A

francescas.com

Audited 6 days ago· bigcommerce

PDFShareSign in to re-audit
86
Grade B

Agent-readiness across all five AI commerce surfaces.

Surfaces — click to filter

13 failing · 9 not checked · 22 shown

9 checks couldn't run on this store — each is listed below with the reason. Your score reflects only what we could verify.

HALFCRITICAL
HTTPS enforced sitewide + HSTS (≥ 6-month max-age)https-and-hsts-enforcedHSTS

Enforce HTTPS sitewide and ship a Strict-Transport-Security header with max-age ≥ 6 months

Why this matters: AI agents and payment flows refuse plain HTTP; weak HSTS is treated as effectively no HSTS by trust-and-safety scanners.

RFC 6797 — HTTP Strict Transport Security (HSTS)
Findings (1)

Confirmed the homepage is HTTPS (status 200), probed http://francescas.com/ for redirect behaviour, and parsed the Strict-Transport-Security header (value: "max-age=300").

How: URL scheme + homepage status check, an http://host/ redirect probe through politeFetch, and a Strict-Transport-Security max-age parse (RFC 6797; ≥ 180-day threshold).

  • HSTS max-age is below the 6-month minimumCRITICAL

    /parsed max-age = 300s (need ≥ 15552000s = 180 days)

    What we found

    max-age=300

    What we expected

    Strict-Transport-Security: max-age=31536000; includeSubDomains

    Bump max-age to at least 15552000 (180 days). 31536000 (1 year) is required for preload-list inclusion.

How to fix · 3 steps · create a free account to viewCreate a free account →
FAILHIGH
GTIN coverage on PDPsproduct-gtin-populatedSchema.orgMerchant

Populate gtin on every branded Product node

Why this matters: GTINs let agents match your product to the same item elsewhere; without them you lose cross-catalog matching.

schema.org/Product.gtin
Findings (11)

Checked 20 sampled product pages for a GTIN in the Product JSON-LD (0 carry a valid GTIN, 0%).

How: Extract gtin / gtin8 / gtin12 / gtin13 / gtin14 from the first Product JSON-LD node on each PDP; validate digit length.

Coverage

0/20 · 0%

…and 1 more

How to fix · 2 steps · create a free account to viewCreate a free account →
FAILHIGH
MerchantReturnPolicy satisfies Option A (country+category) or B (returnLink)merchant-return-policy-option-a-or-bReturnsSchema.org

Make every MerchantReturnPolicy node satisfy Option A or Option B

Why this matters: A policy node missing both shapes is invisible to agents — they can't render it, link to it, or quote your return terms.

Google return-policy SD — required-shape MUSTs
Findings (11)

Inspected 67 MerchantReturnPolicy nodes across 20 PDPs (0 satisfy Option A or B, 0%).

How: For each PDP, walk every hasMerchantReturnPolicy node (Product or Offer level) and require either (applicableCountry + returnPolicyCategory) OR a syntactically-valid merchantReturnLink URL.

Coverage

0/67 · 0%

…and 1 more

How to fix · 2 steps · create a free account to viewCreate a free account →
FAILHIGH
UCP profile carries all four required top-level keysucp-profile-required-keysUCP

Add every required top-level key to the UCP profile

Why this matters: A profile missing one of the four required keys is treated as non-conformant — agent runtimes fall back to default behaviour and may skip the merchant.

UCP overview — required profile keys
Findings (1)

Profile is missing required key(s): signing_keys.

How: Read the profile root (or top-level ucp wrapper) and verify the presence of version, services, capabilities, and signing_keys keys.

  • Required top-level key signing_keys is missingHIGH

    /.well-known/ucp

    What we expected

    Add a top-level "signing_keys" field to the JSON document (empty array/object is fine).

    Set signing_keys at the root of the JSON document.

How to fix · 2 steps · create a free account to viewCreate a free account →
FAILHIGH
Each service satisfies the transport-conditional field requirementsucp-service-transport-conditional-fieldsUCP

Populate the conditional fields required by each service's transport

Why this matters: A service declared with the right transport but missing endpoint/schema is unreachable — agents can't negotiate or connect.

UCP overview — transport-conditional fields
Findings (1)

Validated 1 services with recognised transports (0 satisfy their transport's required fields).

How: For each services[] entry with a recognised transport, require the transport-conditional fields: rest/mcp → endpoint+schema; a2a → endpoint; embedded → schema.

Coverage

0/1 · 0%

  • Service is missing transport-conditional field(s)HIGH

    /.well-known/ucpnamespace=dev.ucp.shopping; transport=rest

    What we found

    missing: schema

    What we expected

    `endpoint` + `schema`

    Add schema to this services[] entry.

How to fix · 2 steps · create a free account to viewCreate a free account →
NAHIGH
MerchantReturnPolicy finite-window has positive merchantReturnDaysmerchant-return-policy-finite-daysReturns

Skipped — No MerchantReturnPolicy node used the MerchantReturnFiniteReturnWindow category, so the `merchantReturnDays` check has nothing to evaluate.

Context: AI agents quote your concrete return window in shopping cards. Without `merchantReturnDays`, your policy renders as 'has a return policy' without the headline number.

Google return-policy SD — merchantReturnDays required for finite windows
Why this was skipped

No MerchantReturnPolicy node used the MerchantReturnFiniteReturnWindow category, so the merchantReturnDays check has nothing to evaluate.

How: For each MerchantReturnPolicy node whose returnPolicyCategory normalizes to MerchantReturnFiniteReturnWindow, require merchantReturnDays to be a positive number (or a numeric string > 0).

NAHIGH
Every signing_keys[] entry is a valid JWKucp-signing-keys-validJWKS

Skipped — Profile declares no signing_keys; JWK validation has no entries to evaluate.

Context: Malformed JWK entries are rejected silently by agents — signed payloads cannot be verified and the merchant loses trust signal.

RFC 7517 — JSON Web Key (JWK)
Why this was skipped

Profile declares no signing_keys; JWK validation has no entries to evaluate.

How: Walk signing_keys[] and validate each entry per RFC 7517 §4.1 (kty required) + RFC 7518 §6 (kty-specific required parameters). kid is OPTIONAL per RFC 7517 §4.5 and not enforced here.

FAILMEDIUM
Product `sku` populatedproduct-sku-populatedSchema.orgMerchant

Populate sku on every Product JSON-LD node

Why this matters: A stable SKU lets agents track and re-identify your product across catalogs.

schema.org/Product.sku
Findings (11)

Read the sku field on Product JSON-LD across 20 sampled product pages (0 populated, 0%).

How: On each PDP with a Product node, accept sku if it is a non-empty trimmed string or a number.

Coverage

0/20 · 0%

…and 1 more

How to fix · 2 steps · create a free account to viewCreate a free account →
FAILMEDIUM
HSTS policy carries the includeSubDomains directivehsts-include-subdomainsHSTS

Add includeSubDomains to your Strict-Transport-Security header

Why this matters: Without includeSubDomains, an HTTP subdomain (staging, mail, …) can be used to attack the apex's cookies.

RFC 6797 — HSTS `includeSubDomains` directive
Findings (1)

Inspected the homepage Strict-Transport-Security header ("max-age=300") and the includeSubDomains directive is absent.

How: Parse the homepage Strict-Transport-Security header for the includeSubDomains directive (RFC 6797 §6.1.2).

  • HSTS header is missing the includeSubDomains directiveMEDIUM

    /

    What we found

    max-age=300

    What we expected

    Strict-Transport-Security: max-age=31536000; includeSubDomains

    Append ; includeSubDomains to your STS header once every subdomain you operate supports HTTPS.

How to fix · 2 steps · create a free account to viewCreate a free account →
FAILMEDIUM
MerchantReturnPolicy returnPolicyCategory uses valid Schema.org enummerchant-return-policy-category-enumReturns

Use a valid Schema.org returnPolicyCategory enum value

Why this matters: An invalid category is silently dropped — your policy looks present in the source but never renders in Google's return-policy rich result.

Google return-policy SD — returnPolicyCategory enum
Findings (11)

Validated returnPolicyCategory on 67 MerchantReturnPolicy nodes (0 valid Schema.org enum, 0%).

How: On each MerchantReturnPolicy node where returnPolicyCategory is set, accept the bare enum name or the schema.org URL form; reject any other string.

Coverage

0/67 · 0%

…and 1 more

How to fix · 2 steps · create a free account to viewCreate a free account →
NAMEDIUM
MerchantReturnPolicy merchantReturnLink URL is reachablemerchant-return-link-reachableReturns

Skipped — No MerchantReturnPolicy node carried a `merchantReturnLink` URL, so reachability has nothing to evaluate.

Context: A broken return-link makes Option B policies invisible — agents can't render or follow the link.

Google return-policy SD — merchantReturnLink reachability
Why this was skipped

No MerchantReturnPolicy node carried a merchantReturnLink URL, so reachability has nothing to evaluate.

How: Collect every unique merchantReturnLink URL across all MerchantReturnPolicy nodes; probe each once via politeFetch (failSoft). 2xx counts as reachable.

NAMEDIUM
MerchantReturnPolicy applicableCountry uses ISO 3166-1 alpha-2 codesmerchant-return-policy-applicable-country-isoReturns

Skipped — No MerchantReturnPolicy node carried `applicableCountry`, so the ISO-code check has nothing to evaluate.

Context: A non-ISO country is dropped silently; the policy looks present but never reaches the merchant-listing rich result.

Google return-policy SD — applicableCountry MUST be ISO alpha-2
Why this was skipped

No MerchantReturnPolicy node carried applicableCountry, so the ISO-code check has nothing to evaluate.

How: On each MerchantReturnPolicy node where applicableCountry is set, extract every candidate string and require every one to match /^[A-Z]{2}$/i.

NAMEDIUM
Each capability has version + spec + schemaucp-capability-required-fieldsUCP

Skipped — Profile declares no capabilities; required-field checks have nothing to evaluate.

Context: Capabilities missing version/spec/schema can't be matched against agent support tables — agents skip them silently.

UCP overview — capabilities
Why this was skipped

Profile declares no capabilities; required-field checks have nothing to evaluate.

How: For each capabilities[] entry, require non-empty string values for version, spec, and schema.

NAMEDIUM
Each service's `spec` URL origin matches its namespace authorityucp-service-spec-url-origin-matchesUCP

Skipped — No services declared a `spec` URL; origin matching has nothing to evaluate.

Context: A spec URL on an unrelated authority signals the service was copy-pasted from stale documentation — agents can't trust the conformance claim.

UCP overview — service specs
Why this was skipped

No services declared a spec URL; origin matching has nothing to evaluate.

How: For each service with a spec URL, require the URL origin to be a canonical UCP authority OR the host/path to include the namespace token.

FAILLOW
Product images meet Google’s 50,000-pixel area thresholdimage-area-50k-pixelsMerchant

Upload higher-resolution product images (area ≥ 50,000 pixels)

Why this matters: Tiny product images get dropped from Google’s shopping rich-result modules and are unhelpful to AI agents quoting your product visually.

Image quality (≥50K pixels area)
Findings (11)

Inspected <img width=… height=…> attributes on 20 sampled product pages (0 have at least one image with area ≥ 50,000 px; dimensions absent from HTML are not HEAD-probed and count as indeterminate).

How: For every sampled PDP, parse <img> tags and read explicit width and height attributes; a PDP passes when at least one image has width × height ≥ 50,000. PDPs without any explicit-dimension <img> are marked indeterminate (this check does not HEAD image URLs).

Coverage

0/20 · 0%

…and 1 more

How to fix · 2 steps · create a free account to viewCreate a free account →
FAILLOW
HSTS policy carries the preload directivehsts-preload-directiveHSTS

Add preload to your Strict-Transport-Security header and submit to hstspreload.org

Why this matters: HSTS preload-list inclusion is the strongest downgrade protection available — first-time visits are protected too.

RFC 6797 — HSTS `preload` directive (vendor extension)
Findings (1)

Inspected the homepage Strict-Transport-Security header ("max-age=300") and the preload directive is absent.

How: Parse the homepage Strict-Transport-Security header for the preload directive (hstspreload.org vendor extension to RFC 6797).

  • HSTS header is missing the preload directiveLOW

    /

    What we found

    max-age=300

    What we expected

    Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

    Append ; preload after includeSubDomains and submit your domain at https://hstspreload.org/.

How to fix · 3 steps · create a free account to viewCreate a free account →
FAILLOW
Product `aggregateRating` presentproduct-aggregate-rating-presentSchema.org

Add an AggregateRating to Product nodes when you have real reviews

Why this matters: Review ratings are a trust signal agents use to rank and filter products.

schema.org/AggregateRating
Findings (11)

Looked for a valid aggregateRating on Product JSON-LD across 20 sampled product pages (0 valid, 0%).

How: On each Product node, parse aggregateRating (or the first element if it's an array) and require ratingValue in [0,5] AND reviewCount or ratingCount ≥ 1.

Coverage

0/20 · 0%

…and 1 more

How to fix · 2 steps · create a free account to viewCreate a free account →
NALOW
OfferShippingDetails deliveryTime is a valid ShippingDeliveryTimeoffer-shipping-delivery-time-validShipping

Skipped — No OfferShippingDetails node carried `deliveryTime`, so the ShippingDeliveryTime check has nothing to evaluate.

Context: Without populated handling/transit times, agents can't quote a delivery window in shopping cards.

Google shipping-policy SD — deliveryTime as ShippingDeliveryTime
Why this was skipped

No OfferShippingDetails node carried deliveryTime, so the ShippingDeliveryTime check has nothing to evaluate.

How: On each OfferShippingDetails node where deliveryTime is set, require an object with at least one of handlingTime / transitTime populated as a QuantitativeValue.

NALOW
UCP MCP-transport entries have valid HTTPS endpointsucp-mcp-transport-validUCP

Skipped — Walked services[] for `transport: "mcp"` entries; none advertised.

Context: If you advertise MCP transport, agents will try to connect — broken or non-HTTPS endpoints fail silently and lose the integration.

UCP overview — transport declarations
Why this was skipped

Walked services[] for transport: "mcp" entries; none advertised.

How: Filter services[] to entries where transport=mcp and validate that endpoint is an absolute https:// URL.

FAILINFO
Apple Pay markers detected (informational)apple-pay-detectedSchema.org

Enable Apple Pay through your payment processor (informational only)

Why this matters: Apple Pay is a checkout-quality signal for human shoppers — informational only, does not affect the agent-readiness score.

Apple Pay availability — payment options observed
Findings (1)

Scanned the homepage and 20 sampled PDPs for Apple Pay markers; none matched.

How: Substring match on known Apple Pay SDK/markup signatures (ApplePaySession, apple-pay-button, /apple-developer-merchantid-domain-association) across the homepage and every sampled PDP HTML.

  • No Apple Pay markers detected on the homepage or PDPsINFO

    /

    Enable Apple Pay in your payment processor's dashboard (Stripe / Adyen / Braintree). Informational only — does not affect the score.

How to fix · 3 steps · create a free account to viewCreate a free account →
FAILINFO
Google Pay markers detected (informational)google-pay-detectedSchema.org

Enable Google Pay through your payment processor (informational only)

Why this matters: Google Pay is a checkout-quality signal for human shoppers — informational only, does not affect the agent-readiness score.

Google Pay availability — payment options observed
Findings (1)

Scanned the homepage and 20 sampled PDPs for Google Pay markers; none matched.

How: Substring match on known Google Pay SDK/markup signatures (pay.google.com/gp/p/js/pay.js, google.payments.api, <google-pay-button) across the homepage and every sampled PDP HTML.

  • No Google Pay markers detected on the homepage or PDPsINFO

    /

    Enable Google Pay in your payment processor's dashboard (Stripe / Adyen / Braintree). Informational only — does not affect the score.

How to fix · 3 steps · create a free account to viewCreate a free account →
NAINFO
llms.txt present (informational)llms-txt-presentllms.txt

Skipped — Looked for /llms.txt at the site root; the fetcher returned no file.

Context: An /llms.txt manifest points agents at your feed and key pages without them having to guess.

llmstxt.org — /llms.txt manifest
Why this was skipped

Looked for /llms.txt at the site root; the fetcher returned no file.

How: Check whether the fetcher reached an /llms.txt at the site root. Informational only — no failure path per llmstxt.org being a voluntary community convention.

Engine 2.0.0 · ACP 2026-04-17 · UCP 2026-04-08

Get notified when this score drops.

Paid plans auto-rescan your store weekly and email you when anything changes — incl. when ACP/UCP ships a new spec.

See plans · from $29/mo →