Mega Analyzer Changelog

Back to methodology · Open the tool

Dated history of probe additions, scoring weight changes, and false-positive guards. The check set is versioned so external citations to specific scores stay reproducible.

Agent Inspector scope and score stability · November 6, 2026

The Inspector keeps its existing discovery order and main-score calculation, with the parsing corrections below. Passive runs use only GET and HEAD reads of public files, never a handshake, POST, OPTIONS or DELETE, and never call tools. A linked endpoint address may be read by GET like any other public link. Unanswered optional files are named without removing completed scores, while failed stages retain partial results and retry. Supplemental text review now checks only titles and descriptions for a short list of possible signals; it does not read argument names or keys and never changes a main score.

Cards with a byte order mark now parse correctly, and relative card endpoint addresses resolve against the site; these corrections can change the selected endpoint, rows and scores.

Agent Inspector results update · November 6, 2026

The Inspector now keeps gathered public facts when a request fails, shows declared tools as unconfirmed, and offers a clear next step without enabling the handshake. Separate panels add contextual text review, registry comparisons, listing readiness, word changes and documented connection examples; the existing main scores keep their calculation. Full scans add clearer access states and bounded legacy SSE fallback with separate setup and ping timing. The mcptry public methodology informed some checks, and results link to its independent view without fetching its data. Method and limits.

v2026.11.06 · November 6, 2026

The Mega Analyzer, the Agent Endpoint Inspector and the Mega Security Analyzer now follow one rule: a public scan stays passive, and a report states only what was measured. Scores change on pages with no JSON-LD and on Shopify stores with hidden products. A passive result and a full result are different measures. See Passive and full scans.

• Passive by default (Mega Analyzer): a default run sends only ordinary reads, and every report says which kind of scan ran. Crawler-labeled requests, Meta's link-preview replay and the agent handshake run only when you tick a box and press Run on a site you own or have permission to test. Links and autorun cannot turn it on, the tick lasts for one run, and anything skipped shows "Not run in passive mode" and stays out of the score.
• Passive by default (Agent Endpoint Inspector): it reads public files with GET and HEAD requests and sends no handshake. A linked endpoint address may be read by GET like any other public link. The agent handshake is an unticked box. Passive results are labeled as such and leave out anything not run. Addresses in agent files are now read correctly when they sit inside Markdown punctuation, and a list request that failed shows "Not available" instead of 0. Tool labels are stated as unverified guesses from the tool's own words.
• Handshake in a Mega Analyzer full scan: it now also runs when a site names its endpoint only in llms.txt, as Shopify's default text does, and it returns the same results as the Inspector. A passive Mega Analyzer run does not call the probe, and sends nothing to an MCP or A2A endpoint.
• Missing schema now counts (scored): a page with no JSON-LD used to drop the Schema bucket from the average, so a page with none could outscore a page with some. The bucket now counts at 0, with a share of 0.6 of a bucket for E-commerce, Local, YMYL and B2B pages and 0.35 for others. A blank app shell or an unreadable page stays unknown.
• Shopify store checks: hidden products (scored in SEO, even from the home page), prices, labels against SKUs, stock, barcodes, offers against page data, overlays, store locators and retailers. A Shopify store now reads as E-commerce at minimum.
• Platform defaults: settings a platform owns read "Platform default: ask Shopify" (or the platform's name) in all three tools, leave the fix list and do not change the score. Both agent tools now show one shared row saying whether llms.txt and agents.md are default text and whether they hold business facts.
• Mega Security Analyzer: any count it did not measure shows "Not run" with a short reason, instead of 0. A direct route setting now holds on every read. The Build flaws count matches its category. It no longer raises X-UA-Compatible as a fingerprint, CSRF on Shopify's own forms, or a tracker suggestion that was only a limit of a static read. Moving script addresses such as @latest with no integrity value are flagged, DMARC with no rua address is called out in plain words, and certificate days match the calendar.
• Other Mega Analyzer fixes: the fix list is ordered by estimated gain, so its top item agrees with "Held back most by". Exports state when PageSpeed was still pending. A page with words on it is no longer called a blank app shell, and the robots row names the file and the rule.

v2026.10.30 release 3 · October 30, 2026

• Owner permission in Mega: guessed repository, environment and WordPress backup paths require the same per-origin owner permission as the Security Analyzer and a deliberate Run click. Automatic and unticked runs leave the owner row unscored. Sensitive responses retain derived evidence only, without raw file bodies or shared caches.
• End-of-life findings: an expired runtime or WordPress release line is a finding even when a server may receive vendor backports. Findings tell owners to upgrade unless their host confirms extended support. Patch-only comparisons retain the backport caution.
• WordPress advisories: exact versions and qualified version hints join the dated Wordfence Intelligence feed. Hints say “may be affected”; malformed version ranges remain unknown. Every displayed advisory carries its record link and Defiant copyright/license attribution, plus MITRE attribution for CVE records.
• Security data updates: the scanner and both reports show source dates, who refreshed the data, changes since the preceding update, stale warnings and a “New this week” filter. The weekly server-side update can publish validated feed data without a website deployment. Failed refreshes preserve the last good data. No visitor data is sent to Wordfence.

v2026.10.30 · October 30, 2026

The Mega Security Analyzer now joins bounded public software evidence to dated advisory sources. A version match is a lead to review, not proof of exploitation. Missing versions or incomplete sources stay unknown.

• Public components and advisories: reviewed package identities, exact or uncertain versions, affected and fixed ranges, source dates, CISA KEV and FIRST EPSS context replace the hand-maintained vulnerability table. Lockfiles and source maps do not prove that a dependency runs in production.
• Permission and limits: pressing Run or Enter with the owner checkbox checked includes the fixed owner checks in the same run. Automatic links remain passive until “Run the owner checks too” is pressed. The scanner samples up to five declared scripts, two declared maps and a fixed, robots-fenced set of files within 30 additional URLs shared with HTTP redirect checks, a declared WordPress theme stylesheet, a declared RSS feed and two conditional WordPress owner routes. If all optional slots apply, later slots beyond the ceiling remain explicitly unmeasured. Redirects and allowed fallback attempts are counted separately.
• Sanitized evidence: raw bodies and full secret values remain out of security responses, browser replay, exports and prompts. Alternate security evidence routes remain disabled while their privacy and transport requirements are unresolved. A refusal is an access observation, not a clean result.
• Reports and fixes: confidence, coverage, source dates, plain-English guidance, PDF export and a reviewable AI fix prompt accompany findings. Existing header, cookie, TLS, DNS and page checks remain part of the security report.
• Mega Analyzer: the compact “Known vulnerabilities and exposures” sample is unscored and preserves all existing rows and the score. Its existing robots-fenced file checks are unchanged.

This scan only reads what your site already shows every visitor. Anything beyond that, such as signed-in scans, injection or configuration testing, or load testing, is a separate engagement. It starts only after the site owner approves it in writing and ownership is verified with a DNS record or a file on the site. Ask about a separate engagement

v2026.10.28b · October 28, 2026

The second half of the cross-check work from v2026.10.28a: more independent tools in "How other tools see this site", Google's own speed numbers on the score card, and a second prompt that turns the AI visibility results into a change plan. None of it changes the score.

• More outside checks, grouped: the button now also asks Google PageSpeed Insights (Lighthouse accessibility, best practices and SEO, plus the checks both tools make, one by one), the Google Knowledge Graph (does Google know this business as an entity), the Mozilla HTTP Observatory, the W3C HTML checker, the HSTS preload list, certificate transparency logs (crt.sh), DNS from two public resolvers (SPF, DMARC, MX, DNSSEC), the domain’s registration record (RDAP), Wikidata and the Wayback Machine. Rows are grouped (Google; security and certificates; domain and DNS; structured data and entities; accessibility and HTML; AI agents; history; registries) and fill in as each answer lands. A row with no matching check here is marked "For reference" rather than agree or differs.
• Registries, only when they apply: the NPI registry for clinicians a medical site names in its own structured data, the SEC adviser search for financial advisers, and the Texas Comptroller or Colorado Secretary of State when the page’s address is in those states (is the entity active, and its latest report year). Only an exact name match counts; a similar name is never reported as the business. Addresses, officers and phone numbers from these records are not kept.
• The Knowledge Graph match is strict: an entity counts only when its website is the audited site, or its exact name matches and the page’s own structured data declares the same kind of organization. Other results are listed as "not this business".
• Speed from Google, through our server: the score card’s speed note now shows Chrome field data from real visitors when Google has it (LCP, INP, CLS) and the Lighthouse mobile score, with the Lighthouse version. The test runs on our server, so it no longer depends on Google’s shared free quota, which refused most browser requests. Speed is still not part of the grade.
• Prompt 2, the change plan: after your assistant answers the AI visibility prompt, paste the second prompt into the same chat. It reads your website, checks the facts against what it found, and writes a plan: facts that disagree, Google profile, listings, pages to add, reviews, structured data, answers for AI assistants, forms and prices, with every unknown fact marked for the owner to confirm. It is built from what our audits of 43 businesses found most often. On the Mega Analyzer card, Prompt 2 ends with this scan’s top findings so the assistant can confirm them and fold them in. Reference copy: prompt-2.txt.

v2026.10.28a · October 28, 2026

We checked the Mega Analyzer against six independent tools on three Dallas Fort Worth agency websites: Google's Rich Results Test, the Schema.org Validator, Lighthouse, WebAIM WAVE and Cloudflare's isitagentready.com. Where they agreed, nothing changed. Where the analyzer was wrong, it is fixed, and the results page now shows what those tools say next to its own findings. Only the sitemap item below changes scored rows; everything else here is unscored.

• No more "content checks may be noisy" on full pages: the warning that a page is a client-side app shell fired on a WordPress page because a case study address contained the letters "ng-app", and on a Duda page because its widget data contained "props". It now needs a thin page as well as a framework fingerprint: fewer than 250 words in the HTML the server sends, the same rule the analyzer's own server-rendered content check uses. Each fingerprint must also be real markup, not ordinary text. Real app shells still get the warning, and the roughly 40 other tools that show this banner follow the same rule.
• Sitemap row after a redirect (scored): "URL in sitemap" compared the address you typed, so a bare domain that redirects to www was reported missing from a sitemap that listed the www page. It now compares the final address, treats www and the bare domain, http and https, and a trailing slash as the same page, and names the entry it matched. On the test site that raised this, the score went from 97 to 98. Because the page is now found in the sitemap, the related row "Listed current URL agrees with indexing and canonical hints" is checked instead of reading not applicable: on a site whose sitemap and canonical tag both name the bare domain while that address redirects to www, it now reports the conflict (that site's overall score stayed the same).
• The quick accessibility check says what it cannot see: it reads the page source, so it cannot measure color contrast as the browser draws it or see images that scripts add after loading. WAVE and Lighthouse both caught low contrast that it could not. The accessibility tab now says so and links WAVE and PageSpeed Insights for the page you audited.
• Score card notes: under the grade, "Speed is not part of this grade" with Google PageSpeed's mobile result when Google answers (a link to the PageSpeed report when it does not); what the grade counts ("Scored on 41 weighted criteria; 6 of them lost points", next to the Full Summary’s issue and warning counts, which also include advisory checks); and "Held back most by" the single fix worth the most points, when it is worth at least one point. The exports and Plain-English Results carry the same lines.
• How other tools see this site: a button at the end of the results runs the Schema.org Validator and isitagentready.com on the page you audited and shows each answer next to the analyzer's own reading, marked agree, differs or not comparable. Not comparable is used where the two tools define a rule differently (for example, robots.txt rules that name no AI crawler). It also gives prefilled links to Google's Rich Results Test, WAVE and PageSpeed Insights. Nothing is sent to these services until you press the button.
• Retry the requests that did not come back: when some of the audit's requests timed out, were rate limited or failed, a button under "Review and track fixes" sends only those again and re-scores the page from all the answers. That gives the same result as a full run that got them, in seconds instead of a minute or more. When every request came back, it says so: on the three agency sites, the checks marked unknown were not waiting on any request.
• See how customers find you: a new card on the results page and a new page, AI visibility prompt, write a prompt you run in your own AI assistant (ChatGPT, Claude, Gemini, Perplexity or Copilot, with web search on). It shows which searches your customers use, who comes up, and whether assistants name your business. The card fills it in from the scan; the page takes a prefill link. Neither sends anything anywhere. The walkthrough is in Does ChatGPT recommend your business?

v2026.10.27a · October 27, 2026

Scans of sites that refuse our scanner's network address, and corrections from a hand-verified audit of a retail site. A site with the problems below now scores a little lower, and the Plain-English Results name them.

• A refused scan is no longer graded: some shared hosting platforms block an address for every site they host once it requests a path that robots.txt fences off as a trap, then answer every request from that address with a short "Access from your address is blocked." message. The Mega Analyzer used to grade that sentence as the site ("no title, 6 words, 0 security headers"). Such a reply is now recognised as a refusal of our address: the run retries it through our second network route, then tries the same page on the www or bare-domain twin, and scans the twin when it serves the site, with a note at the top of the report, the Full Summary, the AI prompt and the Plain-English Results naming both addresses. When nothing gets through, the run stops with an explanation and the paste-HTML option instead of a grade. Individual refused requests (a crawler probe, a file, a link-preview probe) are marked not measured, never "blocked" or "missing".
• No more trap paths: the directory-listing check no longer requests /backup/, and every guessed path (exposed files, directory listings, policy-page guesses) is requested only when robots.txt lets every crawler in, and only from our own network, never relayed through the second route. The Mega Security Analyzer reads robots.txt first for the same reason; paths it leaves out are reported as not checked and are not counted in its score.
• The address you typed does not answer: when it has no DNS record, does not answer or has a certificate problem, the www or bare-domain twin is tried before the archived-copy fallback. A Rescan button now sits next to Plain-English Results.
• Policy pages that are really the home page: a site that answers unknown addresses, and even its own footer "Privacy" link, with its home page was reported as having every policy page. A policy address whose page has the home page's title and nearly all of its text no longer counts, and the row says so. A page with a cart link plus a shop or account link is treated as selling online, so a returns policy is expected.
• Plain-English Results: an http:// address that serves the site without redirecting is now urgent (it used to read as a broken link while the report listed "Secure connection" as working); a domain that accepts mail but publishes neither SPF nor DMARC is urgent; missing privacy, terms, returns and accessibility pages appear; the business name comes from the page's schema when og:site_name is only the web address; and "Loads quickly", "accurate summary" and other claims the run does not measure were removed.
• New and corrected rows: SPF and DMARC absence on a domain that receives mail or publishes an address at the domain (scored); framework session cookies sent without Secure (scored); a password box limited to fewer than 64 characters (scored); jQuery UI advisories and three more jQuery advisories, read from the library's own banner only; unfinished template parts (placeholder Latin, unfilled template codes, social icons that link nowhere, empty phone links); a retired Universal Analytics tag; the Google Maps loader blocking the page head; retired script hosts; a free-mail address as the only business email; a missing CAA record; a missing security.txt; and the gaps in a business profile (type, logo, hours, map coordinates, a founding date the page claims). The homepage site-name check accepts the canonical homepage when you scan the other host.

v2026.10.24b · October 24, 2026

A Mega Analyzer run no longer waits on a host that does not answer. Scores and findings do not change.

• Hosts that do not answer: one site's canonical link, social image and llms.txt links named its future domain while that domain still sat on a parking address that never accepts a connection. Each of the 23 requests to it waited out its time limit (8 to 25 seconds), mostly one after another, so the run took about 5 minutes and stayed between 66 and 80 percent for most of it. Now, once a host has timed out twice without answering anything in the run, its remaining requests are not sent and count as failed, exactly as they would have after the wait. The address you typed is never skipped, and neither is a host that answered once. The report, the Full Summary, the AI prompt and the plain-English export name the host and how many requests were skipped, and say when it is the page's canonical host.

v2026.10.24a · October 24, 2026

Corrections from two audits of real business sites, where our tools gave advice that did not fit the business. None of these change how a correct site is scored. The day also adds two new checks, both unscored: business facts that disagree across a site, and a new Federal Profile Checker.

• Mega Analyzer business type: federal and defense contractors are now recognised. Set-aside certifications (SDVOSB, VOSB, WOSB, 8(a), HUBZone), SAM registration, UEI and CAGE codes, NAICS codes, DoD and contract vehicles such as GSA schedules count toward B2B-DefenseContractor, and a generic LocalBusiness schema type no longer outweighs them. Before, a certified SDVOSB was labelled an industrial shop. Books and guides about government contracting are not counted as contractors. A contractor is not treated as a storefront: a click-to-call link stays optional advice, and the team page check still counts.
• Legal Pages Audit: a missing Disclaimer page is advisory, not a critical failure, unless the site is a health, finance or legal practice or earns affiliate commissions. A Disclaimer is not a legal requirement for most businesses; the row now says so. Privacy Policy, Terms and Accessibility Statement checks are unchanged.
• DNS & Email Audit: SPF advice now names the mail services found in the MX records, SPF includes and tenant records (Google Workspace, Microsoft 365, Proofpoint, Mimecast, Zoho, GoDaddy, Namecheap and others). A provider's own recommendation is quoted only when that provider is in use; otherwise the advice is to move to -all once every sender is listed and DMARC reports are clean. A domain with no SPF record gets a starting record built from its own providers instead of a Google one.
• Google Business Profile and Bing Places audits: a business whose only address is a private mailbox, or that publishes no street address, is no longer treated as a storefront. The report explains that a Business Profile needs a real staffed location or a service-area profile with the address hidden, and stops suggesting storefront business types such as Dentist or Plumber. For a mailbox address, the map, hours, photo and review-link rows are shown as advice that does not lower the score; a service-area business without a street address keeps its hours and review rows, and only the map advice stands down.
• Mega Security Analyzer: a severity label appears only on a failing row. The Terraform state file row printed “CRITICAL” even when the result was “Not exposed.”
• SGE Readiness Audit: missing FAQPage, HowTo, BreadcrumbList and other schema rows now say “on this page” and suggest running the audit on the key inner pages, since the audit reads one URL. The Mega SEO breadcrumb row says the same.
• Agent Endpoint Inspector: MCP and A2A endpoints a site advertises in its llms.txt (and llms-full.txt when linked) are now probed, and Wix sites are checked at their standard /_api/mcp path. An endpoint that answers 401, or 403 with an authentication challenge, is reported as “exists, requires authorization” instead of “no MCP server”. The Mega Analyzer's agent rows use the same probe.
• Agent Endpoint Inspector, platform servers and blocked sites: an MCP server that the site's host builds into every site (Wix's /_api/mcp, and Shopify's storefront /api/ucp/mcp, both from the platforms' own documentation) is labelled “Platform MCP”. It is credited as a way for AI agents to read the site's content, but it is not counted as agent tooling the business built, and its protocol rows are shown as information. A site whose firewall refuses every request now reads “Blocked by the site”, separate from “inconclusive” and from “nothing to check”, so a blocked site is not mistaken for one with no agent files.
• Mega Analyzer and Mega SEO Analyzer, addresses that redirect: a canonical tag that names an address which redirects (for example the www host after a move to the bare domain) is now a warning; before, the Mega Analyzer listed it as unscored information and the Mega SEO Analyzer did not check it. Sitemap entries and the robots.txt Sitemap line on a host that redirects are flagged too.
• Accessibility for AI agents: the WCAG checks flag role="dialog" on an element that cannot be a dialog (an <aside>, for example) and an aria-modal dialog left in the page while it is closed. Google PageSpeed's Agentic Browsing check “Accessibility tree is well-formed” fails on the first. The Agent Ready Audit shows both, plus Lighthouse's llms.txt recommendations (a title line, Markdown links rather than bare addresses), as an unscored section.
• Parking pages: a domain that shows a registrar or marketplace parking page (Namecheap, GoDaddy, Sedo, a /lander redirect, Wix “Reconnect Your Domain”) now stops the Mega Analyzer, Mega SEO, AEO and GEO analyzers and the Site Analyzer with “This domain shows a parking page; there is no site to audit yet”, instead of grading the parking page.
• Mega Analyzer, federal contractors and IT resellers: sites detected as federal contractors get criteria drawn from what veteran-owned firms that win federal awards publish: UEI and CAGE, NAICS codes (also in the Organization JSON-LD), certifications stated the same way everywhere, contract vehicles with their contract numbers, a capability statement in the menu, named leaders with Person schema, contract-level past performance, a careers page, a LinkedIn company page in sameAs, and security.txt and DMARC (a cyber firm is judged on its own email and disclosure hygiene). A new B2B-ITReseller type, detected from line cards, partner logos, “authorized reseller” and value-added reseller wording with GSA Advantage or SEWP, adds a line card, partner-tier wording, vehicle numbers with GSA Advantage or SEWP links, a quote form that asks for part number, quantity and term, a “how to buy from us” page, VPAT and Section 508 help, and NAICS and PSC codes. Each criterion explains why it matters, and none says a firm must hold a contract vehicle.
• Business facts across the site: phone numbers, street address, city, state and ZIP, legal names, opening hours, email domains and certification or license status words, compared across the page text, the footer, JSON-LD, meta tags and llms.txt (and llms-full.txt when it is linked). Each disagreement shows both snippets and where each came from, for example “llms.txt says SDVOSB is pending; the home page says it is certified”. Formatting differences, a toll-free number next to a local one, fax numbers, labeled mailing addresses and declared multiple locations are not counted, and neither is an llms.txt that lists several locations or nearby businesses.
• Federal profile: when the page shows a UEI, a CAGE code or an SBA certification, or the vertical is a federal contractor, the Mega reads the business's record in SBA's Small Business Search through our fed-profile function, in parallel with the other checks and with a time limit, and lists the top three findings: certifications the site claims that SBA does not show, a certification the site still calls pending, identifiers and NAICS codes that differ, empty profile fields. The full detail is in the new Federal Profile Checker, which adds the profile card, prime awards from USAspending, a peer benchmark and a paste kit.

v2026.10.23f · October 23, 2026

Eight more single-page checks from our dedicated audits now run inside the Mega Analyzer, each from one function the dedicated tool also uses. They read evidence the run already has (no extra requests) and appear as unscored review rows in the report, the Full Summary, the AI prompt and the plain-English export.

• Link purpose: links with the same accessible name that go to different places, with each destination and its nearby context. A review, not a failure: the same words can serve the same purpose.
• Character set: where the charset declaration sits in the first 1,024 bytes and which source decides the encoding (byte order mark, header, then meta).
• Embedded frames: each third-party frame's sandbox tokens and allow permissions. A sandbox is optional hardening; add one only after testing the embed.
• Text and WhatsApp links: optional sms: and WhatsApp contact routes and their number format.
• Missing pages: whether the 404 page shows a not-found message, a link home and other ways back into the site.
• Content Security Policy: each script, style, image, frame and connection URL checked against the enforced policy, with directive fallback, nonces, hashes, 'strict-dynamic', multiple policies and report-only handled.
• Analytics debug: GA4 debug_mode, gtm_debug and GTM environment parameters left in live code. A repeated measurement ID is not reported as duplicate events.
• Storage writes: localStorage, sessionStorage and cookie writes in the page's own scripts, with their keys. A source match does not show a write runs before consent.

Corrections in the dedicated tools: the CSP audit no longer treats every same-site resource as allowed; the GA4/GTM audit stops reporting the standard snippet as a duplicate tag; Head Integrity detects a byte order mark from the response size; the iframe audit no longer counts a permission set to 'none' as granted; the 404 audit drops its canonical advice; the identical-link audit recommends names that keep the visible words together. Module guidance links in the Mega now open as links instead of showing raw markup.

v2026.10.23e · October 23, 2026

One set of checks for the Mega Analyzer and the dedicated audits. We ran both against the same six live sites and fixed every place where they disagreed. The rule now: one shared function per check, used by both pages. New Mega rows are shown in the report, the Full Summary, the AI prompt and the plain-English export, but do not change the Mega score.

• New in the Mega: visible label missing from a control's accessible name (WCAG 2.5.3); llms.txt file-list format; a privacy notice at each form; negotiated TLS protocol, cipher and certificate key; FAQ answer wording compared with the page, not just the questions; transitions on properties that may need layout or paint (a source review, not a measurement); a declared service worker's lifecycle, caching and offline fallback.
• Mega corrections: shared A2A results are no longer shown as incomplete; a meaningful logo name that matches its filename passes; the word “tracking” in a nearby cookie sentence no longer makes a matching phone number ambiguous; sampled scripts are read before they are scanned for credentials and known advisories (an empty HEAD response was being scanned instead).
• Dedicated-tool corrections: Schema Validator no longer counts an @graph twice; Meta & OG Inspector no longer stops on a missing description; Security Headers reports optional policies and browser defaults as information; E-E-A-T, GEO Content Extractability and Trust Signal Surface stop asking home pages for Article markup and dates; the WCAG audit asks for a skip link only when there is a repeated block to bypass; DNS & Email Audit recognises revoked DKIM keys and null MX; SSL Grade keeps an unproven post-quantum result unknown; Sitemap Auditor measures each redirect instead of picking a host by majority; Privacy Disclosure Audit sees Google tags created by code.
• Audit arsenal: the 75 audits that need more than one page (uploads, exports, accounts, crawls or several sites) are now linked, each saying what you need to provide.
• Freshness: modules the Mega loads on demand now carry their own content version, so a cached older copy cannot run with a newer page.

v2026.10.23d · October 23, 2026

Legal pages. The Mega Analyzer now runs the same checks as the Legal Pages Audit, from one shared module, instead of only looking for links on the home page. It finds each policy (privacy, terms, cookies, accessibility, disclaimer, and refund, data processing or copyright where they apply) at its footer link or the usual addresses, reads it, and reports pages that are missing, thin or past their review date. The rows appear in a Legal pages block, the Full Summary, the Mega AI Prompt and the plain-English report, with a link to the full audit. They do not change the Mega score or any bucket score. On six live sites the standalone audit and the shared module returned identical rows, and the Mega scores were unchanged. A blocked or unreadable policy page is reported as not measured, never as missing.

v2026.10.23c · October 23, 2026

Speed and re-runs. Nothing here changes what a check finds or how it scores.

• Runs take about half as long. Server calls are now spaced half a second apart instead of one second, which is still two requests a second to the audited site and half of the per-visitor limit on the page-fetch service. Three evidence modules no longer add a second one-second wait of their own. The time left uses the run's own time per call once ten calls have finished, so a slow site does not make the estimate run short.
• Correcting the business vertical or the platform no longer repeats the whole audit. The page re-scores from the answers the run already received, at once, and fetches only what the corrected setting asks for that the run did not. Run and Re-run still fetch everything fresh.
• Maintenance: the run controller moved into its own file, large answers are parsed once, and the per-run caches of extra files start empty on every run, so a path the new run does not fetch cannot keep the previous site's answer.
• Background tabs: on a computer, a run in a background tab keeps its pace (the wait between calls runs in a worker, which browsers do not slow down), and the tab title shows the progress, then "Results ready". Phones pause pages in background tabs; the progress card says so and the run carries on when the tab is shown again.
• The Full Summary pass rate counts only the checks that can pass or fail on this page. Informational items (optional, not applicable here, or not measured) are listed separately and no longer pull the rate down: a page with no issues and no warnings reads 100%.
• Under the Plain-English Results button, a pointer leads to the Full Summary and the Mega AI Prompt further down the page.
• Every script and stylesheet on the tool pages carries a version taken from its content, so a returning visitor never runs a cached older copy of a changed file with a newer page.

v2026.10.23b · October 23, 2026

Run shell and progress, after a read-only audit of the Mega Analyzer using the Ponytail audit method. Nothing here changes what a check finds or how it scores.

• Progress and time left: a run takes about one second per server call, because calls to the audited site are spaced one second apart. The bar and the time left now count finished calls against the number of calls the same site needed on its last run (95 for a site not seen before). Before, the bar reached 45% within two seconds and then stood still for about 35 seconds, and the time left could read "2s" with more than 100 seconds to go. On the audited runs the new estimate was within about a second on average. Past the expected count it says "finishing" instead of a number.
• After one audit the page refused every form send, so the free weekly email sign-up on the results page always failed. Sends now go out normally.
• A re-run within five minutes could score the previous copy of the page from a cache. Each run now asks for a fresh copy.
• The page loaded the egress script twice, so choosing "Direct only" had no effect until a reload. It now loads once.
• An error during a run now leaves a message saying the audit stopped and why, instead of a blank page.
• Very large llms-full.txt files are read up to 256 KiB, since only their presence is checked.
• Every other scanner now shows a progress bar under its Run button while it works, with the elapsed time, how many lookups have finished and, when the usual duration is known, the time left. Usual durations come from timing each tool, then from the last runs in the same browser.
• Deep links with autorun=1 to tools that take pasted text no longer press Run on an empty form and open a blocking dialog.
• New site design: a cool grey ground with charcoal text, one brass accent, a grotesque display face over a neutral text face (both self-hosted), and lighter headings. Text contrast was measured in both themes on the main pages and a sample of 55 tools: 0 failures, down from 1,018 on the same pages before the change.

v2026.10.23 · October 23, 2026

Business vertical: the Mega Analyzer now scores every vertical instead of taking the first keyword match. The page's own schema decides first, then a platform built for one vertical (restaurant menu and ordering platforms, photographer galleries, parish website hosts), then words that appear in the title, main heading, description or section headings, or that repeat in the copy. One stray word no longer decides, and LegalService or FinancialService schema is no longer outranked by health keywords. On a labelled set of 193 sites the earlier method was right on 127 and the scored method on 189. The report says what the vertical was detected from and asks for a correction when confidence is low. The analyzer also reports the site stack (builder, host, CDN and DNS) from response headers, page code and nameservers, and a link to a platform no longer counts as hosting on it.

Corrections from a hand-verified audit of a small web-development business site. These remove false findings; no checks were added to the scores.

• DNS and email: a blocklist answer in 127.255.255.0/24 (a refused query) or another error code reads as "could not check", not a listing, and a list counts only after it answers its own test entries. The spoofing label follows the DMARC enforcement level, and strict alignment is no longer described as equal to p=reject.
• Security headers: COEP is optional and unscored, and the generated configuration keeps values the site already sends.
• WebMCP: a /.well-known/webmcp file is not part of the draft and no longer scores.
• Agent readiness: an open robots.txt passes, blocking training-only crawlers is reported as an AI-training opt-out, and OAuth discovery rows are not applicable without a protected API. Bing Places listing links are informational.
• Legal pages and SEO: a cookie section in the privacy policy covers cookies when the page sets no cookies and loads no trackers, and consent and GPC rows apply only when cookies or trackers exist. HTTP/3 is read from Alt-Svc, outbound links and Report-To/NEL endpoints are counted correctly, and policy update dates come from the visible stamp or dateModified, never datePublished.
• Local SEO: JSON-LD nodes that share an @id are merged before reading, credential issuers are not counted as businesses, reviews count only when review text or ratings are visible (not loading placeholders), and a service-area business without a published street address gets a note instead of a failure.
• Content measurements: word counts, densities and paragraph statistics use visible text, not script, JSON-LD, CSS or SVG. JSON-LD blocks are not counted as main-thread scripts, decorative images with captions count as correct, and review, search and newsletter forms are not counted as lead forms.
• Security Analyzer: vertical audit suggestions need schema, a vertical platform or prominent repeated words; a tracker the page's own CSP blocks is reported as never loading; the CSRF row is informational when the page sets no cookies and shows no session.

v2026.10.22 · October 22, 2026

Corrections found by running the analyzer on a small mobile repair business. The finance vertical no longer fires on one ordinary use of "investment" in sales copy: without finance schema it now needs an advisory or planning phrase, or the word several times, so a repair page reads as a repair business. When the cache-busting parameter sends sitemap.xml or another root file to a redirect or the home page, the file is fetched once more without it, and a sitemap.xml that could not be fetched (blocked, failed or 5xx) is reported as not verified instead of missing. File paths that every network answers with the same 403 are listed as refused by the site, not as blocked requests, so the access banner and the 499 cell agree. Each score card now says how many scored criteria its number rests on, and Perf + AI says that load speed is measured with PageSpeed Insights or the Core Web Vitals Audit, not here. Review advice in the vertical playbooks now follows Google's review-snippet rules: ratings a business publishes about itself in its LocalBusiness or Organization markup earn no stars, and a Google or Yelp total must never be copied into a site's own markup, so the advice is to show real reviews on the page, link the review profiles and ask for reviews with a direct link. Issue counts and scores do not move except where a sitemap or the vertical had been misread.

v2026.10.21 · October 21, 2026

A Vercel Security Checkpoint answer (HTTP 429 with the checkpoint page) now counts as a bot challenge, with the same split grade, critical row and suppressed content checks as a Cloudflare challenge. Before, it read as "AI crawlers are not being challenged". A plain 429 rate limit without a challenge page is still not a block, and the informational banner no longer says "not challenged" unless the page answered 2xx with content. When only the challenge page was read, the AI eligibility composite marks the content cells as not verified and the 499 row as blocked or unknown instead of reachable. In the Agent Endpoint Inspector, a robots.txt, MCP server card or A2A agent card request answered with a challenge, a 401, 403 or 429, a 5xx or nothing is reported as not read, not as missing. No scores move for sites that answer normally.

October 20, 2026: integrated phone report review

Completed report tabs keep framing controls within the phone viewport. Repeated check titles in different tabs include their category so each displayed source title is distinct. Status labels stay compact, optional history controls use sentence case, and sample and weekly email actions include clearer labels. Full fix prompts include agent document defects while keeping unknown evidence separate. Agent checks keep the existing read-only server handshake, count answered links without penalizing links skipped at the scan limit, and explain absent optional files. Normal scans allow 12 extra lookups; Run all checks allows 40. A broken published agent file displays a warning while staying outside the grade. A valid llms.txt needs its title; an optional file list is not required. Absent optional agent files keep add/help links without an automatic Fix action.

October 20, 2026: access finding accuracy

Mega Analyzer limits access cards to the audited host. Missing DNS records and certificate errors do not trigger alternate access attempts. Proxy platform errors do not count as recovered content. An alias without DNS receives an informational explanation.

2026-10-20, report usability

Optional checks are grouped beside the URL form, with a Run all checks choice. Progress appears beside the run controls. Report rows keep their status and actions together on phones. Completed all-checks runs offer a full fix prompt. A whole-site audit requires contact first to confirm ownership or management and approval.

v2026.10.20ar · October 20, 2026

Agent verification checks actual response status, media types and supported document fields, then samples declared URLs using read-only GET or HEAD. The follow-up budget is twelve requests with an eight second timeout per request. Cached evidence is reused. Unsupported revisions, fetch failures and endpoints beyond the limit remain unverified. Optional protocols remain unscored. The Agent Readiness comparison score stays separate from verification. Protocol sessions and tool calls are left to the dedicated inspector.

v2026.10.20a · October 20, 2026

IndexNow key file comparison ignores one leading UTF-8 BOM and trailing line breaks, spaces or tabs. Different keys, extra text and whitespace inside the key still produce an informational finding. No checks, scoring or resource requests are added.

v2026.10.20 · October 20, 2026

Crawler roles now distinguish current Anthropic, Google and Mistral tokens from historical aliases. Vendor-specific user-fetch caveats replace guaranteed blocking claims. Informational source reviews inventory directional overrides, hidden assistant-directed phrases and unofficial instruction metadata without following the text or inferring malicious intent. Suspected-secret review adds six redacted pattern families without credential validation. Conditional lazy, noscript and legacy resource declarations extend the existing mixed-content review. No additional network requests or dependencies are added.

v2026.10.19l · October 19, 2026

Mega Analyzer recognizes localized article update labels near machine-readable dates while retaining article-only scope. New source reviews cover AI chat disclosure, hidden text cues, map links, iframe dimensions, repeated image text, form fields, telephone links, explicitly linked product feeds, IndexNow key declarations and discovered DKIM keys. These reviews are informational and unscored; source declarations do not prove runtime behavior, compliance or service enrollment. At most two additional reads inspect explicit same-host key and product-feed declarations. Generated sitemap dates are capped at a frozen build instant and verified before deployment without altering published article dates.

v2026.10.19k · October 19, 2026

Unadvertised nested www hosts no longer imply a redirect or certificate requirement. DNS lookup failures are distinguished from TLS validation. Laundry classification uses the primary business and its offers rather than partner descriptions. Linked accessibility statements are recognized; Spanish coverage is optional advice. A valid one-item homepage breadcrumb is informational rich-result ineligibility. API catalog retrieval is reported separately from declaration validity. Regression fixtures preserve neutral, unscored non-applicable protocol outcomes, short-page and passage inventories, and editorial comparisons. No additional requests are added.

v2026.10.19j · October 19, 2026

The visible article update date appears once and is scored only for article-like pages. Missing dates and disagreement with dateModified are warnings. Homepages, products and contact pages receive an unscored not-applicable result. The duplicate identity-bucket weight is removed. This review reuses the fetched source and adds no requests.

v2026.10.19i · October 19, 2026

Legacy optional adoption, editorial style and source heuristics no longer earn or lose quality points. Passage failures are replaced by one neutral inventory. Voice and Mobile comparisons remain visible and unscored, and are excluded from the overall mean. Bing title, description and HTML-size warnings retain the owner's observed Webmaster Tools guidance, with one row per metric. Actual document, resource and accessibility defects retain their scoped evidence requirements. Unknown evidence receives no score. Archived auxiliary files retain their provenance and are excluded from live checks. The fix plan covers every remaining scored warning and failure using the actual bucket weights, grouped remedies and estimated gains. No additional requests are added. Certificate lifetime uses the existing default TLS probe. Optional early-hints and post-quantum transport tests are explicitly enabled by the user; otherwise they say Not tested in this scan.

v2026.10.19h · October 19, 2026

Static accessibility reviews cover focus obstruction leads, dragging alternatives, repeated form entry and help order on already fetched comparable pages. Opt-in transport capture distinguishes actual interim 103 responses from final Link headers. Certificate schedules and constrained hybrid key exchange use the existing TLS probe. All seven diagnostics are informational and unscored, with no additional requests. Missing, partial or unsupported evidence remains unknown. Static source does not establish accessibility conformance, renewal automation or universal transport support.

v2026.10.19g · October 19, 2026

Optional delivery diagnostics review response header grammar, import maps, fragment expectations, intrinsic placeholders and sampled script declarations. Static leads do not establish browser behavior, cache reuse, digest authenticity or measured performance. Collection reuses existing evidence without additional requests. Local workflow controls provide a reviewed fix plan, bounded action exports, owner-scoped templates and opt-in row history with deletion. A shared request scheduler preserves evidence and cancels superseded runs. All new diagnostics are informational and unscored.

v2026.10.19f · October 19, 2026

Optional diagnostics now review TDM reservation precedence, declared Preferred Sources controls, static ARIA values and widget relationships, fetched CSS motion and color declarations, details markup, HTTPS service bindings, ECH framing, address hints, CAA constraints and web-host TLSA syntax. A separate hosting lookup is off by default and sends only the public hostname to the provider when selected. All new diagnostics are informational and unscored. Missing, unsupported or incomplete evidence remains unknown; declarations do not establish runtime accessibility, successful transport, legal compliance, publisher eligibility or a whole site carbon footprint. Additional collection shares six requests at most, including resolver fallbacks and aliases.

v2026.10.19e · October 19, 2026

Mega Analyzer now reviews declared API catalogs, OAuth resource metadata and challenges, UCP profiles, app manifests and app associations. Optional protocol diagnostics cover typed MCP catalogs, NLWeb declarations, llms files, Markdown alternates, WebSub, usage preferences, compression dictionaries, public bot keys, unpaid HTTP 402 responses, RSL and trust.txt. Presence alone does not establish protocol support. Static evidence, unsupported revisions and failed fetches retain explicit limits. Optional adoption and restrictive policies are informational and unscored; old llms and manifest adoption points are removed. New collection reuses existing responses with at most ten additional read-only requests.

v2026.10.19d · October 19, 2026

Declared Recipe, Article, Course, question, discussion, paywall, application, dataset, carousel, rental, employer-rating, education, movie, math and Speakable features receive scoped optional checks. Preview metadata, podcast feeds, public reciprocal identity links, domain handles, publication dates, news disclosure markers and measured search icons are reviewed from bounded evidence. Eight additional reads at most reuse cached feeds and image samples. Missing evidence stays unknown. Optional adoption never reduces a score; static fields do not establish search eligibility, account ownership or publisher policy compliance. Speakable head metadata is accepted, and Article recommendations replace the former required-content scoring.

v2026.10.19c · October 19, 2026

Scoped privacy diagnostics distinguish executable markup from held tags, review recognizable Consent Mode calls, privacy destinations, disclosure excerpts, GPC and static consent controls. Mail checks validate declared DMARC, SPF, MTA-STS, TLS reporting and BIMI within bounded evidence. Advertising declarations are reviewed only with applicable publisher or app evidence. Additional collection shares a maximum of eighteen reads, including twelve DNS queries; exhaustion remains unknown. These checks do not prove consent behavior, legal compliance, sender alignment, provider logo eligibility or seller authorization. Original direct-response fields are retained, and service-business calibration recognizes text scheduling, laundry service types and preview origins. Passage details are informational beneath their scored summary.

v2026.10.19b · October 19, 2026

Structured-data checks now merge shared identifiers and equivalent value arrays before reviewing declared Product, Review, BreadcrumbList, Event, JobPosting, ProductGroup and ProfilePage features. A dated consumer registry distinguishes active search features from retired presentations. Declared merchant returns, shipping and loyalty policies are checked from the supplied graph. Entity checks review phone roles, overnight hours, country-sensitive addresses, homepage site names and visible author context. Optional vocabulary, missing profiles and unresolved external references remain unscored. These static checks do not prove visible price parity, ownership, eligibility, identity or inclusion in search results. No additional network requests are made.

v2026.10.19 · October 19, 2026

The Mega Analyzer adds scoped image candidate syntax, source-marked hero discovery, VideoObject required and recommended values, key moments, thumbnail evidence, sampled JPEG metadata, font declarations, resource reuse, decoded asset budgets, overlays, preview readiness and inline contrast checks. Accessible names, alternative text, focus review and authentication diagnostics now distinguish static evidence from conformance. Statement disclosure uses supplied content only. Original response fields are preserved, safe list headers remain usable, and partial script samples state their scope. Absent HTTPS HSTS and enforced CSP warn consistently; unsafe-inline alone warns, while malformed or broadly unsafe script policies fail. Optional adoption and unavailable evidence remain unscored. Static checks do not certify LCP, CLS, INP, rendered accessibility or provenance signatures.

v2026.10.18d · October 18, 2026

Mega Analyzer now evaluates effective browser security policies, cookie prefixes and partitioned cookies, HTML freshness, reporting declarations, optional account discovery, mixed resources and validating DNSSEC evidence. Script checks inspect bounded declared resources for integrity, reviewed advisory ranges, redacted credential patterns, source maps and lifecycle hints. Optional draft features and deliberate restrictions are informational. Missing header boundaries, exact bytes or complete samples remain unknown. Static evidence does not certify runtime security, back/forward cache eligibility or account workflows.

v2026.10.18c · October 18, 2026

International and indexing checks now preserve URL path case, query strings and trailing slashes. HTML, HTTP and sitemap hreflang declarations share one bounded evaluator. Sitemap checks inspect extension payloads, URL scope and uncompressed limits. New indexing diagnostics cover canonical delivery channels, pagination, sampled filter links, link destinations, descriptions, titles, declared feeds and response evidence. Optional features, deliberate restrictions and review leads are unscored. Missing or incomplete evidence remains unknown. Shared link names include image alternative text.

v2026.10.18b · October 18, 2026

Corrected 45 verified findings across crawl policy, sitemap membership and XML, canonical URLs, snippet and Bing usage directives, retired HowTo results, Product fields and review policies, email and DNS, legal wording, optional agent signals, media and HTTP evidence, security guidance and static accessibility checks. Missing max-snippet no longer implies a 160-character default. Optional features and incomplete measurements are unscored; sitemap indexes no longer prove page membership. Extra sitemap reads are bounded to three children. Static checks do not claim CrUX field measurements or establish WCAG conformance.

Rules now live in independently tested shared helpers. The existing accessibility helper remains shared by the Analyzer and Mega Analyzer. Browser back-tests compare the same corpus against production and a draft, with repeated-production noise measured separately.

v2026.10.18 · October 18, 2026

The Mega Analyzer now warns when a page sitemap lists non-page files, with up to three examples. Indexable PDF and Office documents receive information only, and child sitemaps in a sitemap index are excluded. The title row explains Bing's limit of 70 characters; the description row records that 171 characters flagged and 165 passed in Bing Webmaster Tools. The existing HTML weight row also explains Bing's "Html size is too long" finding above about 1 MB. These additions do not change scoring thresholds or count HTML weight twice.

Images with empty alt text now receive an informational advisory explaining Bing Site Scan's missing-alt warning and when descriptive alt is appropriate. Explicitly decorative or hidden images, 1x1 pixels and noscript images are excluded. Scores are unchanged.

v2026.10.16b · October 16, 2026

Three agent readiness checks: WebMCP origin-trial tokens are decoded and their Ed25519 signatures, origin, feature and expiry checked from response headers, head metadata and first-party script injection. Declarative form labels check both required form attributes and descriptions on named visible controls, excluding hidden and search forms. MCP directory readiness checks tool titles, explicit boolean permission hints and the 64-character name limit, alongside the existing client behavior check. The trial runs in Chrome 149 to 162, ending March 29, 2027; Chrome still ships declarative forms under that trial following their removal from the draft on October 8.

v2026.10.16 · October 16, 2026

WebMCP Readiness Checker: the capability test follows the WebMCP draft

• WebMCP Readiness Checker, capability row: a page that declares its tools with document.modelContext.registerTool() or with toolname forms now passes. In the WebMCP draft a tool's name, description and input schema (ModelContextTool) are the capability declaration. Before, the row passed only on an inline <script type="application/webmcp+json"> block and warned on every page without one, including pages that register their tools exactly as the draft describes. That block appears in no WebMCP draft, explainer or commit in the specification repository, whose README lists static manifests as an alternative it considered and did not adopt. It is now information: optional, no points, and never a warning when the page registers tools. A page with only that block, and no registered tool or toolname form, now warns and scores 0 on this row (it scored 25). The row is renamed from "Capability JSON declarations" to "Capability declarations"; the other three rows are unchanged.

Back test (October 16, 2026): the production checker against this release on eight live pages. Five pages that register tools with registerTool() and carry no application/webmcp+json block moved from a warning to a pass (25 points each). A contact page that has both kept its score, with the block reported as optional. A page with only the block and a removed provideContext() call dropped from 25 to 0, and a page with nothing stayed at 0. No other row changed on any page.

v2026.10.15d · October 15, 2026 (fourth release)

Agent file checks: URL templates, file names that look like emails, review rules without a link, and declarative forms in the WebMCP Readiness Checker

• Agent file links (Agent Endpoint Inspector and Mega Analyzer): a URL template in an agent file, such as /states/{slug}/ or /api/states/{slug}.json, raw or encoded as %7B, is not fetched and never reported as a broken link. The check already skipped them; a test now holds it to that. Name one working example beside each template so an assistant has an address that answers.
• Contact details across agent surfaces: a file name that looks like an address, such as an Astro stylesheet named _@astro.kzvuioaj.css or a script named app@1.2.3.min.js, is no longer read as an email. The top-level domain must not be a file extension, the part before the @ needs a letter or a digit, and a match that starts a path segment is skipped.
• Review requests for agents: agent files that state the rule (only the customer writes and posts a review; an assistant never writes or posts one or offers anything for one) now pass even when they name no review link, with a note to add the platform's own review link if the business asks for reviews. Before, that case was information, under a title that said no such line was found. An incentive or a line that lets an assistant post a review still warns.
• WebMCP Readiness Checker: the declarative test now reads forms the way the WebMCP repository's declarative explainer describes them: toolname and tooldescription on the form, toolparamdescription on its controls, and toolautosubmit, which warns on a form that collects personal details or sends a request. The explainer is an exploration, not part of the specification, and the row says so. data-webmcp-* attributes, which no WebMCP draft defines and no browser reads, are now information and score nothing; before, they earned the test's 25 points. Only tags count, not script text or comments.

jwatte.com dogfood: llms.txt and AGENTS.md now say that only readers write and post reviews of the books, in their own words, and that an assistant never writes or posts one for a reader or offers anything for one.

Back test (October 15, 2026): the Mega Analyzer and the Agent Endpoint Inspector on 13 sites (the twelve from the earlier releases plus a housing data site), production run twice, then this release from a draft deploy. No row, grade, crawl score or category score changed on any site; the one difference, a Vary header row on one site, also differs between the two production runs. No site in the set had a file name read as an email or review wording without a link, so those two corrections show in the tests and, after this release, in jwatte.com's own review row. The WebMCP Readiness Checker on four sites: the two that carried only data-webmcp-* attributes went from 75 to 50, and the two with no declarative forms kept 25, their declarative row moving from a warning to information.

v2026.10.15c · October 15, 2026 (third release)

Agent files, cards and links: ten more checks in the Agent Endpoint Inspector and the Mega Analyzer, and corrections to five earlier rows

The Agent Endpoint Inspector and the Mega Analyzer now check whether what a site publishes for AI agents holds together. Each row is explained in its own section of the article. All are unscored, and the inspector rows never fail and stay out of its coverage dimensions:

• Agent file links: up to eight (inspector) or six (analyzer) same-site links from llms.txt, llms-full.txt, AGENTS.md and /.well-known/llms.txt, sampled across folders; redirect loops, missing pages and errors warn, redirects are information. MCP and A2A endpoints and POST-only addresses are not counted as broken.
• Public AGENTS.md: a public file that reads as a coding-agent README (install, build, deploy steps, a local dev server, hosting identifiers) warns.
• Contact details across agent surfaces: phones and emails in the JSON-LD, the page, the agent files, ai-plugin.json and the MCP and A2A cards; a different phone than the business in the JSON-LD warns, files that disagree on email are information, placeholders and 555 numbers are ignored, and extra numbers such as an after-hours line pass.
• WebMCP registration and form tools: registration only through navigator.modelContext or provideContext() warns (the current draft defines document.modelContext.registerTool()); toolautosubmit on a declarative form that collects personal details or sends a request warns; data-webmcp-* attributes are information.
• Forms agents can operate: labels, button names and autocomplete on personal fields, on the home page and up to two linked lead pages; hidden forms are skipped.
• Schema.org actions for forms: a documented prefill link for a request form should have a matching action whose urlTemplate uses the same parameters (information when it does not).
• Data freshness for agents: JSON data files named in the agent files should carry an as-of time the files tell agents to quote (information).
• robots.txt for AI agents (inspector): Content-Signal lines, and user-triggered fetchers reported apart from training crawlers, with each vendor's own statement on robots.txt.
• MCP server card claims: a card that claims resources, prompts or logging, or names a transport other than streamable-http or sse, with no MCP endpoint answering, warns.
• NLWeb discovery link: a rel="nlweb" link is noted as information; the endpoint is never called.

Corrections to the earlier rows: forms hidden from people (the hidden attribute, display:none, form-detection copies) no longer count as request forms; a prefill link now needs "filled in" or "prefill" wording beside it, not the word "fill" alone; a WebMCP tool that sends a JSON-RPC request to the site's own MCP or A2A endpoint is a read, not a submission. jwatte.com dogfood: its contact page form now marks name and email with autocomplete, the unused data-webmcp-* attributes on its script tags are gone, and its ai-plugin.json gives the same contact email as llms.txt.

Back test (recorded inputs, before and after, October 15, 2026): 23 Mega Analyzer pages and 16 inspector runs: the earlier corpus plus three sites with known problems (a realtor, a rental host and a laundromat). Sites that follow the pattern passed the new rows or got information where something is truly missing (no schema.org action for a documented form, no as-of field). The three problem sites got the warnings they should: looping links, a coding-agent README as AGENTS.md, WebMCP registered only through the old API shapes, and server cards for servers that do not exist. Among the earlier rows, the leasing sites now count one documented prefill link instead of three (the others have no "filled in" wording beside them) and still pass, and a laundromat whose WebMCP tools read its own MCP server lost a false "submits for the user" warning. No grade, crawl score or category score moved; the warnings count went up only where a warning was added.

v2026.10.15b · October 15, 2026 (second release)

The agent fills, the person sends: forms, WebMCP tools and reviews, in the Mega Analyzer and the Agent Endpoint Inspector

An AI assistant may open a booking, maintenance, leasing or contact form already filled in, but only the person should send it. The Mega Analyzer has a new "Agent forms, tools and reviews" card in the Perf + AI tab, and the Agent Endpoint Inspector has the same five rows. They run on any site with forms and agent files (or WebMCP tools), not only lodging, and each one is explained in a section of the rewritten article AI assistants and small-business sites: bookings, service requests and reviews the person still sends:

• Form prefill for agents: passes when llms.txt, AGENTS.md, an MCP tool description or a WebMCP tool documents a link with parameters that opens a non-booking form (contact, service, maintenance, leasing, quote) filled in; information when the site has such forms and nothing is documented. Booking links stay with the lodging rows and are not counted twice.
• Submit boundary for agents: passes when the agent files say whether an assistant may submit a form for the person, whichever way they say it, and the row says which way; warns when a site has forms and agent files and never says.
• WebMCP tool annotations: reads the tools a page registers from its inline scripts and a few of its own script files, without running them, and counts the tools and their readOnlyHint values. Warns when a tool calls form.submit() or requestSubmit(), clicks a submit button or posts data, and when a tool that fills a form or opens a page is marked read-only; a tool that only returns a link may be read-only. Information for a lookup marked as changing things, or a tool with no readOnlyHint.
• Personal data in prefill links: warns when a documented prefill parameter (booking links included) is a name, email, phone, date of birth, card number, password or similar.
• Review requests for agents: where the agent files or tools mention reviews, passes for the platform's review link with wording that only the customer writes and posts the review; warns on wording that lets an assistant write or post a review for someone, or that offers anything for one.

All five rows are unscored, so no grade changes, and in the inspector they never fail. Both tools read at most one linked form page and a few same-site scripts through the same guarded fetch proxy, and only on sites that publish agent files or tools; nothing is submitted and no tool is called. jwatte.com's own WebMCP tools now declare readOnlyHint: true (each one only returns data or a link), and its llms.txt and AGENTS.md now say that an assistant may fill in the contact form but only the person sends it.

Back test (recorded inputs, before and after the change, October 15, 2026): the 17 Mega Analyzer pages and 10 inspector runs of the first release, plus seven sites that follow the pattern (two motel sites, a portfolio hub, a rooms directory, two commercial leasing sites and a self-storage site): 20 analyzer pages and 13 inspector runs. The seven passed every row that applied, except the self-storage site, whose older WebMCP contact tool declares no readOnlyHint (information). Three controls gained a submit-boundary warning: a hotel, a laundromat and jwatte.com, each with a contact form and agent files that never say who sends it (jwatte.com's is fixed in this release). The restaurant, the dental practice, the online store and two hotel pages gained no rows; two business pages on one of the leasing sites passed with that site. No existing row changed, and no grade, crawl score or category score moved; on those three pages the count of warnings went up by one.

v2026.10.15 · October 15, 2026

Lodging: what an AI assistant needs to help a guest book a room, in the Mega Analyzer and the Agent Endpoint Inspector

Retail agent-readiness checks (product identifiers, carts, payment and checkout protocols) do not describe a hotel or a motel, and their advice would add product markup to rooms. The Mega Analyzer's Hotel / lodging readiness card now has an "Agent booking readiness" section with six rows, written up in When an AI assistant books the room:

• Booking link for agents: passes when the ReserveAction urlTemplate carries date (and room) placeholders, or when llms.txt, AGENTS.md or a rates JSON they link documents the prefill parameters; warns on a bare booking URL; fails when the booking action points at a contact, inquiry, waitlist or application page.
• Cancellation policy for agents: passes when a cancellation or refund policy URL is named in the agent files, a linked data file or the JSON-LD; warns when the only copy is a noindex page that nothing an agent reads points to.
• ai-plugin.json API claim: an api member with "type": "openapi" must point at a document that parses as OpenAPI; pointing it at llms.txt or an HTML page warns. No api member is fine.
• Booking page link preview: og:title, og:image and twitter:card on the page that takes the booking (information only when the booking engine is on another site).
• Tax basis on prices: every PriceSpecification and UnitPriceSpecification should declare valueAddedTaxIncluded; warns when it is missing, and fails when the page says "before tax" or "plus tax" and the markup drops or contradicts it.
• Room offers: on pages that list room types, each room's Offer names a HotelRoom or other Accommodation in itemOffered and prices it with a unit (unitCode DAY, WEE or MON, unitText or referenceQuantity); eligibleDuration is suggested when the page states a stay limit.

The rows run only when the hotel card runs: a lodging type anywhere in the JSON-LD graph (now including HotelRoom, Suite, Accommodation and LodgingReservation, nested or referred to by @id), lodging copy with booking signals, or a Local-Hospitality business type chosen in the audit alignment bar. Choosing Local-Hospitality there now turns the card on; before, any vertical override turned it off. The rows are unscored, like the rest of the card, and missing surfaces read as information, not failures.

The Agent Endpoint Inspector gains the agent-file side of the same checks: the ai-plugin.json claim on any site that publishes one, and on booking sites, whether the booking link's prefill parameters are documented and whether the agent files name a cancellation policy that answers 200. These rows never fail; when only the agent files suggest bookings (no lodging type and no ReserveAction), they are information only. Both tools read files through the same guarded fetch proxy and never submit a form or call an MCP tool. jwatte.com's own ai-plugin.json labelled llms.txt as OpenAPI; its api member is gone.

Back test (recorded inputs, before and after the change, October 15, 2026): 17 Mega Analyzer pages (six pages on three lodging sites, three hotel property pages (two from large brands), and eight controls: two restaurants, two stores, a dental practice, a laundromat, a self-storage site and jwatte.com) and 10 inspector runs. Lodging pages gained the new rows and nothing else; the hotel brands showed bare booking URLs and a price specification with no tax flag; no control gained a lodging row, and no existing row changed because of this release.

v2026.10.13d · October 13, 2026 (fourth release)

Mega Analyzer now marks Full Summary with "Review" and Mega AI Prompt with "Fix prompt" once results are ready. The cues stay visible when you open either tab, import a scan, run it again or mark a check N/A. A short results line links to both tabs. There is no animation.

A collapsible "How to use this" strip explains the three steps, scan time and that the scan changes nothing on your site. It remembers your choice in this browser. A sentence beside the grade explains the letter and score. Level and prompt framing choices remain optional. The existing controls, checks and scoring rules stay in place. The existing prompt preferences badge also has clearer contrast in the light theme. Other Mega tools are unchanged.

Import scan also fixes an existing error that tried to replace a constant result object. Imports now update that object and rebuild the page document and tracker patterns from the saved HTML so the report can display it.

v2026.10.13c · October 13, 2026 (third release)

Spanish pages: a Spanish readability formula, Spanish help and contact wording, language roots graded as home pages, and an hreflang language check

The WCAG Accessibility Audit and the Mega Analyzer now read the page language from <html lang>, or from the hreflang alternate that points at the page itself when lang is missing. English pages are graded exactly as before.

• Spanish readability: Spanish pages get the Szigriszt-Pazos perspicuity index, P = 206.835 − 62.3 × syllables per word − words per sentence, read on the INFLESZ scale: under 40 muy difícil, 40 to 55 algo difícil, 55 to 65 normal, 65 to 80 bastante fácil, over 80 muy fácil. Sources: Barrio-Cantalejo et al., "Validación de la Escala INFLESZ", An. Sist. Sanit. Navar. 2008;31(2):135-152 (the bands and the formula's use) and the open-source textstat implementation (the exact formula, which the paper prints with a misplaced bracket), both read October 13, 2026. Flesch-Kincaid stays for English. Any other language says "not graded" instead of guessing.
• WCAG 3.2.6 Consistent Help: on Spanish pages, Contacto, Contáctenos, Contáctanos, Ayuda, Soporte, Atención al cliente, Preguntas frecuentes and any tel: or mailto: link count as help, as well as the English words.
• Language roots are home pages: in the Mega Analyzer, a path such as /es/, /fr/ or /es-mx/ that names the site root in its hreflang set, and that the root names back, gets the home-page checks (for example the BreadcrumbList exemption and the industry modules' home-page rows) instead of the inner-page ones.
• English word lists: on a non-English page, reading grade, passive voice, hedge, jargon, vague-claim and CTA density say "not checked for this language" instead of failing or passing by default, and the Voice score counts only the rows it can check. On Spanish pages the FAQ, about, team, privacy, terms and accessibility link checks also match Spanish addresses (/preguntas-frecuentes, /sobre-nosotros, /privacidad, /aviso-legal, /accesibilidad and similar), opening hours and "actualizado el" dates are read in Spanish, and the font-glyph typo row no longer flags the Spanish word "Al".
• hreflang: a new row checks that each page's <html lang> matches the hreflang code the group uses for it. The existing reverse-link check no longer reports a missing reverse link when a page writes href before hreflang.
• Back test: both tools ran on recorded copies of 16 public pages, before and after the change: 8 English pages (2,663 Mega Analyzer rows and 132 WCAG rows), 7 Spanish pages (two Spanish home pages on language roots, a motel page, a constitution, an encyclopedia article, a software tutorial with no contact link and an essay with only a mailto link) and a French page. On the English pages no existing row changed; the only addition is the new hreflang language row on the four that have hreflang. On the Spanish pages real problems still show: the page with no contact link still gets the 3.2.6 warning, and the three dense texts still score 43 to 50 on INFLESZ (algo difícil). The French page says "not graded".

v2026.10.13b · October 13, 2026 (second release)

AI catalog (ARD manifest) rows now grade the file the way Lighthouse does, and the Agent Endpoint Inspector checks it too

The standard is Agentic Resource Discovery, ARD v0.91 (a proposal dated August 26, 2026; read October 13, 2026). Lighthouse grades the catalog in its Agentic Browsing category, and its two current versions disagree, so the analyzer now reports both. The old rows passed catalogs that Lighthouse 13.5 scores 0: they never checked for extra fields in host, accepted any type containing a slash, flagged valid identifiers such as urn:air:example.com:sitemap, and required the optional host.identifier.

• Lighthouse's own validators: both verdicts come from the validator code in the Lighthouse 13.5.0 package and in the 13.5.0-dev nightly that carries ARD v0.91, run in your browser. On 114 recorded catalogs they give exactly Lighthouse's score and rows, a check that now gates every deploy.
• Found the way Lighthouse finds it: a robots.txt Agentmap line, <link rel="ard"> or rel="ai-catalog", a Link header, then /.well-known/ard.json and /.well-known/ai-catalog.json. Found only at the older address is a warning under ARD v0.91; an advertised address that does not load is reported.
• New and renamed rows: "ARD manifest (AI catalog) at /.well-known/ard.json or /.well-known/ai-catalog.json", "ARD manifest passes Lighthouse 13.5 (released ard-schema audit)" and "ARD manifest passes ARD v0.91 (Lighthouse next)". Each issue is said in plain words, with Lighthouse's own message under it.
• Web page instead of a catalog: a site that answers /.well-known/ai-catalog.json with its home page (a single-page app does this) gets a warning on any site, because Lighthouse reads that page as a broken catalog and scores it 0.
• Discovery routes: the Link header and rel="ard" now count, and the advice points at ard.json.
• DNS: SVCB records at _entries._agents and _search._agents (ARD v0.91) are now looked up. A _catalog._agents TXT record still passes but is labeled as the early-draft form it is; Lighthouse does not check DNS.
• Agent Endpoint Inspector: the same three catalog rows, from the same shared code.
• Back test: both tools ran on 18 sites (catalogs that pass, that only warn, that fail, a web page in place of a catalog, and sites with none) before and after the change, reading the same recorded responses. Of 6,270 rows compared, only the catalog, discovery-route and DNS rows changed. Overall scores moved by at most one point, and only where a catalog fails Lighthouse.
• Also updated: jwatte.com's own catalog (now at both addresses, score 1 in both versions), the setup checklist template, items 5.39 to 5.41 and 5.45 of the Getting Found Checklist, and the ARD section of the agent readiness post.

v2026.10.13 · October 13, 2026

Six false positives fixed, plus one each in the Legal Pages Audit and the WCAG Accessibility Audit

All eight were found on a multi-tenant campus site and a shopping center site. Before shipping, each tool ran against 80 public pages twice: once as it was and once with the fix, both reading the same recorded responses. Only the rows below moved. Real dental practices, laundromats offering wash and fold, copy that really hedges, a menu that really wraps on a phone, a site with a cookie banner and cookies, and a logo link with no name are all still flagged.

• Dental vertical: the dental terms now match whole words. A terms page that says "incidental or consequential damages" is no longer graded as a dental practice with a CRITICAL missing trust signals row.
• Laundromat services: a service phrase counts only in a statement with no negation before it. "It does not offer wash-and-fold" and the question "Does it have wash-and-fold service?" no longer read as offering it.
• Multi-tenant pages: the laundromat checks stand down when a page's JSON-LD lists three or more businesses of three or more kinds, laundries are the minority, and the title is not about a laundromat. A campus home page is no longer graded as its laundromat tenant.
• Hedge density: "just" before a direction or a distance ("just west of", "just past", "just minutes from") and "rather than" are no longer counted as hedges.
• FAQPage schema: information, not a fail, on a page with no visible questions and answers. Google only allows the markup where the Q&A is on the page.
• Nav toggle on phones: the "no hamburger" issue is dropped when the CSS the analyzer reads (inline styles and the first two same-site stylesheets) gives the nav a phone layout inside a max-width media query: a grid, a wrapping or stacked row, or a horizontal scroller. A nav that is simply hidden on phones still counts as the problem.
• Legal Pages Audit: no missing cookie banner warning when the Cookie Policy says plainly that the site sets no cookies, no audited page sends a Set-Cookie header, and the homepage loads no common cookie-setting script. "We do not use cookies for advertising" does not count.
• WCAG Accessibility Audit: alt="" on a logo inside a link whose own text names it (a directory tile with the business name) is no longer warned about. Alt text there would make the link read the name twice. A logo link with no name of its own still fails.
• Scoring: no formula changed. A page moves only where one of these rows was wrong.

v2026.10.11g · October 11, 2026

The fetch fallback now returns within its time budget on hard-blocked sites, keeping the direct block finding and reporting which alternate tiers timed out.

v2026.10.11e · October 11, 2026

The analyzer and the inspector share one check set, enforced by fixture parity tests. Authentication challenges, denied requests and timeouts stay inconclusive. Agent Card required fields follow the declared historical or current revision independently of service reachability. Untrusted tool operation labels and possible personal-record metadata are information findings, never executed calls or confirmed exposure.

The inspector adds per-check evidence, UTC observations, redacted excerpts, bounded content hashes, JSON export and dimensions with unknown coverage. The analyzer adds an information coverage summary. No tools or tasks are executed, optional discovery absence is not a defect, and the overall grade formula is unchanged. Evidence before verdicts.

v2026.10.11b · October 11, 2026 (second release)

Agent endpoints: the Mega Analyzer now runs the Agent Endpoint Inspector's full check set

Nine more Crawl Health rows, with the same titles and the same Learn / Fix / Audit links as the Agent Endpoint Inspector, read from the same read-only probe. Like the v2026.10.11 rows they appear only when a site publishes an MCP server card or an A2A agent card. Warnings are kept to defects a client actually hits; consistency gaps are information rows, which stay out of the overall grade.

• MCP: Tool definitions are well formed: warning for a duplicate tool name or an inputSchema that is not a JSON Schema object of type object; information for a name outside 1 to 128 letters, digits, _, - and ., or a tool with no description.
• MCP: Answers ping (warning): the spec requires an empty result, and SDK clients use ping to keep a connection alive.
• MCP: A notification gets 202 with no body: warning when the server refuses notifications/initialized with a 4xx (that can break a client's handshake); information for any other answer than 202 with no body.
• MCP: Answers are JSON or an event stream (warning, shown only when they are not) and MCP: MCP endpoint uses https (warning for plain http).
• MCP: Server card lists the tools the server serves (information): the card's tool list against what tools/list returns.
• MCP: Every tool declares whether it changes anything (information, unchanged severity) now also flags a tool marked both read-only and destructive.
• A2A: Agent card has the required fields: warning when the card has no name, description, version, interface or skills; information when it lacks capabilities, defaultInputModes, defaultOutputModes or an interface's protocolBinding or protocolVersion. A2A: Every skill has an id, name, description and tags (information, with unique ids) and A2A: A2A interfaces use https (warning for plain http).
• Scoring: sites whose agent endpoints are correct see only new passing rows; the overall grade moves only for a site with one of the warning defects above. As before, every row counts in the Crawl section's own score.

v2026.10.11 · October 11, 2026

Agent endpoints, measured: what the MCP server and A2A agent a site advertises actually answer

The Crawl Health rows about the MCP server card and the A2A agent card read the cards. New rows now ask the endpoints those cards name, through a read-only probe that lists capabilities and never runs one: it sends no tool call, resource read, prompt request or A2A message. The probe runs only when a site publishes an MCP server card or an A2A agent card, so sites without either get no new rows and no change. The same checks run on their own, with every tool and skill listed, in the new Agent Endpoint Inspector. Background: One CORS header, 28 sites.

• MCP endpoint answers the handshake (warning when it does not): an endpoint the card names must answer initialize or the 2026-07-28 server/discover. Protocol requests go without an Origin header, as desktop and server-side clients send them, so a server that correctly refuses unknown browser origins is not reported as broken.
• GET answers with a stream or 405 (warning): the Streamable HTTP transport allows only an event stream or 405 in answer to GET.
• Card protocol claims match the server (warning): a card that lists 2026-07-28 must answer server/discover with a 2026-07-28 envelope, and the version a server negotiates must be in the card's list. The newer revision is tested in its own dialect, never through initialize, which correctly returns an older version.
• A2A endpoint answers GET with 405 + Allow: a warning when GET at the endpoint the agent card names answers anything but 405 (a 404 usually means the card points at an endpoint that is not deployed); information when the 405 has no Allow header.
• Information rows: a 405 without the Allow header RFC 9110 requires; a CORS preflight that lists GET while GET is always 405 (browsers ignore it, because GET is CORS-safelisted, but it misleads people and scanners); and tools that declare neither readOnlyHint nor destructiveHint.
• Scoring: the warning rows (the three above, and the A2A row when GET does not answer 405) count toward the overall grade like other crawl warnings; information rows do not. Like every Crawl Health row, all the new rows count in that section's own Crawl score, so a site with an agent card can see that number move by a point or two. Sites that publish no agent card see no change at all.
• More inspector checks (later the same day; the Mega Analyzer gained the same rows in v2026.10.11b): the Agent Endpoint Inspector also checks that every tool has a valid, unique name, a description and an object inputSchema; that no tool is marked both read-only and destructive; that the server card's tool list matches tools/list; that ping gets an empty result and a notification gets 202 with no body; that the MCP endpoint and every A2A interface use https; and that the A2A card carries capabilities, defaultInputModes, defaultOutputModes and, on every skill, an id, name, description and tags with unique ids. It also says when a card names an endpoint on another host.
• What it reads: one call to a new jwatte.com function, which fetches the two MCP card paths and the two A2A card paths, then sends OPTIONS and GET to each endpoint, and to the MCP endpoint the handshake with its notifications/initialized, a ping, tools/list (and resources/list and prompts/list when the server advertises them), server/discover, and a DELETE to close any session the server opened. Private and internal addresses are refused, every request has a timeout, and the whole probe has a time budget.

v2026.10.10 · October 10, 2026

Business vertical: a store or restaurant that names a nearby hospital is not a health practice

• YMYL-Health false positive: a page whose own JSON-LD declares a non-medical business (a store, shopping center, restaurant, cafe, arcade, lodging, trades and similar) and carries no medical schema now needs at least five medical keyword mentions before it is classified YMYL-Health, the same bar editorial pages already had. Before, one nearby-landmark line such as a distance to a regional medical center was enough to classify a retail center as a health practice and raise critical HIPAA, license and practitioner-schema failures. Real practices are unaffected: medical schema still classifies on its own.
• Shopping centers are retail: a page whose JSON-LD declares a ShoppingCenter is classified Local-Retail before its tenants' cafe or restaurant types are read, so a center listing a coffee shop no longer gets restaurant hours and menu checks.

v2026.09.30 · September 30, 2026

Modern browser features: instant page loads, page transitions, dialogs, autofill and passkeys

A new Modern browser features card in Perf + AI, a widget row in the Performance card, a scoring change and a longer detail on the parser-blocking row, and two new results in the shared accessibility rule for autofill tokens. None of the new rows is scored, in the Mega Analyzer or in the Site Analyzer. The one change to the Mega Analyzer score is the parser-blocking row (see Scoring change below). In the Site Analyzer, the existing results for fields without an autofill token and for references to a missing id stay scored, and they now count some fields and references they missed before, so a Site Analyzer score can move either way. Every row reads the HTML, the response headers and the CSS the page ships; none of them runs the page. Background: the companion article on modern browser features for small business sites.

• Speculation rules: each inline block and each file named in a Speculation-Rules response header is parsed the way the HTML standard parses it, and document rules are matched against the page's own links with the browser's own URL pattern matching. The one red result is a rule that would load a sign-out, add-to-cart or other state-changing link before the click at eagerness moderate or more eager; a conservative rule, which waits for pointer down, gets a note, as WordPress core treats it. A link under a docs, blog, knowledge base or tag section (such as /docs/api/logout) is a page about the action, so it does not count. Cart and checkout pages warn only when a broad prerender rule, or an immediate or eager prefetch rule, sweeps them in; account, admin and API links are a note. Eagerness immediate warns only past Chrome's own caps (10 prerenders, 50 prefetches). Rules that do not parse, a rules script with src, a header value that is not a quoted list, a rules file served with the wrong content type or answering 404, and a Content-Security-Policy that blocks the block are warnings, because the page still works without the speed-up. A rules file answering 401, 403, 429 or 5xx, or a bot wall in front of our fetch, reads "could not be checked". The CSP check knows 'inline-speculation-rules', nonces (read from the raw markup when the parser hides them) and hashes (judged only for blocks in plain ASCII). An unknown rule key that looks like a typo is an error; any other unknown key or requirement is a note, since newer browsers may know it. An archived copy of a page behind a bot wall never warns, and the absence note appears only on multi-page sites that are not Next.js, Nuxt or Gatsby apps.
• Cross-document view transitions: a plain cross-fade needs no reduced-motion fallback unless the site's own CSS turns motion off for reduced-motion visitors. A reset on * does not reach the ::view-transition layers, so a site with that reset and an unguarded opt-in gets a warning. Other motion warns only when it is proven (keyframes on a transition layer that move, or linked items with their own names that morph, leaving out named links in the header, navigation and footer, which stay in place) and only when every stylesheet and same-site script was read (libraries, service-worker registration and WebMCP files aside, since none of them can hold a fallback); otherwise the row says "not verified". Recognised fallbacks: the opt-in inside @media (prefers-reduced-motion: no-preference), navigation: none or view-transition-name: none under a reduce query, rules on the transition layers under a reduce query, a reduce-motion class, and scripts that check the setting. Names shared by two elements on screen warn, since the browser then skips the transition; hidden elements and names set through var() are left out. Pages that use no view transitions get no row.
• Dialog and popover: native <dialog> and popover pass. Warnings for wiring that does nothing as written (a dialog opened with the open attribute that claims aria-modal="true", a popovertarget on an element that is not a button or at a target without the popover attribute, a submit button inside a form) and for custom dialogs with no accessible name. Consent and chat tools are left out, and disabled buttons and custom elements are not judged.
• Passkeys on sign-in pages: for information only, never a warning. It opens only for a real sign-in form (a password next to a username or email field) and passes on a webauthn autocomplete token, a navigator.credentials call (inline or in a sign-in script it reads), or passkey sign-in markup such as a "Sign in with a passkey" button or a WebAuthn element. A link that only talks about passkeys does not count. A sign-in screen drawn from data also passes when one inline script holds the passkey button and its WebAuthn challenge; the button label alone, as in a translation file, does not count.
• Autofill tokens (A11y tab and Site Analyzer): autocomplete values that are not in the HTML standard's list fail, and autocomplete="off" on a sign-in or contact field warns: Chrome usually fills those fields anyway, and the field no longer says what it holds. Fields are now classified by their names instead of any name containing "name". No longer counted as missing a token: fields for someone else's details (an emergency contact, a reference, a pet), product and subject fields, store locators, and one-field hidden honeypot wrappers; a form-level autocomplete="off" now moves its fields to the new off result. Newly counted: address text areas, the username field of a sign-in form, company or organization fields, and fields named only by their id. Address lookups, card and PIN fields, twin fields beside one with a valid token, and page or post passwords are never judged. In the Site Analyzer, the two new results (a value browsers do not recognize, and autocomplete="off") are shown but not scored; the result for fields without a token is scored as before.
• Broken references: popovertarget and commandfor pointing at an id that is not on the page now count in the shared missing-id rule, except on disabled buttons and for ids a script creates.
• Widget scripts (INP risk): a new information row in the Performance card names the chat, accessibility overlay, reviews, popup, booking and translation widgets that load with the page, whether blocking, async, deferred or through a loader snippet, and explains why their setup work lands while people start tapping. The analyzer does not measure INP. Consent managers, A/B testing tools and translation services that must run first are not counted, nor are widgets that load on first use or tags held back by a consent tool or Cloudflare Rocket Loader. A loader snippet counts only when it names the widget script URL: a vendor host that only appears in a consent tool map, an allow-list or a code sample on the page is not a loader, and a Next.js script set to load when idle is not counted either.
• Parser-blocking scripts: the row keeps its title and its weight. Its detail now names the chat, accessibility overlay, reviews, popup, booking and translation widgets among the scripts it counts. When a widget's global is called inline right after its tag (Calendly, for example), the detail says to use the vendor's async snippet and make that call in the script's onload callback, because adding defer alone would break it. The scripts the row no longer counts are named in a sentence of their own (see Scoring change).
• Scoring change: the scored parser-blocking row in the Performance card no longer counts consent managers (such as Cookiebot, OneTrust and Usercentrics), A/B testing tools (such as Optimizely and VWO), or translation services that translate the page before it is shown (Weglot, Localize, Bablic, ConveyThis and Transifex Live). These ask to load first and synchronously, so a head whose only blocking scripts are these now passes, and the detail names them separately. Google Translate and GTranslate still count. The row also stops counting scripts that Cloudflare Rocket Loader has rewritten (their type reads like 4b6c5dd6b0a2c5e1a5b0d-text/javascript): Rocket Loader holds them until the page has rendered, so they do not block the parser, and the detail says how many it left out. The row keeps its weight, so sites with these scripts can score higher, and no other site's Mega Analyzer score changes.
• A11y tab: the existing warning rules (such as heading order, duplicate ids and small tap targets) now show amber and count as warnings in the Full Summary instead of issues. This changes no score.
• What it reads: the Speculation-Rules header now passes through our fetch function for direct fetches only, and the probes add up to 2 rules files, 4 stylesheets, 2 same-site scripts and 2 sign-in scripts, each only when a row needs them. Fast mode and pasted HTML skip the optional ones. In the Site Analyzer, the shared accessibility rows now show their titles and details as text.

v2026.09.26 · September 26, 2026

One false page-type count, relative links, and two display fixes

No new rows and no weight changes. Two fixes change a verdict on some sites; the other two change only how rows look.

• Translations are not a second page-type node: a workTranslation or translationOfWork reference points at the page in the other language, so it no longer counts toward "page-type nodes describing this URL". A bilingual site whose English WebPage referenced its Spanish twin as {"@type":"WebPage","@id":"https://example.com/es/#webpage"} read "Multiple page-type blocks describing this URL (2)", showed DILUTION on the entity-anchor signal and lost the single-page-type points. Every other page-type node, anywhere in the graph, is still counted.
• Relative canonical, feed and Webmention links: these are now resolved against the audited page, and against its own <base href> when it has one. They were resolved against jwatte.com, so a relative canonical such as href="/" read "Canonical points to jwatte.com" and was treated as pointing off the site.
• Crawl Health formatting: these rows showed their own formatting as raw text. The ARD rows ended in "<br><br>Learn more: <a href=...>", and other rows read "&lt;head&gt;" instead of "<head>". Their line breaks, code spans and links to our own articles and tools now render. Anything taken from the audited site is still shown as plain text.
• Phones: a JSON-LD example with no spaces in the B2B SaaS readiness row made the Perf + AI tab 665px wide, so a phone zoomed the whole page out to fit it. Long unbroken text now wraps inside its row.

v2026.09.24 · September 24, 2026

Meta's crawlers, link previews, and the WebMCP registerTool change

Meta publishes no "Muse" standard for websites (checked September 24, 2026). What it does document for site owners is five robots.txt tokens, the limits its link-preview crawler works within, and WhatsApp's own preview limits. These rows test those, plus three results from a Facebook Sharing Debugger test we ran on September 24. They sit in Perf + AI, in the AI Search Readiness and Social preview readiness cards, and rows marked for information never cost points. Background: Is Your Site Ready for Meta Muse? There Is No Standard. Here Is What Meta Actually Documents. The full single-site version is the Meta AI Crawler + Link Preview Audit.

• Meta-WebIndexer: the crawler behind Meta AI citations, resolved under RFC 9309 through the shared parser at /js/rfc9309-robots.js. A robots.txt that answers 4xx counts as allow-all, one that answers 5xx as a complete disallow, and one we could not read is "not verified". Meta-WebIndexer also joins the answer-engine crawler row, and that row's score now covers it.
• The five Meta tokens: a table showing which group facebookexternalhit, Meta-WebIndexer, Meta-ExternalAgent, Meta-ExternalFetcher and Meta-ExternalAds each obey, the verdict at the scanned path, and any Content-Signal line in that group. It only warns (and scores) when facebookexternalhit is disallowed, because that blanks every shared link.
• robots.txt groups: named groups that can fetch paths the * group blocks (a named group inherits nothing from *), and rules stranded below a blank line or comment inside a named group, which still bind to it. A blanket Disallow: / under * with named Allow groups is the deliberate allow-list pattern and is not reported.
• Link-preview crawler access: the page is requested as facebookexternalhit and as Meta-WebIndexer and compared with the normal request. A refusal (403, 503 or a challenge page) fails, and a different og:title or og:image warns. A refusal the normal request also got, or a bare 429, is not judged. Skipped in fast mode.
• Range request: Meta's crawler sends Range: bytes=0-524288. A 200 (Range ignored) or a 206 whose body matches its Content-Range passes; a 206 whose body length disagrees with Content-Range warns; a 416, or returned bytes without the og: tags, fails. A reply our proxy could not decode is not checked for og: tags.
• Open Graph placement: byte offsets of every og: tag and of </head>. An og: tag past Meta's first 1 MB, a head that ends after WhatsApp's first 300 KB, or og:title, og:description or og:url after </head> fails; other og: tags after it warn.
• og:image file size: over 8,000,000 bytes fails (in our test a 9,430,028-byte PNG came back "Image Too Big"), and over 600 KB warns for WhatsApp. The size comes from Content-Length (not used when that reply is compressed, because it is then the encoded size), or from counting the bytes when the server sends none.
• og:image format: JPEG, PNG and GIF pass. WebP is for information only: it is outside Meta's documented list, but it rendered as the normal large card in our test. AVIF is for information only and untested. SVG warns, because in our test it rendered only as a small, cropped square thumbnail. An og:image:type that disagrees with the file also warns.
• og:image real size: measured in the browser, or read from the file header when the image cannot load here (an image that sends Cross-Origin-Resource-Policy same-site or same-origin is read from the header without trying the browser). An SVG has no fixed pixel size, so its size is for information only and the format row carries the verdict. Under 200x200 fails; missing or wrong og:image:width and og:image:height, under 600x315, or outside WhatsApp's limits warns. When more than one og:image is present the order is listed (the first one is used), with a warning when the first fails and a later one would work.
• Public phone number on a local business: for information only. Meta is testing Muse calls to businesses whose numbers are public, and the row links Meta's opt-out form. Taking those calls is a business decision.
• WebMCP registration, rewritten: the WebMCP draft removed provideContext() on March 5, 2026 (pull request 132). The row now passes on registerTool() (on document.modelContext, or the navigator alias) in the page or in a WebMCP script it loads, and warns when only provideContext() is found. Only inline JavaScript and the loaded WebMCP scripts count, so an article that mentions the API is not read as calling it. A page with no agent actions and no WebMCP code gets its own "not applicable" row instead of the registerTool pass.
• Form labels: the failing detail now notes that Meta says its Muse agent reads an accessibility tree snapshot, so an unlabeled field probably reaches it as a nameless control (our inference, not a Meta rule).

v2026.09.23 · September 23, 2026

Two iPhone form rows, judged from the page's own CSS

Every browser on an iPhone runs WebKit, and WebKit's iOS theme rewrites date fields after the page's CSS has run. Desktop Chrome never shows the result, so these rows read the CSS the page ships and work out what an iPhone does with it. Both sit in Perf + AI, under Mobile presentation. Background: Why iPhone date fields stick out of forms that look fine in desktop Chrome.

• Date and time inputs not normalized for WebKit: for each date, time, datetime-local, month and week input, the cascade is resolved (importance, cascade layers, specificity, order, the style attribute) at 375 and at 430px wide, to see whether appearance: none or -webkit-appearance: none wins at both. It fails only when the page's own CSS sets a width, padding or border on the field (a reset such as padding: 0 or a page-wide * rule does not count) and nothing turns the iOS theme off, and only when every stylesheet the HTML links was read; otherwise it says "not verified" and names the unread files. A date field nobody styled is reported as the native control, for information, and one that is never drawn (hidden, opacity: 0, 1px by 1px) is left out. Media queries are evaluated at phone widths, including the range syntax and not; rules for print, for hover or fine pointers and for landscape only are left out.
• Text fields below 16px: iPhone browsers zoom the page when a field under 16px takes focus. Font sizes are resolved through inheritance, rem against the root, var(), min(), max() and clamp() at 375 and at 430px, and a field under 16px at either width counts; a field with no font size of its own is 11px on iOS but is only counted when the page styles its box, and anything that cannot be resolved without layout is left out. Advisory, and hidden when the viewport tag already blocks zoom or the page has no mobile viewport.
• What it reads: inline <style> blocks and the first two same-origin stylesheets, as before, plus, when the page has date or time inputs, up to four more stylesheets (later same-origin ones, other hosts, one level of @import). Font, icon and animation libraries are not counted as unread. It never renders the page or loads it as an iPhone, and CSS added later by scripts is not seen.
• Checked against Chromium: on 15 live pages, the resolved font size of 99 text fields and the winning appearance of 19 date fields matched Chromium's computed style at 375 and at 430px, apart from one textarea that Chromium shrinks to 13px through its own monospace default, which iPhone WebKit does not have.

v2026.09.22b: September 22, 2026 (second release)

Fifteen more, mostly from data the run already had

The last of the candidates that need no capability the analyzer lacks. Several of these read signals that were already being collected for other rows and simply never rendered.

• robots.txt blocking the AI discovery paths the audit itself fetches (llms.txt, the .well-known files, the sitemap, the markdown companions), evaluated with the same RFC 9309 parser as the answer-engine row. A site can publish llms.txt and forbid every compliant crawler from reading it.
• Sitemap lastmod trustworthiness: future dates, unparseable values, or every entry sharing one build timestamp. Google uses lastmod only while it is consistently accurate and discounts it site-wide when it is not.
• Navigation links a crawler cannot follow: a javascript: href, an empty href with a click handler, or a click handler on a div inside the nav or header.
• Internal links on non-canonical variants: a different scheme or host, the same path linked in two letter cases, or the same path linked both with and without a trailing slash. Consistent camelCase URLs and a directory index that ends in a slash are not defects, so both tests compare a path against itself rather than against a house style.
• A public JavaScript source map beside the first same-origin script, verified by parsing it rather than by the 200 alone.
• security.txt validity per RFC 9116: a Contact field, an Expires date, and an Expires that is neither past nor more than a year out.
• Sampled same-origin images that do not load (a HEAD on up to four), and camera or screenshot default filenames (IMG_4521.jpg, a bare content hash), which throw away the filename signal Google Images reads.
• Social links that stop at a platform home page rather than a profile, including sameAs entries, which give Google no entity to reconcile.
• Three privacy rows that reuse the policy this audit already fetches: a "Do Not Sell or Share" link when an advertising pixel loads, a policy with no last-updated date or one older than two years, and a policy still carrying its template placeholders.
• CAA against the CA that actually issued the live certificate. The record says who may issue; the certificate says who did. When they disagree the site keeps working until the next renewal is refused, which is the kind of failure that surfaces at 2am on a holiday.
• Two more shared WCAG rules: a positive tabindex (which pulls an element to the front of the tab order for the whole page), and focusable controls inside an aria-hidden="true" block that is still rendered, where keyboard focus lands on something a screen reader will not announce.

v2026.09.22: September 22, 2026

Sixteen more checks: the runners-up from the same review

The review that produced the previous release ranked far more candidates than it shipped. These are the ones that scored next, all of them measurable from the inputs the analyzer already has plus a handful of extra probes.

• Canonical target reachable and indexable. When a page names a different URL as canonical, that URL is now fetched: a 404, a redirect away from it, or a noindex on it means Google discards the hint and picks its own canonical. Self-referencing canonicals pass without a fetch.
• Launch leftovers. Links and assets pointing at a loopback address, a dev/staging/preview subdomain, an ngrok tunnel, a placeholder image service or example.com (the page's own host is excluded); a meta http-equiv="refresh" redirect where a 301 belongs; utm_, fbclid and gclid parameters on the site's own internal links; affiliate and paid links without rel="sponsored" (matched on known networks and affiliate-specific parameters, not on a bare ref=, which is ordinary attribution).
• Directory listings on /uploads/, /images/, /assets/, /files/ and /backup/ (the WordPress path when WordPress is detected), each verified by an "Index of" signature rather than a 200 alone.
• Sibling-host TLS. The www or apex twin gets its own handshake: a certificate that does not name it, or no certificate at all, is a browser warning for every visitor who types the other host form, and the redirect never gets a chance to run.
• Local schema depth: Review nodes without an author or a ratingValue and AggregateRating nodes without a count; GeoCoordinates that are 0,0, out of range, or carry a longitude whose sign contradicts a US address; a PostalAddress that is a bare string or missing streetAddress, locality, region, postal code or country; hours printed on the page with no openingHoursSpecification behind them, which is what Maps and the AI assistants read for "open now".
• Web app manifest actually installable (parses, has a name, a 192px and a 512px icon, a start_url and a standalone-style display), not merely linked.
• Two more shared WCAG rules: controls nested inside other controls (a button inside a link), and unrecognized ARIA roles or misspelled aria-* attributes, which assistive technology ignores silently.
• Email and DNS: the DKIM selector implied by the newsletter service the page's form posts to (Mailchimp, SendGrid, Mandrill, Amazon SES, Postmark, Zoho); an MX exchange with no A or AAAA record, which bounces inbound mail; and linked subdomains of your own domain that do not resolve, including a CNAME to a service that someone else could claim.

v2026.09.21b: September 21, 2026 (second release)

Sixty-four new checks, one new card, eight new tools

Ten independent reviews (performance, security, accessibility, technical SEO, AI and agent discovery, local business, privacy law, hygiene, email and DNS, multilingual and mobile) each proposed the checks a generalist 2026 audit is expected to carry and the analyzer did not; a second pass tried to prove each one was already there under other words; a third scored value and false-positive risk. Sixty-four survived and every one carries Learn, Fix and Audit pills. Anything that costs points is a visible row, as before.

• Performance: the likely LCP image is found by position (before the first H2, inside a hero container, or in the first 15% of the body) and fails when it is lazy-loaded or JS-placeholdered; a second row asks for fetchpriority="high" or a preload; parser-blocking <script src> in <head>; embed iframes without loading="lazy"; web fonts without font-display (Google Fonts URLs, inline and same-origin @font-face); srcset with width descriptors but no sizes; HTML cached for hours without revalidation; sampled same-origin CSS/JS served uncompressed; unversioned assets cached immutable or fingerprinted assets cached under a day. The first two same-origin stylesheets and the first script are now fetched through the proxy (HEAD for the script).
• Trust / Security Headers: mixed content (active vs passive, from a stub that had never been built); cookie flags on the first response (Secure, HttpOnly on session-looking names, SameSite, None-without-Secure); CSP quality ('unsafe-inline' with no nonce or hash, wildcards, report-only, no frame-ancestors); HSTS max-age and includeSubDomains; server, X-Powered-By and generator version disclosure; live API secrets in source (fixed-prefix patterns, masked); /.git/HEAD, /.env and wp-config.php.bak probes verified by content signature; WordPress REST user enumeration and xmlrpc.php (WordPress sites only); certificate expiry and chain validity from the existing TLS probe the analyzer had never called.
• New card, Email + domain posture (DNS): DMARC presence (exactly one record) and enforcement (p=, t=y, pct), SPF validity (one record, an all mechanism, no +all, lookup mechanisms over ten), the DKIM selector the MX provider signs with (Google, Microsoft 365, Zoho, Proton, Fastmail), and whether the contact address on the page belongs to a domain that has MX at all. One probe-dns call.
• Crawl Health: the http:// twin must redirect to https; the www/apex twin must redirect to the canonical host; robots.txt must not block the page’s own CSS/JS (RFC 9309 group semantics, longest-match, wildcards); canonical must be absolute, https, same-host and unique; sitemap URLs must use the canonical scheme and host; a URL in the sitemap must be indexable; <head> closed early (metadata parsed into the body, with the offending tag named); duplicate title, description, canonical or viewport tags.
• E-E-A-T: stale footer copyright year; dateModified vs datePublished vs sitemap lastmod disagreement; Article author that is a plain string or a Person with no url, @id or sameAs.
• AI Search Readiness: snippet suppression that removes the page from AI Overviews and AI Mode (nosnippet, max-snippet under 160, data-nosnippet on most of the body, googlebot-specific metas and X-Robots-Tag); noarchive / nocache (Bing Copilot); answer-engine crawlers (OAI-SearchBot, PerplexityBot, Claude-SearchBot, Applebot, bingbot, DuckAssistBot) evaluated per RFC 9309. The old five-point deduction for any disallowed AI bot is gone: blocking a training-only crawler is a legitimate choice with no citation cost.
• Accessibility (shared with the Site Analyzer): eleven more quick rules: iframe accessible names, filename or placeholder alt text, keyboard-unreachable div controls, focus ring removed with no :focus-visible replacement (reads the fetched stylesheets), videos with sound and no captions track, autocomplete tokens on personal-data fields, radio and checkbox groups without fieldset, html lang invalid or contradicting the text (stopword detection across six languages), empty headings, aria / label / skip-link references to missing ids, data tables without header cells. The GTM <noscript> iframe that the parser hoists out of <head> is recognized from the raw markup and ignored.
• Structured Data and Trust + Conversion: self-serving review markup on the business node; openingHoursSpecification and openingHours shape; placeholder contact data in JSON-LD; phone parity between JSON-LD, tel: links and visible text; visible numbers not tap-to-call; the privacy policy link resolves and names the trackers the page loads; pre-ticked consent checkboxes; session-replay recorders (informational); an advertising pixel on a healthcare-provider page.
• Also: og:image fetched and checked for an image content-type; JS-only translation widgets; hreflang shape (BCP 47, absolute, self-reference); phone, email and ZIP fields that open the wrong mobile keyboard. The Mega AI fix prompt now carries every failing or advisory row from the rendered report.
• Eight new tools back the rows that had no deep-dive: Cookie Flags Audit, Exposed Files Probe, Iframe Embed Audit, Asset Cache Policy Audit, Head Integrity Audit, Local Schema Validity Audit, Click to Call Audit and Privacy Disclosure Audit; ten companion articles explain the rows that had no on-topic post.

v2026.09.21: September 21, 2026

Every row gets its pills, eleven false positives closed, and “cannot” stops reading as “did not”

• Learn / Fix / Audit on every check row. A static inventory of all 421 row titles (pass and fail wording) plus live runs on thirteen sites found 116 rows rendering without a pill cluster; 60 new resource entries close them, and the Retrieval (AEO) card gained a summary row so it carries pills too. The Full Summary copies of each row now match as well (the bucket badge and the N/A button were being read as part of the title, which defeated every anchored pattern).
• DNS-AID SVCB reads n/a, not fail, on a DNS host that cannot publish it. The zone’s NS set is now probed alongside the agent records; a Netlify-DNS zone (NS1 delegation on a Netlify-served site) exposes no SVCB and no DNSSEC through its control plane, so the row is excluded from the Agent Readiness Score and the isitagentready.com figure : which still counts it as a failure : is printed beside ours instead of silently disagreeing.
• OAuth discovery (RFC 8414 / 9728) is gated on a protected surface, not merely an agent surface. A site whose auth.md and manifests declare no authentication has no authorization server to describe; a 404 at /.well-known/oauth-protected-resource is the specified answer and the rows now say so.
• Resource-hint advice counts hosts the page fetches assets from, not every absolute href. A hub page whose footer links to twelve sister domains read as “12 third-party hosts, 0 hints” while loading nothing cross-origin; a fully self-hosted page no longer fails for needing no hints, and a page whose only cross-origin loads are async analytics gets an info row (dns-prefetch at most).
• Vertical classification is schema-first for lodging. A motel whose landmark copy mentioned a hospital was keyword-classified YMYL-Health and handed a critical “missing HIPAA notice”; the e-commerce module also fired on room-rate Offer nodes and, because the hotel module stands down to it, the hotel card never ran. Lodging schema without cart or commerce-platform signals is a hotel.
• WCAG quick checks: a 1×1px skip link parked off-screen until focus is not a 24×24 pointer target; controls inside a [hidden] subtree (Netlify Forms’ registration shadow form) are not unlabelled form controls.
• Scores now match the rows. A page with no failing row scored 91 because Wikidata, ORCID, kgmid, Gravatar, six-plus sameAs, <cite>, Speakable and mainEntityOfPage (all rendered as optional info rows) still cost points, info-severity crawl checks counted against SEO, the Voice score used stricter hidden bands than the Voice rows, and four Perf signals (HTML weight, DOM size, image dimensions, legacy image formats) were stat tiles rather than rows. Optional signals are now bonuses (present earns, absent costs nothing), the Voice score uses the same landing-page bands the rows show, the four Perf signals are check rows with pills, and alt="" on a decorative image no longer counts as missing alt. Rule going forward: anything that costs points is a visible row, and a row that reads as optional cannot cost points.
• Sixteen new companion articles. Every Learn pill added in this release was re-read against its check; where the target post did not actually explain the signal, a dedicated article now does (landmarks and unique ids, placeholder leftovers, canonical target mismatch, content hub link, table of contents, expertise word count, sitemap slug hygiene, shipping policy page, Speakable selector validation, repeated site name in the title, visible contact signals, article:author meta, ImageObject creator, CreativeWork.usageInfo, x402, and the Organization node).
• Smaller guards: the nav-item count is scoped to the primary nav (the whole document was being counted); a two-column key/value table needs no scroll wrapper; the team-page row is informational for a local business whose About page names the owner; a multi-property operator page (subOrganization list, no lodging type of its own) is not asked for its own TripAdvisor pin.

v2026.08.31: August 31, 2026

Agent-readiness parity, and four scoring corrections

• Agent Readiness Score card reproduces isitagentready.com’s arithmetic so the two reports can be diffed line by line. Their check set was read from a live /api/scan response rather than from the rendered page.
• DNS-AID probe widened to the seven queries they actually issue: SVCB and HTTPS at _index._agents, _a2a._agents and _mcp._agents, plus TXT at _index._agents. Previously only SVCB at _index was asked for, so a zone publishing an HTTPS record passed there and failed here. _catalog._agents is kept as a deliberate superset.
• A2A Agent Card added to the parity card. Their discovery category carries nine checks and ours carried eight, so every site serving /.well-known/agent-card.json was undercounted.
• Three parity rows now read the fetched artifact instead of a check row’s severity. Content Signals passed on any site with named per-bot rules and no Content-Signal line; x402 and MPP returned neutral on a real commerce surface and dropped out of the denominator, inflating the reproduced score.
• Agent Skills v0.2.0 validation corrected. The required entry shape is name/type/description/url/digest, where type must be skill-md or archive and digest must be sha256:<64 hex> : not the Subresource-Integrity sha256-<base64> form. The $schema URI is an opaque identifier that deliberately does not resolve.
• DNS-AID wildcard control probe. A wildcard in a parent zone answers ANY name, so an answer at _index._agents is not by itself evidence that a site published anything. Measured: every *.netlify.app name returns 1 . alpn=h2 for HTTPS at that label : including deliberately nonexistent ones : because it is Netlify’s generic HTTP/2 service binding. isitagentready.com scores that as a PASS, so every netlify.app site collects a free point there. The analyzer now runs a control lookup, discards anything matching it, and says so in the finding.
• Known disagreement, kept on purpose: Web Bot Auth stays neutral. The http-message-signatures-directory is published by the bot operator to advertise its signing keys, not by the site receiving the requests.

v2026.06.22: June 22, 2026

Full-control hosts in the platform override

• Platform override dropdown now lists Cloudflare Pages, Cloudflare Workers, Netlify, and Vercel as selectable static/edge hosts.
• Because these hosts give full file control, root-file probes (ai.txt, llms.txt, AGENTS.md, security.txt, humans.txt) stay real findings rather than softening to informational.
• Contrasts with locked builder platforms (Wix, Squarespace tenants, Linktree, etc.) where the same probes correctly downgrade to info.

v2026.06.17: June 17, 2026

Hotel/lodging and B2B-SaaS readiness modules

• New hotel / lodging readiness module: Hotel/LodgingBusiness typing, check-in/check-out times, star rating, per-room HotelRoom/Offer, and a local-listing sameAs graph check (Google Hotels/Maps, Apple Maps, Yelp, TripAdvisor, OTAs).
• New B2B SaaS / AI-product readiness module: SoftwareApplication/WebApplication typing, brand entity graph, WebSite node, FAQPage over a visible FAQ, per-route Open Graph, templated-<title> detection, and BreadcrumbList.
• Each module gates on detected vertical and stands down to professional/commerce verticals to avoid double-flagging.

v2026.06.10: June 10, 2026

Per-site platform + vertical override dropdowns

• New Audit alignment bar atop results with two dropdowns to correct the detected business vertical and platform. Changing either re-runs the whole audit: score, checks, and AI fix prompts regenerate.
• Overrides save per site in your browser, so a corrected vertical or stack sticks across re-runs.
• Platform fingerprint coverage expanded to ~60 stacks, adding headless CMSes (Sanity, Contentful), enterprise CMSes (Drupal, Optimizely), and many vertical-SaaS/local-marketing platforms.
• Correcting the platform realigns the root-file softeners and [PLATFORM]/[VENDOR-CONTACT-REQUIRED] fix tagging to the real stack.

v2026.06.09: June 9, 2026

Large false-positive-guard wave (publishers, apps, testimonials)

• Publisher / aggregator / app guard: sites typed NewsMediaOrganization, WebApplication, SoftwareApplication, Dataset, or Periodical (with no business-vertical schema) no longer get keyword-misclassified into YMYL, Local, or E-commerce.
• Editorial pull-quotes and prose-shape voice metrics on publisher/app pages downgrade to informational; only density checks still fail.
• @graph double-walk fixed across JSON-LD walkers: nodes inside one @graph are no longer counted twice (was inflating duplicate-node and date-field counts).
• Self-quote testimonials exempted: a <blockquote> whose <cite> matches a Person/Org named in the page's own JSON-LD no longer counts as a customer review.
• Outbound-marketplace stores (CTAs routing to a third-party marketplace, no on-site checkout) stop tripping agentic-commerce checks; appointment-only businesses can satisfy the hours check with a literal "by appointment" statement.
• ImageObject licensing fields, Product/Offer suggestions, and review checks on publisher/app contexts downgrade to info per current Search Console guidance.

v2026.06.03: June 3, 2026

Craft-butcher / meat-DTC module + ACP feed validator

• New craft-butcher / meat-DTC readiness layer atop e-commerce: hybrid GroceryStore/LocalBusiness typing, perishable cold-chain OfferShippingDetails, Recipe schema, provenance/countryOfOrigin, per-lb UnitPriceSpecification, and substantiation for USDA / grade / "Product of USA" claims.
• New companion tool: ACP feed validator: checks a product feed against the Agentic Commerce spec (required fields, ISO-4217/ISO-3166 enums, conditional seller ToS + privacy on checkout, GTIN check-digit, NDJSON shape).
• Regulated-claim regexes (superlatives, reviews, guarantees, provenance) now match a bounded title-plus-lead region instead of the whole page, so nav/footer/related-product carousels stop misattributing findings.
• Wired Learn/Fix/Audit pills onto the CPA and defense-contractor cards (blocks existed without them).

v2026.06.02: June 2, 2026

Trade-company entity-typing fixes + HVAC module

• Trade-company person-typing fixed: company types like HVACBusiness, GeneralContractor, Plumber, Electrician, and RoofingContractor are no longer nagged to dual-type as Person or carry worksFor: they're companies with a separately-named owner.
• New HVAC / heating-and-cooling readiness module: HVACBusiness typing, EPA 608 / NATE / state-license trifecta, heat-pump growth nudge, permit / CO-safety, brands & maintenance-plan / financing signals.
• Disabled a sitemap sub-check that fired "no usable XML sitemap" on trade home pages; sitemap coverage already lives in the crawl-health checks.
• Breadcrumb check now exempts the site root; first-party relative scripts are no longer flagged as SRI-eligible (SRI is cross-origin only).

v2026.06.01: June 1, 2026

Electrician and men's-health readiness modules

• New electrician / electrical-contractor readiness module: Electrician subtype, the http://www.schema.org @context defect, visible state-license-number display, per-service Service, EV-charger growth nudge, and permit/NEC compliance signal.
• New men's-health / hormone-clinic readiness module (YMYL-Health): MedicalClinic typing, per-location identity, and E-E-A-T plus Ryan Haight / FDA / FTC / HIPAA compliance signals.
• Both gate on detected vertical and stand down cleanly to adjacent local/professional verticals.

v2026.05.31: May 31, 2026

E-commerce, handyman, and brand-presence modules

• New e-commerce / DTC readiness module: Product/Offer completeness (condition, priceValidUntil, GTIN/MPN/SKU, shipping, return policy, countryOfOrigin when "Made in X" appears), brand Organization @id + founder, review-as-data (FTC 16 CFR 465), CollectionPage/ItemList, and deceptive-pricing guards.
• New handyman / home-services readiness module: LocalBusiness/HomeAndConstructionBusiness + NAP, per-trade Service, Google Business Profile probe, placeholder-555 phone trap, client-rendered-SPA invisibility trap, and a state-licensed-trade guardrail.
• New brand presence / entity alignment check: sameAs breadth across Instagram, Pinterest, TikTok, Facebook, YouTube, LinkedIn, and Google Business Profile.

v2026.05.30: May 30, 2026

Production-homebuilder module + BigLaw layer

• New production-homebuilder readiness module: firm HomeAndConstructionBusiness, per-community Place/areaServed/geo, SingleFamilyResidence + Offer (price/availability) on floor plans, plus Fair Housing 3604(c), RESPA Section 8, and TILA/Reg Z 1026.24 compliance checks.
• New BigLaw / multinational-firm layer extending the legal module: ranking-directory sameAs (Chambers, Legal 500, Best Lawyers), corpus-scale Article + author binding, Event/VideoObject/PodcastEpisode on relevant paths, and hreflang-vs-office-footprint checks.
• The BigLaw layer activates only for large/multinational firms; small-firm legal audits are unaffected.

v2026.05.21: May 21, 2026

Brand-copy quality and page-meta hygiene checks

• New brand-copy checks: font-glyph-collision typos (e.g. capital-I vs lowercase-L), dev placeholders left in production (lorem ipsum, TBD, "coming soon"), joined-word headlines, and all-caps headings that should be CSS-uppercased.
• New page-meta checks: over-long meta descriptions (Google rewrites past ~170 chars), missing og:image, and twitter:card downgrade detection.
• New nonprofit checks (501(c)(3) sites): visible EIN and a stated 501(c)(3) status line for donor and grant-officer diligence.
• New operational-hygiene checks: thank-you / confirmation funnel pages indexed without noindex, and thin pages missing noindex.

v2026.05.20: May 20, 2026

Platform fingerprinting, bot-challenge detection, and sitemap-debris checks

• New bot-challenge detector: flags when the audited page is actually a Vercel / Cloudflare / AWS WAF / Imperva / Akamai challenge wall: the same wall AI crawlers hit: instead of reporting every signal as missing.
• robots.txt platform fingerprint fallback catches managed platforms even when no CDN URL is visible in the HTML, so root-file advice gates correctly.
• New sitemap-debris checks: indexed placeholder slugs (hello-world, sample-page, templated blog titles), republished-draft random-suffix URLs, and duplicate home-page aliases (/home, /home-2) competing with /.
• New photographer-vertical image-rights check: recommends ImageObject/Photograph schema when none is present.

v2026.05.17: May 17, 2026

Cross-page reference "missing name" detector

• New detector for JSON-LD cross-page @id references that carry @type but no name: the next Search Console error after the "Invalid object type" fix.
• Covers mainEntity, about, author, publisher, isPartOf, and mainEntityOfPage reference fields; same-page refs stay bare and pass.
• Fix copy instructs adding name alongside @id + @type on each cross-page reference.

v2026.05.16: May 16, 2026

Search Console "invalid object type" and "invalid datetime" detectors

• New detector for bare {"@id":"..."} reference objects with no inline @type and no on-page definition: the trigger for Search Console's "Invalid object type" rich-result error that public validators pass silently.
• New detector for date-only dateCreated/dateModified/datePublished values (YYYY-MM-DD), the "Invalid datetime value" trigger; fix copy shows full ISO 8601 with timezone offset.
• Both become top-priority entity-binding penalties with explicit GSC TYPE / GSC DATE labels.

v2026.05.13: May 13, 2026

Knowledge-Graph entity-anchor reconciliation

• New entity-anchors section: scores binding to Google's Knowledge Graph via sameAs kgmid, Google Maps cid, Google Business Profile, LinkedIn, and Wikidata: distinct from just adding more schema.
• Checks Person/Org dual-typing on vertical nodes, shared-@id consolidation, worksFor/parentOrganization employer relations, and flags circular self-referential sameAs.
• New mainEntityOfPage object-form check enforces a closed bidirectional Person ↔ ProfilePage loop, plus a guard for HTML-encoded & in sameAs URLs (a templating autoescape bug).

v2026.05.12: May 12, 2026

Vertical classification overhaul + self-host and mobile checks

• Vertical classifier rebuilt around ~120 schema.org LocalBusiness subtypes plus dozens of keyword verticals (restaurant, trades, fitness, beauty, auto, nonprofit, industrial, religious, education, senior-care, and more) so businesses without explicit schema still classify correctly.
• YMYL gating tightened: Legal/Finance/Health now require the regulated schema or ≥5 keyword hits, so editorial blog mentions no longer mislabel a site as YMYL.
• Trust, voice-density, and editorial-only checks (dateModified, RSS, llms-full, etc.) downgrade to informational on local-service and publisher contexts that shouldn't be held to them.
• New self-host opportunity check (third-party CDN fonts/scripts that could move on-site) and a mobile auto-scaling check (zoom-blocking viewport, fixed widths, unwrapped wide tables) with drop-in CSS.
• Sitemap discovery now falls back through Yoast / WP-core / index variants and parses Sitemap: directives from robots.txt; apex↔www are treated as the same site.

v2026.05: May 11, 2026

• Added SoftwareApplication, HowTo, and FAQPage JSON-LD to the tool page itself. Author byline and visible last-updated stamp moved into the page hero. (Eat-your-own-dog-food for the E-E-A-T bucket.)
• Published this /methodology/ page and changelog. Linked from the tool hero.
• Bucket count documented as 10 in /.well-known/agent-skills/index.json, /.well-known/agent-card, and /llms-full.txt (previously documented as 6).

v2026.05.10: May 10, 2026

Nine SHIP-NOW signal additions from the Cloudflare Agents v2 research pass:

• AGENTS.md probe at /AGENTS.md (per agents.md).
• /.well-known/mcp.json (Cloudflare path), probed in parallel with the SEP-2127 /.well-known/mcp/server-card.json. Dual-publish gap is flagged when only one of the two is present.
• x402 v2 advertisement via Link: rel="payment-required" response header or Accept-Payment: x402. Gated to commerce / dev surfaces.
• OAuth Resource Server Link: rel="oauth-protected-resource" header on 401 responses. Gated on presence of an OAuth Protected Resource metadata file.
• Vary: Accept on the markdown response: confirms server actually negotiates text/markdown.
• Per-page .md companion + /index.md root marker. Warn on /blog, /posts, /articles, /docs, /news.
• /llms-ctx.txt + /llms-ctx-full.txt (FastHTML llmstxt.org extension).
• JSON Feed v1.1 enrichment fields in /feed.json: language, authors[], feed_url.
• schema:CreativeWork.usageInfo URL: Schema.org canonical AI-rights pointer.

v2026.04.17: Cloudflare Agent Readiness baseline

Initial 13-probe Cloudflare Agent Readiness coverage:

• Content-Signal directive in robots.txt.
• Link response headers (RFC 8288).
• API Catalog at /.well-known/api-catalog (RFC 9727).
• MCP Server Card at /.well-known/mcp/server-card.json (SEP-2127). Gated on _isAgentTarget.
• Agent Skills at /.well-known/agent-skills/index.json (v0.2.0).
• Web Bot Auth signature directory (informational; never penalized).
• OAuth metadata + OAuth Protected Resource. Gated on _isAgentTarget.
• WebMCP imperative API. Gated on _hasAgentCta.
• ACP discovery + MPP openapi.json. Gated on _isCommerceSurface.

v2026.04: Foundation

• SEO, Schema, E-E-A-T, Voice, Mobile parity, Performance, A11y, Indexing hygiene, Retrieval (AEO) buckets shipped.
• Mega AI fix prompt output bucket.
• Mark It N/A feature: excludes a check from both the score and the AI prompt.
• Export / Import scan JSON: save the full scan, re-run the prompt without re-fetching, diff against past scans.
• JSON-LD walker fix: recurses into all object values (not only @graph) so Review and AggregateRating nested inside Product.review / OfferCatalog are detected.
• Physical-goods gate: shippingDetails / hasMerchantReturnPolicy only flagged on Products with gtin/mpn/isbn/productID/itemCondition, or when the root schema is not Service / LocalBusiness / SelfStorage / OfferCatalog family.