn, Wikidata, Google Business Profile and the rest, and AI search computes entity confidence by traversing those links. - Fix: Add a sameAs array to the Person or Organization node with at least three, ideally six or more, full profile URLs: Google Business Profile, LinkedIn, Wikidata, the industry directory, and the social profiles the business actually maintains. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [E-E-A-T Author Entity Graph](https://jwatte.com/tools/e-e-a-t-author-entity-graph/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/) and 7 more. Standard: schema.org sameAs. - [ ] **7.43 Wikidata reference detected** - Pass: A Wikidata item for the business or person exists and its URL appears in sameAs or the page HTML. - Warn: Analyzer and Mega SEO Analyzer report a missing Wikidata reference as a warning; Mega Analyzer's E-E-A-T tab reports it as informational. - Fail: E-E-A-T Analyzer fails with no Wikidata reference; Batch Analyzer and Mega Batch withhold weight 12; E-E-A-T Generator marks the action item missing until a QID is entered. - Numbers and lists the tool uses: regex /wikidata\.org/i on sameAs or HTML (E-E-A-T Analyzer /wikidata/i on sameAs plus substring 'wikidata.org'); E-E-A-T Analyzer Knowledge Panel Readiness is High only with overall score 75 or more, a Wikidata reference and 3 or more sameAs, Medium at 50; E-E-A-T Generator Wikidata statements: business instance of P31 = business Q4830453, country P17 = United States Q30, official website P856, industry P452, inception P571, founded by P112; person P31 = human Q5, occupation P106, citizenship P27, website P856, employer P108; book P31 = book Q571, author P50, publication date P577, title P1476; snippet "sameAs": "https://www.wikidata.org/wiki/Q[YOUR_QID]"; add descriptions in more than one language. - Why: Wikidata is the number one feed into Google's Knowledge Graph and a Knowledge Panel trigger, though it matters most for entities that meet notability. - Fix: Create the Wikidata item (label, description, aliases, the property statements above, descriptions in several languages), note the Q-number and add its URL to sameAs. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/) and 4 more. Standard: Wikidata. - [ ] **7.44 ORCID reference detected** - Pass: An orcid.org profile URL appears in sameAs or the page HTML (applies to academic and research authors). - Fail: Analyzer and E-E-A-T Analyzer report a missing ORCID as informational; Batch Analyzer and Mega Batch withhold weight 8 and 5. - Numbers and lists the tool uses: regex /orcid\.org/i; ORCID record must be PUBLIC, list the employer and the site domain; snippet "sameAs": "https://orcid.org/0000-0002-XXXX-XXXX"; E-E-A-T Generator shows the ORCID field only for author, medical and education industries; Batch Analyzer methodology gives Wikidata and ORCID 20 points combined. - Why: ORCID is a free researcher ID that signals intellectual credibility for academic authors. - Fix: If the author publishes research, register at orcid.org, set the record public, and add the ORCID URL to sameAs. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [E-E-A-T Generator](https://jwatte.com/tools/eeat-generator/) and 3 more. Standard: ORCID. - [ ] **7.45 LinkedIn Profile Linked** - Pass: A LinkedIn /in/ or /company/ profile URL appears in sameAs (or in the page links). - Fail: E-E-A-T Analyzer fails with no LinkedIn reference in sameAs or page links; Schema Validator reports a missing LinkedIn sameAs as an informational row. - Numbers and lists the tool uses: Schema Validator /linkedin\.com\/(in|company)\//i on sameAs of nodes typed /^(Person|Organization|LocalBusiness|Corporation|RealEstateAgent|Attorney|Dentist|Physician|FinancialService|InsuranceAgency|AccountingService)$/ with a non-empty sameAs; E-E-A-T Analyzer /linkedin/i on sameAs or any href; E-E-A-T Generator personal profile headline '[Title] at [Company]', company as current Experience, website in Contact Info, URL https://www.linkedin.com/in/yourname/; company page with exact business name, website, industry, size, description matching Wikidata, logo and banner, 2 to 3 updates posted. - Why: LinkedIn is the most-crawled professional identity directory and the canonical cross-reference for B2B entity reconciliation. - Fix: Complete the personal and company LinkedIn pages and add both URLs to sameAs. - Verify: [Schema Validator](https://jwatte.com/tools/schema-validator/), [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [E-E-A-T Generator](https://jwatte.com/tools/eeat-generator/). - [ ] **7.46 Strong Social Presence** - Pass: At least three social platforms are linked from sameAs or page links (Batch Analyzer needs two references). - Warn: E-E-A-T Analyzer warns with 1 to 2 platforms. - Fail: E-E-A-T Analyzer fails with 0 social links; Batch Analyzer withholds weight 15 below 2 matches. - Numbers and lists the tool uses: E-E-A-T Analyzer platforms facebook.com, twitter.com, x.com, youtube.com, instagram.com, pass 3, warn 1; Batch Analyzer /facebook\.com|twitter\.com|x\.com|linkedin\.com|instagram\.com|youtube\.com|tiktok\.com/gi, 2 or more, weight 15; E-E-A-T Generator Instagram: professional Business account connected to a Facebook Page, same logo, exact business name, at least 3 posts before adding to schema; TikTok: Business account, website link needs 1,000+ followers or a Business account. - Why: Social profiles corroborate identity across platforms and double as sameAs anchors. - Fix: Set up business profiles on the platforms you will maintain, use the exact business name and logo, and link them from the page and sameAs. - Verify: [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/), [E-E-A-T Generator](https://jwatte.com/tools/eeat-generator/). - [ ] **7.47 `<n>` rel='me' identity links** - Pass: The page carries rel="me" links to the owned profiles (E-E-A-T Analyzer and Batch Analyzer want at least two). - Warn: Analyzer warns with 0 rel=me links; E-E-A-T Analyzer warns with exactly one. - Fail: E-E-A-T Analyzer fails with 0 rel=me links. - Numbers and lists the tool uses: Mega Analyzer link[rel~="me"], a[rel~="me"] (token match), relMe > 0; Batch Analyzer and Mega Batch link[rel="me"], a[rel="me"]; Analyzer and E-E-A-T Analyzer count `<link>` elements whose rel is exactly me; Analyzer relMe > 0; Mega Batch relMe > 0 weight 8; E-E-A-T Analyzer pass 2, warn 1, fail 0; Batch Analyzer 2 or more, weight 8; Single Site Gen spec: rel="me" links in `<head>` pointing to the same profiles; E-E-A-T Generator emits one `<link rel="me" href="<url>">` per entered profile in this key order: google, linkedin, linkedin_co, facebook, instagram, twitter, youtube, wikidata, bing, yelp, bbb, amazon_author, goodreads, orcid, zillow, realtor, tripadvisor, booking, opentable, healthgrades, zocdoc, avvo, justia, sparefoot, houzz, thumbtack, psychtoday, samhsa; Monoclone Generator base layout adds one rel=me link per site in the network. - Why: Rel=me is the IndieWeb identity link that verifies the same person or business owns each profile, closing a loop engines can crawl. - Fix: Add `<link rel="me" href="...">` in the head for each owned profile (and each owned site), matching the sameAs list. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [E-E-A-T Generator](https://jwatte.com/tools/eeat-generator/) and 4 more. Standard: IndieWeb rel=me; HTML rel=me link relation. - [ ] **7.48 Entity anchors (KG)** - Pass: The Person, Organization or vertical entity node carries at least three Knowledge Graph reconciliation anchors and no binding defects. - Warn: 1 to 2 anchors is amber; a fragment @id without a slash is flagged SLASH. - Fail: In priority order: an unresolved bind reference (GSC TYPE), a date-only value (GSC DATE), duplicate inline entities or conflicting @ids (DUP @id), more than one page-type node (DILUTION), an inline page-type mainEntityOfPage (PHANTOM MEP), an anonymous author or publisher Organization (ANON ORG), HTML entities inside JSON-LD (HTML ENT), HTML-encoded ampersands in sameAs (& BUG), or zero anchors (NONE). - Numbers and lists the tool uses: anchors counted (entityAnchorCount): Google kgmid /[?&]kgmid=\/[gm]\/\w+/, Google Maps cid /google\.com\/maps\?cid=\d+/ or /maps\.app\.goo\.gl\//, Google Business Profile /share\.google\// or /g\.page\// or /business\.google\.com\// or a Maps cid, LinkedIn /linkedin\.com\/(in|company)\//, Wikidata, Gravatar /(?:^|\/\/)(?:[a-z0-9.-]+\.)?gravatar\.com\/(?!avatar\/)[A-Za-z0-9._-]+/i, all tested against the joined sameAs list, plus an identifier PropertyValue with propertyID /kgmid|googleKgmid|knowledgeGraph/i (counted only when no kgmid sameAs) and propertyID /googlePlaceId|placeId/i; dual-typed Person plus vertical type, @id merged across blocks, mainEntityOfPage, ProfilePage, ItemList and hasMap are listed in the detail line but do not add to the count; 3 anchors green, 1 amber; N/A when no Person, Organization or vertical entity; E-E-A-T bucket weights: Person 12, Organization 12, sameAs 3 or more 15, 6 or more 5, Wikidata 10, ORCID 5, kgmid 2, Maps cid or GBP 1, no circular sameAs 1, Gravatar 1, no duplicate inline entities 1, no @id conflicts 1. - Why: AI search pipelines need something to bind the name to this URL against; a real estate agent site lost AI Mode citations for the operator's own name after a schema cleanup removed these cross-references. - Fix: Fix the flagged binding defect first, then add the kgmid, Maps cid, Business Profile share link, LinkedIn, Wikidata, Gravatar and industry directory URLs to sameAs. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **7.49 Google Knowledge Graph kgmid linked** - Pass: The entity's Google Knowledge Graph id is carried as a kgmid sameAs URL or as an identifier PropertyValue (a Google Place ID identifier also counts as an anchor). - Warn: Mega Analyzer reports an absent kgmid as informational. - Numbers and lists the tool uses: sameAs https://www.google.com/search?kgmid=/g/...; identifier [{@type: PropertyValue, propertyID matching /kgmid|googleKgmid|knowledgeGraph/i, value /g/...}] (adds 1 anchor only when no kgmid sameAs) and propertyID /googlePlaceId|placeId/i (adds 1 anchor). - Why: The kgmid is the strongest single Knowledge Graph reconciliation signal. - Fix: Find the entity's kgmid from its Knowledge Panel share link and add it as a sameAs URL and/or an identifier PropertyValue, alongside a googlePlaceId identifier for local businesses. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org PropertyValue. - [ ] **7.50 Circular self-reference in sameAs** - Pass: No sameAs entry resolves to the page's own origin. - Numbers and lists the tool uses: own origin derived from canonical or og:url; origin plus pathname compared with trailing slashes collapsed; circularSameAsCount must be 0. - Why: SameAs must point to other canonical profiles of the same entity; the site's own URL there is noise that weakens the cross-reference signal. - Fix: Remove the site's own URL from sameAs (keep it in url) and replace it with real off-site profiles. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **7.51 HTML-encoded ampersands in sameAs URLs (subset): `<n>`** - Pass: No sameAs URL contains an HTML-encoded ampersand. - Numbers and lists the tool uses: sameAsHtmlEncodedCount must be 0; gated on a Person or Organization node. - Why: Google's Knowledge Graph crawler tries to follow sameAs URLs, so an & inside one breaks the link. - Fix: Emit JSON-LD without template autoescaping so sameAs URLs come out raw. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org sameAs. - [ ] **7.52 mainEntityOfPage on Person/Org: object @id pointing at a ProfilePage** - Pass: MainEntityOfPage on the Person or Organization node is an object @id that references a ProfilePage block on the page. - Warn: An object @id that does not point at a ProfilePage is reported as informational (add a ProfilePage block with a matching @id); a missing mainEntityOfPage is also informational, reported as MISSING with the suggested {"@id":"`<bio-page>`/#profilepage"} form. - Fail: A string URL form (weak binding). - Numbers and lists the tool uses: recommended form {"@id":"`<page>`/#profilepage"} paired with a ProfilePage block with a matching @id; gated on a Person or Organization node. - Why: The object @id form pointing at a ProfilePage is the strongest AI Mode binding between the entity and its page. - Fix: Change mainEntityOfPage to the {"@id":"`<page>`/#profilepage"} object form and add a ProfilePage block with that @id. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org mainEntityOfPage, ProfilePage. - [ ] **7.53 ProfilePage rich-result type declared: yes / no** - Pass: The page's JSON-LD declares a ProfilePage node (only the type is tested; the suggested shape is mainEntity {"@id":"<Person @id>"}). - Numbers and lists the tool uses: hasProfilePage = schemaTypes includes ProfilePage; gated on a Person or Organization node. - Why: Person or Organization alone are not rich-result eligible; ProfilePage makes the bio page eligible for Google's profile-page rich result. - Fix: Add @type ProfilePage with mainEntity {"@id":"<Person @id>"} on the bio page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: Google Profile Page structured data; schema.org ProfilePage. - [ ] **7.54 Anonymous author/publisher Organization in Article/NewsArticle: `<n>`** - Pass: Every author and publisher on Article, BlogPosting, NewsArticle, Recipe and Review nodes is an @id reference, not an inline Organization without an @id. - Numbers and lists the tool uses: anonAuthorPublisherCount must be 0; node types checked /^(Article|BlogPosting|NewsArticle|Recipe|Review)$/; an author or publisher object typed /Organization|NewsMediaOrganization/ with no @id counts; gated on a Person or Organization node. - Why: An inline Organization in author or publisher creates a phantom anonymous sibling of the canonical site Organization. - Fix: Replace the inline Organization with a {"@id":"`<site>`/#organization"} reference. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org Article, NewsArticle, Organization. - [ ] **7.55 Review / AggregateRating schema** - Pass: First-party testimonials on the page are backed by Review or AggregateRating JSON-LD (with reviewCount), or the page has no testimonials, is a publication or app, or shows borrowed third-party reviews where markup would be a spam risk. - Warn: GBP Review Audit warns when no reviews or testimonials are shown on the page, and flags an aggregateRating on the business's own node; Mega SEO Analyzer reports no review or testimonial signal as informational. - Fail: Mega Analyzer fails when visible testimonial sections have no Review or AggregateRating JSON-LD; Mega GEO Analyzer scores Review signals under 60 when no reviews are shown and few review profiles are linked. - Numbers and lists the tool uses: Mega Analyzer passes when Review or AggregateRating is in schemaTypes; renders a Not applicable pass when no element matches [class*="testimonial" i], [class*="review" i], blockquote (a blockquote whose `<cite>` tokens all appear in one JSON-LD Person or Organization name is excluded as a self-quote), when a NewsMediaOrganization, WebApplication, SoftwareApplication, Dataset, DataCatalog or Periodical type is present, or when the body text matches /\b(google review|verified google|yelp review|trustpilot|tripadvisor|facebook review|bbb review)\b/; GBP Review Audit passes on visible review or testimonial wording, a review widget or Review items with text; Mega GEO Analyzer Review signals base 20, +35 reviews shown, +25 for two or more review profiles linked (+15 for one), +20 leave-a-review link, nothing for aggregateRating on the business's own node, pass at 80, warn at 60; Mega SEO Analyzer /"@type"\s*:\s*"(Review|AggregateRating)"|\btestimonial\b/i; Competitor Gap Matrix /"@type"\s*:\s*"(Review|AggregateRating)"/i as one of five trust tests; Single Site Gen and Site Migration Gen require Review or AggregateRating. - Why: Structured ratings on a product, app, book or course can earn review stars and let AI search cite 'rated X by N customers'. A business's own LocalBusiness or Organization markup cannot earn stars, and ratings copied from other sites are not allowed. - Fix: Mark up real first-party reviews of things you sell, never inflated and never copied from Google or Yelp. For the business itself, show reviews as text and link to your review profiles. - Verify: [GBP + Review Signal Audit](https://jwatte.com/tools/gbp-review-audit/), [Competitor Gap Matrix](https://jwatte.com/tools/competitor-gap-matrix/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/) and 3 more. Standard: Google rich-results spam policy; schema.org Review / AggregateRating. - [ ] **7.56 Review-platform outbound links** - Pass: The page links to at least one third-party review platform profile, and GBP Review Audit wants Google plus at least one more platform. - Warn: GBP Review Audit warns with fewer than two platforms linked; Trust Signal Surface Audit warns when the homepage links no external review platform; E-E-A-T Analyzer reports a missing BBB reference as informational. - Fail: Mega Analyzer rates zero review-platform links as bad. - Numbers and lists the tool uses: Mega Analyzer hosts g2.com, capterra.com, trustpilot.com, bbb.org, producthunt.com, glassdoor.com, clutch.co, gartner.com, softwareadvice.com, getapp.com, reviews.google; GBP Review Audit counts Google (/search\.google\.com\/local\/writereview|google\.com\/maps\/place|maps\.app\.goo\.gl|g\.page/i), Yelp /yelp\.com\/biz/i, BBB /bbb\.org\//i, Facebook /facebook\.com\/[^"'\/]+\/?(reviews|recommendations)?/i, pass at 2 or more; Trust Signal Surface Audit /(trustpilot\.com|bbb\.org|g2\.com|capterra\.com)/i on the homepage; E-E-A-T Analyzer 'bbb.org' in body or href; suggested pairings: Yelp + BBB + Healthgrades for medical, Yelp + Angi + HomeAdvisor for trades, Yelp + TripAdvisor + OpenTable for restaurants. - Why: Outbound links to review profiles corroborate reputation and are the aggregator signal AI and search engines weight. - Fix: Link the Google review profile plus at least one vertical platform (Yelp, BBB, Facebook, Healthgrades, Avvo, Angi, G2 or Capterra) from the homepage. - Verify: [GBP + Review Signal Audit](https://jwatte.com/tools/gbp-review-audit/), [Trust Signal Surface](https://jwatte.com/tools/trust-signal-surface-audit/), [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **7.57 Google review URL linked from site** - Pass: The site links to its Google review, Maps place or g.page short link. - Warn: No link is reported as 'No Google leave-a-review short-link'. - Numbers and lists the tool uses: /search\.google\.com\/local\/writereview|google\.com\/maps\/place|maps\.app\.goo\.gl|g\.page/i on the raw HTML. - Why: The Google short link is the entry point for gathering the reviews that feed the Business Profile signal. - Fix: Generate a g.page/r/... link in Google Business Profile and link it from the site, every invoice, receipt and post-service email, with a same-day text request after service. - Verify: [GBP + Review Signal Audit](https://jwatte.com/tools/gbp-review-audit/). - [ ] **7.58 "Leave a review" CTA in body** - Pass: The body text asks visitors to leave or write a review. - Warn: No call to action is reported as a warning. - Numbers and lists the tool uses: /leave (?:us )?a review|write a review|share your experience|rate us|review us/i. - Why: A visible review call to action lifts review conversion. - Fix: Add a 'Leave us a Google review' block to the homepage footer, the contact page and the thank-you page. - Verify: [GBP + Review Signal Audit](https://jwatte.com/tools/gbp-review-audit/). - [ ] **7.59 Rating visible / Rating >= 4.2** - Pass: A star rating renders for the business and it is at least 4.2. - Fail: No rating at all (the listing needs its first reviews) or a rating below 4.2, both critical. - Numbers and lists the tool uses: rating regexes /(\d\.\d)\s*$/ and /(\d\.\d)\s*★/ on whitespace-collapsed text; threshold 4.2 (Google Maps Audit); E-E-A-T Generator cites 4.5+ average with 50+ reviews as the level that lifts local pack visibility. - Why: A listing with no rating or a low one cannot compete for the map pack. - Fix: Gather first reviews so a rating renders, then keep it above 4.2 by asking every satisfied customer and resolving complaints. - Verify: [Google Maps](https://jwatte.com/tools/google-maps-audit/), [E-E-A-T Generator](https://jwatte.com/tools/eeat-generator/). - [ ] **7.60 >= 20 reviews / Aim for 50+ Google reviews (currently `<n>`)** - Pass: The Google Business Profile shows at least 20 reviews, with 50 or more as the target. - Warn: Google Maps Audit warns with fewer than 20 reviews. - Fail: E-E-A-T Generator marks the action item missing below 50 reviews. - Numbers and lists the tool uses: review count regex /\(([\d.]+)$|([\d.]+)\s+Google reviews/; 20 (Google Maps Audit); 50 (E-E-A-T Generator), 50+ reviews with a 4.5+ average cited for measurably higher local pack visibility. - Why: Google factors in review quantity, rating, recency and velocity when ranking local businesses. - Fix: Run a post-service review request workflow until the Google count passes 50. - Verify: [Google Maps](https://jwatte.com/tools/google-maps-audit/), [E-E-A-T Generator](https://jwatte.com/tools/eeat-generator/). - [ ] **7.61 Social proof: testimonial block, case-study link, customer logo strip** - Pass: The page shows two or more testimonials, links to a case study or customer story, and carries a customer logo strip or 'trusted by' wording. - Warn: E-E-A-T Analyzer warns with exactly one case-study or testimonial phrase; the Mega Analyzer social-proof rows report absence as informational. - Fail: E-E-A-T Analyzer fails with zero case-study or testimonial phrases. - Numbers and lists the tool uses: testimonial block blockquote, [class*="testimonial" i], [class*="quote" i] count 2 or more; case study href /(case[-_ ]?stud|customer[-_ ]?stor|success[-_ ]?stor|client[-_ ]?stor)/i or paths /case-studies/, /customer-stories/, /success-stories/; logo strip [class*="logo" i][class*="strip" i], [class*="customer" i][class*="logo" i], [aria-label*="customer" i][aria-label*="logo" i] or body /\b(trusted by|used by|customers include|as used at)\b/i; E-E-A-T Analyzer /(case study|testimonial|client|customer review)/gi pass 2, warn 1. - Why: Case studies, testimonials and customer logos demonstrate real-world experience, calibrated against high-signal sites such as Stripe, Linear and Notion. - Fix: Add at least two testimonials, a case-study page and a customer logo strip. - Verify: [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **7.62 Award / recognition signal** - Pass: The Organization node lists an award or the body text names a recognition. - Warn: The Mega Analyzer social-proof row reports absence as informational; E-E-A-T Generator marks the credentials and awards item missing until the awards field is filled. - Numbers and lists the tool uses: /\b(winner of|1st place|first place|voted best|#1\s+(?:ranked|rated|in)|featured (?:in|on)|as seen (?:in|on)|award[- ]?winning|recognized by|top[- ](?:10|25|50|100)\b|inc\.?\s*5000|fast\s?company|forbes\s+(?:\d{2,4}|best|top)|y\s?combinator|techcrunch\s+disrupt|product\s?hunt\s+#\d|hackathon)/i or Organization.award entries. - Why: Recognition is an E-E-A-T authority indicator. - Fix: Add award to the Organization node and name real recognitions on the page, adding new credentials, awards and publications as they are earned. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [E-E-A-T Generator](https://jwatte.com/tools/eeat-generator/). Standard: schema.org award. - [ ] **7.63 Press / "as seen in" block detected** - Pass: The page has a press or as-seen-in section or names a major outlet that covered the business. - Warn: About Page Conversion Audit warns when no press section is detected; Mega SEO Analyzer reports it as informational. - Numbers and lists the tool uses: Mega SEO Analyzer /as seen in|featured in|press|media kit/i; About Page Conversion Audit /as.?seen.?(in|on)|featured.?(in|on)|press.?mentions|media.?(coverage|mentions)|in the news|covered by|(\bforbes|bloomberg|wsj|techcrunch|fast.?company|nyt|new york times|inc|entrepreneur|wired|reuters)\b/i. - Why: Even one credible third-party logo lifts About page conversion 5 to 15 percent. - Fix: When real third-party coverage exists, add a press block with logos linked to the source articles, near the founder photo. - Verify: [About-Page Conversion Audit](https://jwatte.com/tools/about-page-conversion-audit/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). - [ ] **7.64 5. Trust Badges HTML Section** - Pass: The homepage or About page shows a badge strip with the Google rating and review count, the industry platform rating, years in business, licenses and awards. - Fail: With no inputs the generated section contains only the comment ''. - Numbers and lists the tool uses: badges: '`<rating>` Google Rating (`<count>` reviews)', '`<rating>` `<industry label>` Rating (`<count>` reviews)', 'Est. `<year>`, `<years>` years in business' where years = current year minus founding year, one badge per license line, one per award line; review count defaults to 0; industry rating label: restaurant Yelp, hotel TripAdvisor, real estate Zillow, medical and dental Healthgrades, legal Avvo, author Goodreads, saas G2/Capterra, storage SpareFoot, recovery, nonprofit and education Google, all others Yelp. - Why: Reviews are ranking signals, and cross-platform ratings shown together compound trust. - Fix: Enter the real Google and industry ratings with counts, founding year, licenses and awards, then paste the badge section on the homepage or About page. - Verify: [E-E-A-T Generator](https://jwatte.com/tools/eeat-generator/). - [ ] **7.65 Tenure signal detected** - Pass: The page states a founding year or a years-of-experience count. - Warn: No 'years of experience' or 'founded in' statement is reported as a warning. - Numbers and lists the tool uses: year /(founded|established|since|in business|serving.{0,30})\s*(?:in\s*)?(\d{4})/i; years /(\d{1,2})\+?\s*(years?|yrs)\s*(of\s*)?(experience|in business|serving|building|working)/i. - Why: 'Founded 2018' or '14 years of experience' is a specific trust claim that beats vague words like 'seasoned'. - Fix: Put one specific number (years, clients or projects) in the first 100 words of the About page. - Verify: [About-Page Conversion Audit](https://jwatte.com/tools/about-page-conversion-audit/). - [ ] **7.66 Quantified experience detected** - Pass: The page carries at least two quantified claims such as clients served or projects completed. - Warn: About Page Conversion Audit warns with no quantified number; the Mega Analyzer specificity row reports fewer than two as informational. - Numbers and lists the tool uses: About Page Conversion Audit /\b\d{2,}[,]?\d{0,3}\+?\s*(clients|customers|projects|audits|deals|students|readers|books sold|sites|engagements|businesses)/gi; Mega Analyzer quantifiedClaimsCount 2 or more. - Why: '4,200 clients served' beats 'many clients'; specific numbers are more credible and more citable than vague marketing. - Fix: Add at least one specific count in the first 100 words and use numbers with units throughout. - Verify: [About-Page Conversion Audit](https://jwatte.com/tools/about-page-conversion-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **7.67 License / insurance / bonded marker** - Pass: The page prints a license number or bonded-and-insured wording. - Warn: The Mega Analyzer specificity row reports absence as informational. - Numbers and lists the tool uses: /\b(license(?:d|#)?\s*(?:no\.?|number)?\s*[:#]?\s*[a-z0-9\-]+|bonded\s+(?:and|&)\s+insured|fully\s+(?:licensed|insured|bonded)|(?:contractor|medical|nursing|attorney|bar|real\s?estate)\s+license\s+#)\b/i; Legal Pages Generator local-service notice: licensed and insured as required in operating jurisdictions, license numbers available on request, not a warranty of outcomes. - Why: License and insurance status is a primary trust signal for trades, legal, medical and real estate businesses. - Fix: Print the license number and insured or bonded status in the footer and on the About and contact pages. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Legal Pages Generator](https://jwatte.com/tools/legal-pages-generator/). - [ ] **7.68 Founder / author photo detected** - Pass: An image on the About page has founder, author or headshot keywords in its alt text or src. - Warn: No labelled human photo on a page with more than two images is reported as 'Human photo not clearly labeled'. - Fail: No match on a page with two or fewer images is reported as 'No human photo detected'. - Numbers and lists the tool uses: /founder|ceo|author|owner|headshot|bio|portrait|profile|team/ on lowercased alt plus src; warn gate more than 2 images. - Why: Visitors are four times more likely to trust a page with a human face, and the About page is where identity is established. - Fix: Put a professional photo of a real person above the fold with alt text containing founder, bio, author or CEO, not a stock image. - Verify: [About-Page Conversion Audit](https://jwatte.com/tools/about-page-conversion-audit/). - [ ] **7.69 Copyright Notice Found** - Pass: The body text contains the word copyright, a copyright symbol or a year. - Warn: Neither is reported as a warning. - Numbers and lists the tool uses: substring 'copyright' or /©|\d{4}/. - Why: A copyright line with the current year is a small sign the site is maintained. - Fix: Add a copyright notice with the current year in the footer. - Verify: [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/). - [ ] **7.70 Knowledge Panel** - Pass: A branded search shows a Knowledge Panel for the business or person. - Numbers and lists the tool uses: SERP markers /data-async-context="query.*?kgmid|class="[^"]*\bkno-kp\b|"knowledgeGraph":|aria-label="Knowledge Graph"/i; triggers listed by E-E-A-T Generator: a Wikidata entry with sameAs to your profiles, consistent name, address and phone across 10+ platforms, on-site schema linking those profiles, mentions from authoritative third-party sources, a Google Business Profile with reviews and activity; check quarterly. - Why: A Knowledge Panel appears when the Knowledge Graph has enough corroborated data about the entity, which is the same data AI answers rely on. - Fix: Build Wikipedia or Wikidata presence, consistent sameAs and Business Profile activity, then check for the panel each quarter. - Verify: [SERP Features](https://jwatte.com/tools/serp-features/), [E-E-A-T Generator](https://jwatte.com/tools/eeat-generator/). - [ ] **7.71 Security / compliance badges** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: /\b(soc\s?2|iso\s?27001|iso\s?9001|hipaa\s+compliant|gdpr\s+compliant|ccpa\s+compliant|pci[- ]?dss|fedramp|sox\s+compliant|ssl\s+secured|mcafee\s+secure|norton\s+secured)\b/i; Mega Analyzer trust-stats row rates a count above 0 as good; specificity row lists SOC 2, ISO 27001, HIPAA, GDPR, PCI-DSS. - Why: Compliance claims are trust signals for B2B buyers, but only when they are real. - Fix: State real certifications with evidence such as a report or certificate link; never claim one you do not hold. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **7.72 Gravatar profile URL in sameAs** - Pass: Gravatar profile URL present in sameAs (Mega Analyzer: +1 E-E-A-T point when the page hosts a Person, Organization or vertical agent entity; Author Entity Graph: +2 per Gravatar-bound author); absence renders an informational row and a Schema Validator info issue. - Numbers and lists the tool uses: /(?:^|\/\/)(?:[a-z0-9.-]+\.)?gravatar\.com\/(?!avatar\/)[A-Za-z0-9._-]+/i on sameAs (avatar/ image paths excluded); Schema Validator gate: node type /^(Person|Organization|LocalBusiness|Corporation|RealEstateAgent|Attorney|Dentist|Physician|FinancialService|InsuranceAgency|AccountingService)$/ with a non-empty sameAs; Mega Analyzer E-E-A-T +1 only when hasPerson or hasOrg or hasVerticalAgent; E-E-A-T Author Entity Graph +2 score per Gravatar-bound author; form https://gravatar.com/`<slug>`. - Why: The Gravatar slug encodes a hash of the verified email, tying one identity across WordPress, Disqus, Stack Exchange and many comment systems, which is the strongest portable anchor for operators who cannot qualify for Wikidata. - Fix: Add https://gravatar.com/`<your-slug>` to the Person's sameAs. - Verify: [Schema Validator](https://jwatte.com/tools/schema-validator/), [E-E-A-T Author Entity Graph](https://jwatte.com/tools/e-e-a-t-author-entity-graph/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **7.73 Author photo in article: yes / no** - Pass: Author photo found via the selectors (pass); absence renders an info row; counts 1 of 8 points in the Author authority score (6 or more pass, 4 to 5 warn, under 4 fail) - Numbers and lists the tool uses: selectors [class*="author"] img, [rel="author"] img, [itemprop="author"] img; recommended 120 x 120 minimum, WebP, alt="[Name]". - Why: An author photo is a cheap authorship signal with outsized impact. - Fix: Add an author photo (120 x 120 minimum, WebP, alt text with the name) in the byline or an 'About the author' block. - Verify: [Author Authority per Article](https://jwatte.com/tools/author-authority-per-article/). - [ ] **7.74 Author bio snippet detected: yes / no** - Pass: Bio marker regex matches body text (pass); absence renders an info row; counts 1 of 8 points in the Author authority score (6 or more pass, 4 to 5 warn, under 4 fail) - Numbers and lists the tool uses: /about the author|author bio|written by|\bcredentials?\b|\bexpertise\b/i on body text; E-E-A-T Generator bio partial: `<section itemscope itemtype="https://schema.org/Person">` with itemprop image (120 x 120, round), name, jobTitle, description, '`<n>`+ years of experience' and up to 8 profile links as `<a rel="me noopener">`. - Why: A bio block with credentials shows why this author can speak to the topic. - Fix: Add a 2 to 4 sentence bio with title, years of experience and certifications near the end of each article, and a fuller microdata-annotated bio on the About or author page. - Verify: [Author Authority per Article](https://jwatte.com/tools/author-authority-per-article/), [E-E-A-T Generator](https://jwatte.com/tools/eeat-generator/). Standard: schema.org Person (microdata). - [ ] **7.75 Google Scholar Reference** - Pass: 'scholar.google' found in body text or HTML: pass (10 points in the Expertise pillar score); absent: info row excluded from the score. - Numbers and lists the tool uses: substring 'scholar.google' in body text or HTML. - Why: A Google Scholar profile establishes research credentials for academic authors. - Fix: If applicable, link the author's Google Scholar profile. - Verify: [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/). - [ ] **7.76 ResearchGate / Academia Reference** - Pass: 'researchgate' or 'academia.edu' found in body text or HTML: pass (10 points in the Expertise pillar score); absent: info row excluded from the score. - Numbers and lists the tool uses: substrings 'researchgate', 'academia.edu' in body text or HTML. - Why: Academic platform profiles corroborate research credentials. - Fix: If applicable, link ResearchGate or academia.edu profiles. - Verify: [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/). - [ ] **7.77 Crunchbase Reference** - Pass: 'crunchbase' found in body text or a sameAs URL: pass (10 points in the Authoritativeness pillar score); absent: info row excluded from the score. - Numbers and lists the tool uses: substring 'crunchbase' in body text or /crunchbase/i on sameAs. - Why: A Crunchbase profile is a business credibility signal for companies. - Fix: If applicable, create a Crunchbase profile and link it from sameAs. - Verify: [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/). - [ ] **7.78 Professional affiliations shown** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: /member of|affiliated|partner|\b(bbb|better business bureau|chamber of commerce|trade association|aapc|aicpa|bar|society)\b/i. - Why: Association logos such as BBB, the bar, a CPA society or a trade group reinforce legitimacy. - Fix: Show the logos of relevant associations the business belongs to. - Verify: [About-Page Conversion Audit](https://jwatte.com/tools/about-page-conversion-audit/). - [ ] **7.79 .well-known/webfinger found** - Pass: Pass row when /.well-known/webfinger returns a 2xx non-empty body (10 points in the Network section score); absence adds no row. - Numbers and lists the tool uses: path /.well-known/webfinger; absence is not reported. - Why: WebFinger enables federated identity discovery for ActivityPub and Mastodon. - Fix: Serve a WebFinger resource if the site participates in the fediverse. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). Standard: WebFinger. - [ ] **7.80 Global Privacy Control reference detected** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: /globalprivacycontrol|\bGPC\b/i. - Why: Honoring the Global Privacy Control signal is how the site respects browser-level opt-outs. - Fix: Honor the Sec-GPC signal and say so in the privacy policy. - Verify: [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: Global Privacy Control. - [ ] **7.81 Review-response cadence (process check)** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: reply to 100% of 1 to 3 star reviews within 48 hours; reply to 4 to 5 star reviews within 7 days; post-service review request workflow; respond to every review. - Why: Google ranks businesses that respond to reviews higher, and review recency and velocity are ranking inputs. - Fix: Set up a post-service review request and a response script library for 1, 2, 3 and 5 star reviews, professional in tone with no defensiveness or legal-sounding language. - Verify: [GBP + Review Signal Audit](https://jwatte.com/tools/gbp-review-audit/), [E-E-A-T Generator](https://jwatte.com/tools/eeat-generator/). - [ ] **7.82 Accept reviews from Apple Maps users** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: manual checklist item; Apple Maps shows Yelp and TripAdvisor reviews inline and the Yelp integration is automatic. - Why: Apple Maps users see the Yelp and TripAdvisor ratings, so those profiles feed the Apple listing too. - Fix: Keep the Yelp and TripAdvisor profiles current so the Apple Business Connect listing surfaces reviews. - Verify: [Apple Business](https://jwatte.com/tools/apple-business-audit/). - [ ] **7.83 Visible consent / cookie banner element present / Cookie preference center link** - Pass: A visible consent banner element and a cookie preference center link are present. - Numbers and lists the tool uses: hasConsentBannerEl = any element matching [id*="cookie" i], [class*="cookie" i][class*="banner" i], [class*="consent" i][class*="banner" i], [id*="onetrust" i], [id*="cookiebot" i], [role="dialog"][aria-label*="cookie" i], [aria-describedby*="cookie" i], or body text matching /\b(we\s+use\s+cookies|this\s+(?:site|website)\s+uses\s+cookies|by\s+clicking\s+(?:accept|agree))/i; hasPreferenceCenter = any link href matching /\/(cookie-settings|cookie-preferences|privacy-settings|manage-cookies|cookie-manage|opt-out|do-not-sell)(\/|$)/i, or body text matching /(cookie\s+(settings|preferences)|manage\s+cookies|do\s+not\s+sell|privacy\s+preferences)/i; both rows use renderInfo so absence is reported as information. - Why: GDPR requires a way to withdraw consent as easily as it was given and CCPA requires a Do Not Sell link, and a footer 'Manage cookies' link covers both. - Fix: Add a consent banner and a footer 'Manage cookies' link (see /blog/blog-cookie-preference-center-link/). - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: GDPR Art. 7(3); CCPA. - [ ] **7.84 Privacy Policy linked from landing page** - Pass: The page links to a privacy policy. - Fail: No link on the page matches the privacy-path pattern (the row renders as a failed check). - Numbers and lists the tool uses: href regex /\/privacy(\/|$|-policy|-notice|_policy)|\/pp\/?$/i over the page's a[href] links; Legal Pages Generator policy section How we protect information declares TLS in transit, encryption at rest where applicable, access controls, and regular audits, and states that no system is perfectly secure. - Why: Privacy laws and the platforms you embed require a reachable privacy policy, and its absence is a visible trust gap. - Fix: Publish /privacy/ describing what you collect and how you protect it, and link it from the footer. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: GDPR Art. 13; CCPA 1798.130. - [ ] **7.85 Cookie Policy linked (separate from Privacy Policy)** - Pass: The page links to a cookie policy. - Fail: No link matches the cookie-path pattern (the row renders as a failed check). - Numbers and lists the tool uses: href regex /[\/#]cookies?/i over the page's a[href] links (a /privacy#cookies anchor also counts). - Why: Loading analytics or embeds sets cookies, and the ePrivacy rules expect a cookie disclosure. - Fix: Add /cookies (or /privacy#cookies) and link it from the footer. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: ePrivacy Directive. - [ ] **7.86 Terms of Use / Terms of Service page linked** - Pass: The page links to a terms page. - Fail: No link matches the terms-path pattern (the row renders as a failed check). - Numbers and lists the tool uses: href regex /\/(terms|tos|tou|legal|terms-of-service|terms-of-use|terms-and-conditions|disclaimer)(\/|$|\.html)/i over the page's a[href] links. - Why: Terms set acceptable use, liability and dispute rules for everyone who uses the site. - Fix: Publish a terms page and link it from the footer. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). ## 8. Speed and Core Web Vitals Core Web Vitals are a ranking input and a real-user measurement. This section is what the field data reports, what makes the largest element slow, what shifts the layout, what third-party scripts cost, and whether the CDN is actually caching. **Verify this section with:** [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/), [CWV Fix Generator](https://jwatte.com/tools/cwv-fix-generator/), [Competitor Gap Matrix](https://jwatte.com/tools/competitor-gap-matrix/), [Edge Cache Effectiveness Probe](https://jwatte.com/tools/edge-cache-effectiveness-probe/), [Uptime + Response-Time Diagnostic](https://jwatte.com/tools/uptime-check/), [DIY Uptime Alert Generator](https://jwatte.com/tools/diy-uptime-alert-generator/), [Core Web Vitals Audit](https://jwatte.com/tools/cwv-audit/), [Mega Batch](https://jwatte.com/tools/mega-batch/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/), [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/), [CrUX Field Data Probe](https://jwatte.com/tools/crux-field-data-probe/), [Image Alt Audit](https://jwatte.com/tools/image-alt-audit/), [Image LCP Candidate Audit](https://jwatte.com/tools/image-lcp-candidate-audit/), [Third-Party Script Cost Audit](https://jwatte.com/tools/third-party-script-cost/), [Migration Analyzer](https://jwatte.com/tools/migration-analyzer/), [Trust Signal Surface](https://jwatte.com/tools/trust-signal-surface-audit/), [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **8.1 Content-Encoding compression active** - Pass: The HTML response carries a Content-Encoding header of br, gzip or zstd. - Warn: Compressed with gzip or zstd but not brotli (Mega SEO Analyzer), brotli being 15-25% smaller. - Fail: No compression at all fails in Mega SEO Analyzer, loses 4 points in the Batch Analyzer hosting score, and warns in Mega Analyzer and Analyzer. - Numbers and lists the tool uses: Regex /br|gzip|zstd/i on the Content-Encoding header (Mega Analyzer, Analyzer, Batch Analyzer weight 4, Competitor Gap Matrix); brotli preferred, /br/i passes and /gzip|br|zstd/i without br warns, brotli cited as 15-25% smaller than gzip (Mega SEO Analyzer); generator config nginx brotli on, brotli_comp_level 6, gzip_comp_level 6, gzip_vary on, types text/plain text/css text/xml application/javascript application/json application/xml image/svg+xml font/woff2, Apache AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css application/javascript application/json, Netlify, Cloudflare and Vercel need no config (CWV Fix Generator). - Why: Uncompressed HTML, CSS and JS take longer to download, which delays the first byte and the largest paint. - Fix: Turn on Brotli (or at least gzip) at the host or CDN; most CDNs do this by default, self-hosted nginx or Apache needs the compression config. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Competitor Gap Matrix](https://jwatte.com/tools/competitor-gap-matrix/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/) and 2 more. Standard: RFC 9110 Content-Encoding; RFC 7932 (Brotli). - [ ] **8.2 Cache-Control: `<value>`** - Pass: The response sends a Cache-Control header. - Warn: No Cache-Control header (Mega SEO Analyzer). - Numbers and lists the tool uses: Header presence only (Mega SEO Analyzer); generator pattern for a Netlify or Cloudflare Pages _headers file: /*.css, /*.js, /*.woff2 and /images/* get Cache-Control: public, max-age=31536000, immutable and need fingerprinted filenames such as app.a3b4c.css, HTML at /* gets Cache-Control: public, max-age=0, s-maxage=600, stale-while-revalidate=86400 (CWV Fix Generator). - Why: Without caching rules every repeat visit downloads the same files again and the CDN cannot serve pages for you. - Fix: Send Cache-Control on every response: one year plus immutable for fingerprinted static assets, and a short max-age with s-maxage and stale-while-revalidate for HTML. - Verify: [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [CWV Fix Generator](https://jwatte.com/tools/cwv-fix-generator/). Standard: RFC 9111. - [ ] **8.3 Edge-cache header observed** - Pass: The response carries an edge-cache header (cf-cache-status, x-cache, cache-status or age) and, where classified, reports a HIT. - Warn: No edge-cache header is reported as info in Mega SEO Analyzer; in the Edge-Cache Effectiveness Probe a URL with no hit or miss token but Age over 0 is AGED, an EXPIRED, REVALIDATED, STALE or DYNAMIC token is DYNAMIC, and no cache headers at all is UNKNOWN. - Fail: A MISS token in cf-cache-status, x-cache or cache-status (Edge-Cache Effectiveness Probe). - Numbers and lists the tool uses: Headers cf-cache-status, x-cache, age (Mega SEO Analyzer); headers cf-cache-status, x-cache, cache-status, age evaluated in the order hit, miss, aged (Age > 0), dynamic, unknown, with hit = /HIT|hit/ on cf-cache-status or /HIT/i on x-cache or /hit/ on cache-status, miss = /MISS|miss/ on cf-cache-status or /MISS/i on x-cache or /miss/ on cache-status, dynamic = /EXPIRED|REVALIDATED|STALE|DYNAMIC/i on the three status headers joined, up to 30 pasted URLs (Edge-Cache Effectiveness Probe). - Why: Without an edge cache in front of it, every visit hits your origin server directly, which is slower and costs more. - Fix: Put the site behind a CDN or edge cache, and for URLs that show MISS add Cache-Control: public, max-age=N, s-maxage=N; consider stale-while-revalidate for dynamic URLs. - Verify: [Edge Cache Effectiveness Probe](https://jwatte.com/tools/edge-cache-effectiveness-probe/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). - [ ] **8.4 Edge cache-hit ratio: `<n>`% (`<n>` / `<n>`)** - Pass: At least 70% of the sampled URLs are served from the edge cache. - Warn: A hit ratio of 40% to 69%, or 30% or more of the sampled URLs classified miss, dynamic or unknown (reported as '`<n>` URLs bleeding origin traffic'). - Fail: A hit ratio under 40%. - Numbers and lists the tool uses: pass >= 70%, warn >= 40%, fail < 40%, ratio = round(hits / probed * 100); bleeding-origin warning when miss + dynamic + unknown >= 0.3 of the sampled URLs; sample of up to 30 URLs. - Why: Every page your CDN could have served but did not is extra latency for the visitor and extra load and cost on your origin. - Fix: Review Cache-Control, the Vary header (a Vary on User-Agent or Accept-Encoding for no reason fragments the cache key), Set-Cookie on HTML responses (many CDNs skip caching when present, so move cookies to a sub-domain or a cookie-less media domain), and strip or normalize utm_* and fbclid parameters at the edge; re-probe weekly. - Verify: [Edge Cache Effectiveness Probe](https://jwatte.com/tools/edge-cache-effectiveness-probe/). - [ ] **8.5 `<n>` unversioned URL(s) cached as immutable or near-permanent** - Pass: No URL without a content hash or version marker is served with Cache-Control immutable or a max-age of a month or more. - Fail: One or more URLs with no content hash or version marker are served with Cache-Control immutable or a max-age of 2592000 seconds (30 days) or more. - Numbers and lists the tool uses: /immutable/i in Cache-Control, or max-age >= 2592000 from /max-age=(\d+)/i; a URL counts as versioned when it matches /[.\-_][0-9a-f]{8,}\.[a-z0-9]+($|\?)/i, /[?&](v|ver|rev|hash|build)=[^&]+/i or /\/v\d+\//i; up to 3 affected paths listed. - Why: Immutable tells the browser never to check again, so on a file whose name never changes your next deploy stays invisible to every returning visitor until the cache expires, even though a fresh fetch looks correct. - Fix: Either fingerprint the filename so immutable is true, or drop immutable and shorten max-age, adding stale-while-revalidate to keep repeat views fast. - Verify: [Edge Cache Effectiveness Probe](https://jwatte.com/tools/edge-cache-effectiveness-probe/). - [ ] **8.6 HTTP/3 advertised via Alt-Svc** - Pass: The alt-svc response header advertises h3. - Warn: Not advertised is reported as info, not a warning (Mega SEO Analyzer). - Numbers and lists the tool uses: Regex /h3(-\d+)?=/i on the alt-svc header (Mega SEO Analyzer); /h3=/i on alt-svc (Competitor Gap Matrix). - Why: HTTP/3 sets up connections faster and handles flaky mobile networks better than HTTP/2. - Fix: Enable HTTP/3 at the host or CDN and make sure it advertises it with an Alt-Svc header. - Verify: [Competitor Gap Matrix](https://jwatte.com/tools/competitor-gap-matrix/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: RFC 9114. - [ ] **8.7 Link header with preload: <yes (Early Hints candidate) / no>** - Pass: A Link response header is present and contains rel=preload. - Warn: A Link header without preload, or no Link header at all, is reported as info (103 Early Hints not in use). - Numbers and lists the tool uses: Regex /rel=preload/i on the Link response header. - Why: A preload in the Link header lets the CDN send a 103 Early Hints response, so the browser starts fetching critical files before the HTML arrives. - Fix: Send a Link: `<url>`; rel=preload header for the critical stylesheet, font or hero image so the CDN can emit 103 Early Hints. - Verify: [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: RFC 8297 (103 Early Hints). - [ ] **8.8 Vary: Accept on Markdown response (cache-correctness)** - Pass: When the page answers an Accept: text/markdown request with Markdown, the response carries a Vary header that names Accept. - Warn: Markdown negotiation works but Vary: Accept is missing. - Numbers and lists the tool uses: Regex /\baccept\b/i on the Vary header; only evaluated when Markdown negotiation was tested and supported. - Why: Without Vary: Accept a CDN can store the Markdown and HTML versions under one cache entry and hand the wrong one to the next visitor. - Fix: Set Vary: Accept in netlify.toml or your origin headers for every URL that serves Markdown by content negotiation. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: RFC 9110 Vary. - [ ] **8.9 Response time: `<n>` ms (server-side, one-shot)** - Pass: The page responds in under 1000 ms. - Warn: 1000 ms to under 3000 ms (Uptime Check); a Prometheus SlowResponse alert fires when the probe duration stays over 3 seconds for 5 minutes (DIY Uptime Alert Generator). - Fail: 3000 ms or more (Uptime Check). - Numbers and lists the tool uses: 1000 ms, 3000 ms (Uptime Check); probe_http_duration_seconds > 3 for 5m, severity warning (DIY Uptime Alert Generator). - Why: A slow single probe from one location means real visitors in distant regions see something considerably worse, and sustained slow responses tend to come before outages. - Fix: Check the hosting tier, origin latency, caching and upstream dependencies, and put a CDN in front of the origin. - Verify: [Uptime + Response-Time Diagnostic](https://jwatte.com/tools/uptime-check/), [DIY Uptime Alert Generator](https://jwatte.com/tools/diy-uptime-alert-generator/). - [ ] **8.10 HTML weight: `<n>`KB** - Pass: The uncompressed HTML is 100 KB or less. - Warn: 101 KB to 250 KB is reported as info in Analyzer and as ok in Mega Analyzer; over 250 KB warns in Analyzer (heavy). - Fail: Over 250 KB shows red in the Mega Analyzer stat and loses 15 points in the Mega Analyzer and Mega Batch Perf + AI score; over 200 KB deducts from the CWV Audit LCP signal; Single Site Gen and Site Migration Gen specify at most 250 KB per page. - Numbers and lists the tool uses: 100 KB good, 250 KB heavy, KB = round(html.length / 1024) (Mega Analyzer, Analyzer); Lighthouse flags over 100 KB uncompressed HTML (Analyzer); at most 250 KB, weight 15 in the Perf + AI score (Mega Analyzer, Mega Batch); 250 KB per page (Single Site Gen, Site Migration Gen); 200 KB with deduction min(40, (KB - 200) / 15) points off the LCP signal, KB = round(Blob size / 1024) (CWV Audit). - Why: A big HTML document takes longer to download and parse before anything can be drawn. - Fix: Trim markup, inline only the critical CSS and move large inline scripts and styles into cached external files. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Core Web Vitals Audit](https://jwatte.com/tools/cwv-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega Batch](https://jwatte.com/tools/mega-batch/) and 2 more. Standard: Lighthouse. - [ ] **8.11 DOM size: `<n>` nodes** - Pass: The page has 1500 elements or fewer. - Warn: Over 1500 nodes is flagged heavy (Analyzer). - Numbers and lists the tool uses: 1500 nodes, the Lighthouse threshold (Mega Analyzer, Analyzer, Mega Batch weight 12, Single Site Gen, Site Migration Gen); weight 10 in the Mega Analyzer Perf + AI score. - Why: Large DOM trees use more memory, slow down rendering and make every interaction slower. - Fix: Reduce nesting depth and node count; remove wrapper divs, hidden duplicate menus and unused markup. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega Batch](https://jwatte.com/tools/mega-batch/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/) and 1 more. Standard: Lighthouse. - [ ] **8.12 Performance score: `<n>`/100** - Pass: The PageSpeed Insights mobile performance score is 90 or higher. - Warn: 50 to 89, needs improvement. - Fail: Under 50, poor. - Numbers and lists the tool uses: PageSpeed Insights API v5 with category=performance and strategy=mobile; score = round(categories.performance.score * 100); pass >= 90, warn >= 50; scores below 90 may affect rankings (Analyzer manual reminder). - Why: The mobile performance score is Google's own summary of how fast the page loads, and Core Web Vitals directly affect rankings. - Fix: Run the page at pagespeed.web.dev and target a mobile performance score of 90 or more. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). Standard: Google PageSpeed Insights / Lighthouse performance score. - [ ] **8.13 LCP: `<n>` s** - Pass: Largest Contentful Paint is 2.5 seconds or less. - Warn: Over 2.5 seconds up to 4 seconds, needs improvement. - Fail: Over 4 seconds, poor. - Numbers and lists the tool uses: good <= 2500 ms, needs improvement <= 4000 ms, poor > 4000 ms; Analyzer reads the Lighthouse lab value from PageSpeed Insights mobile; Mega SEO Analyzer and CrUX Field Data Probe read the Chrome UX Report 28-day p75 field value for the URL, falling back to origin data; target LCP < 2.5 s (Single Site Gen, Site Migration Gen); target LCP <= 2.5 s on mobile (CWV Fix Generator); CWV Audit instead estimates a heuristic LCP signal from static HTML, 100 minus its page-weight, blocking CSS, blocking script, eager-image and font-preload deductions, good >= 85, warn >= 60. - Why: LCP measures how long the biggest visible element takes to appear, and it is a Core Web Vital that Google ranks on. - Fix: Keep the hero image eager with fetchpriority=high, preload it, serve it in AVIF or WebP with srcset, cut render-blocking CSS and JS and speed up the server; after a fix wait 7 to 14 days for the field data to reflect it. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [CrUX Field Data Probe](https://jwatte.com/tools/crux-field-data-probe/), [Core Web Vitals Audit](https://jwatte.com/tools/cwv-audit/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/) and 3 more. Standard: Google Core Web Vitals LCP thresholds (2.5 s good, 4 s poor); Chrome UX Report 28-day window. - [ ] **8.14 INP: `<n>` ms** - Pass: Interaction to Next Paint is 200 ms or less. - Warn: Over 200 ms up to 500 ms, needs improvement. - Fail: Over 500 ms, poor. - Numbers and lists the tool uses: good <= 200 ms, needs improvement <= 500 ms, poor > 500 ms, Chrome UX Report p75 (Mega SEO Analyzer, CrUX Field Data Probe); target INP < 200 ms (Single Site Gen, Site Migration Gen); target INP <= 200 ms (CWV Fix Generator); CWV Audit estimates a heuristic INP signal from static HTML, 100 minus its total-script, inline-script and GTM deductions, good >= 85, warn >= 60. - Why: INP measures how quickly the page responds when someone taps or clicks, and it is a Core Web Vital that Google ranks on. - Fix: Cut or defer third-party scripts (the usual culprit is a long task from a tag or chat widget), split long JavaScript tasks and keep event handlers light. - Verify: [CrUX Field Data Probe](https://jwatte.com/tools/crux-field-data-probe/), [Core Web Vitals Audit](https://jwatte.com/tools/cwv-audit/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/) and 2 more. Standard: Google Core Web Vitals INP thresholds (200 ms good, 500 ms poor). - [ ] **8.15 CLS: `<n>`** - Pass: Cumulative Layout Shift is 0.1 or less. - Warn: Over 0.1 up to 0.25, needs improvement. - Fail: Over 0.25, poor. - Numbers and lists the tool uses: good <= 0.1, needs improvement <= 0.25, poor > 0.25; Analyzer reads the Lighthouse lab value from PageSpeed Insights mobile to three decimals; Mega SEO Analyzer and CrUX Field Data Probe read the Chrome UX Report p75 value and compare the raw percentile as returned while displaying it as v / 100 to three decimals; target CLS < 0.1 (Single Site Gen, Site Migration Gen); target CLS <= 0.1 (CWV Fix Generator); CWV Audit estimates a heuristic CLS signal, 100 minus its missing-dimension image and font-display deductions, good >= 85, warn >= 60. - Why: CLS measures how much the page jumps around while loading, and it is a Core Web Vital that Google ranks on. - Fix: Give every image, iframe and embed explicit width and height or an aspect-ratio box, reserve space for ads and late content and stop fonts swapping late. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [CrUX Field Data Probe](https://jwatte.com/tools/crux-field-data-probe/), [Core Web Vitals Audit](https://jwatte.com/tools/cwv-audit/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/) and 3 more. Standard: Google Core Web Vitals CLS thresholds (0.1 good, 0.25 poor). - [ ] **8.16 FCP: `<n>` s** - Pass: First Contentful Paint is 1.8 seconds or less at p75. - Warn: Over 1.8 seconds up to 3 seconds, needs improvement. - Fail: Over 3 seconds, poor. - Numbers and lists the tool uses: good <= 1800 ms, needs improvement <= 3000 ms, poor > 3000 ms, Chrome UX Report p75. - Why: FCP is when the first text or image shows up for real visitors, so a slow FCP means a blank screen. - Fix: Reduce render-blocking resources and server response time, which drive FCP. - Verify: [CrUX Field Data Probe](https://jwatte.com/tools/crux-field-data-probe/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: Chrome UX Report FCP thresholds. - [ ] **8.17 TTFB: `<n>` ms** - Pass: Time to First Byte is 800 ms or less at p75. - Warn: Over 800 ms up to 1800 ms, needs improvement. - Fail: Over 1800 ms, poor. - Numbers and lists the tool uses: good <= 800 ms, needs improvement <= 1800 ms, poor > 1800 ms, Chrome UX Report p75 EXPERIMENTAL_TIME_TO_FIRST_BYTE (Mega SEO Analyzer, CrUX Field Data Probe); target TTFB <= 800 ms (CWV Fix Generator). - Why: TTFB is how long real visitors wait for the server to start answering, and everything else on the page waits behind it. - Fix: The usual culprits are origin compute, database time or un-cached origin hits; cache HTML at the edge and check the hosting tier. - Verify: [CrUX Field Data Probe](https://jwatte.com/tools/crux-field-data-probe/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: Chrome UX Report TTFB thresholds. - [ ] **8.18 All `<img>` tags have width + height** - Pass: Every img element declares both width and height attributes. - Warn: Analyzer, Image Alt Audit and Image LCP Candidate Audit (any of the first 6 images) report missing dimensions as a warning; Mega SEO Analyzer warns when the first image lacks either attribute. - Fail: Mega Analyzer shows the missing width/height count red and loses 10 points in its Perf + AI score on any missing image; Mega Batch loses 12 points on any; Batch Analyzer loses 10 points when fewer than 80% of images have both; Image LCP Candidate Audit fails when the first image (the LCP candidate) is missing width or height; CWV Audit deducts from its CLS signal. - Numbers and lists the tool uses: Missing = not both width and height attributes; images inside `<picture>` excluded in the itemized lists (Mega Analyzer, Analyzer, Batch Analyzer, Mega Batch) but not in the Batch Analyzer score bucket, CWV Audit, Image Alt Audit or Image LCP Candidate Audit; up to 30 src values listed (Analyzer), up to 20 (Batch Analyzer, Mega Batch); weight 10 in the Mega Analyzer Perf + AI score, weight 12 (Mega Batch); 80% of images with both, weight 10 (Batch Analyzer); 8 points per image capped at 60 off the CLS signal (CWV Audit); first image regex /\bwidth\s*=/i and /\bheight\s*=/i (Mega SEO Analyzer); first image and the first 6 images checked (Image LCP Candidate Audit); generator adds CSS img, video { max-width: 100%; height: auto; } (CWV Fix Generator). - Why: Without dimensions the browser reserves no space, so the page jumps when each image arrives, which is the layout shift Google measures as CLS. - Fix: Put the intrinsic pixel width and height on every img (and video), enforce it in the template, and keep them responsive with CSS max-width: 100%; height: auto. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Image Alt Audit](https://jwatte.com/tools/image-alt-audit/), [Core Web Vitals Audit](https://jwatte.com/tools/cwv-audit/), [Image LCP Candidate Audit](https://jwatte.com/tools/image-lcp-candidate-audit/) and 6 more. Standard: Core Web Vitals CLS. - [ ] **8.19 Legacy image formats (`<n>` JPG/PNG/GIF)** - Pass: No image is served as JPG, PNG or GIF; images use WebP or AVIF, ideally inside `<picture>` with a fallback. - Warn: Image LCP Candidate Audit warns when the first image is not webp, avif or svg, and when 3 or more of the first 6 images are legacy; Image Alt Audit warns on a PNG or JPEG 1200 px wide or wider. - Fail: Mega Analyzer loses 8 points in its Perf + AI score on any legacy image and itemizes them; Analyzer reports the count as info; Batch Analyzer and Mega Batch only list legacy images in the fix prompt. - Numbers and lists the tool uses: Legacy regex /\.(jpg|jpeg|png|gif)(\?|$)/i on src or data-src (Mega Analyzer, Batch Analyzer, Mega Batch); modern = src contains .webp or .avif or a `<picture>` source[type*=webp] or source[type*=avif] (Mega Analyzer); extension regex /\.(avif|webp|jpg|jpeg|png|gif|svg)(?:$|[?#])/ on src and srcset candidates with up to 30 listed (Analyzer); weight 8 in the Mega Analyzer Perf + AI score; up to 20 listed in the prompt (Batch Analyzer, Mega Batch); modern = webp, avif, svg for the first image, warn at 3 or more legacy among the first 6 (Image LCP Candidate Audit); natural width >= 1200 px and extension png, jpg or jpeg (Image Alt Audit); conversion commands magick hero.jpg -quality 82 hero.webp and magick hero.jpg -quality 65 hero.avif (CWV Fix Generator); savings cited: WebP about 30% and AVIF about 50% smaller (Mega Analyzer), 30-50% (Analyzer), 25-50% (Image Alt Audit), AVIF 40-60% and 30-60% weight saving (Image LCP Candidate Audit), AVIF 30-50% and WebP 25-35% (CWV Fix Generator). - Why: JPG, PNG and GIF files are far heavier than the same picture in WebP or AVIF, and image bytes are usually the biggest part of page weight. - Fix: Convert images to AVIF and WebP at build or upload time (sharp, squoosh, or a WordPress plugin such as LiteSpeed Cache, Imagify, ShortPixel or WebP Express) and serve them through `<picture>``<source type="image/avif">``<source type="image/webp">``<img src="fallback.jpg">``</picture>`. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Image Alt Audit](https://jwatte.com/tools/image-alt-audit/), [Image LCP Candidate Audit](https://jwatte.com/tools/image-lcp-candidate-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/) and 5 more. - [ ] **8.20 Responsive images using srcset (`<n>`/`<n>`)** - Pass: At least half of the images carry srcset (checked when the page has 3 or more images). - Warn: Below 50% with 3 or more images (Mega Analyzer); the first image without srcset warns (Image LCP Candidate Audit). - Fail: Batch Analyzer fails its score bucket below 30% with 3 or more images. - Numbers and lists the tool uses: Gate imgs >= 3, srcset share >= 0.5 (Mega Analyzer); gate imgs >= 3, img[srcset] + source[srcset] over img count >= 0.3, weight 8 (Batch Analyzer); first image srcset non-empty, suggested 3 sizes such as 480w, 960w, 1600w plus a sizes attribute (Image LCP Candidate Audit); generator pattern widths 400w 800w 1200w 1600w with sizes="(max-width: 768px) 100vw, 1200px" (CWV Fix Generator). - Why: Without srcset a phone downloads the full desktop-size image, often about four times more than it needs. - Fix: Add srcset with three or four widths and a sizes attribute to content images, starting with the hero. - Verify: [Image LCP Candidate Audit](https://jwatte.com/tools/image-lcp-candidate-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/), [CWV Fix Generator](https://jwatte.com/tools/cwv-fix-generator/). - [ ] **8.21 Lazy loading: `<n>`/`<n>` images** - Pass: When the page has more than 2 images, at least one below-the-fold image uses loading=lazy, and no more than 3 images load eagerly. - Warn: More than 2 images and none lazy (Analyzer). - Fail: More than 3 eager images (no loading attribute or loading=eager) costs 10 points off the CWV Audit LCP signal. - Numbers and lists the tool uses: imagesTotal > 2 gate, at least one img[loading=lazy]; 0 images or 2 or fewer reported as info (Analyzer); eager = no loading attribute or loading === 'eager', > 3 eager images, 10 points off the LCP signal (CWV Audit); generator pattern gives below-fold img loading="lazy" decoding="async" with width and height and iframe loading="lazy" with width and height, about 50% of initial bytes saved on image-heavy pages (CWV Fix Generator). - Why: Images the visitor cannot see yet compete for bandwidth with the hero image; lazy-loading them frees the connection for what shows first. - Fix: Add loading="lazy" to every image and iframe below the fold, and keep the hero and the first viewport eager. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Core Web Vitals Audit](https://jwatte.com/tools/cwv-audit/), [CWV Fix Generator](https://jwatte.com/tools/cwv-fix-generator/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/) and 1 more. - [ ] **8.22 Large file size: `<n>`KB (consider WebP/AVIF)** - Pass: Each image file is 500,000 bytes or smaller. - Warn: An image over 500,000 bytes. - Numbers and lists the tool uses: Content-Length > 500000 bytes in the direct image URL audit and in batch mode (up to 25 URLs); the direct mode label cites WebP saves 85-92% and AVIF 92-95% at this size; the batch mode label is '`<n>`KB (consider WebP/AVIF)'. - Why: One oversized image can dominate the whole page weight and the largest paint. - Fix: Resize the image to the largest size actually displayed and convert it to WebP or AVIF. - Verify: [Image Alt Audit](https://jwatte.com/tools/image-alt-audit/). - [ ] **8.23 Detected LCP candidate** - Pass: The initial HTML contains at least one img, and the first one in DOM order is taken as the LCP candidate. - Warn: No img in the initial HTML; the LCP is probably a CSS background-image or a video poster, which the browser discovers late. - Numbers and lists the tool uses: candidates = first 6 img elements, LCP candidate = the first; each records src (currentSrc or src), srcset, loading, fetchpriority, width, height, alt and the extension from /\.(webp|avif|jpg|jpeg|png|gif|svg)(\?|#|$)/i, '?' when no match. - Why: LCP is won or lost on one element, usually the hero image, so the audit needs to know which one to check. - Fix: For a CSS background hero, use image-set() for AVIF and WebP with a fallback and add <link rel="preload" as="image" href="hero.avif" imagesrcset=... fetchpriority="high"> in `<head>`; verify the LCP element in the Chrome DevTools Performance panel. - Verify: [Image LCP Candidate Audit](https://jwatte.com/tools/image-lcp-candidate-audit/). - [ ] **8.24 First `<img>` not lazy-loaded** - Pass: The first image in the HTML (the LCP candidate) does not carry loading=lazy. - Warn: Any of the first 6 images lazy-loaded (Image LCP Candidate Audit). - Numbers and lists the tool uses: First /<img\b[^>]*>/i matched against /loading\s*=\s*["']?lazy/i (Mega SEO Analyzer); loading attribute lowercased === 'lazy' on the first image fails, any lazy among the first 6 warns, first 1 to 2 images should be eager, 200-800 ms delay cited (Image LCP Candidate Audit); first img tag must not match /loading=["']lazy["']/i (Competitor Gap Matrix). - Why: Loading=lazy on the hero tells the browser to wait before fetching the very image that decides LCP, which is the most common silent LCP killer. - Fix: Remove loading="lazy" from the above-the-fold hero, and use loading="eager" or omit the attribute for the first one or two images. - Verify: [Image LCP Candidate Audit](https://jwatte.com/tools/image-lcp-candidate-audit/), [Competitor Gap Matrix](https://jwatte.com/tools/competitor-gap-matrix/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [CWV Fix Generator](https://jwatte.com/tools/cwv-fix-generator/) and 1 more. Standard: Core Web Vitals LCP. - [ ] **8.25 LCP candidate has fetchpriority="high"** - Pass: The first image carries fetchpriority="high". - Warn: Missing or another value is reported as info in Mega SEO Analyzer and as a warning in Image LCP Candidate Audit. - Numbers and lists the tool uses: Regex /fetchpriority\s*=\s*["']?high/i on the first img (Mega SEO Analyzer); fetchpriority lowercased === 'high', 100-300 ms improvement cited (Image LCP Candidate Audit); /(fetchpriority=["']high["'])/i anywhere in the HTML (Competitor Gap Matrix). - Why: Fetchpriority=high moves the hero image up the browser's download queue so it arrives before less important files. - Fix: Add fetchpriority="high" to the LCP image (and to its preload link). - Verify: [Image LCP Candidate Audit](https://jwatte.com/tools/image-lcp-candidate-audit/), [Competitor Gap Matrix](https://jwatte.com/tools/competitor-gap-matrix/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/). Standard: Core Web Vitals LCP. - [ ] **8.26 LCP image not preloaded** - Pass: A `<link rel="preload" as="image">` for the hero appears in `<head>` before any CSS, with fetchpriority="high". - Numbers and lists the tool uses: Generator pattern: mobile variant media="(max-width: 768px)" and desktop variant media="(min-width: 769px)", each with fetchpriority="high", imagesrcset and imagesizes (100vw mobile, 1200px desktop); the LCP img itself carries fetchpriority="high" loading="eager" decoding="async" width="1200" height="675"; 200-800 ms LCP saving on mobile cited. - Why: The browser only finds the hero image after it has parsed the HTML and loaded the CSS; a preload moves that discovery to the very start of the page load. - Fix: Add the preload links to `<head>` before any stylesheet and set fetchpriority="high" on the LCP img. - Verify: [CWV Fix Generator](https://jwatte.com/tools/cwv-fix-generator/). - [ ] **8.27 Iframes / embeds without width+height** - Pass: Every iframe declares width and height and sits in a container with a CSS aspect-ratio. - Numbers and lists the tool uses: Generator pattern: wrapper div with aspect-ratio: 16 / 9; width: 100%, iframe width="560" height="315" with style width and height 100% and border 0, a title attribute, loading="lazy" and an allow list (accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture). - Why: An iframe is 0 by 0 pixels until its content loads, so a YouTube or map embed without dimensions pushes everything below it down. - Fix: Set width and height on every iframe and wrap it in an aspect-ratio container. - Verify: [CWV Fix Generator](https://jwatte.com/tools/cwv-fix-generator/). - [ ] **8.28 Dynamic content without reserved space (ads, embeds, lazy-loaded)** - Pass: Ad slots, embeds, carousels and lazy-loaded sections have reserved space through aspect-ratio or min-height. - Numbers and lists the tool uses: Generator pattern: .ad-slot-300x250 { width: 300px; aspect-ratio: 300 / 250; background: #f0f0f0; contain: layout paint; } .youtube-embed-wrapper { aspect-ratio: 16 / 9; width: 100%; } .user-content-block { min-height: 200px; } for variable-height content. - Why: Anything that loads after the first paint shoves the content below it unless its box already has a size. - Fix: Give every async-loaded rectangle an aspect-ratio box, or a min-height when the height is unpredictable. - Verify: [CWV Fix Generator](https://jwatte.com/tools/cwv-fix-generator/). - [ ] **8.29 Render-blocking stylesheets: `<n>`** - Pass: No more than 2 stylesheets block rendering. - Warn: 3 or 4 blocking stylesheets (Mega SEO Analyzer); more than 3 (Image LCP Candidate Audit). - Fail: More than 4 (Mega SEO Analyzer); more than 2 costs 15 points off the CWV Audit LCP signal. - Numbers and lists the tool uses: Regex /<link[^>]+rel=["']stylesheet["']/gi excluding media=print and tags with an onload attribute, pass <= 2, warn 3 to 4, fail > 4 (Mega SEO Analyzer); blocking = no media, media=all or media=screen, > 2 deducts 15 points off the LCP signal (CWV Audit); regex /<link[^>]+rel=["']stylesheet["']/g, pass <= 3 (Image LCP Candidate Audit); generator pattern inlines about 14 KB of critical CSS and loads the rest with <link rel="preload" as="style" onload="this.onload=null;this.rel='stylesheet'"> plus a `<noscript>` fallback, extraction tools critters, critical-css, beasties (CWV Fix Generator); critical CSS inline (Single Site Gen, Site Migration Gen). - Why: Each blocking stylesheet is a network round-trip the browser must finish before it can draw anything. - Fix: Inline the critical above-the-fold CSS and load the rest without blocking (preload as=style with an onload swap, or media=print plus onload). - Verify: [Core Web Vitals Audit](https://jwatte.com/tools/cwv-audit/), [Image LCP Candidate Audit](https://jwatte.com/tools/image-lcp-candidate-audit/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [CWV Fix Generator](https://jwatte.com/tools/cwv-fix-generator/) and 2 more. - [ ] **8.30 `<n>` render-blocking scripts (no async/defer)** - Pass: External scripts carry async or defer, with no more than 2 blocking script[src] tags. - Fail: More than 2 script[src] without async or defer costs 15 points off the CWV Audit LCP signal; Third-Party Script Cost labels each external script BLOCKING when it has neither attribute. - Numbers and lists the tool uses: blocking = neither async nor defer, > 2, 15 points off the LCP signal (CWV Audit); async regex /<script[^>]+async[\s\S]{0,200}src=["']?/i and defer regex /<script[^>]+defer[\s\S]{0,200}src=["']?/i per external script (Third-Party Script Cost); generator pattern defer for app code, async for independent scripts such as gtag, analytics injected on window load after a 2000 ms setTimeout with async = true (CWV Fix Generator); GA4 gtag async, Clarity deferred (Single Site Gen). - Why: A synchronous script in `<head>` stops the HTML parser until it downloads and runs, delaying everything the visitor sees. - Fix: Add defer to app scripts and async to independent ones such as analytics, and load third-party tags after the load event. - Verify: [Core Web Vitals Audit](https://jwatte.com/tools/cwv-audit/), [Third-Party Script Cost Audit](https://jwatte.com/tools/third-party-script-cost/), [CWV Fix Generator](https://jwatte.com/tools/cwv-fix-generator/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/). - [ ] **8.31 External scripts: `<n>`** - Pass: The page loads no more than 10 scripts from other hostnames and no more than 15 script[src] tags in total. - Warn: More than 10 scripts on other hostnames (Migration Analyzer). - Fail: More than 15 script[src] elements costs 15 points off the CWV Audit INP signal. - Numbers and lists the tool uses: > 15 script[src], 15 points off the INP signal (CWV Audit); > 10 external-host scripts (Migration Analyzer); unique external script URLs counted with regex /<script[^>]+src=["']([^"']+)["']/gi, same-host scripts excluded, protocol-relative srcs resolved to https (Third-Party Script Cost). - Why: Every script is download and main-thread work, and the total is what makes taps feel sluggish. - Fix: Remove scripts you do not use, combine what remains, and defer the rest. - Verify: [Core Web Vitals Audit](https://jwatte.com/tools/cwv-audit/), [Third-Party Script Cost Audit](https://jwatte.com/tools/third-party-script-cost/), [Migration Analyzer](https://jwatte.com/tools/migration-analyzer/). - [ ] **8.32 `<n>` inline scripts (each blocks the main thread)** - Pass: No more than 5 inline scripts, none larger than 1 KB. - Fail: More than 5 inline scripts costs 10 points off the CWV Audit INP signal. - Numbers and lists the tool uses: script:not([src]) count > 5, 10 points off the INP signal (CWV Audit); no inline script over 1 KB (Single Site Gen, Site Migration Gen). - Why: Each inline script runs on the main thread while the page is still being built. - Fix: Move inline code into a deferred external file and keep any remaining inline script tiny. - Verify: [Core Web Vitals Audit](https://jwatte.com/tools/cwv-audit/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/), [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/). - [ ] **8.33 Third-party script cost: high / med / low** - Pass: No high-cost third-party host loads on the page, or each one is deferred, consent-gated or loaded only after the first user interaction. - Warn: A medium-cost host is present (Third-Party Script Cost). - Fail: A high-cost host is present (Third-Party Script Cost); Google Tag Manager detected costs 8 points off the CWV Audit INP signal. - Numbers and lists the tool uses: High hosts: googletagmanager.com, googleadservices.com, facebook.net, connect.facebook.net, hotjar.com, fullstory.com, intercom.io, intercomcdn.com, driftt.com, drift.com, zdassets.com, hubspot.com, hs-scripts.com (sort weight 3); medium hosts: google-analytics.com, googletag, clarity.ms, segment.com, segment.io, calendly.com, hsforms.net, klaviyo.com, cookiebot.com, cookielaw.org, osano.com (weight 2); low hosts: stripe.com, js.stripe.com, cookieyes.com, termly.io, cdn.jsdelivr.net, unpkg.com, cdnjs.cloudflare.com, and any unrecognized host defaults to low (weight 1); match = host.includes(key), first key wins; approximate per-script size in KB from body length plus a summed total; table sorted by class weight then size descending; 31 keys in the KNOWN_COSTS table (the footer text says about 40) (Third-Party Script Cost); literals 'googletagmanager' or 'gtm.js', 8 points off the INP signal (CWV Audit); generator loader injects the script with async after the first click, scroll, keydown, mousemove or touchstart ({ once: true, passive: true }) or after a 3000 ms fallback timer, 50-300 ms per script cited (CWV Fix Generator). - Why: Chat widgets, pixels, session recorders and tag managers are the single biggest cause of Core Web Vitals regressions on small-business sites. - Fix: For each high-cost script decide keep, defer, consent-gate or remove; load pixels, GTM, FullStory, Hotjar and Intercom only after the first user interaction, render a static 'Chat with us' button that swaps in the real widget on click, consider lighter analytics such as Plausible or Fathom, and measure LCP and INP before and after. - Verify: [Third-Party Script Cost Audit](https://jwatte.com/tools/third-party-script-cost/), [Core Web Vitals Audit](https://jwatte.com/tools/cwv-audit/), [CWV Fix Generator](https://jwatte.com/tools/cwv-fix-generator/). - [ ] **8.34 `<n>` third-party CDN asset(s) could be self-hosted** - Pass: No font, script or stylesheet is loaded from a public CDN that could be self-hosted. - Numbers and lists the tool uses: CDN profiles: fonts.googleapis.com and fonts.gstatic.com (font), fonts.bunny.net and use.fontawesome.com (font), cdn.jsdelivr.net (script or css), cdnjs.cloudflare.com (script or css), unpkg.com (script or css), code.jquery.com (script), stackpath.bootstrapcdn.com and maxcdn.bootstrapcdn.com (script or css), use.typekit.net (font), cdn.tailwindcss.com (css); link[href], script[src] and @import URLs in inline `<style>` via /@import\s+(?:url\()?[\"']?(https?:\/\/[^\"')]+)/gi; own host (www. stripped), data:, javascript: and blob: excluded; analytics, chat and payment SDKs excluded; Tailwind play CDN costs a 350 KB+ runtime CSS download; 100-300 ms LCP win cited. - Why: Each public CDN costs a DNS lookup and TLS handshake on first visit, takes away your control over caching, integrity and compression, adds a third-party privacy hop, and goes down when the CDN does (jsdelivr.net and unpkg.com both had multi-hour outages in 2024-25). - Fix: Download the versioned asset once into /vendor/ or /fonts/ with a long Cache-Control, self-host Google Fonts with google-webfonts-helper, and replace the Tailwind CDN with a built tailwind.css (npx tailwindcss --minify). - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **8.35 Resource hints (`<n>` preconnect, `<n>` dns-prefetch, `<n>` preload)** - Pass: The page has at least 2 resource hints in total, with 1 to 4 preconnects covering the render-critical third-party origins. - Warn: Fewer than 2 hints (Mega Analyzer, Trust Signal Surface Audit); more than 4 preconnects (Mega SEO Analyzer); zero preconnect or zero dns-prefetch is reported as info (Analyzer, Mega SEO Analyzer). - Fail: Mega Analyzer fails when the page uses 5 or more external hosts and has fewer than min(3, hosts) preconnect or dns-prefetch links. - Numbers and lists the tool uses: preconnect + dns-prefetch + preload >= 2, weight 4 in the Perf + AI score (Mega Analyzer; Trust Signal Surface Audit with regexes /<link[^>]+rel=["'][^"']*\bpreconnect\b[^"']*["']/gi and the same shape for dns-prefetch and preload); externals >= 5 and hints < min(3, externals) fails, external hosts from /(?:src|href)\s*=\s*["']https?:\/\/([^"'/]+)/gi capped at 50 (Mega Analyzer); preconnect 1 to 4 passes, > 4 warns, regex /<link[^>]+rel=["']preconnect["']/gi (Mega SEO Analyzer); dns-prefetch /<link[^>]+rel=["']dns-prefetch["']/i (Mega SEO Analyzer); link[rel=preconnect] > 0 and link[rel=dns-prefetch] > 0 (Analyzer); /(rel=["']preconnect["'])/i (Competitor Gap Matrix); max 4 to 6 preconnects, 300-500 ms handshake cost cited (CWV Fix Generator); preconnect third-party critical origins (Single Site Gen, Site Migration Gen, Analyzer scaffold). - Why: A DNS lookup plus TLS handshake to a font, image or script host costs 100 to 500 ms on mobile before the file even starts downloading; a hint lets the browser do it while the HTML is still parsing. - Fix: Add `<link rel="preconnect">` for the 2 to 4 origins that are render-critical (font host, LCP image host, critical API), with crossorigin only where the fetch is CORS-mode such as fonts.gstatic.com; give analytics and other async origins at most a dns-prefetch; preload the LCP hero with `<link rel="preload" as="image">`. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Trust Signal Surface](https://jwatte.com/tools/trust-signal-surface-audit/), [Competitor Gap Matrix](https://jwatte.com/tools/competitor-gap-matrix/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/) and 4 more. Standard: W3C Resource Hints / Preload. - [ ] **8.36 Font preload hints: `<n>`** - Pass: When the page declares @font-face, at least one `<link rel="preload" as="font">` exists. - Warn: Zero font preloads is reported as info (Mega SEO Analyzer). - Fail: @font-face declared with no font preload costs 10 points off the CWV Audit LCP signal. - Numbers and lists the tool uses: Regex /<link[^>]+rel=["']preload["'][^>]+as=["']font["']/gi, > 0 (Mega SEO Analyzer); /@font-face/g count in the HTML vs link[rel="preload"][as="font"], fontFaces > 0 and 0 preloads deducts 10 (CWV Audit); generator pattern `<link rel="preload" as="font" type="font/woff2" crossorigin>` (CWV Fix Generator). - Why: A font declared inside CSS is discovered late, after the stylesheet downloads; preloading pulls it to the start of the page load. - Fix: Preload the one or two critical woff2 files in `<head>` with as="font" type="font/woff2" crossorigin. - Verify: [Core Web Vitals Audit](https://jwatte.com/tools/cwv-audit/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [CWV Fix Generator](https://jwatte.com/tools/cwv-fix-generator/). - [ ] **8.37 font-display: swap / optional present: <yes/no>** - Pass: Every @font-face rule declares font-display: swap or optional. - Warn: @font-face present without font-display swap or optional (Mega SEO Analyzer). - Fail: @font-face present without the literal 'font-display:swap' costs 5 points off the CWV Audit CLS signal. - Numbers and lists the tool uses: Gate /@font-face/i, regex /font-display\s*:\s*(swap|optional)/i (Mega SEO Analyzer); literal 'font-display:swap' with no space, 5 points off the CLS signal (CWV Audit); generator pattern swap = immediate fallback text, optional = use the font only if cached, fallback = 100 ms block then 3 s swap, example woff2 with font-weight: 100 900 and unicode-range U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, up to 3 s of invisible text without it (CWV Fix Generator); font-display: swap (Single Site Gen, Site Migration Gen, Analyzer scaffold). - Why: Without font-display the browser can hide all text for up to 3 seconds while the web font downloads. - Fix: Add font-display: swap (or optional) to each @font-face rule so fallback text shows immediately. - Verify: [Core Web Vitals Audit](https://jwatte.com/tools/cwv-audit/), [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [CWV Fix Generator](https://jwatte.com/tools/cwv-fix-generator/) and 2 more. - [ ] **8.38 Font swap causes layout shift** - Pass: The fallback font is metric-matched to the web font with size-adjust, ascent-override, descent-override and line-gap-override. - Numbers and lists the tool uses: Generator pattern: @font-face 'Inter Fallback' with src: local('Arial'); ascent-override: 90.20%; descent-override: 22.48%; line-gap-override: 0%; size-adjust: 107.40%; body font-family: 'Inter', 'Inter Fallback', sans-serif. - Why: When the fallback font is a different size from the real one, the swap reflows every line of text, which shows up as layout shift. - Fix: Define a metric-matched fallback @font-face (generate the overrides with capsize or the font style matcher) and list it right after the web font in font-family. - Verify: [CWV Fix Generator](https://jwatte.com/tools/cwv-fix-generator/). Standard: https://github.com/seek-oss/capsize and https://meowni.ca/font-style-matcher/ cited as generators. - [ ] **8.39 Minified CSS/JS** - Pass: Stylesheets and scripts are served minified. - Why: Whitespace and comments in CSS and JS are bytes every visitor downloads for nothing. - Fix: Minify CSS and JS in the build step. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/), [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/). - [ ] **8.40 No abandoned-site tech fingerprints detected** - Pass: No IE-era polyfills or outdated libraries are present. - Fail: Detected, rated critical. - Numbers and lists the tool uses: Seven fingerprints on the raw HTML: html5shiv or html5shim, selectivizr, respond.js or respond.min.js, IE conditional comments via /<!--\s*\[if\s+(lt\s+)?IE/i, jQuery 1.x or 2.0 via /jquery[\/.-](1\.\d+|2\.0)/i, Bootstrap 2.x or 3.x via /bootstrap[\/.-](2\.\d+|3\.\d+)/i, AngularJS 1.x via /angular\.js\/1\.|angularjs\/1\./i; any match sets hasAbandonedTech and the check fails at severity critical, listing the detected names. - Why: IE-era polyfills and outdated libraries tell crawlers and AI retrieval engines the site has not been maintained (Ahrefs 2024 freshness study; Profound 2024 LLM-citation cohort). - Fix: Remove html5shiv, selectivizr, respond.js and IE conditional comments, and bring jQuery, Bootstrap and AngularJS up to current versions. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **8.41 Web app manifest linked** - Pass: The `<head>` links a web app manifest. - Warn: Missing is a warning in the Mega Analyzer report. - Numbers and lists the tool uses: link[rel=manifest] href, resolved against the audited URL; weight 3 in the Perf + AI score. - Why: Google Discover eligibility and the Chrome install prompt both depend on a manifest. - Fix: Add `<link rel="manifest" href="/site.webmanifest">` to the `<head>` of every page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: W3C Web Application Manifest. - [ ] **8.42 Non-passive scroll / touch listeners** - Pass: Touchstart, wheel and scroll listeners are registered with { passive: true }. - Numbers and lists the tool uses: Events touchstart, wheel, scroll; listeners that must call preventDefault are isolated to the specific element with { passive: false }. - Why: A single non-passive touch or wheel listener forces the browser to wait for your code before it can scroll, so every scroll stutters. - Fix: Mark scroll, wheel and touch listeners passive and isolate any listener that needs preventDefault. - Verify: [CWV Fix Generator](https://jwatte.com/tools/cwv-fix-generator/). - [ ] **8.43 Event handlers fire on every event (scroll / input / resize)** - Pass: High-frequency handlers are debounced, throttled or gated behind requestAnimationFrame. - Numbers and lists the tool uses: debounce 200 ms on input; throttle 100 ms on scroll with { passive: true }; requestAnimationFrame ticking pattern for scroll and resize; 60 events per second cited. - Why: An input or scroll handler that runs 60 times a second swamps the main thread and makes the page feel sticky. - Fix: Wrap input handlers in debounce, and scroll and resize handlers in throttle or a requestAnimationFrame gate. - Verify: [CWV Fix Generator](https://jwatte.com/tools/cwv-fix-generator/). - [ ] **8.44 Long tasks (>50ms) blocking main thread** - Pass: No JavaScript task runs longer than 50 ms. - Numbers and lists the tool uses: 50 ms long-task threshold; await scheduler.yield() inside loops (Chrome 129+); requestIdleCallback chunks with a 50 ms budget (performance.now() + 50); heavy work offloaded to a Web Worker via postMessage. - Why: Any script that runs for more than 50 ms blocks every tap and click until it finishes. - Fix: Split long work with scheduler.yield or requestIdleCallback, or move it to a Web Worker. - Verify: [CWV Fix Generator](https://jwatte.com/tools/cwv-fix-generator/). - [ ] **8.45 Below-fold sections rendered on first paint** - Pass: Long below-the-fold sections use content-visibility: auto with contain-intrinsic-size. - Numbers and lists the tool uses: content-visibility: auto; contain-intrinsic-size: auto 500px on .article-section.comments-list.related-posts.footer-wide; not applied to above-the-fold content such as .hero and .main-cta; 50-80% render-time cut cited. - Why: The browser lays out and paints the whole page on first load, including sections nobody has scrolled to; content-visibility lets it skip them until needed. - Fix: Apply content-visibility: auto with contain-intrinsic-size to long below-fold sections only, never to the hero. - Verify: [CWV Fix Generator](https://jwatte.com/tools/cwv-fix-generator/). - [ ] **8.46 Speculation Rules API: <enabled / not configured>** - Pass: A `<script type="speculationrules">` is present. - Warn: Not configured is reported as info. - Numbers and lists the tool uses: Regex /<script[^>]+type=["']speculationrules["']/i. - Why: Speculation rules let the browser prerender the page a visitor is most likely to open next, so it appears instantly. - Fix: Add a speculationrules script that prerenders or prefetches the likely next pages. - Verify: [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: Speculation Rules API. - [ ] **8.47 View Transitions API: detected** - Pass: The HTML contains a @view-transition rule or ::view-transition CSS (reported only when found). - Numbers and lists the tool uses: Regex /@view-transition\s*\{|::view-transition/i. - Why: Cross-document view transitions make page-to-page navigation feel like one smooth app. - Fix: Optional; add a @view-transition rule for cross-document transitions. - Verify: [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: View Transitions API. - [ ] **8.48 Service Worker detected** - Pass: The HTML registers a service worker. - Warn: None found is reported as info. - Numbers and lists the tool uses: Regex /serviceWorker|navigator\.serviceWorker/i on the HTML. - Why: A service worker allows offline access and background sync; not required, but useful for repeat visits. - Fix: Optional; register a service worker if offline access or repeat-visit caching would help the site. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **8.49 `<n>` Shopify app scripts loading** - Pass: 4 or fewer Shopify app embeds load. - Warn: 5 to 8. - Fail: More than 8. - Numbers and lists the tool uses: Count of /cdn/shop/apps/ or apps.shopifycdn.com references; 4, 8; Shopify sites only. - Why: Each installed app embed is a separate blocking request on every page. - Fix: In Shopify Admin > Apps > installed, disable or remove the apps you do not use. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **8.50 Custom CSS bundle size** - Pass: The Squarespace Custom CSS block is under 20,000 characters. - Warn: 20,000 characters or more. - Numbers and lists the tool uses: Length of the style id=customCss block; 20000; Squarespace sites only. - Why: A huge inline Custom CSS block is the most common Squarespace slowdown. - Fix: Consolidate and trim the Custom CSS block. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **8.51 `<n>` typography font sources** - Pass: No more than 2 font sources load. - Warn: More than 2. - Numbers and lists the tool uses: Count of use.typekit.net or fonts.squarespace.com references; 2; Squarespace sites only. - Why: Every extra font source is another download that can shift text after it appears. - Fix: Consolidate fonts under Design > Fonts. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **8.52 `<n>` parastorage bundles loaded** - Pass: 10 or fewer static.parastorage.com bundles load. - Warn: More than 10. - Numbers and lists the tool uses: Count of static.parastorage.com references; 10; Wix sites only. - Why: The Wix client-side runtime is one of the heaviest on the web, and every extra bundle adds to it. - Fix: Remove Wix apps and page elements you do not need. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **8.53 jQuery loading (Webflow default)** - Pass: The Webflow site does not load jQuery. - Warn: JQuery found. - Numbers and lists the tool uses: /js/webflow-`<hash>`.js plus jquery in the HTML; Webflow sites only. - Why: Webflow ships jQuery with every site by default even when nothing uses it. - Fix: Site Settings > Custom Code, disable jQuery if nothing depends on it. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **8.54 Contentful image CDN in use** - Pass: Images are served from ctfassets.net. - Warn: Not found. - Numbers and lists the tool uses: (images|assets|cdn).ctfassets.net; Contentful sites only. - Why: Serving Contentful images from anywhere else loses the on-the-fly resizing and the edge cache. - Fix: Serve images from ctfassets.net. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **8.55 Sanity reads via apicdn.sanity.io** - Pass: Content reads go through apicdn.sanity.io. - Warn: Only api.sanity.io found. - Numbers and lists the tool uses: apicdn.sanity.io vs api.sanity.io; neither host found is reported as info; Sanity sites only. - Why: Api.sanity.io hits the origin on every read while apicdn.sanity.io serves from an edge cache. - Fix: Switch reads to apicdn.sanity.io and keep api.sanity.io for writes. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **8.56 Data source: <this URL / origin-wide> (Chrome UX Report 28-day p75)** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: source = 'URL' when loadingExperience.metrics has keys, 'origin' when originLoadingExperience.metrics has keys, else null; when neither exists the Field Performance dimension is skipped (Mega SEO Analyzer) or the probe stops with 'No CrUX field data available for this URL or origin' (CrUX Field Data Probe); strategy mobile or desktop and overall_category shown; metric keys LARGEST_CONTENTFUL_PAINT_MS, INTERACTION_TO_NEXT_PAINT, CUMULATIVE_LAYOUT_SHIFT_SCORE, FIRST_CONTENTFUL_PAINT_MS, EXPERIMENTAL_TIME_TO_FIRST_BYTE; 28-day CrUX window. - Why: Origin-wide data means this specific page does not get enough Chrome traffic to have its own numbers, and no data at all means the site is too small or new to appear in the Chrome UX Report yet. - Fix: No fix; the site needs enough real Chrome visitors to appear in CrUX, so use lab tools in the meantime and wait 7 to 14 days after a fix for field data to reflect it. - Verify: [CrUX Field Data Probe](https://jwatte.com/tools/crux-field-data-probe/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: Chrome UX Report; Google PageSpeed Insights API v5. - [ ] **8.57 Format-conversion savings (WebP / AVIF)** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: Rendered when at least one image returned Content-Length > 0 and Content-Type image/*; projected WebP ratio: webp, avif, svg 1.0, gif 0.40, jpg/jpeg 0.75, png or other 0.22 under 50,000 bytes, 0.12 under 200,000, else 0.10; projected AVIF ratio: avif, svg 1.0, webp 0.70, gif 0.30, jpg/jpeg 0.50, png or other 0.16 under 50,000, 0.08 under 200,000, else 0.06; slow-4G transfer at 1600 kbps, seconds = bytes * 8 / 1024 / 1600; top 10 files by AVIF bytes saved; per-file and batch totals use the same ratios. - Why: The transfer-time difference is a direct LCP change on mobile, so this shows how many seconds the conversion would buy. - Fix: On WordPress, LiteSpeed Cache, Imagify, ShortPixel or WebP Express convert on upload; on a static site add a build step with sharp or squoosh-cli and a `<picture>` tag with WebP and AVIF sources. - Verify: [Image Alt Audit](https://jwatte.com/tools/image-alt-audit/). - [ ] **8.58 Marketing / runtime stack layers** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: analytics: GA4, Google Tag Manager, Plausible, Fathom Analytics, Matomo, Mixpanel, Segment, Hotjar, FullStory, Microsoft Clarity, Amplitude; consent: Cookiebot, OneTrust, CookieYes, Osano, Termly, iubenda, Complianz, Borlabs Cookie; payment: Stripe, PayPal, Square, Klarna, Afterpay, Braintree, Apple Pay; support: Intercom, Drift, Zendesk, Crisp Chat, Tidio, Help Scout Beacon; booking: Calendly, Cal.com; email: Mailchimp form, ConvertKit, Klaviyo; membership: Memberstack, Outseta, Pico. - Why: Knowing which third-party services the page loads is the starting point for deciding which ones cost more speed than they are worth. - Fix: Review the list against what the business actually uses and remove the rest. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). ## 9. Accessibility Accessibility is a legal exposure as well as a quality bar. This section is the WCAG 2.2 AA criteria the tools test, the critical failures that are also the most common lawsuit claims, forms, color scheme, and the accessibility statement page. **Verify this section with:** [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [ADA Litigation Risk Score](https://jwatte.com/tools/ada-litigation-risk/), [Legal Pages Generator](https://jwatte.com/tools/legal-pages-generator/), [Site Analyzer](https://jwatte.com/tools/analyzer/), [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/), [Migration Analyzer](https://jwatte.com/tools/migration-analyzer/), [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/), [Mega Batch](https://jwatte.com/tools/mega-batch/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [User Preference Media Queries Audit](https://jwatte.com/tools/prefers-color-scheme-audit/), [Rendered DOM Paste Audit](https://jwatte.com/tools/rendered-dom-paste-audit/), [Image LCP Candidate Audit](https://jwatte.com/tools/image-lcp-candidate-audit/), [Form Conversion Audit](https://jwatte.com/tools/form-conversion-audit/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/), [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/). - [ ] **9.1 Accessibility statement linked** - Pass: The site links to an accessibility statement page, or the page mentions an accessibility statement, WCAG conformance or ADA compliance. - Warn: ADA Litigation Risk warns instead of failing when no accessibility link or statement wording is found. - Fail: Mega Analyzer and E-E-A-T Analyzer fail the page when no accessibility statement link is found. - Numbers and lists the tool uses: Mega Analyzer link regex /\/(accessibility|a11y|accessibility-statement|ada)(\/|$)/i on hrefs; E-E-A-T Analyzer /accessibility|wcag/i on hrefs or the phrase 'accessibility statement' in body text; ADA Litigation Risk /\/accessibility(?:\.html|\/|")|accessibility statement|accessibility policy|ADA compliance|WCAG 2\.[12]/i on the HTML. - Why: An accessibility statement documents your conformance target and gives visitors a way to report barriers, and it is the first thing plaintiff-side ADA firms look for. - Fix: Publish an /accessibility/ page that names your WCAG 2.1 AA or 2.2 AA target, a contact email for barrier reports, known limitations and a last-updated date, and link it from the footer of every page. - Verify: [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [ADA Litigation Risk Score](https://jwatte.com/tools/ada-litigation-risk/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: W3C accessibility statement guidance; ADA Title III (2024 DOJ rule); EN 301 549. - [ ] **9.2 Accessibility Statement: required sections** - Pass: The statement names WCAG 2.2 Level AA as the target, lists the practices followed, discloses known limitations, gives a feedback channel with a response commitment, describes the stack and assistive-technology test matrix, and cites the regulations that apply. - Numbers and lists the tool uses: Target WCAG 2.2 Level AA (https://www.w3.org/TR/WCAG22/); practices: semantic HTML with proper heading hierarchy, keyboard-navigable controls with visible focus indicators, contrast 4.5:1 normal text and 3:1 large text, alt text on meaningful images and null alt on decorative, form labels and error messages associated with inputs, ARIA landmarks where semantic HTML is insufficient, responsive layout at 400% zoom without horizontal scroll; known limitations: older blog posts, third-party embeds (YouTube, maps, analytics iframes), PDFs older than the effective-date year; feedback: email with page URL, issue description and preferred format or assistive technology, response within 5 business days; tested with current NVDA, JAWS, VoiceOver, keyboard-only navigation and browser zoom up to 400%; stack phrase 'a modern web stack' for SaaS, otherwise 'standards-compliant HTML, CSS, and JavaScript'; regulations: ADA Title III and the September 2024 DOJ rule, EN 301 549 / European Accessibility Act, UK Public Sector Bodies (Websites and Mobile Applications) Accessibility Regulations 2018. - Why: A statement that names a target, admits known gaps and offers a working contact is documented good faith, which matters if a demand letter arrives. - Fix: Generate the statement with the Legal Pages Generator, then make the site actually meet each listed practice before publishing it. - Verify: [Legal Pages Generator](https://jwatte.com/tools/legal-pages-generator/). Standard: WCAG 2.2 AA; ADA Title III; DOJ September 2024 rule; EN 301 549; European Accessibility Act; UK PSBAR 2018. - [ ] **9.3 Accessibility overlay widget installed: `<vendor>`** - Pass: No third-party accessibility overlay widget is loaded on the page. - Warn: ADA Litigation Risk warns when an overlay is detected and reports 'No accessibility overlay detected' as information otherwise. - Fail: Mega Analyzer fails the page when any vendor signature matches in the first 250,000 characters of HTML. - Numbers and lists the tool uses: Mega Analyzer signatures: accessiBe /acsbapp\.com|acsbap\.com|acsb\.js|data-acsb|acsbJS/i; UserWay /cdn\.userway\.org|userway\.js|userwayApp|data-account[^>]{0,60}userway/i; AudioEye /wsmcdn\.audioeye\.com|audioeye_dom|ae-handle|window\.AudioEye|audioeye\.com\/ae\.js/i; EqualWeb /aacdn\.nagich|equalweb\.com\/[^"'\s]*\.js|INDmenu/i; Recite Me /api\.reciteme\.com|reciteme\.com\/[^"'\s]*\.js|Recite\.load/i, scanned in the first 250000 characters; ADA Litigation Risk /accessibe|userway\.org|equalweb|audioeye|accessibly|facilware|accessibility-widget|a11y-widget/i; evidence cited: FTC v. accessiBe consent order finalized April 2025 with a $1M penalty, UsableNet 2024 tracker with 1,023 of about 4,000 ADA Title III suits citing the overlay as a barrier, DOJ March 2022 web-accessibility guidance. - Why: Overlay widgets do not make a site WCAG conformant and are not a legal defense; they were named as a barrier in about a quarter of 2024 ADA Title III complaints. - Fix: Remove the overlay and fix the underlying HTML, CSS and ARIA problems; run the WCAG Accessibility Audit to find them. - Verify: [ADA Litigation Risk Score](https://jwatte.com/tools/ada-litigation-risk/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: WCAG 2.1 / 2.2 AA; ADA Title III; DOJ March 2022 web accessibility guidance; FTC v. accessiBe (April 2025). - [ ] **9.4 `<n>` PDF(s) linked from the homepage** - Pass: No public PDF links are on the page. - Warn: One or more links point to a PDF file. - Numbers and lists the tool uses: selectors a[href$=".pdf"], a[href*=".pdf?"]. - Why: PDFs that were never tagged for accessibility are a heavy ADA exposure because screen readers cannot read them in order. - Fix: Convert public PDFs to HTML where possible; where a PDF must stay, remediate it with tagging software (CommonLook, Axes4, Foxit) so it has tags, reading order and alt text on its images, and remove abandoned PDFs. - Verify: [ADA Litigation Risk Score](https://jwatte.com/tools/ada-litigation-risk/). Standard: ADA Title III. - [ ] **9.5 HTML lang attribute missing (WCAG 3.1.1)** - Pass: The `<html>` element has a non-empty lang attribute. - Fail: Analyzer, WCAG Quick Checks, WCAG Accessibility Audit (critical), ADA Litigation Risk and Migration Analyzer fail a missing lang; Batch Analyzer deducts its 12-point weight. - Numbers and lists the tool uses: lang read from documentElement: trimmed getAttribute in WCAG Quick Checks and WCAG Accessibility Audit, raw truthiness in Analyzer, ADA Litigation Risk, Batch Analyzer and Migration Analyzer; crit:true in WCAG Accessibility Audit; Batch Analyzer weight 12; WCAG Fix Generator sc=3.1.1, lvl=A, impact=serious. - Why: Screen readers use the page language to choose pronunciation rules, so a missing lang gets the content read in the wrong voice. - Fix: Add lang="en" (or the correct BCP-47 code such as en-US) to the `<html>` tag. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [ADA Litigation Risk Score](https://jwatte.com/tools/ada-litigation-risk/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/) and 2 more. Standard: WCAG 2.2 SC 3.1.1 Language of Page (Level A). - [ ] **9.6 Document title missing (WCAG 2.4.2)** - Pass: The page has a `<title>` that names both the page and the site and is at least 5 characters long. - Warn: WCAG Quick Checks warns when the title is shorter than 3 characters as a likely placeholder. - Fail: WCAG Accessibility Audit fails a missing title or one under 5 characters as a critical AA fail; WCAG Quick Checks fails only an empty title. - Numbers and lists the tool uses: minimum 3 characters (WCAG Quick Checks); minimum 5 characters, crit:true (WCAG Accessibility Audit); WCAG Fix Generator sc=2.4.2, lvl=A, impact=serious. - Why: The title is the first thing a screen reader announces and it identifies the page in tabs, history and search results. - Fix: Give every page a unique, descriptive `<title>` that names both the page and the site, such as 'Product Name, Acme', not 'Home' or the site name alone. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 2.4.2 Page Titled (Level A). - [ ] **9.7 Viewport blocks zoom (WCAG 1.4.4)** - Pass: A viewport meta tag is present and does not disable user scaling or cap maximum-scale. - Warn: Mega Analyzer warns when maximum-scale is present but below 5. - Fail: Zoom is blocked by user-scalable=no or 0, or maximum-scale=1 (WCAG Accessibility Audit also fails any maximum-scale below 1); Mega Analyzer and Analyzer also fail a missing viewport meta. - Numbers and lists the tool uses: regexes /user-scalable\s*=\s*(no|0)/ and /maximum-scale\s*=\s*1(?:\.0+)?/ on the lowercased content (WCAG Quick Checks, Batch Analyzer weight 5, Mega Batch weight 6); Migration Analyzer /user-scalable\s*=\s*no/i and /maximum-scale\s*=\s*1[^.0-9]/i on the raw content, passing when no viewport meta exists; Analyzer /maximum-scale\s*=\s*1(?:\.0+)?(?:\s*[,;]|\s*$)/; WCAG Accessibility Audit /maximum-scale\s*=\s*(1(?:\.0+)?|0\.\d+)/ with crit:true; Mega Analyzer fails on /user-scalable\s*=\s*(no|0)/ or /maximum-scale\s*=\s*1(?:\.0+)?\b/ on the lowercased content or a missing viewport, warns when parseFloat(maximum-scale) < 5, and its mobile-overflow scan re-flags /user-scalable\s*=\s*(no|0)|maximum-scale\s*=\s*1(?:\.0)?\b/i as a warning; WCAG Fix Generator sc=1.4.4, lvl=AA, impact=critical, test at 200% zoom at 1280x1024 with no horizontal scroll or cut-off content. - Why: Low-vision visitors need to pinch-zoom to at least 200%, and blocking zoom is one of the easiest accessibility failures for anyone to spot. - Fix: Use `<meta name="viewport" content="width=device-width, initial-scale=1">`, remove user-scalable=no and maximum-scale (or set maximum-scale=5.0), and use rem or em font sizes so the layout survives 200% zoom. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/) and 3 more. Standard: WCAG 2.2 SC 1.4.4 Resize Text and SC 1.4.10 Reflow (Level AA). - [ ] **9.8 color-scheme meta: set / not set** - Pass: The HTML carries `<meta name="color-scheme">` or the CSS declares the color-scheme property. - Warn: Prefers Color Scheme Audit warns when neither is set; Mega SEO Analyzer reports a missing meta as information only. - Numbers and lists the tool uses: HTML regex /<meta[^>]+name=["']color-scheme["']/i (both tools); CSS regex /color-scheme\s*:\s*(light|dark|light dark|dark light)/i (Prefers Color Scheme Audit). - Why: Without color-scheme the browser's native form controls and scrollbars ignore the visitor's light or dark preference. - Fix: Add `<meta name="color-scheme" content="light dark">` and html { color-scheme: light dark }. - Verify: [User Preference Media Queries Audit](https://jwatte.com/tools/prefers-color-scheme-audit/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: CSS color-scheme property; HTML meta name=color-scheme. - [ ] **9.9 prefers-color-scheme dark: `<n>`** - Pass: At least one @media rule targets prefers-color-scheme: dark in the inline styles or the first five linked stylesheets. - Warn: Prefers Color Scheme Audit warns when no dark-mode rule exists; Mega SEO Analyzer only reports a pass when one is found. - Numbers and lists the tool uses: regex /@media[^{]*prefers-color-scheme\s*:\s*dark/gi over every inline `<style>` plus the first 5 link[rel="stylesheet"] files (Prefers Color Scheme Audit); /prefers-color-scheme\s*:\s*dark/i on the HTML (Mega SEO Analyzer). - Why: Dark mode is a system preference visitors set on purpose, and a site that ignores it glares at them at night. - Fix: Define light values as CSS custom properties at :root and override them inside @media (prefers-color-scheme: dark); swap images per scheme with `<picture>``<source media="(prefers-color-scheme: dark)" srcset="dark.png">``<img src="light.png">``</picture>`. - Verify: [User Preference Media Queries Audit](https://jwatte.com/tools/prefers-color-scheme-audit/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: CSS media query prefers-color-scheme. - [ ] **9.10 prefers-reduced-motion guards: `<n>`** - Pass: At least one @media rule targets prefers-reduced-motion. - Warn: No reduced-motion rule is found in the inline styles or the first five linked stylesheets. - Numbers and lists the tool uses: regex /@media[^{]*prefers-reduced-motion/gi over every inline `<style>` plus the first 5 linked stylesheets. - Why: Visitors with vestibular disorders turn on reduced motion, and animations that ignore it can make them dizzy or sick. - Fix: Add @media (prefers-reduced-motion: reduce) { * { animation: none !important; transition: none !important; } } or scope the rule to your animated elements. - Verify: [User Preference Media Queries Audit](https://jwatte.com/tools/prefers-color-scheme-audit/). Standard: CSS media query prefers-reduced-motion. - [ ] **9.11 No `<main>` landmark (WCAG 1.3.1)** - Pass: The page has exactly one `<main>` element or role="main". - Warn: WCAG Quick Checks and Analyzer warn when main is missing, and WCAG Quick Checks also warns when more than one main exists. - Fail: WCAG Accessibility Audit fails a missing main and more than one main as critical fails; Mega Analyzer and Batch Analyzer fail a missing main. - Numbers and lists the tool uses: selector main, [role="main"]; exactly one (WCAG Quick Checks; WCAG Accessibility Audit multiMain > 1 crit:true); Batch Analyzer weight 8; Mega Analyzer reports main, nav, skip link, unique IDs and aria-label count in one block. - Why: Screen-reader users jump straight to the main landmark to skip the header and navigation on every page. - Fix: Wrap the primary content of each page in a single `<main id="main">` element and remove or nest any extras. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/). Standard: WCAG 2.2 SC 1.3.1 Info and Relationships (Level A). - [ ] **9.12 No `<nav>` or role="navigation"** - Pass: Primary navigation is wrapped in `<nav>` or role="navigation", the masthead in `<header>` or role="banner", and the site footer in `<footer>` or role="contentinfo". - Warn: Analyzer warns when the nav landmark is missing; WCAG Accessibility Audit warns when a nav, header or footer landmark is missing; Migration Analyzer warns when fewer than 2 landmarks of any kind are found. - Fail: Mega Analyzer and Batch Analyzer fail a missing navigation landmark. - Numbers and lists the tool uses: selectors nav, [role="navigation"]; header, [role="banner"]; footer, [role="contentinfo"]; Batch Analyzer nav weight 6; Migration Analyzer counts role banner/navigation/main/contentinfo plus main, nav, header, footer and needs at least 2. - Why: Landmarks let assistive-technology users jump to or past whole regions instead of tabbing through every link. - Fix: Use `<header>`, `<nav aria-label="Main navigation">`, `<main>` and `<footer>` for the page regions instead of generic `<div>`s. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/) and 1 more. Standard: WCAG 2.2 SC 1.3.1 Info and Relationships (landmarks). - [ ] **9.13 No skip-to-content link (WCAG 2.4.1)** - Pass: A skip link to the main content is the first focusable element on the page. - Warn: Analyzer, WCAG Quick Checks, ADA Litigation Risk and Migration Analyzer warn when no skip link is found; WCAG Quick Checks only checks pages that have a main landmark. - Fail: WCAG Accessibility Audit fails a missing skip link as a critical fail; Mega Analyzer and Batch Analyzer fail it. - Numbers and lists the tool uses: selectors a.skip-link, a[href="#main"], a[href="#content"] (Mega Analyzer, Analyzer); plus a[href^="#"][class*="skip"] gated on a main landmark (WCAG Quick Checks); plus a[href="#main-content"] or the first a[href^="#"] whose text matches /^\s*(skip|jump)\s+(to|past|link)/i (WCAG Accessibility Audit, crit:true); text /skip (?:to )?(?:main|content|nav)/i or a[href^="#main"], a[href^="#content"], a.skip-link, a.skip-nav (ADA Litigation Risk); a[href^=#main], a[href=#content], a[href=#main-content].skip-link, [class*=skip] (Migration Analyzer); Batch Analyzer weight 15; WCAG Fix Generator sc=2.4.1, lvl=A, impact=serious. - Why: Keyboard and screen-reader users otherwise have to tab through the whole navigation on every single page before reaching the content. - Fix: Add `<a href="#main" class="skip-link">`Skip to main content`</a>` as the first element in `<body>`, point it at `<main id="main">`, and keep it off-screen until it receives focus (.skip-link { position:absolute; top:-100px } .skip-link:focus { top:0 }). - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [ADA Litigation Risk Score](https://jwatte.com/tools/ada-litigation-risk/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/) and 3 more. Standard: WCAG 2.2 SC 2.4.1 Bypass Blocks (Level A). - [ ] **9.14 No H1 on page (WCAG 2.4.6)** - Pass: The page has exactly one `<h1>`. - Warn: More than one `<h1>`; WCAG Quick Checks separates visually-hidden H1s (the logo-as-H1 pattern) from visible ones. - Fail: Zero `<h1>` elements (a critical fail in WCAG Accessibility Audit). - Numbers and lists the tool uses: pass === 1, warn > 1, fail === 0; visually-hidden class regex /\b(visually-hidden|sr-only|screen-reader|visuallyhidden|vh-?hidden)\b/ on the lowercased class (WCAG Quick Checks). - Why: Screen readers and outline tools use the single H1 to tell the visitor what the page is about, and none or several confuses them. - Fix: Use one H1 per page that describes the page content and demote extra H1s (often a reused promo or newsletter section) to `<h2>`; with the logo-as-H1 pattern keep the visually-hidden one. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [ADA Litigation Risk Score](https://jwatte.com/tools/ada-litigation-risk/). Standard: WCAG 2.2 SC 2.4.6 Headings and Labels; SC 1.3.1. - [ ] **9.15 `<n>` skipped heading level(s) (WCAG 1.3.1)** - Pass: Headings follow a sequential order with no level jumping by more than one, and at least one heading exists. - Warn: A heading level jumps more than one step deeper than the previous one, such as H2 to H4. - Fail: Analyzer fails a page with no h1 to h6 headings at all. - Numbers and lists the tool uses: skip rule level[i] > level[i-1] + 1 in document order; WCAG Accessibility Audit lists each jump as h`<n>` -> h`<m>` with the first 40 characters of heading text. - Why: Screen readers build a page outline from heading levels, and a skipped level makes it sound like a section is missing. - Fix: Restore a sequential outline: h1, then h2, then h3, and never jump from h1 to h3 or h2 to h4. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/). Standard: WCAG 2.2 SC 1.3.1 Info and Relationships (Level A). - [ ] **9.16 `<n>` empty heading(s)** - Pass: No h1 to h6 element is empty. - Fail: WCAG Accessibility Audit fails any empty heading as a critical fail (crit:true). - Numbers and lists the tool uses: selector h1,h2,h3,h4,h5,h6; trimmed text length 0; crit:true. - Why: An empty heading is announced as a heading with nothing in it and breaks heading navigation. - Fix: Remove empty headings or fill in real text. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/). Standard: WCAG 2.2 SC 2.4.6 Headings and Labels. - [ ] **9.17 `<n>` heading(s) repeated 3+ times at the same level** - Pass: No heading text is repeated three or more times at one level. - Warn: The same heading text appears 3 or more times at the same level, such as five 'Read more' h3s in a card grid. - Numbers and lists the tool uses: count >= 3 per level plus lowercased text key; empty headings excluded. - Why: Repeated identical headings give screen-reader users an outline where every section sounds the same. - Fix: Make each repeated heading unique and descriptive of its own section. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/). Standard: WCAG 2.2 SC 2.4.6 Headings and Labels. - [ ] **9.18 Headings and labels, descriptive** - Pass: Every section heading and form label describes its content without needing the surrounding context. - Numbers and lists the tool uses: sc=2.4.6; lvl=AA; impact=serious. - Why: A heading that reads 'Form' or 'More' tells a screen-reader user scanning the outline nothing about what follows. - Fix: Rename generic headings and labels so they stand alone: 'Contact form' instead of 'Form'. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 2.4.6 Headings and Labels (Level AA). - [ ] **9.19 Info & relationships, semantic structure** - Pass: Structure that is visible on screen (regions, headings, tables, lists, grouped fields) is also conveyed by semantic HTML. - Numbers and lists the tool uses: sc=1.3.1; lvl=A; impact=serious. - Why: A layout built from styled `<div>`s looks organized but sounds like one long paragraph to a screen reader. - Fix: Use real semantic elements (`<nav>`, `<main>`, `<article>`, `<aside>`, `<header>`, `<footer>`, `<h1>` to `<h6>`) instead of `<div>`; give tables `<th scope="col|row">`, grouped fields `<fieldset>``<legend>`, and lists `<ul>``<li>` instead of ; treat ARIA roles as the last resort. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 1.3.1 Info and Relationships (Level A). - [ ] **9.20 Meaningful sequence, reading order** - Pass: The visual order of content matches the DOM order. - Numbers and lists the tool uses: sc=1.3.2; lvl=A; impact=serious. - Why: Screen readers read the DOM in source order, so content moved around with CSS positioning is read out of sequence. - Fix: Avoid position:absolute or order tricks that rearrange visual content away from the source order; restructure the HTML instead. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 1.3.2 Meaningful Sequence (Level A). - [ ] **9.21 `<n>` data table(s) have no `<th>` / `<thead>`** - Pass: Every table contains a `<th>` or a `<thead>`. - Numbers and lists the tool uses: gated on tables.length > 0; a table with no `<th>` and no `<thead>` fails; crit:true. - Why: Without header cells a screen reader cannot tell the visitor which column or row a value belongs to. - Fix: Give data tables `<th>` header cells and a `<caption>`; if a table is only used for layout, add role="presentation". - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/). Standard: WCAG 2.2 SC 1.3.1 Info and Relationships. - [ ] **9.22 `<n>` list(s) contain non-`<li>` children** - Pass: Every `<ul>` and `<ol>` contains only `<li>` children. - Warn: A list has child elements and every one of them is something other than `<li>`. - Numbers and lists the tool uses: selector ul, ol; children.length > 0 and every child tagName !== 'LI'. - Why: A list that holds `<div>`s instead of items is announced as an empty list and loses its item count. - Fix: Wrap the content inside `<li>` elements or switch the container to `<div>`. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/). Standard: WCAG 2.2 SC 1.3.1 Info and Relationships. - [ ] **9.23 Images missing alt text (`<n>`)** - Pass: Every `<img>` has an alt attribute: descriptive text for content images and alt="" for decorative ones. - Warn: Analyzer, Rendered DOM Paste Audit and ADA Litigation Risk (below 10% of images) report missing alt as a warning, and Migration Analyzer warns at 1 to 3 missing. - Fail: ADA Litigation Risk fails at 10% or more of images missing alt, Migration Analyzer fails at more than 3, Batch Analyzer fails below 80% coverage, and WCAG Accessibility Audit counts any missing alt as a critical AA fail. - Numbers and lists the tool uses: Mega Analyzer, Batch Analyzer prompt and Mega Batch count alt missing or alt === '' (src, data-src or '(no src)' listed, prompt caps 20); WCAG Quick Checks, WCAG Accessibility Audit, ADA Litigation Risk, Rendered DOM Paste Audit and Migration Analyzer count only a missing alt attribute (alt="" passes); Analyzer treats alt plus role="presentation", role="none" or aria-hidden="true" as decorative and lists up to 30; ADA Litigation Risk pct = round(missing / total * 100), warn below 10, fail at 10 or more; Migration Analyzer warn 1 to 3, fail over 3; Batch Analyzer pass when 0 images or withAlt / imgs >= 0.8, weight 15; Mega Batch weight 12; Mega Analyzer emits the itemized fix section when imgsMissingAlt + imgsMissingDims + imgsLegacy + dupIds > 0; WCAG Fix Generator sc=1.1.1, lvl=A, impact=critical. - Why: Missing alt text is the lead complaint in most ADA demand letters and it hides what the image says from screen readers and search engines. - Fix: Add descriptive alt text to every content image and alt="" (optionally with role="presentation" or aria-hidden="true") to decorative ones; give complex graphics a long description through aria-describedby or a `<details>` element. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [ADA Litigation Risk Score](https://jwatte.com/tools/ada-litigation-risk/), [Rendered DOM Paste Audit](https://jwatte.com/tools/rendered-dom-paste-audit/) and 5 more. Standard: WCAG 2.2 SC 1.1.1 Non-text Content (Level A); ADA Title III. - [ ] **9.24 `<n>` image(s) have alt="" but look meaningful (>=64px)** - Pass: No image with an empty alt is 64 pixels or larger unless it is marked decorative. - Warn: An image has alt="", no role="presentation" or aria-hidden="true", and a width or height attribute of 64 or more. - Numbers and lists the tool uses: width >= 64 or height >= 64 from the attributes (default 0); exempt when role="presentation" or aria-hidden="true". - Why: A large image with an empty alt is usually a content image that was marked decorative by mistake, so screen readers skip it. - Fix: Confirm each flagged image is truly ornamental, otherwise write real alt text for it. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/). Standard: WCAG 2.2 SC 1.1.1 Non-text Content. - [ ] **9.25 `<n>` image(s) use a filename / placeholder as alt** - Pass: No alt text is a filename or a generic placeholder word. - Fail: An image's trimmed alt matches the filename or placeholder pattern. - Numbers and lists the tool uses: FILENAME_ALT_RE = /^(image|img|picture|photo|graphic|screenshot)[-_ ]?\d*$|\.(jpg|jpeg|png|gif|webp|svg|bmp|tiff?)$/i on the trimmed alt; severity fail, not flagged crit. - Why: An alt of 'image1.jpg' or 'photo' tells a screen-reader user nothing about what the picture shows. - Fix: Rewrite each flagged alt to describe what the image communicates. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/). Standard: WCAG 2.2 SC 1.1.1 Non-text Content. - [ ] **9.26 `<n>` image(s) have alt >250 chars** - Pass: No alt attribute is longer than 250 characters. - Warn: An alt attribute is longer than 250 characters. - Numbers and lists the tool uses: alt length > 250. - Why: Alt text that long is read in one unbroken stream with no way to pause, and it belongs in a caption or the body text. - Fix: Move the long description into adjacent body text or a caption and keep the alt short. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/). Standard: WCAG 2.2 SC 1.1.1 Non-text Content. - [ ] **9.27 `<n>` image-map area(s) missing alt** - Pass: Every `<area href>` inside a `<map>` has alt text. - Numbers and lists the tool uses: gated on map area count > 0; any area[href] with a missing or empty alt fails. - Why: Image-map hotspots are links, and without alt their destinations have no name for screen readers. - Fix: Give each `<area>` an alt that describes its link target. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/). Standard: WCAG 2.2 SC 1.1.1 Non-text Content. - [ ] **9.28 LCP candidate alt text: "`<alt>`" | (missing)** - Pass: The first image on the page (the likely hero or LCP image) has non-empty alt text. - Warn: The first image has no alt or an empty alt. - Numbers and lists the tool uses: first `<img>` only; alt shown truncated to 60 characters. - Why: The hero image is the most visible image on the page, so a missing alt there is both a WCAG 1.1.1 failure and a lost search signal. - Fix: Add descriptive alt text to the hero image. - Verify: [Image LCP Candidate Audit](https://jwatte.com/tools/image-lcp-candidate-audit/). Standard: WCAG 2.2 SC 1.1.1 Non-text Content. - [ ] **9.29 `<n>` image-only link(s) have no accessible name** - Pass: Every link that wraps only an image has alt text on the image or an aria-label on the link. - Numbers and lists the tool uses: selector a[href] img; link text with whitespace removed has length 0, no aria-label on the anchor, image alt trims to empty; crit:true; each anchor href listed. - Why: Screen readers announce the raw URL or skip the link entirely when a logo or icon link has no name. - Fix: Add alt text to the wrapped image or an aria-label to the anchor. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/). Standard: WCAG 2.2 SC 2.4.4 Link Purpose. - [ ] **9.30 Images of text, replace with real text where possible** - Pass: Text is delivered as HTML text styled with CSS, not baked into image files, apart from logos and essential branding. - Numbers and lists the tool uses: sc=1.4.5; lvl=AA; impact=moderate. - Why: Text inside an image cannot be read by screen readers, translated, or resized cleanly. - Fix: Replace hero banners and headings rendered as images with real HTML text styled with CSS; logos and essential branding are exempt. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 1.4.5 Images of Text (Level AA). - [ ] **9.31 `<n>` generic link text instance(s) ("click here", "read more", etc.)** - Pass: Link text describes the destination on its own, and no links use generic phrases such as 'click here' or 'read more'. - Warn: Analyzer warns on any vague link; Mega Analyzer warns when 10% or more of anchors are generic. - Fail: WCAG Accessibility Audit fails any generic link that has no aria-label, aria-labelledby or title as a critical fail. - Numbers and lists the tool uses: Analyzer regex /^(click here|here|read more|learn more|more|link)$/i on the trimmed text of every `<a>`; Mega Analyzer lowSignalRe = /^\s*(click\s+here|read\s+more|learn\s+more|here|this\s+page|this\s+link|link|more|continue|→|»)\s*$/i on trimmed a[href] text, gate anchorsTotal > 0, lowPct = round(anchorsLowSignal / anchorsTotal * 100), warn when lowPct >= 10; WCAG Accessibility Audit LOW_SIGNAL = /^\s*(click\s+here|read\s+more|learn\s+more|more|here|this\s+page|this\s+link|link|continue|details|info|find\s+out\s+more|→|»|>>?)\s*\.?$/i, links with href matching /^(#|mailto:|tel:|javascript:)/i excluded, list capped at 20 with text sliced to 40 chars, crit:true; WCAG Fix Generator sc=2.4.4, lvl=A, impact=critical, flagged phrases 'click here', 'read more', 'learn more'. - Why: Screen-reader users often navigate by a list of links, and 'click here' repeated ten times gives them nothing to choose from. - Fix: Rewrite each link so the text alone names the destination, for example 'Read the 2026 pricing guide' instead of 'Click here'; where the surrounding context is needed, add an aria-label. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 2.4.4 Link Purpose (In Context) (Level A). - [ ] **9.32 `<n>` link(s) with no accessible name (WCAG 2.4.4, 4.1.2)** - Pass: Every a[href] has a non-empty accessible name from visible text, an image alt, aria-label, aria-labelledby or title. - Numbers and lists the tool uses: WCAG Quick Checks accessible-name order: aria-label; aria-labelledby (visible text of each referenced id, joined); for img, area and input the alt, then value when type is submit or button; visible text with whitespace collapsed; title attribute; WCAG Accessibility Audit: text with whitespace removed has length 0, no aria-label, no aria-labelledby and no img[alt]:not([alt=""]) descendant, links with href matching /^(#|mailto:|tel:|javascript:)/i excluded, list capped at 20, crit:true. - Why: An icon-only link with no name is invisible to screen readers, so social icons and cart links become unusable. - Fix: Give the link visible text, alt text on the wrapped image, or an aria-label. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/). Standard: WCAG 2.2 SC 2.4.4 Link Purpose; SC 4.1.2 Name, Role, Value. - [ ] **9.33 `<n>` button(s) with no accessible name (WCAG 4.1.2)** - Pass: Every button and button-like control has an accessible name from text content, a value, an aria-label, or an image child with alt. - Numbers and lists the tool uses: WCAG Quick Checks selector button, input[type="button"], input[type="submit"], input[type="reset"], [role="button"] with the same accessible-name order as the link check; WCAG Accessibility Audit `<button>` with whitespace-removed text length 0, no aria-label, no aria-labelledby and no img[alt]:not([alt=""]) or svg title descendant, list capped at 20, crit:true; WCAG Fix Generator sub-code 1.1.1b, lvl=A, impact=critical, covers inputs, selects, textareas and buttons. - Why: An unnamed button is announced only as 'button', so the visitor has no idea what pressing it will do. - Fix: Give each button visible text, a value, an aria-label (for example `<button aria-label="Close dialog">`X`</button>`), or an image child with alt. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 4.1.2 Name, Role, Value (Level A). - [ ] **9.34 `<n>` element(s) have onclick but no keyboard handler / role / tabindex** - Pass: Every clickable element is a native control or has a role, a tabindex and a keyboard handler. - Numbers and lists the tool uses: [onclick] elements whose tag is not A, BUTTON, INPUT, SELECT or TEXTAREA and that have no role and no tabindex; list capped at 20; crit:true; WCAG Fix Generator sc=2.1.1, lvl=A, impact=critical. - Why: A `<div onclick>` works with a mouse but cannot be reached or activated from the keyboard, which locks out keyboard and switch users. - Fix: Use a real `<button>`, or add role="button", tabindex="0" and a keydown handler for Enter and Space. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 2.1.1 Keyboard (Level A). - [ ] **9.35 `<n>` modal dialog(s) detected / No modal dialogs detected on homepage** - Pass: Keyboard focus can enter and leave every widget; modal dialogs trap focus while open, close on Escape and return focus to the trigger. - Numbers and lists the tool uses: ADA Litigation Risk counts [role="dialog"], [aria-modal].modal, [class*="modal"], passes at 0 and reports any count as information to verify manually; WCAG Fix Generator sc=2.1.2, lvl=A, impact=critical. - Why: A modal that swallows keyboard focus with no way out is one of the most common and most serious keyboard failures. - Fix: Test each modal by keyboard: Escape closes it, focus returns to the element that opened it, and Tab stays inside while it is open; watch for iframes without focus management and autofocus handlers that loop. - Verify: [ADA Litigation Risk Score](https://jwatte.com/tools/ada-litigation-risk/), [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 2.1.2 No Keyboard Trap (Level A). - [ ] **9.36 Focus order, tab order follows logical sequence** - Pass: Tab order follows the reading order, with no positive tabindex values. - Numbers and lists the tool uses: sc=2.4.3; lvl=A; impact=serious; avoid tabindex>0. - Why: Keyboard users move through the page in DOM order, so a layout that differs from it sends them jumping around the screen. - Fix: Let DOM order set the tab order, never use tabindex greater than 0, and only reorder with CSS Grid or Flexbox where the visual order still matches the reading order. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 2.4.3 Focus Order (Level A). - [ ] **9.37 `<n>` element(s) rely on title attribute alone for their accessible name** - Pass: Fewer than 3 elements depend on the title attribute alone for their name. - Warn: 3 or more elements have a title attribute but no aria-label, no text content and no img[alt] descendant. - Numbers and lists the tool uses: trigger count >= 3; tag names excluded LINK, IFRAME, META, SCRIPT, STYLE, SVG, USE, PATH. - Why: Title tooltips never appear on touch screens and screen readers handle them inconsistently. - Fix: Use visible text, aria-label or aria-labelledby instead of relying on title. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/). Standard: WCAG 2.2 SC 1.4.13 Content on Hover or Focus. - [ ] **9.38 `<n>` element(s) where aria-label does not contain the visible text** - Pass: Every button and link that carries an aria-label includes its visible text in that label. - Warn: Visible text (aria-hidden descendants removed) is longer than 2 characters, the aria-label is longer than 2 characters, and the label does not include the visible text. - Numbers and lists the tool uses: selectors button[aria-label], a[aria-label]; [aria-hidden="true"] descendants removed; whitespace collapsed to one space and lowercased; symbol-only visible text (no /[a-z0-9]/ match) exempt; list capped at 10 with text sliced to 30 chars; WCAG Fix Generator sc=2.5.3, lvl=A, impact=serious. - Why: Voice-control users say the words they see, and if the accessible name is different the command does nothing. - Fix: Make the aria-label start with or contain the visible text; do not set aria-label="Send" on a button that says 'Submit'. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 2.5.3 Label in Name (Level A). - [ ] **9.39 `<n>` element(s) have unrecognized ARIA role(s)** - Pass: Every role attribute uses a valid WAI-ARIA role token. - Numbers and lists the tool uses: VALID_ROLES = alert, alertdialog, application, article, banner, button, cell, checkbox, columnheader, combobox, complementary, contentinfo, definition, dialog, directory, document, feed, figure, form, grid, gridcell, group, heading, img, link, list, listbox, listitem, log, main, marquee, math, menu, menubar, menuitem, menuitemcheckbox, menuitemradio, navigation, none, note, option, presentation, progressbar, radio, radiogroup, region, row, rowgroup, rowheader, scrollbar, search, searchbox, separator, slider, spinbutton, status, switch, tab, table, tablist, tabpanel, term, textbox, timer, toolbar, tooltip, tree, treegrid, treeitem; fails when the role attribute is non-empty and every space-separated token is absent from the list; list capped at 20; crit:true. - Why: A misspelled role is silently ignored, so the element loses the meaning you meant to give it. - Fix: Correct the role to a valid token such as button, link, navigation, main, dialog, alert or region. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/). Standard: WCAG 2.2 SC 4.1.2 Name, Role, Value; WAI-ARIA roles. - [ ] **9.40 `<n>` unknown aria-* attribute(s)** - Pass: Every aria-* attribute is a known WAI-ARIA state or property. - Warn: An attribute name starts with aria- but is not in the known list. - Numbers and lists the tool uses: VALID_ARIA_ATTRS = aria-activedescendant, aria-atomic, aria-autocomplete, aria-busy, aria-checked, aria-colcount, aria-colindex, aria-colspan, aria-controls, aria-current, aria-describedby, aria-details, aria-disabled, aria-dropeffect, aria-errormessage, aria-expanded, aria-flowto, aria-grabbed, aria-haspopup, aria-hidden, aria-invalid, aria-keyshortcuts, aria-label, aria-labelledby, aria-level, aria-live, aria-modal, aria-multiline, aria-multiselectable, aria-orientation, aria-owns, aria-placeholder, aria-posinset, aria-pressed, aria-readonly, aria-relevant, aria-required, aria-roledescription, aria-rowcount, aria-rowindex, aria-rowspan, aria-selected, aria-setsize, aria-sort, aria-valuemax, aria-valuemin, aria-valuenow, aria-valuetext; list capped at 15. - Why: A typo such as aria-labeledby (one L) does nothing, and the control stays unlabeled. - Fix: Correct the attribute to the valid ARIA spelling or remove it. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/). Standard: WCAG 2.2 SC 4.1.2 Name, Role, Value; WAI-ARIA states and properties. - [ ] **9.41 Name, role, value, custom widgets have ARIA** - Pass: Custom components (dropdowns, tabs, modals, tree views) expose a role and their state through ARIA attributes. - Numbers and lists the tool uses: sc=4.1.2; lvl=A; impact=critical; patterns https://www.w3.org/WAI/ARIA/apg/patterns/. - Why: A tab strip or dropdown built from plain `<div>`s has no name, role or state, so a screen reader cannot operate it. - Fix: Add the role plus state attributes for each widget, such as role="tab", aria-selected="true", aria-expanded="false" inside `<ul role="tablist">`, following the WAI-ARIA Authoring Practices pattern for that widget. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 4.1.2 Name, Role, Value (Level A). - [ ] **9.42 ARIA labels: `<n>` elements** - Pass: More than 3 elements carry an aria-label (Analyzer), or at least 3 (Batch Analyzer). - Warn: Analyzer warns at 1 to 3 aria-labels and reports 0 as information. - Fail: Batch Analyzer fails fewer than 3. - Numbers and lists the tool uses: Analyzer pass > 3, warn 1 to 3, info at 0; Batch Analyzer min 3, weight 10; Mega Analyzer reports the count in its landmarks block and passes when ariaLabels > 0. - Why: Icon buttons, search fields and social links usually need aria-labels, so a page with none has probably left its controls unnamed. - Fix: Add aria-label to icon-only controls and to any element whose purpose is not clear from its visible text. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/). - [ ] **9.43 ARIA roles: `<n>` elements** - Pass: More than 3 elements carry a role attribute (Analyzer), or at least 2 (Batch Analyzer). - Fail: Batch Analyzer fails fewer than 2 role attributes; Analyzer reports 3 or fewer as information. - Numbers and lists the tool uses: Analyzer pass > 3, info <= 3; Batch Analyzer min 2, weight 6. - Why: Landmark and widget roles tell assistive technology what each region and control is. - Fix: Prefer semantic HTML landmarks (header, nav, main, footer) and add ARIA roles only where no native element fits. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/). - [ ] **9.44 `<n>` interactive target(s) below 24x24 px (WCAG 2.5.8, 2.2 AA)** - Pass: No link, button or input declares a width or height under 24 CSS pixels. - Warn: WCAG Quick Checks flags interactive elements whose inline style sets both width and height in px with either under 24; WCAG Accessibility Audit flags a width or height attribute or inline style under 24. - Numbers and lists the tool uses: minimum 24x24 CSS px; WCAG Quick Checks selector a, button, input[type="button"], input[type="submit"], input[type="checkbox"], input[type="radio"], [role="button"], style matching both /\bwidth\s*:\s*(\d+)\s*px/i and /\bheight\s*:\s*(\d+)\s*px/i; WCAG Accessibility Audit selectors a[href], button, input[type="button"], input[type="submit"], width or height attribute or inline /width\s*:\s*(\d+)/ and /height\s*:\s*(\d+)/, a dimension of 0 ignored; only inline sizes are inspected, CSS-driven sizes are not measured; the generated-site build spec asks for 44x44 px touch targets (Single Site Gen). - Why: Tiny icon buttons are hard to hit for anyone with a tremor or a large thumb, and WCAG 2.2 now sets a 24 pixel floor. - Fix: Make every click target at least 24x24 CSS pixels, usually by adding padding. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/). Standard: WCAG 2.2 SC 2.5.8 Target Size (Minimum) (Level AA). - [ ] **9.45 Pointer gestures, complex gestures have single-point alternative** - Pass: Every pinch, swipe or multi-point gesture has a single-tap alternative. - Numbers and lists the tool uses: sc=2.5.1; lvl=A; impact=moderate. - Why: Visitors with motor impairments cannot perform complex gestures. - Fix: Add plus and minus buttons for zoom and next and previous buttons for swipe carousels. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 2.5.1 Pointer Gestures (Level A). - [ ] **9.46 Pointer cancellation, down-event triggers action** - Pass: Click actions fire on pointer-up, not pointer-down. - Numbers and lists the tool uses: sc=2.5.2; lvl=A; impact=moderate. - Why: Visitors need to be able to drag off a button to abort a press they started by mistake. - Fix: Handle on:click rather than on:mousedown. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 2.5.2 Pointer Cancellation (Level A). - [ ] **9.47 Motion actuation, shake-to-undo has alternative** - Pass: Any feature triggered by device motion (shake, tilt) has an on-screen alternative. - Numbers and lists the tool uses: sc=2.5.4; lvl=A; impact=moderate. - Why: Visitors with tremor or in motorized wheelchairs trigger motion features by accident. - Fix: Provide a button for anything shake-to-undo or tilt-to-rotate does. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 2.5.4 Motion Actuation (Level A). - [ ] **9.48 Inline scripts attach keyboard listeners** - Pass: Single-character keyboard shortcuts can be turned off, remapped, or only fire while a control has focus. - Numbers and lists the tool uses: WCAG Accessibility Audit reports as information when /addEventListener\s*\(\s*['"](?:keydown|keypress|keyup)['"]/ matches the HTML; WCAG Fix Generator sc=2.1.4, lvl=A, impact=moderate. - Why: Speech-input users dictate words that contain the shortcut letters, so a single-key shortcut fires by accident. - Fix: If you ship single-key shortcuts, add a setting to disable or remap them, or scope them to a focused control, and verify by hand. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 2.1.4 Character Key Shortcuts (Level A). - [ ] **9.49 WCAG 2.4.7: Focus visible** - Pass: The CSS defines a visible focus indicator (a :focus-visible or :focus rule) and never removes the outline without a replacement. - Warn: Analyzer warns when no focus rule is found in the HTML or the first three same-origin stylesheets; WCAG Accessibility Audit warns when outline:none appears but a :focus-visible rule also exists. - Fail: WCAG Accessibility Audit fails as critical when outline:none or outline:0 appears and :focus-visible appears nowhere in the served HTML. - Numbers and lists the tool uses: Analyzer /focus-visible|:focus\s*\{/ on the HTML, then /focus-visible/i on the first 3 same-origin link[rel="stylesheet"] files; WCAG Accessibility Audit counts /outline\s*:\s*(none|0)/gi in the served HTML only and tests /:focus-visible/i, linked stylesheets are not read so a pass means not detected; WCAG Fix Generator sc=2.4.7, lvl=AA, impact=critical, indicator contrast 3:1, forbidden pattern :focus { outline: none } without replacement; the generated-site build spec asks for a focus ring of at least 2px at 3:1 (Single Site Gen). - Why: Keyboard users need to see which element is active, and :focus { outline: none } with no replacement leaves them blind. - Fix: Add :focus-visible { outline: 2px solid #f59e0b; outline-offset: 2px; } to your stylesheet, and never remove an outline without providing a replacement of at least 3:1 contrast. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 2.4.7 Focus Visible (Level AA). - [ ] **9.50 Sticky/fixed elements detected, verify focus ring not hidden behind them** - Pass: When an element receives keyboard focus, no sticky or fixed header or footer hides it. - Numbers and lists the tool uses: WCAG Accessibility Audit reports as information when /position\s*:\s*(sticky|fixed)/i matches the HTML; WCAG Fix Generator sc=2.4.11, lvl=AA, impact=serious, scroll-margin-top: 80px. - Why: A sticky header can cover the link a keyboard user just tabbed to, so they cannot see where they are. - Fix: Tab through the page and confirm focused elements stay visible; add scroll-margin-top: 80px to focusable elements or scroll-padding-top on the scroll container. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 2.4.11 Focus Not Obscured (Minimum) (Level AA). - [ ] **9.51 WCAG 1.4.3: Color contrast** - Pass: Body text reaches 4.5:1 contrast against its background and large text reaches 3:1. - Warn: ADA Litigation Risk warns when an inline color declaration uses a very light hex value; Analyzer always reports contrast as information because it cannot measure it. - Numbers and lists the tool uses: ADA Litigation Risk regex /color\s*:\s*#(?:c|d|e|f)(?:c|d|e|f)(?:c|d|e|f)/i on the HTML (approximation only); WCAG Fix Generator sc=1.4.3, lvl=AA, impact=critical, body text 4.5:1, large text (18pt or 14pt bold and up) 3:1, suggested gold body color #c07400 on cream; the generated-site build spec requires 4.5:1 text and 3:1 large text (Single Site Gen). - Why: Light grey or gold text on a pale background is the most common contrast failure and is unreadable for many low-vision visitors. - Fix: Check colors with the WebAIM contrast checker or WAVE, then darken the text or lighten the background until body text reaches 4.5:1 and large text 3:1. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [ADA Litigation Risk Score](https://jwatte.com/tools/ada-litigation-risk/), [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 1.4.3 Contrast (Minimum) (Level AA). - [ ] **9.52 Non-text contrast, UI components below 3:1** - Pass: Button borders, input borders, focus indicators and meaningful icons reach 3:1 contrast against their adjacent color. - Numbers and lists the tool uses: sc=1.4.11; lvl=AA; impact=serious; 3:1 against the adjacent color. - Why: Thin grey form borders on a white background are the most common failure, and low-vision visitors cannot find the field. - Fix: Darken control borders, focus rings and icons until they reach 3:1 against the surrounding color. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 1.4.11 Non-text Contrast (Level AA). - [ ] **9.53 Use of color, color alone is not the sole indicator** - Pass: Color is never the only way a state, an error or a link is conveyed. - Numbers and lists the tool uses: sc=1.4.1; lvl=A; impact=serious. - Why: Color-blind visitors cannot tell a red error from normal text or a colored link from body copy. - Fix: Pair red error text with a label or icon, pair required-field asterisks with aria-required or explicit labeling, and underline links in body text. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 1.4.1 Use of Color (Level A). - [ ] **9.54 Sensory characteristics, do not rely on shape/color alone** - Pass: Instructions never depend on shape, color or position alone. - Numbers and lists the tool uses: sc=1.3.3; lvl=A; impact=moderate. - Why: 'Click the red button' or 'see the box on the right' means nothing to a visitor who cannot perceive that cue. - Fix: Always include a text label in instructions alongside any shape, color or position reference. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 1.3.3 Sensory Characteristics (Level A). - [ ] **9.55 Text spacing, breaks when user overrides line-height / letter-spacing** - Pass: Content is not cut off and does not overlap when the visitor applies wider text spacing. - Numbers and lists the tool uses: sc=1.4.12; lvl=AA; impact=moderate; line-height 1.5x, paragraph spacing 2x, letter-spacing 0.12x, word-spacing 0.16x. - Why: Dyslexic readers widen spacing with a browser extension, and fixed-height text boxes then clip the words. - Fix: Avoid fixed-height containers for text and prefer min-height so the box grows with the spacing. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 1.4.12 Text Spacing (Level AA). - [ ] **9.56 Hover / focus popups, not dismissable or not hoverable** - Pass: Tooltips and popovers that appear on hover or focus can be dismissed with Escape, can be hovered without vanishing, and stay until dismissed or focus moves. - Numbers and lists the tool uses: sc=1.4.13; lvl=AA; impact=moderate; three requirements: dismissable (Esc), hoverable, persistent. - Why: A dropdown that disappears as the pointer moves toward it is unusable for anyone with unsteady hands or screen magnification. - Fix: Make every hover or focus popup dismissable, hoverable and persistent, and remove on-hover menus that vanish as the visitor moves toward them. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 1.4.13 Content on Hover or Focus (Level AA). - [ ] **9.57 Orientation, content does not require specific orientation** - Pass: The page works in both portrait and landscape unless one orientation is essential. - Numbers and lists the tool uses: sc=1.3.4; lvl=AA; impact=moderate. - Why: Visitors with a device mounted to a wheelchair cannot rotate it to suit the site. - Fix: Remove any CSS rotation lock; only something like a piano app may require one orientation. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 1.3.4 Orientation (Level AA). - [ ] **9.58 `<n>` form control(s) without a label (WCAG 1.3.1, 3.3.2)** - Pass: Every input, select and textarea has a programmatic label: a `<label for>`, a wrapping `<label>`, aria-label or aria-labelledby. - Warn: Analyzer warns on unlabeled inputs and reports a page with no inputs as information. - Fail: WCAG Accessibility Audit, WCAG Quick Checks, ADA Litigation Risk and Form Conversion Audit fail any unlabeled control (critical in WCAG Accessibility Audit). - Numbers and lists the tool uses: Analyzer selector input:not([type="hidden"]):not([type="submit"]):not([type="button"]):not([name="bot-field"]),select,textarea, labeled by aria-label, aria-labelledby, title, label[for=id] or a `<label>` ancestor; WCAG Quick Checks selector input:not([type="button"]):not([type="submit"]):not([type="reset"]):not([type="hidden"]), select, textarea, exempt with aria-label, aria-labelledby, label[for=id], closest('label') or aria-hidden="true"; WCAG Accessibility Audit excludes types hidden, submit, button, reset, image, accepts title, list capped at 20, crit:true; ADA Litigation Risk selector input:not([type="hidden"]):not([type="submit"]):not([type="button"]):not([type="image"]),textarea,select, accepts title; Form Conversion Audit needs a label[for] inside the form, aria-label, aria-labelledby or a wrapping label, placeholder never counts; WCAG Fix Generator sc=3.3.2, lvl=A, impact=critical. - Why: A placeholder disappears the moment someone types, so a field with no real label leaves screen-reader users guessing what to enter, and unlabeled inputs are a top-three ADA demand-letter trigger. - Fix: Add `<label for="email">`Email address`</label>` next to `<input id="email">`, or an aria-label on the input, and mark required fields with visible text or an asterisk plus a legend. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [ADA Litigation Risk Score](https://jwatte.com/tools/ada-litigation-risk/), [Form Conversion Audit](https://jwatte.com/tools/form-conversion-audit/) and 1 more. Standard: WCAG 2.2 SC 1.3.1 Info and Relationships; SC 3.3.2 Labels or Instructions (Level A); ADA Title III. - [ ] **9.59 `<n>` radio group(s) not wrapped in `<fieldset>``<legend>`** - Pass: Every group of two or more related radio buttons sits inside a `<fieldset>` with a `<legend>`. - Numbers and lists the tool uses: input[type="radio"][name] grouped by name; group size >= 2; ancestor test closest('fieldset') on the first radio; crit:true; instance list shows name="`<value>`". - Why: Without a group name a screen reader announces 'Yes' and 'No' with no hint of what question they answer. - Fix: Wrap each set of related radios or checkboxes in `<fieldset>` with a `<legend>` that states the question. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/). Standard: WCAG 2.2 SC 1.3.1 Info and Relationships. - [ ] **9.60 `<n>` personal-data input(s) missing autocomplete attribute** - Pass: Every input that collects personal data carries the matching autocomplete token. - Warn: An email, tel, password, name, phone or address input has no autocomplete attribute (WCAG Accessibility Audit); any text, email, tel, password or url input without one (Form Conversion Audit). - Numbers and lists the tool uses: WCAG Accessibility Audit selector input[type="email"],input[type="tel"],input[type="password"],input[name*="name"],input[name*="email"],input[name*="phone"],input[name*="address"], excluded types hidden, submit, button, reset, image, checkbox, radio, list capped at 20; Form Conversion Audit input types text, email, tel, password, url with an empty autocomplete; tokens email, tel, given-name, family-name, organization, street-address, postal-code, country, bday, new-password / current-password; WCAG Fix Generator sc=1.3.5, lvl=AA, impact=moderate, token list https://www.w3.org/TR/WCAG22/#input-purposes. - Why: Autocomplete tokens let browsers and password managers fill the form, which helps people with motor or memory difficulties and adds roughly 5 to 15% mobile conversion. - Fix: Add autocomplete="email", "tel", "name", "given-name", "family-name", "street-address", "postal-code" and so on to each personal-data field. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [Form Conversion Audit](https://jwatte.com/tools/form-conversion-audit/), [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 1.3.5 Identify Input Purpose (Level AA); HTML autocomplete tokens. - [ ] **9.61 Forms present but no role="status" / aria-live regions** - Pass: Form success and error messages, and other status updates such as 'Cart updated', are announced through a live region. - Numbers and lists the tool uses: WCAG Accessibility Audit reports as information when form count > 0 and the count of [role="status"], [role="alert"], [aria-live] is 0; WCAG Fix Generator sc=4.1.3, lvl=AA, impact=serious. - Why: A message that only appears visually is missed entirely by screen-reader users, who never learn whether the form failed or succeeded. - Fix: Put status messages in an aria-live="polite" region or role="status", and urgent errors in role="alert" or aria-live="assertive". - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 4.1.3 Status Messages (Level AA). - [ ] **9.62 Error identification, invalid fields are announced** - Pass: Invalid fields are flagged in text and ARIA, not only by a red highlight. - Numbers and lists the tool uses: sc=3.3.1; lvl=A; impact=critical. - Why: Screen readers cannot see a red border, so the visitor never learns which field failed. - Fix: Set aria-invalid="true" on failing fields and link the error text with aria-describedby. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 3.3.1 Error Identification (Level A). - [ ] **9.63 Error suggestion, errors offer fix recommendations** - Pass: Every error message tells the visitor how to fix the input. - Numbers and lists the tool uses: sc=3.3.3; lvl=AA; impact=moderate. - Why: 'Email is required' leaves a visitor who typed something wrong with no idea what to change. - Fix: Write errors like 'Please enter a valid email address (e.g., name@example.com)'. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 3.3.3 Error Suggestion (Level AA). - [ ] **9.64 Error prevention, legal/financial forms have review + undo** - Pass: Legal commitments, financial transactions and data deletions offer a review step, a confirmation and an undo window. - Numbers and lists the tool uses: sc=3.3.4; lvl=AA; impact=serious. - Why: A mis-tapped submit on a payment or deletion cannot be taken back without a review step. - Fix: Add a review page and a confirmation before irreversible actions, and require re-confirmation for the truly irreversible ones. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 3.3.4 Error Prevention (Legal, Financial, Data) (Level AA). - [ ] **9.65 Form #`<n>` asks for email in `<n>` fields** - Pass: No form asks for the same information twice, and a multi-step form pre-fills or skips data already entered. - Numbers and lists the tool uses: WCAG Accessibility Audit reports as information when one form has 2 or more input[type="email"], input[name*="email" i] fields; WCAG Fix Generator sc=3.3.7, lvl=A, impact=moderate. - Why: Re-typing an email or address is a real barrier for visitors with motor or memory impairments, and WCAG 2.2 now forbids it. - Fix: Pre-fill repeated fields or offer a 'same as above' option. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 3.3.7 Redundant Entry (Level A). - [ ] **9.66 `<n>` auth-form(s), `<n>` CAPTCHA/cognitive test(s) detected** - Pass: Login and verification flows do not require memorizing strings, solving puzzles or typing a CAPTCHA without an alternative. - Warn: An authentication form is present together with a CAPTCHA or cognitive-test widget; auth forms without one are reported as information. - Numbers and lists the tool uses: auth form = `<form>` containing input[type="password"] or any input or label whose name or text matches AUTH_RE = /(password|passcode|pin|otp|2fa|mfa|captcha|verify)/i; cognitive tests counted with [data-hcaptcha-widget-id].g-recaptcha, [class*="captcha" i]; WCAG Fix Generator sc=3.3.8, lvl=AA, impact=serious. - Why: Distorted-text CAPTCHAs and memory puzzles lock out people with cognitive or visual disabilities, and WCAG 2.2 now prohibits them without an alternative. - Fix: Offer passkeys, OAuth, an email or SMS passcode, or a magic link as an alternative, and confirm password managers can autofill the form. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 3.3.8 Accessible Authentication (Minimum) (Level AA); SC 3.3.9. - [ ] **9.67 `<n>` <select onchange=...> detected** - Pass: Changing a form control's value never navigates or submits without a warning or an explicit button. - Numbers and lists the tool uses: WCAG Accessibility Audit reports as information when select[onchange] count > 0; WCAG Fix Generator sc=3.2.2, lvl=A, impact=serious. - Why: Keyboard users arrow through a `<select>` to read the options, and a select that navigates on change fires before they reach the one they want. - Fix: Add a visible Go or submit button instead of navigating on change, or announce the change through aria-live. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 3.2.2 On Input (Level A). - [ ] **9.68 On focus, no context change on focus** - Pass: Receiving focus never submits a form or navigates. - Numbers and lists the tool uses: sc=3.2.1; lvl=A; impact=serious. - Why: Tabbing through a page must not trigger side effects, or keyboard users set things off just by moving. - Fix: Remove any auto-submit or navigation bound to a field receiving focus; focus is not activation. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 3.2.1 On Focus (Level A). - [ ] **9.69 `<n>` of `<n>` `<video>` elements missing `<track kind="captions">`** - Pass: Every audible video has a captions or subtitles track, and embedded players carry real (not auto-generated) captions. - Warn: WCAG Accessibility Audit warns when only muted videos lack a track; ADA Litigation Risk warns when videos or YouTube, Vimeo or Wistia embeds exist and no caption track is found. - Fail: WCAG Accessibility Audit fails as critical when at least one unmuted video has no track. - Numbers and lists the tool uses: track selectors track[kind="captions"], track[kind="subtitles"]; the muted attribute exempts a video (WCAG Accessibility Audit, crit when audibleNoTrack > 0); ADA Litigation Risk video selectors video, iframe[src*="youtube"], iframe[src*="vimeo"], iframe[src*="wistia"], reports no video as information; WCAG Fix Generator sc=1.2.2, lvl=A, impact=critical. - Why: Deaf and hard-of-hearing visitors get nothing from an uncaptioned video, and YouTube auto-captions do not count as compliant captions. - Fix: Add `<track kind="captions" srclang="en" src="captions.vtt" default>` to each `<video>`, and for YouTube or Vimeo embeds upload your own caption file (Rev.com, 3PlayMedia or Otter at about $1 to $3 per minute); captions inside a third-party player cannot be seen by the scanner, so verify by hand. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [ADA Litigation Risk Score](https://jwatte.com/tools/ada-litigation-risk/), [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 1.2.2 Captions (Prerecorded) (Level A); ADA Title III. - [ ] **9.70 `<n>` `<audio>` element(s) present** - Pass: Every audio-only item has a text transcript nearby, and every video-only item has an audio description or transcript. - Numbers and lists the tool uses: WCAG Accessibility Audit reports as information whenever `<audio>` elements exist, since transcripts cannot be detected; WCAG Fix Generator sc=1.2.1, lvl=A, impact=serious. - Why: A podcast player with no transcript gives deaf visitors nothing at all. - Fix: Add a visible link such as `<a href="/transcripts/episode-12">`Transcript`</a>` next to each audio player, and an audio description or full transcript for video-only content. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 1.2.1 Audio-only and Video-only (Prerecorded) (Level A). - [ ] **9.71 `<n>` unmuted autoplay media (WCAG 1.4.2)** - Pass: No video or audio element autoplays, or any that does is muted and can be paused. - Fail: WCAG Quick Checks fails autoplay media without the muted attribute; WCAG Accessibility Audit fails any autoplay video or audio, muted or not, as critical. - Numbers and lists the tool uses: selector video[autoplay], audio[autoplay]; the muted attribute exempts in WCAG Quick Checks; WCAG Accessibility Audit crit:true for any autoplay, which must be pausable and should auto-pause after 5 seconds unless the user opts in; WCAG Fix Generator sc=1.4.2, lvl=A, impact=moderate, autoplay longer than 3 seconds needs a pause, stop or mute control. - Why: Autoplaying sound talks over a screen reader and cannot be stopped by many visitors. - Fix: Remove autoplay, or add the muted attribute and a pause control that works without moving focus. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 1.4.2 Audio Control; SC 2.2.2 Pause, Stop, Hide (Level A). - [ ] **9.72 Pause, stop, hide, animation or moving content** - Pass: Carousels, tickers, animated GIFs and auto-updating feeds that run longer than 5 seconds have a pause control. - Numbers and lists the tool uses: sc=2.2.2; lvl=A; impact=serious; runs more than 5s. - Why: Moving content distracts readers with attention disorders and can hide text before a slow reader finishes it. - Fix: Add a pause button to carousels and tickers, and a pause or frequency control to live-updating content. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 2.2.2 Pause, Stop, Hide (Level A). - [ ] **9.73 Meta refresh redirect under 20 seconds (WCAG 2.2.1)** - Pass: The page has no meta refresh, or WCAG Quick Checks accepts a delay of 20 seconds or more. - Fail: WCAG Quick Checks fails a delay between 1 and 19 seconds; WCAG Accessibility Audit fails any meta refresh as critical regardless of delay. - Numbers and lists the tool uses: WCAG Quick Checks selector meta[http-equiv="refresh" i], parses the seconds before the first ';' and fails when 0 < sec < 20; WCAG Accessibility Audit selector meta[http-equiv="refresh"] (no i flag), parses /^\s*(\d+)\s*(?:;\s*url=)/i and fails any refresh, crit:true. - Why: A page that reloads or jumps on its own timer disorients visitors and can move them before a screen reader finishes. - Fix: Replace the meta refresh with a server 301 or 302 redirect, or give the visitor 20 seconds or more and a way to stop the timer. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/). Standard: WCAG 2.2 SC 2.2.1 Timing Adjustable (Level A); SC 3.2.5. - [ ] **9.74 Timing adjustable, session / form timeouts** - Pass: Auto-logouts, carousel auto-advance and form timeouts can be extended or turned off. - Numbers and lists the tool uses: sc=2.2.1; lvl=A; impact=serious; warn 20s before expiry; real-time content such as sports scores is exempt. - Why: A slow typist or screen-reader user loses a whole form when a session expires without warning. - Fix: Warn 20 seconds before a timeout, offer an extend button, and let visitors disable auto-advance. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 2.2.1 Timing Adjustable (Level A). - [ ] **9.75 Three flashes or below, seizure risk** - Pass: Nothing on the page, including video, ads and loading spinners, flashes more than 3 times per second. - Numbers and lists the tool uses: sc=2.3.1; lvl=A; impact=critical; 3 flashes per second; test tool https://trace.umd.edu/peat/. - Why: Flashing content can trigger seizures in photosensitive visitors. - Fix: Remove or slow any flashing element and test video with the PEAT tool. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 2.3.1 Three Flashes or Below Threshold (Level A). - [ ] **9.76 `<n>` mobile-presentation issue(s), fix to prevent horizontal page scroll + unreadable nav on phones** - Pass: Content reflows at 320 CSS pixels wide with no horizontal scroll, and none of the mobile overflow checks below fire. - Fail: Mega Analyzer renders a fail row (renderChk false) whenever one or more mobile-presentation issues are found, listing each issue as a bullet. - Numbers and lists the tool uses: Mega Analyzer _mobileScaleIssues list: viewport meta missing; viewport blocks zoom (user-scalable=no or maximum-scale=1); viewport caps zoom with maximum-scale below 5; inline width:Npx over 480 with no inline max-width; tables with no horizontal-scroll wrapper (class no-mobile-scroll, table-responsive or scrollable, inline overflow-x auto or scroll or display:block on the table, or a parent with inline overflow-x auto or scroll or class table-responsive, scrollable, table-wrap or table-scroll); iframe, video, embed or object with width attribute over 480 or inline width of 3 or more digits px and no max-width; inline `<style>` rules with grid-template-columns:1fr or repeat(N,1fr) not matched by minmax(0,1fr) or minmax(auto,1fr); mailto or tel links whose text is over 22 characters with no spaces, flagged only when no inline overflow-wrap or word-break rule exists and the page has no link rel=stylesheet; primary nav (header nav, nav[aria-label*=primary or main], nav#mainNav, nav.mainNav) with more than 5 top-level links or buttons outside [role=menu].nav-dropdown.submenu and no toggle button (button[aria-controls], button.nav-toggle, button.hamburger, button.menu-toggle, button[aria-label*=menu or navigation], [class*=hamburger]); WCAG 1.4.4 reflow target 320x256; fix prompt rules: grid 1fr to minmax(0,1fr) plus min-width:0, nav toggle at @media(max-width:880px), width:Npx over 480 becomes width:100%;max-width:Npx, tables get an overflow-x wrapper or the @media(max-width:768px) pattern, retest at 344, 375, 390, 412, 768 and 1024 px; WCAG Fix Generator sc=1.4.10, lvl=AA, impact=serious, test at 320x600, tables and maps excepted. - Why: Horizontal scrolling on a phone hides content off-screen and makes text impossible to read without panning. - Fix: Apply the drop-in CSS html,body{overflow-x:hidden;max-width:100%}img,iframe,video,svg{max-width:100%;height:auto}a[href^="mailto:"],a[href^="tel:"]{overflow-wrap:anywhere;word-break:break-word}@media(max-width:768px){table{display:block;overflow-x:auto;white-space:nowrap}table th,table td{white-space:normal}}, use responsive units (%, vw, rem), keep existing class names, and treat body{overflow-x:hidden;max-width:100vw} inside the mobile media query as containment rather than a fix. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 1.4.4 Resize Text; SC 1.4.10 Reflow (Level AA). - [ ] **9.77 Mobile overflow: inline fixed widths over 480 px** - Pass: No element sets an inline pixel width wider than a phone screen without a max-width. - Warn: WCAG Accessibility Audit warns when 5 or more elements set width or min-width over 400px. - Fail: Mega Analyzer lists any inline width over 480px with no inline max-width as a bullet in the mobile-presentation fail row (renderChk false). - Numbers and lists the tool uses: Mega Analyzer lowercases the inline style then matches /(?:^|;|\s)width\s*:\s*(\d+)\s*px/ with parseInt > 480 and no max-width in the style, any count fires; WCAG Accessibility Audit width > 400 via /(?:^|[;\s])(?:min-)?width\s*:\s*(\d+)px/i after stripping /max-width\s*:\s*[^;]+/gi, skips elements inside an inline overflow(-x): auto or scroll wrapper, trigger count >= 5. - Why: A fixed 600px block forces the whole page wider than the phone and breaks reflow at 320px. - Fix: Replace fixed widths with width:100%; max-width:Npx, percentages, grid or flex. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: WCAG 2.2 SC 1.4.10 Reflow (Level AA). - [ ] **9.78 Mobile overflow: tables without a horizontal-scroll wrapper** - Pass: Every table is wrapped in a scrolling container or is itself scrollable. - Warn: One or more tables have no scroll wrapper (reported as N of M tables). - Numbers and lists the tool uses: a table passes with class /(no-mobile-scroll|table-responsive|scrollable)/i, inline /overflow[\s-]*x\s*:\s*(auto|scroll)/ or /display\s*:\s*block/, a parent with inline overflow-x auto or scroll, or a parent class /(table-responsive|scrollable|table-wrap|table-scroll)/i. - Why: A wide table row stretches the whole page on a phone. - Fix: Wrap each table in a `<div style="overflow-x:auto">`. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: WCAG 2.2 SC 1.4.10 Reflow. - [ ] **9.79 Mobile overflow: iframes/videos/embeds with fixed width** - Pass: No iframe, video, embed or object is wider than 480px without a max-width. - Warn: One or more embeds are wider than 480px with no max-width. - Numbers and lists the tool uses: width attribute > 480 and no max-width, or inline /width\s*:\s*\d{3,}px/ and no max-width. - Why: A fixed-width embed overflows the phone viewport. - Fix: Add max-width:100% to embeds and an aspect-ratio wrapper for video. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: WCAG 2.2 SC 1.4.10 Reflow. - [ ] **9.80 Mobile overflow: CSS grid 1fr min-content trap** - Pass: No inline `<style>` grid uses 1fr or repeat(N,1fr) columns without a matching minmax(0,1fr) or minmax(auto,1fr). - Warn: One or more inline grid rules use the 1fr shorthand with no minmax guard. - Numbers and lists the tool uses: gridTrapPattern /grid-template-columns\s*:\s*(?:repeat\s*$\s*\d+\s*,\s*)?1fr/gi minus minmaxPattern /minmax\s*\(\s*(?:0|auto)\s*,\s*1fr\s*$/gi per style block; only inline styles are scanned because external stylesheets cannot be read. - Why: 1fr is shorthand for minmax(auto,1fr), so one wide child inflates the grid and pushes the page past the viewport. - Fix: Use minmax(0,1fr) for the columns and min-width:0 on the grid items. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **9.81 Mobile overflow: long mailto/tel links without a wrap rule** - Pass: No mailto or tel link has more than 22 unbroken characters, or a wrap rule for them exists, or external stylesheets are present so the rule cannot be ruled out. - Warn: A mailto or tel link exceeds 22 characters with no whitespace, all CSS is inline, and no overflow-wrap or word-break rule targets mailto links. - Numbers and lists the tool uses: text length > 22 and no /\s/; wrap rule regex /a\[href\^=[\"']mailto:[\"']\][^{]*\{[^}]*(?:overflow-wrap|word-break)\s*:/i; skipped when link[rel=stylesheet] is present. - Why: A 30-character email address inside a narrow card widens the whole page on a phone. - Fix: Add a[href^="mailto:"],a[href^="tel:"]{overflow-wrap:anywhere;word-break:break-word}. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **9.82 Mobile overflow: many nav items with no hamburger toggle** - Pass: The primary nav has 5 or fewer top-level items, or a visible toggle button exists in the header. - Warn: The primary nav has more than 5 top-level links or buttons and no toggle. - Numbers and lists the tool uses: primary nav selector: header nav, nav[aria-label*="primary" i], nav[aria-label*="main" i], nav#mainNav, nav.mainNav; items exclude descendants of [role="menu"].nav-dropdown.submenu; toggle selector: button[aria-controls], button.nav-toggle, button.hamburger, button.menu-toggle, button[aria-label*="menu" i], button[aria-label*="navigation" i], [class*="hamburger"]; threshold > 5 items. - Why: At phone widths six or more nav items wrap to several lines or overflow the header. - Fix: Add a `<button class="nav-toggle">` shown at @media(max-width:880px) and collapse the nav into a drawer. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **9.83 No visible help/contact link found** - Pass: A help, contact, support or FAQ link is present and appears in the same relative place on every page. - Warn: No anchor text matches contact, help, support, faq or get help. - Numbers and lists the tool uses: regex /^\s*(contact|help|support|faq|get\s+help)\s*$/i on trimmed anchor text; WCAG Fix Generator sc=3.2.6, lvl=A, impact=moderate. - Why: WCAG 2.2 says that when a site offers help it must sit in a consistent location so visitors do not have to hunt for it. - Fix: Expose a help or contact link (usually in the footer) and keep it in the same relative order on every page that has one. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 3.2.6 Consistent Help. - [ ] **9.84 Consistent navigation, nav order same across pages** - Pass: Main navigation, breadcrumbs and the search box sit in the same place and order on every page. - Numbers and lists the tool uses: sc=3.2.3; lvl=AA; impact=moderate. - Why: Visitors learn the layout once and expect it everywhere, and a nav that moves is disorienting for screen-reader and cognitive-disability users. - Fix: Use one shared header and footer template across the site. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 3.2.3 Consistent Navigation (Level AA). - [ ] **9.85 Consistent identification, same function named consistently** - Pass: The same function uses the same label and icon on every page. - Numbers and lists the tool uses: sc=3.2.4; lvl=AA; impact=moderate. - Why: A button called 'Submit' on one page and 'Send' on another reads as two different actions. - Fix: Standardize labels and icons for repeated actions site-wide. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 3.2.4 Consistent Identification (Level AA). - [ ] **9.86 Multiple ways, site search or sitemap** - Pass: A multi-page site offers at least two ways to find any page. - Numbers and lists the tool uses: sc=2.4.5; lvl=AA; impact=moderate; at least two of: sitemap, search box, table of contents, navigation menu listing all pages; single-page apps exempt. - Why: Visitors who cannot use the main menu need a second route, such as search or a sitemap page. - Fix: Add an HTML sitemap page or a site search alongside the navigation menu. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 2.4.5 Multiple Ways (Level AA). - [ ] **9.87 Language of parts, inline language switches** - Pass: Foreign-language phrases inside body text carry an inline lang attribute. - Numbers and lists the tool uses: sc=3.1.2; lvl=AA; impact=moderate; applies to real phrases, not loan words that are part of English. - Why: A screen reader reads a French phrase with English pronunciation unless the span says otherwise. - Fix: Wrap foreign phrases like a la carte. - Verify: [WCAG Fix Generator](https://jwatte.com/tools/wcag-fix-generator/). Standard: WCAG 2.2 SC 3.1.2 Language of Parts (Level AA). - [ ] **9.88 Flesch-Kincaid grade ~`<n>`** - Pass: Body text reads at grade 11 or below. - Warn: Grade is above 11 and up to 14. - Fail: Grade is above 14. - Numbers and lists the tool uses: only run when word count >= 150; body clone with script, style, nav, header, footer, aside, noscript, form removed; sentences split on /[.!?]+\s+/; syllables per word = count of /[aeiouy]+/ groups after lowercasing, stripping non-letters and a trailing e, minimum 1; grade = 0.39*(words/sentences) + 11.8*(syllables/words) - 15.59, shown to 1 decimal; pass <= 11, warn <= 14, fail > 14; WCAG 3.0 draft targets grade 9 or below for general audiences. - Why: Long sentences and rare words shut out readers with cognitive disabilities and everyone reading in a hurry on a phone. - Fix: Shorten sentences and prefer common words. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/). Standard: WCAG 3.0 draft Clear Words / Readable outcome. - [ ] **9.89 `<n>` duplicate id attribute(s) (WCAG 4.1.1)** - Pass: No id value is used by more than one element. - Warn: Analyzer, WCAG Quick Checks and WCAG Accessibility Audit (for duplicates nothing references yet) report duplicates as warnings. - Fail: Mega Analyzer, Batch Analyzer and Mega Batch fail any duplicate id. - Numbers and lists the tool uses: id count > 1; Mega Analyzer lists the first 10; WCAG Quick Checks lists the first 5; Batch Analyzer weight 5; Mega Batch weight 10; WCAG Fix Generator sc=4.1.1, lvl=A, impact=moderate, validator https://validator.w3.org/. - Why: A duplicated id makes labels, ARIA references and anchor links attach to the wrong element, because the browser silently picks the first one. - Fix: Rename the duplicates so every id on the page is unique, then validate the HTML. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/) and 2 more. Standard: WCAG 2.1 SC 4.1.1 Parsing (retired in WCAG 2.2 but still invalid HTML); SC 1.3.1. - [ ] **9.90 `<n>` duplicate id(s) are referenced and resolve to the wrong element** - Pass: No duplicated id is referenced by a label, an ARIA relationship attribute or an in-page link. - Numbers and lists the tool uses: duplicate = id count > 1; reference sources: label[for]; space-split tokens of aria-labelledby, aria-describedby, aria-controls, aria-owns, aria-details, aria-errormessage, aria-flowto, headers, list, form; decoded fragments of a[href^="#"] and area[href^="#"]; crit:true. - Why: When something points at a duplicated id it lands on the first match, so a label or skip link silently attaches to the wrong element. - Fix: Make every referenced id unique so each label, ARIA relationship and skip link resolves to the intended element. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/). Standard: WCAG 2.2 SC 4.1.2 Name, Role, Value; SC 1.3.1. - [ ] **9.91 prefers-color-scheme light: `<n>`** - Pass: At least one @media rule targets prefers-color-scheme: light. - Numbers and lists the tool uses: regex /@media[^{]*prefers-color-scheme\s*:\s*light/gi over inline styles and the first 5 linked stylesheets; reported as information when the count is 0. - Why: An explicit light-scheme block shows the site handles both schemes on purpose rather than by accident. - Fix: Define light values at :root and override them in the dark media query. - Verify: [User Preference Media Queries Audit](https://jwatte.com/tools/prefers-color-scheme-audit/). Standard: CSS media query prefers-color-scheme. - [ ] **9.92 prefers-contrast: `<n>`** - Pass: At least one @media rule targets prefers-contrast. - Numbers and lists the tool uses: regex /@media[^{]*prefers-contrast/gi over inline styles and the first 5 linked stylesheets; reported as information when the count is 0. - Why: Visitors who ask their system for more contrast get it only if the site listens to the query. - Fix: Add a @media (prefers-contrast: more) block that raises text and border contrast. - Verify: [User Preference Media Queries Audit](https://jwatte.com/tools/prefers-color-scheme-audit/). Standard: CSS media query prefers-contrast. - [ ] **9.93 forced-colors: `<n>`** - Pass: At least one @media rule targets forced-colors. - Numbers and lists the tool uses: regex /@media[^{]*forced-colors/gi over inline styles and the first 5 linked stylesheets; reported as information when the count is 0. - Why: Windows High Contrast mode strips backgrounds, so buttons and cards without borders disappear. - Fix: Test with Windows Contrast Themes and use system colors inside @media (forced-colors: active). - Verify: [User Preference Media Queries Audit](https://jwatte.com/tools/prefers-color-scheme-audit/). Standard: CSS media query forced-colors (Windows High Contrast / Contrast Themes). - [ ] **9.94 prefers-reduced-data: `<n>`** - Pass: At least one @media rule targets prefers-reduced-data. - Numbers and lists the tool uses: regex /@media[^{]*prefers-reduced-data/gi over inline styles and the first 5 linked stylesheets; reported as information when the count is 0. - Why: Visitors on metered connections can ask for lighter pages through this query. - Fix: Serve lighter images and skip non-essential fonts inside @media (prefers-reduced-data: reduce). - Verify: [User Preference Media Queries Audit](https://jwatte.com/tools/prefers-color-scheme-audit/). Standard: CSS media query prefers-reduced-data. - [ ] **9.95 Manual dark toggle: yes / no** - Pass: The CSS contains a class or data-attribute hook for a user-controlled dark theme. - Numbers and lists the tool uses: regex /\.dark\s*[\{,:]|\[data-theme=["']dark["']\]|html\.dark\b/i on the collected CSS; reported as information when it does not match. - Why: A manual toggle lets a visitor override the system scheme for this one site. - Fix: Add a light/dark/system toggle stored in localStorage and set the theme class before render with an inline script to avoid a flash. - Verify: [User Preference Media Queries Audit](https://jwatte.com/tools/prefers-color-scheme-audit/). Standard: CSS media query prefers-color-scheme (user override pattern). - [ ] **9.96 ACCESSIBILITY, WCAG 2.2 Level AA (generated-site build spec)** - Pass: A generated or migrated site ships with a skip link first in the tab order, semantic landmarks, alt (or alt="") plus width and height on every image, ARIA labels on icon-only controls, focus-visible styles, 4.5:1 text and 3:1 large-text and UI contrast, a label for every input, keyboard reachability, a prefers-reduced-motion guard, unique ids, no skipped heading levels, srcset and sizes on images, no mobile-only hidden images or collapsed primary content, and 44x44 px touch targets. - Numbers and lists the tool uses: skip link a.skip-link href=#main first; landmarks main, nav, header, footer, article, section, aside; alt attribute never omitted; width+height on every img; focus-visible >= 2px and >= 3:1; contrast 4.5:1 text, 3:1 large text and UI; touch targets >= 44x44 px; viewport must not include user-scalable=no or maximum-scale=1; placeholder is not a label; The $20 Dollar Agency, Ch 26. - Why: These are the requirements the jwatte.com site generators build to, so a site that meets them starts at WCAG 2.2 AA instead of needing a retrofit. - Fix: Build or migrate the templates against this list, then run the WCAG Accessibility Audit on the output. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/), [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/). Standard: WCAG 2.2 AA (SC 1.1.1, 1.4.3, 1.4.4, 1.4.11, 2.4.1, 2.4.7). - [ ] **9.97 `<n>` element(s) with draggable="true"** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: [draggable="true"] count > 0 reported as information; WCAG 2.2 badge. - Why: Drag-only interactions exclude visitors who cannot make precise pointer movements. - Fix: If the UI relies on drag to reorder or move items, add a non-drag alternative such as arrow buttons or keyboard shortcuts, and verify by hand. - Verify: [WCAG A11y Audit](https://jwatte.com/tools/wcag-accessibility-audit/). Standard: WCAG 2.2 SC 2.5.7 Dragging Movements (Level AA). - [ ] **9.98 State jurisdiction risk lens: California Unruh Act fail, NY / FL / PA warn, other states baseline federal ADA risk** - Pass: - Warn: State is NY (state and NYC Human Rights Law both apply, frequent SMB plaintiff circuit, fix WCAG fails within 30 days of a demand letter), FL (the number 2 filing state, fix fails fast and publish /accessibility/ with a last-updated date) or PA (well-established plaintiff bar). - Fail: State is CA: California treats ADA Title III violations as per-se Unruh Act violations, minimum $4,000 statutory damages per visit, no cure period, plaintiffs can stack visits. - Numbers and lists the tool uses: select#state options: empty, CA, NY, FL, PA, TX, IL, MA, OTHER; CA = fail; NY, FL, PA = warn; any other non-empty value (TX, IL, MA, OTHER) = info '`<state>`, baseline federal ADA risk'; empty = info 'State not specified'. The fail and warn rows count toward the composite ADA litigation risk: HIGH when fails >= 2 or (fails >= 1 and warns >= 3), MODERATE when fails >= 1 or warns >= 2, otherwise LOW. - Why: ADA Title III applies nationwide, and California, New York, Florida and Pennsylvania add state-law exposure and active plaintiff firms on top. - Fix: Select your state for jurisdiction-weighted scoring; in the high-risk states fix the failing checks fast and publish /accessibility/ with a last-updated date. - Verify: [ADA Litigation Risk Score](https://jwatte.com/tools/ada-litigation-risk/). Standard: ADA Title III; California Unruh Civil Rights Act; New York State and NYC Human Rights Law. - [ ] **9.99 Date and time inputs not normalized for WebKit (iPhone Safari and every iPhone browser): `<k>` of `<n>` fields** - Pass: Every date, time, datetime-local, month and week input on the page gets appearance: none or -webkit-appearance: none from a rule that applies at both 375 and 430 px wide, or from its own style attribute. A date field that is never drawn (the hidden attribute, aria-hidden="true", display: none, visibility: hidden, opacity: 0, or 1px by 1px) is left out. The pass row adds a note when nothing sets text-align or a height on ::-webkit-date-and-time-value (iOS then keeps the value centered, and an empty field can shrink to a thin bar, WebKit bug 198959). - Fail: The page's own CSS sets a width, min-width, height, min-height (or inline-size and block-size), padding or border with a value other than 0, none or auto on one or more of those inputs, from a selector that is not a page-wide universal reset (*, html *, body *; a scoped one such as .row > * counts), no appearance: none wins on them at 375 and at 430 px wide, and every stylesheet the HTML links was read. - Numbers and lists the tool uses: input types date, time, datetime-local, month and week outside noscript, the first 40 judged; the cascade resolved by !important, cascade layer (unlayered beats layered for normal declarations, later layers beat earlier ones), specificity, source order and the style attribute; appearance and -webkit-appearance treated as one property; all: unset or all: initial counts as none; a selector list holding a selector the browser rejects is dropped whole, as browsers do; media queries are evaluated at phone widths from 360 to 480 px (min-width, max-width, the range syntax such as (768px <= width <= 1200px), not, and the media type; any other feature counts as matching), and rules for print, (hover: hover), (pointer: fine) or (orientation: landscape) do not count; the media attribute of a link or style element and the media of an @import apply to every rule in that file; a brace inside a quoted string (content: "{", an SVG data URI) does not end a rule; CSS read: inline style blocks (400,000 characters), the first two same-origin stylesheets, and when the page has date or time inputs up to four more (later same-origin files, files on other hosts, one level of @import), 600,000 characters per file; a link with media="print" and an onload that switches media counts as screen CSS, and rel=preload as=style counts as a stylesheet; font, icon and animation libraries (Google Fonts, Bunny Fonts, Typekit, Font Awesome, Bootstrap Icons, Material Icons, Ionicons, Remix Icon, Boxicons, Line Awesome, IcoMoon, animate.css, AOS) are not counted as unread; info row "Date and time inputs: WebKit normalization not verified (`<k>` stylesheets not read)" when no appearance: none is found and a linked file was not read (not fetched, another host, an HTTP error, HTML instead of CSS, an empty reply, cut off at the size limit); info row "Date and time inputs use the native iPhone control, unstyled (`<n>` fields)" when no rule sets a width, padding or border on the field; no row when the page has no date or time input; not scored. - Why: Every browser on an iPhone runs WebKit. On iOS it draws these inputs as buttons and, after the page's CSS, sets box-sizing: content-box, padding of 0.5em a side, a minimum width equal to the longest date in the visitor's language (the width and box-sizing step is skipped only for a fixed pixel width) and a minimum height of 20/11 of the font size, and it centers the value, so a field set to width: 100% runs past its container while desktop Chrome shows nothing wrong. - Fix: input[type="date"], input[type="time"], input[type="datetime-local"], input[type="month"], input[type="week"] { -webkit-appearance: none; appearance: none; box-sizing: border-box; width: 100%; min-width: 0; } plus input::-webkit-date-and-time-value { text-align: left; min-height: 1.5em; margin: 0; }. The native picker still opens on tap. If the fields sit in a flex row or a 1fr grid column, give that cell min-width: 0 as well. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: WebKit source, RenderThemeIOS.mm adjustInputElementButtonStyle and adjustMenuListButtonStyle, RenderTheme.cpp adjustStyle, html.css; CSS Basic User Interface Module Level 4, appearance. - [ ] **9.100 Text fields below 16px: iPhone zooms the page when one is tapped (`<k>` of `<n>` fields)** - Pass: Every text field whose size the tool can resolve comes out at 16px or more at phone width, and at least one could be resolved. The pass row notes any field it could not resolve. - Warn: One or more fields come out under 16px at 375 px or at 430 px wide (each width zooms on the phones of that width), or have no font size of their own (11px on iOS) while the page's CSS sets their width, padding or border, and every stylesheet the HTML links was read. - Numbers and lists the tool uses: input types text, email, tel, url, search, password and number, an input with no type, and textarea; readonly, disabled and tabindex="-1" fields skipped, and so is a field that is hidden (the hidden attribute, aria-hidden="true", display: none or visibility: hidden on it or an ancestor); the first 60 judged; sizes resolved through inheritance, rem against the root (16px when the root sets none), em and %, var() with its fallback, min(), max(), clamp() and single-value calc(), every rule, variable and vw unit resolved at 375 px and at 430 px wide separately, and the keywords (small 13px, medium 16px, large 18px and the rest); ch, ex, multi-term calc() and system font keywords are left unresolved; :focus, :hover and :active rules count, so a focus rule that raises the size to 16px passes; the same phone-width rule filter and the same CSS reach as 9.99; shown only when the viewport meta has width=device-width and does not block zoom; info row "Text field font size not verified: `<k>` fields look below 16px, `<n>` stylesheets not read" when a linked file was not read; advisory (warn), not scored. - Why: WebKit on iPhone zooms the page to 16 divided by the focused field's font size (a 14px field about 1.14 times, an 11px one about 1.45 times), and the page stays zoomed after the keyboard closes. Chrome, Firefox and in-app browsers on iPhone use the same WebKit view. - Fix: Give input, select and textarea a font size of at least 16px at phone width, for example font-size: max(16px, 1rem). Do not add maximum-scale=1 to the viewport tag instead: it also blocks pinch zoom in in-app browsers and on Android. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: WebKit source, WKWebViewIOS.mm _zoomToFocusRect and html.css (the 11px form control font on iOS); WCAG 2.2 SC 1.4.4 Resize Text. ## 10. Security headers, TLS and the email your domain sends A missing header is a finding on every audit, a certificate problem is a warning in the visitor's browser, and a missing DMARC record lets anyone send mail as you. This section is the response headers, the certificate, DNS, and the records that protect your domain's email. **Verify this section with:** [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Trust Signal Surface](https://jwatte.com/tools/trust-signal-surface-audit/), [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/), [SSL Grade](https://jwatte.com/tools/ssl-grade/), [Uptime + Response-Time Diagnostic](https://jwatte.com/tools/uptime-check/), [DIY Uptime Alert Generator](https://jwatte.com/tools/diy-uptime-alert-generator/), [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [Security Headers](https://jwatte.com/tools/security-headers-audit/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/), [Competitor Gap Matrix](https://jwatte.com/tools/competitor-gap-matrix/), [Mega Batch](https://jwatte.com/tools/mega-batch/), [DNS / Email Auth Audit](https://jwatte.com/tools/dns-email-audit/), [Platform Audit](https://jwatte.com/tools/platform-audit/), [Migration Analyzer](https://jwatte.com/tools/migration-analyzer/), [Mega AEO Analyzer](https://jwatte.com/tools/mega-aeo-analyzer/). - [ ] **10.1 Site served over HTTPS** - Pass: The URL being audited starts with https. Each tool tests the entered URL after normalization (a bare domain is given https:// automatically), not the post-redirect final URL; Mega Analyzer retries over http:// when the https fetch fails with status 0 or 502 and then reports that. - Numbers and lists the tool uses: regex /^https:/ on the normalized input in Trust Signal Surface Audit; url.startsWith('https:') in Mega Analyzer; url.startsWith('https') in E-E-A-T Analyzer; a URL typed without a scheme is prefixed with https:// in all three tools before the check runs. - Why: Plain HTTP lets anyone on the network read or alter what your visitors see, and browsers flag the site as not secure. - Fix: Serve the whole site over HTTPS and redirect every http:// URL to its https:// version. - Verify: [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Trust Signal Surface](https://jwatte.com/tools/trust-signal-surface-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **10.2 TLS protocol: `<protocol>`** - Pass: The server negotiates TLS 1.3. - Warn: TLS 1.2 is negotiated in SSL Grade (deducts 10); any protocol older than TLS 1.2 in Uptime Check (warn only). Uptime Check passes both TLS 1.3 and TLS 1.2. - Fail: Any protocol other than TLSv1.3 in Mega Security Analyzer (TLS 1.2 included); any protocol older than TLS 1.2 in SSL Grade (deducts 40). - Numbers and lists the tool uses: exact match TLSv1.3 to pass in Mega Security Analyzer and SSL Grade; TLSv1.3 or TLSv1.2 accepted in Uptime Check; Mega Security Analyzer has no warn tier (pass or fail); SSL Grade deductions 10 for TLS 1.2 and 40 for anything older; Uptime Check warns, never fails, on a legacy protocol; MITRE TA0009 Collection, T1040 Network Sniffing; CWE-319. - Why: Older TLS versions can be downgraded and sniffed, so the connection is not as private as the padlock suggests. - Fix: Enable TLS 1.3 on the server, load balancer or CDN that terminates TLS, and disable TLS 1.0 and 1.1. - Verify: [SSL Grade](https://jwatte.com/tools/ssl-grade/), [Uptime + Response-Time Diagnostic](https://jwatte.com/tools/uptime-check/), [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). Standard: TLS 1.3 RFC 8446; CWE-319; MITRE ATT&CK T1040. - [ ] **10.3 Cipher: `<cipher>`** - Pass: The negotiated cipher suite is an AEAD cipher (AES-GCM or ChaCha20-Poly1305). - Warn: The negotiated cipher is not AEAD (SSL Grade deducts 15). - Numbers and lists the tool uses: cipher name must match /GCM|CHACHA20/i (Mega Security Analyzer, SSL Grade); cipher read from cipher_standard_name or cipher_name; SSL Grade deduction 15; SSL Grade emits no row when the cipher string is empty, Mega Security Analyzer emits the row and warns on an empty cipher. - Why: Non-AEAD ciphers lack built-in integrity checks, which leaves room for tampering attacks. - Fix: Prefer AES-GCM or ChaCha20-Poly1305 suites in the TLS configuration and drop CBC suites. - Verify: [SSL Grade](https://jwatte.com/tools/ssl-grade/), [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). - [ ] **10.4 Certificate expiry: `<n>` days remaining** - Pass: The certificate has 30 or more days of validity left. - Warn: The certificate expires in 14 to 29 days. - Fail: The certificate is expired or expires in under 14 days. - Numbers and lists the tool uses: 30 and 14 days (Mega Security Analyzer, SSL Grade, Uptime Check); expired = days_until_expiry below 0; SSL Grade deductions 50 expired, 15 under 14 days, 5 under 30 days; Uptime Check computes days as floor((valid_to - now) / 86400000); DIY Uptime Alert Generator templates: Gatus fails when [CERTIFICATE_EXPIRATION] is under 48h (alert after failure-threshold 2), Prometheus TLSExpiringSoon fires when probe_ssl_earliest_cert_expiry - time() is under 86400 * 14 seconds for 10m. - Why: An expired certificate blocks the site for every visitor with a full-page browser warning. - Fix: Renew the certificate now and turn on automatic renewal (ACME or your host's managed certificates), then add a monitor that alerts at least 14 days before expiry. - Verify: [SSL Grade](https://jwatte.com/tools/ssl-grade/), [Uptime + Response-Time Diagnostic](https://jwatte.com/tools/uptime-check/), [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/), [DIY Uptime Alert Generator](https://jwatte.com/tools/diy-uptime-alert-generator/). - [ ] **10.5 Certificate chain valid** - Pass: The certificate chain verifies against a trusted root during the handshake. - Warn: Chain not verified (Mega Security Analyzer reports warn with the authorization error). - Fail: Chain not verified (SSL Grade deducts 20). - Numbers and lists the tool uses: tls.standard.authorized must be truthy; SSL Grade deduction 20. - Why: A chain that does not verify produces browser warnings even when the certificate itself is valid. - Fix: Install the full intermediate chain from your certificate authority alongside the leaf certificate. - Verify: [SSL Grade](https://jwatte.com/tools/ssl-grade/), [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). - [ ] **10.6 Key: `<bits>`-bit `<type>`** - Pass: The certificate key is ECDSA or RSA of 2048 bits or more. - Fail: The key is RSA below 2048 bits (SSL Grade deducts 30). - Numbers and lists the tool uses: 2048 bits minimum for RSA; ECDSA of any size passes (/ECDSA/i); SSL Grade deduction 30. - Why: Small RSA keys are within reach of modern attackers and are rejected by current browsers. - Fix: Reissue the certificate with RSA 2048 or larger, or with ECDSA P-256. - Verify: [SSL Grade](https://jwatte.com/tools/ssl-grade/). - [ ] **10.7 HSTS header (Strict-Transport-Security)** - Pass: The Strict-Transport-Security header is present with max-age of at least one year and includeSubDomains. - Warn: Header present but max-age is under 31536000 or includeSubDomains is missing (Analyzer, Security Headers Audit, SSL Grade); header missing entirely in Mega Analyzer, Analyzer, Mega SEO Analyzer and SSL Grade. - Fail: Header missing entirely in Mega Security Analyzer, Security Headers Audit and Batch Analyzer. - Numbers and lists the tool uses: header name strict-transport-security; presence only in Mega Analyzer, Mega SEO Analyzer, Mega Security Analyzer, Batch Analyzer (weight 8); Analyzer requires max-age >= 31536000 and includeSubDomains (regexes /max-age=(\d+)/i, /includeSubDomains/i, /preload/i); Security Headers Audit expects /max-age=\d+/ and warns without /includeSubDomains/i, preload eligible when max-age >= 31536000 (weight 15); SSL Grade parses /max-age=(\d+)/i and deducts 5 under 31536000 and 10 when missing; recommended value max-age=63072000; includeSubDomains; preload (Mega Analyzer, Analyzer) or max-age=31536000; includeSubDomains; preload (Mega Security Analyzer, Security Headers Audit, SSL Grade, Single-Site Generator); MITRE TA0009, T1557; CWE-319. - Why: HSTS tells browsers to always use HTTPS, which blocks downgrade attacks and removes the http to https redirect hop. - Fix: Add Strict-Transport-Security: max-age=31536000; includeSubDomains; preload at the host or CDN layer (netlify.toml, vercel.json, Cloudflare _headers.htaccess or nginx add_header), confirm there is no mixed content or plain-HTTP entry point first, and only submit to hstspreload.org once you are sure, because preload is hard to undo. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Security Headers](https://jwatte.com/tools/security-headers-audit/), [SSL Grade](https://jwatte.com/tools/ssl-grade/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/) and 3 more. Standard: HSTS RFC 6797; CWE-319; MITRE ATT&CK T1557. - [ ] **10.8 Content-Security-Policy header present** - Pass: A Content-Security-Policy is delivered as a response header (or, in Analyzer, as a meta http-equiv tag). - Warn: No CSP found (Mega Analyzer, Analyzer, Mega SEO Analyzer, Mega Security Analyzer). - Fail: No CSP found (Security Headers Audit, Batch Analyzer). - Numbers and lists the tool uses: header names content-security-policy and content-security-policy-report-only; Analyzer also accepts meta[http-equiv="Content-Security-Policy"]; Security Headers Audit weight 15; Batch Analyzer weight 8; MITRE TA0001, T1190; CWE-79; baseline policy emitted by Security Headers Audit: default-src 'self'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; script-src 'self'; font-src 'self' data:; connect-src 'self' https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self'; Single-Site Generator locked mode: default-src self; base-uri self; form-action self; frame-ancestors none; object-src none; img-src self data:; style-src self; script-src self; connect-src self, with self-inline adding style-src unsafe-inline and custom adding only exact analytics, font and CDN origins. - Why: A CSP is the strongest defense against cross-site scripting because it limits which scripts and resources the browser will run on your pages. - Fix: Add a Content-Security-Policy header that at minimum sets default-src, script-src and frame-ancestors, built from the third-party scripts your site actually uses, and stage it in report-only mode first because a strict policy can break embeds and inline scripts. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Security Headers](https://jwatte.com/tools/security-headers-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/) and 2 more. Standard: CSP Level 3 (W3C); CWE-79; MITRE ATT&CK T1190. - [ ] **10.9 Content-Security-Policy quality: <strict-dynamic / nonce or hash / unsafe-inline / basic>** - Pass: Mega Security Analyzer: the policy is enforced (not report-only), has no 'unsafe-eval', no bare * in script-src or default-src, and any 'unsafe-inline' is paired with a nonce, hash or 'strict-dynamic' (a plain policy with none of these also passes). Mega SEO Analyzer: the enforced policy contains a nonce, hash or 'strict-dynamic'. - Warn: The policy is report-only, allows 'unsafe-inline' without a nonce, hash or 'strict-dynamic', allows 'unsafe-eval', or has a bare * in script-src or default-src. - Numbers and lists the tool uses: nonce or hash regex /'nonce-|'sha(256|384|512)-/i; strict-dynamic regex /['"]strict-dynamic['"]/i; unsafe-inline /'unsafe-inline'/i; unsafe-eval /'unsafe-eval'/i (Analyzer warns on /unsafe-eval/i alone); wildcard test /(^|\s)\*(\s|$)/ on the value of /(?:^|;)\s*(?:script-src|default-src)\s+([^;]*)/gi; report-only header without an enforced header counts as weak; Security Headers Audit warns on /unsafe-inline|unsafe-eval/ (score 70 percent of weight 15); Mega SEO Analyzer reports a policy with none of these as basic (info); only evaluated when a CSP exists. - Why: A policy that allows unsafe-inline or unsafe-eval scores like a real CSP but leaves inline script injection wide open. - Fix: Enforce the policy rather than report-only, replace 'unsafe-inline' with nonces or hashes plus 'strict-dynamic', remove 'unsafe-eval', and remove bare * from script-src and default-src. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Security Headers](https://jwatte.com/tools/security-headers-audit/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). Standard: CSP Level 3 (W3C); CWE-79. - [ ] **10.10 CSP includes default-src** - Pass: The policy contains a default-src directive. - Warn: The policy has no default-src directive. - Numbers and lists the tool uses: regex /default-src/i on the CSP string; only evaluated when a CSP exists. - Why: Without default-src, any resource type you did not name explicitly has no restriction at all. - Fix: Add default-src 'self' as the baseline and then loosen specific directives as needed. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **10.11 CSP script-src covers all external scripts** - Pass: Every external script host on the page is allowed by script-src (or default-src). - Warn: One or more external script origins are not allow-listed (lists up to 5 hosts). - Numbers and lists the tool uses: directive regex (?:^|;)\s*`<directive>`\b([^;]*); 'none' denies, * allows, 'self' and other quoted tokens are skipped, scheme is stripped, *.example.com matches by suffix, a bare https: or http: token allows all hosts on that scheme; only evaluated when script-src or default-src exists and the page has at least one external script. - Why: Scripts that the policy does not allow are silently blocked in strict browsers, so features break without an obvious error. - Fix: Add each external script origin the page uses to script-src. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **10.12 Clickjacking defense (X-Frame-Options or CSP frame-ancestors)** - Pass: An X-Frame-Options header is present (any value in Mega Analyzer, Analyzer, Mega Security Analyzer and Batch Analyzer; DENY or SAMEORIGIN in Security Headers Audit), or the CSP contains frame-ancestors (accepted by Mega Analyzer on the enforced header and by Mega Security Analyzer on the enforced or report-only header; Analyzer, Security Headers Audit and Batch Analyzer do not credit frame-ancestors). - Warn: Neither is set (Mega Analyzer, Analyzer); X-Frame-Options present with a value other than DENY or SAMEORIGIN (Security Headers Audit). - Fail: Neither is set (Mega Security Analyzer, Security Headers Audit, Batch Analyzer). - Numbers and lists the tool uses: header name x-frame-options; frame-ancestors regex /frame-ancestors/i on the enforced CSP (Mega Analyzer) or the enforced or report-only CSP (Mega Security Analyzer); Analyzer also accepts meta http-equiv="x-frame-options" and does not read frame-ancestors; Security Headers Audit expects /DENY|SAMEORIGIN/i (weight 8, other values warn at 40 percent); Batch Analyzer weight 5; recommended SAMEORIGIN (Security Headers Audit generated config) or DENY (Single-Site Generator, Site Migration Generator, Monoclone Generator); MITRE TA0001; CWE-1021. - Why: Without a framing restriction another site can load your page inside an invisible frame and trick visitors into clicking things they cannot see. - Fix: Add X-Frame-Options: SAMEORIGIN (or DENY) or a CSP frame-ancestors directive at the host or CDN layer. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Security Headers](https://jwatte.com/tools/security-headers-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/) and 1 more. Standard: RFC 7034; CSP frame-ancestors; CWE-1021; MITRE ATT&CK TA0001. - [ ] **10.13 X-Content-Type-Options: nosniff** - Pass: The X-Content-Type-Options header is present with the value nosniff. - Warn: Header missing (Mega Analyzer, Analyzer, Mega SEO Analyzer, Mega Security Analyzer); header present without nosniff (Security Headers Audit). - Fail: Header missing (Security Headers Audit, Batch Analyzer). - Numbers and lists the tool uses: header name x-content-type-options; value regex /nosniff/i (Mega Analyzer, Analyzer, Security Headers Audit); presence only in Mega SEO Analyzer, Mega Security Analyzer and Batch Analyzer (weight 5); Analyzer also accepts meta http-equiv; Security Headers Audit weight 5; CWE-16. - Why: It stops browsers from guessing a file type, which blocks a class of attacks where an upload is treated as a script. - Fix: Add X-Content-Type-Options: nosniff at the host or CDN layer. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Security Headers](https://jwatte.com/tools/security-headers-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/) and 2 more. Standard: X-Content-Type-Options (WHATWG Fetch); CWE-16. - [ ] **10.14 Referrer-Policy set: `<value>`** - Pass: A Referrer-Policy header (or meta name=referrer in Analyzer) is present and does not use a leaky value. - Warn: Header missing (Mega Analyzer, Analyzer, Mega SEO Analyzer, Mega Security Analyzer); header present with unsafe-url or no-referrer-when-downgrade (Security Headers Audit). - Fail: Header missing (Security Headers Audit, Batch Analyzer). - Numbers and lists the tool uses: header name referrer-policy; Analyzer also accepts meta[name="referrer"]; Security Headers Audit warns on /unsafe-url|no-referrer-when-downgrade/i (weight 5); Batch Analyzer weight 5; recommended value strict-origin-when-cross-origin (Mega Analyzer, Analyzer, Mega Security Analyzer, Security Headers Audit, Single-Site Generator); Single-Site Generator Cloudflare block allows no-referrer as an alternative. - Why: It controls how much of your URL is sent to other sites when visitors click away, which protects private page paths and query strings. - Fix: Add Referrer-Policy: strict-origin-when-cross-origin at the host or CDN layer, or as a meta name=referrer tag. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Security Headers](https://jwatte.com/tools/security-headers-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/) and 2 more. Standard: Referrer Policy (W3C). - [ ] **10.15 Permissions-Policy header set** - Pass: A Permissions-Policy (or legacy Feature-Policy) header is present and does not grant camera, microphone, geolocation, payment or usb to all origins. - Warn: Header missing (Mega Analyzer, Analyzer, Mega SEO Analyzer); header present but grants a sensitive feature to * (Mega Security Analyzer). - Fail: Header missing (Security Headers Audit, Batch Analyzer). - Numbers and lists the tool uses: header names permissions-policy and feature-policy (Mega SEO Analyzer checks permissions-policy only; Analyzer line 2211 checks permissions-policy or meta http-equiv="permissions-policy", line 2807 adds feature-policy); Mega Security Analyzer open-feature list camera, microphone, geolocation, payment, usb with per-feature regex `<feature>`\s*=\s*\*, missing header is info; Security Headers Audit weight 5; Batch Analyzer weight 4; recommended value camera=(), microphone=(), geolocation=() (Mega Analyzer, Analyzer, Security Headers Audit missing message, Monoclone Generator), geolocation=(), microphone=(), camera=(), interest-cohort=(), payment=(), usb=() (Security Headers Audit generated config), or camera=(), microphone=(), geolocation=(), interest-cohort=() (Single-Site Generator, Site Migration Generator). - Why: It switches off browser features like camera, microphone and location by default so an injected script cannot use them. - Fix: Add Permissions-Policy: camera=(), microphone=(), geolocation=() at the host or CDN layer and scope any feature you do need to self. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Security Headers](https://jwatte.com/tools/security-headers-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/) and 2 more. Standard: Permissions Policy (W3C). - [ ] **10.16 Cross-Origin-Opener-Policy: `<value>`** - Pass: The Cross-Origin-Opener-Policy header is present with same-origin. - Warn: Header present with unsafe-none (Mega Security Analyzer) or any value other than same-origin (Security Headers Audit). - Fail: Header missing (Security Headers Audit); missing is info in Mega SEO Analyzer and Mega Security Analyzer. - Numbers and lists the tool uses: header name cross-origin-opener-policy; Mega Security Analyzer warns on /unsafe-none/i; Security Headers Audit expects /same-origin/i (weight 4); recommended value same-origin. - Why: It isolates your pages from windows that opened them, which closes a channel other sites can use to poke at your page. - Fix: Add Cross-Origin-Opener-Policy: same-origin at the host or CDN layer. - Verify: [Security Headers](https://jwatte.com/tools/security-headers-audit/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). - [ ] **10.17 Cross-Origin-Embedder-Policy: `<value>`** - Pass: The Cross-Origin-Embedder-Policy header is present with require-corp or credentialless. - Warn: Header present with another value (Security Headers Audit). - Fail: Header missing (Security Headers Audit); missing is info in Mega SEO Analyzer, which only reports it when COOP or COEP is present. - Numbers and lists the tool uses: header name cross-origin-embedder-policy; Security Headers Audit expects /require-corp|credentialless/i (weight 3); Mega SEO Analyzer gate coop || coep; generated config value credentialless. - Why: Together with COOP it gives the page cross-origin isolation, which some powerful browser features require. - Fix: Add Cross-Origin-Embedder-Policy: credentialless (or require-corp if you control every embedded resource) alongside COOP. - Verify: [Security Headers](https://jwatte.com/tools/security-headers-audit/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). - [ ] **10.18 Cross-Origin-Resource-Policy: `<value>`** - Pass: The Cross-Origin-Resource-Policy header is present with same-origin, same-site or cross-origin. - Warn: Header present with an unrecognized value (Security Headers Audit). - Fail: Header missing (Security Headers Audit); missing is info in Mega Security Analyzer. - Numbers and lists the tool uses: header name cross-origin-resource-policy; Security Headers Audit expects /same-origin|same-site|cross-origin/i (weight 3); recommended same-origin (Mega Security Analyzer, Single-Site Generator) or same-site (Security Headers Audit generated config). - Why: It limits which other sites may load your files directly, which keeps your assets from being pulled into someone else's page. - Fix: Add Cross-Origin-Resource-Policy: same-site (or same-origin) at the host or CDN layer. - Verify: [Security Headers](https://jwatte.com/tools/security-headers-audit/), [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). - [ ] **10.19 Security header set scored against competitors** - Pass: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, Referrer-Policy and Permissions-Policy are all present on your page, so the Competitor Gap Matrix Security dimension scores 100. - Fail: A competitor's Security dimension is higher than yours; the Competitor Gap Matrix lists it as a gap row with the point difference. - Numbers and lists the tool uses: Competitor Gap Matrix Security dimension = round(100 * present / 5) over strict-transport-security, content-security-policy, x-content-type-options, referrer-policy, permissions-policy (X-Frame-Options is not scored); Analyzer AI prompt inventory lists HTTPS, HSTS value, CSP source (header or meta) with the first 80 chars, Permissions-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy value, SRI count and mixed content count as Detected or NOT FOUND without scoring them; Analyzer scaffold prompt asks for HSTS with preload, Content-Security-Policy, X-Frame-Options DENY, X-Content-Type-Options nosniff, Referrer-Policy strict-origin-when-cross-origin, Permissions-Policy; Single-Site Generator and Site Migration Generator scaffolds emit Strict-Transport-Security max-age=31536000; includeSubDomains; preload, Content-Security-Policy default-src 'self'; script-src 'self' plus explicit external origins only; object-src 'none'; base-uri 'self'; frame-ancestors 'none', X-Frame-Options DENY, X-Content-Type-Options nosniff, Referrer-Policy strict-origin-when-cross-origin, Permissions-Policy camera=(), microphone=(), geolocation=(), interest-cohort=(); Single-Site Generator Cloudflare public/_headers block adds Cross-Origin-Opener-Policy same-origin, Cross-Origin-Resource-Policy same-origin, /api/* X-Robots-Tag noindex plus Cache-Control no-store, and SSL mode Full (Strict); Monoclone Generator writes [[headers]] for = "/*" into dist/<site.id>/netlify.toml with publish = "." carrying only X-Frame-Options DENY, X-Content-Type-Options nosniff, Referrer-Policy strict-origin-when-cross-origin and Permissions-Policy camera=(), microphone=(), geolocation=(); host equivalents named by Monoclone Generator: netlify.toml, vercel.json or next.config.js headers(), Cloudflare _headers, Amplify customHeaders in amplify.yml, Azure staticwebapp.config.json, Firebase firebase.json, Render dashboard or _headers; Security Headers Audit emitters cover Netlify and Cloudflare Pages _headers, a Cloudflare Worker, vercel.json, nginx add_header, Apache .htaccess, Caddy and a CloudFront response-headers policy. - Why: Headers are set at the host or CDN layer, not in the HTML, so a site can look fine in the source and still ship none of them. - Fix: Emit the whole header block from the hosting config (netlify.toml, vercel.json, Cloudflare _headers.htaccess or nginx) for every path, then confirm in production with curl -I because a staging build can differ. - Verify: [Competitor Gap Matrix](https://jwatte.com/tools/competitor-gap-matrix/). Standard: RFC 6797; CSP Level 3; W3C Subresource Integrity. - [ ] **10.20 security.txt (/.well-known/security.txt) served** - Pass: A file is served at /.well-known/security.txt (HTTP 2xx in Mega Security Analyzer; fetched content in the other tools). No tool verifies that it contains a Contact: line. - Warn: File missing (Mega Analyzer, Batch Analyzer, Mega Batch); platform-limited hosts downgrade to info in Mega Analyzer. - Fail: File missing (E-E-A-T Analyzer); missing is info in Analyzer and Mega Security Analyzer. - Numbers and lists the tool uses: path /.well-known/security.txt; Mega Security Analyzer defines a /^Contact:/im content pattern for this probe but passes on a 2xx status alone; Single-Site Generator scaffold fields Contact, Expires, Policy, Preferred-Languages, Canonical, served as application/json or text/plain (not text/html). - Why: It gives security researchers a published way to report a problem to you instead of posting it publicly. - Fix: Publish /.well-known/security.txt with Contact: and Expires: lines. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/) and 2 more. Standard: RFC 9116. - [ ] **10.21 No secret, state or backup files reachable at the web root** - Pass: None of the probed secret-bearing paths returns a 2xx response with matching content. - Fail: Any probed path returns 200 to 299 and its body matches the content signature (existence alone for the binary backup.zip). - Numbers and lists the tool uses: /.env matches /^[A-Z_][A-Z0-9_]*=/m; /.git/HEAD matches /^ref:\s+refs\//; /terraform.tfstate matches /"terraform_version"|"resources":\s*\[/; /terraform.tfstate.backup matches /"terraform_version"/; /backup.sql and /db.sql match /CREATE TABLE|INSERT INTO/i; /backup.zip existence only (binary); /web.config matches /`<configuration>`|`<connectionStrings>`/i; /appsettings.json matches /"Logging"|"ConnectionStrings"/; probe timeout 6000 ms; signal file_exposure. - Why: These files hold passwords, API keys, database dumps and cloud credentials, and anyone who guesses the URL can download them. - Fix: Remove each file from the publish directory or block it at the server, then rotate every secret it contained. - Verify: [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). - [ ] **10.22 No dependency manifests or lockfiles reachable at the web root** - Pass: None of /package.json, /package-lock.json, /yarn.lock or /composer.json returns a 2xx response with matching content. - Numbers and lists the tool uses: /package.json matches /"dependencies"\s*:/; /package-lock.json matches /"lockfileVersion"\s*:/; /yarn.lock matches /# yarn lockfile/; /composer.json matches /"require"\s*:/; signal file_exposure. - Why: A public manifest tells an attacker exactly which libraries and versions you run, which makes finding a known hole much faster. - Fix: Move manifests and lockfiles out of the publish directory or block them at the server. - Verify: [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). - [ ] **10.23 No build, deploy, CI or container config reachable at the web root** - Pass: None of the probed build or CI config paths returns a 2xx response with matching content. - Numbers and lists the tool uses: /netlify.toml matches /\[\[?(build|headers|redirects|functions)/; /deploy-site.mjs matches /import |require\(|netlify deploy/; /eleventy.config.js matches /module\.exports|export default|eleventyConfig/; /vite.config.js matches /defineConfig|export default/; /next.config.js matches /module\.exports|nextConfig/; /CLAUDE.md matches /^#\s|##\s/m; /.gitlab-ci.yml matches /stages:|variables:|script:/; /.github/workflows/deploy.yml matches /name:|on:|jobs:/; /.travis.yml matches /language:|script:/; /.circleci/config.yml matches /version:\s*2/; /Dockerfile matches /^FROM\s+/im; /docker-compose.yml and /docker-compose.yaml match /services:|version:\s*["']\d/; signal file_exposure. - Why: On a static host the publish directory is the web root, so build scripts, CI files and project notes left next to index.html are served to anyone, and they reveal secret names, redirects and site structure. - Fix: Keep build and CI files out of the publish directory (or block them at the server) and list your own publish root for any site-specific script names. - Verify: [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). - [ ] **10.24 No debug pages, error logs or OS metadata reachable at the web root** - Pass: None of /phpinfo.php, /error_log or /.DS_Store is served. - Numbers and lists the tool uses: /phpinfo.php matches /PHP Version|phpinfo/; /error_log matches /PHP (Warning|Error|Fatal|Notice):|\[error\]/i; /.DS_Store existence only (binary, 2xx status); signal file_exposure. - Why: Debug pages and logs leak server paths, versions and stack details, and .DS_Store leaks directory listings. - Fix: Delete these files from the web root and block them at the server. - Verify: [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). - [ ] **10.25 Exposed package.json declares `<n>` dependency range(s) that permit known-vulnerable releases** - Pass: No publicly served package.json entry has a version range whose lower bound is below a known security floor. - Warn: A served package.json lists a dependency or devDependency whose first version number is below the library's security floor (first 10 flagged entries listed). - Numbers and lists the tool uses: only runs when /package.json returns 200 to 299 with parseable JSON; version parsed with /(\d+\.\d+(?:\.\d+)?)/ and compared to the LIB_DB floor for that key (floors listed under the JavaScript library check); CWE-1104. - Why: The declared range may allow a vulnerable release to be installed, and the file itself should not be public in the first place. - Fix: Raise each minimum version above the floor and, separately, move package.json out of the web root. - Verify: [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). Standard: CWE-1104. - [ ] **10.26 Server / X-Powered-By header does not disclose software versions** - Pass: Server and X-Powered-By headers are absent or carry no product version or framework name. - Warn: Server names Apache, nginx or Microsoft-IIS with a version number, or names Oracle, IBM WebSphere or IBM HTTP Server; X-Powered-By is present (Express or any other value); X-AspNet-Version or X-AspNetMvc-Version is present alongside a Microsoft-IIS Server header. - Numbers and lists the tool uses: Apache /apache/i with version /Apache\/?(\d+\.\d+(?:\.\d+)?)/i; nginx /nginx/i with /nginx\/(\d+\.\d+(?:\.\d+)?)/i; IIS /microsoft-iis/i with /Microsoft-IIS\/(\d+\.\d+)/i; Oracle /oracle/i on Server or headers x-oracle-dms-ecid, x-oracle-dms-rid; IBM /websphere|ibm.http/i; Express /express/i on x-powered-by; headers x-aspnet-version, x-aspnetmvc-version checked only when Server matches /microsoft-iis/i; a hidden version renders info (Apache detected (version hidden, good), nginx (version hidden), IIS detected); distribution names in an Apache Server header render info: /red hat|rhel/i, /ubuntu/i, /debian/i; Caddy /caddy/i renders pass (no version disclosure by default); any non-empty Server or X-Powered-By is listed as info (Server / X-Powered-By header leak, CWE-200); Uptime Check shows Server as info; CWE-200. - Why: A version string lets an attacker look up the exact known holes for that release instead of guessing. - Fix: Hide the version at the server: ServerTokens Prod and ServerSignature Off (Apache, IBM HTTP Server), server_tokens off (nginx), removeServerHeader in web.config or the URL Rewrite module (IIS), app.disable('x-powered-by') (Express), `<httpRuntime enableVersionHeader="false" />` and MvcHandler.DisableMvcResponseHeader = true (ASP.NET), or strip Server, X-Powered-By and X-Oracle-* headers at the reverse fetch. - Verify: [Uptime + Response-Time Diagnostic](https://jwatte.com/tools/uptime-check/), [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). Standard: CWE-200. - [ ] **10.27 Server operating system is still under security support** - Pass: The Server header does not fingerprint an end-of-life operating system. - Warn: Server header names CentOS (end of life December 2021). - Fail: Server header shows Microsoft-IIS/8.5 (Windows Server 2012 R2) or Microsoft-IIS/8.0 (Windows Server 2012), both out of extended support since October 10, 2023. - Numbers and lists the tool uses: /centos/i on an Apache Server header; /Microsoft-IIS\/8\.5/ and /Microsoft-IIS\/8\.0/; /Microsoft-IIS\/10\.0/ renders info (Windows Server 2016, 2019, 2022 or 2025; Server 2019 mainstream support ended January 9, 2024 with extended support through January 9, 2029; Server 2022 mainstream support ends October 13, 2026); RHEL patching cadence is quarterly. - Why: An operating system past end of life gets no security patches, so every new hole stays open. - Fix: Migrate CentOS to Rocky Linux, AlmaLinux or RHEL, and Windows Server 2012 or 2012 R2 to Server 2022 or 2025. - Verify: [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). - [ ] **10.28 SPF record** - Pass: One TXT record at the apex starts with v=spf1, ends in -all or ~all, and needs 8 or fewer DNS lookups. - Warn: The record ends in ?all, or needs 9 or 10 lookups (DNS Email Audit). - Fail: No v=spf1 TXT record at the apex, no all mechanism, +all, or more than 10 lookups. - Numbers and lists the tool uses: detection regex /^v=spf1\b/i on TXT answers; policy regex /[~\-+?]all\b/; lookup mechanisms /\b(include|a|mx|ptr|exists|redirect)\s*[:=]\s*([^\s"]+)/gi counted recursively through include and redirect to depth 4; warn above 8 lookups, fail above 10; BEC posture points: -all 20, ~all 15, ?all or +all 5, missing 0 (max 20); Mega Security Analyzer checks presence only (fail when missing, CWE-290); DNS Records Generator emits v=spf1 `<provider include>` -all with TTL 3600, or v=spf1 -all when the provider is custom (no include); DNS Email Audit recommends v=spf1 -all for a non-sending domain; Cloudflare Workers sending alert mail through MailChannels need v=spf1 a mx include:relay.mailchannels.net ~all (DIY Uptime Alert Generator). - Why: SPF names the servers allowed to send mail as your domain, so without it anyone can send invoices or password resets that look like they came from you. - Fix: Publish one TXT record such as v=spf1 include:_spf.google.com ~all adapted to your mail provider (or v=spf1 -all for a domain that never sends), change +all or ?all to -all or ~all, and consolidate or flatten includes when the lookup count nears 10. - Verify: [DNS / Email Auth Audit](https://jwatte.com/tools/dns-email-audit/), [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). Standard: SPF RFC 7208 (section 4.6.4, 10-lookup limit); CWE-290. - [ ] **10.29 DMARC record** - Pass: A TXT record at _dmarc.`<domain>` starts with v=DMARC1 and sets p=reject without t=y, or p=quarantine with adkim=s and aspf=s. - Warn: The record carries t=y, sets p=quarantine without strict alignment, or sets p=none (monitor only). - Fail: No v=DMARC1 record at _dmarc.`<domain>`, or a p= value other than none, quarantine or reject. - Numbers and lists the tool uses: record regex /^v=dmarc1\b/i; p= /\bp=(none|quarantine|reject)/i; sp= /\bsp=(none|quarantine|reject)/i; np= /\bnp=(none|quarantine|reject)/i; psd= /\bpsd=([ynu])\b/i; testing /\bt=y\b/i; adkim /\badkim=s\b/i; aspf /\baspf=s\b/i; BEC posture points: p=reject without t=y 35, p=quarantine with adkim=s and aspf=s 30, p=quarantine without strict alignment 20, p=none or any record with t=y 5, missing 0 (max 35); Mega Security Analyzer checks presence only with starter value v=DMARC1; p=none; rua=... (CWE-290); DNS Records Generator emits v=DMARC1; p=`<none or reject>`; sp=`<same>`; rua=mailto:`<address>`; ruf=mailto:`<same>`; fo=1; adkim=s; aspf=s; pct=100 at _dmarc with TTL 3600; rollout order: MX, SPF and DKIM first (wait 30 to 60 minutes), test to a Gmail inbox for SPF=PASS and DKIM=PASS, DMARC p=none for 2 to 4 weeks of rua reports, then p=quarantine for another 2 weeks, then p=reject. - Why: DMARC tells receiving mail servers what to do with mail that fails SPF and DKIM, and at p=none it only watches, so forged mail still lands. - Fix: Start with v=DMARC1; p=none; rua=mailto:dmarc@`<domain>` on a sending domain, use t=y rather than pct to test, and move to p=quarantine with adkim=s and aspf=s, then p=reject, once reports show every legitimate sender aligned; a non-sending domain goes straight to v=DMARC1; p=reject; sp=reject; np=reject; adkim=s; aspf=s. - Verify: [DNS / Email Auth Audit](https://jwatte.com/tools/dns-email-audit/), [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). Standard: DMARCbis (2026 revision replacing RFC 7489); CWE-290. - [ ] **10.30 DKIM selector found** - Pass: At least one TXT record matching v=DKIM1 exists at `<selector>`._domainkey.`<domain>` across the common selector list plus any selector you supply. - Warn: No DKIM record on any scanned selector and the domain is not classified as non-sending. - Numbers and lists the tool uses: DKIM regex /v=dkim1/i on TXT answers; typed selector normalized with .replace(/\._domainkey.*$/,'').toLowerCase(); COMMON_SELECTORS: default, google, k1, k2, k3, s1, s2, s3, s4, selector1, selector2, dkim, dkim1, dkim2, dkim3, dkim4, dkim5, s5, s6, s7, s8, s9, s10, amazonses, scph0820, scph0123, scph1024, mandrill, everlytic, mailgun, mg, smtpapi, sendgrid, em, em1, em2, em3, pm, pmsvc1, pmsvc2, mailjet, sparkpost, zoho, zm1, zm2, protonmail1, protonmail2, protonmail3, fm1, fm2, fm3, sig1, mail, smtp, mxvault, sm, mta, relay, server, auth, postfix, exim, cm, `<currentYear>`, `<currentYear-1>`, `<currentYear-2>`, s`<currentYear>`, s`<currentYear-1>`, one, two, main, key1, key2, private, public, _domainkey; Mega Security Analyzer scans about 24 common selectors and names Postmark pm, SendGrid s1 and em, Mailjet mailjet as non-standard; no hits on a non-sending domain renders info (not applicable); a typed selector that does not resolve while others do renders info; DNS Records Generator emits `<selector>`._domainkey TXT v=DKIM1; k=rsa; p=`<key from provider dashboard>` with provider selectors google, selector1 (Microsoft 365), fm1, zoho, protonmail, k1 (Mailgun), s1 (SendGrid), 20240101pm (Postmark), abc123._domainkey (SES), resend. - Why: DKIM signs your outgoing mail so receivers can prove it was not altered, and a missing signature hurts both deliverability and spoofing resistance. - Fix: Enable DKIM in your mail provider's admin console and publish the record it gives you at `<selector>`._domainkey; if your provider uses a custom or date-stamped selector, re-run the audit with that selector instead of creating a record at the wrong name. - Verify: [DNS / Email Auth Audit](https://jwatte.com/tools/dns-email-audit/), [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). Standard: DKIM RFC 6376. - [ ] **10.31 DKIM key strength** - Pass: The first DKIM key found is k=ed25519, or k=rsa with an estimated 2048 bits or more. - Warn: K=rsa between 1024 and 2047 bits, or an algorithm other than rsa or ed25519. - Fail: K=rsa below 1024 bits. - Numbers and lists the tool uses: evaluated on the first DKIM hit only; kTag regex /\bk=([a-z0-9]+)/i default rsa; p= regex /\bp=([A-Za-z0-9+\/=]+)/; algorithm test /^(rsa|ed25519)$/i; bits estimated from the whitespace-stripped p= length: >= 680 chars gives 4096, >= 370 gives 2048, >= 190 gives 1024, > 0 gives 512; BEC posture points: ed25519 or RSA >= 2048 20, RSA 1024 to 2047 15, RSA under 1024 5, no DKIM 0 (max 20). - Why: A short RSA key can be forged, which lets an attacker sign mail as you. - Fix: Rotate to a 2048-bit RSA or Ed25519 DKIM key at your mail provider and publish the new record. - Verify: [DNS / Email Auth Audit](https://jwatte.com/tools/dns-email-audit/). - [ ] **10.32 MX records** - Pass: The apex has at least one MX record. - Warn: No MX record and the domain is not classified as non-sending. - Numbers and lists the tool uses: MX query on the apex; first 3 records shown; no MX on a non-sending domain renders info; DNS Records Generator presets: google 1 smtp.google.com; microsoft365 0 `<domain-with-dashes>`.mail.protection.outlook.com; fastmail 10 in1-smtp.messagingengine.com and 20 in2-smtp.messagingengine.com; zoho 10 mx.zoho.com, 20 mx2.zoho.com, 50 mx3.zoho.com; protonmail 10 mail.protonmail.ch and 20 mailsec.protonmail.ch; TTL 3600. - Why: Without MX records the domain cannot receive email, which is fine for a web-only domain but a silent outage for one that should. - Fix: Add the MX records your mail provider specifies if the domain is meant to receive mail. - Verify: [DNS / Email Auth Audit](https://jwatte.com/tools/dns-email-audit/). - [ ] **10.33 Parked / non-sending domain locked against spoofing** - Pass: A domain with no MX, no DKIM hit and no sender-authorizing SPF mechanism publishes SPF -all and DMARC p=reject. - Warn: The domain is non-sending but either the SPF -all lock or DMARC p=reject is missing. - Numbers and lists the tool uses: nonSending = no MX answers and no DKIM hits and SPF has no /(?:include:|redirect=|exists:|ip4:|ip6:|\+all)/i mechanism; spfLocked regex /(?:^|\s)-all\b/; dmarcReject regex /\bp=reject\b/i; row only rendered when nonSending is true; BEC posture rescored as round(100 * (DMARC points + SPF points) / 55) with DKIM, MTA-STS, BIMI and TLS-RPT marked N/A. - Why: A domain that never sends mail is still a favorite for forgery, and only an explicit lock tells receivers to reject anything claiming to be from it. - Fix: Publish SPF v=spf1 -all and DMARC v=DMARC1; p=reject; sp=reject; np=reject; adkim=s; aspf=s with no p=none ramp, no sender includes and no DKIM key. - Verify: [DNS / Email Auth Audit](https://jwatte.com/tools/dns-email-audit/). Standard: DMARCbis (np tag). - [ ] **10.34 CAA record** - Pass: The apex has at least one CAA record. - Warn: No CAA records (DNS Email Audit); missing renders info in Mega Security Analyzer. - Numbers and lists the tool uses: CAA query on the apex; first 3 records shown; DNS Records Generator emits 0 issue "letsencrypt.org", 0 issue "sectigo.com", 0 issuewild "letsencrypt.org", 0 iodef "mailto:security@`<domain>`" with TTL 3600. - Why: Without CAA any certificate authority in the world can issue a certificate for your domain, which makes impersonation easier. - Fix: Add CAA records such as 0 issue "letsencrypt.org" and 0 iodef "mailto:security@`<domain>`" naming only the authorities you use. - Verify: [DNS / Email Auth Audit](https://jwatte.com/tools/dns-email-audit/), [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). Standard: CAA RFC 8659. - [ ] **10.35 MTA-STS** - Pass: A TXT record at _mta-sts.`<domain>` contains v=STSv1 (the id= tag is reported when present; the policy file at https://mta-sts.`<domain>`/.well-known/mta-sts.txt is not fetched). - Warn: No record while the domain has MX (info when there is no MX). - Numbers and lists the tool uses: query _mta-sts.`<domain>` TXT; regex /v=stsv1\b/i; id regex /\bid=([a-z0-9]+)/i; policy file at https://mta-sts.`<domain>`/.well-known/mta-sts.txt with version: STSv1, mode: enforce, mx: *.example.com, max_age: 604800; BEC posture points: MTA-STS with TLS-RPT 15, MTA-STS alone 10, missing with MX 0 (max 15); DNS Records Generator emits v=STSv1; id=`<UTC date YYYYMMDD>` with TTL 3600. - Why: Without MTA-STS an attacker on the network can strip encryption from mail delivered to you, and Gmail and Yahoo are moving toward requiring it for bulk senders. - Fix: Publish TXT _mta-sts.`<domain>` with v=STSv1; id=YYYYMMDD01 and host the policy file at https://mta-sts.`<domain>`/.well-known/mta-sts.txt with mode enforce, paired with a TLS-RPT record. - Verify: [DNS / Email Auth Audit](https://jwatte.com/tools/dns-email-audit/). - [ ] **10.36 TLS-RPT** - Pass: A TXT record at _smtp._tls.`<domain>` starts with v=TLSRPTv1. - Fail: Missing while the domain has MX renders info; no row when there is no MX. - Numbers and lists the tool uses: query _smtp._tls.`<domain>` TXT; regex /v=tlsrptv1\b/i; BEC posture solo bonus 5 points when TLS-RPT exists without MTA-STS, otherwise counted inside the MTA-STS row; generator value v=TLSRPTv1; rua=mailto:tls-reports@`<domain>` with TTL 3600. - Why: It is where other mail servers report failed encrypted deliveries to you, so without it you never learn that MTA-STS enforcement is failing. - Fix: Add TXT _smtp._tls.`<domain>` with v=TLSRPTv1; rua=mailto:tls-rpt@`<domain>`. - Verify: [DNS / Email Auth Audit](https://jwatte.com/tools/dns-email-audit/). - [ ] **10.37 BIMI** - Pass: A TXT record at default._bimi.`<domain>` contains v=BIMI1; the l= logo URL and a= VMC URL are reported when present but neither is required to pass. - Fail: Missing renders info; optional. - Numbers and lists the tool uses: query default._bimi.`<domain>` TXT; regex /v=bimi1\b/i; l= regex /\bl=(https?:\/\/[^\s;"]+)/i; a= regex /\ba=(https?:\/\/[^\s;"]+)/i; requires DMARC at p=quarantine or p=reject; BEC posture points 5 when present (max 5); DNS Records Generator emits v=BIMI1; l=https://`<domain>`/bimi-logo.svg; a=https://`<domain>`/bimi-vmc.pem with TTL 3600; a VMC (paid, from Entrust or DigiCert) is required for Gmail's blue check. - Why: It shows your logo next to your mail in Gmail, Apple Mail and Yahoo, which is a trust signal, but only after DMARC is enforced. - Fix: Once DMARC is at quarantine or reject, publish TXT default._bimi.`<domain>` with v=BIMI1; l=https://your.domain/logo.svg and optionally a VMC. - Verify: [DNS / Email Auth Audit](https://jwatte.com/tools/dns-email-audit/). - [ ] **10.38 Mail-server blacklist (RBL) status** - Pass: No IPv4 address of the domain's MX hosts is listed on any of the five checked DNS blacklists. - Fail: At least one MX host IP is listed on at least one RBL zone. - Numbers and lists the tool uses: only runs when MX records exist; RBL zones zen.spamhaus.org (Spamhaus ZEN), bl.spamcop.net (SpamCop), b.barracudacentral.org (Barracuda), dnsbl.sorbs.net (SORBS), dnsbl-1.uceprotect.net (UCEPROTECT L1); first 3 MX hosts, first 2 A records per host, IPv4 only /^\d+\.\d+\.\d+\.\d+$/; listed when an A query for `<reversed ip>`.`<zone>` returns any answer. - Why: Mail from a blacklisted server is rejected or sent to spam by receivers that honor these lists, and on shared hosting the listing may belong to a neighbor. - Fix: Request delisting from each RBL that lists you and allow 24 to 72 hours for it to clear. - Verify: [DNS / Email Auth Audit](https://jwatte.com/tools/dns-email-audit/). - [ ] **10.39 BEC posture, Business Email Compromise resistance** - Pass: The composite score across DMARC, SPF, DKIM, MTA-STS, BIMI and TLS-RPT is 85 or higher (STRONG). - Warn: Score 65 to 84 (MODERATE, some attack paths remain). - Fail: Score below 65 (WEAK, the domain is easily spoofed for invoice or wire fraud). - Numbers and lists the tool uses: becScore = min(100, sum of layer points); layer maxima DMARC 35, SPF 20, DKIM 20, MTA-STS 15, BIMI 5, TLS-RPT solo bonus 5; non-sending domains rescored as round(100 * (DMARC + SPF) / 55); verdict cutoffs 85 and 65; Security Headers Audit links every result to /tools/dns-email-audit/?domain=`<host>`&autorun=1 and names the DMARC, SPF, DKIM, MTA-STS, BIMI and TLS-RPT layers; FBI IC3 reports BEC losses crossed $3 billion in the U.S. in 2024; Analyzer cannot query DNS from the browser and points to mxtoolbox.com/SuperTool.aspx. - Why: HTTP security headers stop attacks on your pages but do nothing to stop someone sending fake invoices from your domain, which is the most common and most expensive small-business fraud. - Fix: Raise the lowest-scoring layer first: enforce DMARC, publish SPF ending in -all, sign with a 2048-bit RSA or Ed25519 DKIM key, add MTA-STS paired with TLS-RPT, and optionally BIMI. - Verify: [DNS / Email Auth Audit](https://jwatte.com/tools/dns-email-audit/), [Security Headers](https://jwatte.com/tools/security-headers-audit/), [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **10.40 DNS zone signed with DNSSEC** - Pass: The zone publishes DNSKEY records, or it publishes no SVCB agent-discovery record that would need signing. - Warn: An SVCB record is published but the zone is unsigned; otherwise advisory. - Numbers and lists the tool uses: Mega Analyzer row only rendered when the DNS-AID probe resolved and either an SVCB record at _index._agents is published or the site is an agent target; pass gate: dnssec OR no SVCB record; row title DNS-AID discovery zone signed with DNSSEC; DNS Records Generator enablement notes: Cloudflare Dashboard > DNS > Settings > DNSSEC > Enable then copy Digest, KeyTag, Algorithm and DigestType to the registrar; DigitalOcean does not sign natively; AWS Route53 aws route53 enable-hosted-zone-dnssec then get-dnssec; Google Cloud DNS gcloud dns managed-zones update `<zone>` --dnssec-state on; BIND dnssec-keygen -a RSASHA256 -b 2048 -n ZONE then dnssec-signzone -A -3 <16-hex salt> -N INCREMENT; the DS record always goes to the registrar; allow 24 to 48 hours for propagation. - Why: Without DNSSEC a resolver cannot tell your real DNS answers from forged ones, which matters most once agents read discovery records from your zone. - Fix: Turn on DNSSEC signing at your DNS host, paste the generated DS record at your registrar, and confirm your DNS host supports both SVCB and DNSSEC. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: DNSSEC; DNS-AID. - [ ] **10.41 No mixed content** - Pass: An https page references no http:// subresources or form actions. - Warn: Passive mixed content (http:// img, video, audio or source) is present, which triggers a browser warning (Mega SEO Analyzer); a form posts to http:// (Mega Security Analyzer CWE-319 pattern). - Fail: Active mixed content (http:// script, iframe, link, object, embed or form) is present and blocked by browsers (Mega SEO Analyzer); any http:// subresource on an https page (Analyzer, lists up to 4 samples). - Numbers and lists the tool uses: Analyzer selectors img[src], script[src], iframe[src], source[src], video[src], audio[src], link[href][rel="stylesheet"], link[href][rel~="icon"] with raw attribute /^http:\/\//i, only on https pages; Mega SEO Analyzer active regex /<(script|iframe|link|object|embed|form)[^>]+(?:src|href|action|data)\s*=\s*["']http:\/\//i and passive regex /<(img|video|audio|source)[^>]+src\s*=\s*["']http:\/\//i; Mega Security Analyzer form regex /<form[^>]*action=["']http:\/\//i (OWASP A02:2021). - Why: Browsers block http:// scripts and frames on an https page and warn on http:// images, so parts of the page silently break or lose the padlock, and a form posting to http:// sends visitor data in the clear. - Fix: Serve every subresource and form action over https:// (or use protocol-relative or relative URLs). - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). Standard: W3C Mixed Content; CWE-319; OWASP Top 10 2021 A02. - [ ] **10.42 SRI (Subresource Integrity) on eligible external scripts (`<n>`/`<n>`)** - Pass: Every SRI-eligible external script carries an integrity attribute (Analyzer, Mega SEO Analyzer at 100 percent); at least 80 percent of eligible scripts carry one (Mega Analyzer). - Warn: Coverage below 80 percent (Mega Analyzer); some or no eligible scripts covered (Analyzer); coverage 50 to 99 percent of all cross-origin scripts (Mega SEO Analyzer). - Fail: Coverage below 50 percent of all cross-origin scripts (Mega SEO Analyzer); coverage below 80 percent in the Mega Analyzer header bucket. - Numbers and lists the tool uses: Mega Analyzer: eligible src regex /^(?:https?:)?\/\//i, data: and javascript: excluded, threshold 0.8 of eligible, row hidden when there are no external scripts, all-exempt renders pass; SRI_HOSTILE exempt hosts googletagmanager.com, google-analytics.com, googleadservices.com, pagead2.googlesyndication.com, tpc.googlesyndication.com, adservice.google.com, cdn.tailwindcss.com, connect.facebook.net, static.hotjar.com, cdn.heapanalytics.com, js.hs-scripts.com, js.hs-analytics.net, js.intercomcdn.com, cdn.segment.com, static.zdassets.com, embed.tawk.to, cdn.amplitude.com, plausible.io, www.clarity.ms, snap.licdn.com, analytics.tiktok.com, static.ads-twitter.com, sc-static.net, js-na1.hs-scripts.com, cdn.jsdelivr.net/npm/@stripe, js.stripe.com, checkout.stripe.com, m.stripe.network, paypal.com, paypalobjects.com, wp.com/_static, ajax.googleapis.com, apis.google.com, accounts.google.com, news.google.com, fonts.googleapis.com, fonts.gstatic.com; Analyzer: requires all eligible scripts covered, DYNAMIC_SCRIPT_ORIGINS excluded (exact or same registrable domain) www.googletagmanager.com, www.google-analytics.com, googleadservices.com, pagead2.googlesyndication.com, tpc.googlesyndication.com, adservice.google.com, cdn.tailwindcss.com, www.clarity.ms, clarity.ms, connect.facebook.net, www.facebook.com, static.hotjar.com, script.hotjar.com, cdn.matomo.cloud, plausible.io, cdn.heapanalytics.com, platform.twitter.com, js.stripe.com, checkout.stripe.com, m.stripe.network, static.zdassets.com, embed.tawk.to, cdn.amplitude.com, js.intercomcdn.com, cdn.segment.com, js.hs-scripts.com, js.hs-analytics.net, snap.licdn.com, analytics.tiktok.com, static.ads-twitter.com, sc-static.net, paypal.com, paypalobjects.com, ajax.googleapis.com, apis.google.com, accounts.google.com; Mega SEO Analyzer: no exemptions, script regex /<script\b[^>]+src\s*=\s*["'][^"']+["'][^>]*>/gi, cross-origin /^https?:\/\//i, integrity /\bintegrity\s*=\s*["']/i, pass 100, warn 50 to 99, fail below 50; Single-Site Generator scaffold uses integrity sha384 plus crossorigin anonymous. - Why: If a CDN serving one of your scripts is compromised, the integrity hash makes the browser refuse the altered file instead of running it. - Fix: Add integrity="sha384-..." and crossorigin="anonymous" to static CDN scripts such as jQuery, Bootstrap and Font Awesome (generate the hash with openssl dgst -sha384 -binary file.js | openssl base64 -A or srihash.org); rolling analytics bundles from Google, Meta, Hotjar and Stripe cannot take a hash and are exempt. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: W3C Subresource Integrity. - [ ] **10.43 All external links have rel="noopener"** - Pass: Every a[target=_blank] link carries rel noopener or noreferrer. - Warn: `<n>` target=_blank links lack both noopener and noreferrer. - Numbers and lists the tool uses: selector a[target="_blank"]; rel must include noopener or noreferrer. - Why: A new-tab link without noopener lets the opened page take control of your tab and swap it for a phishing page. - Fix: Add rel="noopener noreferrer" to every link that uses target="_blank". - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **10.44 No inline event handlers** - Pass: The HTML contains no inline on* event handler attributes. - Warn: `<n>` inline event handlers found (a CSP blocker). - Numbers and lists the tool uses: regex /\son(click|change|submit|error|load|mouseover|focus|blur|input)\s*=/gi. - Why: Inline handlers only work if the CSP allows unsafe-inline, so they keep you from deploying a strict policy. - Fix: Move inline handlers to addEventListener calls in an external script. - Verify: [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). - [ ] **10.45 No API keys, tokens or private keys in page source** - Pass: The HTML matches none of the secret-shaped patterns. - Warn: An API-key-shaped literal appears in inline JS or a data attribute (Mega Security Analyzer CWE-798 pattern). - Fail: The HTML contains an AWS key, Stripe live key, Anthropic key, GitHub token or PEM private key pattern (Mega SEO Analyzer); a Sanity write-token-shaped string or a Contentful preview or access token appears (Platform Audit). - Numbers and lists the tool uses: Mega SEO Analyzer regex /AKIA[0-9A-Z]{16}|sk_live_[A-Za-z0-9]{24,}|sk-ant-[A-Za-z0-9_\-]{80,}|ghp_[A-Za-z0-9]{36}|-----BEGIN (RSA |EC )?PRIVATE KEY-----/; Mega Security Analyzer regex /api[_-]?key\s*[:=]\s*["'][A-Za-z0-9_-]{20,}/i (OWASP A07:2021); Platform Audit: Sanity sk followed by 40 or more [A-Za-z0-9_-], Contentful ?preview=true or ?access_token= with 10 or more alphanumerics; Single-Site Generator keeps secrets out of [vars] and generates them with crypto.randomBytes(48) hex via wrangler secret put and .dev.vars. - Why: Anything in the HTML is public, so a key there can be used by anyone to run up your bill, read draft content or change your data. - Fix: Remove the secret from the page, rotate it immediately, and keep keys server-side (environment variables or a secret store) with public tokens scoped read-only. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). Standard: CWE-798; OWASP Top 10 2021 A07. - [ ] **10.46 No inline eval, document.write or unescape patterns (CWE-79)** - Pass: No inline script uses eval(), document.write() or unescape(). - Warn: An inline script matches the XSS or cloaked-payload pattern. - Numbers and lists the tool uses: regex /<script[^>]*>[^<]*eval\(|<script[^>]*>[^<]*document\.write\(|unescape\(/i; OWASP A03:2021. - Why: These constructs are the classic shape of injected or hidden malicious code and they also block a strict CSP. - Fix: Remove eval and document.write(unescape(...)) constructs and pair the cleanup with a strict CSP. - Verify: [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). Standard: CWE-79; OWASP Top 10 2021 A03. - [ ] **10.47 POST forms carry a CSRF token (CWE-352)** - Pass: Every POST form has a visible CSRF token field nearby. - Warn: A POST form has no csrf, _token or authenticity_token within 2000 characters. - Numbers and lists the tool uses: regex /<form[^>]*method=["']post["'][^>]*>(?![\s\S]{0,2000}csrf|_token|authenticity_token)/i; lookahead window 2000 chars; OWASP A01:2021. - Why: Without a token another site can submit your forms on behalf of a logged-in visitor. - Fix: Add a hidden _token or csrf-token input to every POST form and validate it server-side. - Verify: [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). Standard: CWE-352; OWASP Top 10 2021 A01. - [ ] **10.48 No http: or relative iframe targets (CWE-1021)** - Pass: The page has no frame tags and every iframe src is an absolute https URL. - Warn: A frame tag, an http: iframe src or a relative iframe src is present. - Numbers and lists the tool uses: regex /<frame|<iframe[^>]*src=["']http:|<iframe[^>]*src=["'](?!https?:\/\/)/i; OWASP A05:2021. - Why: Embeddable frame targets combined with a missing framing header are the setup for a clickjacking attack. - Fix: Use https iframe sources and set X-Frame-Options or CSP frame-ancestors. - Verify: [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). Standard: CWE-1021; OWASP Top 10 2021 A05. - [ ] **10.49 No framework fingerprint in meta tags (CWE-16)** - Pass: The page has no X-UA-Compatible meta and no generator meta naming the CMS or its version. - Warn: A generator meta names WordPress, Drupal or Joomla (Mega Security Analyzer), or exposes a Joomla version number (Platform Audit); an X-UA-Compatible meta is present. - Numbers and lists the tool uses: regex /<meta\s+http-equiv=["']?X-UA-Compatible["']?|<meta\s+name=["']?generator["']?\s+content=["'](?:WordPress|Drupal|Joomla)/i (OWASP A05:2021); Platform Audit reads generator Joomla! `<version>` (warn) and TYPO3 `<version>` (info, LTS supported 3 years). - Why: A version in the generator tag helps attackers match your site to known holes for that release. - Fix: Strip the generator meta tag and the X-UA-Compatible meta from the template. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/), [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). Standard: CWE-16; OWASP Top 10 2021 A05. - [ ] **10.50 Source maps not referenced in production bundle** - Pass: No //# sourceMappingURL=...map reference appears in the HTML. - Warn: A source map reference is found (Next.js). - Numbers and lists the tool uses: //# sourceMappingURL=...map in HTML. - Why: Shipping source maps hands your original source code to anyone who looks. - Fix: Set productionBrowserSourceMaps: false in next.config.js (or the equivalent in your bundler). - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **10.51 No stack trace or internal path leaked in the response** - Pass: The response body contains no JS stack-frame pattern or internal server path. - Fail: The body matches a stack-frame pattern or an internal path. - Numbers and lists the tool uses: regex /at\s+\S+\s+$.+:\d+:\d+$/; regex /\/var\/task\/|file:\/\/\/|\/home\/runner\//i. - Why: A leaked stack trace maps your server's internals for an attacker. - Fix: Catch errors server-side and return only a generic message such as {"error":"internal"}. - Verify: [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). Standard: CWE-209. - [ ] **10.52 No debug flags or internal comments in production HTML (CWE-200)** - Pass: The HTML has no debug=true flag, error_reporting() call or internal HTML comment. - Warn: The page matches the debug or internal-comment pattern. - Numbers and lists the tool uses: regex /debug\s*=\s*true|error_reporting\s*\(|<!--\s*(?:debug|staging|internal|todo)/i; OWASP A01:2021. - Why: Debug flags and internal notes tell outsiders how the site is built and what is unfinished. - Fix: Strip debug flags and internal comments from the production build. - Verify: [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). Standard: CWE-200; OWASP Top 10 2021 A01. - [ ] **10.53 Dependency & framework versions: `<n>` librar(y|ies) fingerprinted** - Pass: Every fingerprinted JavaScript library is at or above the latest known release, or above its security floor with no end-of-life flag. - Warn: A library is behind the latest release but above its floor, is marked unmaintained (Moment.js, Slick Carousel, Owl Carousel 2), or its major version is end of life (Vue below 3). - Fail: A library is below its security floor (known CVEs), or is end of life at any version (AngularJS 1.x, Prototype.js, MooTools). - Numbers and lists the tool uses: detection from script[src] and link[href] URLs: /\/ajax\/libs\/([A-Za-z0-9._-]+)\/(\d+\.\d+(?:\.\d+)?(?:-[A-Za-z0-9.]+)?)\//, /(?:\/npm\/|unpkg\.com\/)((?:@[A-Za-z0-9._-]+\/)?[A-Za-z0-9._-]+)@(\d+\.\d+(?:\.\d+)?(?:-[A-Za-z0-9.]+)?)/, /jquery-ui-(\d+\.\d+\.\d+)/i, /jquery-migrate-(\d+\.\d+\.\d+)/i, /jquery[.-](\d+\.\d+\.\d+)(?:\.slim)?(?:\.min)?\.js/i, /\/bootstrap\/(\d+\.\d+\.\d+)\//i, /\/((?:@[A-Za-z0-9._-]+\/)?[A-Za-z0-9._-]+)@(\d+\.\d+(?:\.\d+)?)/, WordPress ?ver= /\/([A-Za-z0-9._-]+?)\.(?:js|css)\?[^"']*\bver=v?(\d+\.\d+(?:\.\d+)?)/i, /\/([A-Za-z0-9._]+?)[-.](\d+\.\d+(?:\.\d+)?)(?:\.slim)?(?:\.min)?\.(?:js|css)/i; license banners jQuery /jQuery (?:JavaScript Library )?v?(\d+\.\d+\.\d+)/, jQuery UI /jQuery UI(?: -)? v?(\d+\.\d+\.\d+)/, Bootstrap /Bootstrap v(\d+\.\d+\.\d+)/, Lodash /[Ll]odash (\d+\.\d+\.\d+)/, moment /moment[\s\S]{0,120}?version\s*:\s*(\d+\.\d+\.\d+)/i, Vue /Vue\.js v(\d+\.\d+\.\d+)/, Swiper /Swiper (\d+\.\d+\.\d+)/, Modernizr /Modernizr (\d+\.\d+\.\d+)/; lowest detected version per library is evaluated; cmpVer strips a leading non-digit prefix, drops any -prerelease suffix and compares dot-separated integers; LIB_DB (floor / latest / CVEs): jquery 3.5.0 / 4.0.0 / CVE-2020-11022, CVE-2020-11023; jquery-ui 1.13.2 / 1.14.2 / CVE-2022-31160, CVE-2021-41182, CVE-2021-41183, CVE-2021-41184; jquery-migrate none / 4.0.2; bootstrap floors by major 3: 3.4.1, 4: 4.3.1, 5: 0.0.0 / latest 5.3.8 / CVE-2019-8331, CVE-2018-14041, CVE-2018-14042; lodash 4.17.21 / 4.18.1 / CVE-2021-23337, CVE-2019-10744; underscore 1.13.2 / 1.13.8 / CVE-2021-23358; moment 2.29.4 / 2.30.1 / CVE-2022-31129, CVE-2022-24785 (eol); angularjs none / 1.8.3 / CVE-2024-21490, CVE-2022-25844, CVE-2020-7676 (anyVersionFail, eol January 2022); angular none / 22.0.0; vue none / 3.5.35 (eolBelowMajor 3, Vue 2 end of life 2023-12-31); react 16.0.0 / 19.2.7; d3 none / 7.9.0; handlebars 4.7.7 / 4.7.9 / CVE-2021-23369, CVE-2021-23383; axios 1.8.2 / 1.17.0 / CVE-2025-27152, CVE-2024-39338, CVE-2023-45857; chart.js 2.9.4 / 4.5.1 / CVE-2020-7746; swiper none / 12.2.0; slick-carousel none / 1.8.1 (eol, last release 2017); owl.carousel none / 2.3.4 (eol); select2 4.0.6 / 4.1.0 / CVE-2016-10744; popper 2.0.0 / 2.11.8; font-awesome none / 7.2.0; gsap 3.6.0 / 3.15.0 / CVE-2020-28478; three 0.125.0 / 0.184.0 / CVE-2020-28496; modernizr none / 3.13.1; tailwindcss none / 4.3.0; alpinejs none / 3.15.12; marked 4.0.10 / 18.0.5 / CVE-2022-21680, CVE-2022-21681; dompurify 3.1.3 / 3.4.8 / CVE-2024-45801, CVE-2024-47875; backbone none / 1.6.1; prismjs 1.27.0 / 1.30.0 / CVE-2022-23647, CVE-2021-32723; highlight.js 10.1.2 / 11.11.1 / CVE-2020-26237; prototype none / 1.7.3 (anyVersionFail, eol); mootools none / 1.6.0 (anyVersionFail, eol); npm-only keys glob 9.0.0 / 13.0.6; minimatch 3.0.5 / 10.2.5 / CVE-2022-3517; semver 7.5.2 / 7.8.3 / CVE-2022-25883; ws 8.17.1 / 8.21.0 / CVE-2024-37890; node-fetch 2.6.7 / 3.3.2 / CVE-2022-0235; ejs 3.1.10 / 6.0.1 / CVE-2022-29078, CVE-2024-33883; jsonwebtoken 9.0.0 / 9.0.3 / CVE-2022-23529, CVE-2022-23539, CVE-2022-23540, CVE-2022-23541; express 4.21.2 / 5.2.1 / CVE-2024-45296, CVE-2024-52798, CVE-2024-29041; minimist 1.2.6 / 1.2.8 / CVE-2021-44906; ansi-regex 5.0.1 / 6.2.2 / CVE-2021-3807; baseline latest refreshed 2026-06-09, CVEs verified 2026-05-29; no fingerprintable library renders info (a clean result is not proof you are current); CWE-1104. - Why: Outdated front-end libraries carry published, easily exploited holes, and they are the most common finding on small-business sites. - Fix: Upgrade each flagged library to the current release (with a sha384 integrity hash if self-hosted), plan a migration for any end-of-life major version, and replace end-of-life libraries (AngularJS, Prototype.js, MooTools, Moment.js, Slick, Owl) with a maintained alternative rather than upgrading them. - Verify: [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). Standard: OWASP Top 10 2021 A06; CWE-1104. - [ ] **10.54 CMS major version is still supported** - Pass: Drupal is at major version 10 or higher (Magento 2.x era signals, a possible 1.x install and PWA Studio detection all render info only). - Warn: Drupal major version below 10 (Drupal 9 reached end of life November 2023). - Numbers and lists the tool uses: Drupal regex /Drupal\s+(\d+)/ on the HTML, pass at major 10 or higher, warn below 10, info when no version is found; Magento 2.x signals /mage-init|_staticversion|X-Magento-Cache-Debug/i (info either way, Magento 1.x end of life June 2020); PWA Studio /magento-storefront-pwa|pwa-studio/i (info). - Why: A CMS past end of life stops receiving security patches, and store platforms are a prime target. - Fix: Upgrade Drupal to 10 or 11; migrate Magento 1.x to Adobe Commerce 2.x. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **10.55 `<n>` custom-code block(s) inline (Framer)** - Pass: No inline script blocks start with /* Custom code */. - Warn: One or more Framer custom-code blocks are inlined. - Numbers and lists the tool uses: count of script blocks starting with /* Custom code */. - Why: Pasted custom code is the usual place where a site builder page picks up an injection hole or a slow script. - Fix: Review each custom-code block for cross-site scripting risk and remove what is not needed. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **10.56 GraphQL introspection disabled and CMS project references scoped** - Pass: No Hygraph introspection markers appear in the HTML. - Warn: Hygraph introspection markers (__schema or introspectionQuery) are found in the HTML. - Numbers and lists the tool uses: Hygraph introspection regex /__schema|introspectionQuery/i (warn); Sanity projectId regex /['"]projectId['"]\s*:\s*['"][a-z0-9]{8}['"]/gi and Studio regex /\.sanity\.studio|sanity-studio/i render info only (projectId is expected on public sites). - Why: Introspection left on in production lets anyone read your whole content schema. - Fix: Disable GraphQL introspection in production and keep Studio references and project IDs off public pages where possible. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **10.57 `<n>` third-party tracker(s) detected** - Pass: None of the 22 known tracker fingerprints appears in the HTML. - Warn: No Tier 1 tracker but at least one Tier 2 advertising pixel is present. - Fail: At least one Tier 1 session-replay tracker is present; Tier 3 or 4 only renders info. - Numbers and lists the tool uses: Tier 1: FullStory /fullstory\.com|fs\.js/i, Hotjar /static\.hotjar\.com|hotjar-/i, LogRocket /logrocket\.com|lr-\.js/i, Mouseflow /mouseflow\.com|mf\.js/i, Inspectlet /inspectlet\.com/i, Smartlook /smartlook\.com/i; Tier 2: Facebook Pixel /connect\.facebook\.net|fbq\(|facebook\.com\/tr/i, TikTok Pixel /analytics\.tiktok\.com/i, LinkedIn Insight /snap\.licdn\.com|linkedin\.com\/px/i, X (Twitter) Pixel /static\.ads-twitter\.com|twq\(/i, Pinterest Tag /ct\.pinterest\.com/i, Snap Pixel /sc-static\.net|snap\.licdn/i, Reddit Pixel /redditstatic\.com\/ads|reddit\.com\/conversion/i; Tier 3: Google Analytics 4 /googletagmanager\.com\/gtag\/js|google-analytics\.com\/g\/collect/i, Adobe Analytics /omtrdc\.net|demdex\.net/i, Mixpanel /api-js\.mixpanel\.com|mixpanel\.com\/track/i, Amplitude /cdn\.amplitude\.com|api\.amplitude\.com/i, Segment /cdn\.segment\.com|api\.segment\.io/i, Heap /heapanalytics\.com/i; Tier 4: Intercom /widget\.intercom\.io|intercomcdn\.com/i, Drift /js\.driftt\.com|drift\.com\/chat/i, Cloudflare RUM /static\.cloudflareinsights\.com/i. - Why: Every tracker must be disclosed under GDPR, CCPA and CPRA, and session-replay tools record keystrokes, so a misconfiguration can export personal data. - Fix: Remove trackers you do not use, disclose the rest in the privacy policy, and run the third-party data leakage audit for the full breakdown. - Verify: [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). Standard: CWE-200. - [ ] **10.58 Trackers load only behind a consent management platform** - Pass: A consent management platform marker is present (Mega Security Analyzer emits no row when neither a CMP marker nor inline tracker calls are found). - Warn: Squarespace cookie banner missing (Platform Audit). - Fail: Inline tracker calls are present with no consent platform marker in the HTML. - Numbers and lists the tool uses: CMP regex /cookiebot|onetrust|iubenda|quantcast|trustarc|klaro|cookie-consent|usercentrics|didomi/i; inline tracker regex /fbq\(|gtag\(|_hsq|ga\(/i (Mega Security Analyzer, CWE-359); Mega Analyzer next-step signals hasTrackingPixels /googletagmanager|gtag\(|connect\.facebook\.net|hotjar|clarity\.ms/i and hasConsentVendor /cookiebot|onetrust|cookieyes|complianz|borlabs|iubenda|termly/i; Migration Analyzer consent signatures Cookiebot, OneTrust, CookieYes, Complianz, Borlabs, Iubenda, Termly, Cookie Script, Osano and tracking signatures GTM, GA4, Meta Pixel, Hotjar, Clarity, AdSense, Google Ads, Segment, Mixpanel, Amplitude; Squarespace markers cookie-banner-v2 or sqs-cookie-banner. - Why: Firing trackers before consent is a lawful-basis violation under GDPR the moment an EU visitor loads the page, and a similar duty applies under UK and California rules. - Fix: Gate every non-essential tracker behind a consent banner (Squarespace: Settings > Cookies & Visitor Data) and confirm by inspection that declining actually stops the tags from firing. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/), [Migration Analyzer](https://jwatte.com/tools/migration-analyzer/). Standard: CWE-359. - [ ] **10.59 CORS: Access-Control-Allow-Origin not wildcard with credentials** - Pass: Access-Control-Allow-Origin is set to an explicit origin rather than * (Mega SEO Analyzer reports CORS: ACAO scoped to that origin); an absent header produces no finding. - Fail: Access-Control-Allow-Origin is * and Access-Control-Allow-Credentials is true. - Numbers and lists the tool uses: acao === '*'; /true/i on access-control-allow-credentials; no finding when ACAO is absent or * without credentials (Mega SEO Analyzer); CWE-942. - Why: Browsers refuse the combination, but a fetch rewrite can turn it into a leak of one user's data to any site. - Fix: Replace the wildcard with an explicit origin allowlist whenever credentials are allowed. - Verify: [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). Standard: Fetch Standard CORS; CWE-942. - [ ] **10.60 CORS wildcard on user-scoped responses** - Pass: Access-Control-Allow-Origin is not a bare *. - Warn: Access-Control-Allow-Origin is * (without credentials). - Numbers and lists the tool uses: exact '*'. - Why: Any site can read a wildcard response in a browser, which is fine for public data and unacceptable for anything tied to a user. - Fix: Scope Access-Control-Allow-Origin to known origins for any response that depends on a session or user. - Verify: [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). - [ ] **10.61 Cache-Control set on JSON or XML responses** - Pass: A JSON or XML response carries a Cache-Control header. - Warn: Content-Type matches json or xml and Cache-Control is absent. - Numbers and lists the tool uses: /json|xml/i on content-type; header name cache-control; adjacent info row 'Public cache on JSON' when cache-control matches /public/i and content-type matches /json/i. - Why: Without a cache directive a CDN may store one user's data and serve it to another. - Fix: Add Cache-Control: private, no-store to any response tied to a session. - Verify: [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). - [ ] **10.62 Retry-After sent on throttled responses** - Pass: A 429 or 503 response includes a Retry-After header. - Warn: The response status is 429 or 503 and Retry-After is absent. - Numbers and lists the tool uses: status /^429|^503/; header name retry-after; suggested value Retry-After: 60. - Why: Without it clients and crawlers do not know when to back off, so they keep hammering the site. - Fix: Add Retry-After: 60 to rate-limit and maintenance responses. - Verify: [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). - [ ] **10.63 Reporting endpoint: <v2 / legacy Report-To / none>** - Pass: A Reporting-Endpoints header is present. - Warn: Only the legacy Report-To header is present. - Fail: Neither header is present (info). - Numbers and lists the tool uses: header names reporting-endpoints, report-to. - Why: A reporting endpoint is how browsers tell you when your CSP or other policies block something on a real visitor's page. - Fix: Send a Reporting-Endpoints header pointing at a collector and reference it from the CSP report-to directive. - Verify: [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: W3C Reporting API. - [ ] **10.64 Post-quantum hybrid key exchange** - Pass: The TLS handshake negotiates a post-quantum hybrid key-exchange group. - Warn: Not supported (Mega Security Analyzer flags harvest-now-decrypt-later exposure); SSL Grade reports it as info with no deduction. - Numbers and lists the tool uses: tls.pqc.supported truthy; recommended group X25519MLKEM768; MITRE TA0009 Collection; CWE-327. - Why: Traffic recorded today can be decrypted later by a quantum-capable attacker unless the key exchange already resists that. - Fix: Enable the hybrid X25519MLKEM768 group on the TLS terminator (most CDNs offer it as a setting) and verify with openssl s_client. - Verify: [SSL Grade](https://jwatte.com/tools/ssl-grade/), [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). Standard: ML-KEM NIST FIPS 203; CWE-327. - [ ] **10.65 Prompt-injection defense** - Pass: The page source contains 0 or 1 prompt-injection-shaped patterns (score 100 or 80). - Warn: 2 hits (score 60). - Fail: 3 or more hits (score 40 or below). - Numbers and lists the tool uses: patterns /ignore (all |the )?(previous|above|prior) instructions/i, /you are now/i, /system prompt/i, /jailbreak/i, /<!--\s*assistant/i, Unicode direction-override characters U+202D and U+202E in raw, HTML entity (‭ ‮) or escape (‭ ‮) form; score = 100 - hits * 20, floor 0; severity score >= 80 pass, >= 60 warn, else fail. - Why: Hidden instruction-shaped text in your pages (often pasted into comments or reviews) can hijack the AI assistants that read your site on a customer's behalf. - Fix: Audit content for accidentally embedded prompt-shaped strings and sanitize user-generated content (comments, reviews) for hidden Unicode and instruction patterns. - Verify: [Mega AEO Analyzer](https://jwatte.com/tools/mega-aeo-analyzer/). - [ ] **10.66 OAuth / OIDC discovery metadata (RFC 8414)** - Pass: Authorization-server or OpenID configuration metadata is published, or the site is not an agent target. - Warn: The site is an agent target and publishes neither document. - Numbers and lists the tool uses: paths /.well-known/oauth-authorization-server, /.well-known/openid-configuration; gate _isAgentTarget. - Why: It lets AI agents and MCP clients discover how to authenticate to your service without manual setup. - Fix: Publish issuer, authorization_endpoint, token_endpoint, jwks_uri and grant_types_supported at the well-known path. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: RFC 8414; OpenID Connect Discovery; Cloudflare Agent Readiness Score (https://isitagentready.com/). - [ ] **10.67 OAuth Protected Resource Metadata (RFC 9728)** - Pass: /.well-known/oauth-protected-resource exists, or the site is not an agent target. - Warn: The site is an agent target and the document is missing. - Numbers and lists the tool uses: path /.well-known/oauth-protected-resource; gate _isAgentTarget. - Why: It tells agents which authorization servers and scopes they need to obtain an access token for your resource. - Fix: Publish resource, authorization_servers and scopes_supported at the well-known path. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: RFC 9728; Cloudflare Agent Readiness Score (https://isitagentready.com/). - [ ] **10.68 OAuth Resource Server Link header on 401 (RFC 9728)** - Pass: When oauth-protected-resource metadata exists, the Link header advertises it. - Warn: The metadata exists but the Link header is missing. - Numbers and lists the tool uses: regex /rel\s*=\s*"?oauth-protected-resource"?/i on the Link header; gate aux.oauthPR. - Why: Many MCP clients only learn that OAuth is required from this header on the 401 response. - Fix: Add Link: </.well-known/oauth-protected-resource>; rel="oauth-protected-resource" to 401 responses. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: RFC 9728. - [ ] **10.69 .well-known/change-password found** - Pass: The file at /.well-known/change-password resolves; a pass row is rendered and counts 10 of 10 points in the section score. When it is absent no row is rendered. - Numbers and lists the tool uses: path /.well-known/change-password; pass only, absence is not reported. - Why: Browsers and password managers use this URL to send users straight to your password-change page. - Fix: Serve /.well-known/change-password as a redirect to your account password page. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). Standard: RFC 8615. - [ ] **10.70 Trusted Types directive enabled** - Pass: The Content-Security-Policy header matches /require-trusted-types-for|trusted-types\s+/i; the pass finding counts toward the Security dimension score (pass findings divided by all findings). No finding is added otherwise, and nothing is evaluated without a CSP. - Numbers and lists the tool uses: regex /require-trusted-types-for|trusted-types\s+/i on the CSP; pass only, no finding otherwise; only evaluated when a CSP exists. - Why: Trusted Types stops scripts from writing raw HTML into the page, which removes a whole class of DOM injection. - Fix: Add require-trusted-types-for 'script' to the CSP once your scripts are compatible. - Verify: [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: W3C Trusted Types. - [ ] **10.71 OCSP stapling active** - Pass: Tls.standard.ocsp_stapled is truthy; the pass row 'OCSP stapling active' adds no points to the SSL grade but counts in the scorecard pass rate. When not stapled an info row 'OCSP stapling not detected' is shown with no deduction. - Numbers and lists the tool uses: tls.standard.ocsp_stapled truthy; not stapled renders info with no deduction. - Why: Stapling saves every visitor a certificate-revocation round trip. - Fix: Enable OCSP stapling on the TLS terminator. - Verify: [SSL Grade](https://jwatte.com/tools/ssl-grade/). - [ ] **10.72 Product/service-specific legal pages: Refund, Shipping, DPA, FTC affiliate, medical, financial, legal disclaimers** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: gated by schema type: Refund for Product, OfferCatalog or Service; Shipping for Product; DPA for SoftwareApplication or Service; FTC affiliate disclosure for Article, BlogPosting or Review; Medical disclaimer for Medical, HealthTopicContent or Physician; Financial disclaimer for FinancialService, InvestmentOrDeposit or BankOrCreditUnion; Legal disclaimer for LegalService or Attorney. - Why: FTC rules, Google Merchant Center, GDPR Article 28, 16 CFR 255, YMYL expectations and state bar rules each expect a specific page or disclaimer for that kind of business. - Fix: Add the page or disclaimer that matches the schema types your site publishes. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: GDPR Art. 28; 16 CFR 255. - [ ] **10.73 without a browser window / self-hosted CMS admin paths gated and write keys kept server-side** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: admin paths Strapi /admin, Payload /admin, Craft /admin (cpTrigger), Kirby /panel, MODX /manager/, OpenCart /admin, Decap /admin/index.html, Statamic /content/; advisories for Storyblok visual editor bridge, Prismic preview toolbar, Builder.io key scope, Sitecore token scope, Commerce.js key, Saleor tokens, Snipcart webhooks, SFCC API scope, PrestaShop modules, Hydrogen Oxygen, Mailchimp GDPR. - Why: A guessable admin URL and a write-capable key in the front end are the two easiest ways into a without a browser window CMS. - Fix: Auth-gate, IP-allowlist or rename the admin path, keep write keys server-side and scope public tokens read-only. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **10.74 Bot-protection markers present** - Pass: Response body matches /challenge-platform|__cf_chl|turnstile|hcaptcha|recaptcha/i or the cf-mitigated header is set; the pass row 'Bot-protection markers present' (Posture category) counts in the scorecard pass rate. On a Cloudflare-fronted site with no marker an info row is shown instead, which the scorecard excludes. - Numbers and lists the tool uses: regex /challenge-platform|__cf_chl|turnstile|hcaptcha|recaptcha/i or header cf-mitigated; a Cloudflare-fronted site with no marker renders info; Single-Site Generator modes none (default), turnstile (server-side siteverify), access-rl (constant-time compare, KV rate limit keyed rl:`<bucket>`:`<ip>` with expirationTtl = window, fail open on KV error, fail closed on the gate), waf-managed (managed challenge plus Bot Fight Mode plus rate limiting rule); client IP from CF-Connecting-IP. - Why: Public write endpoints without a challenge get scraped and spammed, and on Cloudflare the fix is a free one-click setting. - Fix: Enable Bot Fight Mode or Turnstile on public forms and API endpoints, and keep the challenge scoped so your own UI calls still pass. - Verify: [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). - [ ] **10.75 DMARC pct= is obsolete (DMARCbis)** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: regex /\bpct=\d+/i; value from /\bpct=(\d+)/i, default 100; DNS Records Generator still emits pct=100. - Why: DMARCbis removes the pct tag, so receivers on the new spec ignore it while older ones may still honor it. - Fix: Delete the pct tag and use t=y to test, then move p through none, quarantine and reject as sources align. - Verify: [DNS / Email Auth Audit](https://jwatte.com/tools/dns-email-audit/). Standard: DMARCbis. - [ ] **10.76 DMARC np= (non-existent subdomains)** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: regex /\bnp=(none|quarantine|reject)/i; row rendered when np is empty and the domain sends mail. - Why: Subdomains that were never created inherit no policy, which makes them a favorite for spoofers. - Fix: Add np=reject to the DMARC record to reject forged mail from any non-existent subdomain without changing how real subdomains are handled. - Verify: [DNS / Email Auth Audit](https://jwatte.com/tools/dns-email-audit/). Standard: DMARCbis (np tag). - [ ] **10.77 DMARC monitoring (rua=)** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: regex /\brua=mailto:/i; a missing rua never demotes the DMARC pass. - Why: Without an aggregate-report address you have no stream of reports to spot abuse or misaligned senders. - Fix: Add rua=mailto:dmarc@`<domain>`; managed services such as Valimail, dmarcian and Postmark DMARC Digests ingest and chart these reports for free. - Verify: [DNS / Email Auth Audit](https://jwatte.com/tools/dns-email-audit/). Standard: DMARCbis. ## 11. Content, keywords and what the top ten already do The checks on the words themselves: thin pages, keyword placement, readability, the voice tells that read as generated, and the gaps between your page and the pages that already rank for the same question. **Verify this section with:** [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [SGE Readiness Audit](https://jwatte.com/tools/sge-readiness-audit/), [Mega Batch](https://jwatte.com/tools/mega-batch/), [Rendered DOM Paste Audit](https://jwatte.com/tools/rendered-dom-paste-audit/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/), [Keyword Inspection](https://jwatte.com/tools/keyword-inspection/), [Monoclone Gen.](https://jwatte.com/tools/monoclone-generator/), [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/), [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [About-Page Conversion Audit](https://jwatte.com/tools/about-page-conversion-audit/), [Heading Gap Audit](https://jwatte.com/tools/heading-gap-audit/), [Content Gap TF-IDF Analyzer](https://jwatte.com/tools/content-gap-tfidf/), [SERP Feature Opportunity Matrix](https://jwatte.com/tools/serp-feature-opportunity-matrix/), [SERP Features](https://jwatte.com/tools/serp-features/), [Content Velocity](https://jwatte.com/tools/content-velocity/). - [ ] **11.1 ads.txt found** - Pass: An ads.txt file is served at /ads.txt. - Numbers and lists the tool uses: /ads.txt; only presence is reported, absence is not flagged (Analyzer). - Why: The Authorized Digital Sellers file controls who is allowed to sell your ad inventory. - Fix: If you run display ads, publish /ads.txt listing your authorized sellers. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). Standard: IAB ads.txt. - [ ] **11.2 Content depth: `<n>` words** - Pass: The main body holds at least 800 words after navigation, header, footer and scripts are removed. - Warn: Between 300 and 799 words is flagged as thin; the SGE audit warns below 1,200 and the Rendered DOM audit warns below 300. - Fail: Under 300 words is very thin content; the SGE audit fails below 600 and the Rendered DOM audit fails below 100. - Numbers and lists the tool uses: Analyzer: pass >= 800, warn 300 to 799, fail < 300; body text excludes script, style, nav, header, footer, aside, noscript. Mega Analyzer: >= 800 words on expertise pages; Voice score adds 10 points at >= 800; writing-framework score adds 20 points at >= 600; body text strips script, style, nav, header, footer, aside, noscript, form.site-footer.footer, [role=contentinfo].legal.disclaimer.terms.footer-disclaimer.footer-bottom.cookie-consent, #cookie-consent, with footer text kept separately and tables and definition lists removed from prose text; wordCount = body text split on whitespace. Mega SEO Analyzer: pass >= 600, warn 300 to 599, fail < 300; strips script, style, nav, header, footer blocks; only words longer than one character count. SGE Readiness Audit: pass >= 1200, warn 600 to 1199 (thin for SGE), fail < 600 (insufficient); words from the main element text. Mega Batch: >= 800 words earns the E-E-A-T bucket weight 10 and 20 Voice points; excludes script, style, nav, header, footer, aside, noscript, form. Rendered DOM Paste Audit: pass >= 300, warn 100 to 299, fail < 100; words in main, article, role=main or body. Single Site Generator: at least 3 minutes of reading on pillar pages (about 675 words). - Why: Short pages rarely rank for competitive queries, pages under 300 words are treated as thin, and pages above 1,200 words are included in AI answers more often. - Fix: Expand key pages with substantive content: 600 words minimum for competitive queries, 800 or more for expertise pages, and 1,200 or more where you want AI answer inclusion. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [SGE Readiness Audit](https://jwatte.com/tools/sge-readiness-audit/), [Rendered DOM Paste Audit](https://jwatte.com/tools/rendered-dom-paste-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/) and 3 more. Standard: Google Helpful Content System self-assessment (developers.google.com/search/docs/fundamentals/creating-helpful-content). - [ ] **11.3 Thin page (`<n>` chars) and still indexable** - Pass: Body text is at least 1,500 characters, or the page is noindex, or its canonical points to a fuller page. - Fail: Body text is under 1,500 characters on a page that is indexable and canonical to itself. - Numbers and lists the tool uses: 1500 characters of body innerText; applies only when the page is indexable and has no canonical or a canonical whose path equals its own (Mega Analyzer). - Why: Thin pages that are still indexable dilute the site in search. - Fix: Expand the page to 1,500 or more characters, or add noindex,follow, or set the canonical to a fuller page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **11.4 GEO bucket: body text over 2000 characters with at least three H2** - Pass: Body text exceeds 2,000 characters and the page has three or more H2 headings. - Numbers and lists the tool uses: doc.body.textContent length > 2000; H2 count >= 3; weight 10 (Batch Analyzer). - Why: Long, sectioned content is easier for AI systems to read and quote. - Fix: Expand the copy and break it into sections with descriptive H2 headings. - Verify: [Batch Compare](https://jwatte.com/tools/batch-analyzer/). - [ ] **11.5 `<n>` paragraphs found** - Pass: The page has at least five paragraph elements. - Warn: Fewer than five paragraphs. - Numbers and lists the tool uses: 5 p elements (Analyzer); the Keyword Inspection rewrite prompt targets 40 to 150 words per paragraph so each paragraph is its own retrieval chunk. - Why: Well-structured content has several paragraphs with clear topics, each short enough to be quoted on its own. - Fix: Break the copy into five or more paragraphs of roughly 40 to 150 words each. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Keyword Inspection](https://jwatte.com/tools/keyword-inspection/). - [ ] **11.6 Dev-placeholder text detected in production (`<n>` locations)** - Pass: No placeholder text appears in the title, meta description, H1 or the first 4,000 body characters. - Numbers and lists the tool uses: patterns: gwapo, pogi, guapo, lorem ipsum, placeholder text, [enter X], TBD (case-sensitive), coming soon, under construction, sample text, your text here, tagline goes here; slots: title, meta description, H1, first 4000 body characters (Mega Analyzer). Monoclone Generator rule: realistic placeholder content for the niche, no lorem ipsum. - Why: Leftover developer text ships to production and shows up in search results, for example a meta description reading 'Case studies listing gwapo'. - Fix: Search the site for the patterns and replace every one with real copy before deploying. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Monoclone Gen.](https://jwatte.com/tools/monoclone-generator/). - [ ] **11.7 Font-glyph-collision typo suspected (`<n>` instances)** - Pass: No 'Al', 'A1', 'Il' or 'I1' tokens appear in the title, H1 or H2 text. - Numbers and lists the tool uses: regex /\b(?:A[l1]|I[l1])\b/g over title + H1 + H2 text (first 6000 characters); up to 3 examples shown (Mega Analyzer). - Why: In sans-serif fonts lowercase L and capital I look identical, so 'Al' reads as 'AI' to people but search engines see the wrong characters. - Fix: Check the token in DevTools and retype it as 'AI' where that was the intent. Learn more: /blog/blog-ai-mode-binding-bugs-validators-miss/. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **11.8 Potential duplicate content with `<path>`** - Pass: No sampled inner page shares more than 80 percent of its word set with the analyzed page. - Warn: A compared page exceeds 80 percent text similarity. - Numbers and lists the tool uses: fingerprint strips script, style, nav, header, footer, lowercases, keeps words longer than 3 characters, takes the first 200 of those words and deduplicates them into a set; main fingerprint needs >= 20 words; candidates are sitemap.xml loc values excluding the input and final URL (trailing slash ignored); 5 random pages; fetched HTML must be >= 200 characters; pages that redirect back to the analyzed page are skipped; Jaccard = intersection / union; threshold > 0.8 (Analyzer). Monoclone Generator rule: keep articles unique across sites by using relatedArticles to filter which articles show on which site. - Why: Near-identical pages compete with each other in search and split ranking signals. - Fix: Differentiate the copy on each page or point the duplicates at one canonical URL. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Monoclone Gen.](https://jwatte.com/tools/monoclone-generator/). - [ ] **11.9 Brand-name mentions on page: `<n>`** - Pass: The brand name appears at least five times in the page HTML. - Warn: Fewer than five mentions is thin brand presence. - Numbers and lists the tool uses: 5; brand stem = hostname with leading www. removed and the final .tld stripped, regex metacharacters escaped, matched case-insensitive and global (Mega SEO Analyzer). - Why: Pages that barely name the brand give search and AI systems little to connect the content to the business. - Fix: Mention the brand name in the page copy at least five times where it reads naturally. - Verify: [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). - [ ] **11.10 In title tag** - Pass: The target keyword appears in the page title. - Numbers and lists the tool uses: case-insensitive substring match of the entered keyword (lowercased, trimmed) against the title text; requires a keyword in the keyword field (Analyzer). - Why: The title tag is the first place search engines look for the topic of the page. - Fix: Add the target keyword to the title tag. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **11.11 In H1** - Pass: At least one H1 heading contains the target keyword. - Numbers and lists the tool uses: substring match across all H1 texts, case-insensitive; requires an entered keyword (Analyzer). - Why: The H1 tells readers and search engines what the page is about. - Fix: Add the keyword to the H1 heading. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **11.12 In H2 headings** - Pass: At least one H2 heading contains the target keyword. - Numbers and lists the tool uses: substring match across all H2 texts, case-insensitive; requires an entered keyword (Analyzer). - Why: Subheadings that repeat the topic help search engines confirm what each section covers. - Fix: Include the keyword in an H2 subheading. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **11.13 In meta description** - Pass: The meta description contains the target keyword. - Numbers and lists the tool uses: case-insensitive substring match; requires an entered keyword (Analyzer). - Why: A keyword in the meta description is bolded in search results and lifts click-through. - Fix: Add the keyword to the meta description. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **11.14 In URL** - Pass: The page URL contains the target keyword. - Numbers and lists the tool uses: case-insensitive substring match on the full URL string; requires an entered keyword (Analyzer). - Why: A descriptive slug is a small ranking signal and reads better in results. - Fix: Consider including the keyword in the URL slug. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **11.15 Density optimal (0.5-2.5%)** - Pass: Keyword density is between 0.5 and 2.5 percent of body words. - Fail: Below 0.5 percent is under-optimized; above 2.5 percent is over-optimized and risks a keyword-stuffing penalty. - Numbers and lists the tool uses: occurrences = whole-word regex new RegExp('\\b' + escaped keyword + '\\b', 'gi') over document.body.textContent lowercased; words split on /\s+/; density = (kwCount / totalWords) * 100 to two decimals; optimal band 0.5 to 2.5 percent; also renders Occurrences, Density and Total Words stats (Analyzer). - Why: Using the keyword too rarely leaves the topic unclear; using it too often looks like stuffing. - Fix: Use the keyword more naturally when under 0.5 percent and reduce it when over 2.5 percent. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **11.16 Flesch reading ease (target >= `<n>`)** - Pass: Flesch reading ease is at or above the floor for the page type: 60 for normal pages, 50 for landing pages, 35 for data-dominant pages. - Warn: On publication or application sites the row is informational; a score of 45 to 59 earns partial Voice points. - Fail: Below the floor; under 45 earns the minimum Voice points. - Numbers and lists the tool uses: flesch = 206.835 - 1.015 * (words / sentences) - 84.6 * (syllables / words); sentences split on /(?<=[.!?])\s+(?=[A-Z0-9])/ keeping sentences longer than 3 characters; syllables: words of 3 or fewer letters count 1, trailing (?:[^laeiouy]es|ed|[^laeiouy]e) and leading y stripped, then /[aeiouy]{1,2}/g groups counted (minimum 1); voice analysis runs on prose text (tables and definition lists removed) and returns null when text is under 50 characters. Floors: 60 default, 50 landing-page context, 35 data-dominant; landing-page context = LocalBusiness-family schema on the page, FAQPage schema, a tool or data gallery, or a data-dominant page; data-dominant = tables + dl >= 3 and >= 0.4 times the paragraph count; gallery pages are >= 8 links matching /\/tools?\/[a-z0-9\-]+\/?$/i or >= 8 matching /\/(states?|counties|metros?|zips?|cities)\/[a-z0-9\-]+\/?$/i; publication types NewsMediaOrganization, WebApplication, SoftwareApplication, Dataset, DataCatalog, Periodical downgrade the row to info. Voice score: >= 60 earns 20 points, >= 45 earns 12, else 5 (Mega Analyzer). Mega Batch: >= 60 adds 30 points, >= 45 adds 15, else 0; computed only when body text exceeds 200 characters. Single Site Generator and Site Migration Generator target: Flesch >= 60. Mega AI fix prompt target: >= 60. - Why: Lower scores mean denser prose that readers and AI systems find harder to quote. - Fix: Shorten sentences and use simpler words until the score clears the floor. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega Batch](https://jwatte.com/tools/mega-batch/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/), [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/). Standard: Flesch Reading Ease. - [ ] **11.17 Reading grade level (target 8-12)** - Pass: Flesch-Kincaid grade level is between 8 and 12. - Warn: On publication or application sites the row is informational; the stat tile shows ok up to grade 12 and good at 9 or below. - Fail: Outside 8 to 12; above 12 earns no Voice points. - Numbers and lists the tool uses: grade = 0.39 * (words / sentences) + 11.8 * (syllables / words) - 15.59; pass band 8 to 12; stat tile good <= 9, ok <= 12; Voice score: grade <= 9 earns 15 points, <= 12 earns 8 (Mega Analyzer). Mega Batch: grade <= 9 adds 25 points, <= 12 adds 10, above 12 adds 0. Single Site Generator, Site Migration Generator and Mega AI fix prompt target: grade 8 to 12. - Why: Copy pitched at a high-school reading level is understood by the widest audience and quoted more readily. - Fix: Lower the reading grade with shorter sentences and everyday words; do not go below grade 8 on expert topics. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega Batch](https://jwatte.com/tools/mega-batch/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/), [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/). Standard: Flesch-Kincaid Grade. - [ ] **11.18 Passive voice ratio (target <= 10%)** - Pass: No more than 10 percent of sentences are passive. - Warn: On publication or application sites the row is informational; 11 to 20 percent earns partial Voice points and shows ok on the stat tile. - Fail: Above 10 percent; above 20 percent earns no Voice points. - Numbers and lists the tool uses: PASSIVE_RE = /\b(?:am|is|are|was|were|be|been|being)\s+(?:\w+ly\s+)?(\w+ed|written|taken|seen|done|made|given|shown|known|held|told|found|built|grown|drawn|thrown|sent|lost|kept|left|set|put|cut|hit|run)\b/gi; passivePct = passive matches / sentences * 100; pass <= 10; stat tile ok <= 20; Voice score: <= 10 earns 15 points, <= 20 earns 8 (Mega Analyzer). Mega Batch: <= 10 adds 25 points, <= 20 adds 10, above 20 adds 0. Single Site Generator, Site Migration Generator and Mega AI fix prompt target: passive <= 10 percent. - Why: Active voice reads with more confidence and lifts retrieval confidence in AI answers. - Fix: Rewrite passive sentences in active voice with a clear subject doing the action. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega Batch](https://jwatte.com/tools/mega-batch/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/), [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/). - [ ] **11.19 Mean sentence length (target 12-22 words)** - Pass: Average sentence length is between 12 and 22 words. - Warn: On publication or application sites the row is informational. - Numbers and lists the tool uses: 12 to 22 words per sentence; sentences split on /(?<=[.!?])\s+(?=[A-Z0-9])/ keeping sentences longer than 3 characters (Mega Analyzer). - Why: Very short sentences read as choppy and very long ones lose the reader. - Fix: Split sentences over 22 words and combine fragments under 12 where they belong together. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **11.20 Sentence length variance (std dev 6-`<n>`)** - Pass: The standard deviation of sentence length is between 6 and 12 words, or between 6 and 18 on landing pages. - Warn: On publication or application sites the row is informational. - Numbers and lists the tool uses: std dev >= 6 and <= stdMax; stdMax = 18 on landing pages, else 12; Voice score awards 10 points when std dev is between 5 and 14 (Mega Analyzer). Single Site Generator, Site Migration Generator and Mega AI fix prompt target: std dev 6 to 12. - Why: Too little variation reads as monotonous and too much reads as chaotic. - Fix: Mix short and medium sentences deliberately instead of writing every sentence at the same length. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/), [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/). - [ ] **11.21 Hedge word density (target <= 3 per 1K words)** - Pass: Hedging words appear no more than 3 times per 1,000 words. - Fail: Above 3 per 1,000 words; above 6 earns no Voice points. - Numbers and lists the tool uses: HEDGES = /\b(?:very|really|quite|somewhat|rather|(?<!not\s)(?<!n['’]t\s)just|maybe|perhaps|probably|basically|actually|literally|honestly|arguably|essentially)\b/gi; per1k = count / (words / 1000); pass <= 3; Voice score: <= 3 earns 10 points, <= 6 earns 5; writing-framework score adds 20 points at <= 3 (Mega Analyzer). Single Site Generator target: hedge density <= 3 per 1000 words (basically, really, very, somewhat, arguably). Site Migration Generator target: hedge density <= 3 per 1000 words. Mega AI fix prompt target: <= 3 per 1K. - Why: Hedges dilute confident copy and reduce how often answer engines cite the page. - Fix: Cut hedges such as perhaps, basically and very, or replace them with a specific claim. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/), [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/). - [ ] **11.22 Marketing-jargon density (target <= 1 per 1K words)** - Pass: Marketing buzzwords appear no more than once per 1,000 words. - Warn: On long-form article pages the AI-citation panel warns when the rate exceeds 1 per 1,000 words. - Fail: Above 1 per 1,000 words on the Voice tab; above 3 earns no Voice points. - Numbers and lists the tool uses: JARGON = /\b(?:revolutionary|best-in-class|industry-leading|next-generation|world-class|cutting-edge|state-of-the-art|game-chang(?:er|ing)|disruptive|synerg(?:y|istic|ize)|paradigm shift|holistic|seamless(?:ly)?|robust|bespoke|turnkey|best-of-breed|unparalleled|premier)\b/gi; per1k = count / (words / 1000); pass <= 1; Voice score: <= 1 earns 10 points, <= 3 earns 5; writing-framework score adds 20 points at <= 1; the AI-citation warn row runs only on article pages with >= 800 words (Mega Analyzer). Mega AI fix prompt target: <= 1 per 1K. - Why: Buzzwords read as unspecific marketing copy and retrieval systems discount jargon-heavy pages. - Fix: Replace each buzzword with a concrete claim about what the product or service does; see /tools/ai-citation-specificity-audit/. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **11.23 Vague-claim density (target <= 1 per 1K words)** - Pass: Vague quantity phrases appear no more than once per 1,000 words. - Warn: On long-form article pages the AI-citation panel warns when the rate exceeds 1 per 1,000 words. - Fail: Above 1 per 1,000 words on the Voice tab; above 3 earns no Voice points. - Numbers and lists the tool uses: VAGUE = /\b(?:many (?:businesses|companies|organizations|customers|users|people)|most (?:businesses|companies|organizations)|several (?:businesses|companies|organizations)|a lot of|lots of|numerous|countless|a variety of|various|plenty of)\b/gi; per1k = count / (words / 1000); pass <= 1; Voice score: <= 1 earns 10 points, <= 3 earns 5; writing-framework score adds 20 points at <= 1; the AI-citation warn row runs only on article pages with >= 800 words (Mega Analyzer). Mega AI fix prompt target: <= 1 per 1K. - Why: Vague quantifiers signal unsupported claims and are the phrases answer engines skip. - Fix: Replace 'many businesses' style phrases with a real number and its source. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **11.24 CTA density (target 1-`<n>` per 1K words)** - Pass: Call-to-action verbs appear at least once per 1,000 words and no more than the ceiling for the page type: 5 on normal pages, 15 on landing pages, 30 on tool or data galleries. - Numbers and lists the tool uses: CTAS = /\b(?:buy|sign up|subscribe|register|download|get started|try|start|join|learn more|contact|book|schedule|apply|request|click|tap|call|order|shop|reserve|claim)\b/gi; per1k = count / (words / 1000); floor 1; ceiling 5 default, 15 landing page, 30 tool or data gallery (>= 8 links matching /\/tools?\/[a-z0-9\-]+\/?$/i or /\/(states?|counties|metros?|zips?|cities)\/[a-z0-9\-]+\/?$/i) (Mega Analyzer). Single Site Generator and Site Migration Generator target: at least 1 CTA per 500 words. - Why: Readers need an explicit next step, but conversion pages are CTA-dense by design so the ceiling widens for them. - Fix: Add a clear call to action near the top and the end of the page; trim repeated CTAs on prose pages. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/), [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/). - [ ] **11.25 Definition in the first 100 words (writing-framework signal)** - Pass: The first 100 words of the body contain a definition of the page topic. - Numbers and lists the tool uses: firstChunkHasDefinition checks the first 100 words; it is one of five 20-point signals in the writing-framework score (hedges <= 3 per 1K, jargon <= 1 per 1K, vague claims <= 1 per 1K, definitional opener, word count >= 600); score >= 80 green, >= 60 amber, below 60 red (Mega Analyzer). - Why: Opening with a plain definition gives readers and answer engines the quotable answer before the detail. - Fix: Start the body with one or two sentences that define the topic in plain words. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **11.26 Quantified claims** - Pass: The copy contains at least two numbers paired with real units such as customers, years in business, revenue or percentages. - Numbers and lists the tool uses: QUANTIFIED_RE /\b\d{2,}(?:,\d{3})*\+?\s*(?:customers|users|subscribers|clients|companies|cities|states|countries|projects|permits|installations|transactions|employees|team\s+members|years\s+(?:in\s+business|of\s+experience)|patients|students|downloads|deployments)\b|\$\d{1,3}(?:[.]\d{3})*[MBK]?\+?\s*(?:in|ARR|MRR|raised|revenue|saved|funding)|\b\d{1,2}(?:\.\d)?x\s+(?:faster|cheaper|more|better|growth)|\b\d{1,3}%\s+(?:faster|cheaper|smaller|of\s+)/i counted globally; pass at count >= 2 (Mega Analyzer). - Why: High-trust sites make specific, checkable claims instead of vague marketing copy. - Fix: Add at least two specific, verifiable numbers such as years in business, customers served or a measured result. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **11.27 `<n>` first-party-experience markers ("I tested", "we measured", etc.), HCU rewards demonstrated experience** - Pass: At least two distinct first-person experience patterns appear in the body (Mega SEO Analyzer), or first-person pronouns appear at least five times (E-E-A-T Analyzer). - Warn: Exactly one experience pattern (Mega SEO Analyzer), or one to four first-person pronouns (E-E-A-T Analyzer). - Fail: No experience pattern and no first-person pronoun at all. - Numbers and lists the tool uses: Mega SEO Analyzer patterns, each counted at most once: /\bI (tested|tried|measured|ran|built|wrote|saw|photographed|filmed)\b/i, /\bwhen I\b/i, /\bin my experience\b/i, /\bour team (tested|tried|measured|ran)\b/i, /\bwe (tested|tried|measured|ran|built)\b/i; pass >= 2, warn 1, fail 0. E-E-A-T Analyzer: /\b(i |my |we |our )/gi on lower-cased body text; pass >= 5, warn 1 to 4, fail 0. - Why: Google's helpful-content self-assessment asks whether the content clearly demonstrates first-hand experience. - Fix: Write in first person about what you tested, measured or built, and say what happened. - Verify: [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: Google Helpful Content self-assessment. - [ ] **11.28 `<n>` AI-boilerplate phrases detected, rewrite in concrete, named-tradeoff voice** - Pass: No AI-boilerplate phrase appears in the body. - Warn: One or two occurrences. - Fail: More than two occurrences. - Numbers and lists the tool uses: patterns /\bin today's fast-paced\b/i, /\bin the ever-evolving landscape\b/i, /\bnavigate the complexities\b/i, /\bdelve into\b/i, /\bin the realm of\b/i, /\bseamlessly integrate\b/i, /\bleverage (cutting-edge|state-of-the-art)\b/i, /\bunlock the (full )?potential\b/i, /\bharness the power\b/i, /\bplethora of\b/i, /\btestament to\b/i, /\bcornerstone of\b/i, /\bmultifaceted approach\b/i, /\bholistic (view|approach)\b/i, /\bparadigm shift\b/i; pass 0, warn 1 to 2, fail > 2 (Mega SEO Analyzer). - Why: These phrases are over-represented in pages demoted by Google's helpful-content updates. - Fix: Rewrite each flagged sentence in concrete language that names a real trade-off or fact. - Verify: [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). - [ ] **11.29 Ideal Customer Profile declared (industry + audience schema)** - Pass: The title, meta description, H1 or the first 3000 body characters name at least one target industry, or the JSON-LD declares an audience. - Warn: Neither an industry term nor audience schema is found. - Numbers and lists the tool uses: ICP_INDUSTRY = /\b(?:manufacturing|healthcare|legal|finance|accounting|retail|e-?commerce|saas|b2b|b2c|automotive|dealership|hospitality|restaurant|real estate|construction|agriculture|energy|utilities|insurance|pharmaceutical|biotech|government|nonprofit|education|logistics|aerospace|defense|consulting|law firm|medical practice|self-storage|property management|dental|veterinary|fitness|salon|spa)\b/gi on the lower-cased title, meta description, H1s and the first 3000 body characters, up to 5 distinct industries; audience schema when any JSON-LD block stringified matches /"audience"/i, /"Audience"/i or /"targetAudience"/i; severity warn; runs only on article pages: wordCount >= 800, looksLikeArticle (Article, BlogPosting or NewsArticle schema, or URL /\/blog\/|\/articles?\/|\/posts?\/|\/news\/|\/guides?\//, or >= 5 H2 with >= 1500 words and < 10 images) and not looksLikeLanding (path '/', or WebSite plus ItemList or CollectionPage, or >= 10 images with >= 3 H2) (Mega Analyzer). - Why: AI agents cannot route a query to your page unless it says who the page is for. - Fix: State 'for [industry] [size] in [geography]' in the copy and add schema.org/Audience; see /tools/ideal-customer-declaration-audit/. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org Audience. - [ ] **11.30 Audience-split navigation** - Pass: Two or more navigation links take the form 'For X' or 'I'm a X'. - Numbers and lists the tool uses: nav a, header a, [role="navigation"] a text matching /^(for\s+|i[' ]m\s+a|i\s+am\s+a)\s+\w+/i; pass at >= 2 matches (Mega Analyzer). - Why: Persona-based navigation makes clear who the product serves when the site speaks to distinct audiences. - Fix: Add 'For [audience]' navigation links when you serve more than one distinct audience. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **11.31 Human-in-the-loop / AI safety messaging** - Pass: The copy states that a human reviews or oversees AI output. - Numbers and lists the tool uses: /\b(human[- ]in[- ]the[- ]loop|human\s+review|nothing\s+(?:goes\s+out|ships)\s+without|human\s+oversight|reviewed\s+by\s+(?:a\s+)?human)\b/i (Mega Analyzer). - Why: Buyers of AI products want to know how humans check the output; the signal matters on AI product pages. - Fix: State plainly how humans review AI output before it reaches customers. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **11.32 Rich Image Content / Few Images / No Images Found** - Pass: The page has at least three images. - Warn: One or two images. - Fail: No images at all. - Numbers and lists the tool uses: img element count; pass >= 3, warn 1 to 2, fail 0 (E-E-A-T Analyzer). Keyword Inspection reports your img count next to the rounded competitor average with no threshold. - Why: Pages with no images usually lack the first-hand experience signals readers and raters look for. - Fix: Add original photos that show the work, the product or the place. - Verify: [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [Keyword Inspection](https://jwatte.com/tools/keyword-inspection/). - [ ] **11.33 Video intro <embedded|absent>** - Pass: The page contains a video element or an embedded video from YouTube, Vimeo, Wistia or Loom. - Numbers and lists the tool uses: video element or /youtube\.com\/embed|vimeo\.com|wistia\.com|loom\.com/ in the HTML; absence is reported as info (About Page Conversion Audit). Keyword Inspection counts video, iframe[src*="youtube"] and iframe[src*="vimeo"] elements against the rounded competitor average with no threshold. - Why: A 30 to 60 second founder intro lifts About page conversion 10 to 20 percent. - Fix: Embed a 30 to 60 second intro video if you can produce one. - Verify: [About-Page Conversion Audit](https://jwatte.com/tools/about-page-conversion-audit/), [Keyword Inspection](https://jwatte.com/tools/keyword-inspection/). - [ ] **11.34 Has data tables** - Pass: The page contains at least one HTML table. - Numbers and lists the tool uses: table count > 0 (Keyword Inspection). - Why: Tables are a rich-content signal that competing pages often use. - Fix: Add a table where competitors use one and you do not, for example a comparison or pricing table. - Verify: [Keyword Inspection](https://jwatte.com/tools/keyword-inspection/). - [ ] **11.35 Has 3plus lists** - Pass: The page contains three or more ul or ol lists. - Numbers and lists the tool uses: ul + ol count >= 3 (Keyword Inspection). - Why: Lists are a rich-content signal that competing pages often use. - Fix: Add lists where competitors use them and you do not. - Verify: [Keyword Inspection](https://jwatte.com/tools/keyword-inspection/). - [ ] **11.36 Email capture detected** - Pass: The HTML contains an email input, newsletter, subscribe or signup marker. - Warn: No email capture detected. - Numbers and lists the tool uses: /type=.email.|newsletter|subscribe|signup/i on the HTML (Analyzer). - Why: An email signup is one of the highest-return elements on any page. - Fix: Add a newsletter signup or email capture form. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **11.37 Primary CTA detected <near top|not in upper page area>** - Pass: A button or call-to-action link exists in the main, hero or first section of the page. - Warn: No CTA in the upper page area. - Numbers and lists the tool uses: selector 'main button, main a.btn, main .cta.hero a.hero button, header+section a' (About Page Conversion Audit). - Why: About pages should route visitors to the next step such as booking a call or seeing case studies, not just tell a story. - Fix: Place a clear CTA at the bottom of the first screen: 'Book a call', 'Start trial' or 'See case studies'. - Verify: [About-Page Conversion Audit](https://jwatte.com/tools/about-page-conversion-audit/). - [ ] **11.38 Origin story / mission <present|missing>** - Pass: The page contains origin-story or mission language. - Warn: No origin story or mission language found. - Numbers and lists the tool uses: /my story|our story|why (i|we) started|it began|origin|founded to|mission/i (About Page Conversion Audit). - Why: Narrative builds affinity, and the specific reason you started lands better than a generic mission statement. - Fix: Add a two-paragraph origin story about the specific reason you started. - Verify: [About-Page Conversion Audit](https://jwatte.com/tools/about-page-conversion-audit/). - [ ] **11.39 Values / principles section <present|absent>** - Pass: The page contains a values or principles section. - Numbers and lists the tool uses: /our values|our principles|what we believe|we.{0,8}believe/i; absence is reported as info (About Page Conversion Audit). - Why: Optional, but a values section converts well for buyers who choose on shared principles. - Fix: Add a short values or principles section. - Verify: [About-Page Conversion Audit](https://jwatte.com/tools/about-page-conversion-audit/). - [ ] **11.40 Affiliate density `<n>`% of all links (`<n>` affiliate / `<n>` total), HCU-demoted pattern when paired with thin insight** - Pass: Fewer than three affiliate-tagged links on the page. - Warn: Three or more affiliate links, each of which needs original 'why this over the alternative' reasoning. - Fail: Five or more affiliate links that make up more than 25 percent of all links. - Numbers and lists the tool uses: Mega SEO Analyzer: affiliate patterns /amazon\.com[^"'<>\s]+tag=/gi and /href=["'][^"']*[?&](?:aff_id|affid|affiliate|ref_tag|partner_id|tag=|a_aid=|clickref=|tid=|referrer_id=)[^"']*["']/gi; link count /<a [^>]+href=/gi; pass < 3, warn >= 3, fail >= 5 with density > 0.25. Analyzer: presence only, /amzn\.to|amazon\.com.*tag=|cj\.com|awin|impact\.com/i, reported as info either way. - Why: High affiliate density without original insight is a classic pattern in pages demoted by Google's helpful-content updates. - Fix: Pair each affiliate link with your own reasoning on why this product over the alternative, and cut links that add nothing. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). - [ ] **11.41 Your homepage is a login wall (about `<n>` words, `<n>` link(s), an auth form, and no marketing page)** - Pass: The homepage is a public marketing page, not just an authentication form. - Fail: The homepage has an auth form, under 180 words, six or fewer links and no marketing links. - Numbers and lists the tool uses: hasAuthForm = a password input, or signup and login wording with a form; word count < 180; link count <= 6; marketingLinks = /\b(pricing|features?|how[ -]it[ -]works|use[ -]cases?|customers?|testimonials?|about(?:[ -]us)?|our story|blog|docs?|documentation|contact)\b/i; applies to the homepage only (Mega Analyzer). - Why: A login-only homepage gives search engines and AI nothing to index or cite, so the product is invisible. - Fix: Build a public landing surface (home, how it works, features, pricing, FAQ, about, contact) and keep the app behind /app. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **11.42 Keyword Gaps** - Pass: No single word or two-word phrase used in the headings of enough competitor pages is missing from your title, H1, H2 and H3 headings. - Fail: A term is used in the headings of at least max(2, ceil(0.3 x competitors)) competitor pages and is absent from your headings; it is listed as 'body only' when it exists in your body text and 'missing entirely' otherwise. - Numbers and lists the tool uses: competitorsUsing >= Math.max(2, Math.ceil(comps.length * 0.3)); up to 40 single words and 40 phrases, combined table capped at 60 rows with phrases first; priority HIGH when the share of competitors using the term is >= 0.6, MED >= 0.4, LOW otherwise; shared strengths = terms in the headings of at least ceil(0.5 x competitors) that you already use, up to 20; heading text = title + H1s + H2s + H3s; tokenizer: lowercase, replace /[^a-z0-9\s-]/g with a space, split on /\s+/, keep tokens 3 to 40 characters that are not purely digits and not in STOP; bigrams from adjacent tokens, skipped when either token is a stop word; STOP = a about above after again against all also am an and any are aren as at be because been before being below between both but by can cant cannot could couldnt did didnt do does doesnt doing dont down during each few for from further had hadnt has hasnt have havent having he her here hers herself him himself his how however i ie if in into is isnt it its itself just lets me more most mustnt my myself no nor not of off on once only or other ought our ours ourselves out over own same shant she should shouldnt so some such than that thats the their theirs them themselves then there theres these they this those through to too under until up very was wasnt we well were werent weve what whats when where which while who whos whom why will with wont would wouldnt you your yours yourself yourselves one two three four five six seven eight nine ten use used using get got like make made new best top good great many much way ways thing things need needs really right first (Keyword Inspection). - Why: Terms that most of the top-ranking pages share in their headings are the ones search engines treat as core to the query. - Fix: Weave every HIGH-priority gap term naturally into your H1, H2, H3 and body without stuffing, then work down to MED and LOW. - Verify: [Keyword Inspection](https://jwatte.com/tools/keyword-inspection/). - [ ] **11.43 Heading Topics Your Page Is Missing** - Pass: Every competitor heading topic is matched by at least one of your H2 or H3 headings. - Fail: A competitor H2 uses topic tokens absent from every one of your H2s (Keyword Inspection), or a competitor topic cluster has no heading of yours with Jaccard similarity of 0.45 or higher (Heading Gap Audit). - Numbers and lists the tool uses: Keyword Inspection: competitor H2 headings whose tokens include at least one token not in your H2 token set, deduped by lowercased text, up to 30 rows with up to 6 novel tokens each. Heading Gap Audit: competitor H2 and H3 headings are grouped into clusters (a heading joins the first cluster whose canonical heading has Jaccard >= 0.5 with it, else starts a new cluster); headings normalized to lowercase with /[^a-z0-9 ]+/g replaced by a space; similarity is Jaccard over tokens longer than 2 characters; a cluster is covered when any of your headings has Jaccard >= 0.45 with its canonical heading; coverage percent = covered / clusters x 100 (100 when no clusters); the fix prompt lists the first 20 missing clusters and prioritizes those with >= 50 percent competitor coverage; up to 5 competitors. - Why: Subtopics the ranking pages all cover and you do not are the cheapest sections to add. - Fix: Add a new H2 with a one-paragraph, answer-shaped body for each missing topic that at least half the competitors cover; combine three or four related gaps into one deeper section where they overlap. - Verify: [Keyword Inspection](https://jwatte.com/tools/keyword-inspection/), [Heading Gap Audit](https://jwatte.com/tools/heading-gap-audit/). - [ ] **11.44 Unique to you** - Pass: No heading on your page sits outside every competitor topic cluster. - Warn: One of your H2 or H3 headings matches no competitor topic cluster; review it for differentiation versus tangent. - Numbers and lists the tool uses: uniqueMine = your headings where no cluster canonical has Jaccard >= 0.45; the fix prompt lists the first 10 (Heading Gap Audit). - Why: Unique topics are either genuine differentiation worth keeping or tangents that dilute the page. - Fix: Keep unique sections that serve the query and prune the ones that do not. - Verify: [Heading Gap Audit](https://jwatte.com/tools/heading-gap-audit/). - [ ] **11.45 `<n>` top-ranking phrases are completely missing from your page** - Pass: No term that several top-ranking pages use with meaningful weight is absent from your page. - Warn: One to ten missing terms, or any term you use at a lower rate than the competitor average. - Fail: More than ten missing terms. - Numbers and lists the tool uses: tokenizer /[a-z][a-z'-]{2,24}/g on lowercased text, length >= 3, not purely digits, not in STOPWORDS; bigrams from adjacent non-stopword tokens; tf = count / total tokens; idf = ln((N + 1) / (df + 1)) + 1 over competitor docs plus yours; tfidf = tfAvg x idf; a term counts only when >= 2 competitor docs contain it; missing = tfMy === 0, sorted by tfidf, top 25; thin = tfMy > 0 and tfAvg - tfMy > 0.002, top 15; your edge = tfMy > tfAvg, top 10; competitor pages come from the top DuckDuckGo results for the query, 3 to 10 documents (default 8), excluding your own host, text from main, article or [role="main"] else body with script, style, nav, footer, header, aside, noscript, iframe, svg, form removed, pages need > 200 characters; STOPWORDS = a, about, above, after, again, against, all, am, an, and, any, are, aren, as, at, be, because, been, before, being, below, between, both, but, by, can, cannot, could, couldn, did, didn, do, does, doesn, doing, don, down, during, each, few, for, from, further, had, hadn, has, hasn, have, haven, having, he, her, here, hers, herself, him, himself, his, how, i, if, in, into, is, isn, it, its, itself, just, me, might, more, most, must, my, myself, need, no, nor, not, now, of, off, on, once, only, or, other, ought, our, ours, ourselves, out, over, own, same, shall, shan, she, should, shouldn, so, some, such, than, that, the, their, theirs, them, themselves, then, there, these, they, this, those, through, to, too, under, until, up, very, was, wasn, we, were, weren, what, when, where, which, while, who, whom, why, will, with, won, would, wouldn, you, your, yours, yourself, yourselves, also, however, therefore, thus, hence, moreover, indeed, rather, perhaps, quite, even, still, yet, well, okay, get, got, getting, make, makes, making, made, one, two, three, four, five, many, much, like, likes, liked, liking, see, sees, seen, saw, want, wants, wanting, wanted, use, uses, used, using (Content Gap TF-IDF). - Why: The vocabulary gap between your page and the top-ranking set is the strongest predictor of which pages gain rank after publication. - Fix: Judge each missing phrase for relevance, drop boilerplate, weave the remaining 15 to 20 terms in naturally, add H2 or H3 sections for the topics they imply, and expand the sections behind thin terms. - Verify: [Content Gap TF-IDF Analyzer](https://jwatte.com/tools/content-gap-tfidf/). - [ ] **11.46 Word Count vs Avg** - Pass: Your body word count meets or exceeds the competitor average. - Warn: Shorter than the average by up to 500 words (Keyword Inspection), or between 70 and 100 percent of the average meaningful-token count (Content Gap TF-IDF). - Fail: Shorter than the average by more than 500 words (Keyword Inspection), or under 70 percent of the competitor average token count (Content Gap TF-IDF). - Numbers and lists the tool uses: Keyword Inspection: body text = body with script, style, nav, header, footer, aside, noscript, form removed; wordCount = split(/\s+/).length; avgWc = round(sum of competitor word counts / competitors), minimum and maximum also shown; depthGap = avgWc - yours; pass <= 0, warn 1 to 500, fail > 500; rewrite target ~max(avgWc, yours) words. Content Gap TF-IDF: avgWords = mean of post-stopword unigram token counts across parsed competitor pages; your count = your unigram plus bigram token count; ABOVE at >= 100 percent, within range at >= 70 percent, BELOW under 70 percent; emitted as an info finding, not scored. - Why: Ranking pages tend to be longer; the comparison shows how far you are from the average, minimum and maximum competitor length. - Fix: Extend the page toward the competitor average with genuine, relevant content, closing at least half the gap without padding. - Verify: [Keyword Inspection](https://jwatte.com/tools/keyword-inspection/), [Content Gap TF-IDF Analyzer](https://jwatte.com/tools/content-gap-tfidf/). - [ ] **11.47 Your domain present** - Pass: Your domain appears among the URLs extracted from the Bing results page for the query, shown as rank #n (SERP Feature Opportunity Matrix), or among the top 30 hostnames in the pasted Google SERP (SERP Features). - Fail: Not found in any URL extracted from the Bing results page (labelled 'not in top 10'), or absent from the top 30 hostnames, which the strategy prompt calls the first problem to solve. - Numbers and lists the tool uses: SERP Feature Opportunity Matrix: domain lowercased with https?:// stripped and only the first path segment kept; result URLs from a.result__url, a.result__a and a[href] in the Bing search HTML (https://www.bing.com/search?q=) with the uddg redirect parameter decoded and only http(s) kept; youRank = index of the first extracted URL whose hostname minus leading www. equals the domain, searched over the whole extracted list (only the first 10 URLs are stored, the rank search is not limited to them); rank shown as #index+1, otherwise 'not in top 10'; up to 6 queries. SERP Features: hostnames from /\/url\?(?:q|esrc)=(https?:\/\/[^&"<\s]+)/ig and /href="(https?:\/\/[^"]+)"/ig, leading www. stripped, excluding /^(google\.|googleusercontent|gstatic|googleadservices|googletag|doubleclick|youtube-nocookie|schema\.org|w3\.org|policies\.google|support\.google|accounts\.google|translate\.google|lens\.google|news\.google|maps\.google|docs\.google)/i, ranked by count, top 30 shown with your domain highlighted gold and tracked competitors blue; your domain normalized (trim, lowercase, strip scheme, www., path and trailing commas or whitespace); only evaluated when a domain is entered. - Why: If you do not appear in the results at all, no SERP feature is winnable until the page ranks. - Fix: Get the page into the top 10 organic results for the query before targeting its SERP features; the strategy prompt names the weakest competitor to displace in 90 days. - Verify: [SERP Feature Opportunity Matrix](https://jwatte.com/tools/serp-feature-opportunity-matrix/), [SERP Features](https://jwatte.com/tools/serp-features/). - [ ] **11.48 `<n>` competitor feature gap(s)** - Pass: You appear next to every SERP feature your tracked competitors appear next to. - Numbers and lists the tool uses: competitors split on /[\n,]+/, normalized, up to 10; window of 4000 characters on each side of every hostname match (regex '(?:www\.)?' + host with dots escaped, flags gi); feature presence tested with the 14 SERP feature signatures inside the window; gaps = union of competitor-adjacent features minus your adjacent features; only evaluated when your domain is entered; quick-fill presets: seo = ahrefs.com, semrush.com, moz.com, searchengineland.com, searchenginejournal.com; finance = nerdwallet.com, bankrate.com, investopedia.com, thepennyhoarder.com, smartasset.com; realestate = zillow.com, redfin.com, realtor.com, trulia.com, movoto.com; ecommerce = amazon.com, etsy.com, walmart.com, target.com, ebay.com; creator = substack.com, medium.com, linkedin.com, ghost.org, beehiiv.com (SERP Features). - Why: Sitting next to a feature is not proof of owning it, but it is a strong signal that a competitor holds the featured snippet, AI Overview citation or PAA answer you do not. - Fix: For each feature a competitor owns and you do not, write a one-paragraph content brief (title, H2 outline, word count, schema, CTA) and build it. - Verify: [SERP Features](https://jwatte.com/tools/serp-features/). - [ ] **11.49 Google Analytics detected** - Pass: GA4 or gtag markers appear in the HTML. - Warn: No Google Analytics detected. - Numbers and lists the tool uses: /gtag|GA4|G-[A-Z0-9]+|google-analytics|googletagmanager/i (Analyzer). - Why: GA4 is free and shows which pages and traffic sources actually work. - Fix: Add gtag.js: `<script async src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXXXXX">``</script>` plus gtag('config','G-XXXXXXXXXX'). - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **11.50 Behavior analytics detected** - Pass: Microsoft Clarity or Hotjar markers appear in the HTML. - Numbers and lists the tool uses: /clarity\.ms|clarity/i; /hotjar/i; absence is reported as info (Analyzer). - Why: Clarity (free) or Hotjar give heatmaps and session recordings that show where visitors get stuck. - Fix: Add Microsoft Clarity or Hotjar if you want behavior recordings. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **11.51 Payment/commerce integration detected** - Pass: A payment or commerce marker appears in the HTML. - Numbers and lists the tool uses: /stripe|paypal|gumroad|lemonsqueezy|shopify|woocommerce|buy.*button|add.*cart/i; absence is reported as info (Analyzer). - Why: If you sell products or services, a payment integration lets visitors buy without leaving the site. - Fix: Add a payment integration such as Stripe, Gumroad or Lemon Squeezy if you sell online. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **11.52 AdSense detected** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: /pagead|adsense|ca-pub/i; both presence and absence are reported as info (Analyzer). - Why: Display advertising is one of the revenue streams the tool checks for. - Fix: No action required; add display ads only if they fit your revenue model. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **11.53 AI-content disclosure marker detected, transparency signal for high-AI-content pages** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: /ai-?generated|written with (the help of |assistance of )?(AI|chatgpt|claude|gemini)|aiGenerated|"aiSource"/i (Mega SEO Analyzer). - Why: Disclosing AI-generated content is a transparency signal Google encourages but does not require. - Fix: No fix required; disclose AI assistance where it is material. - Verify: [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). - [ ] **11.54 Average external links** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: for each a[href]: new URL(a.href, pageUrl).hostname differs from the page hostname and the protocol matches /^https?:$/; competitor value = round(sum / competitors); no threshold (Keyword Inspection). - Why: Links to authoritative outside sources are compared as a content-quality signal. - Fix: Add citations to authoritative outside sources where competitors link out and you do not. - Verify: [Keyword Inspection](https://jwatte.com/tools/keyword-inspection/). - [ ] **11.55 `<funnel>` `<intent>` intent** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: nav = /\blogin\b|\bsign[- ]in\b|\bcontact\b|\bhomepage\b|\bwebsite\b/ or /^\s*[a-z][a-z0-9._-]{2,}\s*$/; trans = /\b(buy|price|pricing|cost|cheap|discount|coupon|promo|deal|near me|order|book|subscribe|download|free trial|sign up|checkout|demo)\b/; commercial = /\b(vs\.?|versus|compare|comparison|review(s)?|best|top|cheapest|alternative|alternatives)\b/; info = /^\s*(what|how|why|when|where|who|which|is|can|does|do|are|should|will)\b/ or /\b(guide|tutorial|example|explain(ed|ing)?|definition|meaning|learn)\b/; precedence: trans = Transactional, else commercial = Commercial Investigation, else info = Informational, else nav = Navigational, else Informational; funnel: Transactional = BOFU, Commercial Investigation = MOFU, otherwise TOFU (Keyword Inspection). - Why: Top-of-funnel searchers want depth and definitions, mid-funnel searchers want comparisons, and bottom-of-funnel searchers want pricing, features and a way to act. - Fix: Match the page to the stage: BOFU pages lead with pricing, features, CTAs and trust signals; MOFU pages lead with side-by-side tables, pros and cons and alternatives; TOFU pages lead with definitions, mechanism, examples and FAQ and save conversion CTAs for the end. - Verify: [Keyword Inspection](https://jwatte.com/tools/keyword-inspection/). - [ ] **11.56 Word count Δ** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: wd = to.words - from.words between two snapshots of the same URL; green when > 0, red when < 0, grey when 0; each snapshot records title, meta description, H1s, H2s, body word count (script, style, nav, header, footer, aside, noscript, form removed), distinct JSON-LD @type values, publish date (article:published_time, else meta name=date, else time[datetime]) and modified date (article:modified_time), stored under localStorage key 'cvm-history-v1' (Content Velocity). - Why: Word-count deltas between snapshots show when a page was expanded or trimmed. - Fix: Snapshot key pages on a schedule and review what changed in word count, headings, schema and dates. - Verify: [Content Velocity](https://jwatte.com/tools/content-velocity/). - [ ] **11.57 Features detected** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: SERP Features: presentCount out of 14 signatures in the pasted Google SERP; 8 or more features = feature-heavy where blue-link click-through drops sharply; 3 or fewer favors a link-click strategy; approximate organic results = distinct cite elements matching /^https?:|^[a-z0-9-]+\.[a-z]{2,}/i. SERP Feature Opportunity Matrix: up to 6 queries; a feature is green when it fires on at least half the queries, amber when on some, 'none' when on zero; features firing on ceil(queries / 2) or more are listed as opportunities to fix first. - Why: A feature-heavy results page leaves little room for classic links, but it is exactly where AI and GEO visibility is won. - Fix: Fix the features that fire on half or more of your target queries first; try question-shaped queries for PAA, product queries for Shopping and local queries for the Local Pack. - Verify: [SERP Features](https://jwatte.com/tools/serp-features/), [SERP Feature Opportunity Matrix](https://jwatte.com/tools/serp-feature-opportunity-matrix/). - [ ] **11.58 Featured Snippet** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: SERP Feature Opportunity Matrix (Bing preferred, DuckDuckGo fallback): /class="[^"]*b_snippet|class="[^"]*kp-wholepage|result--snippet|zCubwf|xpd/i. SERP Features (pasted Google HTML): /class="[^"]*\b(?:V3FYCf|g mnr-c|xpdopen|kno-rdesc)\b|data-md="0\b"|"featuredSnippet"|aria-level="2"[^>]*>Featured snippet/i. - Why: The position-zero box appears for the query, so a concise answer can win it. - Fix: Write a 40 to 60 word answer paragraph directly below the question H2, use list or table formatting when it fits, and add FAQPage, HowTo or Article schema with a speakable selector. - Verify: [SERP Feature Opportunity Matrix](https://jwatte.com/tools/serp-feature-opportunity-matrix/), [SERP Features](https://jwatte.com/tools/serp-features/). - [ ] **11.59 People Also Ask** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: /people also ask|related-questions-pair|\bPAA\b/i on the SERP HTML (SERP Feature Opportunity Matrix). - Why: The query triggers a People Also Ask box, so question-shaped headings can earn a slot. - Fix: Use H2 question headings that match real searches, answer in the first paragraph below each, and add FAQPage schema with 3 to 8 questions. - Verify: [SERP Feature Opportunity Matrix](https://jwatte.com/tools/serp-feature-opportunity-matrix/). - [ ] **11.60 Knowledge Panel** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: /class="[^"]*knowledge-panel|kp-header|b_ans/i on the SERP HTML (SERP Feature Opportunity Matrix). - Why: The query shows a knowledge panel, which entity schema and linked profiles can claim. - Fix: Publish Organization schema with a sameAs array to Wikipedia, Wikidata, LinkedIn and Crunchbase, and full identity on Organization, Person, Place or Event schema. - Verify: [SERP Feature Opportunity Matrix](https://jwatte.com/tools/serp-feature-opportunity-matrix/). - [ ] **11.61 Video Carousel** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: SERP Feature Opportunity Matrix: /video-carousel|VideoObject|thumbnail-div|class="[^"]*b_videoCluster/i. SERP Features: /class="[^"]*\bRzdJxc\b|"videoCarousel"|aria-label="Videos"/i. - Why: Google prefers video answers for the query, and a matching video tends to take half the attention. - Fix: Embed a YouTube video with a clear title, description and chapter markers on your own channel, and add VideoObject schema with thumbnailUrl, uploadDate, duration, description and contentUrl. - Verify: [SERP Feature Opportunity Matrix](https://jwatte.com/tools/serp-feature-opportunity-matrix/), [SERP Features](https://jwatte.com/tools/serp-features/). - [ ] **11.62 Image Pack** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: SERP Feature Opportunity Matrix: /class="[^"]*image-pack|isv-r|b_imgTbl|imagepack/i. SERP Features: /class="[^"]*\bezO2md\b|"imageResultGroup"|aria-label="Images"/i. - Why: The query returns an image-heavy results page. - Fix: Publish original images of 1,200px or more with descriptive alt text and file names next to a matching heading, add ImageObject schema and an image sitemap. - Verify: [SERP Feature Opportunity Matrix](https://jwatte.com/tools/serp-feature-opportunity-matrix/), [SERP Features](https://jwatte.com/tools/serp-features/). - [ ] **11.63 Local Pack** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: /class="[^"]*local-pack|maps-search-result|b_localPoi|local-results/i on the SERP HTML (SERP Feature Opportunity Matrix). - Why: The query shows a map pack, which a complete business profile and local schema can enter. - Fix: Claim and complete the Google Business Profile with regular posts and photos, and add LocalBusiness schema with address, telephone, openingHours and geo. - Verify: [SERP Feature Opportunity Matrix](https://jwatte.com/tools/serp-feature-opportunity-matrix/). - [ ] **11.64 Top Stories** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: SERP Feature Opportunity Matrix: /top-stories|topStories|class="[^"]*newsvertical|b_newsDisplay/i. SERP Features: /aria-label="Top stories"|data-hveid="CAA?QAA"|"topStoriesCarousel"/i. - Why: The query is treated as news, and only Google News publishers with NewsArticle markup appear in the box. - Fix: Register in Google News Publisher Center, publish daily, and use NewsArticle schema with datePublished, author and image. - Verify: [SERP Feature Opportunity Matrix](https://jwatte.com/tools/serp-feature-opportunity-matrix/), [SERP Features](https://jwatte.com/tools/serp-features/). Standard: schema.org NewsArticle. - [ ] **11.65 Shopping** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: SERP Feature Opportunity Matrix: /class="[^"]*shopping|product-carousel|sh-pr|b_commerceAds/i. SERP Features: /aria-label="(?:Shopping|Products?)"|"shoppingRelatedResults"|"productResultsGroup"/i. - Why: The query is commercial and shows product listings. - Fix: Set up a Google Merchant Center feed and Product schema with offers, price, availability, shippingDetails and hasMerchantReturnPolicy. - Verify: [SERP Feature Opportunity Matrix](https://jwatte.com/tools/serp-feature-opportunity-matrix/), [SERP Features](https://jwatte.com/tools/serp-features/). Standard: schema.org Product. - [ ] **11.66 Sitelinks** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: /sitelinks|b_jotop|sub-links|class="[^"]*site-link-container/i on the SERP HTML (SERP Feature Opportunity Matrix). - Why: Sitelinks appear for brands with a clear structure and strong brand signal. - Fix: Build a strong brand signal, clear site architecture and well-named internal pages, with BreadcrumbList and WebSite schema carrying a SearchAction. - Verify: [SERP Feature Opportunity Matrix](https://jwatte.com/tools/serp-feature-opportunity-matrix/). - [ ] **11.67 Twitter/X Carousel** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: SERP Feature Opportunity Matrix: /twitter-carousel|b_social|tweet-result|g-section-with-header/i. SERP Features: /aria-label="(?:Tweets|Posts)"|"twitterCarousel"/i. - Why: The query shows a social freshness carousel that an active account can fill. - Fix: Keep an active official X account matching the brand name, link it with rel=me and list it in Organization sameAs. - Verify: [SERP Feature Opportunity Matrix](https://jwatte.com/tools/serp-feature-opportunity-matrix/), [SERP Features](https://jwatte.com/tools/serp-features/). - [ ] **11.68 Podcasts** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: /podcast-badge|class="[^"]*podcasts/i on the SERP HTML (SERP Feature Opportunity Matrix). - Why: The query surfaces podcast results. - Fix: Submit the show to Apple Podcasts, Spotify and Google Podcasts, publish an RSS feed, and add PodcastSeries and PodcastEpisode schema. - Verify: [SERP Feature Opportunity Matrix](https://jwatte.com/tools/serp-feature-opportunity-matrix/). - [ ] **11.69 Recipes** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: /recipe-card|class="[^"]*recipe-result/i on the SERP HTML (SERP Feature Opportunity Matrix). - Why: The query returns recipe cards. - Fix: Publish a recipe card with ingredients, instructions, nutrition and rating, and add Recipe schema with recipeIngredient, recipeInstructions, nutrition and aggregateRating. - Verify: [SERP Feature Opportunity Matrix](https://jwatte.com/tools/serp-feature-opportunity-matrix/). - [ ] **11.70 AI Overview / Search Generative Experience** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: /data-sgrd=|data-async-context="query.+?aiOverview|aria-label="AI Overview"|"xpdOpen":true.*?hveid.*?"SGE"|data-md="AIOverview"|"sge_overview"|"aiOverview":\{/i on the pasted Google SERP HTML (SERP Features). - Why: An AI summary at the top of the results cuts traditional click-through 30 to 60 percent on queries where it fires. - Fix: Write clear factual claims, dense named entities, direct question-and-answer prose, structured data, a dateModified stamp, citation markup and llms.txt so the page is cited as a source. - Verify: [SERP Features](https://jwatte.com/tools/serp-features/). - [ ] **11.71 Things to know / Refine** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: /"thingsToKnow"|aria-label="Things to know"|"refineQueryList"/i on the pasted Google SERP HTML (SERP Features). - Why: Google surfaces multiple subtopics for explorer-style queries. - Fix: Cover the breadth of subtopics rather than going deep on one. - Verify: [SERP Features](https://jwatte.com/tools/serp-features/). - [ ] **11.72 Related searches** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: /Related searches|class="[^"]*\bK6fYtd\b|"relatedSearches"/i on the pasted Google SERP HTML (SERP Features). - Why: Bottom-of-page query expansions show what else searchers want. - Fix: Use the related searches as candidate H2 topics and related pages to build. - Verify: [SERP Features](https://jwatte.com/tools/serp-features/). - [ ] **11.73 Discussions and forums** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: /aria-label="Discussions and forums"|"discussionsAndForums"/i on the pasted Google SERP HTML (SERP Features). - Why: Google increasingly favors community discussion for these terms. - Fix: No remedy in the tool; the signal shows the query favors forum-style content. - Verify: [SERP Features](https://jwatte.com/tools/serp-features/). - [ ] **11.74 Business vertical detected** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: Order of evaluation: schema types first, then title, meta description and the first 5000 body characters; a schema match returns immediately; keyword-only YMYL-Health, YMYL-Legal and YMYL-Finance matches on editorial or tool sites (Blog, NewsArticle, BlogPosting, Article, Newsletter, TechArticle, ScholarlyArticle, Periodical, SoftwareApplication, WebApplication, NewsMediaOrganization, Dataset, DataCatalog, or a CollectionPage, ItemList or SearchResultsPage type with >= 3 schema types) need >= 5 keyword hits; restaurant keyword-only needs >= 3 hits; a keyword-derived YMYL, Local or E-commerce vertical is reset to SaaS-B2B or General when the schema declares NewsMediaOrganization, WebApplication, SoftwareApplication, Dataset, DataCatalog, Periodical, or ProfilePage plus Person, with no business-vertical schema present. Specialty sections scan the first 8000 (legal, CPA), 12000 (defense, home inspection, aviation, RIA), 14000 (homebuilder, restaurant), 16000 (laundromat, self-storage, car wash, e-commerce, butcher, HVAC, electrician, handyman) or 18000 (men's health clinic, B2B SaaS, hotel) body characters. Legal, CPA, defense, homebuilder, home inspection, aviation, RIA, laundromat, self-storage, car wash, handyman and men's health clinic fire when strong signals >= 2, or strong >= 1 and support >= 2; restaurant fires on a Restaurant-class schema type or strong >= 2; e-commerce on Product plus Offer schema or the same strong/support rule; butcher on >= 2 meat signals plus a commerce signal and not restaurant-only; HVAC and electrician on the trade schema type plus a trade keyword, or strong >= 2, or a trade title plus support >= 2, or a trade phrase plus >= 2 detected services; B2B SaaS on strong >= 2, or strong >= 1 and support >= 3, or a SoftwareApplication type plus support >= 2; hotel on a lodging schema type, or strong >= 2, or lodging plus booking keywords plus night, rate or stay in the body. Later sections stand down when an earlier one matched. Selectable verticals: General, E-commerce, SaaS-B2B, Local-Service, YMYL-Health, YMYL-Health-Dental, YMYL-Health-MentalHealth, YMYL-Health-Chiropractic, YMYL-Health-Optometry, YMYL-Health-Podiatry, YMYL-Health-MensClinic, YMYL-Legal, YMYL-Finance, YMYL-Finance-CPA, YMYL-Finance-RIA, Local-Restaurant, Local-RealEstate, Local-Storage, Local-SpecialtyInstaller, Local-Trades, Local-HVAC, Local-Electrician, Local-Handyman, Local-Homebuilder, Local-HomeInspection, Local-EventVenue, Local-Hospitality, Local-Fitness, Local-BeautyWellness, Local-Auto, Local-CarWash, Local-Laundromat, Local-OutdoorGuide, Local-Photography, Local-Pharmacy, Local-PetVet, Local-EducationInstitutional, Local-Education, Local-Cultural, Local-FuneralService, Local-Florist, Local-Childcare, Local-Tax, Local-CreativeServices, Local-Audiology, Local-PoolService, Local-EscapeGame, Local-TobaccoCigar, Local-CraftServices, Local-Retail, Local-ButcherDTC, Local-Religious, Local-Nonprofit, Local-Industrial, Local-SeniorCare, B2B-DefenseContractor, B2B-AviationLessor, B2B-Services-CX-BPO, YMYL-Insurance, B2B-FoodProcessor; the user override is stored per host under localStorage key jw-vertical-override:`<host>` (Mega Analyzer). The full per-vertical keyword and schema regex lists live in the tool source. - Why: The detected vertical decides which industry-specific checks, trust signals and fix prompts apply, so a wrong guess produces wrong advice. - Fix: Declare the specific schema.org business subtype so classification is driven by your markup rather than keywords, and pick the correct vertical in the Audit alignment bar when detection is wrong. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **11.75 README.md: Disclaimers** - Pass: Affiliate, sponsored or AI-generated content carries the required FTC disclosure, and traffic beyond host free tiers is budgeted. - Numbers and lists the tool uses: FTC 16 CFR Part 255; free-tier limits are per site (Netlify) or per project (other hosts); identity graph via ORCID, Amazon Author, Goodreads and LinkedIn rather than Wikidata. - Why: Cross-promoting sponsored content, affiliate offers or AI-generated text without disclosure breaks FTC rules, platform policies and consumer-protection law. - Fix: Add affiliate disclosures where required and budget for traffic that exceeds free tiers. - Verify: [Monoclone Gen.](https://jwatte.com/tools/monoclone-generator/). Standard: FTC 16 CFR Part 255. ## 12. Hosting, deployment and moving a site Where the files live decides several checks before you write a line. HTTPS on your own domain, cache headers that do not freeze a stale page, an uptime check that tells you before a customer does, and the rules for moving a site without losing what it had earned. **Verify this section with:** [Uptime + Response-Time Diagnostic](https://jwatte.com/tools/uptime-check/), [Site Analyzer](https://jwatte.com/tools/analyzer/), [SGE Readiness Audit](https://jwatte.com/tools/sge-readiness-audit/), [Mega Batch](https://jwatte.com/tools/mega-batch/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/), [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/), [Security Headers](https://jwatte.com/tools/security-headers-audit/), [AI Bot Policy Generator](https://jwatte.com/tools/ai-bot-policy-gen/), [Image Alt Audit](https://jwatte.com/tools/image-alt-audit/), [Migration Analyzer](https://jwatte.com/tools/migration-analyzer/), [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/), [Monoclone Gen.](https://jwatte.com/tools/monoclone-generator/), [DIY Uptime Alert Generator](https://jwatte.com/tools/diy-uptime-alert-generator/), [DNS Records Gen.](https://jwatte.com/tools/dns-records-generator/), [Platform Audit](https://jwatte.com/tools/platform-audit/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). - [ ] **12.1 HTTP status `<n>`** - Pass: The URL returns a 200 to 299 status. - Fail: The URL returns 400 to 499 (404 not found, 403 forbidden, 401 authentication required), 500 or higher, or cannot be reached; 300 to 399 renders info with the final URL. - Numbers and lists the tool uses: status buckets 200 to 299, 300 to 399, 400 to 499, 500 and above; special-cased 401, 403, 404. - Why: This is what a visitor sees right now, and a 5xx or no connection means the site is down for everyone. - Fix: For a persistent 5xx contact your host; for no connection check DNS and firewall rules. - Verify: [Uptime + Response-Time Diagnostic](https://jwatte.com/tools/uptime-check/). - [ ] **12.2 HTTPS enabled** - Pass: The page URL uses https:// and plain http:// requests redirect to the https:// version. - Fail: The https:// address does not answer at all (connection failure or 502) even though http:// does, or the URL is served over plain http. - Numbers and lists the tool uses: URL starts with https (Analyzer url.startsWith('https'); SGE Readiness Audit /^https:/i; Mega Batch isHttps); http:// must redirect to https:// at the hosting layer (Single Site Gen); Mega Analyzer treats a status of 0 or 502 on the https:// address of a bare domain as HTTPS unavailable and reports the http:// copy instead, while real 4xx or 5xx responses are reported as they are. - Why: HTTPS is a baseline trust signal for browsers, Google and AI answer engines, and non-secure pages are deprioritized by every AI answer system. - Fix: Turn on Force HTTPS in the hosting dashboard (Netlify, Vercel and Cloudflare offer one-click certificates) and redirect http to https. Netlify example: netlify.toml [[headers]] for = "/*" Strict-Transport-Security = "max-age=63072000; includeSubDomains; preload". - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [SGE Readiness Audit](https://jwatte.com/tools/sge-readiness-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega Batch](https://jwatte.com/tools/mega-batch/) and 1 more. - [ ] **12.3 `<n>`-hop redirect chain (`<label>`)** - Pass: Each tested variant (http://, the other www form, and /index.html) reaches the final page with no redirect or a single 301 to 308 redirect. - Warn: A variant takes more than one redirect hop before reaching the final page. - Numbers and lists the tool uses: Variants: http:// when the URL is https://, the non-www host when the hostname starts with www. (else the www host), /index.html when the path is /; redirect statuses 301 to 308; pass when the chain is 2 hops with a first status of 301 to 308 (label 'Single redirect for `<label>`') or 1 hop with a 2xx status ('No redirect needed for `<label>`'); warn when more than 2 hops; at most 5 hops followed; URLs displayed truncated to 50 characters. - Why: Every extra redirect hop slows the first response and wastes crawl budget. - Fix: Consolidate each chain into a single 301 redirect straight to the final URL. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **12.4 Canonical hostname matches served hostname** - Pass: The hostname in the canonical link equals the hostname of the final URL after redirects. - Numbers and lists the tool uses: Canonical hostname compared with the final URL hostname after redirects; provisional hosts exempt: /\.(netlify\.app|vercel\.app|pages\.dev|web\.app|firebaseapp\.com|github\.io|onrender\.com|fly\.dev)$/i. - Why: A canonical that points at a different host than the one actually serving the page tells search engines to index a different site. - Fix: Point the canonical at the served hostname (the www or non-www form the redirect lands on), not the address you typed; provisional hosts are not penalized during a DNS cutover. - Verify: [Batch Compare](https://jwatte.com/tools/batch-analyzer/). - [ ] **12.5 www preference consistent** - Pass: The canonical URL and the final served URL agree on whether the hostname starts with www. - Fail: The canonical uses one form (www or non-www) and the served URL uses the other; the Analyzer reports 'www redirect missing, canonical/URL conflict' as a fail and the Batch Analyzer docks the 15-point item. - Numbers and lists the tool uses: hostname.startsWith('www.') compared between canonical and served URL (Analyzer, Batch Analyzer); Analyzer runs this only when a canonical is present and the host is not provisional, and labels a redirected input 'www redirect working as intended'; Batch Analyzer exempts provisional hosts. - Why: When both www and non-www versions answer without a redirect, Google treats them as separate sites and splits your ranking signals, and Search Console reports 'Page with redirect' errors. - Fix: Pick one form and 301 redirect the other. Netlify: netlify.toml [[redirects]] from = "https://example.com/*" to = "https://www.example.com/:splat" status = 301 force = true (and the reverse for the other choice); Apache: RewriteCond %{HTTP_HOST} ^www\.example\.com [NC] then RewriteRule ^(.*)$ https://example.com/$1 [R=301,L]; Nginx: return 301; Vercel: host-based redirect in vercel.json; Cloudflare: _redirects. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/). - [ ] **12.6 Canonical uses HTTPS** - Pass: The canonical link's URL begins with https://. - Fail: The canonical href begins with http://; the Analyzer reports 'Canonical uses HTTP (not HTTPS)' as a fail and the Batch Analyzer docks the 10-point item. - Numbers and lists the tool uses: canonical protocol === 'https:' (Analyzer, Batch Analyzer). - Why: A canonical that names the http:// address while the page is served over HTTPS points search engines at the insecure copy. - Fix: Update the canonical href to https://. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Batch Compare](https://jwatte.com/tools/batch-analyzer/). - [ ] **12.7 Hosting config file carries headers, redirects and caching** - Pass: The site ships a hosting configuration file that sets security headers, redirects and caching rules for the platform it runs on. - Numbers and lists the tool uses: Config files by host in the generators (HOST_CFGS): Netlify netlify.toml; Vercel vercel.json; Cloudflare _headers + _redirects; GitHub Actions .github/workflows/deploy.yml; the deliverable is that file 'with headers, redirects, and caching rules'. The Analyzer hosting fix prompt asks for fixes for Netlify (netlify.toml), Vercel (vercel.json), Cloudflare Pages (_redirects/_headers), Apache (.htaccess) and Nginx (nginx.conf), and its AI fix prompt requires every warning to be checked against the deployment stack first because the audit reads static HTML plus a handful of aux files and cannot see CDN/origin headers, server-side redirects, edge middleware or environment-specific configs (headers set via _headers / netlify.toml / vercel.json / .htaccess / Cloudflare Rules / nginx.conf; robots/sitemap generated by the SSG build). - Why: Security headers, redirects and cache rules live at the hosting layer, so without a config file nobody is setting them. - Fix: Add the config file for your host (netlify.toml, vercel.json, _headers plus _redirects.htaccess or nginx.conf) and keep headers, redirects and caching in it; when an AI writes a fix, tell it which stack you run first. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Single Site Gen](https://jwatte.com/tools/single-site-gen/), [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/). - [ ] **12.8 Cache-Control** - Pass: The main page response includes a Cache-Control header. - Numbers and lists the tool uses: Header present (Security Headers Audit); Uptime Check reports the value or '(none)' as info. - Why: Explicit cache directives keep browsers and CDNs from caching pages in ways you did not intend. - Fix: Add a Cache-Control header, for example Cache-Control: public, max-age=3600, must-revalidate. - Verify: [Security Headers](https://jwatte.com/tools/security-headers-audit/), [Uptime + Response-Time Diagnostic](https://jwatte.com/tools/uptime-check/). - [ ] **12.9 Content-Type: `<type>`** - Pass: The final response's Content-Type header starts with text/html. - Numbers and lists the tool uses: /^text\/html/i; a non-HTML type is reported as info, not failed; no row when the header is empty. - Why: A page that is not served as HTML may be an API endpoint, feed or file, which browsers and crawlers treat differently. - Fix: Confirm the URL is meant to serve non-HTML; otherwise correct the server's Content-Type for the page to text/html. - Verify: [Uptime + Response-Time Diagnostic](https://jwatte.com/tools/uptime-check/). - [ ] **12.10 Web app manifest served** - Pass: A manifest file is served at /site.webmanifest or /manifest.json. - Warn: Neither /site.webmanifest nor /manifest.json is served. - Numbers and lists the tool uses: /site.webmanifest, /manifest.json. - Why: A manifest makes the site installable, adds Android home-screen shortcuts and helps Google Discover eligibility. - Fix: Ship /site.webmanifest (or manifest.json) and reference it with `<link rel="manifest">`. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **12.11 Web App Manifest found** - Pass: The HTML head contains link[rel="manifest"]. - Numbers and lists the tool uses: link[rel="manifest"]; a missing link is reported as info 'No Web App Manifest'. - Why: The link is what tells browsers where the manifest lives, so the file alone is not enough. - Fix: Add `<link rel="manifest" href="/site.webmanifest">` and fill the manifest with the app name, icons and theme color. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). - [ ] **12.12 Verification commands confirm robots.txt, ai.txt and /.well-known/ai.txt are live with expected per-bot content** - Pass: After deploy, /robots.txt, /ai.txt and (when the mirror is enabled) /.well-known/ai.txt return 200 and contain the expected per-bot rules. - Numbers and lists the tool uses: curl -sI `<origin>`/robots.txt | head -1; curl -s `<origin>`/robots.txt | head -5; the same pair for /ai.txt; curl -sI `<origin>`/.well-known/ai.txt | head -1 when the mirror is enabled; curl -s `<origin>`/robots.txt | grep -A2 "`<bot>`" for the first 5 bots in the catalog. - Why: A policy file that was generated but never deployed, or that the platform silently drops, does nothing. - Fix: Run the curl commands after deploying, then run the AI Posture Audit at https://jwatte.com/tools/ai-posture-audit/ to confirm every source agrees per bot. - Verify: [AI Bot Policy Generator](https://jwatte.com/tools/ai-bot-policy-gen/). - [ ] **12.13 Platform cannot host root files** - Pass: The site's platform can publish arbitrary files at the domain root, so the root-file checks apply normally. - Fail: The site runs on a platform that blocks arbitrary root files, so ai.txt, llms-full.txt, the /.well-known llms mirror, humans.txt, security.txt and AGENTS.md cannot be published and their checks are downgraded to 'platform limitation'. - Numbers and lists the tool uses: Platforms that cannot host root files: /^(Wix|Weebly|Linktree|Carrd|Substack|Beehiiv|ChamberMaster|Townsuite|Etsy Storefront|Bandzoogle|Constant Contact Landing|SmugMug|Pixieset|Spacecrafted|eCatholic|LPi WeConnect|OSV $Our Sunday Visitor$|Square Online)$/i; Pixieset fallback when nothing else matched: robots.txt names at least 6 of AhrefsBot, BLEXBot, BUbiNG, dotbot, MJ12bot, PetalBot, SemrushBot, SiteAuditBot, SMTBot and has a wildcard Crawl-delay 1 matching /user-agent\s*:\s*\*\s*\n\s*crawl-delay\s*:\s*1\b/im. - Why: On these platforms a missing root file is a limitation of the platform, not a choice you made, and no amount of editing will fix it. - Fix: Migrate to a static host (Netlify, Cloudflare Pages or Vercel) if you need to publish root files. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **12.14 Server Content-Type matches expected image type (`<ct>`)** - Pass: A direct image URL is served with a Content-Type that begins with image/. - Warn: The image URL returns a Content-Type that is present but is not an image type (label: URL ends in .`<ext>` but server returned Content-Type "`<ct>`"). - Numbers and lists the tool uses: Content-Type ^image\/. - Why: When the host labels an image file with the wrong type, browsers may refuse to render it. - Fix: Correct the MIME type mapping on the host for that image extension. - Verify: [Image Alt Audit](https://jwatte.com/tools/image-alt-audit/). - [ ] **12.15 Abandoned-site technology fingerprints** - Pass: The HTML contains none of the legacy shims and library versions in the list. - Fail: The HTML matches at least one fingerprint (html5shiv, selectivizr, respond.js, IE conditional comments, jQuery 1.x or 2.0, Bootstrap 2.x or 3.x, AngularJS 1.x); reported as a critical fail listing the detected fingerprints. - Numbers and lists the tool uses: html5shiv|html5shim; selectivizr; respond(.min).js; IE conditional comments /<!--\s*\[if\s+(lt\s+)?IE/i; jQuery /jquery[\/.-](1\.\d+|2\.0)/i; Bootstrap /bootstrap[\/.-](2\.\d+|3\.\d+)/i; AngularJS /angular\.js\/1\.|angularjs\/1\./i. - Why: Legacy shims for Internet Explorer and old library versions signal a site nobody maintains. - Fix: Remove the IE shims and upgrade jQuery, Bootstrap and AngularJS to current versions. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **12.16 Site appears hand-rolled and predates HTML5 + JSON-LD** - Pass: The site is not flagged as a pre-2015 hand-rolled build. - Warn: An XHTML 1.0 or HTML 4 doctype is combined with jQuery 1.x or 2.0 or a nested layout table, and the page has no JSON-LD script; reported as a warn advisory. - Numbers and lists the tool uses: Doctype in the first 500 characters /<!DOCTYPE\s+html\s+PUBLIC\s+["']-\/\/W3C\/\/DTD\s+(?:XHTML\s+1\.0|HTML\s+4)/i AND (jQuery version /^[12]\./ taken from the /jquery[\/.-](1\.\d+|2\.0)/i match OR a nested `<table>` /<table[^>]*>[\s\S]*<table/i in the first 8000 characters) AND no `<script type="application/ld+json">`; the 'no recognized CMS' condition appears only in the code comment and the advisory text, not in the boolean. - Why: When the stack itself is that old, most other failures are downstream of it and patching them one by one is not worth the effort. - Fix: Rebuild on a modern static generator (Eleventy, Astro, Hugo or Jekyll); see /tools/static-site-rebuild-guide/. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **12.17 Vendor-locked platform: `<value>` (`<vertical>`)** - Pass: The site does not run on an industry-specific vendor platform. - Warn: The site runs on a vendor platform built for one industry, so content export may require the vendor's cooperation and proprietary widgets will not transfer. - Numbers and lists the tool uses: Migration Analyzer: Dental ProSites, Officite, Sesame Communications, PBHS, Smile Marketing, Dental Branding; Legal FindLaw, Justia, Scorpion, Mockingbird; Restaurant BentoBox, Toast, Popmenu, ChowNow; Real estate Placester, Real Geeks, Sierra Interactive, IDX Broker. Site Migration Gen: vendor-dental ProSites, Officite; vendor-legal FindLaw, Justia, Scorpion; vendor-restaurant BentoBox, Toast; vendor-realestate Placester, Real Geeks. - Why: Industry vendors hold your content and widgets inside their platform, which makes leaving expensive. - Fix: Before any migration, ask the vendor for a content export and plan replacements for widgets that will not move with you. - Verify: [Migration Analyzer](https://jwatte.com/tools/migration-analyzer/), [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/). - [ ] **12.18 Double-CDN detected: `<cdn>` → `<cdn>`** - Pass: At most one CDN request-id header appears on the response. - Warn: Two or more CDN request-id headers appear on one response, meaning one CDN is fronting another. - Numbers and lists the tool uses: >= 2 of: cf-ray (Cloudflare), x-nf-request-id (Netlify), x-vercel-id (Vercel), x-amz-cf-id (AWS CloudFront), fly-request-id (Fly.io). - Why: Stacking one CDN in front of another adds cache-coherence problems, doubles the IP-trust chain and can hide rate limiting. - Fix: Confirm the layering is intentional (for example Cloudflare for bot protection in front of Netlify as origin) and that both layers' cache rules agree; see /blog/blog-netlify-waf-vs-cloudflare-double-cdn/. - Verify: [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). - [ ] **12.19 301 REDIRECT MAP** - Pass: Every old URL maps to its new URL in the host's native redirect format, every redirect returns 301 (not 302 or 307), and a catch-all sends unknown old paths to the homepage. - Numbers and lists the tool uses: First 15 internal links listed in the map; wildcard rule for /blog/YYYY/MM/slug patterns; status 301 only; formats: _redirects or [[redirects]] in netlify.toml, vercel.json, _redirects (Cloudflare).htaccess or Actions (GitHub). - Why: A migration without a complete 301 map breaks inbound links and throws away the ranking equity the old URLs earned. - Fix: Write the old-to-new map in the host's redirect file before cutover and make every entry a 301. - Verify: [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/). - [ ] **12.20 WordPress plugins detected: `<n>`** - Pass: Five or fewer distinct plugins are referenced from /wp-content/plugins/. - Warn: More than 5 distinct plugins are detected. - Numbers and lists the tool uses: Distinct /wp-content/plugins/`<name>`/ paths; warn when > 5. - Why: Every plugin is code someone else maintains and a feature that has to be rebuilt if you leave WordPress. - Fix: Remove plugins you do not use and note which remaining ones would need a replacement in a migration. - Verify: [Migration Analyzer](https://jwatte.com/tools/migration-analyzer/). - [ ] **12.21 Portable assets: `<n>` / `<n>`** - Pass: At least 60 percent of detected assets are portable to another platform. - Warn: Between 40 and 59 percent of assets are portable. - Fail: Under 40 percent of assets are portable. - Numbers and lists the tool uses: contentPortability = portable / total * 100; pass >= 60, warn 40 to 59, fail < 40. - Why: The share of images, styles and content you can take with you decides how painful a platform move would be. - Fix: Export with the platform's native path: WordPress WXR export plus /wp-content/uploads/ (wp2md, ACF to frontmatter); Squarespace WXR export plus /s/ assets; Webflow Export Code zip plus the API for CMS items; Shopify Storefront API plus CDN images (checkout cannot be static); Wix has no native export so pull from static.wixstatic.com; unknown platforms via wget --mirror or httrack; convert images to WebP or AVIF, preserve alt text and keep a slug map. - Verify: [Migration Analyzer](https://jwatte.com/tools/migration-analyzer/), [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/). - [ ] **12.22 Vendor-locked assets: `<n>`** - Pass: No asset is classified vendor-locked. - Warn: 1 to 3 vendor-locked assets are detected. - Fail: More than 3 vendor-locked assets are detected. - Numbers and lists the tool uses: A detected vertical vendor platform (ProSites, Officite, Sesame Communications, PBHS, Smile Marketing, Dental Branding, FindLaw, Justia, Scorpion, Mockingbird, BentoBox, Toast, Popmenu, ChowNow, Placester, Real Geeks, Sierra Interactive, IDX Broker) counts as one; external scripts matching shopify|squarespace|wix|webflow|hubspot; iframes other than google.com/maps, maps.google, youtube, vimeo or wistia; forms whose action matches wufoo|typeform|jotform|formspree|hubspot|salesforce|pardot; warn 1 to 3, fail > 3. - Why: Vendor-locked scripts, embeds and forms stop working the day you leave the vendor. - Fix: Replace locked features with open equivalents: forms with Netlify Forms or Formspree; analytics with GA4, Plausible or Umami; image CDN with Cloudinary or imgix; booking with Cal.com or Calendly; chat with Tawk.to or Crisp; maps with Google Maps or Leaflet plus OpenStreetMap; reviews as static cards with Review schema; food ordering as a static menu plus DoorDash or UberEats links; property search via an IDX iframe. - Verify: [Migration Analyzer](https://jwatte.com/tools/migration-analyzer/), [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/). - [ ] **12.23 Platform-dependent assets: `<n>`** - Pass: No asset is classified platform-dependent. - Warn: 1 to 5 platform-dependent assets are detected. - Fail: More than 5 platform-dependent assets are detected. - Numbers and lists the tool uses: Images hosted on squarespace-cdn|wixstatic|cdn.shopify|webflow; external scripts that match neither the vendor widget list shopify|squarespace|wix|webflow|hubspot nor the tracking list google|facebook|hotjar|clarity|segment|mixpanel|amplitude; stylesheets matching squarespace|wix|webflow|shopify|hubspot; every WordPress plugin; the WordPress theme; forms whose action does not match wufoo|typeform|jotform|formspree|hubspot|salesforce|pardot (shown as (inline) when the action is empty); warn 1 to 5, fail > 5. - Why: Platform-dependent assets can be moved but each one needs rework during a migration. - Fix: Copy vendor-CDN images and CSS into your own repo and rebuild plugin-driven features as static equivalents. - Verify: [Migration Analyzer](https://jwatte.com/tools/migration-analyzer/). - [ ] **12.24 Vendor lock-in score: `<n>` / 100** - Pass: The lock-in score is 20 or below. - Warn: The lock-in score is 21 to 50. - Fail: The lock-in score is above 50. - Numbers and lists the tool uses: (vendorLocked*3 + platformDep*1.5) / (total*3) * 100; pass <= 20, warn 21 to 50, fail > 50; gauge red >= 60, amber >= 30. - Why: A single number for how much of the site would have to be rebuilt to leave the current platform. - Fix: Reduce the vendor-locked and platform-dependent asset counts above; the score follows them. - Verify: [Migration Analyzer](https://jwatte.com/tools/migration-analyzer/). - [ ] **12.25 Overall migration readiness: `<n>` / 100** - Pass: The readiness score is 70 or above. - Warn: The readiness score is 45 to 69. - Fail: The readiness score is below 45. - Numbers and lists the tool uses: contentPortability*0.25 + urlRiskScore*0.2 + seoEquity*0.2 + (100 - vendorLock)*0.2 + techComplexity*0.15; pass >= 70, warn 45 to 69, fail < 45; gauge red < 40, amber < 70; technical simplicity starts at 85 with deductions: -15 when WordPress plugins > 5 (else -8 when > 2), -10 when iframes > 3, -10 when forms > 2, -10 when external scripts > 10, -20 for a vendor platform, -15 for e-commerce, clamped 0 to 100. - Why: Combines portability, URL risk, SEO equity, lock-in and technical complexity into one readiness figure. - Fix: Plan a phased migration with a redirect map, starting with the components that drag the score down. - Verify: [Migration Analyzer](https://jwatte.com/tools/migration-analyzer/). - [ ] **12.26 Content type: `<value>`** - Pass: The site is classified static or dynamic. - Warn: The site is classified e-commerce, the most complex kind of migration. - Numbers and lists the tool uses: ecommerce when the platform family is ecom; dynamic when forms > 1 or WordPress plugins > 3; otherwise static. - Why: E-commerce migrations carry checkout, inventory and customer data that a static rebuild cannot hold. - Fix: Informational; treat an e-commerce site as its own migration project. - Verify: [Migration Analyzer](https://jwatte.com/tools/migration-analyzer/). - [ ] **12.27 Ads & Consent Mode v2** - Pass: Consent Mode loads before any Google tag, and AdSense, Mediavine or Ezoic ad scripts are gated on the consent dialog. - Fail: A Google tag or ad script loads before Consent Mode. - Numbers and lists the tool uses: Per-site adsenseId, gaId, clarityId fields drive the tags (Monoclone Generator). - Why: Tags that fire before consent is recorded collect data you may not be allowed to collect. - Fix: Insert the Consent Mode default call ahead of gtag and wrap ad loaders in the consent callback. - Verify: [Monoclone Gen.](https://jwatte.com/tools/monoclone-generator/). Standard: Google Consent Mode v2. - [ ] **12.28 .gitignore** - Pass: The repo's .gitignore excludes build output, caches and secret files. - Numbers and lists the tool uses: node_modules/, dist/, _site/.DS_Store.env.env.local.netlify/.vercel/.wrangler/.cache/.eleventy.cache/.astro/.next/, public/, resources/. - Why: Build output and .env secrets must never be committed. - Fix: Copy the list into .gitignore at the repo root. - Verify: [Monoclone Gen.](https://jwatte.com/tools/monoclone-generator/). - [ ] **12.29 Continuous uptime monitoring with alerts** - Pass: A monitor requests the site on a fixed interval and alerts a person by email, Slack or push when the response is an error or a timeout, then reports recovery. - Numbers and lists the tool uses: Interval default 5 minutes, allowed 1 to 60 (DIY Uptime Alert Generator; Uptime Check suggests every 5 minutes and names UptimeRobot (free), StatusCake (free tier), BetterUptime, Pingdom); Netlify scheduled function and Vercel cron fetch with AbortSignal.timeout(10000) and alert when HTTP status >= 400; Cloudflare Worker fetches with cf: { cacheTtl: 0 } and no timeout, alerting on status >= 400 or a fetch exception; curl -fsS --max-time 10 in GitHub Actions and shell; Netlify netlify.toml [functions."uptime-check"] schedule = "*/`<interval>` * * * *" with node_bundler esbuild; Vercel vercel.json crons path /api/uptime-check, requires the Pro plan ($20/mo); Cloudflare Worker scheduled() on a */`<interval>` * * * * cron trigger with MailChannels https://api.mailchannels.net/tx/v1/send from alerts@yoursite.com (SPF TXT v=spf1 a mx include:relay.mailchannels.net ~all); GitHub Actions cron */`<interval>` * * * * or 0 */`<hours>` * * * when interval >= 60, about 5 to 10 minute real granularity, actions/github-script@v7 opens an issue '[ALERT] `<url>` is down', dawidd6/action-send-mail@v3 via smtp.gmail.com:465 with secrets SMTP_USERNAME and SMTP_PASSWORD; shell script /usr/local/bin/uptime-check.sh alerts only on state change using /var/tmp/uptime-state-`<md5 of URL>` (LAST_STATE defaults to up), logs to /var/log/uptime-check.log, needs mailutils or mailx plus an SMTP relay (Mailgun free 100/day, AWS SES $0.10/1000, postfix to smtp.gmail.com); Uptime Kuma louislam/uptime-kuma:1 on port 3001, HTTP(s) monitor with heartbeat interval*60 seconds and Retries 2, status page behind Caddy reverse_proxy localhost:3001; Gatus twinproduction/gatus:latest on port 8080, endpoint interval `<interval>`m with conditions [STATUS] == 200, [RESPONSE_TIME] < 2000 and [CERTIFICATE_EXPIRATION] > 48h, failure-threshold 2, send-on-resolved true, sqlite /data/data.db, SMTP port 587, under 20MB memory; Prometheus prom/prometheus (9090) + prom/alertmanager (9093) + prom/blackbox-exporter (9115), module http_2xx, scrape and evaluation interval `<interval>`m, rule group interval 1m with alerts SiteDown (probe_success == 0 for 2m, severity critical), TLSExpiringSoon (probe_ssl_earliest_cert_expiry - time() < 86400 * 14 for 10m, severity warning) and SlowResponse (probe_http_duration_seconds > 3 for 5m, severity warning), Alertmanager group_wait 30s, group_interval 5m, repeat_interval 4h, Slack channel #alerts, Grafana dashboard 7587, minimum 1GB RAM; Monit daemon cycle interval*60 seconds with start delay 10, httpd port 2812 localhost only, check host port 443 protocol https timeout 10 seconds for 2 cycles, about 2MB RAM; ntfy push with headers Title, Priority urgent, Tags warning,red_circle to https://ntfy.sh/`<topic>`, self-host with binwiederhier/ntfy; recommended hybrid: shell+cron on a $5/mo VPS plus native deploy notifications. - Why: A one-shot diagnostic tells you the site was up at that moment; only a monitor tells you when it goes down. - Fix: Set up a monitor (a hosted service, a scheduled function on your host, a GitHub Actions workflow or a cron script on a small VPS) that checks every 5 minutes and alerts on a non-200 response; require two consecutive failures before paging to avoid single-blip alerts. - Verify: [Uptime + Response-Time Diagnostic](https://jwatte.com/tools/uptime-check/), [DIY Uptime Alert Generator](https://jwatte.com/tools/diy-uptime-alert-generator/). - [ ] **12.30 Deploy failure notifications** - Pass: The host emails (and optionally Slacks) on failed deploys, and form submissions notify you. - Numbers and lists the tool uses: Netlify: Deploy succeeded and Deploy failed events to the alert email, outgoing webhook on Deploy failed to /.netlify/functions/alert-on-deploy-failure, form notifications on every submission; Vercel: Failed deployments email, deployment.failed webhook to /api/alert-on-deploy-failure; free on both hosts' free tiers. - Why: A broken deploy can leave the old build live or the site down without anyone noticing. - Fix: Netlify: Site settings, Build & deploy, Deploy notifications, Add notification, and Site settings, Forms, Form notifications. Vercel: Project settings, Notifications, and Project settings, Git, Deployment Notifications. - Verify: [DIY Uptime Alert Generator](https://jwatte.com/tools/diy-uptime-alert-generator/). - [ ] **12.31 Scheduled jobs report to a dead-man's switch** - Pass: Each cron job (backups, batch jobs, sitemap pings, certificate renewals) pings a Healthchecks check on success and its /fail endpoint on failure, and a missed ping raises an alert. - Numbers and lists the tool uses: curl -fsS -m 10 --retry 3 https://healthchecks.yoursite.com/ping/`<uuid>` (and /ping/`<uuid>`/fail); example crontab 0 3 * * * /usr/local/bin/nightly-backup.sh; self-hosted image healthchecks/healthchecks:latest on port 8000, EMAIL_PORT 587, SECRET_KEY from openssl rand -hex 32, 512MB+ VPS (~$5/mo); hosted healthchecks.io free tier 20 checks. - Why: Things that should keep running fail silently, so a missed ping is treated as a real incident. - Fix: Create a check per job and append the ping curl to each job; use shell+cron or Gatus alongside it for active HTTP checks of the site itself. - Verify: [DIY Uptime Alert Generator](https://jwatte.com/tools/diy-uptime-alert-generator/). - [ ] **12.32 Monit (classic Unix): filesystem and system checks** - Pass: On a self-hosted server, root filesystem usage stays at or below 90 percent, the 5-minute load average at or below 4 and memory usage at or below 90 percent. - Numbers and lists the tool uses: space usage > 90% on /; loadavg (5min) > 4; memory usage > 90%. - Why: A full disk or exhausted memory takes the site down before an HTTP check notices. - Fix: Free disk space or add capacity when the alert fires. - Verify: [DIY Uptime Alert Generator](https://jwatte.com/tools/diy-uptime-alert-generator/). - [ ] **12.33 DNS records applied at the provider** - Pass: Records are entered in the provider's native format with TXT values quoted, long TXT values split into strings of at most 255 characters, Cloudflare proxying off for TXT, MX and CAA, and the SOA serial incremented after every zone change. - Numbers and lists the tool uses: BIND: name padded to 24 columns, TTL default 3600, TXT values over 257 characters split into 250-character quoted chunks in parentheses (255 character per-string limit), inner quotes escaped, CAA rendered as flag tag "value", increment the SOA serial; Cloudflare Terraform provider v4+ with proxied = false (must be false for TXT, MX, CAA), MX split into host without trailing dot plus priority, CAA parsed with /^(\d+)\s+(\S+)\s+"(.*)"$/; DigitalOcean doctl compute domain records create with --record-type, --record-name, --record-data, --record-priority (MX), --record-flags and --record-tag (CAA), --record-ttl, after doctl auth init with a PAT that has write on domains; DigitalOcean does not sign DNSSEC natively; AWS Route53 change batch with Action UPSERT and names ending in a trailing dot, applied with aws route53 change-resource-record-sets --hosted-zone-id `<id>` --change-batch file://changes.json; Google Cloud DNS gcloud dns record-sets transaction start, add and execute with --zone after gcloud dns managed-zones create. - Why: A DNS record typed in the wrong format, or proxied when it must not be, silently breaks email authentication and certificate issuance. - Fix: Use the generator's output for your provider, keep Cloudflare proxying off for TXT, MX and CAA, and bump the SOA serial after every change. - Verify: [DNS Records Gen.](https://jwatte.com/tools/dns-records-generator/). - [ ] **12.34 Cloudflare deployment model and bindings (wrangler.toml)** - Pass: Wrangler.toml declares either pages_build_output_dir (Pages) or main (Worker), never both, pins compatibility_date, adds the nodejs_compat flag if needed, and every secret change is followed by a redeploy. - Numbers and lists the tool uses: cf-model: pages (default), pages-worker, worker; bindings D1 and KV default on, R2, Durable Objects, Queues, Workers AI / Vectorize default off; D1 parameterized queries, additive migrations, migrations list --remote before deploy; KV eventually consistent (~60s, ~1 write/sec per key), fail open; Durable Objects SQLite-backed 10GB per object; deploy order: deploy, set secrets, deploy again; Worker first then Pages vars; ALTER TABLE migrations snapshot first and guard backfills WHERE IS NULL; custom domain via dashboard with proxied DNS; README documents order, var names and post-deploy checks; Cloudflare projects add wrangler.toml, _headers, _redirects.dev.vars.example, migrations/. - Why: Secrets are not live until a deploy after they are set, and mixing Pages and Worker settings in one config breaks the build. - Fix: Pick one deployment model, pin compatibility_date, and redeploy after setting secrets. - Verify: [Single Site Gen](https://jwatte.com/tools/single-site-gen/). Standard: Cloudflare Workers/Pages docs. - [ ] **12.35 Site MUST pass jwatte.com audit suite on first deploy** - Pass: After launch or migration the site scores mega-analyzer >= 90, analyzer >= 90, eeat-analyzer >= 85, ai-citation-readiness 14/14, mobile-parity 100 percent, and link-graph shows no orphans or dead ends. - Numbers and lists the tool uses: 90, 90, 85, 14/14, 100%; migration: run site-migration-capture on the new site against the source manifest (every page, image, heading and schema block in the manifest must appear), spot-check 5 old URLs for a 301, compare Google cache old vs new; the build prompt lists which jwatte.com/tools/ audits to run. - Why: Score targets turn 'the site is live' into 'the site is verified'. - Fix: Run the named audits after deploy and fix anything below target before announcing the site. - Verify: [Single Site Gen](https://jwatte.com/tools/single-site-gen/), [Site Migration Gen](https://jwatte.com/tools/site-migration-gen/). - [ ] **12.36 Multi-site network: varied HTML shells, registrars and launch timing** - Pass: Sites in a network rotate three header and footer skins with visibly different HTML structure, spread domains across registrars and registration dates, and stagger deploys over the first 30 to 90 days. - Fail: All domains registered at one registrar in one sitting, all sites deployed the same day, or every site sharing one identical HTML shell. - Numbers and lists the tool uses: skins ['a','b','c'] rotated (i-1)%3, recommended for 10+ sites; registrars named: Porkbun, Cloudflare Registrar, Namecheap, Google Domains successor; registrations spread across several weeks; deploys across the first 30 to 90 days. - Why: Template, IP, registrar and burst-publishing fingerprints are what identify a network to search engines. - Fix: Build one site, ship it, measure, then expand; create three header and footer variants and rotate them per site; rotate registrars and stagger launches. - Verify: [Monoclone Gen.](https://jwatte.com/tools/monoclone-generator/). - [ ] **12.37 Online Store 2.0 JSON templates + section groups** - Pass: The Shopify theme uses templates/*.json, section groups or {% sections %}. - Warn: None of the Online Store 2.0 markers are found, indicating a Vintage (pre-2021) theme. - Numbers and lists the tool uses: templates/*.json, section_groups or {% sections %}. - Why: Section groups and JSON templates let you edit the header and footer without touching code. - Fix: Upgrade to an Online Store 2.0 theme. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **12.38 Shop Pay button present** - Pass: The Shopify storefront HTML references shop-pay, shop_pay or shopify_pay. - Numbers and lists the tool uses: shop-pay|shop_pay|shopify_pay. - Why: Shop Pay typically lifts mobile conversion by 10 to 15 percent. - Fix: Admin > Settings > Payments > Shop Pay. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **12.39 Multi-currency / country selector** - Pass: The Shopify storefront references /cdn/shop/files/flag, country_selector or enabled_currencies. - Numbers and lists the tool uses: /cdn/shop/files/flag|country_selector|enabled_currencies. - Why: Signals whether Shopify Markets is switched on for international buyers. - Fix: Turn on Shopify Markets. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **12.40 Checkout Extensibility** - Pass: Checkout_extensibility or extensions/checkout appears in the Shopify storefront HTML. - Numbers and lists the tool uses: checkout_extensibility or extensions/checkout. - Why: Checkout.liquid is deprecated for Shopify Plus. - Fix: Verify checkout extensibility in the admin. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **12.41 Eleventy version `<n>`** - Pass: The generator meta reports Eleventy major version 3 or higher. - Warn: The Eleventy major version is below 3. - Numbers and lists the tool uses: generator meta Eleventy v<major.minor>; warn when major < 3. - Why: 3.x is the modern ESM-first line. - Fix: Upgrade to Eleventy 3.x. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **12.42 Gatsby page-data prefetch / webpack-runtime** - Pass: /page-data/*.json prefetch is found. - Numbers and lists the tool uses: /page-data/*.json; webpack-runtime-`<hash>`.js. - Why: Missing page-data may indicate Gatsby v1 or v2, which are end of life. - Fix: Migrate to Gatsby 5 or later. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **12.43 Astro Islands / View Transitions** - Pass: Astro-island markers are found; view transitions are reported when present. - Numbers and lists the tool uses: astro-island; view-transition|astro-view-transitions. - Why: Confirms the site uses Astro's island architecture. - Fix: Informational; no fix. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **12.44 Ghost theme / Members portal / Koenig cards / Portal signup CTA** - Pass: The members portal and a portal signup CTA are found; theme and Koenig card markers are reported as info. - Numbers and lists the tool uses: casper.theme|/content/themes/casper/; portal.min.js|ghost-portal|data-members-signin|/members/; kg-card|koenig-card|kg-bookmark|kg-gallery; data-portal="signup"|ghost-portal-button. - Why: Shows whether the Ghost membership and signup features are switched on. - Fix: Settings > Membership; Settings > Portal. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **12.45 HubSpot portal meta / Forms / CTAs / tracking script** - Pass: The HubSpot tracking script is found; portal meta, forms and CTAs are reported. - Numbers and lists the tool uses: data-hs-meta-data; js.hsforms.net|hs-form; js.hs-cta.com|hs-cta-wrapper; js.hs-analytics.net. - Why: Confirms which HubSpot features the site actually loads. - Fix: Informational; confirm the features you pay for are the ones loaded. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **12.46 Platform detected: `<name>` (`<type>`), `<detected via>`** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: Mega Analyzer VENDOR_FP ordered list, first match wins, hosts rank above widgets: ProSites, Officite, Sesame Communications, PBHS, Smile Marketing, Dental Branding, FindLaw, Justia, Scorpion, Mockingbird, BentoBox, Toast, Popmenu, ChowNow, Owner.com, SpotHopper, Tambourine, Placester, Real Geeks, Sierra Interactive, WordPress, Squarespace, Wix, Shopify, Webflow, GoDaddy Builder, Weebly, Spacecrafted, Pixieset, SmugMug, Carrd, Linktree, Substack, Beehiiv, Townsuite, ChamberMaster, Constant Contact Landing, Etsy Storefront, Bandzoogle, HubSpot CMS, Duda, Framer, Square Online, eCatholic, LPi WeConnect, OSV (Our Sunday Visitor), Tithe.ly, Pushpay, Givelify, EasyTithe, Subsplash, Clover Sites, Sharefaith, Planning Center, Ekklesia 360, Finalsite, SchoolBlocks, Blackbaud, A Place for Mom referral, Enquire (senior CRM), HoneyBook, Aisle Planner, Perfect Venue, Tripleseat, HubSpot (marketing embed), GoHighLevel, Mindbody, Housecall Pro, ServiceTitan, Jobber, Vagaro, Boulevard, BLOX CMS (TownNews), Adobe Experience Manager, Sitecore, Drupal, Sanity, Contentful, Optimizely CMS (Episerver), Townsquare Interactive, Vendasta Website Pro, Neighborly (franchise platform), CPA Site Solutions, Equisolve (investor relations), Parish Solutions Co, HungerRush / Menufy (hosted ordering), Homefiniti, Kentico, DotNetNuke (DNN), Umbraco, Hugo, Jekyll, Eleventy, Statamic, Astro, Microsoft IIS / ASP.NET, Next.js, Nuxt, Gatsby, Expo / React Native Web, Vite SPA, SolidJS; widget tier: Podium, CallRail, Juvo Leads, ZyraTalk, Broadly, Contractor Commerce, BidClips, Text Request, Lasso CRM, NoviHome, BDX / NewHomeSource, Lotvue, BankingBridge, Corrigo warranty portal, Matterport 3D tour, Citrix ShareFile portal, Aiwyn payment portal, Thomson Reuters NetClient CS, Envestnet Tamarac portal, Addepar portal, Fiduciary Briefcase, Marketo, Oracle Eloqua, Salesforce Pardot, ActiveCampaign form, Vuture, Usercentrics CMP, Consentmo GDPR, Yext, ATS careers embed, Spectora, Vanco Giving, Faith Direct, ParishSOFT Giving / WeShare, SecureGive, RebelGive, Blackbaud Luminate Online, Flocknote, BoxCast livestream, Ministry Scheduler Pro, We Adore Him adoration, MassIntentions.com, Church Community Builder, Ministry Forms, Elfsight, 123FormBuilder, Eventbrite, TableUp, inKind, Appstle Subscriptions, MultiShip, GoAffPro, Storage Commander; footer credit fallback /(?:created|powered|designed|built|developed|made)\s+(?:by|with)\s+([\w][\w &.']+?)(?:\.|,|<|$)/i; owner override list JW_PLATFORMS adds Cloudflare Pages, Cloudflare Workers, Netlify, Vercel and 'None / custom-built', stored per host as jw-platform-override:`<host>`. Mega Analyzer next-step tool recommender detection on the full raw HTML, first match wins (only the body text sample handed to the recommender is capped at 40000 characters): /wp-content|wp-json|WordPress/i WordPress; /cdn\.shopify\.com|Shopify\.theme/i Shopify; /Static\.SQUARESPACE_CONTEXT|squarespace-cdn/i Squarespace; /static\.wixstatic\.com|_wixCIDX/i Wix; /assets\.website-files\.com|data-wf-page/i Webflow; /ghost-url|casper\.theme/i Ghost; /cdn11\.bigcommerce\.com/i BigCommerce; /hs-scripts\.com|__hs_(?:cos|cta)/i HubSpot CMS; /framerusercontent\.com/i Framer. Mega SEO Analyzer: WordPress /wp-content|wp-includes|\/wp-json\/|generator.*WordPress/i; WooCommerce /woocommerce|wc-ajax/i; Shopify /cdn\.shopify\.com|shopify\.com\/s|Shopify\.theme/i; Squarespace /static1\.squarespace|squarespace-cdn/i; Wix /static\.wixstatic\.com|wix\.com|_wixCIDX/i; Webflow /assets-global\.website-files\.com|webflow\.js|data-wf-/i; Next.js /__NEXT_DATA__|_next\//i; Nuxt /__NUXT__|_nuxt\//i; Gatsby /___gatsby|__GATSBY/i; SvelteKit /sveltekit-|\+layout\.svelte/i; Astro /astro-[a-z0-9]+|data-astro-/i; Ghost /ghost\.io|\/ghost\/api\/|data-ghost/i; Drupal /sites\/default\/files|drupal|Drupal\.settings/i; HubSpot CMS /hs-scripts\.com|hsforms|hubspot/i; Contentful /ctfassets\.net|contentful\.com/i; Sanity /cdn\.sanity\.io/i; Eleventy /\<\!--.*eleventy|11ty/i; Jekyll /jekyll-/i; Magento /mage\/cookies|magento/i; BigCommerce /bigcommerce\.com|cdn11\.bigcommerce/i; then headers Netlify (/netlify/i on server or x-nf-request-id), Vercel (/vercel|Vercel/ on server or x-vercel-id), Cloudflare Pages (/cloudflare pages/i on server or cf-ray). Platform Audit body signatures ranked by KIND_RANK commerce 1, commerce-overlay 2, sitebuilder 3, cms 4, without a browser window-cms 5, framework 6, all matches kept and the lowest rank is primary: shopify (cdn.shopify.com|Shopify.theme|myshopify.com|shopify-section|/cdn/shop/files/), shopify-hydrogen, bigcommerce (cdn11.bigcommerce.com|bigcommerce.com/s-|Stencil.|__STENCIL__), magento, salesforce-cc, prestashop, opencart, oroCommerce, saleor, vendure, snipcart, foxy, commercejs, squarespace (static1.squarespace.com|squarespace-cdn|Static.SQUARESPACE_CONTEXT|sqs-block), wix (static.wixstatic.com|_wixCIDX|wix-code|wix.com/_functions), webflow (assets.website-files.com|webflow.com|w-nav|data-wf-page|data-wf-site), framer, mailchimp-sites, carrd, wordpress (wp-content|wp-includes|wp-json), drupal, joomla, typo3, concrete5, modx, craft, statamic, kirby, plone, ghost, hubspot-cms, sanity, contentful, strapi, payload, hygraph, storyblok, prismic, builderio, umbraco, sitecore, decap, tina, next.js (__NEXT_DATA__|_next/static|/_next/image), nuxt, gatsby, astro, remix, svelte/kit, qwik, solid-start, eleventy, hugo, jekyll (generator meta); when no platform check function was dispatched it renders 'No platform signature matched'; a WordPress primary stops the Platform Audit and routes to the WordPress + WooCommerce and WordPress security audits. Migration Analyzer signatures: WordPress, WooCommerce, Shopify, BigCommerce, Squarespace, Wix, Webflow, Ghost, Drupal, Joomla, Magento, HubSpot CMS, Framer, Next.js, Nuxt, Gatsby, Astro, Eleventy, Hugo, Jekyll, Svelte/Kit, Contentful, Sanity, Weebly, GoDaddy Builder, Duda in families cms, ecom, builder, jamstack, ssg, without a browser window (warn when nothing matches). Fix tags: [OWNER] content edits and body schema you can apply; [PLATFORM] CMS or hosting config (CDN headers, redirects, server settings); [VENDOR-CONTACT-REQUIRED] locked at template level, needs a vendor ticket; [INFRASTRUCTURE] DNS, TLS, registrar. - Why: Knowing the platform tells you which fixes you can make yourself, which need a hosting config change, and which need a vendor ticket. - Fix: Confirm the detected platform (override it when the fingerprint grabbed an agency's 'designed by' credit or a white-label embed) and route each fix to the surface that platform exposes: WordPress head and schema via Yoast, Rank Math or AIOSEO plus Site Health; Netlify headers via _headers; Vercel headers via the vercel.json headers block; WordPress sites continue in the dedicated WordPress + WooCommerce audit. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [Migration Analyzer](https://jwatte.com/tools/migration-analyzer/). - [ ] **12.47 Edge/serverless platform(s) detected** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: Mega Security Analyzer: Netlify (/\bnetlify\b/i on server or x-nf-request-id); Cloudflare (/cloudflare/i on server, cf-ray, cf-worker); Vercel (/vercel/i on server, x-vercel-id, x-vercel-cache); AWS API Gateway / Lambda (x-amz-apigw-id, x-amzn-requestid); AWS CloudFront (x-amz-cf-id); Fly.io (fly-request-id, /\bfly\/[\d.]+/i on server, fly-region); Deno Deploy (/deno/i on server, x-deno-deployment-id); Render (x-render-origin-server, rndr-id); Railway (x-railway-edge, x-railway-request-id); DigitalOcean App Platform (x-do-app-origin, x-do-orig-host). Platform Audit hosting headers (HOSTING_RULES): Netlify x-nf-request-id or server netlify; Vercel x-vercel-id, x-vercel-cache or server vercel; Cloudflare cf-ray, cf-cache-status or server cloudflare; Cloudflare Pages cf-ray plus server pages; AWS CloudFront x-amz-cf-id or via cloudfront; AWS Amplify x-amz-meta-amplifyapp; Fastly x-served-by or via fastly; Akamai server akamai or x-akamai-request-id; Fly.io fly-request-id, fly-region or server fly/`<version>`; Render x-render-origin-server, rndr-id; Railway x-railway-edge, x-railway-request-id; Firebase Hosting x-firebase-cache-status or server firebase; GitHub Pages github.com in x-served-by or server github; DigitalOcean App Platform x-do-app-origin or server digitalocean. Platform Audit platform headers (HEADER_RULES): Shopify x-shopid, x-shopify-stage or server shopify; Wix server wix or x-wix-request-id; Webflow server webflow or x-wf-cache; WP Engine server wpengine or x-cache-group; Kinsta server kinsta or x-kinsta-cache; Pantheon x-pantheon-styx-hostname or server pantheon; WordPress VIP x-vip-cache or x-vip-go-edge; Shopify CDN x-shopify-edge-ip or via shopify-cdn; Magento Cloud x-magento-cache-debug or x-magento-tags. - Why: The hosting platform decides which posture checks apply and where headers and redirects get configured. - Fix: Note the host; for a deeper look run the Serverless Posture Audit at /tools/serverless-posture-audit/. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/), [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). - [ ] **12.48 CDN / fetch markers present** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: x-served-by or x-cache response header present; the value is shown. - Why: Identifies a CDN or caching layer in front of the origin. - Fix: Informational only. - Verify: [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). - [ ] **12.49 Public cache on JSON** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: cache-control matches /public/i AND content-type matches /json/i. - Why: A public cache directive on user-specific JSON can serve one visitor's data to another. - Fix: Confirm the endpoint returns no user-scoped data before leaving it publicly cacheable. - Verify: [Mega Security Analyzer](https://jwatte.com/tools/mega-security-analyzer/). - [ ] **12.50 Images detected: `<n>` / CSS files: `<n>` / Web fonts: `<value>`** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: img src plus CSS url() images; stylesheet links; fonts.googleapis.com families. - Why: The counts size a migration, and Google Fonts are portable. - Fix: Informational only. - Verify: [Migration Analyzer](https://jwatte.com/tools/migration-analyzer/). - [ ] **12.51 Active theme id / handle; Shopify Polaris UI assets detected / No Polaris assets** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: "theme_id": digits or /themes/`<handle>`/assets/; polaris-icons|@shopify/polaris. - Why: Names the live Shopify theme and whether Polaris UI assets are loaded. - Fix: Check theme.liquid in the admin. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **12.52 Squarespace 7.1 (Fluid Engine era) / 7.0 / version unclear** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: templateVersion 7.1, sqs-layout|sqs-row|fluid-engine, or template-`<name>`. - Why: 7.0 sites cannot move to 7.1 without a rebuild. - Fix: Informational only. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **12.53 Squarespace Commerce signals** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: squarespace-commerce|/commerce-orders|product-gallery|add-to-cart-button. - Why: Shows whether Squarespace Commerce is in use on the site. - Fix: Informational only. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **12.54 Editor X detected / Classic Wix Editor** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: editor-x|editorx|wix.com/editor.x. - Why: Names which Wix editor built the site. - Fix: Informational only. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **12.55 Wix Stores / Wix Velo / Wix SEO Wiz / Wix Analytics presence** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: wix-stores|product-gallery-v2|data-hook="add-to-cart-button"; wix-code|_wixCodeRuntime|/_api/cloud-data/; "isSEOReady"|seoWiz|siteIndexStatus; _frog.wixpress.com|static.wixstatic.com/media/analytics. - Why: Shows which Wix features the site loads, including whether the SEO Wiz has been run. - Fix: Complete the 8-step SEO Wiz if it is not detected. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **12.56 Webflow CMS / Ecommerce / interactions.js / Lottie presence** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: w-dyn-list|data-wf-collection|collection-item; w-commerce|/product-category/|data-wf-commerce; webflow.`<hex hash>`.js|js.webflow.com/interactions; lottiefiles.com|lottie-player|.lottie; audit any Lottie above 500KB. - Why: Shows which Webflow features the site loads and flags heavy animation files. - Fix: Dequeue interactions.js if IX2 is unused. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **12.57 Stencil theme framework / Blueprint (legacy) theme; without a browser window API; Optimized One-Page Checkout** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: __STENCIL__|stencil-utils|theme_settings; bigcommerce.com/api/storefront|/graphql; checkout.js|bigcommerce-checkout. - Why: Blueprint themes are pre-2016 legacy. - Fix: Upgrade to Stencil; Advanced Settings > Checkout. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **12.58 Drupal page cache signals / CSRF token scaffolding** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: page_cache|internal_page_cache; csrf-token|X-CSRF-Token. - Why: Shows whether Drupal's page cache and CSRF protection are present in the output. - Fix: Informational only. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **12.59 Framer Forms / Framer CMS presence** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: framer-form|form-submit-button-framer; framer-cms|data-framer-cms-id. - Why: Shows which Framer features the site loads. - Fix: Informational only. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **12.60 Next.js render mode / API routes referenced** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: __NEXT_DATA__[^<]*"isFallback":false; /api/[a-z0-9_-]+ (case-insensitive). - Why: Next.js adds no auth or rate limiting to API routes by default. - Fix: Add authentication and rate limiting to any /api/ route the page references. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **12.61 Nuxt 3 signals present / Nuxt 2 or 3 unclear** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: __NUXT__ "ssr": or _nuxt/builds. - Why: Nuxt 2 is end of life as of June 2024. - Fix: Migrate to Nuxt 3. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **12.62 Build output directory (Eleventy) / Hugo deployment / Hugo version `<n>`** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: Hugo version major >= 0 always passes. - Why: The wrong publish directory leaks /src/*.md files as-is. - Fix: The publish directory must be _site (Eleventy) or /public (Hugo). - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). - [ ] **12.63 Jekyll GitHub Pages likely / SvelteKit SSR markers + adapter / Remix context / Qwik resumability / SolidStart** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: github.io|GitHub.com/.*jekyll; %sveltekit.head%|__sveltekit_, /_app/immutable/chunks; __remixContext "basename":; Qwik detected by q:container|q:slot|qwikloader then Resumability pattern always pass; SolidStart detected by solid-start|solid-js. - Why: Names the framework markers found for the less common stacks. - Fix: Informational only. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). ## Appendix A. Checks that apply to one kind of business The tools gate these on a detected industry so a bakery is not marked down for having no bar number. If one of these is your business, the checks are as binding as the general list. A heading that names several industries means the tools apply that check to each of them. ### Apps behind a login - [ ] **A1.1 The page is missing `<list>` (meta description, Open Graph, canonical, favicon)** - Pass: The login page has a meta description, og:title, canonical and favicon. - Numbers and lists the tool uses: hasMetaDesc; og:title; canonical; favicon regex /<link[^>]+rel=["'][^"']*icon/i. - Why: Links to the app shared in chat and email render broken. - Fix: Add meta description, og:* with twitter:card, canonical and favicon to the login page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A1.2 Make the auth flow accessible** - Pass: - Fail: Pushed unconditionally as a login-wall issue whenever the homepage is detected as a login wall; the markup is not inspected for live regions, landmarks or labels, so the row cannot pass. - Numbers and lists the tool uses: isLoginWall = home path and an auth form (a password input, or sign-up plus log-in text plus a `<form>`) and word count under 180 and 6 or fewer links and no marketing-link keywords (pricing, features, how it works, use cases, customers, testimonials, about, our story, blog, docs, documentation, contact), optionally overridden by the login-wall / app-shell / pre-marketing vertical override; the recommendation names role=alert / aria-live=assertive for errors, a single `<main>`, a `<footer>` and a programmatic label on every input, but none of those is checked. - Why: An error message toggled in a hidden div is never announced to screen readers, so the visitor does not know the login failed. - Fix: Render errors in a live region, add landmarks, and label every input. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: WCAG. - [ ] **A1.3 Account-based app: invite, sign-up and password-reset email is authenticated** - Pass: - Warn: Advisory whenever a sign-up flow exists. - Numbers and lists the tool uses: gate hasSignup; SPF -all; DMARC p=quarantine or p=reject with rua. - Why: An app that grows through invite and reset emails is only as reliable as its SPF, DKIM and DMARC alignment. - Fix: Run the DNS + Email audit and confirm SPF -all, a DKIM selector and a DMARC policy at quarantine or reject. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: SPF; DKIM; DMARC. - [ ] **A1.4 Login page ships transport and framing protection** - Pass: - Warn: Advisory always raised on a login wall. - Numbers and lists the tool uses: headers HSTS, Content-Security-Policy, X-Frame-Options or frame-ancestors, X-Content-Type-Options, Referrer-Policy. - Why: A password form with no framing restriction can be embedded and clickjacked. - Fix: Verify the header set with the Mega Security Analyzer and add the headers at the host or CDN (_headers file). - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). ### Authors and creators - [ ] **A2.1 Amazon Author Page** - Pass: An amazon.com/author URL appears in sameAs or the body text. - Fail: E-E-A-T Analyzer reports a missing Amazon author reference as informational. - Numbers and lists the tool uses: /amazon\.com\/author/i on sameAs or substring 'amazon.com/author' in body text; Author Central: claim the books, add biography, author photo, blog RSS feed, website and social links; snippet "sameAs": "https://www.amazon.com/author/yourname"; E-E-A-T Generator shows the field only for the author industry. - Why: Authors need entity convergence across Amazon, Goodreads and their own site. - Fix: Set up Amazon Author Central and add the author page URL to sameAs. - Verify: [E-E-A-T Audit](https://jwatte.com/tools/eeat-analyzer/), [E-E-A-T Generator](https://jwatte.com/tools/eeat-generator/). ### Aviation asset management - [ ] **A3.1 Leadership / dealmaker bio page carries no Person schema** - Pass: Bio pages carry Person schema. - Numbers and lists the tool uses: gated on a bio page. - Why: The firm's authority is its named principals. - Fix: Emit Person with jobTitle, worksFor, knowsAbout and sameAs. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org Person. - [ ] **A3.2 No ISTAT (International Society of Transport Aircraft Trading) membership/affiliation referenced** - Pass: The About page mentions ISTAT membership. - Numbers and lists the tool uses: /\bistat\b|international society of transport aircraft trading/i. - Why: ISTAT is the canonical industry body and a B2B authority anchor. - Fix: State the membership and add the ISTAT reference to sameAs or memberOf. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A3.3 The site references funds / ABS / JVs / institutional capital but no securities-marketing disclaimer was detected** - Pass: Pages that mention funds, securitizations, joint ventures or institutional capital carry a no-offer disclaimer. - Numbers and lists the tool uses: fund-raising /\bfund\b|\babs\b|asset-backed|securitization|capital partners|institutional (?:investors?|capital)|raise(?:d|s)? capital|joint venture|\bjv\b/i; disclaimer /this (?:is not|does not constitute) an offer|not an offer to (?:sell|buy)|for institutional investors only|accredited investors?|regulation d|private placement|no offer or solicitation/i. - Why: Investor-facing pages should carry a no-offer notice; the tool flags rather than assumes. - Fix: Add the notice and route the wording through securities counsel. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A3.4 `<n>` aviation-asset-management-readiness issue(s)** - Pass: No aviation-asset-management-readiness issue is detected across bio, portfolio, capabilities, news, contact and About contexts. - Numbers and lists the tool uses: ISTAT and AWG anchors; prompt rules: firm ['FinancialService','Organization'] with parentOrganization Corporation and tickerSymbol, sameAs LinkedIn and ISTAT, areaServed Worldwide; Person bios with knowsAbout and memberOf ISTAT; fleet as ItemList; NewsArticle with author, datePublished and publisher; securities-marketing disclaimer on investor-facing pages; validate; never assert ISTAT or AWG membership, AUM or fleet counts unverified. - Why: Citeability as an aircraft lessor to AI search and B2B counterparties depends on these signals. - Fix: Work through the listed issues with the prompt rules above, never asserting unverified memberships, AUM or fleet counts. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A3.5 No dedicated capabilities / portfolio / fleet page detected** - Pass: The site has a portfolio, fleet or capabilities page. - Fail: The About page is standing in for a capabilities surface. - Numbers and lists the tool uses: portfolio page /\/(fleet|portfolio|aircraft|assets?|our-fleet|aircraft-portfolio)(\/|$)/; capabilities page /\/(services|capabilities|what-we-do|solutions|asset-management|trading|leasing|expertise)(\/|$)/; flagged when the current page is an About page (or the home page) and its path matches neither the portfolio nor the capabilities pattern (Mega Analyzer). - Why: Without a structured what-we-do page the site has a topical-authority gap and a B2B credibility gap. - Fix: Add a structured capabilities or fleet page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). ### B2B SaaS - [ ] **A4.1 This page has no Open Graph tags (og:title / og:description / og:image)** - Pass: An inner route has og:title and a twitter:card. - Fail: An inner route (path depth of 1 or more, not the home page) that has a title but no og:title; or, on any page, Open Graph is present but there is no twitter:card meta. Both go to the same issues list. - Numbers and lists the tool uses: hasOg = og:title present; depth = path segments >= 1; not the home page. - Why: Shares on LinkedIn, X, Slack and iMessage render as bare links. - Fix: Set per-route og:* tags and twitter:card summary_large_image. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: Open Graph; Twitter Cards. - [ ] **A4.2 This page's `<title>` is a generic section label rather than this page's actual topic** - Pass: The title is specific to the page, or the first H1 is short. - Fail: An inner page whose title starts with a generic label while the first H1 is 25 or more characters. - Numbers and lists the tool uses: generic regex /^\s*(?:blog|news|customer stor(?:y|ies)|case stud(?:y|ies)|resources?|article|press|updates?|changelog)\b/i; specific H1 = first H1 length >= 25; not the home page. - Why: The title is the strongest per-page topic signal and the label AI answers cite. - Fix: Set the title to '`<H1>` | `<Brand>`'. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A4.3 No SoftwareApplication / WebApplication JSON-LD on a product / pricing / home page** - Pass: Home, product and pricing pages carry a SoftwareApplication or WebApplication node. - Numbers and lists the tool uses: applicationCategory BusinessApplication, operatingSystem Web, offers, featureList, provider @id (Mega Analyzer). - Why: It tells AI engines there is a product to recommend. - Fix: Emit SoftwareApplication with applicationCategory, operatingSystem, offers, featureList and provider @id. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org SoftwareApplication. - [ ] **A4.4 `<n>` SaaS-readiness issue(s)** - Pass: No SaaS readiness issues are reported for the machine-readable product layer. - Numbers and lists the tool uses: gate: SoftwareApplication schema, or product plus demo or trial plus login or pricing signals; signals covered: SoftwareApplication or WebApplication typing, Organization entity graph with sameAs and founder, WebSite node, FAQPage over the visible FAQ, per-page Open Graph, unique titles, BreadcrumbList on nested routes, self-referencing canonical; FTC 16 CFR Part 465 for ratings (Mega Analyzer). - Why: Fixing the layer lets AI answer engines recommend the product, search show distinct pages, and shared links render as cards. - Fix: SoftwareApplication on home, product and pricing pages with @id `<site>`#software, applicationCategory BusinessApplication, operatingSystem Web, offers, featureList and provider @id; one global Organization with founder and sameAs plus a WebSite node; FAQPage matching visible text; BreadcrumbList on nested routes; validate every block; never invent a founder, review count, rating or feature. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org SoftwareApplication, WebApplication, Organization, WebSite, FAQPage, BreadcrumbList; FTC 16 CFR Part 465. - [ ] **A4.5 There is a visible FAQ on the page but no FAQPage schema** - Pass: FAQPage schema is present. - Fail: A visible FAQ section with three or more question marks has no FAQPage schema. - Numbers and lists the tool uses: visibleFaq = (/frequently asked questions/i or /(^|[\s>(])FAQs?([\s<):.]|$)/) and question marks >= 3 (mega-analyzer). - Why: Question and answer pairs are the atomic shape AI Overviews, ChatGPT and Perplexity lift. - Fix: Wrap each Q&A in FAQPage and keep the schema text identical to the visible text. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org FAQPage. - [ ] **A4.6 SaaS-B2B: Fewer than 2 dev-surface links visible (/docs /api /changelog /status /security)** - Pass: At least 2 developer-surface paths are linked from the page. - Numbers and lists the tool uses: paths /docs, /api, /api-reference, /api-docs, /developers, /changelog, /status, /security; threshold 2. - Why: A visible developer surface signals an integrable product to agents and buyers. - Fix: Link /docs, /api, /changelog, /status and /security from the site. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A4.7 SaaS-B2B: No customer logos / case studies / G2 / Capterra outbound link** - Pass: Social-proof wording or a link to a software review site is present. - Numbers and lists the tool uses: /(?:customer\s+logos?|trusted\s+by|case\s+stud(?:y|ies)|customers?\s+(?:say|love))/i; links /g2\.com\/products|capterra\.com\/p\/|trustradius\.com|gartner\.com\/reviews|producthunt\.com/i. - Why: Social proof is the trust signal B2B buyers expect. - Fix: Add customer logos, case studies or G2 and Capterra links. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A4.8 Organization node names no founder** - Pass: The Organization node carries a founder or founders property. - Numbers and lists the tool uses: /"founder"\s*:|"founders"\s*:/i; gated on an Organization node on the About or home page. - Why: Founders are a strong entity and trust signal. - Fix: Add founder Person entries with jobTitle and a LinkedIn sameAs. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org founder. - [ ] **A4.9 Data Processing Addendum: scope through termination** - Pass: A SaaS business publishes a DPA covering scope, processor obligations, sub-processors, international transfers, data-subject requests, audits and termination, plus a subscription and billing clause in its terms. - Numbers and lists the tool uses: generated only for the saas business type; governs GDPR, UK-GDPR, CCPA/CPRA; processor acts on documented instructions only, duration = term of the Agreement plus the Privacy Policy retention, data subjects = end users of the Controller's account, no special-category data required; seven processor duties (a) to (g) with technical and organizational measures per Article 32 GDPR (documented instructions, confidentiality, technical and organizational measures, authorized sub-processors, assistance with requests and DPIAs, delete or return at end of Service, compliance information); sub-processor list at `<siteUrl>`/subprocessors/ with 30 days' notice of additions and a right to object; EU Standard Contractual Clauses (Decision 2021/914) and UK IDTA; Art. 15 to 22 requests forwarded within 5 business days; audit once annually on 30 days' written notice at the Controller's expense, SOC 2 or ISO 27001 reports accepted; deletion within 30 days of termination with certification on request; terms of service subscription clause: auto-renewal at the selected interval, cancel any time effective at period end, no pro-rated refunds except where required by law. - Why: SaaS buyers expect a DPA, a sub-processor list and clear billing terms before they sign. - Fix: Publish the DPA and a sub-processor list at /subprocessors/, and add the subscription clause to the terms. - Verify: [Legal Pages Generator](https://jwatte.com/tools/legal-pages-generator/). Standard: GDPR Article 32; EU SCC Decision 2021/914; UK IDTA; SOC 2; ISO 27001. - [ ] **A4.10 Data Processing Addendum states security measures and a breach-notification deadline** - Pass: The DPA commits to TLS 1.3 in transit, encryption at rest, least-privilege access with quarterly reviews, admin logging, annual penetration testing, documented incident response and background checks, and to notifying the controller within 48 hours of a breach. - Numbers and lists the tool uses: TLS 1.3; quarterly access reviews; annual penetration testing; breach notification within 48 hours with Article 33(3) information. - Why: Business customers in the EU need these commitments in writing before they can lawfully hand you personal data. - Fix: Publish the DPA only if the business actually operates each listed control. - Verify: [Legal Pages Generator](https://jwatte.com/tools/legal-pages-generator/). Standard: GDPR Article 32; GDPR Article 33(3). - [ ] **A4.11 SaaS-B2B: No visible pricing tier or /pricing page link** - Pass: A price-per-unit string appears in the body or schema, or a /pricing link exists. - Numbers and lists the tool uses: /\$\d+(?:[.,]\d{2})?\s*(?:\/|per)\s*(?:mo|month|seat|user|api|request|event|gb)/i on body plus schema; link /\/pricing\/?$/i (Mega Analyzer). - Why: Pricing transparency is a trust signal for software buyers. - Fix: Publish pricing tiers or link a /pricing page from the navigation. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A4.12 SaaS-B2B: security compliance badge mentioned** - Pass: The body or schema mentions SOC 2, ISO 27001, ISO 27017, HIPAA, GDPR, PCI DSS, FedRAMP or HITRUST. - Fail: The SaaS-B2B trust signals line lists the item in red: No SOC 2 / ISO 27001 / HIPAA / GDPR / PCI / FedRAMP / HITRUST mention. - Numbers and lists the tool uses: regex /(?:SOC\s*2(?:\s+type\s+(?:i|ii))?|ISO[- ]?27001|ISO\s*27017|HIPAA\s+(?:compliant|covered)|GDPR\s+(?:compliant|ready)|PCI[- ]DSS|FedRAMP|HITRUST)/i. - Why: B2B buyers treat a published security attestation as a gate before they will talk to sales. - Fix: Publish your compliance attestations on a security or trust page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). ### Butchers and meat markets - [ ] **A5.1 You ship perishable meat but the cold-chain logistics are invisible to machines** - Pass: Shipping pages and product pages carry OfferShippingDetails with a ShippingDeliveryTime. - Numbers and lists the tool uses: deliveryTime /"deliveryTime"|"ShippingDeliveryTime"|"handlingTime"|"transitTime"/i; gated on nationwide shipping on product, shipping or home pages (Mega Analyzer). - Why: 'Will it arrive frozen and what days do you ship' is the top pre-purchase question for shipped food. - Fix: Encode shippingDestination and ShippingDeliveryTime with handlingTime, transitTime, cutoffTime and businessDays. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org OfferShippingDetails, ShippingDeliveryTime. - [ ] **A5.2 There is a recipes section but no Recipe JSON-LD** - Pass: Every recipe page carries Recipe schema. - Numbers and lists the tool uses: recipes linked /\/recipes?\b|>\s*recipes?\s*</i or a recipe page or index (Mega Analyzer). - Why: Recipe is the biggest answer-engine lane for a food brand. - Fix: Emit Recipe per page and link each recipeIngredient to the shop Product. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org Recipe. - [ ] **A5.3 The page sells provenance ("`<value>`") in prose, but the Product schema carries none of it** - Pass: Provenance claims in the copy are encoded as additionalProperty or countryOfOrigin on the Product. - Numbers and lists the tool uses: claim regex /\b(grass[- ]?fed|grass[- ]?finished|pasture[- ]?raised|dry[- ]?aged|\d+[- ]?day aged|aged beef|heritage breed|heirloom breed|berkshire|duroc|wagyu|angus|regenerative|locally (?:raised|sourced)|northwest (?:raised|produced|grown)|family (?:ranch|farm)|raised without (?:antibiotics|hormones)|no (?:added )?hormones)\b/i on the title plus first 6000 characters of the body (Mega Analyzer). - Why: The premium attribute is invisible to AI shoppers unless it is structured. - Fix: Add additionalProperty PropertyValue entries (raising practice, breed, aging, source) and countryOfOrigin, only for what you can substantiate. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org additionalProperty. - [ ] **A5.4 No per-unit price (UnitPriceSpecification / referenceQuantity) in the offer** - Pass: Product offers carry a UnitPriceSpecification per pound. - Numbers and lists the tool uses: regex /"UnitPriceSpecification"|"referenceQuantity"/i; unitCode LBR; skipped on bundle pages (Mega Analyzer). - Why: Meat shoppers compare on price per pound. - Fix: Add UnitPriceSpecification with referenceQuantity value 1 and unitCode LBR. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org UnitPriceSpecification. - [ ] **A5.5 This is a processed / multi-ingredient item but there is no nutrition (NutritionInformation) in schema** - Pass: Processed or multi-ingredient items carry NutritionInformation. - Numbers and lists the tool uses: processed title regex /\b(sausage|bacon|chorizo|bratwurst|bologna|frank|wiener|hot ?dog|jerky|marinated|seasoned|cured|smoked|breaded|seafood|salmon|shrimp|crab|patties|links?|brats?|kielbasa|pepperoni|salami)\b/i on the title; nutrition /"nutrition"\s*:|"NutritionInformation"/i; skipped on bundle pages (Mega Analyzer). - Why: Processed foods carry Nutrition Facts and allergen statements; single-ingredient raw cuts are exempt. - Fix: Add nutrition NutritionInformation plus an ingredient and allergen line. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FDA Nutrition Facts. - [ ] **A5.6 This freezer pack / bundle is modelled as a single bare Product with no contents** - Pass: Bundle pages itemize contents with hasPart, isRelatedTo, OfferCatalog or itemListElement. - Numbers and lists the tool uses: regex /"hasPart"|"isRelatedTo"|"OfferCatalog"|"itemListElement"/i; bundle page = product page with freezer terms or /\b(pack|bundle|box|sampler|variety|assortment|lovers? pack)\b/i in the title (Mega Analyzer). - Why: Shoppers need the cuts, total weight and per-portion value. - Fix: Model hasPart or isRelatedTo entries with total weight and a per-pound UnitPriceSpecification. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org hasPart. - [ ] **A5.7 No perishable-correct return / guarantee language for shipped meat** - Pass: Shipping, product and FAQ pages state a replacement guarantee and encode MerchantReturnNotPermitted. - Numbers and lists the tool uses: regex /MerchantReturnNotPermitted|not (?:eligible|accepted) for return|cannot be returned|no returns? (?:on|for) (?:food|perishable|meat)|all sales final|satisfaction guarantee|replace(?:d|ment)? (?:it|your order)|arrive(?:s|d)? (?:thawed|spoiled)/i; gated on nationwide shipping (Mega Analyzer). - Why: Food is non-returnable, so a standard 30-day return policy is the wrong model. - Fix: State a replacement guarantee in copy and encode returnPolicyCategory MerchantReturnNotPermitted. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org MerchantReturnPolicy. - [ ] **A5.8 `<n>` craft-butcher / meat-DTC-readiness issue(s)** - Pass: No craft-butcher or meat-DTC readiness issues are reported; when issues exist an AI fix prompt lists them. - Numbers and lists the tool uses: USDA FSIS; USDA NOP 7 CFR 205; USDA Product of USA (2026); FTC Made in USA 16 CFR Part 323; FDA FALCPA allergens; FSMA Sanitary Transportation; USDA Safe Handling Instructions; shop node additionalType Wikidata Q1338910 (Mega Analyzer). - Why: Machine-readable claims carry the same liability as visible copy, so USDA, FTC and FDA label and shipping claims must be defensible. - Fix: Add a second [GroceryStore, LocalBusiness] shop node with @id `<site>`#shop, address, geo, hours, areaServed and parentOrganization; perishable OfferShippingDetails with a ship-day window; Recipe schema; provenance as additionalProperty and countryOfOrigin; per-pound UnitPriceSpecification and NutritionInformation on processed items; itemized bundles; MerchantReturnNotPermitted with a replacement guarantee; food-safety guidance; substantiate every claim and never invent prices, weights, ranches, practices, nutrition values or origin facts. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: USDA FSIS; USDA NOP 7 CFR 205; 16 CFR Part 323; FALCPA; FSMA. - [ ] **A5.9 This is a hybrid bricks-and-clicks butcher but the only business entity in schema is the online brand** - Pass: A local storefront business node (GroceryStore, LocalBusiness, Store or FoodEstablishment) is detected. - Fail: Home, about or local page mentions a storefront or local delivery but no local business node exists; sub-issues when that node lacks PostalAddress, geo, openingHoursSpecification or areaServed. - Numbers and lists the tool uses: hasLocalBiz types /LocalBusiness|Store|GroceryStore|FoodEstablishment/i; localDelivery /\b(local delivery|same-?day delivery|deliver (?:locally|in town)|free local|local pickup|curbside)\b/i; additionalType https://www.wikidata.org/wiki/Q1338910. - Why: Without a local node, "butcher near me" and the local pack cannot place the shop. - Fix: Emit a GroceryStore plus LocalBusiness node with address, geo, telephone, hours, areaServed and parentOrganization. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org GroceryStore. - [ ] **A5.10 No storage / thawing / safe-handling guidance for raw meat** - Pass: Handling guidance is present. - Fail: A product, FAQ or shipping page on a store that ships nationwide has no handling guidance. - Numbers and lists the tool uses: /\b(safe handling|keep (?:frozen|refrigerated)|thaw|defrost|store (?:frozen|in the freezer)|refrigerate|cook to (?:an internal|\d+)|internal temperature|shelf life|use by|best (?:by|within))\b/i (Mega Analyzer). - Why: USDA mandates safe-handling instructions on the package, and online guidance cuts returns. - Fix: Add a storage and handling section and a matching FAQPage entry. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: USDA Safe Handling Instructions. - [ ] **A5.11 Regulated meat-label claim detected ("`<value>`")** - Pass: No regulated label claim appears on product, about or home pages. - Warn: A claim such as grass-fed, organic, all-natural, no hormones, antibiotic-free, pasture-raised, free-range, humanely raised or non-GMO is flagged as an advisory to verify. - Numbers and lists the tool uses: /\b(grass[- ]?fed|grass[- ]?finished|organic|all[- ]?natural|\bnatural\b|no (?:added )?hormones|hormone[- ]?free|raised without antibiotics|no antibiotics|antibiotic[- ]?free|pasture[- ]?raised|free[- ]?range|humanely raised|non[- ]?gmo)\b/i on product, about and home pages; reported as an informational issue (Mega Analyzer). - Why: Label claims must be documented and truthful in both copy and schema. - Fix: Confirm each claim with the USDA-inspected processor or an FSIS-approved label. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FSIS-GD-2024-0006; 7 CFR Part 205; 9 CFR 317.8. - [ ] **A5.12 Premium breed / grade claim detected ("`<value>`")** - Pass: No breed or USDA grade claim appears on product pages. - Warn: A claim such as wagyu, Angus, USDA Prime or Choice is flagged as an advisory to verify. - Numbers and lists the tool uses: /\b(wagyu|kobe|akaushi|certified angus|\bangus\b|usda (?:prime|choice|select)|prime grade|choice grade)\b/i on product pages; reported as an informational issue (Mega Analyzer). - Why: An unsubstantiated grade or breed claim is FSIS misbranding and an FTC Section 5 risk. - Fix: Keep the documentation and add the verified grade or breed to Product.additionalProperty. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: 7 CFR Part 54; 9 CFR 317.8; FTC Section 5. - [ ] **A5.13 Origin claim detected ("`<value>`")** - Pass: No origin claim appears on product, about or home pages. - Warn: A Product of USA, Made in USA, American-raised or locally raised claim is flagged as an advisory to verify. - Numbers and lists the tool uses: /\b(product of (?:the )?usa|made in (?:the )?usa|american(?:-raised| beef| pork| made)?|raised in (?:the )?(?:usa|america|idaho)|u\.s\.a\.|locally (?:raised|sourced|produced)|northwest (?:raised|produced))\b/i on product, about and home pages; USDA rule compliance date January 1, 2026 (Mega Analyzer). - Why: USDA requires the animal to be born, raised, slaughtered and processed in the US, and the FTC applies 'all or virtually all'. - Fix: Make the claim substantiable and name the region or ranches behind 'locally raised'. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: USDA Product of USA rule (2026); FTC 16 CFR Part 323. - [ ] **A5.14 Processed or seafood items are sold but no allergen information is surfaced** - Pass: An allergen statement accompanies processed or seafood products. - Numbers and lists the tool uses: /\b(allergen|contains:?\s|major allergen|may contain|shellfish|crustacean|processed in a facility)\b/i on product pages that sell seafood or processed items (Mega Analyzer). - Why: Major food allergens must be declared. - Fix: Add a Contains line and an ingredient statement to each affected product. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FDA FALCPA, 21 U.S.C. 343(w). - [ ] **A5.15 Shipping perishable food but the cold-chain method is not disclosed** - Pass: The cold-chain shipping method is disclosed. - Numbers and lists the tool uses: /\b(dry ice|gel pack|gel-?pack|insulated|cooler|temperature-?controlled|stays? frozen|arrive(?:s)? frozen|cold chain|refrigerated shipping)\b/i on shipping and home pages when the store ships nationwide (Mega Analyzer). - Why: Shoppers will not buy frozen meat without knowing how it travels. - Fix: State the packing and shipping method prominently. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FDA FSMA Sanitary Transportation rule, 21 CFR Part 1 Subpart O. - [ ] **A5.16 On Shopify, most of the above is theme JSON-LD + metafields + an app, not a rebuild** - Pass: The site is not on Shopify, or it has no open issues. - Warn: The site is on Shopify and has open issues; the fixes are theme JSON-LD, metafields and an app rather than a rebuild. - Numbers and lists the tool uses: platform === 'Shopify' with at least one issue. - Why: Theme-level fixes apply across every product at once. - Fix: Request the fixes by name from the theme maintainer. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). ### Car washes - [ ] **A6.1 Reads as Q&A but no FAQPage JSON-LD** - Pass: The FAQ page carries FAQPage schema. - Fail: A home, FAQ or service page contains question marks in the body but has no FAQPage schema. - Numbers and lists the tool uses: Pages: home, FAQ, service; /\?(?:\s|$)/ on the full body (mega-analyzer). - Why: Cancel-anytime and scratch or touchless questions are high-intent for a car wash. - Fix: Wrap the real questions in FAQPage. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org FAQPage. - [ ] **A6.2 Business node has no amenityFeature** - Pass: The car wash business node has amenityFeature on the homepage. - Numbers and lists the tool uses: amenities: free vacuums, touchless or brushless, ceramic coating, tunnel or express, self-serve bays, detailing, dog wash. - Why: Feature filters in the map pack depend on amenityFeature. - Fix: Add amenityFeature entries for the features you offer (free vacuums, touchless, ceramic, tunnel, self-serve, detailing, dog wash). - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org LocalBusiness. - [ ] **A6.3 `<n>` car-wash-readiness issue(s)** - Pass: No car-wash-readiness issues detected. - Numbers and lists the tool uses: gate: car wash, express, touchless, self-serve, detailing or unlimited-wash-club signals, or AutoWash schema; signals: unlimited monthly membership auto-renewal (ROSCA and California, New York, Colorado Automatic Renewal Laws: clear renewal terms, express consent, easy online cancellation; the FTC Click-to-Cancel rule was vacated July 2025 but the obligations remain), AutoWash schema, packages as Offer, AggregateRating or Review (FTC 16 CFR Part 465), GBP, FAQ, app plus license-plate recognition, FTC Green Guides and substantiation, accessibility, Spanish and hreflang; context flags: homepage, packages or menu, membership, FAQ, contact, hasMembership; reference /blog/blog-mega-analyzer-car-wash-readiness/. - Why: Fixing these wins "car wash near me", makes the wash-club auto-renewal compliant, and keeps review, green and superiority claims substantiable. - Fix: If you sell a membership, state the recurring price, frequency and "automatically renews until canceled" next to the join button, require express consent with no pre-checked box, and offer online cancellation matching the signup channel. Emit one AutoWash node per location (@id `<site>`/#autowash with NAP, geo, hours, priceRange, paymentAccepted, sameAs to GBP, Yelp, Facebook and Instagram, and amenityFeature), publish wash tiers as an OfferCatalog of Offers with the unlimited plan as an Offer with a monthly UnitPriceSpecification, disclose plate-data handling in the privacy policy, use only real reviews, make eco and superiority claims specific, add FAQPage, an accessibility statement and Spanish hreflang for membership pages, and validate every JSON-LD block. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: ROSCA; California / New York / Colorado Automatic Renewal Laws; FTC 16 CFR Part 465; FTC Green Guides; schema.org AutoWash, OfferCatalog, Offer, UnitPriceSpecification, FAQPage; WCAG 2.1 AA. - [ ] **A6.4 Ratings shown/claimed but no machine-readable AggregateRating / Review schema** - Pass: Rating claims or review widgets on the home or contact page are backed by AggregateRating or Review schema, or the page makes no rating claim. - Warn: When schema is present the tool asks you to confirm it reconciles with the real platform total. - Numbers and lists the tool uses: claims /\b5-?star|highly rated|top-?rated|best car wash|voted best\b/i; widget /yelp|google review|\b\d(?:\.\d)?\s*(?:out of|\/)\s*5\s*star/i; gated on the home or contact page; FTC penalty up to $51,744 per violation. - Why: A 'voted best' claim must be substantiated. - Fix: Emit AggregateRating from real reviews. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FTC 16 CFR Part 465. - [ ] **A6.5 No accessibility statement or signal** - Pass: Any audited page where the signal regex matches the raw HTML, or that is the accessibility page, gets the pass row 'Accessibility / ADA signal present'. - Fail: The homepage matches none of the signal phrases. - Numbers and lists the tool uses: /accessibility statement|web content accessibility|wcag|ada compliant|ada accessible|wheelchair accessible/i tested on the raw HTML, or isAccessibilityPage; the fail fires on the homepage only; the pass fires on any page where the signal matches. - Why: Car washes are ADA Title III public accommodations, and an inaccessible membership cancel flow compounds auto-renewal risk. - Fix: Publish a statement, conform to WCAG 2.1 AA, and keep the cancel flow accessible. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: ADA Title III; WCAG 2.1 AA. - [ ] **A6.6 MEMBERSHIP / UNLIMITED PLAN with NO clear auto-renewal disclosure** - Pass: Auto-renewal disclosure language appears near the membership offer. - Numbers and lists the tool uses: membership /\bunlimited\b|wash club|membership|monthly (?:plan|wash|membership)|\/month|per month|auto[ -]?renew|recurring|join (?:now|today|the club)/i; disclosure /auto(?:matically)?[ -]?renew|recurring (?:monthly|billing|charge)|until (?:you )?cancel|renews monthly|monthly recurring/i; state law effective dates CA 7/1/2025, NY 11/5/2025, CO 2/16/2026 (Mega Analyzer). - Why: ROSCA and state automatic-renewal laws require the price, frequency and 'renews until canceled' next to signup. - Fix: Put the disclosure in plain text immediately above the join button. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: ROSCA; California, New York, Colorado Automatic Renewal Laws. - [ ] **A6.7 Auto-renewal is mentioned but the recurring price + frequency are not clearly stated as "$X/month" near the signup** - Pass: A recurring price string such as $X/month appears near the signup. - Numbers and lists the tool uses: /\$\d[\d.,]*\s*(?:\/|per )\s*mo|\/month/i; checked on membership and home pages when a renewal disclosure exists (Mega Analyzer). - Why: The exact recurring amount must be stated at the point of consent. - Fix: State the recurring amount and billing interval next to the signup button. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: ROSCA. - [ ] **A6.8 MEMBERSHIP with no findable cancellation path** - Pass: A cancellation path is findable. - Numbers and lists the tool uses: /cancel (?:your )?membership|cancel (?:online|anytime)|manage (?:your )?membership|cancellation/i (Mega Analyzer). - Why: ROSCA requires a simple cancel mechanism, and California, Colorado and New York require online cancellation for online signups. - Fix: Add a clear Cancel Membership link or portal that matches the signup medium. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: ROSCA. - [ ] **A6.9 Membership offered but no explanation of how members enter (app + license-plate recognition)** - Pass: The page explains app or license-plate entry. - Numbers and lists the tool uses: /license plate|no sticker|app|scan|auto-?detected|plate recognition/i (Mega Analyzer). - Why: Members need to know how entry works, and plate-data handling belongs in the privacy policy. - Fix: Add a 'how membership works' section and disclose plate-data handling. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A6.10 Environmental claim ("`<value>`") with no specific basis** - Pass: Any eco or water claim carries a percentage, reclaim or ENERGY STAR basis. - Numbers and lists the tool uses: green claim /\b(eco-?friendly|green|environmentally friendly|water saving|water reclamation|water recycling|biodegradable|sustainable)\b/i; basis /\b\d+%\b|reclaim|energy star/i (Mega Analyzer). - Why: The Green Guides require specific substantiation, and 'biodegradable' needs a complete-breakdown basis. - Fix: Qualify the claim with the number behind it or drop it. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FTC Green Guides. - [ ] **A6.11 Unqualified superiority / finish claim ("`<value>`")** - Pass: No unqualified superiority or finish-safety claim appears. - Numbers and lists the tool uses: /\b(best car wash|#1|cheapest|spot-?free|scratch-?free|100% safe|won'?t scratch|guaranteed)\b/i (Mega Analyzer). - Why: Objective claims need a reasonable basis before they are published. - Fix: Qualify the claim, back it with a guarantee policy, or soften it. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FTC substantiation. - [ ] **A6.12 No Spanish-language signal** - Pass: Spanish content or an es hreflang exists. - Numbers and lists the tool uses: /hreflang=["']es|lang=["']es|\/es\/|espa[nñ]ol|lavado de autos/i; checked on the home page (Mega Analyzer). - Why: Auto-renewal disclosures are most defensible in the customer's own language. - Fix: Add Spanish core and membership pages with reciprocal hreflang. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). ### Churches and parishes - [ ] **A7.1 Church / Place schema present** - Pass: A place of worship declares Church, CatholicChurch, PlaceOfWorship, ReligiousOrganization or a tradition-specific subtype. - Warn: Missing on a page that looks Catholic (Mega Analyzer warn). - Fail: No Church or Place schema is found (analyzer). - Numbers and lists the tool uses: regex /Church|ReligiousOrganization|PlaceOfWorship|Synagogue|Mosque|HinduTemple|BuddhistTemple/i (Mega Analyzer religious); /CatholicChurch|PlaceOfWorship|^Church$/i with gate on Catholic links /\/(mass|parish|sacrament|confession|reconciliation|baptism|rcia|ocia|misa|diocese)(\/|$|-|\?)/i or copy /catholic|parish|\bdiocese\b|mass times/i (Mega Analyzer Catholic); /CatholicChurch|PlaceOfWorship|"@type"\s*:\s*"Church"/i with a Catholic-vocabulary gate on the HTML (analyzer). - Why: It is the entity anchor Google and AI bind 'church near me' answers to, and almost no parish in a 16-site audit had it. - Fix: Add CatholicChurch or Church JSON-LD with name, full address, geo, telephone and sameAs. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org Church, CatholicChurch, PlaceOfWorship. - [ ] **A7.2 Mass times marked up as Event / openingHours** - Pass: Recurring services are marked up as Event, EventSeries or OpeningHoursSpecification. - Fail: No Event or OpeningHoursSpecification is found (critical on Catholic parish pages). - Numbers and lists the tool uses: regex /Event|OpeningHoursSpecification/i (Mega Analyzer religious); /^Event$|OpeningHoursSpecification|EventSeries/i (Mega Analyzer Catholic). - Why: Without machine-readable service times AI answers Mass times from stale aggregators. - Fix: Mark each service as an Event with startTime or eventSchedule and inLanguage, or add OpeningHoursSpecification. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org Event, OpeningHoursSpecification. - [ ] **A7.3 Local-Religious: Service times rendered as text** - Pass: Service or Mass times appear as readable HTML text. - Warn: Mega Analyzer lists 'Service times rendered as text + OpeningHoursSpecification block' under Religious-org signals as a yellow opportunity (not a fail) when the lowercased body text has no service-time phrase; the parish analyzer warns 'No Mass times found as readable text' when no clock-time pattern is found anywhere in the HTML. - Numbers and lists the tool uses: Mega Analyzer, only when ymylVertical is Local-Religious: /(sunday\s+(?:service|worship)|saturday\s+(?:service|worship|shabbat)|friday\s+(?:prayer|jumu)|mass\s+times|service\s+times|worship\s+times)/i on lowercased body text, rendered as a religiousMissing opportunity; parish analyzer, only when the page looks Catholic: /\b\d{1,2}:\d{2}\s?(a\.?m\.?|p\.?m\.?)/i or /\b\d{1,2}\s?(a\.?m\.?|p\.?m\.?)\b/i anywhere in the HTML. - Why: Service times are the top query for worship sites, and times that live only in a PDF bulletin or an image cannot be read by search engines or AI. - Fix: Publish service times as HTML text at a stable URL such as /mass-times and add OpeningHoursSpecification. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org OpeningHoursSpecification. - [ ] **A7.4 Mass-time structured data present (Event / openingHours)** - Pass: Event, openingHoursSpecification or eventSchedule markup appears in the HTML. - Fail: No match renders 'Mass times are not machine-readable (no Event/openingHours schema)'. - Numbers and lists the tool uses: /"@type"\s*:\s*"Event"|openingHoursSpecification|eventSchedule/i. - Why: With no Event or openingHours markup, AI assistants fall back on stale third-party aggregators with the wrong times or the wrong diocese. - Fix: Mark each Mass as an Event with startDate or eventSchedule and tag inLanguage for Spanish or Latin Masses. - Verify: [Site Analyzer](https://jwatte.com/tools/analyzer/). Standard: schema.org Event / openingHoursSpecification. - [ ] **A7.5 Local-Religious: visible "Give / Donate / Tithe" link in main nav (primary conversion signal)** - Pass: At least one link points to a giving page or giving platform. - Numbers and lists the tool uses: href matches /\/(give|giving|donate|donation|tithe|offering|stewardship|generosity|pushpay|tithe\.ly|givelify|easytithe)\/?(?:$|\?|#)/i (Mega Analyzer). - Why: Giving is the primary conversion for a congregation site. - Fix: Add a Give or Donate link in the main navigation. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A7.6 FAQPage schema for common parish questions** - Pass: A FAQPage node is present on the parish site. - Fail: A missing FAQPage is reported as information only, not scored. - Numbers and lists the tool uses: schemaTypes matches /^FAQPage$/i (mega-analyzer). - Why: Parish questions such as Mass times, confession and registration are exactly what answer engines get asked. - Fix: Add FAQPage JSON-LD covering Mass times, confession, Spanish Mass, registration, OCIA and parking. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org FAQPage. ### CPA and accounting firms - [ ] **A8.1 No AICPA membership statement on the About / homepage** - Pass: The About page or homepage mentions AICPA membership. - Numbers and lists the tool uses: /aicpa|american institute of cpas|american institute of certified public accountants/i on body and footer; gated on an About page (/about, /about-us, /about-the-firm, /our-firm, /history, /who-we-are) or the homepage (/). - Why: AICPA membership is the canonical authority anchor for US CPA firms. - Fix: Add a 'Member of the American Institute of CPAs' line and memberOf on the firm JSON-LD. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A8.2 No AICPA Peer Review status referenced on the audit / assurance page** - Pass: Audit and assurance pages mention the firm's peer review status. - Numbers and lists the tool uses: /peer review/i; firms are peer-reviewed every 3 years; gated on an audit page. - Why: Peer review is the CPA equivalent of being verified by an independent reviewer. - Fix: State the review status and link the firm's public file at peerreview.aicpa.org. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: AICPA Peer Review. - [ ] **A8.3 No independence statement on the audit page** - Pass: Audit pages carry an independence statement. - Numbers and lists the tool uses: /\bindependence (rule|standards|policy|requirements)|independence in fact and appearance|yellow book/i; gated on an audit page. - Why: AICPA independence rules apply to all attest engagements. - Fix: Add a one-line statement of independence, citing the Yellow Book where applicable. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: AICPA Code of Professional Conduct. - [ ] **A8.4 No IRS Circular 230 acknowledgment on tax-services page** - Pass: Tax pages reference Circular 230 or practice before the IRS. - Numbers and lists the tool uses: /circular\s*230|irs (?:practice|representation|enrolled agent)/i; gated on a tax page. - Why: Circular 230 section 10.30 governs how tax practitioners advertise. - Fix: Add a footer line acknowledging practice before the IRS under Circular 230. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: Treasury Circular 230 section 10.30. - [ ] **A8.5 No tax outcomes depend on facts disclaimer on the tax page** - Pass: Tax pages carry a results disclaimer. - Numbers and lists the tool uses: /tax outcomes? depend on|no representations? as to results|outcomes? depend.{0,50}facts|results.{0,30}depend.{0,30}facts/i; gated on a tax page. - Why: This is the tax analog of 'prior results do not guarantee a similar outcome'. - Fix: Add: 'Tax outcomes depend on the specific facts of each engagement; no representations as to results are made in this material.'. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A8.6 `<n>` CPA-firm-readiness issue(s)** - Pass: No CPA-firm-readiness issue is detected across bio, practice, office, tax, audit and About contexts. - Numbers and lists the tool uses: IRS Circular 230 10.30; 16 CFR Part 314 (FTC Safeguards Rule, effective 2023-06-09); GLBA; prompt rules: fix invalid ['Person','Organization'] typing (Rank Math Local SEO set to Company or AccountingService); ProfilePage plus ['Person','Accountant'] with honorificSuffix CPA, hasCredential recognizedBy the State Board of Accountancy, memberOf AICPA and the state society; AccountingService per service page; firm ['AccountingService','Organization'] with memberOf AICPA; office PostalAddress and openingHoursSpecification (08:00 to 17:00 example); 'Member of the American Institute of CPAs' statement; Peer Review status with peerreview.aicpa.org link (verify first); Circular 230 footer line on tax pages; FTC Safeguards Rule / GLBA statement naming a Qualified Individual; independence statement (AICPA Code, GAO Yellow Book); validate; never invent ratings, memberships or license numbers. - Why: AICPA, state-board and Circular 230 expectations decide whether a CPA firm reads as credible and compliant. - Fix: Work through the listed issues with the prompt rules above, verifying peer review status first and never inventing memberships or license numbers. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: IRS Circular 230; 16 CFR Part 314. - [ ] **A8.7 CPA: FTC Safeguards Rule / GLBA compliance referenced** - Pass: The About, Privacy or Security page references GLBA, the Safeguards Rule or a written information security program. - Fail: No match on an About page or a path matching /privacy or /security. - Numbers and lists the tool uses: regex /\bglba\b|gramm[\s-]*leach[\s-]*bliley|safeguards rule|ftc safeguards|written information security|\bwisp\b/i; rule effective June 9, 2023; May 13, 2024 amendment requires notifying the FTC within 30 days of a breach involving unencrypted information of 500 or more consumers. - Why: CPA firms count as financial institutions under 16 CFR Part 314 and must maintain a written information security program with a Qualified Individual. - Fix: Add a short visible reference to your Safeguards Rule program on the Privacy or About page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: 16 CFR Part 314 (FTC Safeguards Rule); GLBA. ### Defense contractors - [ ] **A9.1 No ITAR / EAR / export-control statement on a hardware / cryptography / defense-article context page** - Pass: About or capabilities pages that discuss export, munitions, defense articles or cryptography carry an ITAR or EAR reference. - Numbers and lists the tool uses: ITAR /\bitar\b|international traffic in arms|22 cfr (?:120|121|122|123|124|125|126|127|128|129|130)/i on body and footer; EAR /\bear\s+(?:compliance|controlled|registered)\b|export administration regulations|15 cfr\s*7[3-7]\d|bureau of industry and security|\bbis\b\s+(?:license|registered)/i on body and footer; export context /\b(?:export|munitions|defense article|cryptograph|encryption|controlled item)\b/i on the first 12000 characters of body text; gated on an About or capabilities page. - Why: Defense-article registration and export licensing govern the work. - Fix: Add a statement of ITAR or EAR compliance without listing license numbers. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: 22 CFR 120-130 (ITAR); 15 CFR 730-774 (EAR). - [ ] **A9.2 No SAM.gov registration reference** - Pass: About or capabilities pages mention SAM.gov registration. - Numbers and lists the tool uses: /\bsam\.gov\b|system for award management|sam[\s-]?registered/i. - Why: All federal contractors must register at SAM.gov to receive awards. - Fix: State the registration status visibly with the verified CAGE code and UEI. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: SAM.gov. - [ ] **A9.3 No CAGE code disclosure on Capabilities / About** - Pass: The CAGE code is disclosed on the capabilities or About page. - Numbers and lists the tool uses: /\bcage\s*code\s*[:\-]?\s*[a-z0-9]/i; CAGE codes are 5 characters. - Why: CAGE is the lookup key in SAM.gov and DSBS. - Fix: Display the CAGE code on the capabilities page and in the footer. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A9.4 No UEI (Unique Entity Identifier) disclosure** - Pass: The UEI is disclosed on the capabilities or About page. - Numbers and lists the tool uses: /\buei\s*[:\-]?\s*[a-z0-9]|unique entity identifier/i; UEI is 12 characters and replaced DUNS in April 2022. - Why: The UEI is the canonical federal entity identifier. - Fix: Display the UEI alongside the CAGE code. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A9.5 No NAICS code disclosure on Capabilities / About** - Pass: Primary NAICS codes are listed on the capabilities or About page. - Numbers and lists the tool uses: /\bnaics\s*(?:code)?\s*[:\-]?\s*\d{4,6}|naics\s+\d{4,6}/i; typical codes 541330, 541512, 541714, 336411, 541715. - Why: NAICS codes drive set-aside qualification and procurement filtering. - Fix: List the firm's primary NAICS codes publicly. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A9.6 No Section 889 compliance reference** - Pass: The capabilities or About page references Section 889 or FAR 52.204-25 compliance. - Numbers and lists the tool uses: /section\s*889|huawei prohibition|ban on covered telecom|far\s*52\.204[\s-]?25/i. - Why: FAR 52.204-25 prohibits covered Chinese telecom equipment (Huawei, ZTE, Hytera, Hikvision, Dahua) in federal contracts. - Fix: Publish a Section 889 representation on the capabilities or compliance page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FAR 52.204-25; FY19 NDAA Section 889. - [ ] **A9.7 Hardware / manufacturing / materiel context without Buy American Act / Berry Amendment reference** - Pass: About, homepage or Capabilities pages that describe hardware, manufacturing or fabrication reference Buy American, the Berry Amendment or the Trade Agreements Act. - Numbers and lists the tool uses: /buy american|berry amendment|10\s*u\.s\.c\.\s*4862|trade agreements act/i on body plus footer; hardware context /\b(?:hardware|manufactur|fabricat|defense article|cryptograph|systems integrat)\b/i on the first 12000 characters of body; gated on the About page (homepage counts as About) or the Capabilities page. - Why: Domestic-content requirements govern federal procurement of materiel. - Fix: Add a compliance statement. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: 41 USC 8302 (Buy American Act); 10 USC 4862 (Berry Amendment). - [ ] **A9.8 Engineering / manufacturing / aerospace posture without ISO 9001 / AS9100 reference** - Pass: About, homepage or Capabilities pages that describe engineering, manufacturing or aerospace work reference ISO 9001, AS9100, ISO 27001 or ISO 20000. - Numbers and lists the tool uses: /\biso\s*9001\b|\bas9100\b|\biso\s*27001\b|\biso\s*20000\b/i on body plus footer; context /(?:engineering|manufactur|hardware|systems integrat|aerospace)/i on the first 12000 characters of body; gated on the About page (homepage counts as About) or the Capabilities page. - Why: Defense engineering and aerospace work typically requires ISO 9001 and/or AS9100. - Fix: State the certification status or target. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: ISO 9001; AS9100. - [ ] **A9.9 DCAA-compliance language detected** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: /\bdcaa\b/i (pass-only signal). - Why: DCAA compliance is a cost-accounting signal for federal contracts. - Fix: State DCAA-compliant accounting where it is true. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: DCAA. - [ ] **A9.10 Small-business set-aside identity (SDVOSB / WOSB / 8(a) / HUBZone) disclosed** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: /\bsdvosb\b|\bwosb\b|service[\s-]?disabled veteran[\s-]?owned|woman[\s-]?owned small business|hubzone|\b8$a$\b/i (pass-only signal). - Why: Set-aside identity drives eligibility for federal awards. - Fix: Disclose any verified set-aside status on the capabilities page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A9.11 Defense: CMMC level referenced on Capabilities / About** - Pass: The body or footer mentions CMMC or Cybersecurity Maturity Model Certification. - Fail: No match on a Capabilities or About page. - Numbers and lists the tool uses: regex /\bcmmc\b(?:\s*level\s*\d)?|cybersecurity maturity model certification/i; 32 CFR Part 170 effective December 16, 2024; DFARS acquisition rule effective November 10, 2025. - Why: CMMC requirements appear in live solicitations, so contracting officers look for it. Since July 13, 2026 CMMC Phase 2 is suspended, so solicitations ask only for a Level 1 (Self) or Level 2 (Self) assessment. - Fix: State your current CMMC level and self-assessment status on the Capabilities or About page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: 32 CFR Part 170 (CMMC 2.0). - [ ] **A9.12 Defense: DFARS 252.204-7012 or NIST SP 800-171 referenced** - Pass: The page references DFARS 252.204-7012 or NIST SP 800-171 (a separate pass line reports NIST SP 800-172, but it does not satisfy this check). - Fail: Neither appears on a Capabilities or About page. - Numbers and lists the tool uses: regexes /dfars\s*252\.204[\s-]?7012|252\.204[\s-]?7012/i and /nist\s*sp?\s*800[\s-]?171|nist\s*800[\s-]?171|sp\s*800[\s-]?171/i; NIST SP 800-171 has 110 controls. - Why: DFARS 252.204-7012 is the foundational DoD clause for handling controlled unclassified information. - Fix: Reference compliance with both on the Capabilities, About or Security page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: DFARS 252.204-7012; NIST SP 800-171. - [ ] **A9.13 Defense: cloud / SaaS offering references FedRAMP authorization** - Pass: FedRAMP is mentioned, or the page has no cloud context. - Fail: A Capabilities or About page has cloud context and no FedRAMP mention. - Numbers and lists the tool uses: regex /\bfedramp\b/i; cloud context /\b(?:cloud|saas|paas|iaas|platform|hosting|software-as-a-service)\b/i. - Why: Federal agencies can only buy cloud services that hold a FedRAMP authorization. - Fix: State the authorization level (Low, Moderate, High, DoD IL2, IL4, IL5, IL6, GovCloud) or the target you are pursuing. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FedRAMP. - [ ] **A9.14 Defense: cloud / SaaS context references SOC 2** - Pass: SOC 2 is mentioned, or the page has no cloud or managed-service context. - Fail: A Capabilities or About page matches cloud, saas, managed service, hosting or data platform and has no SOC 2 mention. - Numbers and lists the tool uses: regex /\bsoc\s*2\b|soc 2 type i{1,2}/i; context regex /(?:cloud|saas|managed service|hosting|data platform)/i. - Why: SOC 2 is the baseline customers expect before trusting a cloud service with their data. - Fix: State your SOC 2 audit status on the Capabilities or About page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: SOC 2. - [ ] **A9.15 Careers page does not mention security-clearance requirements** - Pass: Security-clearance language is present on the careers page. - Numbers and lists the tool uses: /security clearance|cleared (?:personnel|engineers|workforce|staff|employees)|ts\/sci|top\s*secret|active clearance/i; applies to careers pages matching /\/(careers|jobs|join-?us|opportunities|work-?at|hiring)(\/|$)/ (Mega Analyzer). - Why: Clearance language positions the company for defense work and doubles as an ITAR-related US-persons signal. - Fix: State the clearance level per role and the US citizenship baseline. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A9.16 No Capability Statement PDF on the Capabilities page** - Pass: The capabilities page references a capability statement. - Numbers and lists the tool uses: /capability statement|\bcap statement\b|capability brief/i; applies to capabilities pages matching /\/(capabilities|services|solutions|what-we-do|expertise|offerings|products|practice-areas?)(\/|$)/ (Mega Analyzer). - Why: The one-page capability statement is the standard hand-off document during government procurement. - Fix: Publish a Capability Statement PDF with CAGE, UEI, NAICS codes, past performance, set-asides and certifications. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). ### E-commerce - [ ] **A10.1 Store with international selling intent ships hreflang and multi-currency** - Pass: Hreflang or localized routing is detected on a store that signals international selling. - Fail: International intent is detected on the home or a product page with no hreflang. - Numbers and lists the tool uses: Intent regex /gdpr|popia|lgpd|pdpa|appi|international shipping|worldwide shipping|ships? (?:worldwide|internationally)|duties|customs|\beu\b|united kingdom/i; multi-currency regex /shopify-payment-button|currency.{0,10}(?:selector|switcher)|data-currency|money-format|\bcurrencies\b/i; evaluated on home and product pages (Mega Analyzer). - Why: Prices shown in the wrong currency are a top cause of international cart abandonment, and a single locale hides the store from regional search. - Fix: Publish localized URLs with hreflang plus x-default and enable multi-currency. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A10.2 Product has no brand** - Pass: The Product carries a brand. - Fail: A Product node on a product page has no brand (Mega Analyzer e-commerce issue). - Numbers and lists the tool uses: regex /"brand"\s*:/i on the JSON-LD text; runs only when the page is a product page (path matches /\/products?\//i, or Product plus Offer schema, or og:type product) and a Product or ProductGroup node is present (Mega Analyzer e-commerce module). - Why: Brand attributes the offer to the brand entity. - Fix: Add brand {"@type":"Brand","name":...} linked to the Organization @id. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org brand. - [ ] **A10.3 The page makes a country-of-origin claim ("`<value>`") in prose but the Product schema has no countryOfOrigin** - Pass: A made-in claim in the copy is matched by countryOfOrigin on the Product. - Numbers and lists the tool uses: claim regex /\b(made|handcrafted|hand-?made|crafted|manufactured|woven|tailored|sewn)\s+in\s+(italy|france|spain|portugal|england|the uk|japan|usa|the usa|america|u\.s\.a\.|switzerland|germany|turkey|mexico|peru|morocco|india|scotland)\b/i (Mega Analyzer). - Why: The provenance premium is invisible to machines, and origin claims must be truthful. - Fix: Add countryOfOrigin (and material) to the Product and qualify split-country production. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: 15 U.S.C. 45a. - [ ] **A10.4 Product describes a material (leather / silk / wool / metal etc.) in prose but has no material field** - Pass: The Product carries material when the copy names one. - Numbers and lists the tool uses: regex /\b(leather|cotton|silk|wool|cashmere|linen|suede|canvas|nylon|gold|silver|sterling|brass|steel|ceramic|wood)\b/i on the body (Mega Analyzer). - Why: Material-based filters and AI answers match on the field. - Fix: Add material to the Product. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org material. - [ ] **A10.5 A color appears in the product title/variant but the Product has no color field** - Pass: The Product carries color when a color appears in the title or variant. - Numbers and lists the tool uses: regex /\b(black|white|brown|tan|camel|navy|merlot|burgundy|beige|cream|red|blue|green|pink|gold|silver)\b/i on the title (Mega Analyzer). - Why: Color powers variant disambiguation in shopping surfaces. - Fix: Add color per variant or use ProductGroup with variesBy color. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org color. - [ ] **A10.6 The Product.image array has only `<n>` image while the page renders `<n>` product images** - Pass: The Product.image array carries the gallery images. - Fail: The schema has only one image while the page renders four or more product images. - Numbers and lists the tool uses: image match /"image"\s*:\s*("[^"]+"|\[[^\]]*\])/i; schema count < 2 and page images >= 4 (Mega Analyzer). - Why: Shopping surfaces reward multiple angles. - Fix: Put all gallery images in the image array. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org image. - [ ] **A10.7 Two or more WebSite nodes are emitted on this page (`<n>` found)** - Pass: Exactly one WebSite node is emitted. - Numbers and lists the tool uses: count /"@type"\s*:\s*"WebSite"/gi; fail at 2 or more (Mega Analyzer). - Why: Duplicate top-level entities confuse reconciliation and the sitelinks search box. - Fix: De-duplicate to one WebSite node with SearchAction. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org WebSite. - [ ] **A10.8 `<n>` e-commerce-readiness issue(s) (online store + AI shopping)** - Pass: No e-commerce readiness issues are reported across platform, product, collection, cart, policy, FAQ, about and home contexts. - Numbers and lists the tool uses: 16 CFR Part 465 (consumer reviews); 15 U.S.C. 45a (country of origin); 16 CFR Part 233 (reference pricing); CAN-SPAM and TCPA; WCAG 1.1.1 (Mega Analyzer). - Why: The aggregate covers citeability to AI shopping agents plus FTC review, origin and pricing rules. - Fix: One [OnlineStore, Organization] brand node with founder and sameAs; Product offers with price, priceCurrency, availability, itemCondition, priceValidUntil, seller @id, sku, gtin or mpn and all gallery images; shippingDetails and hasMerchantReturnPolicy; countryOfOrigin and material; color per variant; verified reviews only; FAQPage, CollectionPage, ItemList and BreadcrumbList; exactly one WebSite node on https://schema.org; compare-at prices must be bona fide. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: 16 CFR Part 465; 16 CFR Part 233. - [ ] **A10.9 This FAQ / shipping / returns / care page reads as Q&A but carries no FAQPage JSON-LD** - Pass: The FAQ page carries FAQPage schema. - Fail: The FAQ page, or a policy page with question-shaped copy, has no FAQPage schema. - Numbers and lists the tool uses: isPolicyPage /\/(policies|policy|shipping|returns?|refund|exchange|terms|privacy)(\/|$|-)/i with body /\b(how|what|when|do you|can i|return|exchange|ship|track|care|warranty)\b\?/i (mega-analyzer). - Why: This is one of the biggest AEO wins for a store, and most direct-to-consumer competitors skip it. - Fix: Wrap the questions in FAQPage and keep the answers factual. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org FAQPage. - [ ] **A10.10 Product page ships `<n>` of `<n>` images with no alt text** - Pass: A product page with 4 or more images has zero images missing alt. - Fail: IsProductPage && imgsMissingAlt > 3. - Numbers and lists the tool uses: fail when more than 3 missing; pass needs 0 missing and at least 4 images. - Why: A repeating product-page template turns one missing-alt pattern into a site-wide Level A failure and an ADA demand-letter target. - Fix: Set a descriptive alt from the product name plus the view (front, side, detail). - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: WCAG 1.1.1 (Level A); ADA Title III. - [ ] **A10.11 Reference / strike-through pricing detected ("was $X", "compare at", crossed-out price)** - Pass: No reference-price pattern appears. - Numbers and lists the tool uses: /\b(was|reg\.?|regular|compare at|originally|retail|msrp)\b\s*[:.]?\s*[\$€£]\s?\d/i on body text, or /`<s>`|`<del>`|line-through/i on the HTML (Mega Analyzer). - Why: A was or compare-at price must be a genuine former price. - Fix: Keep former-price claims honest and time-bounded. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FTC 16 CFR Part 233. - [ ] **A10.12 SMS / text-marketing capture detected** - Pass: Only an email capture is present (verify the CAN-SPAM footer and one-click unsubscribe on sends). - Fail: An SMS or text-marketing capture is present. - Numbers and lists the tool uses: SMS /\b(text|sms).{0,30}(?:offer|sign ?up|join|opt-?in)|by (?:submitting|signing up).{0,60}(?:text|sms|messages)|mobile (?:number|phone).{0,30}(?:offer|updates)/i; email /newsletter|sign ?up|subscribe|email.{0,20}(?:offer|discount|10% off|15% off|first order)|join (?:the )?(?:list|club)/i or a type=email input (Mega Analyzer). - Why: The TCPA requires prior express written consent before marketing texts. - Fix: Add an adjacent opt-in disclosure with message rates, frequency, STOP and HELP instructions and an unchecked consent box. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: TCPA; CAN-SPAM. - [ ] **A10.13 `<platform>` platform detected** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: Mega Analyzer: Shopify /cdn\.shopify\.com|\.myshopify\.com|shopify-section|x-shopify|window\.Shopify/i; WooCommerce /woocommerce|wc-|wp-content\/plugins\/woocommerce/i; BigCommerce /cdn\d*\.bigcommerce\.com|bigcommerce/i; Salesforce Commerce /demandware|dwstatic|commercecloud/i; Magento /magento|mage\/|static\/version/i; Centra /centra|centraqa/i. Mega SEO Analyzer Shopify storefront gate: /cdn\.shopify\.com/i, /shopify\.com\/s\//i, /Shopify\.theme/i, /data-shopify-/i, /<header-component\b/i, /<predictive-search\b/i, /\bShopify\.shop\b/i, or /shopify/i in the powered-by, x-shopid or x-shopify-stage header; theme version from /data-theme-version=["']([^"']+)["']/i. - Why: Naming the commerce platform switches on the platform-specific rule pack (Vendor field hygiene, Product schema completeness, empty-landing-page detection, theme-color, favicon, agent-readiness and Shopify-aware H1 hierarchy). - Fix: No fix; confirm the detected platform is right so the platform-specific checks apply. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). - [ ] **A10.14 Theme-color meta is present but empty** - Pass: The theme-color meta has a value. - Warn: A theme-color meta with empty content. - Numbers and lists the tool uses: regex /<meta[^>]+name=["']theme-color["'][^>]+content=["']\s*["']/i. - Why: An empty value fails to brand the mobile browser chrome. - Fix: Set a brand color in Shopify Admin, Online Store, Themes, Customize, Theme settings, Colors. - Verify: [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). - [ ] **A10.15 No `<link rel="icon">` in `<head>`** - Pass: A link rel=icon or shortcut icon exists. - Warn: No icon link in the head. - Numbers and lists the tool uses: regex /<link[^>]+rel=["'](?:icon|shortcut icon)["']/i. - Why: Shopify only emits the icon link when a favicon has been uploaded in theme settings. - Fix: Upload a favicon at Shopify Admin, Online Store, Themes, Customize, Theme settings, Favicon. - Verify: [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). - [ ] **A10.16 `<n>` H1 elements on page** - Pass: Exactly one H1, even when it is the visually hidden logo H1 that Shopify themes emit. - Warn: 2 or more H1s; when one is the hidden brand H1, the other (often a newsletter or banner section) should be demoted; otherwise pick the most important one as the H1. - Numbers and lists the tool uses: h1 regex /<h1\b[\s\S]*?<\/h1>/gi; hidden class regex /class=["'][^"']*(visually-hidden|sr-only|screen-reader)/i; warn at 2 or more. - Why: The duplicate appears on every page that includes that section. - Fix: Demote the extra H1 to H2 in the section template. - Verify: [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). - [ ] **A10.17 Product Offer is Out-of-Stock at $0.00, empty product landing page** - Pass: No Offer is OutOfStock at a zero price. - Numbers and lists the tool uses: availability /OutOfStock/i and price /^0(?:\.0+)?$/; fallback within 400 characters after the first Offer type (Mega SEO Analyzer). - Why: Customers land on a broken result. - Fix: Unpublish the product or set up a 301 redirect in Shopify Admin under Online Store, Navigation, URL Redirects. - Verify: [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: schema.org Offer. - [ ] **A10.18 Product schema brand.name is a real brand string ("`<brand>`"), not the bare domain** - Pass: Brand.name is a real brand string. - Fail: Brand.name is hostname-shaped or equals the page host. - Numbers and lists the tool uses: extract /"brand"\s*:\s*\{[^}]*?"name"\s*:\s*"([^"]+)"/i; domain shape /^[a-z0-9-]+(\.[a-z0-9-]+){1,}$/i or equal to the host (Mega SEO Analyzer). - Why: A Vendor field set to the domain propagates across every Product schema on the store. - Fix: Fix the Vendor field in Shopify Admin under Products with a bulk edit. - Verify: [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: schema.org Brand. - [ ] **A10.19 Product schema has empty "description", Shopify emits "" when the product description field is blank** - Pass: No Product has an empty description or an empty category. - Warn: A Product has category equal to an empty string. - Fail: A Product has description equal to an empty string. - Numbers and lists the tool uses: description === '' (fallback /"description"\s*:\s*""/) and category === '' (fallback /"category"\s*:\s*""/) within 1500 characters after the first Product type (Mega SEO Analyzer). - Why: Validators accept empty strings but Google Merchant Center rejects them. - Fix: Fill the product description and set the Google Product Category in Shopify Admin under Products. - Verify: [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). Standard: schema.org Product; Google Merchant Center; Google product taxonomy. - [ ] **A10.20 UCP capability profile served at /.well-known/ucp** - Pass: /.well-known/ucp is served (Agent-Ready Audit requires a 200 with parseable JSON; Mega Analyzer accepts any 2xx body over 5 chars that is not an HTML error page), or the page is not a commerce surface. - Warn: A commerce surface has no profile (Mega Analyzer warn; Mega SEO Analyzer impact 2; Mega AEO Analyzer: UCP is worth 50 of the agent-commerce dimension's 100 points, ACP eligibility the other 50); Agent-Ready Audit reports absence as informational. - Numbers and lists the tool uses: path /.well-known/ucp; Mega Analyzer commerce surface = Stripe script[src*=js.stripe.com|checkout.stripe.com|@stripe] or Shop Pay script[src*=shop.app|shopify|cdn.shopify.com] or a checkout CTA /(?:add to cart|add-to-cart|buy now|checkout|complete purchase|proceed to checkout)/i in the first 50000 chars, AND no service-family schema (Service, SelfStorageFacility, SelfStorage, LocalBusiness, LodgingBusiness, Hotel, MedicalBusiness, ProfessionalService, HomeAndConstructionBusiness, RealEstateAgent, AutomotiveBusiness, FoodEstablishment, Restaurant, Dentist, LegalService, FinancialService, InsuranceAgency, TravelAgency, MovingCompany, ChildCare, Physician, HealthAndBeautyBusiness), AND not every Offer url off-origin with no payment SDK; Mega SEO Analyzer and Mega AEO Analyzer gate on /js\.stripe\.com|checkout\.stripe\.com|cdn\.jsdelivr\.net\/npm\/@stripe|shop\.app|cdn\.shopify\.com|checkout\.shopify/i or /(?:add to cart|add-to-cart|buy now|checkout|complete purchase)/i over the whole HTML with the same service-schema list and no off-origin Offer rule; Shopify note markers /\/agents\.md|agentic_discovery|\/\.well-known\/ucp|\/api\/ucp\/mcp|universal commerce protocol/i and /\/llms\.txt|\/pages\/llms|"llms"/i. - Why: UCP is the Google plus Shopify discovery path (NRF 2026, about 20 launch partners) that tells shopping agents what your store supports; a brochure or service site has no reason to publish one. - Fix: Publish a JSON capability profile at /.well-known/ucp covering discovery, checkout and post-purchase; modern Shopify storefronts emit it automatically. - Verify: [Agent Ready Audit](https://jwatte.com/tools/agent-ready-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [Mega AEO Analyzer](https://jwatte.com/tools/mega-aeo-analyzer/). Standard: Universal Commerce Protocol (Google + Shopify); Cloudflare Agent Readiness Score (https://isitagentready.com/). - [ ] **A10.21 ACP eligibility (OpenAI + Stripe Agentic Commerce Protocol)** - Pass: The page loads the Stripe SDK, declares Product (or Offer/AggregateOffer) schema and is served over HTTPS, and is not a SaaS subscription page; not applicable off a commerce surface. - Warn: A commerce surface is missing one or more of the three (partial eligibility). - Numbers and lists the tool uses: Stripe /js\.stripe\.com|checkout\.stripe\.com|cdn\.jsdelivr\.net\/npm\/@stripe/i; Product schema /"@type"\s*:\s*"(?:Product|Offer|AggregateOffer)"/i; HTTPS /^https:/i on the URL; SaaS shape excluded: path /\/pricing\/?$/i, SoftwareApplication type, or /applicationCategory[^,]*DeveloperTools|applicationCategory[^,]*BusinessApplication/i; Mega SEO Analyzer evaluates only when Stripe or Product schema is present. - Why: ACP routes agent-driven checkout through Stripe, so all three signals must be present for ChatGPT to buy from you. - Fix: Serve over HTTPS, load the Stripe SDK and publish Product schema on product pages. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/), [Mega AEO Analyzer](https://jwatte.com/tools/mega-aeo-analyzer/). Standard: Agentic Commerce Protocol (OpenAI + Stripe). - [ ] **A10.22 ACP discovery document at /.well-known/acp.json** - Pass: /.well-known/acp.json is served on a commerce surface (Agent-Ready Audit requires parsed JSON with a protocol object; Mega Analyzer requires only a 2xx non-HTML body). - Warn: Missing on a commerce surface (Mega Analyzer); Agent-Ready Audit reports absence as informational. - Numbers and lists the tool uses: path /.well-known/acp.json; Agent-Ready Audit: parsed JSON with a protocol object; Mega Analyzer: any 2xx body that is not an HTML error page, gated on a commerce surface; the fields protocol.name 'acp', protocol.version, api_base_url, transports and capabilities.services are named only in the fix text and are not verified. - Why: Agents find the commerce API without opening a checkout session. - Fix: Publish acp.json with protocol.name 'acp', protocol.version, api_base_url, transports and capabilities.services; skip unless you sell via Stripe/OpenAI ACP. - Verify: [Agent Ready Audit](https://jwatte.com/tools/agent-ready-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: Agentic Commerce Protocol; Cloudflare Agent Readiness Score (https://isitagentready.com/). - [ ] **A10.23 MPP /openapi.json with x-payment-info extensions** - Pass: /openapi.json returns 200, parses as JSON and declares x-payment-info on payable operations. - Warn: Missing on a commerce surface (Mega Analyzer); Agent-Ready Audit reports absence as informational. - Numbers and lists the tool uses: path /openapi.json; /["']x-payment-info["']/. - Why: Declares payable operations to agents. - Fix: Add x-payment-info (intent, method, amount, currency) to payable operations via mppx or pympp middleware; skip unless you sell agent-callable services. - Verify: [Agent Ready Audit](https://jwatte.com/tools/agent-ready-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: MPP (Machine Payment Protocol); Cloudflare Agent Readiness Score (https://isitagentready.com/). - [ ] **A10.24 x402 v2 advertisement (Coinbase-led HTTP 402 protocol)** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: Mega Analyzer: Link header matching /\bpayment-required\b/i or an Accept-Payment header matching /x402/i, on commerce or developer surfaces; Agent-Ready Audit: /api or /api/v1 responds with HTTP 402. - Why: Per-request agent payments over HTTP 402; only relevant if you charge agents per request. - Fix: Add @x402/express, @x402/hono or @x402/next middleware if you sell per-request access. - Verify: [Agent Ready Audit](https://jwatte.com/tools/agent-ready-audit/), [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: x402 v2; Cloudflare Agent Readiness Score (https://isitagentready.com/). - [ ] **A10.25 Shopify agentic-discovery sitemap present at /sitemap_agentic_discovery.xml** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: path /sitemap_agentic_discovery.xml, referenced only from /sitemap.xml; reported only when present. - Why: Modern Shopify storefronts expose their agentic surface through this sitemap. - Fix: Shopify emits this automatically on modern storefronts; no manual fix. - Verify: [Mega SEO Analyzer](https://jwatte.com/tools/mega-seo-analyzer/). - [ ] **A10.26 Brand Organization node has no founder Person** - Pass: The brand Organization node names a founder. - Numbers and lists the tool uses: /"founder"\s*:/i; gated on an Organization node on the About or home page. - Why: AI answer engines cite people, and a brand with no named founder forfeits 'who started `<brand>`' queries. - Fix: Add a founder Person with sameAs and ship a ProfilePage for the founder. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org founder. - [ ] **A10.27 A sameAs value uses a short link / vanity redirect (pin.it, bit.ly, linktr.ee, etc.) instead of the canonical profile URL** - Pass: Every sameAs value and Pinterest link is a full canonical profile URL. - Fail: SameAs contains pin.it, bit.ly, linktr.ee, lnk.to or instagr.am, or the Pinterest link is a pin.it short link with no pinterest.com profile. - Numbers and lists the tool uses: /"sameAs"[\s\S]{0,200}?(pin\.it|bit\.ly|linktr\.ee|lnk\.to|instagr\.am)\//i; /\bpin\.it\//i without /pinterest\.com\//i. - Why: Redirects are weak, breakable entity anchors. - Fix: Replace short links with full canonical profile URLs and add LinkedIn, wholesale marketplaces and founder profiles. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A10.28 The underlying Shopify store domain ("`<value>`.myshopify.com") does not match the current brand name** - Pass: The myshopify subdomain matches the brand name. - Numbers and lists the tool uses: brandToken = og:site_name or title lowercased with non-alphanumerics stripped; pass when brandToken contains the myshopify name, the name contains the first 6 chars of brandToken, or the name is 'shop'. - Why: A rebrand leaves stranded legacy citations under the old name. - Fix: 301 the old domain, add alternateName, and point sameAs and canonicals to the current domain. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A10.29 Customer reviews appear on the page but no machine-readable AggregateRating / Review schema was found** - Pass: A review widget on a product or home page is backed by AggregateRating inside the Product node. - Warn: When schema is present the tool asks you to confirm ratingValue and reviewCount reflect a real, current, non-incentivized total. - Numbers and lists the tool uses: widget /judge\.me|loox|okendo|yotpo|stamped\.io|reviews\.io|junip|fera\.ai|trustpilot|\bstars?\b.*\d(?:\.\d)?\s*(?:out of|\/)\s*5/i. - Why: Visible stars are invisible to AI search and the review snippet without schema. - Fix: Have the review app emit aggregateRating inside the Product node. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FTC 16 CFR Part 465. - [ ] **A10.30 No customer-review system detected and no AggregateRating / Review schema** - Pass: A product or home page has a review system or review schema. - Numbers and lists the tool uses: gated on a product or home page with no review widget and no schema. - Why: Social proof is the biggest DTC conversion and AI-trust signal. - Fix: Install a verified-review app, request post-purchase reviews, then emit AggregateRating; never fabricate. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FTC 16 CFR Part 465. - [ ] **A10.31 Thin cross-platform brand presence** - Pass: Fewer than three of the seven channels are missing from the home or About page links. - Numbers and lists the tool uses: channels Instagram /instagram\.com\//i, Pinterest /pinterest\.com\/|\bpin\.it\//i, TikTok /tiktok\.com\//i, Facebook /facebook\.com\//i, YouTube /youtube\.com\/|youtu\.be\//i, LinkedIn /linkedin\.com\//i, a Google Business / Maps profile /g\.page\/|business\.google\.|maps\.google\.|goo\.gl\/maps|\/maps\/place\//i; scanned over the page HTML plus JSON-LD text on the home or About page; fail at 3 or more missing. - Why: Profiles double as sameAs anchors, and few channels reads as a less established brand. - Fix: Create and link the missing channels and list them in Organization sameAs. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A10.32 Refund / Return Policy: eligibility, request, processing, defects, exchanges** - Pass: An ecommerce store publishes a refund or return policy with the eligibility window, request procedure, processing time, defect claims and exchange process, linked from every product page and the footer. - Numbers and lists the tool uses: digital goods 14-day money-back where required by law including the EU 14-day withdrawal under Directive 2011/83/EU unless waived for immediate download; physical goods returns within 30 days of delivery for unused items in original condition; final-sale, custom and personalized items not returnable unless defective; request by email with order number and reason, photographs of damage for physical goods, response within 2 business days; refund to the original payment method within 5 to 10 business days of approval, excluding original shipping unless the return is the seller's error; defective or damaged items reported within 7 days for replacement or full refund; exchanges via a return and a new order; terms of service purchases clause: prices subject to change, taxes may apply. - Why: Shoppers and regulators expect a stated return window and refund process before purchase. - Fix: Publish the refund or return policy with the windows above and link it from every product page and the footer. - Verify: [Legal Pages Generator](https://jwatte.com/tools/legal-pages-generator/). Standard: Directive 2011/83/EU. ### Electricians - [ ] **A11.1 This page reads as Q and A but has no FAQPage JSON-LD** - Pass: The FAQ page carries FAQPage schema. - Fail: A service or FAQ page contains question marks in the body but has no FAQPage schema. - Numbers and lists the tool uses: Pages: service, FAQ; /\?(?:\s|$)/ on the full body (mega-analyzer). - Why: Service questions already written on the page are what answer engines quote, and the schema makes them eligible. - Fix: Wrap the questions in FAQPage. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org FAQPage. - [ ] **A11.2 `<n>` electrician-readiness issue(s)** - Pass: No electrician-readiness issues detected. - Numbers and lists the tool uses: gate: an Electrician schema type, an 'electrical contractor' or 'Master Electrician' signal, panel-upgrade, generator, EV-charger or rewiring services, or 'licensed / free estimate / service area' copy; signals: Electrician LocalBusiness type, canonical @context, firm node with telephone, areaServed, geo, openingHoursSpecification, sameAs, per-service Service schema, Person node for the Master Electrician, BreadcrumbList on inner pages, AggregateRating or Review (FTC consumer-review rule), FAQPage, Google Business Profile or map signal, state-license-number trust signal, EV-charger growth-category opportunity, permit and NEC code-compliance signal; context flags: homepage, service page, about, contact, gallery, FAQ; reference /blog/blog-mega-analyzer-electrician-contractor-readiness/. - Why: Fixing these makes you findable in the Google map pack and citable to AI for "electrician near me", and turns your license and reviews into trust signals search can read. - Fix: Emit one global Electrician node (@id `<site>`#org with name, image, telephone, url, areaServed, PostalAddress, GeoCoordinates, openingHoursSpecification, priceRange and sameAs to Google Business Profile, Facebook, Yelp, BBB, HomeAdvisor and Nextdoor) referenced by @id on every page, plus per-service Service schema, a Person node for the owner, FAQPage and BreadcrumbList. Display the state electrical license number in the footer and About or Contact and on the business node, use only real reviews (FTC 16 CFR Part 465), verify and fill the Google Business Profile with matching NAP, state that you pull permits and build to the NEC where accurate, and validate every JSON-LD block. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org Electrician, Service, Person, BreadcrumbList, FAQPage, AggregateRating, Review; FTC 16 CFR Part 465; National Electrical Code (NEC); WCAG 1.1.1. - [ ] **A11.3 No license number is displayed** - Pass: Home, About, contact or service pages display the state electrical license number. - Warn: The site advertises being licensed, a Master Electrician or an electrical contractor but shows no license number. - Numbers and lists the tool uses: /\b(?:lic(?:ense)?\.?\s*#|license\s*(?:no\.?|number)|state license|electrical license|contractor (?:license|registration|reg)|\bec\s*#|master(?:s)? license)\b[^.\n]{0,30}\d{3,}/i or /\blicense\s*#?\s*\d{3,}/i. - Why: Electrical work is state-licensed, and the number is a top trust signal. - Fix: Display the license number in the footer, About and contact pages and in schema (identifier or hasCredential). - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FTC substantiation. - [ ] **A11.4 No AggregateRating / Review schema** - Pass: Home, contact and About pages carry AggregateRating or Review schema with a confirmed real total. - Warn: When schema is present the tool asks you to confirm the total; when reviews are referenced without schema it reports that variant. - Numbers and lists the tool uses: widget /google review|yelp|angi|thumbtack|nextdoor|birdeye|homeadvisor|\b\d(?:\.\d)?\s*(?:out of|\/)\s*5\s*star/i on raw HTML plus body; claims /\b5-?star|highly rated|top-?rated|hundreds of (?:happy )?customers|\d+\s*(?:\+\s*)?(?:5-?star\s*)?reviews/i on body; no-schema branch gated on home, contact or About page. - Why: Reviews are the top trust signal for a local trade. - Fix: Confirm the real total and emit aggregateRating; never seed. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FTC 16 CFR Part 465. - [ ] **A11.5 About page tells the owner or experience story but has no Person schema** - Pass: An About page with owner or experience wording carries a Person node. - Numbers and lists the tool uses: /\b(owner|founder|master electrician|started|family-?owned|years? of experience|meet)\b/i on the About page. - Why: The owner is the brand. - Fix: Emit Person with jobTitle Master Electrician and worksFor referencing the business @id. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org Person. - [ ] **A11.6 No EV-charger / Level 2 / Tesla Wall Connector service is mentioned** - Pass: EV-charger service is mentioned on the home page. - Numbers and lists the tool uses: /ev charg|ev[ -]?charging|electric vehicle charg|tesla (?:wall connector|charger)|\bevse\b|level 2 charg/i on the home page (Mega Analyzer). - Why: EV charger installation is the fastest-growing residential electrical category. - Fix: Add an EV-charger service page with Service schema. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A11.7 No mention of permits, inspections, or code compliance** - Pass: Permit, inspection or NEC language is present on home or service pages. - Numbers and lists the tool uses: /\bpermit|\binspection\b|\bnec\b|national electrical code|code-?compliant|up to code|to code\b/i (Mega Analyzer). - Why: Permit and code language is a trust signal AI answers cite for licensed trades. - Fix: Add permit, inspection and code-compliance language where it is accurate. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: NEC. ### Financial services - [ ] **A12.1 YMYL-Finance: FinancialService schema** - Pass: A finance site declares FinancialService, BankOrCreditUnion or InsuranceAgency. - Numbers and lists the tool uses: regex /FinancialService|BankOrCreditUnion|InsuranceAgency/i (Mega Analyzer). - Why: Finance queries get tighter source-quality filters. - Fix: Add FinancialService JSON-LD. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org FinancialService. - [ ] **A12.2 YMYL-Finance: FINRA/CFP/CPA/BrokerCheck credential disclosure** - Pass: A finance credential, BrokerCheck or CRD reference, or a license marker appears in the body text. - Numbers and lists the tool uses: /\b(finra|cfp|cpa|series\s*\d+|registered investment|brokercheck|sec\.gov.*adv|investment adviser representative|\biar\b|crd\s*#?\s*\d+)/i. - Why: BrokerCheck is the FINRA-mandated disclosure for investment adviser representatives. - Fix: Publish FINRA, CFP or CPA credentials, a BrokerCheck link or the CRD number. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FINRA BrokerCheck. - [ ] **A12.3 YMYL-Finance: financial disclaimer (or visible /disclosure link)** - Pass: A financial disclaimer is present on the page or a disclaimer-class page is linked. - Numbers and lists the tool uses: /\b(not\s+(?:financial|investment|tax)\s+advice|past\s+performance\s+(?:does\s+not|is\s+not)|informational\s+purposes?\s+only|your\s+capital\s+is\s+at\s+risk)\b/i on body text; or any link href matching /\/(disclaimer|legal-notice|notice|terms-?(?:of-)?(?:use|service)?|privacy(?:-policy)?|disclosure|aboutus|legal)\/?(?:$|\?|#)/i. - Why: A disclosure is required for financial advice content. - Fix: Add a financial disclaimer or a /disclosure link. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). ### Government offices - [ ] **A13.1 Government or tribal-sovereignty domain detected** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: host /\.(?:gov|mil|nsn\.us|nsn\.gov)$/i; body /\b(?:tribal|nation|pueblo|nsn-)\b/i on the first 6000 characters. - Why: Government and tribal sites are bound by Section 508, WCAG 2.1 AA and the 21st Century IDEA Act as legal requirements, not best practice. - Fix: Run the WCAG Accessibility Audit (/tools/wcag-accessibility-audit/) and a plain-language review. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: Section 508; WCAG 2.1 AA; 21st Century IDEA Act. ### Handyman services - [ ] **A14.1 This service / FAQ page reads as Q&A but has no FAQPage JSON-LD** - Pass: The FAQ page carries FAQPage schema. - Fail: A service or FAQ page contains question marks in the body but has no FAQPage schema. - Numbers and lists the tool uses: Pages: service, FAQ; /\?(?:\s|$)/ on the full body (mega-analyzer). - Why: Service questions already written on the page are what answer engines quote, and the schema makes them eligible. - Fix: Wrap the questions in FAQPage. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org FAQPage. - [ ] **A14.2 `<n>` handyman-readiness issue(s)** - Pass: No handyman-readiness issues detected. - Numbers and lists the tool uses: gate: handyman, plumbing, electrical, painting, drywall, carpentry or HVAC signals, 'licensed bonded insured', 'free quote', a service area, or HomeAndConstructionBusiness or LocalBusiness schema; signals: LocalBusiness or HomeAndConstructionBusiness node with telephone, address or areaServed, geo, openingHoursSpecification, per-trade Service schema, Person for the owner, AggregateRating or Review (FTC), FAQPage, Google Business Profile or map presence, the placeholder-phone (555-01xx) trap, the client-rendered-SPA invisibility trap, Open Graph, a sitemap signal, a state-licensed-trade advertising guardrail; context flags: homepage, service page, about, contact, book or quote, FAQ; reference /blog/blog-mega-analyzer-handyman-local-service-readiness/. - Why: Fixing these makes you findable in the Google map pack and citable to AI for "handyman near me", and keeps trust and licensing claims substantiable. - Fix: Make sure services, phone and service area ship in the initial HTML (prerender or SSR a client-rendered app), then emit one global node typed ['HomeAndConstructionBusiness','LocalBusiness'] (@id `<site>`#org with name, image, telephone, url, areaServed, PostalAddress if published, GeoCoordinates, openingHoursSpecification, priceRange and sameAs to Google Business Profile, Facebook, Yelp or Angi), Service schema per trade, a Person node for the owner and FAQPage. Replace any 555 placeholder phone with the real number everywhere, create and fill the Google Business Profile with matching NAP, use only real reviews (FTC 16 CFR Part 465), limit plumbing, electrical and HVAC pages to the scope your state license allows, and validate every JSON-LD block. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org HomeAndConstructionBusiness, LocalBusiness, Service, Person, FAQPage, AggregateRating; FTC 16 CFR Part 465. - [ ] **A14.3 About page tells the owner story but has no Person schema** - Pass: An About page with owner wording carries a Person node. - Numbers and lists the tool uses: /\b(owner|founder|meet (?:tim|the owner|our)|started|i started|my name is)\b/i on the About page. - Why: The owner is the brand. - Fix: Emit Person with jobTitle Owner, worksFor referencing the business @id, and a photo. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org Person. - [ ] **A14.4 No reviews and no AggregateRating schema** - Pass: Home and contact pages carry AggregateRating or Review schema backed by real reviews. - Warn: When schema is present the tool asks you to confirm the total; when strong ratings are claimed without schema it reports that variant. - Numbers and lists the tool uses: widget /yelp|google review|angi|thumbtack|nextdoor|birdeye|nicejob|\b\d(?:\.\d)?\s*(?:out of|\/)\s*5\s*star/i; claims /\b5-?star|highly rated|top-?rated|hundreds of (?:happy )?customers\b/i. - Why: Reviews are the number one trust and ranking signal for a local trade. - Fix: Stand up the Business Profile, collect reviews, then emit AggregateRating. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FTC 16 CFR Part 465. - [ ] **A14.5 "Licensed, bonded, and insured" is advertised alongside state-regulated trades** - Pass: No licensed, bonded and insured claim is made. - Warn: The claim is made without a regulated trade listed; make sure each part is true and substantiable before launch. - Fail: The claim is made and plumbing, electrical or HVAC work is also advertised. - Numbers and lists the tool uses: /\blicensed,?\s*bonded,?\s*(?:and\s*)?insured\b|\bfully licensed\b/i; regulated trades = plumbing, electrical, hvac (Mega Analyzer). - Why: A general handyman license does not cover separately licensed trades. - Fix: Confirm which licenses you hold, name the license number, and limit the scope or add a disclaimer. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FTC substantiation. ### Health and medical - [ ] **A15.1 YMYL-Health: Practitioner or MedicalBusiness schema** - Pass: A health site declares a medical practice type (Physician, MedicalBusiness, Dentist, MentalHealthService, Chiropractor and so on). - Fail: No medical or practitioner type is found, which is reported as critical for health sites. - Numbers and lists the tool uses: gate /^YMYL-Health(?!-MentalHealth)/i: no schema type matches /MedicalBusiness|Physician|MedicalClinic|Hospital|PrimaryCare|Internist|FamilyPractice|Pediatric|MentalHealthService|Dermatology|Optometric|Optician|EmergencyService|Physiotherapy|CovidTestingFacility|Chiropractor|Geriatric|Surgical|MedicalOrganization|MedicalSpecialty|CommunityHealth/i or /Dentist|DentalClinic/i; mental health (ymylVertical === 'YMYL-Health-MentalHealth') /MentalHealthService|Psychotherapy|MedicalBusiness|Person/i; chiropractic, optometry and podiatry gate /^YMYL-Health-(Chiropractic|Optometry|Podiatry)$/ with /Chiropractor|Optometric|Optician|Podiatric|MedicalBusiness|MedicalClinic|Person/i; reported as critical under 'YMYL vertical (`<vertical>`) missing required trust signals' (Mega Analyzer). - Why: AI Overviews apply tighter source-quality filters to health queries, so the practice needs a recognized medical entity anchor. - Fix: Add Physician, MedicalBusiness, Dentist, MentalHealthService or the specific practice-type JSON-LD with the practitioner's credentials. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org MedicalBusiness; Google Search Quality Rater Guidelines section 3.4. - [ ] **A15.2 YMYL-Health: license or credential disclosure** - Pass: The body text carries an NPI, MD or DO, board-certified or state-license phrase, or a license marker. - Numbers and lists the tool uses: /\b(npi|md\b|do\b|nurse practitioner|board[- ]certified|licensed in\b|state license)/i or the general license marker. - Why: Health sources need visible credentials to pass YMYL filters. - Fix: Publish the NPI, license and board certification in visible copy. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: Google SQRG v2024 3.4. - [ ] **A15.3 YMYL-Health: HIPAA notice or link** - Pass: The word HIPAA appears in the body text or in a link. - Numbers and lists the tool uses: /hipaa/i on body text and link hrefs. - Why: Covered entities must publish a Notice of Privacy Practices. - Fix: Add a HIPAA notice page and link it. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: HIPAA. - [ ] **A15.4 YMYL-Health: medical disclaimer (or visible /disclaimer link)** - Pass: A medical disclaimer is present on the page or a disclaimer-class page is linked. - Numbers and lists the tool uses: medical disclaimer /\b(not\s+(?:medical|professional)\s+advice|consult\s+(?:your|a)\s+(?:doctor|physician|healthcare)|for\s+informational\s+purposes\s+only)\b/i on lowercased body text, or a link matching /\/(disclaimer|legal-notice|notice|terms-?(?:of-)?(?:use|service)?|privacy(?:-policy)?|disclosure|aboutus|legal)\/?(?:$|\?|#)/i; gate /^YMYL-Health(?!-MentalHealth)/i. - Why: A regulated disclaimer is expected on health sites. - Fix: Add a medical disclaimer or link a /disclaimer page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). ### Home and property inspection - [ ] **A16.1 FAQ page carries no FAQPage JSON-LD** - Pass: The FAQ page carries FAQPage schema. - Numbers and lists the tool uses: Page gate: isFaqPage (mega-analyzer). - Why: AI Overviews and People Also Ask preferentially lift schema-wrapped question and answer content. - Fix: Wrap the Q&A in FAQPage > Question > acceptedAnswer. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org FAQPage. - [ ] **A16.2 `<n>` property-inspection-readiness issue(s)** - Pass: No property-inspection-readiness issues detected across the service, FAQ, reviews, booking, sample-report, contact and about contexts. - Numbers and lists the tool uses: contexts: service, FAQ, reviews, booking, sample report, contact, about; references InterNACHI and ASHI Standards of Practice, NRPP and AARST radon, Texas TREC licensing. - Why: Citeability as a home inspector depends on InterNACHI or ASHI, FTC and ADA expectations being visible on the site. - Fix: Replace an invalid ['Person','Organization'] type with ['HomeAndConstructionBusiness','LocalBusiness'] @id #org, give the firm node telephone, PostalAddress, areaServed, memberOf InterNACHI and sameAs (GBP cid, Yelp, BBB, InterNACHI find-an-inspector, Facebook), add a Service node per service page, FAQPage and caption-based alt text on report pages. State the SOP, Code of Ethics, E&O insurance, NRPP or AARST and license number, validate the JSON-LD, and keep every superlative or guarantee claim FTC-substantiable. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A16.3 No machine-readable AggregateRating / Review schema on the reviews / firm node** - Pass: The reviews or About page carries AggregateRating or Review schema. - Numbers and lists the tool uses: gated on a reviews or About page. - Why: AI search cannot cite 'rated X by N customers' unless it is structured, and FTC substantiation applies. - Fix: Show the platform rating and a few reviews as text that links to the source. Do not copy them into aggregateRating on the firm node: Google allows no ratings from other sites and shows no stars for a business's own reviews. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FTC substantiation. - [ ] **A16.4 No InterNACHI or ASHI membership statement on the About / homepage** - Pass: The About page mentions InterNACHI or ASHI membership. - Numbers and lists the tool uses: /internachi|nachi\.org|certified master inspector|certified professional inspector/i or /\bashi\b|american society of home inspectors/i. - Why: Colorado and several other states do not license inspectors, so association membership is the credential. - Fix: Add a visible 'InterNACHI Certified' or 'ASHI Member' line, memberOf on the JSON-LD and the find-an-inspector URL in sameAs. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A16.5 No reference to the InterNACHI/ASHI Standards of Practice, Code of Ethics, or a pre-inspection agreement** - Pass: Service or About pages name the Standards of Practice, Code of Ethics or a pre-inspection agreement. - Numbers and lists the tool uses: /standards of practice|code of ethics|inspection agreement|pre-inspection agreement/i. - Why: Naming the Standards of Practice is a primary trust and scope-limiting signal. - Fix: Add 'Inspections performed to the InterNACHI Standards of Practice' with a link. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: InterNACHI / ASHI Standards of Practice. - [ ] **A16.6 No errors-and-omissions / general-liability insurance statement** - Pass: The About page states E&O and general liability insurance. - Numbers and lists the tool uses: /errors (?:and|&) omissions|\be&o\b|general liability|fully insured|insured and bonded/i. - Why: Insurance is a standard trust signal agents and buyers look for. - Fix: Add a visible 'E&O and general liability insured' line. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A16.7 Radon page without an NRPP / AARST certification reference** - Pass: Radon pages state an NRPP or AARST certification. - Numbers and lists the tool uses: /\bnrpp\b|\baarst\b|national radon proficiency|radon (?:measurement|mitigation) (?:certified|professional)/i; gated on /radon/i in the path or title. - Why: Radon claims are health (YMYL) claims. - Fix: State the NRPP or AARST certification and the state registration. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: AARST-NRPP. - [ ] **A16.8 Texas market referenced but no TREC license disclosure detected** - Pass: Pages that mention Texas markets disclose the TREC license number. - Numbers and lists the tool uses: /trec|texas real estate commission|tx license|license\s*#?\s*\d{3,}/i; Texas market /\b(texas|dallas|fort worth|houston|austin|san antonio|dfw)\b/i. - Why: Texas licenses home inspectors and requires the license number in advertising. - Fix: Disclose the TREC license number on Texas-market pages. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: Texas Real Estate Commission. - [ ] **A16.9 Photo-heavy report/sample page ships `<n>` images with no alt text** - Pass: A sample-report page has 3 or fewer images missing alt. - Fail: IsSampleReportPage && imgsMissingAlt > 3. - Numbers and lists the tool uses: > 3 missing on a sample-report page. - Why: One missing-alt pattern multiplies across every auto-generated inspection report page. - Fix: Set the alt from the existing caption or finding label. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: WCAG 1.1.1 (Level A). - [ ] **A16.10 Superlative / guarantee / review-count claim detected (`<claims>`)** - Pass: No superlative, review-count or guarantee claim appears in the title or opening copy. - Fail: A superlative, a numeric review claim or a guarantee claim matches. - Numbers and lists the tool uses: claim text = title + first 6000 characters of body and footer; superlatives /\b(largest|most-? ?referred|#?1\b|number one|best|most trusted)\b/i; review claim /(\d[\d,]{2,})\s*\+?\s*(?:5-?star|five-?star|reviews?)/i; guarantee claim /\b(\d{2,3}%|money-?back|satisfaction)\s*guarantee/i (Mega Analyzer). - Why: These are advertising claims that FTC substantiation rules require you to back with evidence. - Fix: Keep a dated, verifiable source for each claim and tie review counts to an auditable platform total. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FTC substantiation. ### Hotels and motels - [ ] **A17.1 This rooms/accommodations page has no HotelRoom / Suite schema** - Pass: Room pages model each room as HotelRoom or Suite with an Offer. - Numbers and lists the tool uses: rooms page /\/(rooms?|suites?|accommodations?|stay|book(?:ing)?|reservations?)(\/|$|-)/; room node type /(^|\b)(HotelRoom|Suite|Room)(\b|$)/ or /"@type"\s*:\s*"(?:HotelRoom|Suite)"/i (Mega Analyzer). - Why: Room types and rates become eligible for Google Hotels. - Fix: Model each room as HotelRoom with occupancy, bed, amenityFeature and an Offer. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org HotelRoom. - [ ] **A17.2 A visible FAQ exists but there is no FAQPage schema** - Pass: FAQPage schema is present. - Fail: A visible FAQ with three or more question marks has no FAQPage schema. - Numbers and lists the tool uses: /frequently asked|(^|[\s>(])FAQs?([\s<):.]|$)/ and question marks >= 3 (mega-analyzer). - Why: Guest questions about parking, check-in, pets and cancellation are what answer engines get asked about a hotel. - Fix: Wrap guest Q&A (parking, check-in, pets, amenities, cancellation) in FAQPage. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org FAQPage. - [ ] **A17.3 Hotel node NAP fields (PostalAddress, geo, telephone, checkinTime/checkoutTime, priceRange/starRating)** - Pass: The Hotel node has PostalAddress, geo, telephone, checkinTime and checkoutTime, and priceRange or starRating. - Fail: Missing PostalAddress; missing geo on the home or contact page; missing telephone; missing checkinTime or checkoutTime on the home or rooms page; or neither priceRange nor starRating on the homepage. - Numbers and lists the tool uses: gate hasHotelType || hasOrg; hasPostal /"PostalAddress"|"streetAddress"/i; hasGeo /"geo"\s*:\s*\{|"GeoCoordinates"|"latitude"/i (home or contact page); hasTel /"telephone"\s*:/i; hasCheckin /"checkinTime"|"checkoutTime"/i (home or rooms page); hasPriceRange /"priceRange"/i and hasStar /"starRating"/i (homepage). - Why: These fields feed Google and Apple pins and Google Hotels. - Fix: Add checkinTime (for example 15:00), checkoutTime (for example 11:00) and priceRange or a starRating Rating to the Hotel node. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org Hotel. - [ ] **A17.4 `<n>` hotel-readiness issue(s)** - Pass: No hotel-readiness issues detected. - Numbers and lists the tool uses: gate: Hotel or LodgingBusiness schema, or lodging plus booking signals; signals: Hotel or LodgingBusiness typing, NAP, geo, telephone, check-in and check-out, priceRange or starRating on the hotel node, per-room HotelRoom and Offer, FAQPage, FTC-aware reviews, and the local-listing sameAs graph: Google (Business Profile or Maps to Google Hotels), Apple Maps (Apple Business Connect), Yelp, TripAdvisor, the OTAs; context flags: homepage, rooms or booking, dining, contact or location, FAQ; reference /blog/blog-mega-analyzer-hotel-lodging-readiness/. - Why: Most hotel sites ship the on-page schema but forget to bind it to their listings, and that listing graph drifts out of date, so fixing it keeps the property bookable, map-pack-visible and citable in AI travel answers. - Fix: Emit a Hotel node (@id `<site>`#hotel with name, PostalAddress, GeoCoordinates, telephone, priceRange, starRating, checkinTime 15:00, checkoutTime 11:00) referenced by @id on every page, each room type as HotelRoom with occupancy, bed, amenityFeature and an Offer with price, priceCurrency and availability, and FAQPage over the visible guest FAQ. Add sameAs to Google Business Profile or Maps, Apple Maps, Yelp, TripAdvisor and OTA listings, audit each listing for hours, phone, photos, amenities and cancellation policy, merge or redirect duplicate pins, keep NAP identical everywhere, use only real reviews, and validate every JSON-LD block. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org Hotel, LodgingBusiness, HotelRoom, Offer, QuantitativeValue, Rating, FAQPage, sameAs; Apple Business Connect; FTC 16 CFR Part 465. - [ ] **A17.5 Guest reviews/ratings are referenced but there is no machine-readable AggregateRating / Review schema** - Pass: Home and contact pages that reference guest ratings carry AggregateRating or Review schema. - Numbers and lists the tool uses: /\b\d(?:\.\d)?\s*(?:out of|\/)\s*5\b|guest reviews|\btripadvisor\b|\d+\s*reviews/i. - Why: Referenced ratings that are not structured cannot be cited or shown as stars. - Fix: Emit aggregateRating from the real current total. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FTC 16 CFR Part 465. ### HVAC contractors - [ ] **A18.1 This page reads as Q and A but has no FAQPage JSON-LD** - Pass: The FAQ page carries FAQPage schema. - Fail: A service or FAQ page contains question marks in the body but has no FAQPage schema. - Numbers and lists the tool uses: Pages: service, FAQ; /\?(?:\s|$)/ on the full body (mega-analyzer). - Why: Service questions already written on the page are what answer engines quote, and the schema makes them eligible. - Fix: Wrap the questions in FAQPage. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org FAQPage. - [ ] **A18.2 `<n>` HVAC-readiness issue(s)** - Pass: No HVAC-readiness issues detected, with the list of expected signals satisfied. - Numbers and lists the tool uses: gate: an HVACBusiness schema type, a 'heating and cooling' or 'HVAC' signal, AC, furnace, heat-pump, tune-up or ductwork services, or 'licensed / free estimate / 24/7 emergency' copy; signals: HVACBusiness LocalBusiness type, canonical https://schema.org @context (flags http://www.schema.org), firm node with top-level telephone, areaServed, geo, openingHoursSpecification, sameAs, per-service Service schema, Person node for the owner or lead tech, BreadcrumbList on inner pages, AggregateRating or Review under the FTC consumer-review rule, FAQPage, Google Business Profile or map signal, EPA 608 plus NATE plus state HVAC-license credential trifecta, heat-pump category, mechanical-permit and combustion or carbon-monoxide safety signal, factory-authorized-dealer or brands-serviced signal, maintenance-plan signal, consumer-financing signal, SEER2 / AFUE / A2L refrigerant / 25C rebate literacy; context flags: homepage, service page, about, contact, gallery, FAQ; reference /blog/blog-mega-analyzer-hvac-contractor-readiness/. - Why: Fixing these makes you findable in the Google map pack and citable to AI for "AC, furnace or heat-pump repair near me", and turns your EPA 608 and NATE credentials, reviews and brands into trust signals search can read. - Fix: Emit one global HVACBusiness node (@id `<site>`#org with name, image, telephone, url, areaServed, PostalAddress, GeoCoordinates, openingHoursSpecification, priceRange and sameAs to Google Business Profile, Facebook, Yelp and the manufacturer dealer page) referenced by @id on every page, plus per-service Service schema, a Person node for the owner, FAQPage and BreadcrumbList. Display EPA Section 608, NATE and the state license in the footer and About or Contact as hasCredential, use only real reviews (FTC 16 CFR Part 465), verify and fill the Google Business Profile with matching NAP, and validate every JSON-LD block. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org HVACBusiness, Service, Person, EducationalOccupationalCredential, AggregateRating, Review, FAQPage, BreadcrumbList; FTC 16 CFR Part 465; TILA / Reg Z; WCAG 1.1.1. - [ ] **A18.3 No HVAC credential is displayed (EPA 608 / NATE / state license)** - Pass: Home, About, contact or service pages display an EPA 608 type, NATE certification or a state license number, ideally also as hasCredential schema. - Warn: The site advertises being licensed or certified but shows no HVAC credential. - Numbers and lists the tool uses: EPA 608 /\bepa\b[^.\n]{0,20}(?:608|section\s*608|certified|certification)|section\s*608|\b608[- ]certified\b/i; NATE /\bnate[- ]?certified\b|\bnate\b[^.\n]{0,20}(?:certified|certification|technician)|north american technician excellence/i; license number /\b(?:lic(?:ense)?\.?\s*#|license\s*(?:no\.?|number)|state license|hvac license|mechanical (?:license|contractor)|contractor (?:license|registration|reg)|reg(?:istration)?\s*#)\b[^.\n]{0,30}[a-z]?\d{3,}/i or /\blicense\s*#?\s*[a-z]?\d{3,}/i; the licensed-or-certified warn variant fires on /\blicensed\b|\bbonded\b|\binsured\b|\bcertified\b|\bnate\b|epa (?:608|certified|section 608)|mechanical contractor|hvac contractor/i; all tested on body plus footer text on home, About, contact or service pages. - Why: EPA 608 certification is federally required to handle refrigerant. - Fix: Display the EPA 608 type, NATE and state license number in the footer, About and contact pages and as hasCredential. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: Clean Air Act Section 608; NATE. - [ ] **A18.4 No AggregateRating / Review schema** - Pass: Home, contact and About pages carry AggregateRating or Review schema with a confirmed real total. - Warn: When schema is present the tool asks you to confirm the count and value; when reviews or ratings are referenced without schema it reports that variant. - Numbers and lists the tool uses: widget /google review|yelp|angi|thumbtack|nextdoor|birdeye|homeadvisor|\b\d(?:\.\d)?\s*(?:out of|\/)\s*5\s*star/i; claims /\b5-?star|highly rated|top-?rated|hundreds of (?:happy )?customers|\d+\s*(?:\+\s*)?(?:5-?star\s*)?reviews/i. - Why: Almost no HVAC competitor ships review schema, so a real one stands out. - Fix: Confirm the real current total, emit aggregateRating, and never seed reviews. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FTC 16 CFR Part 465. - [ ] **A18.5 About page tells the owner or experience story but has no Person schema** - Pass: An About page with owner or experience wording carries a Person node. - Numbers and lists the tool uses: /\b(owner|founder|lead tech|technician|started|family-?owned|years? of experience|meet)\b/i on the About page. - Why: The owner is the brand. - Fix: Emit Person with jobTitle, worksFor, photo and hasCredential. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org Person. - [ ] **A18.6 No heat-pump / ductless mini-split service is mentioned** - Pass: Heat-pump or ductless service is mentioned on the home page. - Numbers and lists the tool uses: /heat pump|mini-?split|ductless|dual fuel|cold-?climate heat pump/i on the home page (Mega Analyzer). - Why: Heat pumps are the fastest-growing HVAC category and the focus of the federal 25C credit and IRA rebates. - Fix: Add a heat-pump service page with Service schema. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A18.7 No mention of permits, mechanical code, or combustion / carbon-monoxide safety** - Pass: Permit, mechanical-code or combustion safety language is present on home or service pages. - Numbers and lists the tool uses: /\bpermit|\binspection\b|mechanical code|\bimc\b|to code\b|up to code|code-?compliant/i; /carbon monoxide|\bco\b alarm|combustion (?:analysis|safety|test)|flue|heat exchanger (?:crack|inspection)|gas leak/i (Mega Analyzer). - Why: Permit and combustion-safety language is a genuine trust signal for a licensed trade. - Fix: Add permit, code and carbon-monoxide safety language where it is accurate. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A18.8 No equipment brands or dealer status mentioned** - Pass: Brand names, a 'we service all major brands' statement, or dealer authorization appear on home or about pages. - Numbers and lists the tool uses: brands /carrier|trane|lennox|goodman|rheem|ruud|bryant|amana|york|daikin|mitsubishi|fujitsu|bosch|coleman|payne|american standard|heil|tempstar/i or /all (?:major )?brands|any (?:make|brand)|service all (?:makes|brands)/i; dealer /factory[- ]authorized|authorized dealer|certified dealer|preferred dealer|comfort specialist|elite dealer/i; checked on home and about pages (Mega Analyzer). - Why: Buyers search by brand. - Fix: State the brands you service and any dealer authorization, and mark it up with hasCredential or sameAs. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A18.9 No maintenance plan / membership is offered** - Pass: A maintenance plan or membership is mentioned on home or service pages. - Numbers and lists the tool uses: /maintenance (?:plan|agreement|program|membership)|service (?:plan|agreement)|comfort club|membership|annual (?:plan|agreement)|priority (?:service|scheduling)|tune-?up (?:plan|membership)/i (Mega Analyzer). - Why: Maintenance plans are the core recurring-revenue and retention play. - Fix: Give the plan its own page with a Service or Offer schema node. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A18.10 No financing option is mentioned** - Pass: Consumer financing is mentioned on home or service pages. - Numbers and lists the tool uses: /financ|monthly payment|payment plan|\bwisetack\b|\bsynchrony\b|\bgreensky\b|0% apr|pay over time|installment/i (Mega Analyzer). - Why: Financing removes the price objection; a stated APR triggers TILA and Regulation Z disclosures. - Fix: Add a financing mention or page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: TILA / Regulation Z. - [ ] **A18.11 No efficiency-rating, rebate, or tax-credit content (SEER2 / AFUE / HSPF2, ENERGY STAR, 25C, utility rebates)** - Pass: Efficiency, rebate or tax-credit content is present on home or service pages, and refrigerant-transition literacy is reported separately. - Numbers and lists the tool uses: /\bseer2?\b|\bafue\b|\bhspf2?\b|energy[- ]efficient|high[- ]efficiency|25c|inflation reduction|tax credit|rebate|energy star/i; refrigerant /\br-?410a\b|\br-?454b\b|\br-?32\b|\ba2l\b|low-?gwp|r-?22|refrigerant (?:transition|phase)/i (Mega Analyzer). - Why: Efficiency and rebate content is the highest-intent decision-stage content and a surface AI answers draw on. - Fix: Add efficiency-rating, rebate and tax-credit content, plus a note on the R-410A to A2L refrigerant transition. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). ### Industrial and manufacturing - [ ] **A19.1 Local-Industrial: No industry certification badge (AWS / ISO 9001 / AS9100 / ITAR / NIST / ASME) visible** - Pass: An industrial certification appears in the body text. - Numbers and lists the tool uses: /(?:AWS\s+D1\.1|ISO\s*9001|AS9100|ITAR|NIST\s+800-171|ASME|ASTM|UL\s+listed|CE\s+marked)/i. - Why: Certifications are the trust signal industrial buyers look for. - Fix: Display the certification badges the shop actually holds. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A19.2 Local-Industrial: No Capabilities / Industries-Served / Equipment-List page** - Pass: Capabilities language appears in the text or a capabilities-class link exists. - Numbers and lists the tool uses: text /(?:capabilities|industries\s+served|equipment\s+list|certifications?)/i; links /\/(capabilities|industries|equipment|certifications?|quality)\/?$/i (Mega Analyzer). - Why: Buyers who send RFQs judge a shop by its capabilities, industries served and certifications. - Fix: Add a Capabilities or Industries Served page listing equipment and certifications. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A19.3 Local-Industrial: No RFQ / quote-request CTA visible** - Pass: RFQ or quote-request language appears in the body text. - Numbers and lists the tool uses: /(?:RFQ|request\s+(?:for\s+)?(?:a\s+)?quote|get\s+a\s+quote|quote\s+request)/i (Mega Analyzer). - Why: Industrial buyers convert through a quote request, not an online booking. - Fix: Add a visible RFQ or Get a Quote call to action. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). ### Laundromats - [ ] **A20.1 No Spanish-language signal (hreflang=es, an /es/ path, or Spanish content)** - Pass: A Spanish hreflang, lang, /es/ path or Spanish wording is present on the homepage. - Fail: The homepage has no match. - Numbers and lists the tool uses: regex /hreflang=["']es|lang=["']es|\/es\/|en espa[nñ]ol|espa[nñ]ol/i on the raw HTML; gated to the homepage. - Why: Spanish coverage is a real way to reach and convert more customers. - Fix: Add Spanish core pages with reciprocal hreflang en, es and x-default. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: hreflang. - [ ] **A20.2 The page reads as Q&A but has no FAQPage JSON-LD** - Pass: The FAQ page carries FAQPage schema. - Fail: A home, FAQ or service page contains question marks in the body but has no FAQPage schema. - Numbers and lists the tool uses: Pages: home, FAQ, service; /\?(?:\s|$)/ on the full body (mega-analyzer). - Why: Question and answer content is the exact surface AI Overviews lift for laundromat queries. - Fix: Wrap the real questions in FAQPage > Question > acceptedAnswer. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org FAQPage. - [ ] **A20.3 The page claims 24-hour / 24-7 access but there is no openingHoursSpecification to back it** - Pass: A page that claims 24-hour access also has hours schema. - Fail: Home or contact page text matches the 24/7 claim regex and no openingHoursSpecification exists. - Numbers and lists the tool uses: claims247 /\bopen 24 ?hours?\b|24\/7|24-7|\baround the clock\b|always open\b/i on home or contact pages. - Why: The always-open advantage should be machine-readable so "open now" searches can use it. - Fix: Mirror the claim in schema with opens 00:00 and closes 23:59 across all 7 days. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org/OpeningHoursSpecification. - [ ] **A20.4 `<n>` laundromat-readiness issue(s)** - Pass: No laundromat-readiness issues detected. - Numbers and lists the tool uses: gate: laundromat, coin-laundry, wash-and-fold or drop-off signals, washer-dryer plus Speed Queen, Dexter or Huebsch machine brands, or DryCleaningOrLaundry schema; signals: DryCleaningOrLaundry node with NAP, geo, openingHoursSpecification, honest 24/7-vs-staffed hours, paymentAccepted (coin, card, Apple Pay, Google Pay, app), amenityFeature, areaServed for delivery, sameAs (Google Business Profile, Yelp, Facebook), FAQPage, AggregateRating or Review (FTC), Service schema on wash-and-fold and pickup-and-delivery, accessibility or ADA Title III statement, Spanish and hreflang, client-rendered-SPA trap, Open Graph, FTC superlative and Green Guides guardrails; context flags: homepage, service page, location, pricing, contact or hours, FAQ; reference /blog/blog-mega-analyzer-laundromat-readiness/. - Why: Fixing these wins "laundromat near me" and "open now" in the Google map pack and AI answers, and keeps hours, payment and review claims honest. - Fix: Emit one global DryCleaningOrLaundry node (@id `<site>`/#business with name, image, telephone, url, PostalAddress, GeoCoordinates, openingHoursSpecification, paymentAccepted, priceRange, currenciesAccepted, amenityFeature, areaServed and sameAs to GBP, Yelp and Facebook), mirror real hours in schema and state attended hours separately when access is 24/7, list every payment method in copy and schema, and give wash-and-fold and pickup-and-delivery their own pages with Service nodes. Set the Google Business Profile category to Laundromat with matching NAP, use only real reviews (FTC 16 CFR Part 465), add FAQPage, an accessibility statement, Spanish pages with reciprocal hreflang where warranted, make superlative and eco claims specific, and validate every JSON-LD block. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org DryCleaningOrLaundry, LocationFeatureSpecification, Service, FAQPage; FTC 16 CFR Part 465; FTC Green Guides; ADA Title III; WCAG 2.1 AA. - [ ] **A20.5 No sameAs on the business node** - Pass: The home and contact pages' business node links external profiles via sameAs. - Numbers and lists the tool uses: /"sameAs"\s*:/i; gated on the home or contact page. - Why: Engines reconcile the laundromat across the citation graph through its Business Profile, Yelp and Facebook pages. - Fix: Link Google Business Profile, Yelp and Facebook in sameAs. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org sameAs. - [ ] **A20.6 The site claims strong ratings or shows reviews, but there is no machine-readable AggregateRating / Review schema** - Pass: Rating claims or review widgets on the home or contact page are backed by AggregateRating or Review schema. - Warn: When schema is present the tool asks you to confirm the count reflects a real platform total. - Numbers and lists the tool uses: claims /\b5-?star|highly rated|top-?rated|best laundromat\b/i or widget /yelp|google review|\b\d(?:\.\d)?\s*(?:out of|\/)\s*5\s*star/i; FTC penalty up to $51,744 per violation. - Why: Fabricated ratings are an advertising violation, and real ones should be machine-readable. - Fix: Once you have real reviews, emit aggregateRating with the real count. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: 16 CFR Part 465. - [ ] **A20.7 No accessibility statement or accessibility signal** - Pass: Any audited page where the signal regex matches the raw HTML, or that is the accessibility page, gets the pass row 'Accessibility / ADA signal present'. - Fail: The homepage matches none of the signal phrases. - Numbers and lists the tool uses: /accessibility statement|web content accessibility|wcag|ada compliant|ada accessible|wheelchair accessible/i tested on the raw HTML, or isAccessibilityPage; the fail fires on the homepage only; the pass fires on any page where the signal matches; the fail text cites web filings topping 5,100 in 2025. - Why: Laundromats are public accommodations under ADA Title III, so the website is in scope too. - Fix: Publish an accessibility statement, reach WCAG 2.1 AA, and note accessible machines and parking. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: ADA Title III; WCAG 2.1 AA. - [ ] **A20.8 You advertise 24-hour access AND on-site staff/attendant** - Pass: The site does not claim both 24-hour access and on-site staff. - Numbers and lists the tool uses: 24/7 claim /\bopen 24 ?hours?\b|24\/7|24-7|\baround the clock\b|always open\b/i on body plus footer, combined with /\battendant(?:s)?\b|staff(?:ed| on (?:site|duty))|on-?site staff/i on the body (Mega Analyzer). - Why: An overstated staffing claim is a trust problem and an FTC substantiation risk. - Fix: State which hours are self-service and which are attended. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A20.9 Unqualified superlative / comparative claim detected (`<claim>`)** - Pass: Any superlative appears only inside a quoted customer testimonial. - Fail: A superlative such as 'cheapest', 'best laundromat' or 'newest machines' appears outside blockquote or q elements. - Numbers and lists the tool uses: /\b(cheapest|lowest prices?|best laundromat|#1 laundromat|newest machines|largest laundromat|only 24-?hour laundromat)\b/i on body plus footer; quoted scope /<(blockquote|q)\b[^>]*>[\s\S]*?<\/\1>/gi; flagged when the total match count exceeds the count inside blockquote or q elements (any match outside a quote) (Mega Analyzer). - Why: Objective claims must be substantiable under FTC advertising law. - Fix: State the basis for the claim or soften it to non-comparative language. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FTC endorsement guides. - [ ] **A20.10 Environmental claim detected (`<claim>`) with no specific basis** - Pass: Any eco claim is accompanied by a specific basis such as ENERGY STAR, a percentage saving or high-efficiency front-load machines. - Numbers and lists the tool uses: green claim /\b(eco-?friendly|green laundromat|environmentally friendly|energy efficient|water saving|sustainable)\b/i; basis /energy star|\b\d+%\s*(?:less|fewer)\b|high-?efficiency front-?load/i (Mega Analyzer). - Why: The FTC Green Guides require eco, energy and water claims to be specific and substantiated. - Fix: Replace the claim with a concrete fact or drop it. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FTC Green Guides. ### Law firms - [ ] **A21.1 Multi-jurisdiction firm confirms hreflang (offices detected: `<cities>`)** - Pass: Fewer than two distinct global office cities from the list appear in the body text of a legal site (Mega Analyzer). - Fail: Two or more distinct global office cities from the list appear in the body text of a legal site; the tool asks you to confirm self-referential hreflang plus x-default are emitted site-wide (Mega Analyzer). - Numbers and lists the tool uses: Gate: legal site detected; city regex /\b(london|brussels|amsterdam|frankfurt|paris|madrid|milan|dublin|munich|shanghai|beijing|hong kong|singapore|tokyo|seoul|dubai|abu dhabi|sydney|melbourne|toronto|s[aã]o paulo|mexico city|riyadh|doha|geneva|zurich|luxembourg|moscow|johannesburg)\b/gi on the body text; distinct hits 2 or more; up to 6 cities listed; hreflang itself is not inspected (Mega Analyzer). - Why: A global office list on an hreflang-free English site reads as US-only to non-US search and AI engines. - Fix: Emit self-referential hreflang plus x-default site-wide, with localized pages for each jurisdiction where you practise. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: hreflang. - [ ] **A21.2 YMYL-Legal: LegalService schema** - Pass: A legal site declares LegalService, Attorney or Notary. - Numbers and lists the tool uses: regex /LegalService|Attorney|Notary/i (Mega Analyzer). - Why: Legal queries get tighter source-quality filters, so the firm needs a legal entity type. - Fix: Add LegalService or Attorney JSON-LD. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org LegalService. - [ ] **A21.3 Enterprise site-search detected** - Pass: On a large multi-office (BigLaw) legal site, an enterprise search vendor (Coveo, Algolia, Elasticsearch, Swiftype or SearchUnify) is detected, reported as an advisory pass. - Numbers and lists the tool uses: Gate: isLegalSite and looksBig, where looksBig = 2 or more distinct GLOBAL_CITIES matches in the body text, or /\b(over|more than)\s*\d{3,}\s*(lawyers|attorneys)\b/i, or /\bglobal (law )?firm\b|\bmultinational\b|\boffices (around|across) the (world|globe)\b|\bam ?law\b/i on the body text; then /coveo|algolia|elasticsearch|swiftype|searchunify/i on bodyText plus the stringified JSON-LD (mega-analyzer). - Why: Licensed enterprise search is often already able to power retrieval-based answers, so the remaining build is a user interface layer. - Fix: Consider a cited, no-advice generative answering concierge over the firm's own publications. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A21.4 YMYL-Legal: bar number or jurisdiction** - Pass: Bar admission language or a license marker appears in the body text. - Numbers and lists the tool uses: /bar\s*(?:number|#|no|admission|admitted)|state bar of|admitted in\b|jd\b|esq\b/i. - Why: Attorney credential disclosure is expected on legal sites. - Fix: Publish the bar number and jurisdiction. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A21.5 YMYL-Legal: attorney-advertising disclaimer (or visible /disclaimer link)** - Pass: A legal disclaimer is present on the page or a disclaimer-class page is linked. - Numbers and lists the tool uses: /\b(not\s+legal\s+advice|attorney\s+advertising|prior\s+results\s+do\s+not\s+guarantee|attorney[- ]client\s+relationship)\b/i on body text; or any link href matching /\/(disclaimer|legal-notice|notice|terms-?(?:of-)?(?:use|service)?|privacy(?:-policy)?|disclosure|aboutus|legal)\/?(?:$|\?|#)/i. - Why: Attorney advertising rules require a disclaimer. - Fix: Add the disclaimer or link a /disclaimer page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A21.6 Attorney-advertising notice not visible on this page** - Pass: The visible body text contains an attorney advertising notice. - Numbers and lists the tool uses: /attorney advertising/i on body text. - Why: An inline notice on every page is the safer reading of state bar rules. - Fix: Add 'Attorney advertising. Prior results do not guarantee a similar outcome.' inline on every page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: NY 22 NYCRR 1200.7.1 (Rule 7.1); FL Bar 4-7.13; TX Bar 7.02. - [ ] **A21.7 Prior-results disclaimer absent on an attorney bio page** - Pass: Attorney bio pages carry prior-results language. - Numbers and lists the tool uses: /prior results do not guarantee|prior results.{0,40}do not guarantee/i; gated on a Person page. - Why: The disclaimer is required when results are discussed. - Fix: Add 'Prior results do not guarantee a similar outcome.' to each bio page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: NY, FL, TX, NJ bar rules; NY State Bar Opinion 1009. - [ ] **A21.8 No attorney-client-relationship disclaimer on a contact/office page** - Pass: Contact and office pages state that contacting the firm does not create an attorney-client relationship. - Numbers and lists the tool uses: /does not create (?:an )?attorney-client relationship|no attorney-client relationship/i; gated on an office page or a title matching /contact|inquir/i. - Why: Contact forms should not imply representation. - Fix: Add 'Merely contacting [firm] does not create an attorney-client relationship' above or beside the contact form. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A21.9 No do not send confidential information warning on a contact page** - Pass: Contact and office pages warn visitors not to send confidential information. - Numbers and lists the tool uses: /(?:should not send|do not send) confidential|confidential information.{0,80}(?:not be subject|not be treated as confidential|not be confidential)/i; gated on an office page or a title matching /contact|inquir/i. - Why: Best practice is a modal on attorney mailto links and visible footer text on contact pages. - Fix: Add the confidentiality warning next to every contact form and attorney email link. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: ABA Model Rule 1.18. - [ ] **A21.10 NY-office firm without visible Statement of Client's Rights link** - Pass: A firm whose body text mentions New York has the phrase Statement of Client's Rights (or Client's Rights) in its visible body text; a footer link's anchor text counts. - Fail: The body text matches /new york|nyc|manhattan|brooklyn/i and does not match /statement of client.s rights|client.s rights/i. - Numbers and lists the tool uses: /statement of client.s rights|client.s rights/i; /new york|nyc|manhattan|brooklyn/i. - Why: Conspicuous posting is required, and a footer link satisfies the modern interpretation. - Fix: Add a footer link to the Statement of Client's Rights. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: 22 NYCRR 1210.1. - [ ] **A21.11 BigLaw firm with no ranking-directory sameAs in schema** - Pass: A large multi-office firm's JSON-LD includes Chambers, Legal 500, Best Lawyers, Martindale, Super Lawyers, Lawdragon or IFLR1000 URLs. - Numbers and lists the tool uses: /chambers|legal[\s-]?500|best[\s-]?lawyers|martindale|super[\s-]?lawyers|lawdragon|iflr1000/i on the JSON-LD text; looksBig = 2 or more hits from the global cities list (london, brussels, amsterdam, frankfurt, paris, madrid, milan, dublin, munich, shanghai, beijing, hong kong, singapore, tokyo, seoul, dubai, abu dhabi, sydney, melbourne, toronto, sao paulo, mexico city, riyadh, doha, geneva, zurich, luxembourg, moscow, johannesburg) or /\b(over|more than)\s*\d{3,}\s*(lawyers|attorneys)\b/i or /\bglobal (law )?firm\b|\bmultinational\b|\boffices (around|across) the (world|globe)\b|\bam ?law\b/i. - Why: AI engines reconcile large firms through Chambers, Legal 500, Best Lawyers and Martindale rather than Wikipedia. - Fix: Add those directory URLs to the firm Organization and each attorney Person sameAs array. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org sameAs. - [ ] **A21.12 Thought-leadership page with no author binding** - Pass: Article pages on a large firm's site declare an author in JSON-LD. - Fail: A BigLaw article page with no Article type and no author property. - Numbers and lists the tool uses: /"author"/i on the JSON-LD text; gated on looksBig and an article page. - Why: Named-author content is cited materially more often by AI engines than content attributed only to the firm. - Fix: Bind each publication to its author's Attorney or Person node by @id. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org author. - [ ] **A21.13 `<n>` legal-readiness issue(s)** - Pass: No legal-readiness issue is detected across bio, practice, office and firm-level contexts. - Numbers and lists the tool uses: NY 22 NYCRR 1200 and 1210.1, FL Bar 4-7, TX Bar 7.02; prompt rules: footer 'Attorney advertising. Prior results do not guarantee a similar outcome.'; Person plus Attorney schema with hasCredential (Juris Doctor, Licensed Attorney recognizedBy the state bar, bar number); LegalService on practice pages; firm-level ['Organization','LegalService','ProfessionalService'] with @id `<site>`#org; office PostalAddress, telephone and openingHoursSpecification (08:30 to 18:00 Mon to Fri example); no-attorney-client-relationship text above contact forms; NY Statement of Client's Rights link; EU-office consent platform (OneTrust, Usercentrics, Cookiebot) per GDPR Art. 7 and ePrivacy; validate on the Rich Results Test and validator.schema.org; never invent bar admissions or honors. - Why: State-bar advertising rules and citeability as a legal entity both depend on these signals. - Fix: Work through the listed issues with the prompt rules above, validating every schema block and never inventing admissions or honors. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: 22 NYCRR 1200; GDPR Art. 7. - [ ] **A21.14 EU-office firm without a visible cookie / consent banner** - Pass: A cookie notice, policy, preferences, settings or consent-management reference is present when the firm names an EU office city. - Fail: An EU city is mentioned and no cookie notice text is found. - Numbers and lists the tool uses: cookie regex /cookie (?:notice|policy|preferences|settings)|consent management/i; EU city regex /amsterdam|london|brussels|frankfurt|paris|madrid|milan|dublin/i. - Why: A firm with an EU office must collect explicit consent for non-essential cookies before they fire. - Fix: Add a consent banner that blocks non-essential cookies until the visitor agrees. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: GDPR Art. 7; ePrivacy Directive. - [ ] **A21.15 Accessibility-governance tool detected in the stack** - Pass: An accessibility monitoring vendor (Siteimprove, AudioEye, accessiBe, UserWay, Level Access or Monsido) is detected; advisory pass only. - Numbers and lists the tool uses: /siteimprove|audioeye|accessibe|userway|level ?access|monsido/i on the body text plus JSON-LD; advisory pass only; fires only inside the BigLaw layer: isLegalSite and looksBig (2 or more distinct GLOBAL_CITIES hits, or 'over/more than' followed by a 3+ digit number of lawyers/attorneys, or 'global law firm', 'multinational', 'offices around/across the world/globe' or 'Am Law' in the body). - Why: A law firm that pays for an accessibility watchdog yet ships attorney headshots with no alt text is demonstrably on notice in ADA litigation. - Fix: Verify the attorney headshot and bio grid passes WCAG 1.1.1 so the monitoring contract is not evidence against you. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: WCAG 1.1.1. ### Men's health and TRT clinics - [ ] **A22.1 Spanish-language version with hreflang detected** - Pass: The home page declares at least one hreflang alternate. - Fail: Home page has zero hreflang declarations (Mega Analyzer). - Numbers and lists the tool uses: Regex /hreflang=/gi count of 0 on the home page (Mega Analyzer). - Why: The Hispanic male demographic is underserved by clinics with English-only sites. - Fix: Publish Spanish landing pages with bidirectional hreflang es, en and x-default. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A22.2 This symptom / treatment / FAQ page reads as Q&A but has no FAQPage JSON-LD** - Pass: The FAQ page carries FAQPage schema. - Fail: A FAQ or service page with four or more question marks has no FAQPage schema. - Numbers and lists the tool uses: looksQA = /\?(?:\s|$|<)/ with a question-mark count >= 4; pages: FAQ, service (mega-analyzer). - Why: Symptom and treatment questions are what patients ask answer engines, and the schema makes the clinic's answers eligible. - Fix: Wrap the questions in FAQPage and keep the answers clinician-reviewed. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org FAQPage. - [ ] **A22.3 This page collects patient/health information (intake / booking / symptom form)** - Pass: - Warn: A contact or booking page contains a form or health-intake language. - Numbers and lists the tool uses: gate (contact || booking) && /<form|symptom|intake|new patient|book (?:an? )?appointment|schedule (?:an? )?(?:consult|appointment)|date of birth|medical history/i. - Why: Tracking pixels on pages that collect health information have drawn OCR and FTC enforcement actions. - Fix: Sign a BAA with the form vendor, encrypt submissions, post a Notice of Privacy Practices, and keep marketing pixels off any page that handles health data. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: HIPAA. - [ ] **A22.4 Treatment page is typed only as generic WebPage** - Pass: Treatment pages are typed MedicalWebPage with about MedicalProcedure or Drug. - Numbers and lists the tool uses: procedure types /MedicalProcedure|MedicalTherapy|TherapeuticProcedure|Drug|MedicalCondition/; service pages that are not location pages (Mega Analyzer). - Why: Medical typing maps 'how does this treatment work' queries to the page. - Fix: Type the page MedicalWebPage with about MedicalProcedure or Drug plus medicalSpecialty. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org MedicalWebPage. - [ ] **A22.5 medicalSpecialty declared in schema** - Pass: The clinic node declares medicalSpecialty and areaServed. - Numbers and lists the tool uses: regex /"medicalSpecialty"\s*:/i and /"areaServed"/i, pass-only rows (Mega Analyzer). - Why: Specialty and service area tell YMYL systems what the clinic treats and where. - Fix: Add medicalSpecialty and areaServed to the MedicalClinic node. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org medicalSpecialty. - [ ] **A22.6 Brand node has no sameAs / telephone** - Pass: The brand node on the home or contact page carries both sameAs and telephone. - Numbers and lists the tool uses: gated on an Organization node on the home or contact page. - Why: Zero sameAs is an entity-dark signal. - Fix: Link Facebook, Instagram, YouTube, LinkedIn and the Business Profile in sameAs, and add telephone. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org sameAs. - [ ] **A22.7 No medical reviewer (reviewedBy / lastReviewed) on YMYL-health content** - Pass: Blog and service pages declare reviewedBy or lastReviewed and a credentialed clinician (hasCredential or clinical jobTitle) in schema. - Warn: The content has a Person author but it looks like a CMS or agency placeholder. - Numbers and lists the tool uses: /"reviewedBy"\s*:|"lastReviewed"\s*:/i; placeholder author /"author"\s*:\s*\{[^}]*"name"\s*:\s*"(?:admin|editor|staff|content|team|marketing|[a-z]+ content|webmaster|seo)[^"]*"/i. - Why: A named medical reviewer is the primary E-E-A-T trust signal for health content. - Fix: Declare a named credentialed reviewer and date in schema and add a visible 'Medically reviewed by <Clinician, credential> on `<date>`' byline. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: Google YMYL / E-E-A-T. - [ ] **A22.8 No AggregateRating/Review schema** - Pass: Home, location and contact pages carry AggregateRating or Review schema from each clinic's Business Profile with HIPAA authorization for any testimonial. - Warn: When schema is present the tool asks you to confirm the total; when ratings are claimed without schema it reports that variant. - Numbers and lists the tool uses: widget /google review|\btrustpilot\b|birdeye|podium|\b\d(?:\.\d)?\s*(?:out of|\/)\s*5\s*star|patient (?:reviews|testimonials)/i; claims /\b5-?star|highly rated|top-?rated|thousands of (?:happy )?(?:patients|men)|\d[, ]?\d{3}\+? (?:reviews|patients)/i. - Why: A testimonial that reveals treatment is protected health information. - Fix: Drive reviews through each clinic's Business Profile, emit the real AggregateRating, and get written HIPAA authorization before publishing any testimonial. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FTC 16 CFR Part 465; HIPAA. - [ ] **A22.9 Location page has no MedicalClinic / MedicalBusiness node** - Pass: Each location page has a MedicalClinic or MedicalBusiness node with a page-unique @id, a populated address, hours, sameAs and geo. - Fail: Location page without the node; sub-issues when the @id is shared across clinics (pathname / or empty), the address is empty, or PostalAddress, hours, sameAs or geo is missing. - Numbers and lists the tool uses: clinicId /"@id"\s*:\s*"([^"]*#(?:medicalbusiness|localbusiness|clinic|organization)[^"]*)"/i; shared when the @id pathname is '/' or ''; emptyAddress /"streetAddress"\s*:\s*""/ or a PostalAddress with /"addressLocality"\s*:\s*""/. - Why: A shared @id collapses all clinics into one entity and an empty address leaves the location with no NAP. - Fix: Give each location a page-unique @id and a full PostalAddress, hours, geo and its own Google Business Profile in sameAs. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org MedicalClinic. - [ ] **A22.10 "FDA-approved" appears alongside testosterone/TRT** - Pass: No FDA-approved claim appears next to testosterone content. - Numbers and lists the tool uses: /\bfda-?approved\b/i together with /testosterone|trt|low ?t/i (Mega Analyzer). - Why: Testosterone is approved only for classical hypogonadism, not age-related low T; the February 2025 label update removed the boxed warning but did not broaden the indication. - Fix: Make the indication accurate and bounded. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FDA; FTC. - [ ] **A22.11 Anti-aging / age-related framing of testosterone detected** - Pass: No anti-aging framing accompanies TRT or HRT content. - Numbers and lists the tool uses: /anti-?aging|reverse aging|feel (?:20|young) again|fountain of youth|age-?related (?:low ?t|testosterone|decline)|because you'?re getting older/i with TRT or HRT treatment content (Mega Analyzer). - Why: Anti-aging framing is an off-label promotion risk. - Fix: Frame the treatment around diagnosed hypogonadism. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FDA off-label promotion. - [ ] **A22.12 Online/telehealth testosterone-prescribing language detected** - Pass: TRT pages describe an in-clinic model with no online-prescription claim. - Numbers and lists the tool uses: /(?:get|start) (?:trt|testosterone) online|prescription (?:delivered|shipped|online)|online (?:trt|testosterone) (?:prescription|treatment)|no (?:office|in-person) visit/i on any page with TRT treatment content; the in-clinic pass message is reported only on home or service pages with TRT content (Mega Analyzer). - Why: The Ryan Haight Act and DEA rules generally require an in-person evaluation for a Schedule III drug. - Fix: State the in-clinic model, or confirm and cite the DEA exception you rely on. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: Ryan Haight Act; DEA Schedule III. - [ ] **A22.13 Strong weight-loss claims appear with GLP-1 / semaglutide content** - Pass: No guaranteed or numeric weight-loss claim accompanies GLP-1 content. - Numbers and lists the tool uses: GLP-1 content = weight-loss treatment or /semaglutide|tirzepatide|glp-?1/i; claims /(?:lose|drop)\s+\d+\s*(?:lbs?|pounds)|guaranteed weight loss|melt (?:away )?fat|effortless weight/i (Mega Analyzer). - Why: Weight-loss claims must be substantiated, and compounded sourcing faces FDA scrutiny. - Fix: Keep claims substantiated and disclose that results vary. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FTC; FDA. ### Mental health practices - [ ] **A23.1 YMYL-Health-MentalHealth: state-board license signal (LCSW/LMFT/LPC/LMHC/PsyD #)** - Pass: A state-board credential abbreviation or a license marker appears in the body text. - Numbers and lists the tool uses: /\b(lcsw|lmft|lpc|lmhc|lpcc|psy\.?d|psychologist|state[- ]?board|licensed in\b)/i. - Why: The state-board license is the required credential for therapists. - Fix: Publish the license type and number. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A23.2 YMYL-Health-MentalHealth: Good Faith Estimate / Notice of Privacy Practices (or visible /disclaimer link)** - Pass: No Surprises Act or Notice of Privacy Practices language appears, or a disclaimer-class page is linked. - Numbers and lists the tool uses: /good faith estimate|no surprises act|notice of privacy practices|n\.p\.p\.\b/i. - Why: A Good Faith Estimate is required under the No Surprises Act. - Fix: Publish a Good Faith Estimate and Notice of Privacy Practices notice. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: No Surprises Act. ### Newsletters - [ ] **A24.1 CAN-SPAM notice** - Pass: Newsletter, blog and affiliate sites state the CAN-SPAM commitments: an unsubscribe link and the physical mailing address in every message, honest subject lines and unsubscribe processed within 10 business days. - Numbers and lists the tool uses: generated for newsletter, blog and affiliate business types; reply STOP or unsubscribe; unsubscribe processed within 10 business days per 15 U.S.C. 7704. - Why: Commercial email must carry a working unsubscribe and a physical address. - Fix: Put the physical mailing address and an unsubscribe link in every marketing email and state the policy on the site. - Verify: [Legal Pages Generator](https://jwatte.com/tools/legal-pages-generator/). Standard: 15 U.S.C. 7704 (CAN-SPAM). ### Nonprofits - [ ] **A25.1 'nonprofitStatus': 'NonprofitType501c3' in JSON-LD** - Pass: The Organization node declares nonprofitStatus NonprofitType501c3. - Numbers and lists the tool uses: regex /nonprofitStatus[^,}]{0,80}NonprofitType501c3/ (Mega Analyzer). - Why: It is the signal Google uses to confirm U.S. 501(c)(3) status. - Fix: Add 'nonprofitStatus': 'NonprofitType501c3' to the Organization schema. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org nonprofitStatus. - [ ] **A25.2 taxID (EIN) in JSON-LD** - Pass: The Organization node carries taxID. - Numbers and lists the tool uses: regex /"taxID"\s*:/ (Mega Analyzer). - Why: TaxID cross-references your IRS record. - Fix: Add 'taxID': 'XX-XXXXXXX' to the Organization schema. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org taxID. - [ ] **A25.3 DonateAction in Organization.potentialAction** - Pass: The Organization node carries a DonateAction in potentialAction. - Numbers and lists the tool uses: regex /DonateAction/ (Mega Analyzer). - Why: DonateAction makes the Donate button in Google's Knowledge Panel possible. - Fix: Add potentialAction {"@type": "DonateAction", "target": "`<donate URL>`"}. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org DonateAction. - [ ] **A25.4 EIN visible on the site** - Pass: An EIN-shaped number appears in the visible copy. - Numbers and lists the tool uses: Round 11 card: body text matches /\b(?:EIN|Tax ID)[:\s#]*?(\d{2}-?\d{7})\b/i or /\b(\d{2}-\d{7})\b/; Local-Nonprofit vertical check (line 2642): body text matches /EIN[: #]+\d|tax[- ]deductible|501$c$$3$/i as the combined EIN / 501(c)(3) statement. - Why: Donors and foundations look for the EIN before giving. - Fix: Add a footer line: 'EIN XX-XXXXXXX. Donations tax-deductible to the extent allowed by law.'. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A25.5 501(c)(3) status stated** - Pass: The body text matches /\b501\s*$?c$?\s*$?\s*3$?\)?/i (501(c)(3) with optional spaces or parentheses). - Numbers and lists the tool uses: /\b501\s*$?c$?\s*$?\s*3$?\)?/i on body text. - Why: Donors and grant officers confirm status at a glance. - Fix: State the 501(c)(3) status in the footer or About section. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A25.6 Tax-deductibility language present** - Pass: The body says donations are tax-deductible. - Numbers and lists the tool uses: /tax[-\s]?deductible/i. - Why: Fundraising compliance in many states, and a trust signal for major-gift donors. - Fix: Add 'Donations are tax-deductible to the extent allowed by law.'. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A25.7 Local-Nonprofit: No board roster / leadership page reference** - Pass: Board or leadership language appears on the page. - Numbers and lists the tool uses: /board\s+of\s+(?:directors|trustees)|leadership|our\s+board/i. - Why: A board roster is a governance trust signal. - Fix: Add a board or leadership page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A25.8 Candid (GuideStar) profile linked** - Pass: The site links its Candid (GuideStar) profile or references Form 990. - Numbers and lists the tool uses: Round 11 card: /guidestar\.org\/profile\/|candid\.org\/profile\// on the HTML plus JSON-LD text; Local-Nonprofit vertical check (line 2644): body text matches /(?:form\s+990|guidestar|candid\.org|charity\s+navigator)/i or any link href matches /guidestar|candid\.org|charitynavigator|propublica\.org\/nonprofits/i. - Why: Donors doing diligence go to Candid first. - Fix: Link candid.org/profile/`<EIN>` and the Form 990 from the footer or About page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A25.9 Charity Navigator badge / profile linked** - Pass: The site links its Charity Navigator profile. - Numbers and lists the tool uses: /charitynavigator\.org\/(ein|profile|index\.cfm)/i. - Why: A trust signal for major-gift donors and grant officers. - Fix: Apply (free), then embed the badge or link the profile. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A25.10 BBB Wise Giving Alliance badge / profile linked** - Pass: The site links give.org or a bbb.org/charity profile. - Numbers and lists the tool uses: /give\.org|bbb\.org\/charity/i. - Why: Especially trusted by donors over 50. - Fix: Apply at give.org/get-accredited and embed the seal. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A25.11 Donate link present somewhere on the page** - Pass: An anchor on the page links to a donation flow. - Numbers and lists the tool uses: /<a[^>]+href=["'][^"']*(?:donat|give-?now|contribute|sponsor)/i. - Why: Donors should reach the donation flow in one click. - Fix: Add a Donate button to the header on every page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A25.12 Modern donation platform detected (`<platform>`)** - Pass: The page links a modern donation processor. - Fail: Only a PayPal hosted-button flow (/paypal\.com\/donate\/?\?[^"']*hosted_button_id=/i) or no recognizable processor at all. - Numbers and lists the tool uses: donorbox.org, givebutter.com, classy.org, givelively.org, networkforgood.com, bloomerang.co, stripe.com/payment, donorperfect.com, fundraiseup.com. - Why: Hosted PayPal buttons lack recurring giving, donor email capture and automatic receipts. - Fix: Move to Donorbox, Givebutter, Give Lively or Classy. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A25.13 Local-Nonprofit: No visible /donate or /give CTA** - Pass: At least one link points to a donate page or donation platform. - Numbers and lists the tool uses: href matches /\/(donate|donation|give|giving|contribute|support|sponsor|pushpay|donorbox|givebutter|classy\.org|every\.org|paypal\.com\/donate|stripe\.com\/donate)\/?(?:$|\?|#)/i (Mega Analyzer). - Why: A donate call to action is the primary nonprofit conversion. - Fix: Add a /donate or /give link in the main navigation. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). ### Photographers - [ ] **A26.1 Photographer site: ImageObject or Photograph schema with rights metadata** - Pass: A photography site declares ImageObject or Photograph schema for portfolio work. - Warn: Neither type is present. - Numbers and lists the tool uses: vendor gate /^(Pixieset|SmugMug|Format|Pic-Time|ShootProof|Zenfolio)$/i or photographer copy on title, h1 and meta; top 5 to 10 portfolio pieces (Mega Analyzer). - Why: Images are the product, and the markup declares rights to Google Images and AI image search. - Fix: Add ImageObject with copyrightHolder, copyrightNotice, creditText, license and acquireLicensePage for portfolio pieces. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org ImageObject, Photograph. ### Production homebuilders - [ ] **A27.1 No Spanish-language version / hreflang=es detected** - Pass: A Spanish hreflang or /es/ path is detected. - Fail: An about, process or financing page with no Spanish signal. - Numbers and lists the tool uses: hreflangs matching /^es(\b|-)/i, or html /hreflang=["']es/i, or path /\/es(\/|$)/; gated to about, process and financing pages. - Why: First-time-buyer demand skews heavily Hispanic and most peers are English only. - Fix: Add Spanish pages with reciprocal hreflang en, es and x-default, and translate all disclosures. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: hreflang. - [ ] **A27.2 priceRange on the community node is a bare numeric range with no currency symbol** - Pass: PriceRange on a community node starts with a currency symbol. - Numbers and lists the tool uses: bare /"priceRange"\s*:\s*"\s*\d[\d,]*\s*-\s*\d[\d,]*\s*"/i and not /"priceRange"\s*:\s*"\s*\$/i on community pages (Mega Analyzer). - Why: An engine cannot tell dollars from square feet in a bare number range. - Fix: Use a currency-prefixed priceRange and put square footage on floorSize. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org priceRange. - [ ] **A27.3 Home / floor-plan page does not wrap the home in a SingleFamilyResidence / Residence (or Product) node** - Pass: Each floor-plan or inventory page wraps the home in a SingleFamilyResidence, Residence, House, Accommodation or Product node with an Offer. - Numbers and lists the tool uses: types /(^|\b)(SingleFamilyResidence|Residence|House|Accommodation|Product)(\b|$)/ on floor-plan or inventory pages; floorSize QuantitativeValue unitCode FTK (Mega Analyzer). - Why: A bare FloorPlan is not something an engine can price or sell; a Residence plus Offer is a shoppable home. - Fix: Emit SingleFamilyResidence with numberOfBedrooms, numberOfBathroomsTotal, floorSize and offers. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org SingleFamilyResidence. - [ ] **A27.4 floorSize value contains a thousands comma** - Pass: FloorSize.value is a clean number. - Numbers and lists the tool uses: regex /"floorSize"[\s\S]{0,120}?"value"\s*:\s*"\s*\d{1,3},\d{3}/i on the JSON-LD of floor-plan or inventory pages, excluding the about page (Mega Analyzer homebuilder module). - Why: QuantitativeValue.value must be a number without formatting. - Fix: Emit the raw integer with unitCode FTK. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org QuantitativeValue. - [ ] **A27.5 `<n>` production-homebuilder-readiness issue(s)** - Pass: No production-homebuilder readiness issues are reported across community, floor-plan, inventory, process, financing, warranty, FAQ, contact and about contexts. - Numbers and lists the tool uses: Fair Housing Act 42 U.S.C. 3604(c); RESPA Section 8 12 U.S.C. 2607 and Reg X; TILA Reg Z 12 CFR 1026.24; floorSize unitCode FTK (Mega Analyzer). - Why: The aggregate covers citeability as a homebuilder plus Fair Housing, RESPA and Reg Z rules. - Fix: Firm [HomeAndConstructionBusiness, Organization] (Corporation plus tickerSymbol if public); per-community [HomeAndConstructionBusiness, Place] with geo, areaServed and currency-prefixed priceRange; SingleFamilyResidence plus Offer with InStock or LimitedAvailability, priceValidUntil and seller @id; FAQPage on process, financing and warranty; Person for leaders; AggregateRating only from a real platform count; never invent prices or counts. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: 42 U.S.C. 3604(c); 12 U.S.C. 2607; 12 CFR 1026.24. - [ ] **A27.6 High-intent informational page (buying process / financing / warranty / FAQ) carries no FAQPage JSON-LD** - Pass: A buying process, financing or FAQ page carries FAQPage schema (a warranty page with FAQPage records no pass). - Fail: A buying process, financing, warranty or FAQ page carries no FAQPage JSON-LD. - Numbers and lists the tool uses: Fail gate: (isProcessPage or isFinancingPage or isWarrantyPage or isFaqPage) and not hasFaqPage; pass gate: (isProcessPage or isFinancingPage or isFaqPage) and hasFaqPage; hasFaqPage = a schema type matching /FAQPage/i or JSON-LD text matching /"@type"\s*:\s*"FAQPage"/i (mega-analyzer). - Why: This is the single biggest AEO miss for a builder, because AI Overviews lift exactly this question and answer content. - Fix: Extend the FAQPage template to these pages and keep the answers factual and Fair Housing compliant. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org FAQPage. - [ ] **A27.7 Community page has no per-community Place / LocalBusiness node** - Pass: Each community page carries its own Place or LocalBusiness node, or at least a PostalAddress. - Numbers and lists the tool uses: pass condition hasLocalBiz || /"PostalAddress"/i on community pages. - Why: Each community should be a discrete, mappable entity so the map pack can place it. - Fix: Emit {"@type":["HomeAndConstructionBusiness","Place"], name, address, geo, areaServed, parentOrganization} on every community page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org/Place. - [ ] **A27.8 Leadership / team content present but no Person schema** - Pass: An About page with leadership or sales-team wording carries Person schema. - Numbers and lists the tool uses: /\b(leadership|our team|executives?|founder|ceo|president|division president|new home consultant|sales (?:counselor|consultant))\b/i on the About page. - Why: The people who close the sale are invisible to engines without Person schema. - Fix: Emit Person nodes with jobTitle, worksFor, areaServed and sameAs. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org Person. - [ ] **A27.9 No machine-readable AggregateRating / Review schema on the firm node** - Pass: The About or contact page carries AggregateRating or Review schema tied to a verifiable platform total. - Warn: When schema is present the tool asks you to confirm the count is tied to a verifiable platform total. - Numbers and lists the tool uses: /"aggregateRating"\s*:\s*\{/i; /"@type"\s*:\s*"Review"/i; gated on the About or contact page. - Why: AI search cannot cite 'rated X by N buyers' unless it is structured, and under FTC endorsement rules the number must be substantiable. - Fix: Show the platform rating as text that links to the source. Do not copy it into aggregateRating on the firm node: Google allows no ratings from other sites and shows no stars for a business's own reviews. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FTC endorsement rules. - [ ] **A27.10 No Equal Housing Opportunity statement / logo detected** - Pass: About, contact and community pages carry an Equal Housing Opportunity statement or logo. - Numbers and lists the tool uses: /equal housing (?:opportunity|lender)|fair housing|\beho\b|equal-housing/i on body and footer. - Why: The Fair Housing Act governs all housing advertising. - Fix: Add the EHO logo and statement sitewide. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: 42 U.S.C. 3604(c). - [ ] **A27.11 An affiliated / preferred lender or title company is promoted but no RESPA affiliated-business-arrangement (ABA) disclosure was detected** - Pass: Pages that promote an affiliated lender or title company carry a RESPA affiliated-business disclosure. - Numbers and lists the tool uses: lender mention /\b(preferred lender|in-house (?:mortgage|lender)|our (?:mortgage|lending) (?:partner|affiliate|company)|affiliated (?:lender|mortgage|title)|mortgage solutions|home loans?|title (?:company|services)|loandepot)\b/i; disclosure /affiliated business arrangement|respa|you are not required to use|use of (?:the|an) affiliated|no requirement (?:that|to use)|ABA disclosure/i; gated on financing, process, About or contact pages. - Why: RESPA Section 8 requires an affiliated-business disclosure when referring business to an affiliate. - Fix: Add the notice with the nature of the relationship, an estimate of charges and 'You are NOT required to use [affiliate]'. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: 12 U.S.C. 2607 (RESPA Section 8); Regulation X. - [ ] **A27.12 A rate / monthly-payment / no money down claim appears without the paired TILA / Regulation Z advertising disclosures** - Pass: Any rate, monthly-payment or no-money-down claim is accompanied by APR and Regulation Z disclosure language. - Numbers and lists the tool uses: claim /\b(\d\.\d{1,3}\s*%\s*(?:apr|interest|rate)|\$\d[\d,]*\s*\/?\s*(?:mo|month|monthly)|as low as \d|no money down|zero down|\$0 down|down[- ]payment assistance|\d{1,2}%\s*down)\b/i; disclosure /\bapr\b|annual percentage rate|subject to credit approval|terms and conditions apply|see (?:a )?(?:loan officer|lender) for details|rates? subject to change|equal housing lender|nmls\s*#?\s*\d/i. - Why: Once an ad states a specific rate or payment, Regulation Z triggers required disclosures. - Fix: Add APR, terms, 'subject to credit approval' and the lender NMLS number next to the claim. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: 12 CFR 1026.24 (Regulation Z). - [ ] **A27.13 Warranty page without a clear new-home warranty disclosure** - Pass: The warranty page states the coverage terms. - Numbers and lists the tool uses: /\b(\d{1,2})-?year (?:structural |limited )?warranty|limited (?:home |new-?home )?warranty|warranty (?:terms|coverage|administered)|2-?10 home buyers warranty|builder'?s? (?:limited )?warranty/i. - Why: Vague warranty copy is a trust gap and a consumer-protection exposure. - Fix: State the coverage (for example 1-2-10), the administrator, exclusions and the right-to-cure process. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A27.14 Image-dense <floor-plan|community/inventory> page ships `<n>` of `<total>` images with no alt text** - Pass: A community, floor-plan or inventory gallery page with more than 8 images has zero images missing alt. - Fail: The gallery page has more than 3 images missing alt. - Numbers and lists the tool uses: fail when (isCommunityPage || isFloorPlanPage || (isInventoryPage && !isAboutPage)) && imgsMissingAlt > 3; pass needs 0 missing and more than 8 images. - Why: One missing-alt template pattern repeats across every gallery page, which makes it a site-wide WCAG failure and an ADA demand-letter target. - Fix: Set the alt from the existing caption and describe the home, not an occupant. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: WCAG 1.1.1 (Level A); ADA Title III. - [ ] **A27.15 Possible Fair Housing advertising risk** - Pass: No copy expresses a preference by protected class. - Fail: Copy such as 'perfect for young families', 'adults only', 'no children' or 'exclusive community' matches. - Numbers and lists the tool uses: /\b(perfect for (?:a )?(?:young|christian|single|able-bodied)|ideal for families|family-friendly community|adults? only|no children|empty[- ]?nesters? only|safe (?:christian|white) neighborhood|exclusive community)\b/i (Mega Analyzer). - Why: Marketing copy, image alt text and FAQ answers carry the same Fair Housing liability as an advertisement. - Fix: Have counsel review the flagged copy and describe the home, not the occupant. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: 42 U.S.C. 3604(c). ### Registered investment advisers - [ ] **A28.1 Answer-shaped / FAQ content present but no FAQPage schema** - Pass: FAQPage schema is detected. - Fail: An insight page with question-shaped copy has no FAQPage schema. - Numbers and lists the tool uses: isInsightPage and body matches /\?|how |what |when |should |frequently asked/i (mega-analyzer). - Why: This is an open AEO lane for advisers, as long as every answer stays fair and balanced under the Marketing Rule. - Fix: Wrap educational Q&A, not performance or testimonial content, in FAQPage. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org FAQPage. - [ ] **A28.2 Firm node has an empty/absent sameAs** - Pass: The firm node carries at least one sameAs link. - Numbers and lists the tool uses: /"sameAs"/gi count above 0. - Why: AI search computes entity confidence by traversing sameAs. - Fix: Wire the firm to adviserinfo.sec.gov, LinkedIn and ranking profiles. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org sameAs. - [ ] **A28.3 Advisor bio page carries no Person schema** - Pass: Advisor bio pages carry Person schema with a credential. - Numbers and lists the tool uses: gated on an advisor bio page. - Why: For an RIA the advisors are the product. - Fix: Emit Person with jobTitle, worksFor, hasCredential (CFP recognizedBy the CFP Board), memberOf and sameAs (LinkedIn, IAPD or BrokerCheck). - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org Person. - [ ] **A28.4 Advisor bio has Person schema but no hasCredential** - Pass: The advisor Person node carries hasCredential. - Numbers and lists the tool uses: /"hasCredential"|"credentialCategory"/i. - Why: The designation is the wealth-management equivalent of an attorney's bar credential. - Fix: Add the CFP, CFA, CPWA or CIMA designation with recognizedBy. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org EducationalOccupationalCredential. - [ ] **A28.5 Testimonial / Review / aggregateRating schema detected on an RIA site** - Pass: No Review, testimonial or AggregateRating schema is present on the RIA site. - Fail: Review or AggregateRating schema is present, which is a compliance risk under the Marketing Rule. - Numbers and lists the tool uses: /"@type"\s*:\s*"Review"|"aggregateRating"\s*:/i or types /AggregateRating|Review/i; Marketing Rule compliance date Nov 4 2022. - Why: Testimonials and endorsements require clear and prominent disclosures, and the schema claim carries the same liability. - Fix: Do not add or keep client-rating schema without CCO sign-off and the required disclosures. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: SEC Marketing Rule 206(4)-1. - [ ] **A28.6 No visible link to Form ADV (Part 2 brochure) and/or Form CRS detected** - Pass: The About or contact page references Form ADV or Form CRS. - Numbers and lists the tool uses: /form adv|adviserinfo\.sec\.gov|iapd|form crs|adv part 2|disclosure brochure/i or path /form-adv|\/adv|document\/\d+/i. - Why: The SEC requires delivery of Form ADV Part 2 and Form CRS. - Fix: Add a footer or disclosure link to the firm's SEC IAPD page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: SEC Form ADV / Form CRS. - [ ] **A28.7 No fiduciary statement on the About/homepage** - Pass: The About page states that the firm acts as a fiduciary. - Numbers and lists the tool uses: /\bfiduciary\b/i. - Why: The fiduciary statement is the canonical trust and compliance anchor for an RIA. - Fix: Add 'As a registered investment adviser we act as a fiduciary' plus a conflicts acknowledgment. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A28.8 No past performance / investing involves risk disclaimer on a content/strategy page** - Pass: Service and insight pages carry a past-performance disclaimer. - Numbers and lists the tool uses: /past performance (?:is|does)|no(?:t a)? guarantee of future|results are not guaranteed|investing involves risk|not indicative of future/i. - Why: Any performance or strategy discussion must be fair and balanced and present material risks. - Fix: Add 'Past performance is not indicative of future results; investing involves risk including possible loss of principal.'. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: SEC Marketing Rule 206(4)-1. - [ ] **A28.9 Third-party ranking/award claim detected** - Pass: No third-party ranking or award claim appears, or each claim carries its date, criteria and compensation disclosure. - Fail: A Barron's, Forbes, Five Star, Best or Top RIA claim appears. - Numbers and lists the tool uses: /barron'?s|forbes|financial advisor (?:magazine|ria)|five ?star|best (?:wealth|financial|advisor)|top (?:\d+ )?(?:ria|advisor|wealth)/i. - Why: The Marketing Rule treats third-party ratings as testimonials and endorsements. - Fix: Disclose the rating's date, criteria and any compensation with the claim, visibly and in schema. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: SEC Marketing Rule 206(4)-1. - [ ] **A28.10 No SEC-registration statement detected** - Pass: The About page carries the SEC registration statement. - Numbers and lists the tool uses: /registered investment advis(?:e|o)r|registration (?:with the sec )?does not imply|sec[- ]registered/i. - Why: This is standard required disclosure language and an AI-verifiable registration signal. - Fix: Add '`<Firm>` is an investment adviser registered with the SEC. Registration does not imply a certain level of skill or training.'. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A28.11 `<n>` RIA / wealth-management-readiness issue(s)** - Pass: No RIA readiness issue is detected across advisor bio, service, insight, disclosure, contact and About contexts. - Numbers and lists the tool uses: SEC Rule 206(4)-1; Form ADV Part 2; Form CRS; adviserinfo.sec.gov/firm/`<CRD>`; prompt rules: firm ['FinancialService','Organization'] with IAPD sameAs; advisor Person with hasCredential (CFP recognizedBy the CFP Board) and IAPD individual sameAs; FinancialService per offering; FAQPage only on educational Q&A; no Review or testimonial schema without CCO sign-off and Rule 206(4)-1 disclosures (third-party rankings count as testimonials); visible Form ADV and Form CRS links, fiduciary statement, 'Registration does not imply a certain level of skill or training', past-performance disclaimer; validate; never invent CRD numbers or AUM. - Why: Review schema and marketing claims are a compliance risk under the Marketing Rule, and the disclosures are what make the firm citable. - Fix: Work through the listed issues with the prompt rules above, never inventing CRD numbers or AUM. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: SEC Rule 206(4)-1. ### Restaurants - [ ] **A29.1 Menu / MenuItem / MenuSection schema not declared** - Pass: The restaurant declares Menu-family schema, and dietary attributes where relevant. - Fail: A menu page carries neither a Menu node nor Restaurant schema; missing Menu schema is otherwise reported as info. - Numbers and lists the tool uses: Menu types /^(Menu|MenuItem|MenuSection|MenuAddOn|NutritionInformation)$/; diet /suitableForDiet|RestrictedDiet|"diet":/i; menu node /"@type"\s*:\s*"Menu"/i or /"hasMenu"/i (Mega Analyzer). - Why: Menu markup lets AI Overviews pull dishes, prices and dietary attributes, and some platforms place schema only on the homepage. - Fix: Declare Menu > MenuSection > MenuItem with offers and suitableForDiet on every menu page, linked from the Restaurant node via hasMenu. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org Menu. - [ ] **A29.2 A menu link or Menu node exists but there are no MenuSection / MenuItem entries** - Pass: The Menu node is itemized with MenuSection and MenuItem entries. - Numbers and lists the tool uses: /"@type"\s*:\s*"MenuSection"|"hasMenuSection"/i; /"@type"\s*:\s*"MenuItem"|"hasMenuItem"/i (Mega Analyzer). - Why: Shallow menu markup cannot answer what is on the menu or how much a dish costs. - Fix: Add hasMenuSection entries each with hasMenuItem (name, description, Offer price). - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org MenuItem. - [ ] **A29.3 You link a reservation platform (OpenTable, Resy, or Tock) but acceptsReservations is not in your schema** - Pass: The Restaurant node carries acceptsReservations when a reservation platform is linked. - Numbers and lists the tool uses: regex /"acceptsReservations"/i; gated on a reservation-platform link plus Restaurant schema (Mega Analyzer). - Why: AcceptsReservations lets engines surface a Reserve action. - Fix: Add acceptsReservations with the booking URL to the Restaurant node. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org acceptsReservations. - [ ] **A29.4 Health-grade signal (food businesses)** - Pass: The Google listing text shows a letter health grade or health inspection score. - Fail: Reported as informational when no grade is found. - Numbers and lists the tool uses: gate: runs only when the listing text matches /restaurant|food|cafe|pizz|bakery|bar/i; grade regex /(?:^|\s)(?:A|B|C|D|F)\s*(?:rating|grade)|health\s*(?:score|inspection)/i. - Why: Some metros surface the local health inspection grade on the listing. - Fix: Verify the displayed health inspection grade is current. - Verify: [Google Maps](https://jwatte.com/tools/google-maps-audit/). - [ ] **A29.5 Menu uploaded (for food businesses)** - Pass: A menu is uploaded to the Apple Maps listing. - Why: Apple Maps displays the menu inline, a strong conversion signal. - Fix: Upload the menu in Apple Business Connect. - Verify: [Apple Business](https://jwatte.com/tools/apple-business-audit/). - [ ] **A29.6 `<n>` restaurant-readiness issue(s)** - Pass: No restaurant-readiness issues detected across the managed-platform, menu, team or chef, reservations and contact or hours contexts. - Numbers and lists the tool uses: gate: Restaurant-family schema (Restaurant, FoodEstablishment, BarOrPub, CafeOrCoffeeShop, Bakery, Winery, BreweryOrBrewpub) or at least 2 of: a restaurant word (restaurant, gastropub, eatery, bistro, brasserie, steakhouse, trattoria, taqueria, public house) plus 'menu' in the body; a reservation, book a table, dine-in, happy hour, prix fixe, brunch, private dining or catering phrase plus a reservation or ordering link or 'menu'; a reservation link (opentable, resy.com, exploretock, tock.com, sevenrooms, yelp.com/reservations) or ordering link (tbdine, toasttab, chownow, doordash, grubhub, ubereats, gloriafood, squareup.com/online, slicelife); restaurant, menu, reservations, brunch, happy hour, steakhouse, cafe or bistro in the title; managed platform: SpotHopper (spothopper or spotapps), Popmenu, BentoBox (getbento or bentobox); contexts: managed platform, menu page, team or chef page, reservations page, contact or hours page; reference /blog/spothopper-website-checklist-restaurant-owners/. - Why: So Google and AI search can read what you are, your hours and your menu. - Fix: Add Restaurant schema with openingHoursSpecification, hasMenu (MenuSection and MenuItem with price), acceptsReservations and sameAs, a Person node on the team page and a privacy notice when analytics run. Never fake AggregateRating from embedded third-party reviews. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org Restaurant. - [ ] **A29.7 Restaurant stack detected, <platform | reservations | delivery | off-site menu>** - Pass: Informational; reported, not scored. - Numbers and lists the tool uses: platform: `<vendorPlatform>` when vendorPlatformType is Restaurant; reservations (first match wins): OpenTable /opentable\.com|opentable\.co|otrest|opentable-button/i, Resy /\bresy\.com|resyembed|resy-button/i, Tock /\b(?:exploretock|tock\.com|tockapi)\b/i, Yelp Reservations /yelp\.com\/reservations|yelp-reservation/i; delivery or ordering (first match wins): DoorDash /doordash\.com|order\.doordash|doordash-button/i, UberEats /ubereats\.com|order\.ubereats/i, Grubhub /grubhub\.com|order\.grubhub/i, Seamless /seamless\.com\/menu/i, Postmates/Caviar /postmates\.com|caviar\.com/i, GloriaFood /gloriafood\.com|gloriafood/i, Menufy /menufy\.com/i, Slice /slicelife\.com/i, Square Online ordering /squareup\.com\/(?:online-store|online|store)|\bsquare\.site\b/i, SpotOn /order\.spoton\.com/i, TouchBistro Dine /(?:order|www)\.tbdine\.com/i; off-site menu /\b(?:toasttab\.com\/local|direct\.chownow\.com|order\.chownow|popmenucloud\.com|popmenu-order|bentobox-customers\.com|getbento\.com\/menu|gloriafood\.com\/restaurant|menufy\.com\/|slicelife\.com\/restaurants|square\.site|order\.spoton\.com|order\.tbdine\.com)/i; all matched against the HTML plus links; the row renders only when ymylVertical is Local-Restaurant, as an info row with pass true, and never fails. - Why: Reservation embeds, off-site ordering and a platform-hosted menu count as valid conversion paths, so recognizing them prevents false "no call to action" or "no menu page" findings. - Fix: No change required; if you use a reservation, ordering or menu platform, keep its embed or link on the page so it is recognized. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A29.8 Team, chef, or owner content is present but there is no Person schema** - Pass: The team page carries Person schema. - Numbers and lists the tool uses: gated on a team page. - Why: The people guests come to see are the most authentic trust signal. - Fix: Add a Person node per key person with name, jobTitle, worksFor and sameAs. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org Person. - [ ] **A29.9 Restaurant schema has no sameAs links** - Pass: The Restaurant node carries a sameAs array. - Numbers and lists the tool uses: /"sameAs"/i; gated on Restaurant schema. - Why: SameAs merges the website, Google Business Profile and social profiles into one trusted business. - Fix: Add a sameAs array with the Business Profile or Maps URL, Instagram and Facebook. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org sameAs. - [ ] **A29.10 Reviews are shown on the page but there is no Review or AggregateRating schema** - Pass: A page that shows reviews carries Review or AggregateRating schema that is first-party and genuine. - Numbers and lists the tool uses: shows reviews /review by|customer reviews|what (?:our )?(?:guests|customers) say|testimonial|star rating/i or /yelp|tripadvisor|google review/i. - Why: Wrapping third-party Google or Yelp reviews in your own AggregateRating can trigger a manual penalty, and fake or self-asserted ratings violate the FTC consumer review rule. - Fix: Let the Business Profile carry the stars or run a genuine first-party review program before adding schema. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: 16 CFR Part 465 (FTC consumer review rule, October 2024). - [ ] **A29.11 Analytics or tracking is loading but no privacy policy is linked** - Pass: A privacy or cookie policy link (or the phrase 'privacy policy') is present when analytics or tracking scripts load. - Fail: Analytics is detected and no privacy link is found. - Numbers and lists the tool uses: hasAnalytics /gtag\(|googletagmanager|G-[A-Z0-9]{8,}|connect\.facebook\.net|fbq\(|clarity\.ms|hotjar/i; privacy link /href=["'][^"']*(privacy|cookie)[^"']*["']/i or /privacy policy/i. - Why: Google requires every site running Analytics to disclose it, and the Colorado Privacy Act applies to Colorado businesses. - Fix: Publish a privacy policy that names analytics, forms and your email list, and link it in the footer. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: Colorado Privacy Act; Google Analytics terms. - [ ] **A29.12 Managed platform detected (`<platform>`)** - Pass: No managed restaurant platform is detected. - Warn: SpotHopper, Popmenu or BentoBox is detected; structured data, security headers and head markup are controlled by the platform template. - Numbers and lists the tool uses: SpotHopper /spothopper|spotapps/i; Popmenu /popmenu/i; BentoBox /getbento|bentobox/i; first match wins, tested on raw HTML plus body text; runs only when the page is detected as a restaurant site. - Why: A subscription does not guarantee the template's schema, headers and head markup stay current. - Fix: Send the platform a by-name request for sitewide Restaurant schema, openingHoursSpecification, hasMenu, sameAs, a privacy policy and security headers. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). ### Self-storage - [ ] **A30.1 Reads as Q&A but no FAQPage JSON-LD** - Pass: The FAQ page carries FAQPage schema. - Fail: A home, FAQ or units page contains question marks in the body but has no FAQPage schema. - Numbers and lists the tool uses: Pages: home, FAQ, units; /\?(?:\s|$)/ on the full body (mega-analyzer). - Why: Storage questions about size, climate control, cost, access, insurance, specials and liens are lifted by answer engines. - Fix: Wrap the real questions in FAQPage > Question > acceptedAnswer. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org FAQPage. - [ ] **A30.2 The page mentions access/gate hours but has only one (or no) openingHoursSpecification** - Pass: At least 2 openingHoursSpecification blocks exist when the page mentions access or gate hours, or there is no access-hours mention. - Numbers and lists the tool uses: /access hours|gate hours|24[ -]?hour access|24\/7 access|gate (?:open|access)/i; hoursCount < 2. - Why: Storage has two schedules, office and gate, and Google's panel holds only one. - Fix: Model both schedules as labeled openingHoursSpecification blocks and state both on the page. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A30.3 `<n>` self-storage-readiness issue(s)** - Pass: No self-storage-readiness issues detected. - Numbers and lists the tool uses: gate: self storage, storage units, climate-controlled, drive-up or RV-boat signals, or SelfStorage schema; signals: SelfStorage node with NAP and geo, office-vs-access dual hours, unit inventory as Offer or OfferCatalog, move-in special FTC terms, tenant-insurance or protection-plan disclosure (CA Ins. Code 1758.76), rate-increase and lien or auction policy (state Self-Service Storage Acts), AggregateRating or Review (FTC 16 CFR Part 465), online move-in, size-guide content, Google Business Profile, accessibility (ADA Title III), Spanish and hreflang; context flags: homepage, facility or location, units or pricing, FAQ, contact; reference /blog/blog-mega-analyzer-self-storage-readiness/. - Why: Fixing these wins "storage near me", shows correct office versus access hours, and keeps specials, insurance and review claims compliant. - Fix: Emit one SelfStorage node per facility (@id `<site>`/#facility with NAP, geo, priceRange, paymentAccepted, sameAs to GBP, Yelp and Facebook, and amenityFeature for climate, drive-up, 24hr, gated, elevator, ground-floor, RV and ADA), model office hours and gate hours as two labeled openingHoursSpecification entries stated on the page, and publish unit sizes as an OfferCatalog of Offers with price, priceCurrency and availability. Put clear terms next to any move-in special, disclose the protection plan honestly, publish the rate-increase and lien policy in plain language, surface online move-in and a size guide, use only real reviews, add an accessibility statement and Spanish hreflang where warranted, and validate every JSON-LD block. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org SelfStorage, OfferCatalog, Offer, openingHoursSpecification; FTC 16 CFR Part 465; CA Ins. Code 1758.76; state Self-Service Storage Facility Acts; ADA Title III; WCAG 2.1 AA. - [ ] **A30.4 No sameAs on the business node** - Pass: The home and contact pages' business node links external profiles via sameAs. - Numbers and lists the tool uses: gated on the home or contact page. - Why: Engines reconcile the facility through its Business Profile, Yelp and Facebook, and the Business Profile is the number one lead source. - Fix: Add sameAs linking Google Business Profile, Yelp and Facebook. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org sameAs. - [ ] **A30.5 The site shows or claims ratings but has no machine-readable AggregateRating / Review schema** - Pass: Rating claims or review widgets on the home or contact page are backed by AggregateRating or Review schema, or the page makes no rating claim. - Warn: When schema is present the tool asks you to confirm the count and value reconcile with the real Google or Yelp total. - Numbers and lists the tool uses: claims /\b5-?star|highly rated|top-?rated|best storage\b/i; widget /yelp|google review|\b\d(?:\.\d)?\s*(?:out of|\/)\s*5\s*star/i; FTC penalty up to $51,744 per violation. - Why: Fake, incentivized or suppressed reviews are banned, and real reviews should be machine-readable. - Fix: Emit aggregateRating with the real count and value once genuine reviews exist. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FTC 16 CFR Part 465. - [ ] **A30.6 No accessibility statement or accessible-unit signal** - Pass: Any audited page where the signal regex matches the raw HTML, or that is the accessibility page, gets the pass row 'Accessibility / ADA signal present'. - Fail: The homepage matches none of the signal phrases. - Numbers and lists the tool uses: /accessibility statement|web content accessibility|wcag|ada compliant|ada accessible|wheelchair accessible|ground-floor units?/i tested on the raw HTML, or isAccessibilityPage; the fail fires on the homepage only; the pass fires on any page where the signal matches. - Why: Storage facilities are ADA Title III public accommodations, and the online move-in flow is the top litigation surface. - Fix: Publish an accessibility statement, conform to WCAG 2.1 AA, and note accessible units. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: ADA Title III; WCAG 2.1 AA. - [ ] **A30.7 No online move-in / reserve / pay path found** - Pass: A rent, reserve, move-in online or pay online call to action exists. - Numbers and lists the tool uses: /rent now|reserve|move in online|move-in online|pay online|reserve now|rent online/i; checked on the home page and unit pages /\/(units?|sizes?|unit-sizes?|pricing|rates?|prices)(\/|$)/ (Mega Analyzer). - Why: The modern storage funnel is contactless online move-in. - Fix: Surface Rent, Reserve and Pay Online calls to action plus an autopay or tenant-portal link. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A30.8 Move-in special advertised ("`<value>`") with no adjacent terms** - Pass: No promo headline, or the material terms appear next to it. - Numbers and lists the tool uses: special /first month free|\$1 first month|50% off|half off (?:your )?first|move-?in special|one month free/i; terms /admin(?:istration)? fee|terms apply|see (?:store|details)|required insurance|protection plan|standard rate|then \$/i (Mega Analyzer). - Why: The FTC requires material terms to be clear and conspicuous next to the offer. - Fix: State the admin fee, required insurance, the standard rate after the promo and any minimum stay next to the offer. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FTC clear-and-conspicuous disclosure. - [ ] **A30.9 A protection plan / tenant insurance is referenced but the page does not disclose that buying it is NOT required to rent** - Pass: No insurance mention, or the page says coverage is not required to rent or that existing homeowner or renter coverage may apply. - Numbers and lists the tool uses: insurance mention /protection plan|tenant insurance|storage insurance|insurance is required|coverage is required/i; disclosure /not required to rent|your own (?:insurance|coverage)|existing (?:homeowner|renter)/i (Mega Analyzer). - Why: Several states require disclosing that the protection plan is optional and may duplicate existing coverage. - Fix: Add the disclosure next to every insurance mention and never auto-enroll without separate consent. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: California Ins. Code 1758.76. - [ ] **A30.10 No rate-increase or lien/auction policy language found** - Pass: Rate-change and lien or auction policy language exists on the home or FAQ page. - Numbers and lists the tool uses: /rate (?:increase|change)|lien|auction|past due|default|delinquen/i; checked on the home page and FAQ pages (Mega Analyzer). - Why: Each state's Self-Service Storage Facility Act governs these terms, and renters and AI assistants ask about them. - Fix: Add plain-language rate-change and lien or auction policy text that references the state act. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: state Self-Service Storage Facility Act. - [ ] **A30.11 Unit sizes appear but there is no size guide / estimator** - Pass: A size guide or estimator accompanies the unit sizes. - Numbers and lists the tool uses: sizes /\b(5x5|5x10|10x10|10x15|10x20|10x30)\b/i; guide /size guide|what size|unit size|size estimator|which size/i; checked on the home page (Mega Analyzer). - Why: 'What size storage do I need' is a top-of-funnel question every renter asks. - Fix: Add a size guide (5x5 closet, 10x10 one-bedroom, 10x20 full home) linked from the unit blocks. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A30.12 No Spanish-language signal** - Pass: Spanish content or an es hreflang exists. - Numbers and lists the tool uses: /hreflang=["']es|lang=["']es|\/es\/|espa[nñ]ol|almacenamiento|bodegas/i; checked on the home page (Mega Analyzer). - Why: A large share of storage renters prefer Spanish. - Fix: Add Spanish versions of the core pages with reciprocal hreflang (en, es, x-default). - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A30.13 Unqualified superlative ("`<value>`")** - Pass: Any superlative appears only inside a quoted customer testimonial. - Numbers and lists the tool uses: /\b(cheapest|lowest prices?|largest|biggest|#1|best storage|guaranteed lowest)\b/i on body plus footer; quoted scope /<(blockquote|q)\b[^>]*>[\s\S]*?<\/\1>/gi; flagged when the total match count exceeds the count inside blockquote or q elements (any match outside a quote) (Mega Analyzer). - Why: Objective claims must be substantiable under FTC advertising law. - Fix: Qualify and date the claim, or soften it. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FTC advertising substantiation. - [ ] **A30.14 Environmental claim ("`<value>`") with no specific basis** - Pass: No eco claim, or the claim carries a specific basis such as ENERGY STAR, a percentage or on-site solar. - Numbers and lists the tool uses: green claim /\b(eco-?friendly|green|sustainable|climate friendly|carbon neutral|solar-?powered)\b/i; basis /energy star|\b\d+%\b|on-?site solar/i (Mega Analyzer). - Why: FTC Green Guides require eco claims to be specific and substantiated. - Fix: Make the claim concrete or drop it. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: FTC Green Guides. ### Senior care - [ ] **A31.1 Local-SeniorCare: NursingHome / AssistedLivingFacility / LocalBusiness schema** - Pass: A senior-care site declares NursingHome, AssistedLivingFacility, MedicalBusiness, LocalBusiness or LodgingBusiness. - Numbers and lists the tool uses: regex /NursingHome|AssistedLivingFacility|MedicalBusiness|LocalBusiness|LodgingBusiness/i (Mega Analyzer). - Why: Senior-care facilities need a recognized entity type for local and AI answers. - Fix: Add NursingHome or AssistedLivingFacility JSON-LD. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org NursingHome, AssistedLivingFacility. - [ ] **A31.2 Local-SeniorCare: state license number + licensing-agency name** - Pass: State licensing language with the agency name appears in the body text. - Numbers and lists the tool uses: /(state\s+licens|HHSC|DSS|CDPH|RCFE|Type\s+[ABC]\s+(?:assisted|residential)|licensed\s+by|license\s*#)/i. - Why: A state license is mandatory for care facilities. - Fix: Publish the license number and the licensing agency. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A31.3 Local-SeniorCare: Resident's Bill of Rights / admission-agreement disclosure (or visible /disclosure link)** - Pass: Resident-rights or admission-agreement language appears, or a disclaimer-class page is linked. - Numbers and lists the tool uses: /(resident.?s?\s+(?:bill\s+of\s+rights|rights)|admission\s+agreement|disclosure\s+statement|level\s+of\s+care)/i. - Why: This disclosure is required for residents. - Fix: Publish the Resident's Bill of Rights or the admission agreement. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A31.4 Local-SeniorCare: HIPAA notice (Medicare/Medicaid-billing senior-care facility)** - Pass: The facility does not mention skilled nursing, Medicare or Medicaid, or the word HIPAA appears in the body. - Fail: The site matches /skilled\s+nursing|medicare|medicaid\s+(?:certified|provider)|long[- ]term\s+care\s+facility/i and has no HIPAA mention. - Numbers and lists the tool uses: /skilled\s+nursing|medicare|medicaid\s+(?:certified|provider)|long[- ]term\s+care\s+facility/i; /hipaa/i. - Why: A HIPAA notice is only required when the facility bills Medicare or Medicaid. - Fix: Add a HIPAA notice. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: HIPAA. ### Solo practitioners - [ ] **A32.1 Vertical agent type is dual-typed with Person** - Pass: A node typed as a solo-practitioner vertical (RealEstateAgent, Attorney, Dentist and so on) is also typed Person. - Fail: A vertical practitioner type stands alone without Person. - Numbers and lists the tool uses: vertical types RealEstateAgent, Attorney, LegalService, Notary, Dentist, Physician, PhysicalTherapy, MedicalBusiness, FinancialService, InsuranceAgency, AccountingService, Chiropractor, Optometric, Optician, Podiatric, TravelAgency, Photographer, InteriorDesigner; entity types Person, Organization, LocalBusiness, Corporation, OnlineBusiness, NewsMediaOrganization (Mega Analyzer). - Why: Dual-typing keeps worksFor valid on the same node that declares the vertical. - Fix: Use @type: ["Person", "RealEstateAgent"] (or the relevant vertical type) on the practitioner node. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org multi-typing. - [ ] **A32.2 Agent declares employer relationship** - Pass: The practitioner node declares worksFor and/or parentOrganization. - Fail: A vertical practitioner node has neither worksFor nor parentOrganization. - Numbers and lists the tool uses: same vertical type list as the dual-typing check (Mega Analyzer). - Why: WorksFor validates only on Person-typed nodes and parentOrganization only on Organization-typed nodes, and together they tie the agent to the employer in the Knowledge Graph. - Fix: Add worksFor (Person to Organization) and/or parentOrganization (Organization to Organization) on the practitioner node. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org worksFor, parentOrganization. ### Squarespace sites - [ ] **A33.1 SEO site title configured** - Pass: SiteTitle is set in the Squarespace context. - Numbers and lists the tool uses: regex /"siteTitle"\s*:\s*"([^"]+)"/ on the raw HTML (siteTitle must have a non-empty value); pass when matched, info when absent (never warn or fail). - Why: Squarespace uses the site title in page titles and browser tabs. - Fix: Set it under Settings, Marketing, SEO. - Verify: [Platform Audit](https://jwatte.com/tools/platform-audit/). ### Chiropractic, optometry and podiatry - [ ] **A34.1 YMYL-Health-Chiropractic/Optometry/Podiatry: state-board credential (DC / OD / DPM #) visible** - Pass: The practice's credential abbreviation or a license marker appears in the body text. - Numbers and lists the tool uses: chiropractic /\b(d\.?c\.?|chiropractor|chiropractic\s+(?:license|board)|state\s+board\s+of\s+chiropractic|board[- ]?certified\s+chiropractor)\b/i; optometry /\b(o\.?d\.?|optometrist|optometric\s+(?:license|board)|state\s+board\s+of\s+optometry|abo[- ]certified)\b/i; podiatry /\b(d\.?p\.?m\.?|podiatrist|podiatric\s+(?:license|board)|abpm|abps)\b/i. - Why: DC, OD and DPM practitioners are state-board licensed; NPI, HIPAA and Good Faith Estimate rules apply only to MDs and DOs. - Fix: Publish the DC, OD or DPM license number. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). - [ ] **A34.2 YMYL-Health-Chiropractic/Optometry/Podiatry: scope-of-practice disclaimer or visible /disclaimer link** - Pass: A scope-of-practice or medical disclaimer is present or a disclaimer-class page is linked. - Numbers and lists the tool uses: medical disclaimer /\b(not\s+(?:medical|professional)\s+advice|consult\s+(?:your|a)\s+(?:doctor|physician|healthcare)|for\s+informational\s+purposes\s+only)\b/i on lowercased body text, or a link matching /\/(disclaimer|legal-notice|notice|terms-?(?:of-)?(?:use|service)?|privacy(?:-policy)?|disclosure|aboutus|legal)\/?(?:$|\?|#)/i; gate /^YMYL-Health-(Chiropractic|Optometry|Podiatry)$/. - Why: A scope-of-practice disclaimer is the required notice for these practices. - Fix: Add a scope-of-practice disclaimer. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). ### CPA and accounting firms, Production homebuilders, Home and property inspection, Aviation asset management, Registered investment advisers - [ ] **A35.1 Invalid @type:[Person, Organization] on the firm node** - Pass: The firm node is not dual-typed Person and Organization. - Fail: The global node declares @type ["Person","Organization"] in either order. - Numbers and lists the tool uses: regex /"@type"\s*:\s*\[\s*"Person"\s*,\s*"Organization"\s*\]|"@type"\s*:\s*\[\s*"Organization"\s*,\s*"Person"\s*\]/ on the JSON-LD text (Mega Analyzer CPA, homebuilder, inspection, aviation and RIA modules). - Why: Rank Math and Yoast emit this when the site is set to Person with a logo, but a firm is an Organization, not a Person. - Fix: Switch the global type to ["`<vertical type>`","Organization"] (AccountingService for CPA, HomeAndConstructionBusiness for homebuilder, FinancialService for aviation and RIA) or ["HomeAndConstructionBusiness","LocalBusiness"] for inspection, and change @id from #person to #org. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org multi-typing. ### Health, legal and money pages (YMYL) - [ ] **A36.1 YMYL-Health: Person schema with credential** - Pass: A health or legal site declares a Person node for the practitioner. - Fail: No Person type is found, which is added to the YMYL missing list. - Numbers and lists the tool uses: regex /Person/i on the collected types (Mega Analyzer). - Why: The practitioner or attorney entity is needed for E-E-A-T binding on high-stakes topics. - Fix: Add Person JSON-LD with hasCredential for the practitioner or attorney. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org Person. - [ ] **A36.2 Missing YMYL trust signals (CRITICAL for AI citation eligibility): `<list>`** - Pass: Every trust signal expected for the detected YMYL vertical is present. - Warn: E-E-A-T Generator shows a YMYL alert for medical, dental, legal and recovery industries. - Fail: Any expected signal missing for a YMYL vertical is critical. - Numbers and lists the tool uses: gate /^YMYL-/i or any non-General vertical; an owner-confirmed vertical override is treated as ground truth over the detected one; E-E-A-T Generator flags ymyl:true for medical, dental, legal, recovery and false for the other 18 industries. - Why: AI Overviews and Google apply much tighter source-quality filters to health, finance and legal content, so missing signals can suppress the site entirely. - Fix: Add each listed missing signal (credentials, disclaimers, notices) through schema and visible bios, and do not generate fixes for a misdetected vertical. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/), [E-E-A-T Generator](https://jwatte.com/tools/eeat-generator/). Standard: Google Search Quality Rater Guidelines v2024 section 3.4 (YMYL). - [ ] **A36.3 Disclaimer-class page link fallback** - Pass: Some link on the page points to a disclaimer-class path, which soft-passes the vertical's missing on-page disclaimer. - Numbers and lists the tool uses: /\/(disclaimer|legal-notice|notice|terms-?(?:of-)?(?:use|service)?|privacy(?:-policy)?|disclosure|aboutus|legal)\/?(?:$|\?|#)/i. - Why: Solo practitioners host the regulated disclaimer on /disclaimer/, /legal/ or /terms/ rather than the home hero, and failing the home page for that is misleading. - Fix: Link the disclaimer page from the main navigation or footer. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). ### HVAC contractors, Electricians, Handyman services - [ ] **A37.1 Placeholder phone number detected ("`<value>`")** - Pass: No 555-01xx placeholder number appears in the body text. - Fail: Mega Analyzer fails when a 555-01xx placeholder number appears in the body text of an HVAC, electrician or handyman site. - Numbers and lists the tool uses: phones /$?\d{3}$?[-.\s]?\d{3}[-.\s]?\d{4}/g; placeholder /5\s*5\s*5[-.\s)]*01\d\d/ or /\b555[-.\s]?01\d\d\b/; runs when the Mega Analyzer detects an HVAC, electrician or handyman site. - Why: 555-01xx numbers are reserved fakes left over from template data, and a fake phone in text, schema or your listing sends callers nowhere. - Fix: Replace the placeholder everywhere it appears: the tel: link, the schema telephone field and Google Business Profile. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). ### Laundromats, Self-storage - [ ] **A38.1 No paymentAccepted in schema** - Pass: The business node lists paymentAccepted matching the payment methods described on the page. - Fail: PaymentAccepted is absent on the home or pricing page, or payment methods appear in the copy but not in schema. - Numbers and lists the tool uses: regex /"paymentAccepted"/i; payment copy /apple pay|google pay|tap to pay|contactless|credit card|debit card|card reader|payrange|cashless|mobile app|\bcoins?\b|quarters/i on home, pricing or contact pages (Mega Analyzer laundromat module); pass-only row on self-storage sites. - Why: 'Do you take cards or Apple Pay' is a top pre-visit question that answer engines can state from schema. - Fix: Add paymentAccepted listing exactly the methods you take. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org paymentAccepted. - [ ] **A38.2 No amenityFeature in schema** - Pass: Amenities are encoded as amenityFeature LocationFeatureSpecification entries on the homepage business node. - Numbers and lists the tool uses: regex /"amenityFeature"/i on the homepage; storage amenities named: climate control, drive-up, 24-hour access, gated or keypad security, elevator, ground floor, RV or boat, ADA accessible (Mega Analyzer). - Why: Feature filters and AI answers such as 'largest washer', 'WiFi' or 'climate controlled' match on structured amenities. - Fix: Encode each amenity as an amenityFeature LocationFeatureSpecification. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org amenityFeature. ### Laundromats, Self-storage, Car washes, HVAC contractors, Electricians, Handyman services - [ ] **A39.1 No Open Graph tags** - Pass: At least one og: property is present. - Fail: A home or service page (home or facility page for self-storage) with zero og: properties. - Numbers and lists the tool uses: ogCount = count of /property=["']og:/gi; gated to home and service pages (laundromat, car wash, HVAC, electrician, handyman) or home and facility pages (self-storage). - Why: Shares render as a bare URL with no title, image or description. - Fix: Add og:title, og:description, og:image, og:url and twitter:card. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: Open Graph protocol. ### Law firms, CPA and accounting firms - [ ] **A40.1 Attorney bio JSON-LD missing hasCredential** - Pass: The bio's Person JSON-LD carries hasCredential with credentialCategory license. - Numbers and lists the tool uses: regex /"hasCredential"|"credentialCategory"\s*:\s*"license"/i on bio pages (Mega Analyzer legal and CPA modules). - Why: The bar or state-board license is the primary verification hook AI search uses to cite a professional. - Fix: Add hasCredential with credentialCategory license, the jurisdiction or state board as recognizedBy and the license number. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org EducationalOccupationalCredential. - [ ] **A40.2 Attorney bio JSON-LD missing alumniOf** - Pass: The bio's Person JSON-LD carries alumniOf. - Numbers and lists the tool uses: regex /"alumniOf"/i on bio pages (Mega Analyzer legal and CPA modules). - Why: The school is a primary authority anchor and separates two professionals with similar names. - Fix: Add alumniOf with the law school or university. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org alumniOf. - [ ] **A40.3 Attorney bio JSON-LD missing memberOf** - Pass: The bio's Person JSON-LD carries memberOf. - Numbers and lists the tool uses: regex /"memberOf"/i on bio pages; optional but recommended (Mega Analyzer legal and CPA modules). - Why: Bar and professional-society memberships add depth to the authority profile and weigh heavily in verification queries. - Fix: Add memberOf for bar associations, AICPA, the state society or similar bodies. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org memberOf. ### Law firms, CPA and accounting firms, Defense contractors - [ ] **A41.1 Attorney bio page missing [Person, Attorney] JSON-LD** - Pass: Each bio or leadership page carries a Person node typed with the profession (Attorney, Accountant) or a Person block per named executive. - Fail: A bio page has no professionally typed Person node, or a leadership page has no Person node. - Numbers and lists the tool uses: legal: bio page with /Attorney/i; CPA: bio page with /^Accountant$/i; defense: leadership page with /^Person$/ (Mega Analyzer). - Why: Required for AI-search citation, Knowledge Graph reconciliation and verification of experience claims. - Fix: Add ["Person","Attorney"] or ["Person","Accountant"] JSON-LD on each bio, and a Person block per leader with jobTitle, worksFor, alumniOf and hasCredential. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org Attorney, Accountant, Person. ### Production homebuilders, Home and property inspection - [ ] **A42.1 Placeholder / garbled Person node detected (name=`<value>`)** - Pass: Every Person node has a real human name. - Fail: A Person name has no whitespace, is 6 characters or shorter and is not a capitalized word, which looks like a slug or theme default. - Numbers and lists the tool uses: name regex /"@type"\s*:\s*"Person"[^}]*?"name"\s*:\s*"([^"]{1,40})"/gi; flagged when no whitespace, length <= 6 and not /^[A-Z][a-z]+$/ (Mega Analyzer homebuilder and inspection modules). - Why: A non-human value emitted as a Person pollutes the firm's entity graph. - Fix: Replace the placeholder with the real owner or leader, or remove the node. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org Person. ### Self-storage, Car washes - [ ] **A43.1 Unit sizes/prices are shown but there is no Offer / OfferCatalog schema** - Pass: Priced units, wash tiers or memberships are machine-readable as an OfferCatalog of Offers. - Numbers and lists the tool uses: self-storage: hasOffer /"@type"\s*:\s*"(Offer|OfferCatalog|Product|AggregateOffer)"/i on the JSON-LD or a collected type matching /Offer|OfferCatalog|AggregateOffer/, checked on units pages /\/(units?|sizes?|unit-sizes?|pricing|rates?|prices)(\/|$)/ or when the body names a unit size /\b(5x5|5x10|10x10|10x15|10x20|10x30)\b/i; car wash: hasOffer /"@type"\s*:\s*"(Offer|OfferCatalog|Service)"/i on the JSON-LD or a collected type matching /Offer|OfferCatalog/, checked on service or membership pages or when the body shows a dollar price /\$\d/ (Mega Analyzer self-storage and car wash modules). - Why: 'What does a 10x10 cost' or the unlimited-wash price must be machine-readable with availability. - Fix: Emit an OfferCatalog of Offers with price, priceCurrency USD and availability; model memberships as an Offer with a monthly UnitPriceSpecification. - Verify: [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/). Standard: schema.org Offer, OfferCatalog. ## Cross-checks outside jwatte.com These are the second opinions worth getting, all free: - **Google Search Console** (https://search.google.com/search-console/) and **Bing Webmaster Tools** (https://www.bing.com/webmasters/) for what the engines actually indexed, and to submit the sitemap. The Search Console + Bing Importer on jwatte.com reads the CSV exports from both. - **Cloudflare's agent readiness scorer** at https://isitagentready.com/ : enter a URL and it scores five categories, discoverability, content accessibility, bot access control, protocol discovery and commerce, with a shareable report. The Agent Ready Audit on jwatte.com mirrors the same probes; run both and they should agree, and where they disagree the jwatte tool tells you which probe. - **Google Rich Results Test** (https://search.google.com/test/rich-results) and the **Schema Markup Validator** (https://validator.schema.org/) for structured data. Remember that both validate nodes, not the relationship between a node and the page it lives on; section 3 covers what they miss. - **PageSpeed Insights** (https://pagespeed.web.dev/) for lab and field Core Web Vitals on one URL. - **IndexNow** (https://www.indexnow.org/) to tell Bing and its partners about a changed page the same day. Google does not consume it. - **WAVE** (https://wave.webaim.org/) for a second accessibility opinion, in the browser. ## The loop 1. Write or fix the pages with the plan you have, using Prompt A, B or C. 2. Put them on hosting you control, with your own domain and HTTPS (section 12). 3. Run the Mega Analyzer on the homepage, then the section tools for whatever it flags. 4. Paste each tool's fix prompt, with this file, into the AI. Replace the files it hands back. Redeploy. 5. Check what a crawler sees, not what you see: the rendered-DOM and mobile-parity tools exist because the two are routinely different. 6. Submit the sitemap in Search Console and Bing Webmaster Tools, ping IndexNow, and finish the Google Business Profile. 7. Repeat monthly, or whenever you add a page. The tools are free every time. ## Changelog - 1.2, September 24, 2026: added 2.64 to 2.74 (Facebook and WhatsApp link previews: Open Graph placement, og:image size, type and dimensions, compression and the Range request) and 5.54 to 5.59 (Meta's crawler tokens under RFC 9309: Meta-WebIndexer, facebookexternalhit, named groups that drop the * rules, rules stranded below a named group), the scored checks of the new Meta AI Crawler + Link Preview Audit. Meta publishes no Muse crawler, user agent or website standard (checked September 24, 2026), so these cover only what Meta documents. - 1.1, September 23, 2026: added 9.99 and 9.100, the two iPhone form checks the Mega Analyzer gained that day (date and time inputs WebKit redraws after your CSS, and text fields under 16px that make iPhone zoom on focus), each judged at 375 and 430 px wide. The 95 Mega Analyzer rows added on September 21 and 22 are not in this file yet. - 1.0, September 18, 2026: first release. 873 general checks across 12 sections and 290 industry-specific checks, extracted from the source of 78 tools on jwatte.com and then verified check by check against the code that enforces it (898 confirmed as extracted, 265 corrected, 12 dropped). --- Free to use, copy, adapt and redistribute. No warranty. This file is informational, not legal, financial or SEO consulting advice. Product names are mentioned as nominative fair use; no affiliation is implied.