Confirmed the homepage is HTTPS (status 200), probed http://cocorepublic.com.au/ for redirect behaviour, and parsed the Strict-Transport-Security header (value: "max-age=300").

How: URL scheme + homepage status check, an http://host/ redirect probe through politeFetch, and a Strict-Transport-Security max-age parse (RFC 6797; ≥ 180-day threshold).

• HSTS max-age is below the 6-month minimum■CRITICALCRITICAL severity — weight 10 in score calculation.

  /parsed max-age = 300s (need ≥ 15552000s = 180 days)

  What we found

  max-age=300

  What we expected

  Strict-Transport-Security: max-age=31536000; includeSubDomains

  Bump max-age to at least 15552000 (180 days). 31536000 (1 year) is required for preload-list inclusion.

Probed 5 candidate contact-page paths and none returned a 2xx response.

How: URL probe of contact paths; the first 2xx body is scanned for mailto: / tel: hrefs, plain emails (placeholder hosts excluded), and phone-shaped numbers.

• No contact page reachable▲HIGHHIGH severity — weight 5 in score calculation.

  statuses: /contact-us/=403, /contact/=404, /contact=404, /contact-us=403, /pages/contact=404

  Publish a contact page at /contact (or your platform's standard path) with a mailto: and/or tel: link.

Checked 20 sampled product pages for a GTIN in the Product JSON-LD (0 carry a valid GTIN, 0%).

How: Extract gtin / gtin8 / gtin12 / gtin13 / gtin14 from the first Product JSON-LD node on each PDP; validate digit length.

• No valid GTIN on this product page▲HIGHHIGH severity — weight 5 in score calculation.× 10

  Populate gtin/gtin8/gtin12/gtin13/gtin14 with the manufacturer's barcode.

  Affected (10)

  • /628980-take-home-swatch-neroli-boucle-ivory.ht…
  • /618457-cove-outdoor-teak-root-side-table.html
  • /573184-westwood-bench-with-storage.html
  • /345809-avery-chair.html
  • /345868-salon-chair.html
  • /341631-max-glass-side-table.html
  • /341578-terrace-desk-chair.html
  • /748716-take-home-swatch-washed-luxembourg-whit…
  • /629016-take-home-swatch-rust-velvet.html
  • /cr11-h851-0028154-omega-storage-ottoman.html

…and 1 more

Profile is missing required key(s): signing_keys.

How: Read the profile root (or top-level ucp wrapper) and verify the presence of version, services, capabilities, and signing_keys keys.

• Required top-level key signing_keys is missing▲HIGHHIGH severity — weight 5 in score calculation.

  /.well-known/ucp

  What we expected

  Add a top-level "signing_keys" field to the JSON document (empty array/object is fine).

  Set signing_keys at the root of the JSON document.

Validated 1 services with recognised transports (0 satisfy their transport's required fields).

How: For each services[] entry with a recognised transport, require the transport-conditional fields: rest/mcp → endpoint+schema; a2a → endpoint; embedded → schema.

• Service is missing transport-conditional field(s)▲HIGHHIGH severity — weight 5 in score calculation.

  /.well-known/ucpnamespace=dev.ucp.shopping; transport=rest

  What we found

  missing: schema

  What we expected

  `endpoint` + `schema`

  Add schema to this services[] entry.

Profile declares no signing_keys; JWK validation has no entries to evaluate.

How: Walk signing_keys[] and validate each entry per RFC 7517 §4.1 (kty required) + RFC 7518 §6 (kty-specific required parameters). kid is OPTIONAL per RFC 7517 §4.5 and not enforced here.

Inspected the homepage Strict-Transport-Security header ("max-age=300") and the includeSubDomains directive is absent.

How: Parse the homepage Strict-Transport-Security header for the includeSubDomains directive (RFC 6797 §6.1.2).

• HSTS header is missing the includeSubDomains directive◆MEDIUMMEDIUM severity — weight 3 in score calculation.

  /

  What we found

  max-age=300

  What we expected

  Strict-Transport-Security: max-age=31536000; includeSubDomains

  Append ; includeSubDomains to your STS header once every subdomain you operate supports HTTPS.

Parsed the homepage JSON-LD looking for an Organization/OnlineStore node with a contactPoint, but no Organization-class node is present.

How: Parse homepage <script type="application/ld+json"> blocks, flatten @graph, and look for an Organization/OnlineStore/Store node with a contactPoint carrying email or telephone.

• No Organization/OnlineStore JSON-LD on homepage◆MEDIUMMEDIUM severity — weight 3 in score calculation.

  /

  What we expected

  <script type="application/ld+json">{"@context":"https://schema.org","@type":"OnlineStore","name":"Example Store","url":"https://example.com","contactPoint":[{"@type":"ContactPoint","contactType":"customer service","email":"support@example.com"}]}</script>

  Add an Organization (or OnlineStore) JSON-LD block in the homepage <head> with a contactPoint.

Validated shippingRate on 20 OfferShippingDetails nodes (0 valid MonetaryAmount, 0%).

How: On each OfferShippingDetails node where shippingRate is set, require an object with numeric value/maxValue (typed or numeric string) and a 3-letter ISO 4217 currency.

• shippingRate is not a valid MonetaryAmount◆MEDIUMMEDIUM severity — weight 3 in score calculation.× 10

  Emit { value: <number>, currency: "USD" } (or maxValue + currency).

  Affected (10)

  • /628980-take-home-swatch-neroli-boucle-ivory.ht…missing numeric value/maxValue
  • /618457-cove-outdoor-teak-root-side-table.htmlmissing numeric value/maxValue
  • /573184-westwood-bench-with-storage.htmlmissing numeric value/maxValue
  • /345809-avery-chair.htmlmissing numeric value/maxValue
  • /345868-salon-chair.htmlmissing numeric value/maxValue
  • /341631-max-glass-side-table.htmlmissing numeric value/maxValue
  • /341578-terrace-desk-chair.htmlmissing numeric value/maxValue
  • /748716-take-home-swatch-washed-luxembourg-whit…missing numeric value/maxValue
  • /629016-take-home-swatch-rust-velvet.htmlmissing numeric value/maxValue
  • /cr11-h851-0028154-omega-storage-ottoman.htmlmissing numeric value/maxValue

…and 1 more

Scanned the homepage and 20 sampled PDPs for 8 review-platform asset fingerprints; none matched.

How: Substring scan of homepage and sampled PDP HTML for known review-platform asset fingerprints (judge.me, yotpo, stamped.io, reviews.io, okendo, loox, trustpilot, bazaarvoice).

• No third-party review-platform integration detected◆MEDIUMMEDIUM severity — weight 3 in score calculation.

  none of 8 fingerprints matched across 21 sources

  Install a Judge.me / Yotpo / Loox / Okendo / Stamped / Reviews.io / Trustpilot / Bazaarvoice widget on your storefront.

Resolved an XML sitemap with 1000 <loc> entries, but none look like product URLs.

How: Parse <loc> entries from the resolved sitemap (or sitemap index) and classify each against product-URL patterns (/products/..., /product/..., /p/<id>, etc.).

• Sitemap reachable but contains no product URLs◆MEDIUMMEDIUM severity — weight 3 in score calculation.

  /sitemap.xml1000 total <loc> entries, 0 product-shaped (0%)

  Add product URLs (e.g., /products/<handle>) to the sitemap or include the product-section sitemap in your sitemap index.

No MerchantReturnPolicy node carried a merchantReturnLink URL, so reachability has nothing to evaluate.

How: Collect every unique merchantReturnLink URL across all MerchantReturnPolicy nodes; probe each once via politeFetch (failSoft). 2xx counts as reachable.

Profile declares no capabilities; required-field checks have nothing to evaluate.

How: For each capabilities[] entry, require non-empty string values for version, spec, and schema.

No services declared a spec URL; origin matching has nothing to evaluate.

How: For each service with a spec URL, require the URL origin to be a canonical UCP authority OR the host/path to include the namespace token.

Inspected <img width=… height=…> attributes on 20 sampled product pages (0 have at least one image with area ≥ 50,000 px; dimensions absent from HTML are not HEAD-probed and count as indeterminate).

How: For every sampled PDP, parse <img> tags and read explicit width and height attributes; a PDP passes when at least one image has width × height ≥ 50,000. PDPs without any explicit-dimension <img> are marked indeterminate (this check does not HEAD image URLs).

• All images on this PDP are below the 50,000-pixel threshold●LOWLOW severity — weight 1 in score calculation.× 10

  Upload an image whose width × height ≥ 50,000 (e.g., 400 × 300 = 120,000).

  Affected (10)

  • /628980-take-home-swatch-neroli-boucle-ivory.ht…largest image area observed: 1 px
  • /618457-cove-outdoor-teak-root-side-table.htmllargest image area observed: 1 px
  • /573184-westwood-bench-with-storage.htmllargest image area observed: 1 px
  • /345809-avery-chair.htmllargest image area observed: 1 px
  • /345868-salon-chair.htmllargest image area observed: 1 px
  • /341631-max-glass-side-table.htmllargest image area observed: 1 px
  • /341578-terrace-desk-chair.htmllargest image area observed: 1 px
  • /748716-take-home-swatch-washed-luxembourg-whit…largest image area observed: 1 px
  • /629016-take-home-swatch-rust-velvet.htmllargest image area observed: 1 px
  • /cr11-h851-0028154-omega-storage-ottoman.htmllargest image area observed: 1 px

…and 1 more

Inspected the homepage Strict-Transport-Security header ("max-age=300") and the preload directive is absent.

How: Parse the homepage Strict-Transport-Security header for the preload directive (hstspreload.org vendor extension to RFC 6797).

• HSTS header is missing the preload directive●LOWLOW severity — weight 1 in score calculation.

  /

  What we found

  max-age=300

  What we expected

  Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

  Append ; preload after includeSubDomains and submit your domain at https://hstspreload.org/.

Looked for a valid aggregateRating on Product JSON-LD across 20 sampled product pages (0 valid, 0%).

How: On each Product node, parse aggregateRating (or the first element if it's an array) and require ratingValue in [0,5] AND reviewCount or ratingCount ≥ 1.

• Product has no valid AggregateRating (ratingValue 0-5 + reviewCount/ratingCount ≥ 1)●LOWLOW severity — weight 1 in score calculation.× 10

  Render aggregateRating from real review totals — never fabricate.

  Affected (10)

  • /628980-take-home-swatch-neroli-boucle-ivory.ht…
  • /618457-cove-outdoor-teak-root-side-table.html
  • /573184-westwood-bench-with-storage.html
  • /345809-avery-chair.html
  • /345868-salon-chair.html
  • /341631-max-glass-side-table.html
  • /341578-terrace-desk-chair.html
  • /748716-take-home-swatch-washed-luxembourg-whit…
  • /629016-take-home-swatch-rust-velvet.html
  • /cr11-h851-0028154-omega-storage-ottoman.html

…and 1 more

Walked services[] for transport: "mcp" entries; none advertised.

How: Filter services[] to entries where transport=mcp and validate that endpoint is an absolute https:// URL.

Scanned the homepage and 20 sampled PDPs for Apple Pay markers; none matched.

How: Substring match on known Apple Pay SDK/markup signatures (ApplePaySession, apple-pay-button, /apple-developer-merchantid-domain-association) across the homepage and every sampled PDP HTML.

• No Apple Pay markers detected on the homepage or PDPs○INFOINFO severity — weight 0 in score calculation.

  /

  Enable Apple Pay in your payment processor's dashboard (Stripe / Adyen / Braintree). Informational only — does not affect the score.

Scanned the homepage and 20 sampled PDPs for Google Pay markers; none matched.

How: Substring match on known Google Pay SDK/markup signatures (pay.google.com/gp/p/js/pay.js, google.payments.api, <google-pay-button) across the homepage and every sampled PDP HTML.

• No Google Pay markers detected on the homepage or PDPs○INFOINFO severity — weight 0 in score calculation.

  /

  Enable Google Pay in your payment processor's dashboard (Stripe / Adyen / Braintree). Informational only — does not affect the score.

Looked for /llms.txt at the site root; the fetcher returned no file.

How: Check whether the fetcher reached an /llms.txt at the site root. Informational only — no failure path per llmstxt.org being a voluntary community convention.