Scoring methodology

Everything on this page is derived from the engine’s single source of truth, src/lib/checks.ts in the public repo. The site’s public numbers (homepage, /llms.txt) are rendered from the same constants, so the docs, the product, and the engine can’t drift apart.

The 7 groups

Group	Weight	What it answers	Checks
AI Discovery	30	Can AI systems find and understand the site?	12
Agent Protocols	10	Can agents act on the site, not just read it?	6
DNS & Identity	10	Is the domain reachable, valid, and trustworthy?	8
Security	15	Are responses hardened against common attacks?	9
Performance	10	Does it load fast on real mobile connections?	9
SEO & Content	15	Can search engines index it — and is the content real?	8
Accessibility	10	Can everyone use it, including assistive tech?	7

Group weights total exactly 100, enforced by validateWeights() in the engine.

Scoring rules

Pass = full points, warn = half points, fail = zero.
Skipped checks (e.g. PageSpeed unreachable) are excluded from scoring — never counted against you.
Three checks are critical: llms.txt exists, sitemap-llms.xml exists, and HTTPS serves a valid certificate. Failing a critical check zeroes a high-weight check, so fixing them lifts the score fastest. There is no artificial score cap — the number you see is the true score.
Every check ships with a one-line fix — the report pairs each failure with its remediation.

All 59 checks

AI Discovery — 30 points (12 checks)

Can AI systems find and understand the site?

llms.txt exists — 5 pts
llms.txt has allow/deny rules — 3.5 pts
llms.txt is a reasonable size — 1.5 pts
sitemap-llms.xml exists — 5 pts
robots.txt exists — 2.5 pts
robots.txt doesn’t block AI crawlers — 2.5 pts
sitemap.xml exists — 2.5 pts
sitemap.xml is valid and non-empty — 2 pts
JSON-LD structured data present — 1.5 pts
Meta description present — 1.5 pts
Canonical URL set — 1 pt
Open Graph tags present — 1.5 pts

Agent Protocols — 10 points (6 checks)

Can agents act on the site, not just read it?

MCP endpoint advertised — 3 pts
agents.json / .well-known/agents.json — 2 pts
OpenAPI spec published — 2 pts
Developer / API docs page — 1.5 pts
AI plugin manifest — 1 pt
Contact page reachable — 0.5 pts

DNS & Identity — 10 points (8 checks)

Is the domain reachable, valid, and trustworthy?

A record resolves — 1.5 pts
AAAA record resolves (IPv6) — 1 pt
HTTPS serves a valid certificate — 2.5 pts
Certificate chain verifiable — 1.5 pts
HSTS header set — 1.5 pts
CAA record restricts issuers — 0.5 pts
SPF record published — 0.5 pts
DMARC policy published — 1 pt

Security — 15 points (9 checks)

Are responses hardened against common attacks?

Content-Security-Policy set — 3 pts
Clickjacking protection — 2.5 pts
X-Content-Type-Options: nosniff — 1.5 pts
Referrer-Policy set — 1.5 pts
Permissions-Policy set — 1.5 pts
No server version leak — 1.5 pts
Cookies hardened — 1.5 pts
No mixed content — 1 pt
HTTP redirects to HTTPS — 1 pt

Performance — 10 points (9 checks)

Does it load fast on real mobile connections?

PageSpeed performance ≥ 80 — 1.5 pts
Low external script bloat — 0.5 pts
LCP ≤ 2.5s — 1.5 pts
CLS ≤ 0.1 — 1.5 pts
TBT ≤ 300ms — 1 pt
FCP ≤ 1.8s — 1 pt
Text compression enabled — 1 pt
Mobile viewport configured — 0.5 pts
Resource hints used — 1.5 pts

SEO & Content — 15 points (8 checks)

Can search engines index it — and is the content real?

Title tag well-formed — 2.5 pts
Single H1 heading — 2 pts
Images have alt text — 2.5 pts
Favicon present — 1 pt
No broken internal links — 3 pts
Logical heading order — 1.5 pts
Substantial page content — 1.5 pts
One canonical host (www vs apex) — 1 pt

Accessibility — 10 points (7 checks)

Can everyone use it, including assistive tech?

Page language declared — 1.5 pts
Form fields labeled — 2 pts
Buttons have names — 1.5 pts
Landmark regions present — 1.5 pts
Links have discernible text — 1.5 pts
Skip-to-content link — 1 pt
No duplicate element IDs — 1 pt