How WebAgentScan scores a site

Whether robots.txt (RFC 9309 matching, Googlebot group or *) disallows the homepage or most of the pages it links to, and whether robots.txt answers with a server error.

Source: Google Search Central: How Google interprets robots.txt

noindex in <meta name="robots|googlebot"> or the X-Robots-Tag header on the homepage and sampled pages.

Source: Google Search Central: Robots meta tag and X-Robots-Tag

Pages carrying noindex that robots.txt also disallows, so Google can never read the noindex.

Source: Google Search Central: Block indexing with noindex

The homepage <link rel="canonical"> (or Link header): present, absolute, single and self-referencing; canonical coverage on sampled pages.

Source: Google Search Central: Consolidate duplicate URLs

When the canonical points elsewhere, the target is fetched: it must answer 200 without redirecting and without noindex.

Source: Google Search Central: Consolidate duplicate URLs

The first sitemap from robots.txt (or /sitemap.xml): fetched, valid sitemap XML, one sitemap-index level followed.

Source: Google Search Central: Build and submit a sitemap

Whether robots.txt carries a Sitemap: line, the discovery route every crawler supports.

Source: sitemaps.org protocol

URL count and uncompressed size of the sitemap file read.

Source: sitemaps.org protocol

HTTP status of sampled sitemap URLs. Sitemaps should list final, live URLs only.

Source: Google Search Central: Build and submit a sitemap

Whether <lastmod> is present and varies by URL (identical dates on every URL mean it is generated, not maintained).

Source: Google Search Central blog: Sitemaps lastmod

Length of the homepage <title> in characters.

Source: Zyppy title-length study

Generic titles ("Home", the bare domain) and titles duplicated across the homepage and sampled pages.

Source: Google Search Central: Title links

Presence and length of the homepage meta description; duplicates across sampled pages.

Source: Google Search Central: Meta descriptions and snippets

Words of visible server-rendered text on the homepage and sampled pages.

Source: Google Search Central: Creating helpful, people-first content

Number of <h1> elements on the homepage; sampled pages without one.

Source: HTTP Archive Web Almanac: SEO chapter

Whether headings start at H1 and never skip a level (H2 to H4).

Source: HTTP Archive Web Almanac: SEO chapter

Share of <img> elements with an alt attribute (alt="" counts as a deliberate decorative image) on the homepage and sampled pages.

Source: Google Search Central: Image SEO best practices

Redirect hops between the URL you entered and the page that answered.

Source: Google Search Central: Redirects and Google Search

A request for a random, non-existent path: it should answer 404 or 410, not 200 or a redirect to the homepage (a soft 404).

Source: Google Search Central: HTTP status codes, network and DNS errors

hreflang codes, self-reference, and for up to three alternates: status 200 and a return link back (reciprocity).

Source: Google Search Central: Localized versions of your pages

Required properties for Organization, LocalBusiness, Product/Offer, Article, BreadcrumbList, FAQPage, SoftwareApplication, Review and AggregateRating nodes on the homepage and sampled pages.

Source: Google Search Central: Structured data general guidelines

http:// subresources on https pages: scripts, styles, iframes and form actions (active) and images or media (passive).

Source: MDN: Mixed content

title, meta and canonical/alternate links that a parser finds outside <head> (Google stops reading the head at the first invalid element), and duplicated title, description or canonical.

Source: Google Search Central: Use valid page metadata

Unique crawlable same-site <a href> links on the homepage.

Source: Google Search Central: Crawlable links

og:title, og:description, og:image and twitter:card on the homepage.

Source: The Open Graph protocol

A <link rel="icon"> (or apple-touch-icon) on the homepage.

Source: Google Search Central: Favicon in Search results

The <html lang> attribute and whether it is a valid BCP 47 tag.

Source: MDN: the lang global attribute

Whether /llms.txt is served at that exact path as text, is not a soft-404 HTML page, and indexes the site as Markdown links.

Source: llmstxt.org specification

Whether /agents.txt is served as a distinct, non-empty file stating how agents may use the site.

Source: IETF draft: agents.txt well-known

Which of ai-plugin.json, mcp.json, oauth-protected-resource, ai-catalog.json and agent.json answer under /.well-known/ with real content.

Source: RFC 8615: Well-Known URIs

Whether /sitemap.xml returns a sitemap with URL entries.

Source: sitemaps.org protocol

Whether an Agent2Agent card is published at one of the three common /.well-known paths and names the agent and its skills.

Source: A2A protocol (a2aproject)

Whether the homepage answers Accept: text/markdown with Markdown, and says so with Vary: Accept.

Source: MDN: Content negotiation

The JSON-LD types on the homepage and whether one of them identifies the site owner (Organization, Person, LocalBusiness, WebSite).

Source: Google Search Central: structured data

Visible words in the server-rendered HTML, before any script runs.

Source: Google: JavaScript SEO basics

Presence and length of the <title> and meta description.

Source: Google: influencing title links

Whether /robots.txt exists as a real text file and names any AI crawler explicitly.

Source: RFC 9309: Robots Exclusion Protocol

Whether answer-time crawlers (OAI-SearchBot, ChatGPT-User, PerplexityBot, Claude-User, Claude-SearchBot) are blocked at the site root, by name or by the * group.

Source: OpenAI: overview of OpenAI crawlers

Whether the agent discovery files that exist send Access-Control-Allow-Origin, so in-browser agents can read them.

Source: MDN: Cross-Origin Resource Sharing

Whether the homepage answers a non-browser user agent the way it answers a browser, instead of a block or challenge page.

Source: Google spam policies: cloaking

RFC 9309 evaluation of robots.txt for OAI-SearchBot, Claude-SearchBot and PerplexityBot on the homepage and the pages it links to, including blocks inherited from the User-agent: * group.

Source: RFC 9309: Robots Exclusion Protocol

How robots.txt treats 27 AI and search user agents, grouped into search engines, AI search, user-triggered fetchers, training crawlers and training-control tokens. Reported, not graded: blocking training is a legitimate choice.

Source: Google Search Central: How Google interprets robots.txt

The homepage fetched with OAI-SearchBot's published User-Agent, compared with a browser fetch: HTTP status, bot-challenge or interstitial pages, and whether the page served is much thinner than the browser version. UA-based: a CDN verifying real bots by IP may treat the real crawler differently.

Source: OpenAI: Overview of OpenAI crawlers

The homepage fetched with ChatGPT-User's published User-Agent, compared with a browser fetch: HTTP status, bot-challenge or interstitial pages, and whether the page served is much thinner than the browser version. UA-based: a CDN verifying real bots by IP may treat the real crawler differently.

Source: OpenAI: Overview of OpenAI crawlers

The homepage fetched with Claude-User's published User-Agent, compared with a browser fetch: HTTP status, bot-challenge or interstitial pages, and whether the page served is much thinner than the browser version. UA-based: a CDN verifying real bots by IP may treat the real crawler differently.

Source: Anthropic: Does Anthropic crawl data from the web?

The homepage fetched with PerplexityBot's published User-Agent, compared with a browser fetch: HTTP status, bot-challenge or interstitial pages, and whether the page served is much thinner than the browser version. UA-based: a CDN verifying real bots by IP may treat the real crawler differently.

Source: Perplexity: Perplexity crawlers

The homepage fetched with Googlebot's published User-Agent, compared with a browser fetch: HTTP status, bot-challenge or interstitial pages, and whether the page served is much thinner than the browser version. UA-based: a CDN verifying real bots by IP may treat the real crawler differently.

Source: Google: Overview of Google crawlers and fetchers

Whether the server HTML of the homepage carries readable text, or is an empty client-rendered app shell. Most AI crawlers do not run JavaScript.

Source: Vercel: The rise of the AI crawler

Every <script type="application/ld+json"> block on the homepage decodes as JSON.

Source: W3C JSON-LD 1.1

Share of sampled internal links and sitemap URLs that answer 4xx/5xx or not at all.

Source: Google Search Central: HTTP status codes, network and DNS errors

Share of sampled internal links that redirect instead of pointing at the final URL.

Source: Google Search Central: Redirects and Google Search

/llms.txt served as text and checked against the llmstxt.org grammar: one H1 first, > summary, ## link sections, absolute well-formed links, no placeholders.

Source: llmstxt.org: The /llms.txt file

/llms-full.txt (the full-text companion to llms.txt) answers 200 as text.

Source: llmstxt.org: The /llms.txt file

Age of the newest <lastmod> in the sitemap: a signal of whether content is maintained.

Source: Google Search Central blog: Sitemaps lastmod

A random missing path answers status 404 (so agents can tell missing from present) with a page that links back into the site.

Source: Google Search Central: HTTP status codes, network and DNS errors

Content-Signal lines (search, ai-input, ai-train) and RSL License directives in robots.txt, and RSL <link rel="license"> on the homepage. Reported, not graded.

Source: Content Signals Policy

Organization sameAs links to Wikidata/Wikipedia, else a Wikidata wbsearchentities lookup of the brand name. A signal, not an obligation: not found is grey.

Source: Wikidata API: wbsearchentities

Whether one of the first paragraphs of the homepage is a self-contained 40-60 word answer, the length answer engines and featured snippets most often quote.

Source: Google Search Central: AI features and your website

Article pages in the sample carry an author (JSON-LD author or Person, meta author, rel/itemprop author, byline markup); without article pages, the homepage names an Organization or Person.

Source: Google Search Central: Article author markup best practices

Whether an MCP server answers initialize over Streamable HTTP or SSE, found via /.well-known/mcp.json, /mcp, /api/mcp or the endpoint you give.

Source: MCP specification: lifecycle

Whether tools/list returns at least one tool.

Source: MCP spec: Tools

Share of tools with a description long enough to tell a model when to call them.

Source: MCP spec: Tools

Share of tool input parameters that carry a description.

Source: MCP spec: Tools

Share of tools that declare an outputSchema, so results can be validated.

Source: MCP spec: Tools

Share of tools that declare readOnlyHint / destructiveHint / idempotentHint annotations.

Source: MCP spec: Tools

Whether tool names follow one consistent convention and avoid vague names such as run or do.

Source: MCP spec: Tools

Whether the site shows commerce signals (Product or Offer markup, cart or checkout paths). The pillar is skipped when it does not.

Source: schema.org: Product

Whether products are described with schema.org Product and Offer in JSON-LD.

Source: Google: merchant listing structured data

Whether offers carry price, priceCurrency and availability.

Source: schema.org: Offer

Whether a product feed or catalogue endpoint is discoverable.

Source: Google Merchant Center: product data specification

Whether the site publishes agentic-commerce or payments descriptors an agent can use to check out. The specifications are young, so this carries few points.

Source: Agentic Commerce Protocol

Composite 0-100: AI search crawlers allowed in robots.txt (40), the homepage served to assistant User-Agents without a challenge (40), content present in the server HTML (20). Reported, not graded.

Source: OpenAI: Overview of OpenAI crawlers

Composite 0-100 from landmarks, a single H1, page language, JSON-LD, image alt coverage and named links. Reported, not graded.

Source: W3C WAI-ARIA APG: Landmark regions

Composite 0-100 from labelled form controls, named buttons, absence of blocking overlays, and WebMCP/NLWeb bonuses. Reported, not graded.

Source: WCAG 2.2 Understanding 4.1.2 Name, Role, Value

<main>, <nav>, <header>, <footer> (or the matching ARIA roles) that let an agent find the main content and navigation.

Source: W3C WAI-ARIA APG: Landmark regions

Share of visible inputs, selects and textareas with an accessible name (label, aria-label, aria-labelledby or title; placeholder alone counts half).

Source: W3C WAI: Labeling controls

Share of buttons (<button>, role=button, input type=submit/button) with an accessible name an agent can target.

Source: WCAG 2.2 Understanding 4.1.2 Name, Role, Value

Share of <a href> links with text, aria-label or an image with alt.

Source: WCAG 2.2 Understanding 2.4.4 Link Purpose

Modal dialogs open in the initial HTML (open <dialog>, aria-modal, cookie walls) and whether they offer a named close/accept/reject control.

Source: W3C WAI-ARIA APG: Dialog (modal) pattern

navigator.modelContext tool registration in inline scripts, or declarative WebMCP tool attributes on forms. A bonus: absent is informational.

Source: W3C WebML CG: WebMCP explainer

Whether /ask answers a natural-language query with JSON (the NLWeb protocol). A bonus: absent is informational.

Source: NLWeb project

Ahrefs Domain Rating and SE Ranking Domain InLink Rank, each under its own name, scored on the higher.

Source: Ahrefs: Domain Rating

Number of distinct domains linking to the site, from the same licensed providers.

Source: Ahrefs: Domain Rating

Referring domains and backlinks from the licensed vendor index.

Source: SE Ranking Backlinks API

Change in referring domains over the last 90 days (Ahrefs history, else SE Ranking new/lost).

Source: Ahrefs API v3: Site Explorer

Referring domains gained and lost in the last 30 days.

Source: SE Ranking Backlinks API

Backlinks that point at URLs on the site returning 4xx/5xx (Ahrefs broken-backlinks).

Source: Ahrefs API v3: Site Explorer

Share of referring domains by anchor type: brand, URL, generic and keyword. Flags over-optimised exact-match anchors.

Source: Google: spam policies (link spam)

Heuristics over the referring domains: very low authority (rank under 10), spam-prone TLDs, sitewide links (100+ per domain).

Source: Google: spam policies (link spam)

Share of referring domains that send at least one followed link.

Source: SE Ranking Backlinks API

The strongest domains linking to the site, by vendor domain rank.

Source: SE Ranking Backlinks API

Domains that link to up to three named competitors but not to this site.

Source: Ahrefs API v3: Site Explorer

Whether the site is served over HTTPS with a Strict-Transport-Security max-age.

Source: MDN: Strict-Transport-Security

Presence of Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, X-Frame-Options and Permissions-Policy on the homepage.

Source: OWASP Secure Headers Project

Whether well-known secret files (.env, .git/config, config backups, phpinfo) are readable. Detail is shown only to a verified owner.

Source: OWASP WSTG: configuration and deployment testing

Behind Cloudflare, whether common diagnostic paths (phpinfo, server-status, status pages) print a public IP address that would let an attacker bypass the CDN. Detail is shown only to a verified owner.

Source: Cloudflare: protect your origin server

When the MCP server requires auth, whether RFC 9728 protected-resource metadata tells a client where to authenticate.

Source: RFC 9728: OAuth 2.0 Protected Resource Metadata

Whether an MCP server that exposes mutating tools accepts unauthenticated calls. Detail is shown only to a verified owner.

Source: MCP specification: authorization

Whether tools whose names suggest they change or delete data declare destructiveHint.

Source: MCP spec: Tools

Whether tool names and descriptions contain text that tries to instruct the model (tool poisoning).

Source: OWASP GenAI: LLM01 prompt injection

Where the first hop of http://host/ goes, without following it.

Source: hstspreload.org: submission requirements

The Strict-Transport-Security header on the HTTPS homepage and its max-age.

Source: MDN: Strict-Transport-Security

Whether the HSTS header and redirect meet the browser preload list rules.

Source: hstspreload.org

Whether a CSP is sent as an enforced header (not only report-only or a meta tag).

Source: Mozilla HTTP Observatory: tests and scoring

The effective script-src (or default-src): 'unsafe-inline' without nonces/hashes, 'unsafe-eval', and blanket sources (*, https:, data:).

Source: Mozilla HTTP Observatory: tests and scoring

Whether object-src is 'none' and base-uri is restricted.

Source: OWASP CSP Cheat Sheet

CSP frame-ancestors in the header, or X-Frame-Options DENY/SAMEORIGIN.

Source: OWASP Clickjacking Defense Cheat Sheet

Whether Permissions-Policy switches off powerful features the site does not use.

Source: MDN: Permissions-Policy

The Referrer-Policy header (or meta referrer) value.

Source: Mozilla HTTP Observatory: tests and scoring

X-Content-Type-Options on the homepage.

Source: Mozilla HTTP Observatory: tests and scoring

Server, X-Powered-By, X-AspNet-Version and similar headers that name software and versions.

Source: OWASP WSTG-INFO-02: Fingerprint Web Server

Secure, HttpOnly (for session-like cookies), SameSite and prefix rules on cookies set by the homepage.

Source: MDN: Set-Cookie

Whether versioned third-party scripts carry integrity hashes; unversioned vendor loaders are reported as advisory.

Source: MDN: Subresource Integrity

/.well-known/security.txt and its Contact and Expires fields.

Source: RFC 9116: security.txt

Access-Control-Allow-Origin on the homepage when an unknown Origin is sent, and whether credentials are allowed.

Source: OWASP WSTG-CLNT-07: Testing Cross Origin Resource Sharing

Whether /.git/HEAD or /.env.local serve their real content (the core pillar covers /.env and /.git/config). Detail only for a verified owner.

Source: OWASP WSTG-CONF-04: Old Backup and Unreferenced Files

Whether wp-config.php.bak or backup.sql serve real content (the core pillar covers config.php.bak). Detail only for a verified owner.

Source: OWASP WSTG-CONF-04: Old Backup and Unreferenced Files

Whether Apache server-status or the Spring Boot actuator answer with their real content (the core pillar covers phpinfo). Detail only for a verified owner.

Source: OWASP WSTG-CONF-05: Enumerate Admin Interfaces

Whether the first same-origin JavaScript bundle has a readable .map file.

Source: OWASP WSTG-INFO-05: Review Web Page Content for Information Leakage

The protocol a modern client negotiates with the site.

Source: Mozilla Server Side TLS guidelines

Whether a handshake offering only TLS 1.0 and 1.1 completes.

Source: RFC 8996: Deprecating TLS 1.0 and TLS 1.1

Whether the certificate verifies, matches the host, is not self-signed, and how many days it has left.

Source: MDN: Transport Layer Security

MX records for the registrable domain (reported, not graded).

Source: RFC 7505: A "Null MX" No Service Resource Record

Exactly one v=spf1 TXT record and the qualifier of its all mechanism.

Source: RFC 7208: Sender Policy Framework

DNS lookups the SPF record needs, with include: and redirect= expanded recursively (capped).

Source: RFC 7208 section 4.6.4: DNS lookup limits

The _dmarc TXT record: present, single, and its p= and pct= values.

Source: RFC 7489: DMARC

Whether the DMARC record asks for aggregate reports (rua).

Source: RFC 7489 section 7: DMARC feedback

A DKIM public key at the selectors most likely for the mail provider. Grey when none is found, because selectors cannot be listed.

Source: RFC 6376: DKIM Signatures

CAA records at the host or its registrable domain, and whether they permit the CA that issued the current certificate.

Source: RFC 8659: DNS Certification Authority Authorization

Whether a validating resolver sets the AD flag for the domain, or DNSKEY exists without a valid chain.

Source: ICANN: DNSSEC, what is it and why is it important

Whether the host or its apex/www sibling is a CNAME to a target that no longer resolves, or to a claimable provider without an address. Detail only for a verified owner.

Source: OWASP WSTG-CONF-10: Test for Subdomain Takeover

Whether default._bimi publishes a brand logo record (reported, not graded).

Source: BIMI Group: implementation guide

Tool names, descriptions and schemas for invisible Unicode (tag, zero-width, bidi), base64 text, hidden tags, exfiltration phrasing and cross-tool shadowing.

Source: OWASP GenAI: LLM01 prompt injection

Whether tools named delete/remove/drop/revoke/cancel/refund... set destructiveHint: true and never claim readOnlyHint: true.

Source: MCP specification: Tools (security considerations)

Protected-resource metadata: resource matching the endpoint, https authorization_servers, bearer methods, JSON content type, and a WWW-Authenticate resource_metadata pointer.

Source: RFC 9728: OAuth 2.0 Protected Resource Metadata

A CORS preflight from an unknown origin: reflected origin with credentials, or open browser access to anonymous write tools.

Source: MCP specification: Streamable HTTP transport, security warning

RateLimit, RateLimit-Policy, X-RateLimit-* or Retry-After headers on MCP responses.

Source: IETF draft: RateLimit header fields for HTTP

Tool names on the server card (/.well-known/mcp.json or /.well-known/mcp/server-card.json) against tools/list.

Source: MCP specification: Tools (security considerations)

A sha256 per tool over name, description, schemas and annotations, kept so a later scan can flag silent changes (reported, not graded).

Source: Invariant Labs: MCP tool poisoning and rug pulls

A homepage link to a privacy notice, whether it loads, and how many words of readable text it has.

Source: GDPR Art. 12: transparent information

A homepage link to terms of service, conditions or a legal notice/Impressum.

Source: EU Directive 2000/31/EC (e-Commerce) Art. 5: general information

Whether the notice or homepage names who is responsible for the data and gives an email or postal address.

Source: GDPR Art. 13: information to be provided

Keyword detection of nine Art. 13 topics in the notice: controller, purposes, legal basis, recipients, retention, rights, withdrawing consent, complaints, transfers.

Source: GDPR Art. 13: information to be provided

When US-based tags load, whether the notice names a transfer mechanism (SCCs, EU-US Data Privacy Framework, adequacy).

Source: GDPR Art. 44-46: transfers to third countries

When a homepage form asks for age or date of birth, whether the notice addresses children's data.

Source: GDPR Art. 8: conditions for a child's consent

Whether the notice gives a route (email, form, DPO) for rights requests and a response time.

Source: GDPR Art. 12(3): one month to respond

A homepage link to an accessibility statement.

Source: Directive (EU) 2019/882 (European Accessibility Act)

Fingerprints of 20 consent managers (OneTrust, Cookiebot, SecurePrivacy, Termly, Iubenda, CookieYes, Osano, Didomi, Usercentrics, Klaro, Complianz and more), graded when tracking tags load.

Source: EDPB Guidelines 05/2020 on consent

Meta Pixel, GA4/gtag, Google Ads, GTM, TikTok, LinkedIn Insight, Hotjar and Clarity tags in the raw HTML, and whether each is gated (CMP blocking attributes or Consent Mode default-denied). Zaraz-managed tags are invisible and reported grey.

Source: CJEU C-673/17 Planet49

A persistent control to re-open consent: a "cookie settings" link or a known CMP re-open hook.

Source: GDPR Art. 7(3): withdrawal as easy as giving consent

When advertising tags load, a "Do Not Sell or Share" or "Your Privacy Choices" link or control.

Source: California Civil Code 1798.135 (CCPA/CPRA)

When advertising tags load, whether /.well-known/gpc.json declares gpc: true.

Source: Global Privacy Control specification

Whether the banner offers Reject all with equal prominence. Grey (needs a browser) unless the CMP config is readable in the page.

Source: EDPB Cookie Banner Taskforce report (2023)

How long consent is stored, from a readable CMP config or the consent cookie. Grey when neither is readable.

Source: CNIL: cookies and other trackers guidelines

The lang attribute on <html>.

Source: WCAG 2.2 SC 3.1.1 Language of Page

Images without an alt attribute (alt="" for decoration counts as present).

Source: WCAG 2.2 SC 1.1.1 Non-text Content

Form fields without a label, aria-label, aria-labelledby or title.

Source: WCAG 2.2 SC 4.1.2 Name, Role, Value

Whether there is an h1 and heading levels do not skip going down.

Source: WCAG 2.2 SC 1.3.1 Info and Relationships

Links with no text, aria-label, title or image alt.

Source: WCAG 2.2 SC 2.4.4 Link Purpose (In Context)

Contrast of colour pairs set in inline styles, with alpha composited over the nearest opaque inline background. Grey when colours come only from stylesheets.

Source: WCAG 2.2 SC 1.4.3 Contrast (Minimum)

HTTP status of sampled internal links (from the homepage) and sitemap URLs.

Source: Google Search Central: HTTP status codes, network and DNS errors

Redirect chains of the homepage and sampled URLs: a URL repeating in the chain, or more hops than the client follows (5).

Source: Google Search Central: Redirects and Google Search

Sampled URLs reached through two or more redirects.

Source: Google Search Central: Redirects and Google Search

HTTP status of up to four critical subresources referenced by the homepage (stylesheets, scripts, preloaded or @font-face fonts).

Source: Google Search Central: HTTP status codes, network and DNS errors

For a font served from another origin, whether it answers with Access-Control-Allow-Origin (browsers refuse cross-origin fonts without it).

Source: MDN: Cross-Origin Resource Sharing (fonts need CORS)

Content-Type of fetched stylesheets and scripts, and X-Content-Type-Options: nosniff on the homepage. With nosniff, a wrong type stops the file loading.

Source: MDN: X-Content-Type-Options

Homepage forms have a submit control (or a single field for implicit submission) and a real action rather than javascript: or #.

Source: MDN: Sending form data

Inputs named or labelled for email use type="email", which gives validation, the right mobile keyboard and autofill.

Source: MDN: <input type="email">

Sitemap URLs disallowed by robots.txt, sampled sitemap pages that are noindex or canonicalise elsewhere, and a canonical target that is noindex.

Source: Google Search Central: Build and submit a sitemap

Internal links on the homepage carrying session IDs, tracking parameters or many sort/filter combinations not disallowed in robots.txt.

Source: Google Search Central: Managing crawling of faceted navigation URLs

Median total response time of the homepage and sampled pages as measured by the scanner (includes redirects and transfer).

Source: web.dev: Time to First Byte

Protocol negotiated for the homepage, and HTTP/3 advertised via Alt-Svc.

Source: HTTP Archive Web Almanac: HTTP chapter

Whether the Chrome UX Report publishes phone field data for the page or the origin (28-day window).

Source: Chrome UX Report API

75th-percentile LCP for phone visitors, from the Chrome UX Report (page, else origin).

Source: web.dev: Largest Contentful Paint

75th-percentile INP for phone visitors, from the Chrome UX Report.

Source: web.dev: Interaction to Next Paint

75th-percentile CLS for phone visitors, from the Chrome UX Report.

Source: web.dev: Cumulative Layout Shift

75th-percentile FCP for phone visitors, from the Chrome UX Report.

Source: web.dev: First Contentful Paint

75th-percentile TTFB for phone visitors, from the Chrome UX Report.

Source: web.dev: Time to First Byte

The Lighthouse performance category score from PageSpeed Insights, mobile strategy.

Source: Lighthouse performance scoring

Lab LCP and its breakdown into time to first byte, load delay, load duration and render delay.

Source: web.dev: Optimize LCP

Whether the image Lighthouse picked as the LCP element carries loading="lazy".

Source: web.dev: Lazy loading and LCP

Lighthouse image-delivery audit: AVIF/WebP, compression and sizing.

Source: Lighthouse: serve images in modern formats

Lighthouse unused-javascript audit: bytes downloaded but never executed during load.

Source: Lighthouse: reduce unused JavaScript

Whether HTML, CSS and JavaScript are served with gzip or Brotli (Lighthouse).

Source: Lighthouse: enable text compression

Cache lifetimes on static resources (Lighthouse cache audit).

Source: Lighthouse: efficient cache policy

Total main-thread time (script, style, layout, paint) during a mobile load.

Source: Lighthouse: minimize main-thread work

Main-thread time and bytes from third-party providers (analytics, chat, ads, embeds).

Source: Lighthouse: reduce the impact of third-party code

A viewport meta tag with width=device-width, so phones do not render a shrunken desktop page.

Source: Lighthouse: viewport

Touch target size and spacing on mobile (Lighthouse target-size / tap-targets audit).

Source: web.dev: Accessible tap targets

Share of text at a legible size on a phone (Lighthouse font-size audit, where the Lighthouse version still reports it).

Source: Lighthouse: legible font sizes