Confirmed the homepage is HTTPS (status 200), probed http://sigmabeauty.com/ for redirect behaviour, and parsed the Strict-Transport-Security header (value: "max-age=7889238").

How: URL scheme + homepage status check, an http://host/ redirect probe through politeFetch, and a Strict-Transport-Security max-age parse (RFC 6797; ≥ 180-day threshold).

• HSTS max-age is below the 6-month minimum■CRITICALCRITICAL severity — weight 10 in score calculation.

  /parsed max-age = 7889238s (need ≥ 15552000s = 180 days)

  What we found

  max-age=7889238

  What we expected

  Strict-Transport-Security: max-age=31536000; includeSubDomains

  Bump max-age to at least 15552000 (180 days). 31536000 (1 year) is required for preload-list inclusion.

Sampled 20 PDP(s); 5 returned a noindex directive.

How: For each sampled PDP, inspect the HTML for <meta name="robots" content="...noindex..."> and the response headers for X-Robots-Tag: ...noindex....

• PDP returns noindex (html)▲HIGHHIGH severity — weight 5 in score calculation.× 5

  What we found

  <meta name="robots" content="noindex,nofollow">

  What we expected

  <meta name="robots" content="index, follow">

  Remove the noindex directive from both the meta tag and the X-Robots-Tag header on this route.

  Affected (5)

  • /products/renew-lip-oil-sca_clone_freegiftcontent: noindex,nofollow
  • /products/cream-blush-sca_clone_freegiftcontent: noindex,nofollow
  • /products/green-eggs-glam-favorites-face-setcontent: noindex,nofollow
  • /products/green-eggs-glam-favorites-eye-setcontent: noindex,nofollow
  • /products/3dhdr-kabuki-brush-sca_clone_freegiftcontent: noindex,nofollow

Checked 20 sampled product pages for a GTIN in the Product JSON-LD (0 carry a valid GTIN, 0%).

How: Extract gtin / gtin8 / gtin12 / gtin13 / gtin14 from the first Product JSON-LD node on each PDP; validate digit length.

• No valid GTIN on this product page▲HIGHHIGH severity — weight 5 in score calculation.× 10

  Populate gtin/gtin8/gtin12/gtin13/gtin14 with the manufacturer's barcode.

  Affected (10)

  • /products/2x-sigma-spa-brush-cleaning-glove-pin…
  • /products/3dhd-precision-black-classic
  • /products/3dhd%C2%AE-kabuki-classic
  • /products/renew-lip-oil-sca_clone_freegift
  • /products/gel-eyeliner-wicked
  • /products/f83-curved-kabuki
  • /products/p87-edge-precision%E2%84%A2-brush
  • /products/liquid-lipstick
  • /products/lip-gloss
  • /products/cor-de-rosa-mini-eyeshadow-palette

…and 1 more

Profile is missing required key(s): signing_keys.

How: Read the profile root (or top-level ucp wrapper) and verify the presence of version, services, capabilities, and signing_keys keys.

• Required top-level key signing_keys is missing▲HIGHHIGH severity — weight 5 in score calculation.

  /.well-known/ucp

  What we expected

  Add a top-level "signing_keys" field to the JSON document (empty array/object is fine).

  Set signing_keys at the root of the JSON document.

Wanted to inspect the UCP profile's Cache-Control header, but the runner did not surface transport metadata.

How: Parse the Cache-Control header on the /.well-known/ucp response; require public, max-age ≥ 60, and no no-store/no-cache/private.

• Transport metadata not available — runner update pending●LOWLOW severity — weight 1 in score calculation.

  /.well-known/ucp

  This check activates once the runner (Task I1) populates ctx.wellKnownUcp.cacheControl.

Profile declares no signing_keys; JWK validation has no entries to evaluate.

How: Walk signing_keys[] and validate each entry per RFC 7517 §4.1 (kty required) + RFC 7518 §6 (kty-specific required parameters). kid is OPTIONAL per RFC 7517 §4.5 and not enforced here.

Inspected the homepage Strict-Transport-Security header ("max-age=7889238") and the includeSubDomains directive is absent.

How: Parse the homepage Strict-Transport-Security header for the includeSubDomains directive (RFC 6797 §6.1.2).

• HSTS header is missing the includeSubDomains directive◆MEDIUMMEDIUM severity — weight 3 in score calculation.

  /

  What we found

  max-age=7889238

  What we expected

  Strict-Transport-Security: max-age=31536000; includeSubDomains

  Append ; includeSubDomains to your STS header once every subdomain you operate supports HTTPS.

Found a homepage Organization node but its contactPoint is missing both email and telephone.

How: Parse homepage <script type="application/ld+json"> blocks, flatten @graph, and look for an Organization/OnlineStore/Store node with a contactPoint carrying email or telephone.

• Homepage Organization node has no contactPoint with email or telephone◆MEDIUMMEDIUM severity — weight 3 in score calculation.

  /

  What we expected

  "contactPoint": [{"@type":"ContactPoint","contactType":"customer service","email":"support@example.com","telephone":"+1-555-123-4567"}]

  Add a contactPoint object with at least one of email or telephone.

No MerchantReturnPolicy node carried a merchantReturnLink URL, so reachability has nothing to evaluate.

How: Collect every unique merchantReturnLink URL across all MerchantReturnPolicy nodes; probe each once via politeFetch (failSoft). 2xx counts as reachable.

No OfferShippingDetails node carried shippingDestination, so the DefinedRegion check has nothing to evaluate.

How: On each OfferShippingDetails node where shippingDestination is set, require it to be a DefinedRegion (or array) and every entry to carry addressCountry matching /^[A-Z]{2}$/i.

Profile declares no capabilities; required-field checks have nothing to evaluate.

How: For each capabilities[] entry, require non-empty string values for version, spec, and schema.

Inspected <img width=… height=…> attributes on 20 sampled product pages (0 have at least one image with area ≥ 50,000 px; dimensions absent from HTML are not HEAD-probed and count as indeterminate).

How: For every sampled PDP, parse <img> tags and read explicit width and height attributes; a PDP passes when at least one image has width × height ≥ 50,000. PDPs without any explicit-dimension <img> are marked indeterminate (this check does not HEAD image URLs).

• All images on this PDP are below the 50,000-pixel threshold●LOWLOW severity — weight 1 in score calculation.× 10

  Upload an image whose width × height ≥ 50,000 (e.g., 400 × 300 = 120,000).

  Affected (10)

  • /products/2x-sigma-spa-brush-cleaning-glove-pin…largest image area observed: 2,400 px
  • /products/3dhd-precision-black-classiclargest image area observed: 2,400 px
  • /products/3dhd%C2%AE-kabuki-classiclargest image area observed: 2,400 px
  • /products/renew-lip-oil-sca_clone_freegiftlargest image area observed: 2,400 px
  • /products/gel-eyeliner-wickedlargest image area observed: 2,400 px
  • /products/f83-curved-kabukilargest image area observed: 2,400 px
  • /products/p87-edge-precision%E2%84%A2-brushlargest image area observed: 2,400 px
  • /products/liquid-lipsticklargest image area observed: 2,400 px
  • /products/lip-glosslargest image area observed: 2,400 px
  • /products/cor-de-rosa-mini-eyeshadow-palettelargest image area observed: 2,400 px

…and 1 more

Inspected the homepage Strict-Transport-Security header ("max-age=7889238") and the preload directive is absent.

How: Parse the homepage Strict-Transport-Security header for the preload directive (hstspreload.org vendor extension to RFC 6797).

• HSTS header is missing the preload directive●LOWLOW severity — weight 1 in score calculation.

  /

  What we found

  max-age=7889238

  What we expected

  Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

  Append ; preload after includeSubDomains and submit your domain at https://hstspreload.org/.

Parsed <img> alt attributes across 20 sampled product pages (5 have alt text on at least 80% of images).

How: Per PDP, count <img> tags via regex; a tag 'has alt text' when its alt attribute is present AND non-empty after trim. A PDP passes when it carries no <img> at all OR ≥80% of its <img> tags have non-empty alt.

• Most images on this product page lack alt text●LOWLOW severity — weight 1 in score calculation.× 10

  What we expected

  <img src="/img/sneaker.webp" alt="Red leather running shoe, side view" />

  Populate the alt attribute on each <img> with a description of what the image shows; use alt="" only for decorative images.

  Affected (10)

  • /products/2x-sigma-spa-brush-cleaning-glove-pin…3/11 <img> tags have non-empty alt (27%)
  • /products/3dhd-precision-black-classic7/15 <img> tags have non-empty alt (47%)
  • /products/3dhd%C2%AE-kabuki-classic7/15 <img> tags have non-empty alt (47%)
  • /products/renew-lip-oil-sca_clone_freegift16/24 <img> tags have non-empty alt (67%)
  • /products/gel-eyeliner-wicked18/26 <img> tags have non-empty alt (69%)
  • /products/f83-curved-kabuki17/25 <img> tags have non-empty alt (68%)
  • /products/p87-edge-precision%E2%84%A2-brush19/27 <img> tags have non-empty alt (70%)
  • /products/cor-de-rosa-mini-eyeshadow-palette30/38 <img> tags have non-empty alt (79%)
  • /products/liquid-lipstick-new-mod-17/15 <img> tags have non-empty alt (47%)
  • /products/cream-blush-sca_clone_freegift7/15 <img> tags have non-empty alt (47%)

…and 1 more

Looked for a valid aggregateRating on Product JSON-LD across 20 sampled product pages (11 valid, 55%).

How: On each Product node, parse aggregateRating (or the first element if it's an array) and require ratingValue in [0,5] AND reviewCount or ratingCount ≥ 1.

• Product has no valid AggregateRating (ratingValue 0-5 + reviewCount/ratingCount ≥ 1)●LOWLOW severity — weight 1 in score calculation.× 9

  Render aggregateRating from real review totals — never fabricate.

  Affected (9)

  • /products/3dhd-precision-black-classic
  • /products/3dhd%C2%AE-kabuki-classic
  • /products/renew-lip-oil-sca_clone_freegift
  • /products/liquid-lipstick-new-mod-1
  • /products/cream-blush-sca_clone_freegift
  • /products/e47-shader-crease-classic
  • /products/e55-eye-shading-classic
  • /products/green-eggs-glam-favorites-face-set
  • /products/green-eggs-glam-favorites-eye-set

No OfferShippingDetails node carried deliveryTime, so the ShippingDeliveryTime check has nothing to evaluate.

How: On each OfferShippingDetails node where deliveryTime is set, require an object with at least one of handlingTime / transitTime populated as a QuantitativeValue.

Scanned the homepage and 20 sampled PDPs for Apple Pay markers; none matched.

How: Substring match on known Apple Pay SDK/markup signatures (ApplePaySession, apple-pay-button, /apple-developer-merchantid-domain-association) across the homepage and every sampled PDP HTML.

• No Apple Pay markers detected on the homepage or PDPs○INFOINFO severity — weight 0 in score calculation.

  /

  Enable Apple Pay in your payment processor's dashboard (Stripe / Adyen / Braintree). Informational only — does not affect the score.

Scanned the homepage and 20 sampled PDPs for Google Pay markers; none matched.

How: Substring match on known Google Pay SDK/markup signatures (pay.google.com/gp/p/js/pay.js, google.payments.api, <google-pay-button) across the homepage and every sampled PDP HTML.

• No Google Pay markers detected on the homepage or PDPs○INFOINFO severity — weight 0 in score calculation.

  /

  Enable Google Pay in your payment processor's dashboard (Stripe / Adyen / Braintree). Informational only — does not affect the score.