mehmetozen.dev

HTTP responses can carry a Link header: the same canonical and alternate-language information your HTML declares, but delivered in the response envelope itself. Agents that only send a HEAD request, or that decide what to do while the page is still streaming, read the header without parsing any HTML. Yours is missing (or carries none of the relations agents use: canonical, alternate, describedby).

An agent triaging fifty URLs doesn’t want to download and parse fifty pages to learn which are duplicates of which. The Link header answers at the cheapest possible layer. Sites that provide it get correctly de-duplicated and correctly language-routed even by the most minimal fetchers.

1. Emit a Link header alongside each page, mirroring what your HTML head already declares. Example: Link: <https://yoursite.com/page>; rel="canonical".
2. Most stacks set this in one place: Next.js headers() config, an nginx add_header line, or a CDN response-header rule.
3. If you serve translations, add rel="alternate" entries with hreflang, matching your HTML.

• Run: curl -sI https://yoursite.com | grep -i "^link:" and confirm the relations appear.
• Hit Re-scan above: "Link response headers" flips to PASS.

• The header must AGREE with the HTML. A Link header pointing one place while the in-page canonical points another gives machines two contradictory answers, which is worse than one missing answer.
• Don’t inject the same site-wide canonical on every page via a blanket CDN rule; each page names its own clean URL, exactly as in the HTML tag.

Of everything your server sends for this page, very little is actual readable text. The rest is code, styling, and markup wrapper. Agents fetched a lot of bytes and found few words.

Agents work with retrieval budgets. A page that is 2% text either gets skimmed (and mis-summarised) or skipped. More signal per byte means more of your actual message survives into the agent’s summary.

1. Confirm your real copy is server-rendered. See the JavaScript check; these two usually fail together.
2. Cut boilerplate wrappers: deeply nested divs, inline SVG logos repeated per section, base64 images inlined into HTML.
3. Move large inline styles and scripts into external files.
4. Check how much of the document is inline script: your report now says. If most of it is, that is your framework serializing state for hydration, often a second copy of text already in the HTML. Send only the props a component cannot recompute, and render statically where a page does not need to hydrate.

• Re-scan: "Text-to-markup ratio" improves, and "Page weight" often improves alongside.

• Don’t pad the page with keyword text to inflate the ratio. The ratio is a proxy for substance, and stuffing is the opposite of substance.

Your page HAS structured data, but it is malformed: broken JSON syntax, or types and fields that don’t exist in the schema.org vocabulary. Machines can see the block but can’t parse it.

Invalid JSON-LD is worse than it looks. The agent spends its attention budget on the block, fails to parse it, and falls back to guessing from prose anyway. You pay the cost of structured data without getting the benefit.

1. Paste the failing page into validator.schema.org. It names the exact line and field that breaks.
2. The most common breaks: a trailing comma (invalid JSON), a typo’d type name, or a price written as "$79" instead of "79" with a separate priceCurrency.
3. Fix in place, redeploy, revalidate.

• validator.schema.org reports zero errors for the page.
• Re-scan: "Structured data validates" flips to PASS.

• Don’t delete the block to make the error disappear. That trades "invalid" for "absent" and fails the presence check instead; fix it.
• Don’t hand-edit generated JSON-LD in the page. Fix the template or plugin that generates it, or the error returns on the next publish.

MCP (Model Context Protocol) is how AI assistants call tools. A server card is a small JSON file at /.well-known/mcp/server-card.json that announces "this site offers these tools" so an assistant can find them without scraping your pages. We requested that file from your site and found none.

Assistants that support MCP look for the card at that exact address. With one, "book an appointment on yoursite.com" can become a tool call instead of screen-driving your UI. This is an emerging standard, so it weighs little today; publishing early costs one static file and makes you visible to the assistants adopting it.

1. If you already run an MCP server, describe it: name, description, and endpoint URL in the card.
2. If you don’t, a minimal truthful card naming your site and linking your API docs is still valid. The generated starter in the Fix it section below is filled in for this site.
3. Serve it at exactly /.well-known/mcp/server-card.json with content type application/json.

• Open yoursite.com/.well-known/mcp/server-card.json and confirm it returns your JSON, not a 404 page.
• Hit Re-scan above: "MCP server card" flips to PASS.

• Don’t advertise tools that don’t exist. An assistant that calls a declared endpoint and gets a 404 learns to skip your card entirely.
• Don’t let your framework rewrite /.well-known/* to your single-page app; the file must return raw JSON, not your HTML shell.

RFC 8414 metadata is a JSON file at /.well-known/oauth-authorization-server that tells software where your sign-in endpoints live: where to send a user to authorise, where to exchange tokens. We requested it and found none. This only applies if your site has accounts or an API that third parties connect to.

Agents acting on a user’s behalf (booking, purchasing, managing an account) need permission first, and OAuth is how they get it without ever seeing a password. The metadata file is how they discover your endpoints programmatically instead of a developer hand-configuring each integration. No file means every agent integration starts with manual setup, so most never start.

1. If you run an OAuth authorization server (Auth0, Keycloak, Okta, or your own), enable its metadata endpoint; most providers publish RFC 8414 metadata with a setting.
2. Serve or proxy it at /.well-known/oauth-authorization-server on this domain.
3. If your site has no user accounts or API, this check simply isn’t your priority; it is one reason it carries a small weight.

• Open yoursite.com/.well-known/oauth-authorization-server and confirm JSON with an "issuer" field matching your domain.
• Hit Re-scan above: "OAuth authorization metadata" flips to PASS.

• Don’t publish metadata naming endpoints that don’t answer; broken discovery is worse than none, because clients trust the file over their own guesses.
• Don’t copy another provider’s metadata as a template and leave their URLs in it. Every URL in the file must be yours.