Evidence: security probe returned HTTP 403. Cloudflare header(s): cf-ray, server, cf-cache-status. URL: https://proofcap.io/.env
Review Cloudflare WAF, bot protection, rate-limit, and challenge rules for public marketing/content routes. Allow safe public scans and legitimate search or AI user-fetch crawlers to reach public pages while keeping admin, authenticated, preview, and private paths protected.
Speed Insights
Grade A
99% performance
https://proofcap.io
LCP
648ms
Largest paint
TBT
0ms
Blocking time
CLS
0.000
Layout shift
85
out of 100
82
out of 100
91/111 rule points
92
out of 100
70/76 rule points
72
out of 100
68/94 rule points
92
out of 100
101/110 rule points
Category point breakdown
Biggest score-losing checks
axe found 4 violation rule(s), including 2 serious or critical rule(s). Top rules: button-name (1), color-contrast (37), region (1), image-redundant-alt (1).
Meta description is 175 characters.
No canonical link tag was detected.
Horizontal overflow: 0px. Small tap targets: 39.
Fix rendered axe accessibility violations
-18 rule ptsWhat failed
The rendered page has accessibility rule violations detected by axe-core.
Evidence
axe found 4 violation rule(s), including 2 serious or critical rule(s). Top rules: button-name (1), color-contrast (37), region (1), image-redundant-alt (1).
Priority
Priority 5: fix before sharing the page publicly.
Why it matters
axe checks the actual browser-rendered page, so these issues can affect people using keyboards, screen readers, or other assistive technology.
How to fix it
Fix the top axe rule IDs first, especially critical and serious violations around names, roles, labels, headings, contrast, landmarks, and keyboard-accessible controls.
Agent Prompt
Add a useful meta description
-10 rule ptsWhat failed
The page does not expose a strong short summary for search and answer engines.
Evidence
Meta description is 175 characters.
Priority
Priority 3: fix before sharing the page publicly.
Why it matters
A missing description makes previews weaker when early users share or find the page.
How to fix it
Add a meta description around 50 to 170 characters that says who the product helps and what outcome it creates.
Agent Prompt
Add common public security headers
-6 rule ptsWhat failed
Several basic browser protection headers were not visible.
Evidence
Detected 4 of 5 common public security controls. Present: strict-transport-security, x-content-type-options, frame protection (x-frame-options), referrer-policy. Missing: content-security-policy.
Priority
Priority 5: fix before sharing the page publicly.
Why it matters
These headers reduce avoidable browser-side risk and show a baseline of care before launch.
How to fix it
Add only the missing protections among Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, frame protection, and Referrer-Policy. An existing CSP frame-ancestors directive already provides frame protection and must remain unchanged.
Agent Prompt
Add a canonical URL
-10 rule ptsWhat failed
The page does not declare which public URL is the preferred version.
Evidence
No canonical link tag was detected.
Priority
Priority 9: fix during launch polish.
Why it matters
A canonical tag reduces duplicate URL confusion before marketing links start spreading.
How to fix it
Add a canonical link tag that points to the final public landing page URL.
Agent Prompt
Fix rendered layout ergonomics
-9 rule ptsWhat failed
The browser-rendered page has layout or tap-target issues.
Evidence
Horizontal overflow: 0px. Small tap targets: 39.
Priority
Priority 13: fix during launch polish.
Why it matters
Horizontal overflow and tiny tap targets make the page feel broken on real devices, especially for mobile visitors.
How to fix it
Remove elements wider than the viewport, add responsive constraints, and make important links, buttons, inputs, and controls at least 40px tall and wide where possible.
Agent Prompt
SEO / AEO
Severity mix: 1 critical, 7 high, 3 medium, 1 low.
Meta description
-10 rule ptsMeta description is 175 characters.
Canonical tag
-10 rule ptsNo canonical link tag was detected.
Security
Severity mix: 2 critical, 3 high, 0 medium, 0 low.
Common security headers
-6 rule ptsDetected 4 of 5 common public security controls. Present: strict-transport-security, x-content-type-options, frame protection (x-frame-options), referrer-policy. Missing: content-security-policy.
Accessibility
Severity mix: 0 critical, 3 high, 5 medium, 0 low.
Rendered axe accessibility violations
-18 rule ptsaxe found 4 violation rule(s), including 2 serious or critical rule(s). Top rules: button-name (1), color-contrast (37), region (1), image-redundant-alt (1).
Basic contrast
-8 rule pts12 of 100 rendered text color sample(s) missed WCAG contrast targets. Worst rendered ratio: 2.56.
Design
Severity mix: 0 critical, 3 high, 6 medium, 2 low.
Rendered layout ergonomics
-9 rule ptsHorizontal overflow: 0px. Small tap targets: 39.
Failed checks
These checks need attention.
Meta description
0/10Meta description is 175 characters.
Failed: earned 0 of 10 points.
Priority: Priority 3: fix before sharing the page publicly.
Why it matters: A missing description makes previews weaker when early users share or find the page.
Fix: Add a meta description around 50 to 170 characters that says who the product helps and what outcome it creates.
Agent Prompt
Canonical tag
0/10No canonical link tag was detected.
Failed: earned 0 of 10 points.
Priority: Priority 9: fix during launch polish.
Why it matters: A canonical tag reduces duplicate URL confusion before marketing links start spreading.
Fix: Add a canonical link tag that points to the final public landing page URL.
Agent Prompt
Common security headers
12/18Detected 4 of 5 common public security controls. Present: strict-transport-security, x-content-type-options, frame protection (x-frame-options), referrer-policy. Missing: content-security-policy.
Failed: earned 12 of 18 points from partial coverage.
Priority: Priority 5: fix before sharing the page publicly.
Why it matters: These headers reduce avoidable browser-side risk and show a baseline of care before launch.
Fix: Add only the missing protections among Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, frame protection, and Referrer-Policy. An existing CSP frame-ancestors directive already provides frame protection and must remain unchanged.
Agent Prompt
Basic contrast
0/812 of 100 rendered text color sample(s) missed WCAG contrast targets. Worst rendered ratio: 2.56.
Failed: earned 0 of 8 points.
Priority: Priority 20: lower-risk cleanup after urgent launch blockers.
Why it matters: Low contrast makes a launch page feel less polished and can exclude users with low vision.
Fix: Review key text, buttons, and links against a 4.5:1 contrast target for normal text.
Agent Prompt
Rendered axe accessibility violations
0/18axe found 4 violation rule(s), including 2 serious or critical rule(s). Top rules: button-name (1), color-contrast (37), region (1), image-redundant-alt (1).
Failed: earned 0 of 18 points.
Priority: Priority 5: fix before sharing the page publicly.
Why it matters: axe checks the actual browser-rendered page, so these issues can affect people using keyboards, screen readers, or other assistive technology.
Fix: Fix the top axe rule IDs first, especially critical and serious violations around names, roles, labels, headings, contrast, landmarks, and keyboard-accessible controls.
Agent Prompt
Rendered layout ergonomics
0/9Horizontal overflow: 0px. Small tap targets: 39.
Failed: earned 0 of 9 points.
Priority: Priority 13: fix during launch polish.
Why it matters: Horizontal overflow and tiny tap targets make the page feel broken on real devices, especially for mobile visitors.
Fix: Remove elements wider than the viewport, add responsive constraints, and make important links, buttons, inputs, and controls at least 40px tall and wide where possible.
Agent Prompt
Page-level AEO readiness
Shared eligibility and content signals that affect every search and answer agent.
Index and citation eligibility
No general noindex directive was detected.
Snippet and answer controls
No general nosnippet or max-snippet:0 control was detected.
Canonical alignment
No canonical URL was detected.
Sitemap coverage and freshness
The exact URL appears in the fetched sitemap with lastmod 2026-08-11T16:59:19.606Z.
Structured data
Detected 2 JSON-LD block(s), 0 parse error(s), and types ContactPoint, EntryPoint, ImageObject, Offer, Organization, QuantitativeValue, SearchAction, SoftwareApplication, UnitPriceSpecification, WebSite.
Public or paywalled content
No isAccessibleForFree structured-data value was detected.
Entity clarity
Detected 3 of 3 core identity signals across the title, description, and H1.
Answer-ready visible text
Detected 1170 visible words and 64 audience, use-case, pricing, or integration signals.
Authorship and accountability
No author meta value or structured-data author was detected.
Published or updated date
No datePublished or dateModified value was detected in structured data.
Supporting-source links
No external supporting links were detected; this is contextual rather than a universal requirement.
Rendered content availability
Rendered audit completed with 407 visible text element(s).
Synthetic search-agent reachability
8 of 8 search/discovery User-Agent probes returned reachable content.
Optional LLM-readable summary
No llms.txt file was found; this is optional and does not reduce core AEO readiness.
OAI-SearchBotAI search
Robots: allowed by * allow: / · line 2
Probe: reachable · HTTP 200 · 99% parity
GPTBotModel training
Robots: allowed by * allow: / · line 2
Probe: not tested for this control
ChatGPT-UserUser-requested fetch
Robots: not applicable to user-requested fetches
Probe: not tested for this control
ClaudeBotModel training
Robots: allowed by * allow: / · line 2
Probe: not tested for this control
Claude-SearchBotAI search
Robots: allowed by * allow: / · line 2
Probe: reachable · HTTP 200 · 99% parity
Claude-UserUser-requested fetch
Robots: allowed by * allow: / · line 2
Probe: reachable · HTTP 200 · 99% parity
GooglebotSearch and discovery
Robots: allowed by * allow: / · line 2
Probe: reachable · HTTP 200 · 99% parity
Google-ExtendedData-use policy control
Robots: allowed by * allow: / · line 2
Probe: not tested for this control
BingbotSearch and discovery
Robots: allowed by * allow: / · line 2
Probe: reachable · HTTP 200 · 100% parity
PerplexityBotAI search
Robots: allowed by * allow: / · line 2
Probe: reachable · HTTP 200 · 99% parity
Perplexity-UserUser-requested fetch
Robots: not applicable to user-requested fetches
Probe: not tested for this control
ApplebotSearch and discovery
Robots: allowed by * allow: / · line 2
Probe: reachable · HTTP 200 · 100% parity
Applebot-ExtendedData-use policy control
Robots: allowed by * allow: / · line 2
Probe: not tested for this control
MistralAI-IndexAI search
Robots: allowed by * allow: / · line 2
Probe: reachable · HTTP 200 · 99% parity
MistralAI-UserUser-requested fetch
Robots: allowed by * allow: / · line 2
Probe: reachable · HTTP 200 · 99% parity
meta-externalagentModel training
Robots: allowed by * allow: / · line 2
Probe: not tested for this control
meta-externalfetcherUser-requested fetch
Robots: allowed by * allow: / · line 2
Probe: reachable · HTTP 200 · 99% parity
AmazonbotModel training
Robots: allowed by * allow: / · line 2
Probe: not tested for this control
Amzn-SearchBotAI search
Robots: allowed by * allow: / · line 2
Probe: reachable · HTTP 200 · 99% parity
Amzn-UserUser-requested fetch
Robots: allowed by * allow: / · line 2
Probe: reachable · HTTP 200 · 99% parity
CCBotModel training
Robots: allowed by * allow: / · line 2
Probe: not tested for this control
Ready combines robots policy, a bounded synthetic User-Agent fetch, indexability, and snippet eligibility. Synthetic probes do not prove vendor-origin traffic. Purple preference states are training or data-use choices and do not lower the AEO score.
Share preview
proofcap.io website audit report
Close to ready: 85/100 overall, with prioritized fixes for SEO, security, accessibility, and design.
Public reports expose the scanned public URL, safe scores, sanitized public evidence, and fix guidance. They do not include credentials, cookies, hidden form values, or sensitive response bodies.
