ora.ai

Evaluate CSP scope and HSTS duration instead of header presence alone.

About, contact, privacy, and terms pages let visitors verify who operates the product.

Tell agents which jobs the product is appropriate for and where to begin.

DMARC quarantine or reject policies reduce spoofing once mail sources are aligned.

Use one H1 and avoid skipping heading levels so readers and agents can follow the document outline.

Accurate lastmod values help crawlers prioritize changed pages.

Products offering an A2A agent can publish a machine-readable agent card.

Interactive elements need a text or ARIA-derived name.

Semantic landmarks make the page structure understandable without visual layout.

Products with authentication can expose concise public setup and recovery guidance in auth.md.

A published Agent Skills index should be valid JSON and enumerate usable skill artifacts.

The homepage is requested with common crawler and user-fetch agent identifiers.

Declare the preferred public URL so crawlers consolidate duplicate variants.

Meaningful copy should be available without JavaScript execution.

Products with developer interfaces should expose a predictable developer entry point.

Declare the content language with a valid html lang attribute.

Inputs, selects, and textareas should have associated labels.

A missing page should give a reader a recovery path such as home, docs, search, or sitemap.

The public homepage should not accidentally declare noindex.

The public product should finish on an encrypted HTTPS origin.

A useful llms.txt provides a concise product summary and links to canonical resources.

Links declared for agents should resolve to real public content.

Use a title, summary, and described sections so the file works as a navigation index.

Unbalanced code fences can hide the remainder of a Markdown document from parsers.

A server card lets clients understand an MCP server before connecting.

Summarize the product, audience, and value clearly for search and link previews.

Canonical URL, language, Open Graph image, and Open Graph type improve attribution and previews.

HTTPS pages should not reference insecure HTTP assets.

A responsive viewport lets the page render at the correct width on mobile devices.

Prefer native links, buttons, and form controls over clickable generic elements.

The public homepage should not require a challenge or sign-in before its content can be read.

Provide a title, description, type, and image for reliable launch-link previews.

Keep extracted page content within a practical agent context budget.

Use a concise, specific title that identifies the product and page.

Make the next step explicit with clear action language and a valid destination.

Link public documentation from a page visitors and agents already reach.

Use HTTP redirects and avoid meta-refresh or JavaScript-only redirect stubs.

Crawler policies should intentionally distinguish training, search indexing, and user-requested retrieval.

Publish a valid sitemap or sitemap index for canonical public URLs.

A valid SPF policy helps recipients identify authorized senders; excessive DNS lookups can invalidate it.

sameAs links help disambiguate the brand across authoritative profiles.

Use relevant JSON-LD types with enough identity fields to resolve the organization or product.

Public pages should expose substantive content without a login or challenge wall.

Missing pages should return 404 or 410 instead of a successful app shell.

Emerging catalogs can advertise APIs, agents, skills, and MCP surfaces from a well-known location.

A contact address on the product domain can strengthen operator identity and support trust.

Advertise a Markdown representation through content negotiation or an alternate link.

Canonical pages can optionally serve Markdown when requested and must vary caches by Accept.

Products using delegated authorization should publish standard discovery metadata.

Products with a public API should publish a machine-readable OpenAPI document.

Products with public pricing should make it easy to find from the homepage.

A security.txt file gives researchers a supported disclosure route.