# Website AI Readiness > Scan your website across six categories: discovery, AI signals, semantics, agent protocols, performance and security. Free, with real data from Google. This tool reads a public **website**, the way AI crawlers and search engines read it. To assess your company's **internal data** before an AI project, use [AI Data Quality](https://c2suite.com/en/resources/ai-data-quality) instead. The tool lives at https://c2suite.com/en/resources/website-ai-readiness and needs a browser. You choose a profile for your type of site, and the profile decides which categories count and how much each one weighs. ## Profiles - **Content site or blog**: You publish articles and want to be found and cited. You do not offer an API, so agent manifests do not count. - **Digital product or API**: You have a service that other programs can use. Here the manifests that let an agent call your service do count. - **Company website**: A company site that presents services and captures leads. What matters is that it can be found, that it is understood, and that it loads fast when someone arrives from an ad. ## What each category measures ### Discovery Whether a crawler can find your content, and whether you have told it what it may do with it. This is the most basic layer: without it, nothing else gets read. - **robots.txt.** That it exists and can be read. It is the first file any crawler asks for. - **Sitemap.** That /sitemap.xml responds with a list of URLs. Without it, a crawler only finds the pages that are linked. - **Sitemap listed in robots.txt.** That robots.txt points to the sitemap. That is where crawlers look for it when they do not guess its location. - **AI crawlers.** Whether you block GPTBot, ClaudeBot, PerplexityBot or Google-Extended. Blocking them is a valid choice, but then you will not appear in their answers. - **llms.txt.** A plain-text index written for language models. It is not a standard yet, but it costs little and several agents already read it. - **ai.txt.** States in writing whether you allow your content to be used to train models. ### Search and AI signals What tells a search engine or a model what the page is about and who publishes it. It decides whether they cite you or a source that did declare it. - **Structured data.** At least one valid JSON-LD block. It is the format that Google and AI models read without having to interpret the page. - **Declared entity.** That the JSON-LD says who you are: Organization, LocalBusiness or Person. Without an entity, a model does not know who to credit for what it reads. - **Canonical URL.** Keeps the same content from competing with itself across several addresses. - **Title.** That it exists and fits in a search result: between 15 and 65 characters. - **Meta description.** Between 50 and 165 characters. It is the summary shown in search results and the one a model often quotes. - **Open Graph.** Controls how your page looks when someone shares it on WhatsApp, LinkedIn or Slack. ### Content and semantics Whether the content can be understood without running JavaScript, and whether its structure makes sense. Most AI crawlers do not run JavaScript. - **Content without JavaScript.** That the HTML already contains the text when it arrives. If the page is built in the browser, many agents see a blank page. - **A single H1.** The main heading says what the page is about. Not zero, not five: one. - **Heading hierarchy.** That no levels are skipped (from H2 to H4). A model uses the heading outline to extract a specific passage. - **Alt text.** That images have an alt attribute. It is an accessibility requirement, and it is also the only part of an image a model can read. - **Declared language.** The lang attribute of the HTML element. Without it, a model has to guess which language to answer in. - **Main region.** A main element that separates the content from the navigation and the footer. ### Agent protocols Manifests that let an autonomous agent use your site, not just read it. They only apply if you offer an API or a service: publishing them without one promises something that does not exist. - **OpenAPI specification.** A machine-readable contract of what your API can do. - **API catalog.** The standard discovery point (RFC 9727) where an agent finds your APIs. - **MCP server card.** Declares your service as a tool that an assistant using the Model Context Protocol can call. - **AI resource catalog.** An index of documents and services written for agents. It is more flexible than the API catalog. ### Performance The Core Web Vitals that Google uses for ranking, measured with real users over the last 28 days when your domain has enough traffic. This is the category where most sites fail. - **Loading (LCP).** How long the largest element on the screen takes to appear. Above 2.5 seconds, people start to leave. - **Interaction response (INP).** How long the page takes to react to a click. It replaced FID in March 2024, and it is the metric that most penalizes too much JavaScript. - **Visual stability (CLS).** How much the content moves while the page loads. It is what makes someone tap the wrong button. ### Security and trust The signals that make an agent, and a person, trust what is on the other side. They are headers you set up once and then leave alone. - **HTTPS.** That the site is served encrypted. Without it, nothing else in this category matters. - **HSTS.** Makes the browser use HTTPS even when someone types the address without it. - **Content Security Policy.** Limits where your page can load scripts from. It is the main defense against injected code. - **X-Content-Type-Options.** Stops the browser from guessing a file's type and running it by mistake. - **Referrer-Policy.** Controls how much of your URLs is passed on to the sites you link to. - **Privacy notice.** That there is a link people can find. In Mexico it is also required by law if you collect personal data. --- Source: https://c2suite.com/en/resources/website-ai-readiness You can cite and summarize this content if you credit C2Suite and link to the source URL.