Most important first.
Always-secure instruction (HSTS)
Domain & Security
Technical
Your site does not tell browsers to always use the secure connection.
Why it matters: Without this instruction, a browser may still try the insecure address first, which leaves room for the connection to be tampered with.
How to fix it: Ask your developer or host to add the Strict-Transport-Security header once HTTPS works on every page.
Email protection policy (DMARC)
Domain & Security
Moderate
Your domain does not publish a DMARC record, which lets anyone send email that claims to come from your domain.
Why it matters: A DMARC policy tells receiving mail servers what to do with mail that fails your checks, which protects your customers and your inbox placement.
How to fix it: Add a DMARC record in your DNS, starting with a monitoring policy, then tighten it once your legitimate mail passes.
AI guide file (llms.txt)
AI Readiness
Quick
Your site does not publish an llms.txt file.
Why it matters: An llms.txt file is a short, plain summary of your business and key pages that AI assistants can read quickly and quote accurately.
How to fix it: Create a text file at /llms.txt with a one-paragraph description of your business and links to your most important pages.
Sitemap available
AI Readiness
Quick
We found no sitemap for your site.
Why it matters: A sitemap lists every page you want found, so search engines and AI assistants do not miss the ones buried deep in your site.
How to fix it: Most website builders create a sitemap automatically; turn it on and list it in your robots.txt.