Site report: 1 measured page. Overall grade: Fair.
Bring the findings to the people who can fix them. Copy a ready-to-send summary for Slack, Teams or your next planning meeting.
This is a public report. Your team can open it without an account.
Areas group the checks shown in this report. Their scores are weighted summaries, not individual pages.
Is there substance an agent can read?
Homepage does not serve Markdown via content negotiation
Serve a Markdown representation of your pages when agents request "Accept: text/markdown". Agents like Claude Code and Cursor ask for it, and Markdown cuts token usage by roughly 80% against HTML. Cloudflare ("Markdown for Agents") and Vercel can enable this without code changes.
No <link rel="alternate" type="text/markdown"> fallback found on the homepage
If you cannot enable content negotiation, advertise a Markdown version with <link rel="alternate" type="text/markdown" href="/index.md"> so agents can discover it.
253/254 interactive elements have an accessible name
2/4 form controls have no label
An unlabelled box is one the agent has to guess the meaning of, which is how an email address ends up in a search field. Use <label for>, wrap the control in a label, or add aria-label.
1 link(s) lead nowhere without JavaScript
A link with no destination cannot be followed by a fetch-only agent and cannot be opened in a new tab by a browsing one. Give it a real href, or make it a <button> if it is an action rather than a destination.
16/16 images, frames or videos have no declared dimensions
Undeclared dimensions shift the layout as media loads. An agent working from a screenshot clicks where the button was a moment ago. Set width and height, or aspect-ratio.
Method note: this reads markup, not a rendered accessibility tree
1 JSON-LD block(s) found
@context references schema.org
@graph array present (multi-entity structured data)
Only 1 key type found: WebSite
Add more entity types to your @graph. AI agents use these to understand site structure. Common types: Person, Organization, WebSite, WebPage.
No BreadcrumbList found
Add a BreadcrumbList entity to help AI agents understand your site navigation hierarchy.
No author declared in structured data
An assistant deciding whether to cite a page weighs where it came from. Add author as a Person or Organization, not a bare string.
No sameAs links
sameAs is what turns a name into an entity. Link your Organization or Person to Wikidata, LinkedIn, GitHub or Crunchbase so a model can connect this page to what it already knows.
Content last dated 2026-09-10 (8 days ago)
Structured-data headings appear in the visible text
Server-rendered content detected (1655 words, 10619 chars of visible text)
Text-to-markup ratio is healthy (7.7% of structural markup)
Semantic landmarks present (main, section, header, footer, nav)
Single <h1> heading: "HSBC Group corporate website | HSBC Holdings plc"
15/15 <img> tags have alt attributes
<title> length 48 chars: "HSBC Group corporate website | HSBC Holdings plc"
Meta description length 147 chars
Canonical URL: https://www.hsbc.com/
<html lang="en">
UTF-8 charset declared
Viewport meta present: "width=device-width, initial-scale=1.0"
Can an agent retrieve it at all?
A missing page redirects (301) instead of returning 404
A redirect on a nonexistent path hides the error. Return 404 or 410 so a client can tell the difference.
Homepage takes 2 redirects to answer
Every hop is a round trip the agent pays for, and some clients cap redirects well below a browser. Collapse the chain: point the first URL straight at the final one.
HEAD requests are supported
Content-Type: text/html with charset
ClaudeBot probe failed: Network error: Request timed out
The request did not complete, so access for this crawler is unknown. Re-run the audit; if it persists, check origin health for this user agent.
OAI-SearchBot probe failed: Network error: Request timed out
The request did not complete, so access for this crawler is unknown. Re-run the audit; if it persists, check origin health for this user agent.
2 crawler probe(s) could not be settled from outside
ax-audit sends this user agent from its own network without a Web Bot Auth signature, so an edge that verifies crawlers by IP range or signature will reject the probe while admitting the real crawler. Confirm against your WAF logs before changing any rule.
Site is served over HTTPS
HTTP requests redirect to HTTPS
HSTS max-age=31536000
HSTS includes subdomains
HSTS preload-eligible
Response compressed with gzip
Cache validator present (ETag)
Conditional request returns 304 Not Modified
Homepage size is reasonable (152.8 KB decompressed)
Roughly 2,655 tokens of content in 39,095 tokens of response (93% markup)
An agent pays to receive the markup and then discards it. Serving Markdown on Accept negotiation is the direct fix.
Homepage responded in 420ms
Homepage is indexable
No directive restricts how AI assistants may use this page
Can an agent find what you publish?
/llms.txt not found
Create a /llms.txt file at your site root following the llmstxt.org specification. It should be a Markdown file starting with "# Your Site Name" and include a description, sections, and links.
No sitemap found
Publish an XML sitemap at /sitemap.xml and reference it from robots.txt with: Sitemap: https://your-site.com/sitemap.xml
/robots.txt exists
No core AI crawlers explicitly configured
Add User-agent entries for core AI crawlers in your robots.txt. For each crawler, add: User-agent: <name> followed by Allow: / on the next line.
No Sitemap directive found
Add a Sitemap directive to your robots.txt: Sitemap: https://your-site.com/sitemap.xml
No Content-Signal directive found (optional)
Declare how crawlers may use your content after access with the Content Signals Policy, e.g.: Content-Signal: search=yes, ai-train=no. Known signals: search, ai-input, ai-train, plus the optional use=immediate|reference|full. Generate yours at contentsignals.org.
0/57 known AI crawlers have explicit rules
Add explicit User-agent entries for more AI crawlers to maximize discoverability.
6/7 security headers present
No Link header for AI discovery (llms.txt, Agent Card)
Add a Link response header pointing to your AI discovery files: Link: </llms.txt>; rel="alternate"; type="text/plain", </.well-known/agent-card.json>; rel="alternate"; type="application/json"
No machine-readable discovery relations beyond llms.txt and the Agent Card
Advertise what you publish with Link relations so agents stop guessing paths. Add the ones that apply, for example: Link: </llms.txt>; rel="describedby", </.well-known/api-catalog>; rel="api-catalog". Informational in 3.x: this does not affect your score.
What can an agent call?
No agent resource catalog found
A catalog is one document listing everything an agent can call here (agent cards, MCP servers, APIs, skills), so a client stops probing four conventions to find out. Worth publishing once you have more than one of those. Informational: both ai-catalog.json and ard.json are still drafts, so this never affects your score.
2 form(s) on the page, none declared as agent tools
A declared form is called by an agent rather than driven pixel by pixel. Add toolname and tooldescription to the forms worth automating (search, filter, subscribe) and toolparamdescription to each field.
No agent-facing surface: an Agent Card does not apply to this site
No API surface: API discovery does not apply to this site
No MCP server: MCP discovery does not apply to this site
No developer-facing surface: skills do not apply to this site
No commerce surface: agentic-commerce discovery does not apply to this site
Nothing on this site requires authorization: auth discovery does not apply
What usage rights are declared?
No RSL license discovery found
Declare machine-readable licensing terms for your content with Really Simple Licensing. Add to robots.txt: License: https://your-site.com/license.xml, then publish the RSL document. See https://rslstandard.org.
No machine-readable usage policy declared
State your terms where they can be read without a lawyer. The lowest-effort option is a Content-Signal line in robots.txt: Content-Signal: search=yes, ai-input=yes, ai-train=no. Absence is neutral, not permission, but it also gives you nothing to point at.
/.well-known/security.txt exists
Required field "Contact" missing (RFC 9116)
Add "Contact:" to your security.txt. Use a mailto: or https: URI, e.g., Contact: mailto:security@example.com
Required field "Expires" missing (RFC 9116)
Add "Expires:" to your security.txt. Use an ISO 8601 date, e.g., Expires: 2026-12-31T23:59:59.000Z
No optional fields (Canonical, Preferred-Languages, Policy, etc.)
Consider adding Canonical: (canonical URL), Preferred-Languages: (e.g., en), and Policy: (link to your security policy).
Give your team full reports, prioritized fixes and monitoring, so improvements last beyond the next release.