Confirmed the homepage is HTTPS (status 200), probed http://owletcare.com/ for redirect behaviour, and parsed the Strict-Transport-Security header (value: "max-age=7889238").

How: URL scheme + homepage status check, an http://host/ redirect probe through politeFetch, and a Strict-Transport-Security max-age parse (RFC 6797; ≥ 180-day threshold).

• HSTS max-age is below the 6-month minimum■CRITICALCRITICAL severity — weight 10 in score calculation.

  /parsed max-age = 7889238s (need ≥ 15552000s = 180 days)

  What we found

  max-age=7889238

  What we expected

  Strict-Transport-Security: max-age=31536000; includeSubDomains

  Bump max-age to at least 15552000 (180 days). 31536000 (1 year) is required for preload-list inclusion.

Probed 4 candidate contact-page paths and none returned a 2xx response.

How: URL probe of contact paths; the first 2xx body is scanned for mailto: / tel: hrefs, plain emails (placeholder hosts excluded), and phone-shaped numbers.

• No contact page reachable▲HIGHHIGH severity — weight 5 in score calculation.

  statuses: /pages/contact=403, /pages/contact-us=403, /contact=403, /contact-us=404

  Publish a contact page at /contact (or your platform's standard path) with a mailto: and/or tel: link.

Checked 20 sampled product pages for a GTIN in the Product JSON-LD (0 carry a valid GTIN, 0%).

How: Extract gtin / gtin8 / gtin12 / gtin13 / gtin14 from the first Product JSON-LD node on each PDP; validate digit length.

• No valid GTIN on this product page▲HIGHHIGH severity — weight 5 in score calculation.× 10

  Populate gtin/gtin8/gtin12/gtin13/gtin14 with the manufacturer's barcode.

  Affected (10)

  • /products/owlet-x-divi-bundle
  • /products/dream-sock-charging-cord-and-power-ad…
  • /products/nursery-of-hope-tree-seedling
  • /products/when-baby-sleeps-childrens-book
  • /products/advocate-like-a-mother-t-shirt
  • /products/dad-vocate-t-shirt
  • /products/sleep-mask
  • /products/dream-sight-power-cable
  • /products/dream-sight-mounting-kit
  • /products/cam-2-power-cable

…and 1 more

Profile is missing required key(s): signing_keys.

How: Read the profile root (or top-level ucp wrapper) and verify the presence of version, services, capabilities, and signing_keys keys.

• Required top-level key signing_keys is missing▲HIGHHIGH severity — weight 5 in score calculation.

  /.well-known/ucp

  What we expected

  Add a top-level "signing_keys" field to the JSON document (empty array/object is fine).

  Set signing_keys at the root of the JSON document.

Wanted to inspect the UCP profile's Cache-Control header, but the runner did not surface transport metadata.

How: Parse the Cache-Control header on the /.well-known/ucp response; require public, max-age ≥ 60, and no no-store/no-cache/private.

• Transport metadata not available — runner update pending●LOWLOW severity — weight 1 in score calculation.

  /.well-known/ucp

  This check activates once the runner (Task I1) populates ctx.wellKnownUcp.cacheControl.

Profile declares no signing_keys; JWK validation has no entries to evaluate.

How: Walk signing_keys[] and validate each entry per RFC 7517 §4.1 (kty required) + RFC 7518 §6 (kty-specific required parameters). kid is OPTIONAL per RFC 7517 §4.5 and not enforced here.

Inspected the homepage Strict-Transport-Security header ("max-age=7889238") and the includeSubDomains directive is absent.

How: Parse the homepage Strict-Transport-Security header for the includeSubDomains directive (RFC 6797 §6.1.2).

• HSTS header is missing the includeSubDomains directive◆MEDIUMMEDIUM severity — weight 3 in score calculation.

  /

  What we found

  max-age=7889238

  What we expected

  Strict-Transport-Security: max-age=31536000; includeSubDomains

  Append ; includeSubDomains to your STS header once every subdomain you operate supports HTTPS.

Found a homepage Organization node but its contactPoint is missing both email and telephone.

How: Parse homepage <script type="application/ld+json"> blocks, flatten @graph, and look for an Organization/OnlineStore/Store node with a contactPoint carrying email or telephone.

• Homepage Organization node has no contactPoint with email or telephone◆MEDIUMMEDIUM severity — weight 3 in score calculation.

  /

  What we expected

  "contactPoint": [{"@type":"ContactPoint","contactType":"customer service","email":"support@example.com","telephone":"+1-555-123-4567"}]

  Add a contactPoint object with at least one of email or telephone.

Profile declares no capabilities; required-field checks have nothing to evaluate.

How: For each capabilities[] entry, require non-empty string values for version, spec, and schema.

Inspected <img width=… height=…> attributes on 20 sampled product pages (0 have at least one image with area ≥ 50,000 px; dimensions absent from HTML are not HEAD-probed and count as indeterminate).

How: For every sampled PDP, parse <img> tags and read explicit width and height attributes; a PDP passes when at least one image has width × height ≥ 50,000. PDPs without any explicit-dimension <img> are marked indeterminate (this check does not HEAD image URLs).

• No <img> on this PDP carries explicit width+height attributes●LOWLOW severity — weight 1 in score calculation.× 10

  Server-render explicit width and height attributes so crawlers can verify image area without fetching.

  Affected (10)

  • /products/owlet-x-divi-bundle42 <img> tags found, none with width+height
  • /products/dream-sock-charging-cord-and-power-ad…36 <img> tags found, none with width+height
  • /products/nursery-of-hope-tree-seedling41 <img> tags found, none with width+height
  • /products/when-baby-sleeps-childrens-book38 <img> tags found, none with width+height
  • /products/advocate-like-a-mother-t-shirt42 <img> tags found, none with width+height
  • /products/dad-vocate-t-shirt42 <img> tags found, none with width+height
  • /products/sleep-mask42 <img> tags found, none with width+height
  • /products/dream-sight-power-cable36 <img> tags found, none with width+height
  • /products/dream-sight-mounting-kit36 <img> tags found, none with width+height
  • /products/cam-2-power-cable36 <img> tags found, none with width+height

…and 1 more

Inspected the homepage Strict-Transport-Security header ("max-age=7889238") and the preload directive is absent.

How: Parse the homepage Strict-Transport-Security header for the preload directive (hstspreload.org vendor extension to RFC 6797).

• HSTS header is missing the preload directive●LOWLOW severity — weight 1 in score calculation.

  /

  What we found

  max-age=7889238

  What we expected

  Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

  Append ; preload after includeSubDomains and submit your domain at https://hstspreload.org/.

Looked for a valid aggregateRating on Product JSON-LD across 20 sampled product pages (0 valid, 0%).

How: On each Product node, parse aggregateRating (or the first element if it's an array) and require ratingValue in [0,5] AND reviewCount or ratingCount ≥ 1.

• Product has no valid AggregateRating (ratingValue 0-5 + reviewCount/ratingCount ≥ 1)●LOWLOW severity — weight 1 in score calculation.× 10

  Render aggregateRating from real review totals — never fabricate.

  Affected (10)

  • /products/owlet-x-divi-bundle
  • /products/dream-sock-charging-cord-and-power-ad…
  • /products/nursery-of-hope-tree-seedling
  • /products/when-baby-sleeps-childrens-book
  • /products/advocate-like-a-mother-t-shirt
  • /products/dad-vocate-t-shirt
  • /products/sleep-mask
  • /products/dream-sight-power-cable
  • /products/dream-sight-mounting-kit
  • /products/cam-2-power-cable

…and 1 more

Parsed <img> alt attributes across 20 sampled product pages (0 have alt text on at least 80% of images).

How: Per PDP, count <img> tags via regex; a tag 'has alt text' when its alt attribute is present AND non-empty after trim. A PDP passes when it carries no <img> at all OR ≥80% of its <img> tags have non-empty alt.

• Most images on this product page lack alt text●LOWLOW severity — weight 1 in score calculation.× 10

  What we expected

  <img src="/img/sneaker.webp" alt="Red leather running shoe, side view" />

  Populate the alt attribute on each <img> with a description of what the image shows; use alt="" only for decorative images.

  Affected (10)

  • /products/owlet-x-divi-bundle28/42 <img> tags have non-empty alt (67%)
  • /products/dream-sock-charging-cord-and-power-ad…28/36 <img> tags have non-empty alt (78%)
  • /products/nursery-of-hope-tree-seedling28/41 <img> tags have non-empty alt (68%)
  • /products/when-baby-sleeps-childrens-book28/38 <img> tags have non-empty alt (74%)
  • /products/advocate-like-a-mother-t-shirt28/42 <img> tags have non-empty alt (67%)
  • /products/dad-vocate-t-shirt28/42 <img> tags have non-empty alt (67%)
  • /products/sleep-mask28/42 <img> tags have non-empty alt (67%)
  • /products/dream-sight-power-cable28/36 <img> tags have non-empty alt (78%)
  • /products/dream-sight-mounting-kit28/36 <img> tags have non-empty alt (78%)
  • /products/cam-2-power-cable28/36 <img> tags have non-empty alt (78%)

…and 1 more

Searched JSON-LD on 20 sampled product pages for a BreadcrumbList (0 found, 0%).

How: Search every JSON-LD block on each PDP for @type: BreadcrumbList with a non-empty itemListElement.

• No BreadcrumbList JSON-LD with a populated itemListElement●LOWLOW severity — weight 1 in score calculation.× 10

  Add a BreadcrumbList JSON-LD block walking Home → Category → Product.

  Affected (10)

  • /products/owlet-x-divi-bundle
  • /products/dream-sock-charging-cord-and-power-ad…
  • /products/nursery-of-hope-tree-seedling
  • /products/when-baby-sleeps-childrens-book
  • /products/advocate-like-a-mother-t-shirt
  • /products/dad-vocate-t-shirt
  • /products/sleep-mask
  • /products/dream-sight-power-cable
  • /products/dream-sight-mounting-kit
  • /products/cam-2-power-cable

…and 1 more

Scanned the homepage and 20 sampled PDPs for Apple Pay markers; none matched.

How: Substring match on known Apple Pay SDK/markup signatures (ApplePaySession, apple-pay-button, /apple-developer-merchantid-domain-association) across the homepage and every sampled PDP HTML.

• No Apple Pay markers detected on the homepage or PDPs○INFOINFO severity — weight 0 in score calculation.

  /

  Enable Apple Pay in your payment processor's dashboard (Stripe / Adyen / Braintree). Informational only — does not affect the score.

Scanned the homepage and 20 sampled PDPs for Google Pay markers; none matched.

How: Substring match on known Google Pay SDK/markup signatures (pay.google.com/gp/p/js/pay.js, google.payments.api, <google-pay-button) across the homepage and every sampled PDP HTML.

• No Google Pay markers detected on the homepage or PDPs○INFOINFO severity — weight 0 in score calculation.

  /

  Enable Google Pay in your payment processor's dashboard (Stripe / Adyen / Braintree). Informational only — does not affect the score.