Skip to content
J

jimbir.ch

Compare
Scan history
100/100 Comparing
98/100 Compare
100/100 Compare
100/100 Compare
87/100 Compare
84/100 Current
84/100 Compare
Changes since selected scan Score change: -16

Resolved

  • None

New issues

  • 1.10 Content-Usage preferences
  • 1.11 AGENTS.md agent guide
  • 1.14 DNS-AID agent records
  • 1.2 AI crawler directives
  • 1.4 llms.txt
  • 1.7 Content negotiation (text/markdown)
  • 2.9 Trust anchor pages
  • 3.12 Document title
  • 3.15 Dynamic widget state
  • 4.10 API Catalog (RFC 9727)
  • 4.11 Agent Skills index
  • 4.21 AI Catalog
  • 4.4 MCP Discovery
  • 4.5 OpenAPI / API documentation
  • 5.3 HSTS header
  • 5.4 Content-Security-Policy
  • 5.6 Frame protection

Category changes

  • Agent Protocols -100
  • AI Content Discovery -8
  • Security & Trust -62
  • Content & Semantics -4
  • AI Search Signals -5

Result summary

Measured stable-core coverage

84/100

Methodology grade

A

Methodology 2026-09-02

29 core checkpoints assessed

22 Passed
4 Partial
3 Failed
12 Skipped

Readiness profiles

Select a profile to filter the detailed results.

Action plan

Priority actions Highest-impact implementation details
3 prioritized actions

Prioritized by exact impact on the overall stable-core score.

Failed HSTS header +6 overall pts

Strict-Transport-Security header is not set. Note: sites on the HSTS preload list may not send this header but are still protected via browser preloading.

HSTS header
HIGH

HSTS prevents protocol downgrade attacks by telling browsers to always use HTTPS. AI agents that follow redirects benefit from HSTS as it eliminates insecure initial connections.

Add the Strict-Transport-Security header with max-age=31536000 (1 year) and includeSubDomains. If your site is on the HSTS preload list (hstspreload.org), the header is still recommended for first-visit protection.

Server config plain 
# Nginx
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

# Apache (.htaccess)
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
Sources
Failed Content-Security-Policy +4 overall pts

Content-Security-Policy header is not set.

Content-Security-Policy
HIGH

Content-Security-Policy prevents XSS and injection attacks. For AI agents that interact with your site, CSP ensures the page content hasn't been tampered with by malicious scripts.

Add a Content-Security-Policy header with directives like default-src, script-src, and style-src.

Server config plain 
# Nginx
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'" always;

# Apache (.htaccess)
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'"
Sources
Partial AI crawler directives +3 overall pts

13 AI crawlers have targeted path restrictions: GPTBot, Google-Extended, ChatGPT-User, ClaudeBot, Amazonbot, Claude-User, Bytespider, CCBot, PerplexityBot, Applebot-Extended, meta-externalagent, Claude-SearchBot, OAI-SearchBot.

AI crawler directives
MEDIUM

robots.txt determines which paths crawlers may fetch. This checkpoint measures effective crawl access for common AI user agents; it does not infer training consent.

Some AI crawlers have partial access restrictions. Consider adding explicit Allow: / directives to signal full crawling intent.

robots.txt plain 
# Add to your /robots.txt - explicit Allow for AI crawlers
User-agent: GPTBot
Allow: /

User-agent: ClaudeBot
Allow: /

User-agent: Google-Extended
Allow: /

User-agent: Amazonbot
Allow: /

User-agent: ChatGPT-User
Allow: /

User-agent: PerplexityBot
Allow: /
Sources
Fix with AI Skills
$ /plugin marketplace add bartwaardenburg/isagentready-skills

Detailed results

Agent Protocols

Weight 15% · No applicable checkpoints · 5 bonus opportunities

Not assessed
AI Content Discovery

Weight 30% · 1 partial checkpoint · 5 bonus opportunities

92/100
Security & Trust

Weight 15% · 3 failed checkpoints

38/100
Content & Semantics

Weight 20% · 2 partial checkpoints

96/100
AI Search Signals

Weight 20% · 1 partial checkpoint

95/100
AI Training Exposure

Does not affect the readiness score

Supplemental

No AI training protections detected. Your content may be freely used for AI model training.

Common Crawl presence Unknown

Common Crawl presence was not checked during this scan.

Training crawler blocking Not found

No training crawlers are blocked in robots.txt. All known AI training bots can access your content.

TDMRep declaration Not found

No TDMRep file found at /.well-known/tdmrep.json. The TDM Reservation Protocol (W3C) lets you declare whether you reserve text and data mining rights. See w3.org/community/reports/tdmrep/CG-FINAL-tdmrep-20240510 for the specification.

ai.txt policy Not found

No ai.txt file found. ai.txt lets you declare AI usage preferences for your content.

Web Bot Auth Not found

No Web Bot Auth signature key directory found. Bots cannot prove their identity to origins via signed HTTP requests.

Developer Tools

Scan and fix from your editor

Install our MCP server to scan any website from your terminal. Pair it with AI agent skills to fix failing checks automatically.

  • Scan any website directly from your terminal
  • Fix failing checks with AI agent skills
  • Re-scan to verify improvements
SCAN
claude mcp add isagentready-mcp -- npx -y isagentready-mcp
FIX
/plugin marketplace add bartwaardenburg/isagentready-skills
MCP Server AI Skills
Request a detailed report Optional follow-up with a personalized PDF report
Free PDF Report

Get your detailed report

Receive a personalized report with actionable insights for improving your website's AI agent readiness.

  • Detailed score breakdown per category
  • Prioritized improvement recommendations
  • Step-by-step implementation guide

We'll use this address to send report updates.

Go beyond the homepage

Audit multiple pages of your website. Get a private report with grouped fixes and one included recheck, paid once.

View site audits