A

mccormick.com

Audited 1 day ago· shopify

PDFShareSign in to re-audit
85
Grade B

Agent-readiness across all five AI commerce surfaces.

Surfaces — click to filter

13 failing · 5 not checked · 18 shown

5 checks couldn't run on this store — each is listed below with the reason. Your score reflects only what we could verify.

FAILCRITICAL
Offer price + priceCurrency validoffer-price-currency-validMerchantSchema.org

Set price as a number and priceCurrency as an ISO 4217 code

Why this matters: Agents need a price with a currency to show and compare your product.

Google merchant listing — price + priceCurrency required
Findings (10)

Parsed Offer price and priceCurrency on Product JSON-LD across 20 sampled product pages (10 valid, 50%).

How: Parse Offer price (or AggregateOffer lowPrice) as a parseable numeric price ≥ 0; require priceCurrency to match /^[A-Z]{3}$/i.

Coverage

10/20 · 50%

How to fix · 2 steps · create a free account to viewCreate a free account →
HALFCRITICAL
HTTPS enforced sitewide + HSTS (≥ 6-month max-age)https-and-hsts-enforcedHSTS

Enforce HTTPS sitewide and ship a Strict-Transport-Security header with max-age ≥ 6 months

Why this matters: AI agents and payment flows refuse plain HTTP; weak HSTS is treated as effectively no HSTS by trust-and-safety scanners.

RFC 6797 — HTTP Strict Transport Security (HSTS)
Findings (1)

Confirmed the homepage is HTTPS (status 200), probed http://mccormick.com/ for redirect behaviour, and parsed the Strict-Transport-Security header (value: "max-age=7889238").

How: URL scheme + homepage status check, an http://host/ redirect probe through politeFetch, and a Strict-Transport-Security max-age parse (RFC 6797; ≥ 180-day threshold).

  • HSTS max-age is below the 6-month minimumCRITICAL

    /parsed max-age = 7889238s (need ≥ 15552000s = 180 days)

    What we found

    max-age=7889238

    What we expected

    Strict-Transport-Security: max-age=31536000; includeSubDomains

    Bump max-age to at least 15552000 (180 days). 31536000 (1 year) is required for preload-list inclusion.

How to fix · 3 steps · create a free account to viewCreate a free account →
FAILHIGH
UCP profile carries all four required top-level keysucp-profile-required-keysUCP

Add every required top-level key to the UCP profile

Why this matters: A profile missing one of the four required keys is treated as non-conformant — agent runtimes fall back to default behaviour and may skip the merchant.

UCP overview — required profile keys
Findings (1)

Profile is missing required key(s): signing_keys.

How: Read the profile root (or top-level ucp wrapper) and verify the presence of version, services, capabilities, and signing_keys keys.

  • Required top-level key signing_keys is missingHIGH

    /.well-known/ucp

    What we expected

    Add a top-level "signing_keys" field to the JSON document (empty array/object is fine).

    Set signing_keys at the root of the JSON document.

How to fix · 2 steps · create a free account to viewCreate a free account →
HALFHIGH
Offer `availability` is a Schema.org URLoffer-availability-schema-urlSchema.org

Use a canonical Schema.org availability IRI on every Offer

Why this matters: Agents suppress out-of-stock or ambiguous items; a valid availability URL keeps you eligible.

schema.org/ItemAvailability
Findings (10)

Checked Offer availability on 20 sampled product pages with an Offer (10 use a canonical Schema.org URL, 50%).

How: On each Offer, accept availability only if it matches one of the canonical Schema.org ItemAvailability IRIs (http or https, trailing slash optional).

Coverage

10/20 · 50%

How to fix · 2 steps · create a free account to viewCreate a free account →
HALFHIGH
GTIN coverage on PDPsproduct-gtin-populatedSchema.orgMerchant

Populate gtin on every branded Product node

Why this matters: GTINs let agents match your product to the same item elsewhere; without them you lose cross-catalog matching.

schema.org/Product.gtin
Findings (8)

Checked 20 sampled product pages for a GTIN in the Product JSON-LD (12 carry a valid GTIN, 60%).

How: Extract gtin / gtin8 / gtin12 / gtin13 / gtin14 from the first Product JSON-LD node on each PDP; validate digit length.

Coverage

12/20 · 60%

How to fix · 2 steps · create a free account to viewCreate a free account →
NAHIGH
UCP profile Cache-Control is shared-cacheable with max-age ≥ 60sucp-cache-headers-validUCP

Skipped — the runner did not surface transport metadata

Context: If your UCP profile says `no-cache`, agent runtimes re-fetch on every interaction — brittle at scale and prone to rate-limit failures.

UCP overview — profile caching
Why this was skipped

Wanted to inspect the UCP profile's Cache-Control header, but the runner did not surface transport metadata.

How: Parse the Cache-Control header on the /.well-known/ucp response; require public, max-age ≥ 60, and no no-store/no-cache/private.

  • Transport metadata not available — runner update pendingLOW

    /.well-known/ucp

    This check activates once the runner (Task I1) populates ctx.wellKnownUcp.cacheControl.

NAHIGH
Every signing_keys[] entry is a valid JWKucp-signing-keys-validJWKS

Skipped — Profile declares no signing_keys; JWK validation has no entries to evaluate.

Context: Malformed JWK entries are rejected silently by agents — signed payloads cannot be verified and the merchant loses trust signal.

RFC 7517 — JSON Web Key (JWK)
Why this was skipped

Profile declares no signing_keys; JWK validation has no entries to evaluate.

How: Walk signing_keys[] and validate each entry per RFC 7517 §4.1 (kty required) + RFC 7518 §6 (kty-specific required parameters). kid is OPTIONAL per RFC 7517 §4.5 and not enforced here.

FAILMEDIUM
HSTS policy carries the includeSubDomains directivehsts-include-subdomainsHSTS

Add includeSubDomains to your Strict-Transport-Security header

Why this matters: Without includeSubDomains, an HTTP subdomain (staging, mail, …) can be used to attack the apex's cookies.

RFC 6797 — HSTS `includeSubDomains` directive
Findings (1)

Inspected the homepage Strict-Transport-Security header ("max-age=7889238") and the includeSubDomains directive is absent.

How: Parse the homepage Strict-Transport-Security header for the includeSubDomains directive (RFC 6797 §6.1.2).

  • HSTS header is missing the includeSubDomains directiveMEDIUM

    /

    What we found

    max-age=7889238

    What we expected

    Strict-Transport-Security: max-age=31536000; includeSubDomains

    Append ; includeSubDomains to your STS header once every subdomain you operate supports HTTPS.

How to fix · 2 steps · create a free account to viewCreate a free account →
FAILMEDIUM
Organization/OnlineStore JSON-LD with contactPoint on homepageorganization-jsonld-with-contactSchema.org

Add an Organization (or OnlineStore) JSON-LD block to your homepage with a contactPoint

Why this matters: Organization markup with a contactPoint tells AI agents who you are and how a shopper can reach you for support.

schema.org/Organization (and OnlineStore subclass) with contactPoint
Findings (1)

Parsed the homepage JSON-LD looking for an Organization/OnlineStore node with a contactPoint, but no Organization-class node is present.

How: Parse homepage <script type="application/ld+json"> blocks, flatten @graph, and look for an Organization/OnlineStore/Store node with a contactPoint carrying email or telephone.

  • No Organization/OnlineStore JSON-LD on homepageMEDIUM

    /

    What we expected

    <script type="application/ld+json">{"@context":"https://schema.org","@type":"OnlineStore","name":"Example Store","url":"https://example.com","contactPoint":[{"@type":"ContactPoint","contactType":"customer service","email":"support@example.com"}]}</script>

    Add an Organization (or OnlineStore) JSON-LD block in the homepage <head> with a contactPoint.

How to fix · 3 steps · create a free account to viewCreate a free account →
FAILMEDIUM
Shipping policy page reachableshipping-policy-page-reachableMerchant

Publish a shipping policy page and link it from your site nav/footer

Why this matters: Agents quote shipping terms to shoppers; without a reachable shipping policy they fall back to vague defaults or skip your store.

Google merchant listing — shipping policy
Findings (1)

Probed 4 candidate shipping-policy paths (nav-discovered + platform-conventional) and none returned a 2xx body.

How: Discover candidate URLs by scoring homepage nav/footer anchors for shipping/delivery/dispatch keywords, then append platform-conventional paths; probe each with politeFetch and pass on the first 2xx with ≥200 stripped-body chars.

  • No shipping policy page reachable at any candidate URLMEDIUM

    statuses: /policies/shipping-policy=404, /shipping=404, /shipping-policy=404, /pages/shipping=404

    Publish a shipping policy page at /shipping-policy (or your platform's standard slug) with ≥200 chars of body text and link it from your footer.

How to fix · 2 steps · create a free account to viewCreate a free account →
NAMEDIUM
MerchantReturnPolicy merchantReturnLink URL is reachablemerchant-return-link-reachableReturns

Skipped — No MerchantReturnPolicy node carried a `merchantReturnLink` URL, so reachability has nothing to evaluate.

Context: A broken return-link makes Option B policies invisible — agents can't render or follow the link.

Google return-policy SD — merchantReturnLink reachability
Why this was skipped

No MerchantReturnPolicy node carried a merchantReturnLink URL, so reachability has nothing to evaluate.

How: Collect every unique merchantReturnLink URL across all MerchantReturnPolicy nodes; probe each once via politeFetch (failSoft). 2xx counts as reachable.

NAMEDIUM
Each capability has version + spec + schemaucp-capability-required-fieldsUCP

Skipped — Profile declares no capabilities; required-field checks have nothing to evaluate.

Context: Capabilities missing version/spec/schema can't be matched against agent support tables — agents skip them silently.

UCP overview — capabilities
Why this was skipped

Profile declares no capabilities; required-field checks have nothing to evaluate.

How: For each capabilities[] entry, require non-empty string values for version, spec, and schema.

FAILLOW
HSTS policy carries the preload directivehsts-preload-directiveHSTS

Add preload to your Strict-Transport-Security header and submit to hstspreload.org

Why this matters: HSTS preload-list inclusion is the strongest downgrade protection available — first-time visits are protected too.

RFC 6797 — HSTS `preload` directive (vendor extension)
Findings (1)

Inspected the homepage Strict-Transport-Security header ("max-age=7889238") and the preload directive is absent.

How: Parse the homepage Strict-Transport-Security header for the preload directive (hstspreload.org vendor extension to RFC 6797).

  • HSTS header is missing the preload directiveLOW

    /

    What we found

    max-age=7889238

    What we expected

    Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

    Append ; preload after includeSubDomains and submit your domain at https://hstspreload.org/.

How to fix · 3 steps · create a free account to viewCreate a free account →
FAILLOW
Product `aggregateRating` presentproduct-aggregate-rating-presentSchema.org

Add an AggregateRating to Product nodes when you have real reviews

Why this matters: Review ratings are a trust signal agents use to rank and filter products.

schema.org/AggregateRating
Findings (11)

Looked for a valid aggregateRating on Product JSON-LD across 20 sampled product pages (0 valid, 0%).

How: On each Product node, parse aggregateRating (or the first element if it's an array) and require ratingValue in [0,5] AND reviewCount or ratingCount ≥ 1.

Coverage

0/20 · 0%

…and 1 more

How to fix · 2 steps · create a free account to viewCreate a free account →
FAILLOW
Alt text on at least 80% of PDP imagesimage-alt-text-coverageWCAG

Add descriptive alt text to product images (WCAG 2.x SC 1.1.1)

Why this matters: Alt text is the only text description AI agents and screen readers have for your product imagery.

WCAG 2.x SC 1.1.1 — Non-text Content
Findings (11)

Parsed <img> alt attributes across 20 sampled product pages (0 have alt text on at least 80% of images).

How: Per PDP, count <img> tags via regex; a tag 'has alt text' when its alt attribute is present AND non-empty after trim. A PDP passes when it carries no <img> at all OR ≥80% of its <img> tags have non-empty alt.

Coverage

0/20 · 0%

…and 1 more

How to fix · 3 steps · create a free account to viewCreate a free account →
NALOW
Declarative WebMCP forms are validwebmcp-declarative-tools-validwebmcp

Skipped — No declarative WebMCP forms found on the homepage or sampled product pages. WebMCP is an optional, experimental browser-agent capability — not in scope until advertised.

Context: If you expose WebMCP tools, browser agents call them directly instead of scraping — but a tool missing its name or description is unusable to the agent.

WebMCP — declarative form API
Why this was skipped

No declarative WebMCP forms found on the homepage or sampled product pages. WebMCP is an optional, experimental browser-agent capability — not in scope until advertised.

How: Parse the homepage and sampled PDP HTML for <form> elements carrying WebMCP attributes (toolname/tooldescription/toolautosubmit), then validate each against the 5 declarative-form rules.

FAILINFO
Apple Pay markers detected (informational)apple-pay-detectedSchema.org

Enable Apple Pay through your payment processor (informational only)

Why this matters: Apple Pay is a checkout-quality signal for human shoppers — informational only, does not affect the agent-readiness score.

Apple Pay availability — payment options observed
Findings (1)

Scanned the homepage and 20 sampled PDPs for Apple Pay markers; none matched.

How: Substring match on known Apple Pay SDK/markup signatures (ApplePaySession, apple-pay-button, /apple-developer-merchantid-domain-association) across the homepage and every sampled PDP HTML.

  • No Apple Pay markers detected on the homepage or PDPsINFO

    /

    Enable Apple Pay in your payment processor's dashboard (Stripe / Adyen / Braintree). Informational only — does not affect the score.

How to fix · 3 steps · create a free account to viewCreate a free account →
FAILINFO
Google Pay markers detected (informational)google-pay-detectedSchema.org

Enable Google Pay through your payment processor (informational only)

Why this matters: Google Pay is a checkout-quality signal for human shoppers — informational only, does not affect the agent-readiness score.

Google Pay availability — payment options observed
Findings (1)

Scanned the homepage and 20 sampled PDPs for Google Pay markers; none matched.

How: Substring match on known Google Pay SDK/markup signatures (pay.google.com/gp/p/js/pay.js, google.payments.api, <google-pay-button) across the homepage and every sampled PDP HTML.

  • No Google Pay markers detected on the homepage or PDPsINFO

    /

    Enable Google Pay in your payment processor's dashboard (Stripe / Adyen / Braintree). Informational only — does not affect the score.

How to fix · 3 steps · create a free account to viewCreate a free account →
Engine 2.0.0 · ACP 2026-04-17 · UCP 2026-04-08

Get notified when this score drops.

Paid plans auto-rescan your store weekly and email you when anything changes — incl. when ACP/UCP ships a new spec.

See plans · from $29/mo →