natori.com — AI Commerce Audit

HALFCRITICAL

HTTPS enforced sitewide + HSTS (≥ 6-month max-age)https-and-hsts-enforcedHSTS

Enforce HTTPS sitewide and ship a Strict-Transport-Security header with max-age ≥ 6 months

Why this matters: AI agents and payment flows refuse plain HTTP; weak HSTS is treated as effectively no HSTS by trust-and-safety scanners.

RFC 6797 — HTTP Strict Transport Security (HSTS)

−3.1impact

Findings (1)

Confirmed the homepage is HTTPS (status 200), probed http://natori.com/ for redirect behaviour, and parsed the Strict-Transport-Security header (value: "max-age=7889238").

How: URL scheme + homepage status check, an http://host/ redirect probe through politeFetch, and a Strict-Transport-Security max-age parse (RFC 6797; ≥ 180-day threshold).

HSTS max-age is below the 6-month minimumCRITICAL
/parsed max-age = 7889238s (need ≥ 15552000s = 180 days)
What we found
```
max-age=7889238
```
What we expected
```
Strict-Transport-Security: max-age=31536000; includeSubDomains
```
Bump max-age to at least 15552000 (180 days). 31536000 (1 year) is required for preload-list inclusion.

How to fix · 3 steps · create a free account to viewCreate a free account →

FAILHIGH

GTIN coverage on PDPsproduct-gtin-populatedSchema.orgMerchant

Populate gtin on every branded Product node

Why this matters: GTINs let agents match your product to the same item elsewhere; without them you lose cross-catalog matching.

schema.org/Product.gtin

−2impact

Findings (11)

Checked 20 sampled product pages for a GTIN in the Product JSON-LD (0 carry a valid GTIN, 0%).

How: Extract gtin / gtin8 / gtin12 / gtin13 / gtin14 from the first Product JSON-LD node on each PDP; validate digit length.

Coverage

0/20 · 0%

No valid GTIN on this product pageHIGH× 10
Populate gtin/gtin8/gtin12/gtin13/gtin14 with the manufacturer's barcode.
Affected (10)

…and 1 more

How to fix · 2 steps · create a free account to viewCreate a free account →

FAILHIGH

MerchantReturnPolicy node present on Product or Offermerchant-return-policy-presentReturnsSchema.org

Emit hasMerchantReturnPolicy on Product or Offer JSON-LD

Why this matters: Without the entry-point return-policy node, agents can't render or quote your return terms — they fall back to platform defaults or skip your store.

Google return-policy structured data — entry-point field

−1.8impact

Findings (11)

Inspected hasMerchantReturnPolicy on Product/Offer JSON-LD across 20 sampled product pages (0 present, 0%).

How: On each PDP, locate the Product JSON-LD node and check for a hasMerchantReturnPolicy object/array at Product level OR Offer level. Pass band ≥ 85% coverage, partial ≥ 50%.

Coverage

0/20 · 0%

Product JSON-LD missing hasMerchantReturnPolicyHIGH× 10
Add a MerchantReturnPolicy node to Product or Offer with category + applicableCountry (or merchantReturnLink).
Affected (10)

…and 1 more

How to fix · 2 steps · create a free account to viewCreate a free account →

FAILHIGH

Offer JSON-LD carries shippingDetails (OfferShippingDetails)offer-shipping-details-presentSchema.orgShipping

Emit shippingDetails (OfferShippingDetails) on Offer JSON-LD

Why this matters: Without shippingDetails, AI agents fall back to vague defaults — they can't quote your rates, destinations, or delivery windows in shopping cards.

schema.org/OfferShippingDetails

−1.8impact

Findings (11)

Inspected shippingDetails on Product/Offer JSON-LD across 20 sampled PDPs (0 present, 0%).

How: On each PDP, locate the Product JSON-LD node and check for shippingDetails (single object or array) at Product or Offer level. Pass band ≥ 85% coverage.

Coverage

0/20 · 0%

Offer JSON-LD missing shippingDetailsHIGH× 10
Add OfferShippingDetails with shippingRate, shippingDestination, and deliveryTime.
Affected (10)

…and 1 more

How to fix · 2 steps · create a free account to viewCreate a free account →

FAILHIGH

UCP profile carries all four required top-level keysucp-profile-required-keysUCP

Add every required top-level key to the UCP profile

Why this matters: A profile missing one of the four required keys is treated as non-conformant — agent runtimes fall back to default behaviour and may skip the merchant.

UCP overview — required profile keys

−1.7impact

Findings (1)

Profile is missing required key(s): signing_keys.

How: Read the profile root (or top-level ucp wrapper) and verify the presence of version, services, capabilities, and signing_keys keys.

Required top-level key signing_keys is missingHIGH
/.well-known/ucp
What we expected
```
Add a top-level "signing_keys" field to the JSON document (empty array/object is fine).
```
Set signing_keys at the root of the JSON document.

How to fix · 2 steps · create a free account to viewCreate a free account →

HALFHIGH

Product `image` populatedproduct-image-populatedSchema.orgMerchant

Add a resolvable image URL to every Product node

Why this matters: Agents show your product image in shopping cards; a missing image weakens or drops the listing.

schema.org/Product.image

−1.3impact

Findings (8)

Read the image field on Product JSON-LD across 20 sampled product pages (12 resolve at least one URL, 60%).

How: Resolve image on each Product node into a list of URL strings (string, array, or ImageObject.url/contentUrl); require at least one non-empty URL.

Coverage

12/20 · 60%

Product JSON-LD has no resolvable image URLHIGH× 8
Set image to an absolute URL or array of URLs.
Affected (8)

How to fix · 3 steps · create a free account to viewCreate a free account →

NAHIGH

MerchantReturnPolicy finite-window has positive merchantReturnDaysmerchant-return-policy-finite-daysReturns

Skipped — No MerchantReturnPolicy node used the MerchantReturnFiniteReturnWindow category, so the `merchantReturnDays` check has nothing to evaluate.

Context: AI agents quote your concrete return window in shopping cards. Without `merchantReturnDays`, your policy renders as 'has a return policy' without the headline number.

Google return-policy SD — merchantReturnDays required for finite windows

Not scoredimpact

Why this was skipped

No MerchantReturnPolicy node used the MerchantReturnFiniteReturnWindow category, so the merchantReturnDays check has nothing to evaluate.

How: For each MerchantReturnPolicy node whose returnPolicyCategory normalizes to MerchantReturnFiniteReturnWindow, require merchantReturnDays to be a positive number (or a numeric string > 0).

NAHIGH

MerchantReturnPolicy satisfies Option A (country+category) or B (returnLink)merchant-return-policy-option-a-or-bReturnsSchema.org

Skipped — No PDP carried a `hasMerchantReturnPolicy` node, so Option A/B shape cannot be evaluated.

Context: A policy node missing both shapes is invisible to agents — they can't render it, link to it, or quote your return terms.

Google return-policy SD — required-shape MUSTs

Not scoredimpact

Why this was skipped

No PDP carried a hasMerchantReturnPolicy node, so Option A/B shape cannot be evaluated.

How: For each PDP, walk every hasMerchantReturnPolicy node (Product or Offer level) and require either (applicableCountry + returnPolicyCategory) OR a syntactically-valid merchantReturnLink URL.

NAHIGH

UCP profile Cache-Control is shared-cacheable with max-age ≥ 60sucp-cache-headers-validUCP

Skipped — the runner did not surface transport metadata

Context: If your UCP profile says `no-cache`, agent runtimes re-fetch on every interaction — brittle at scale and prone to rate-limit failures.

UCP overview — profile caching

Not scoredimpact

Why this was skipped

Wanted to inspect the UCP profile's Cache-Control header, but the runner did not surface transport metadata.

How: Parse the Cache-Control header on the /.well-known/ucp response; require public, max-age ≥ 60, and no no-store/no-cache/private.

Transport metadata not available — runner update pendingLOW
/.well-known/ucp
This check activates once the runner (Task I1) populates ctx.wellKnownUcp.cacheControl.

NAHIGH

Every signing_keys[] entry is a valid JWKucp-signing-keys-validJWKS

Skipped — Profile declares no signing_keys; JWK validation has no entries to evaluate.

Context: Malformed JWK entries are rejected silently by agents — signed payloads cannot be verified and the merchant loses trust signal.

RFC 7517 — JSON Web Key (JWK)

Not scoredimpact

Why this was skipped

Profile declares no signing_keys; JWK validation has no entries to evaluate.

How: Walk signing_keys[] and validate each entry per RFC 7517 §4.1 (kty required) + RFC 7518 §6 (kty-specific required parameters). kid is OPTIONAL per RFC 7517 §4.5 and not enforced here.

FAILMEDIUM

HSTS policy carries the includeSubDomains directivehsts-include-subdomainsHSTS

Add includeSubDomains to your Strict-Transport-Security header

Why this matters: Without includeSubDomains, an HTTP subdomain (staging, mail, …) can be used to attack the apex's cookies.

RFC 6797 — HSTS `includeSubDomains` directive

−1.2impact

Findings (1)

Inspected the homepage Strict-Transport-Security header ("max-age=7889238") and the includeSubDomains directive is absent.

How: Parse the homepage Strict-Transport-Security header for the includeSubDomains directive (RFC 6797 §6.1.2).

HSTS header is missing the includeSubDomains directiveMEDIUM
/
What we found
```
max-age=7889238
```
What we expected
```
Strict-Transport-Security: max-age=31536000; includeSubDomains
```
Append ; includeSubDomains to your STS header once every subdomain you operate supports HTTPS.

How to fix · 2 steps · create a free account to viewCreate a free account →

NAMEDIUM

MerchantReturnPolicy merchantReturnLink URL is reachablemerchant-return-link-reachableReturns

Skipped — No MerchantReturnPolicy node carried a `merchantReturnLink` URL, so reachability has nothing to evaluate.

Context: A broken return-link makes Option B policies invisible — agents can't render or follow the link.

Google return-policy SD — merchantReturnLink reachability

Not scoredimpact

Why this was skipped

No MerchantReturnPolicy node carried a merchantReturnLink URL, so reachability has nothing to evaluate.

How: Collect every unique merchantReturnLink URL across all MerchantReturnPolicy nodes; probe each once via politeFetch (failSoft). 2xx counts as reachable.

NAMEDIUM

MerchantReturnPolicy applicableCountry uses ISO 3166-1 alpha-2 codesmerchant-return-policy-applicable-country-isoReturns

Skipped — No MerchantReturnPolicy node carried `applicableCountry`, so the ISO-code check has nothing to evaluate.

Context: A non-ISO country is dropped silently; the policy looks present but never reaches the merchant-listing rich result.

Google return-policy SD — applicableCountry MUST be ISO alpha-2

Not scoredimpact

Why this was skipped

No MerchantReturnPolicy node carried applicableCountry, so the ISO-code check has nothing to evaluate.

How: On each MerchantReturnPolicy node where applicableCountry is set, extract every candidate string and require every one to match /^[A-Z]{2}$/i.

NAMEDIUM

MerchantReturnPolicy returnPolicyCategory uses valid Schema.org enummerchant-return-policy-category-enumReturns

Skipped — No MerchantReturnPolicy node carried `returnPolicyCategory`, so the enum check has nothing to evaluate.

Context: An invalid category is silently dropped — your policy looks present in the source but never renders in Google's return-policy rich result.

Google return-policy SD — returnPolicyCategory enum

Not scoredimpact

Why this was skipped

No MerchantReturnPolicy node carried returnPolicyCategory, so the enum check has nothing to evaluate.

How: On each MerchantReturnPolicy node where returnPolicyCategory is set, accept the bare enum name or the schema.org URL form; reject any other string.

NAMEDIUM

OfferShippingDetails shippingDestination is a valid DefinedRegionoffer-shipping-destination-validShipping

Skipped — No OfferShippingDetails node carried `shippingDestination`, so the DefinedRegion check has nothing to evaluate.

Context: Without a valid destination region, your shipping rate has no scope — Google can't decide whether to render it for a given shopper's country.

Google shipping-policy SD — shippingDestination as DefinedRegion

Not scoredimpact

Why this was skipped

No OfferShippingDetails node carried shippingDestination, so the DefinedRegion check has nothing to evaluate.

How: On each OfferShippingDetails node where shippingDestination is set, require it to be a DefinedRegion (or array) and every entry to carry addressCountry matching /^[A-Z]{2}$/i.

NAMEDIUM

OfferShippingDetails shippingRate is a valid MonetaryAmountoffer-shipping-rate-validShipping

Skipped — No OfferShippingDetails node carried `shippingRate`, so the MonetaryAmount check has nothing to evaluate.

Context: An invalid rate object is silently dropped; agents can't quote your shipping cost in shopping cards.

Google shipping-policy SD — shippingRate as MonetaryAmount

Not scoredimpact

Why this was skipped

No OfferShippingDetails node carried shippingRate, so the MonetaryAmount check has nothing to evaluate.

How: On each OfferShippingDetails node where shippingRate is set, require an object with numeric value/maxValue (typed or numeric string) and a 3-letter ISO 4217 currency.

NAMEDIUM

Each capability has version + spec + schemaucp-capability-required-fieldsUCP

Skipped — Profile declares no capabilities; required-field checks have nothing to evaluate.

Context: Capabilities missing version/spec/schema can't be matched against agent support tables — agents skip them silently.

UCP overview — capabilities

Not scoredimpact

Why this was skipped

Profile declares no capabilities; required-field checks have nothing to evaluate.

How: For each capabilities[] entry, require non-empty string values for version, spec, and schema.

FAILLOW

HSTS policy carries the preload directivehsts-preload-directiveHSTS

Add preload to your Strict-Transport-Security header and submit to hstspreload.org

Why this matters: HSTS preload-list inclusion is the strongest downgrade protection available — first-time visits are protected too.

RFC 6797 — HSTS `preload` directive (vendor extension)

−0.3impact

Findings (1)

Inspected the homepage Strict-Transport-Security header ("max-age=7889238") and the preload directive is absent.

How: Parse the homepage Strict-Transport-Security header for the preload directive (hstspreload.org vendor extension to RFC 6797).

HSTS header is missing the preload directiveLOW
/
What we found
```
max-age=7889238
```
What we expected
```
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
```
Append ; preload after includeSubDomains and submit your domain at https://hstspreload.org/.

How to fix · 3 steps · create a free account to viewCreate a free account →

FAILLOW

Product `aggregateRating` presentproduct-aggregate-rating-presentSchema.org

Add an AggregateRating to Product nodes when you have real reviews

Why this matters: Review ratings are a trust signal agents use to rank and filter products.

schema.org/AggregateRating

−0.3impact

Findings (11)

Looked for a valid aggregateRating on Product JSON-LD across 20 sampled product pages (0 valid, 0%).

How: On each Product node, parse aggregateRating (or the first element if it's an array) and require ratingValue in [0,5] AND reviewCount or ratingCount ≥ 1.

Coverage

0/20 · 0%

Product has no valid AggregateRating (ratingValue 0-5 + reviewCount/ratingCount ≥ 1)LOW× 10
Render aggregateRating from real review totals — never fabricate.
Affected (10)

…and 1 more

How to fix · 2 steps · create a free account to viewCreate a free account →

FAILLOW

Alt text on at least 80% of PDP imagesimage-alt-text-coverageWCAG

Add descriptive alt text to product images (WCAG 2.x SC 1.1.1)

Why this matters: Alt text is the only text description AI agents and screen readers have for your product imagery.

WCAG 2.x SC 1.1.1 — Non-text Content

−0.3impact

Findings (11)

Parsed <img> alt attributes across 20 sampled product pages (0 have alt text on at least 80% of images).

How: Per PDP, count <img> tags via regex; a tag 'has alt text' when its alt attribute is present AND non-empty after trim. A PDP passes when it carries no <img> at all OR ≥80% of its <img> tags have non-empty alt.

Coverage

0/20 · 0%

Most images on this product page lack alt textLOW× 10
What we expected
```
<img src="/img/sneaker.webp" alt="Red leather running shoe, side view" />
```
Populate the alt attribute on each <img> with a description of what the image shows; use alt="" only for decorative images.
Affected (10)
- /products/congo-robe-fuchsia1/62 <img> tags have non-empty alt (2%)
- /products/congo-gown-fuchsia1/62 <img> tags have non-empty alt (2%)
- /products/kumo-printed-stretch-satin-caftan-kum…1/58 <img> tags have non-empty alt (2%)
- /products/nirvana-cozy-brushed-terry-robe-laven…2/51 <img> tags have non-empty alt (4%)
- /products/coco-icon-notch-pj-rose-quartz2/51 <img> tags have non-empty alt (4%)
- /products/fleur-dragon-printed-challis-pj-set-f…1/58 <img> tags have non-empty alt (2%)
- /products/harvest-printed-satin-robe-harvest-bl…1/58 <img> tags have non-empty alt (2%)
- /products/harvest-printed-satin-slip-dress-harv…2/51 <img> tags have non-empty alt (4%)
- /products/harvest-printed-satin-mandarin-pj-set…1/58 <img> tags have non-empty alt (2%)
- /products/satin-essentials-wide-leg-pants-wheat1/58 <img> tags have non-empty alt (2%)

…and 1 more

How to fix · 3 steps · create a free account to viewCreate a free account →

FAILLOW

BreadcrumbList present on PDPsbreadcrumb-list-presentSchema.org

Add a BreadcrumbList JSON-LD block to every PDP

Why this matters: Breadcrumbs help agents understand where a product sits in your catalog.

schema.org/BreadcrumbList

−0.2impact

Findings (11)

Searched JSON-LD on 20 sampled product pages for a BreadcrumbList (0 found, 0%).

How: Search every JSON-LD block on each PDP for @type: BreadcrumbList with a non-empty itemListElement.

Coverage

0/20 · 0%

No BreadcrumbList JSON-LD with a populated itemListElementLOW× 10
Add a BreadcrumbList JSON-LD block walking Home → Category → Product.
Affected (10)

…and 1 more

How to fix · 2 steps · create a free account to viewCreate a free account →

NALOW

MerchantReturnPolicy enrichment enums use valid Schema.org valuesmerchant-return-policy-enums-validReturns

Skipped — No MerchantReturnPolicy node carried returnFees, returnMethod, or refundType, so the enum check has nothing to evaluate.

Context: Invalid enrichment values are dropped silently, leaving merchants confused about why their rendered policy is missing fields they configured.

Google return-policy SD — enum field constraints

Not scoredimpact

Why this was skipped

No MerchantReturnPolicy node carried returnFees, returnMethod, or refundType, so the enum check has nothing to evaluate.

How: On each MerchantReturnPolicy node, inspect returnFees/returnMethod/refundType if set; require the bare name or schema.org URL form of a value in the corresponding Schema.org enum.

NALOW

OfferShippingDetails deliveryTime is a valid ShippingDeliveryTimeoffer-shipping-delivery-time-validShipping

Skipped — No OfferShippingDetails node carried `deliveryTime`, so the ShippingDeliveryTime check has nothing to evaluate.

Context: Without populated handling/transit times, agents can't quote a delivery window in shopping cards.

Google shipping-policy SD — deliveryTime as ShippingDeliveryTime

Not scoredimpact

Why this was skipped

No OfferShippingDetails node carried deliveryTime, so the ShippingDeliveryTime check has nothing to evaluate.

How: On each OfferShippingDetails node where deliveryTime is set, require an object with at least one of handlingTime / transitTime populated as a QuantitativeValue.

FAILINFO

Apple Pay markers detected (informational)apple-pay-detectedSchema.org

Enable Apple Pay through your payment processor (informational only)

Why this matters: Apple Pay is a checkout-quality signal for human shoppers — informational only, does not affect the agent-readiness score.

Apple Pay availability — payment options observed

No score impactimpact

Findings (1)

Scanned the homepage and 20 sampled PDPs for Apple Pay markers; none matched.

How: Substring match on known Apple Pay SDK/markup signatures (ApplePaySession, apple-pay-button, /apple-developer-merchantid-domain-association) across the homepage and every sampled PDP HTML.

No Apple Pay markers detected on the homepage or PDPsINFO
/
Enable Apple Pay in your payment processor's dashboard (Stripe / Adyen / Braintree). Informational only — does not affect the score.

How to fix · 3 steps · create a free account to viewCreate a free account →

FAILINFO

Google Pay markers detected (informational)google-pay-detectedSchema.org

Enable Google Pay through your payment processor (informational only)

Why this matters: Google Pay is a checkout-quality signal for human shoppers — informational only, does not affect the agent-readiness score.

Google Pay availability — payment options observed

No score impactimpact

Findings (1)

Scanned the homepage and 20 sampled PDPs for Google Pay markers; none matched.

How: Substring match on known Google Pay SDK/markup signatures (pay.google.com/gp/p/js/pay.js, google.payments.api, <google-pay-button) across the homepage and every sampled PDP HTML.

No Google Pay markers detected on the homepage or PDPsINFO
/
Enable Google Pay in your payment processor's dashboard (Stripe / Adyen / Braintree). Informational only — does not affect the score.

How to fix · 3 steps · create a free account to viewCreate a free account →

13 failing · 12 not checked · 25 shown