Probed 5 candidate ToS paths (nav-discovered + platform-conventional) and none returned a 2xx body.

How: Discover candidate URLs by scoring homepage nav/footer anchors for terms/tos/legal/conditions keywords, then append platform-conventional paths; probe each with politeFetch and pass on the first 2xx with ≥200 stripped-body chars.

• No terms-of-service page reachable at any candidate URL▲HIGHHIGH severity — weight 5 in score calculation.

  statuses: /terms-conditions/=404, /terms/=404, /terms=404, /terms-of-service=404, /policies/terms-of-service=404

  Publish a ToS page at /terms (or your platform's standard slug) with ≥200 chars of body text.

Checked 20 sampled product pages for a GTIN in the Product JSON-LD (3 carry a valid GTIN, 15%).

How: Extract gtin / gtin8 / gtin12 / gtin13 / gtin14 from the first Product JSON-LD node on each PDP; validate digit length.

• No valid GTIN on this product page▲HIGHHIGH severity — weight 5 in score calculation.× 10

  Populate gtin/gtin8/gtin12/gtin13/gtin14 with the manufacturer's barcode.

  Affected (10)

  • /vertx-mens-delta-stretch-2-0-pants-spine-grey
  • /belleville-tr660-khyber-hot-weather-lightweigh…
  • /1911-trp-45-acp-handgun-stainless-ca-compliant
  • /recover-tactical-rg15-quick-change-rubber-grip…
  • /first-spear-patrol-radio-pouch-motorola-6-12
  • /1911-loaded-target-9mm-handgun-stainless-ca-co…
  • /saint-edge-ar-15-rifle-5-56-black
  • /recover-tactical-mcsb-magazine-clips-for-glock…
  • /1911-trp-operator-longslide-handgun-10mm-black
  • /speer-lawman-rht-frangible-40-s-w-125-gr-cf-rh…

…and 1 more

Inspected hasMerchantReturnPolicy on Product/Offer JSON-LD across 20 sampled product pages (0 present, 0%).

How: On each PDP, locate the Product JSON-LD node and check for a hasMerchantReturnPolicy object/array at Product level OR Offer level. Pass band ≥ 85% coverage, partial ≥ 50%.

• Product JSON-LD missing hasMerchantReturnPolicy▲HIGHHIGH severity — weight 5 in score calculation.× 10

  Add a MerchantReturnPolicy node to Product or Offer with category + applicableCountry (or merchantReturnLink).

  Affected (10)

  • /al4824-transport-case-olive-drab-green-48-62-x…
  • /vertx-mens-delta-stretch-2-0-pants-spine-grey
  • /via-spiga-prish-leather-boots-brown-5-b-m-us
  • /belleville-tr660-khyber-hot-weather-lightweigh…
  • /1911-trp-45-acp-handgun-stainless-ca-compliant
  • /recover-tactical-rg15-quick-change-rubber-grip…
  • /first-spear-patrol-radio-pouch-motorola-6-12
  • /1911-loaded-target-9mm-handgun-stainless-ca-co…
  • /saint-edge-ar-15-rifle-5-56-black
  • /recover-tactical-mcsb-magazine-clips-for-glock…

…and 1 more

Inspected shippingDetails on Product/Offer JSON-LD across 20 sampled PDPs (0 present, 0%).

How: On each PDP, locate the Product JSON-LD node and check for shippingDetails (single object or array) at Product or Offer level. Pass band ≥ 85% coverage.

• Offer JSON-LD missing shippingDetails▲HIGHHIGH severity — weight 5 in score calculation.× 10

  Add OfferShippingDetails with shippingRate, shippingDestination, and deliveryTime.

  Affected (10)

  • /al4824-transport-case-olive-drab-green-48-62-x…
  • /vertx-mens-delta-stretch-2-0-pants-spine-grey
  • /via-spiga-prish-leather-boots-brown-5-b-m-us
  • /belleville-tr660-khyber-hot-weather-lightweigh…
  • /1911-trp-45-acp-handgun-stainless-ca-compliant
  • /recover-tactical-rg15-quick-change-rubber-grip…
  • /first-spear-patrol-radio-pouch-motorola-6-12
  • /1911-loaded-target-9mm-handgun-stainless-ca-co…
  • /saint-edge-ar-15-rifle-5-56-black
  • /recover-tactical-mcsb-magazine-clips-for-glock…

…and 1 more

Profile is missing required key(s): signing_keys.

How: Read the profile root (or top-level ucp wrapper) and verify the presence of version, services, capabilities, and signing_keys keys.

• Required top-level key signing_keys is missing▲HIGHHIGH severity — weight 5 in score calculation.

  /.well-known/ucp

  What we expected

  Add a top-level "signing_keys" field to the JSON document (empty array/object is fine).

  Set signing_keys at the root of the JSON document.

Validated 1 services with recognised transports (0 satisfy their transport's required fields).

How: For each services[] entry with a recognised transport, require the transport-conditional fields: rest/mcp → endpoint+schema; a2a → endpoint; embedded → schema.

• Service is missing transport-conditional field(s)▲HIGHHIGH severity — weight 5 in score calculation.

  /.well-known/ucpnamespace=dev.ucp.shopping; transport=rest

  What we found

  missing: schema

  What we expected

  `endpoint` + `schema`

  Add schema to this services[] entry.

No MerchantReturnPolicy node used the MerchantReturnFiniteReturnWindow category, so the merchantReturnDays check has nothing to evaluate.

How: For each MerchantReturnPolicy node whose returnPolicyCategory normalizes to MerchantReturnFiniteReturnWindow, require merchantReturnDays to be a positive number (or a numeric string > 0).

No PDP carried a hasMerchantReturnPolicy node, so Option A/B shape cannot be evaluated.

How: For each PDP, walk every hasMerchantReturnPolicy node (Product or Offer level) and require either (applicableCountry + returnPolicyCategory) OR a syntactically-valid merchantReturnLink URL.

Profile declares no signing_keys; JWK validation has no entries to evaluate.

How: Walk signing_keys[] and validate each entry per RFC 7517 §4.1 (kty required) + RFC 7518 §6 (kty-specific required parameters). kid is OPTIONAL per RFC 7517 §4.5 and not enforced here.

Inspected the homepage Strict-Transport-Security header ("max-age=31536000") and the includeSubDomains directive is absent.

How: Parse the homepage Strict-Transport-Security header for the includeSubDomains directive (RFC 6797 §6.1.2).

• HSTS header is missing the includeSubDomains directive◆MEDIUMMEDIUM severity — weight 3 in score calculation.

  /

  What we found

  max-age=31536000

  What we expected

  Strict-Transport-Security: max-age=31536000; includeSubDomains

  Append ; includeSubDomains to your STS header once every subdomain you operate supports HTTPS.

No MerchantReturnPolicy node carried a merchantReturnLink URL, so reachability has nothing to evaluate.

How: Collect every unique merchantReturnLink URL across all MerchantReturnPolicy nodes; probe each once via politeFetch (failSoft). 2xx counts as reachable.

No MerchantReturnPolicy node carried applicableCountry, so the ISO-code check has nothing to evaluate.

How: On each MerchantReturnPolicy node where applicableCountry is set, extract every candidate string and require every one to match /^[A-Z]{2}$/i.

No MerchantReturnPolicy node carried returnPolicyCategory, so the enum check has nothing to evaluate.

How: On each MerchantReturnPolicy node where returnPolicyCategory is set, accept the bare enum name or the schema.org URL form; reject any other string.

No OfferShippingDetails node carried shippingDestination, so the DefinedRegion check has nothing to evaluate.

How: On each OfferShippingDetails node where shippingDestination is set, require it to be a DefinedRegion (or array) and every entry to carry addressCountry matching /^[A-Z]{2}$/i.

No OfferShippingDetails node carried shippingRate, so the MonetaryAmount check has nothing to evaluate.

How: On each OfferShippingDetails node where shippingRate is set, require an object with numeric value/maxValue (typed or numeric string) and a 3-letter ISO 4217 currency.

Profile declares no capabilities; required-field checks have nothing to evaluate.

How: For each capabilities[] entry, require non-empty string values for version, spec, and schema.

No services declared a spec URL; origin matching has nothing to evaluate.

How: For each service with a spec URL, require the URL origin to be a canonical UCP authority OR the host/path to include the namespace token.

Inspected <img width=… height=…> attributes on 20 sampled product pages (0 have at least one image with area ≥ 50,000 px; dimensions absent from HTML are not HEAD-probed and count as indeterminate).

How: For every sampled PDP, parse <img> tags and read explicit width and height attributes; a PDP passes when at least one image has width × height ≥ 50,000. PDPs without any explicit-dimension <img> are marked indeterminate (this check does not HEAD image URLs).

• All images on this PDP are below the 50,000-pixel threshold●LOWLOW severity — weight 1 in score calculation.× 10

  Upload an image whose width × height ≥ 50,000 (e.g., 400 × 300 = 120,000).

  Affected (10)

  • /al4824-transport-case-olive-drab-green-48-62-x…largest image area observed: 25,000 px
  • /vertx-mens-delta-stretch-2-0-pants-spine-greylargest image area observed: 25,000 px
  • /via-spiga-prish-leather-boots-brown-5-b-m-uslargest image area observed: 25,000 px
  • /belleville-tr660-khyber-hot-weather-lightweigh…largest image area observed: 25,000 px
  • /1911-trp-45-acp-handgun-stainless-ca-compliantlargest image area observed: 25,000 px
  • /recover-tactical-rg15-quick-change-rubber-grip…largest image area observed: 25,000 px
  • /first-spear-patrol-radio-pouch-motorola-6-12largest image area observed: 25,000 px
  • /1911-loaded-target-9mm-handgun-stainless-ca-co…largest image area observed: 25,000 px
  • /saint-edge-ar-15-rifle-5-56-blacklargest image area observed: 25,000 px
  • /recover-tactical-mcsb-magazine-clips-for-glock…largest image area observed: 25,000 px

…and 1 more

Inspected the homepage Strict-Transport-Security header ("max-age=31536000") and the preload directive is absent.

How: Parse the homepage Strict-Transport-Security header for the preload directive (hstspreload.org vendor extension to RFC 6797).

• HSTS header is missing the preload directive●LOWLOW severity — weight 1 in score calculation.

  /

  What we found

  max-age=31536000

  What we expected

  Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

  Append ; preload after includeSubDomains and submit your domain at https://hstspreload.org/.

Looked for a valid aggregateRating on Product JSON-LD across 20 sampled product pages (0 valid, 0%).

How: On each Product node, parse aggregateRating (or the first element if it's an array) and require ratingValue in [0,5] AND reviewCount or ratingCount ≥ 1.

• Product has no valid AggregateRating (ratingValue 0-5 + reviewCount/ratingCount ≥ 1)●LOWLOW severity — weight 1 in score calculation.× 10

  Render aggregateRating from real review totals — never fabricate.

  Affected (10)

  • /al4824-transport-case-olive-drab-green-48-62-x…
  • /vertx-mens-delta-stretch-2-0-pants-spine-grey
  • /via-spiga-prish-leather-boots-brown-5-b-m-us
  • /belleville-tr660-khyber-hot-weather-lightweigh…
  • /1911-trp-45-acp-handgun-stainless-ca-compliant
  • /recover-tactical-rg15-quick-change-rubber-grip…
  • /first-spear-patrol-radio-pouch-motorola-6-12
  • /1911-loaded-target-9mm-handgun-stainless-ca-co…
  • /saint-edge-ar-15-rifle-5-56-black
  • /recover-tactical-mcsb-magazine-clips-for-glock…

…and 1 more

Parsed <img> alt attributes across 20 sampled product pages (15 have alt text on at least 80% of images).

How: Per PDP, count <img> tags via regex; a tag 'has alt text' when its alt attribute is present AND non-empty after trim. A PDP passes when it carries no <img> at all OR ≥80% of its <img> tags have non-empty alt.

• Most images on this product page lack alt text●LOWLOW severity — weight 1 in score calculation.× 5

  What we expected

  <img src="/img/sneaker.webp" alt="Red leather running shoe, side view" />

  Populate the alt attribute on each <img> with a description of what the image shows; use alt="" only for decorative images.

  Affected (5)

  • /recover-tactical-rg15-quick-change-rubber-grip…10/13 <img> tags have non-empty alt (77%)
  • /speer-lawman-rht-frangible-40-s-w-125-gr-cf-rh…8/11 <img> tags have non-empty alt (73%)
  • /rocky-mens-black-leather-goretex-work-northern…8/12 <img> tags have non-empty alt (67%)
  • /federal-premium-personal-defense-shotshell-wit…10/13 <img> tags have non-empty alt (77%)
  • /saint-victor-ar-15-rifle-b5-5-56-black7/9 <img> tags have non-empty alt (78%)

No MerchantReturnPolicy node carried returnFees, returnMethod, or refundType, so the enum check has nothing to evaluate.

How: On each MerchantReturnPolicy node, inspect returnFees/returnMethod/refundType if set; require the bare name or schema.org URL form of a value in the corresponding Schema.org enum.

No OfferShippingDetails node carried deliveryTime, so the ShippingDeliveryTime check has nothing to evaluate.

How: On each OfferShippingDetails node where deliveryTime is set, require an object with at least one of handlingTime / transitTime populated as a QuantitativeValue.

Walked services[] for transport: "mcp" entries; none advertised.

How: Filter services[] to entries where transport=mcp and validate that endpoint is an absolute https:// URL.

Scanned the homepage and 20 sampled PDPs for Apple Pay markers; none matched.

How: Substring match on known Apple Pay SDK/markup signatures (ApplePaySession, apple-pay-button, /apple-developer-merchantid-domain-association) across the homepage and every sampled PDP HTML.

• No Apple Pay markers detected on the homepage or PDPs○INFOINFO severity — weight 0 in score calculation.

  /

  Enable Apple Pay in your payment processor's dashboard (Stripe / Adyen / Braintree). Informational only — does not affect the score.

Scanned the homepage and 20 sampled PDPs for Google Pay markers; none matched.

How: Substring match on known Google Pay SDK/markup signatures (pay.google.com/gp/p/js/pay.js, google.payments.api, <google-pay-button) across the homepage and every sampled PDP HTML.

• No Google Pay markers detected on the homepage or PDPs○INFOINFO severity — weight 0 in score calculation.

  /

  Enable Google Pay in your payment processor's dashboard (Stripe / Adyen / Braintree). Informational only — does not affect the score.

Looked for /llms.txt at the site root; the fetcher returned no file.

How: Check whether the fetcher reached an /llms.txt at the site root. Informational only — no failure path per llmstxt.org being a voluntary community convention.