Doorman by Wicketry · scanned 13 Sep 2026
Wicketry
A92%
Wicketry scores 107 of 116 points (92 %), which is an A. 7 of 73 checks did not pass. 1 of those is in the heaviest band, the things an agent stops at. The most is at stake in doors: 3 points of 3.
Grade = weighted points earned ÷ points available: A ≥ 90 %, B ≥ 75 %, C ≥ 60 %, D ≥ 40 %, else F. Every finding shows its weight; nothing is hidden in the total. Scanned 13 Sep 2026.
107/116points earned · 92%
30requests made
66things an agent could read
7it could not
Transport5/5A
Discovery11/11A
Trust pack28/28A
Doors0/3F
Machine-readable18/18A
How it describes itself12/14B
What the server says7/9B
Does it agree with itself10/11A
Agent surfaces5/6B
Product & pricing pages11/11A
What an agent could not read 7 findings, heaviest first, each with its one-line fix
FDoors0/3 pts · 1 miss›
- ✕An MCP door answers at /mcp (200, or a deliberate 401/403/405)POST /mcp tools/list → 404Optional: an MCP endpoint lets an agent read your data under a key. If you have one, say so in the agent card.optional; not every site needs a door, but a door that is advertised must answerw 3
BHow it describes itself12/14 pts · 2 misses›
- ✕A Twitter/X card type is declaredmeta twitter:card: (absent)Add `<meta name="twitter:card" content="summary_large_image">`; without it the card falls back to a bare link.w 1
- ✕og:image declares its dimensionsog:image:width/height: (absent) × (absent)Add og:image:width and og:image:height so a reader can lay the card out without downloading the image first.w 1
BWhat the server says7/9 pts · 2 misses›
- ✕A Content-Security-Policy is declaredcontent-security-policy: (absent)Add a Content-Security-Policy. Start in report-only mode; the point here is that one exists and is deliberate, not that it is strict.w 1
- ✕Framing is controlled (X-Frame-Options or CSP frame-ancestors)x-frame-options: (absent) · frame-ancestors in CSP: noDeclare who may frame the page, with `frame-ancestors` in your CSP (the modern form) or `X-Frame-Options`.w 1
ADoes it agree with itself10/11 pts · 1 miss›
- ✕Trailing slashes resolve to one URL (/pricing)GET /pricing/ → 200Pick one form of /pricing and redirect the other to it. Two URLs answering 200 with the same page means an agent cites whichever it happened to be handed, and your own links disagree with each other.w 1
BAgent surfaces5/6 pts · 1 miss›
- ✕/agents.md and the agent card point at the same placespaths in the card: 11; also named in agents.md: 8; only in the card: ['/privacy', '/status', '/terms']Make the two agree. Two agent-facing files describing different paths is worse than one file, because the agent has no way to tell which is current.w 1
What an agent could read 66 findings
ATransport5/5 pts · 0 misses›
- ✓The home page answers 200 over HTTPSGET https://wicketry.com/ → 200 in 413 msw 2
- ✓Plain HTTP redirects to HTTPSGET http://wicketry.com/ → 301 https://wicketry.com/w 1
- ✓HSTS header presentstrict-transport-security: max-age=31536000; includeSubDomainsw 1
- ✓Home page answers in under 1.5 s413 msw 1
ADiscovery11/11 pts · 0 misses›
- ✓/llms.txt exists (83885 bytes)GET /llms.txt → 200w 3
- ✓robots.txt does not single out AI agents by nameuser-agent lines naming GPTBot / ClaudeBot / OAI-SearchBot / PerplexityBotThis is a policy check, not a compliance one: blocking is your right; it just closes the door this report is about.w 2
- ✓A sitemap answers and parses (1093 <loc> entries)GET https://wicketry.com/sitemap.xml → 200w 2
- ✓robots.txt existsGET /robots.txt → 200w 1
- ✓robots.txt names the sitemapSitemap: https://wicketry.com/sitemap.xmlw 1
- ✓llms.txt mentions pricing and linksgrep pric|http in /llms.txtw 1
- ✓The home page advertises agent-useful Link relations (RFC 8288)GET / → link: api-catalog, service-desc, service-docw 1
ATrust pack28/28 pts · 0 misses›
- ✓/.well-known/agent.json — the agent card (who you are, for agents; JSON)GET /.well-known/agent.json → 200 parses as JSONw 3
- ✓/pricing — a pricing page at the obvious pathGET /pricing → 200w 3
- ✓/.well-known/api-catalog — the API catalogue (RFC 9727, a linkset of service-desc/service-doc)GET /.well-known/api-catalog → 200 parses as JSONw 2
- ✓/agents.md — agents.md (how an agent should use the site)GET /agents.md → 200 2591 bytesw 2
- ✓/.well-known/security.txt — security.txt (RFC 9116)GET /.well-known/security.txt → 200 197 bytesw 2
- ✓/privacy — privacy at the obvious pathGET /privacy → 200w 2
- ✓/support — support at the obvious pathGET /support → 200w 2
- ✓/api/openapi.json — an OpenAPI descriptionGET /api/openapi.json → 200 parses as JSONw 2
- ✓/security.txt — security.txt at the root (the older place)GET /security.txt → 200 197 bytesw 1
- ✓/legal — legal at the obvious pathGET /legal → 200w 1
- ✓/terms — terms at the obvious pathGET /terms → 200w 1
- ✓/contact — contact at the obvious pathGET /contact → 200w 1
- ✓/status — a status pageGET /status → 200w 1
- ✓/changelog — a changelogGET /changelog → 200w 1
- ✓/docs — documentationGET /docs → 200w 1
- ✓/for-agents — a page written for agentsGET /for-agents → 200w 1
- ✓/.well-known/openapi.json — OpenAPI at the well-known pathGET /.well-known/openapi.json → 200 parses as JSONw 1
- ✓/data-for-agents — downloadable data for agentsGET /data-for-agents → 200w 1
FDoors0/3 pts · 1 miss›
- ✕An MCP door answers at /mcp (200, or a deliberate 401/403/405)POST /mcp tools/list → 404Optional: an MCP endpoint lets an agent read your data under a key. If you have one, say so in the agent card.optional; not every site needs a door, but a door that is advertised must answerw 3
- ✓OAuth Protected Resource Metadata (RFC 9728): not applicable herePOST /mcp tools/list → 404 (no auth-gated door to describe)not applicable; scored out of the fraction, not passedw 0
AMachine-readable18/18 pts · 0 misses›
- ✓JSON-LD on the home page (ContactPoint, DataDownload, Dataset, Organization, WebSite)3 application/ld+json block(s)w 3
- ✓The page carries real text without JavaScript (8508 visible characters)8 script tag(s); 8508 text charsw 3
- ✓An Organization node names who you aretypes: ['ContactPoint', 'DataDownload', 'Dataset', 'Organization', 'WebSite']w 2
- ✓A Product/Offer/Service/Dataset node names what you offertypes: ['ContactPoint', 'DataDownload', 'Dataset', 'Organization', 'WebSite']w 2
- ✓A price is visible in text on the home page or a /pricing page existsregex (€|$|£)\d on the home pagew 2
- ✓A link on the home page leads to pricing or buyinghrefs containing pricing|prices|buy|checkout|shop|storew 2
- ✓Title is set and readable (63 chars)<title>Wicketry — Software prices change quietly. We check, every day.</title>w 1
- ✓Meta description presentdescription: We read software pricing pages every day, in five countries, and keep what they said. Compw 1
- ✓The home page has an H11 h1 element(s)w 1
- ✓Canonical URL declaredcanonical: https://wicketry.com/w 1
BHow it describes itself12/14 pts · 2 misses›
- ✕A Twitter/X card type is declaredmeta twitter:card: (absent)Add `<meta name="twitter:card" content="summary_large_image">`; without it the card falls back to a bare link.w 1
- ✕og:image declares its dimensionsog:image:width/height: (absent) × (absent)Add og:image:width and og:image:height so a reader can lay the card out without downloading the image first.w 1
- ✓The home page is not marked noindexmeta robots: (absent) · X-Robots-Tag: (absent)w 3
- ✓Open Graph is complete (5/5 tags)meta og:title, og:description, og:url, og:type, og:image — all presentw 2
- ✓The canonical URL agrees with the URL that served the pagecanonical https://wicketry.com/ vs served https://wicketry.com/w 2
- ✓The hreflang set includes the page it is on (7 alternates)served https://wicketry.com/; hreflang hrefs: ['https://wicketry.com/de', 'https://wicketry.com/eu', 'https://wicketry.com/uk', 'https://wicketry.com/', 'https://wicketry.com/es', 'https://wicketry.com/fr']w 2
- ✓Every hreflang code is well formedcodes: ['de', 'en-IE', 'en-GB', 'en-US', 'es', 'fr', 'x-default']w 1
- ✓No hreflang code is declared twice7 distinct codes, no repeatsw 1
- ✓The <html> element declares a language<html lang="en">w 1
BWhat the server says7/9 pts · 2 misses›
- ✕A Content-Security-Policy is declaredcontent-security-policy: (absent)Add a Content-Security-Policy. Start in report-only mode; the point here is that one exists and is deliberate, not that it is strict.w 1
- ✕Framing is controlled (X-Frame-Options or CSP frame-ancestors)x-frame-options: (absent) · frame-ancestors in CSP: noDeclare who may frame the page, with `frame-ancestors` in your CSP (the modern form) or `X-Frame-Options`.w 1
- ✓The home page declares text/html with a character setcontent-type: text/html; charset=utf-8w 2
- ✓The home page is reached in 0 redirects1 request(s): 200w 2
- ✓X-Content-Type-Options: nosniffx-content-type-options: nosniffw 1
- ✓A Referrer-Policy is declaredreferrer-policy: strict-origin-when-cross-originw 1
- ✓The home page HTML is within 500 KB (43.7 KB)43.7 KB of HTML (bytes read)w 1
ADoes it agree with itself10/11 pts · 1 miss›
- ✕Trailing slashes resolve to one URL (/pricing)GET /pricing/ → 200Pick one form of /pricing and redirect the other to it. Two URLs answering 200 with the same page means an agent cites whichever it happened to be handed, and your own links disagree with each other.w 1
- ✓A URL that cannot exist returns 404GET /doorman-probe-no-such-page-9f3a → 404w 3
- ✓No <lastmod> is dated in the future (3 entries)0 future date(s); scan date 2026-09-13w 2
- ✓The links sampled from llms.txt are alive (3 sampled)3 link(s), all answeredw 2
- ✓The www/apex pair is coherent (www.wicketry.com)GET https://www.wicketry.com/ → 301 → https://wicketry.com/w 2
- ✓The 404 page helps a reader get somewhere else3191 visible characters, 31 link(s)w 1
BAgent surfaces5/6 pts · 1 miss›
- ✕/agents.md and the agent card point at the same placespaths in the card: 11; also named in agents.md: 8; only in the card: ['/privacy', '/status', '/terms']Make the two agree. Two agent-facing files describing different paths is worse than one file, because the agent has no way to tell which is current.w 1
- ✓The agent card answers what an agent arrives with (3/3)/.well-known/agent.json keys: ['citation', 'contact', 'endpoints', 'generated', 'how_to_read', 'legal', 'name', 'purpose', 'url', 'what_we_do_not_do']the card declares it sells nothing, so no pricing pointer is expectedw 2
- ✓A Dataset declares its licence and how to fetch it1 Dataset node(s), 1 with both license and distributionw 2
- ✓The Organization node can be reached or corroborated1 Organization node(s), 1 with contactPoint, sameAs or emailw 1
AProduct & pricing pages11/11 pts · 0 misses›
- ✓The pricing page shows prices in text with a currency/pricing says in words that there is nothing to paythe page states it charges nothing; that is a price an agent can carryw 3
- ✓The pricing page answers 200GET /pricing → 200 in 586 msw 2
- ✓The pricing page offers a way to buy or to reach a humana link onward (checkout, sign-up or contact) on /pricingw 2
- ✓The pricing page carries real text without JavaScript709 visible characters on /pricingw 2
- ✓The pricing page says how often each figure is chargedbilling words found in the visible text of /pricingw 1
- ✓The pricing page has its own title and description<title>Pricing — Wicketry</title>; description presentw 1
Product and pricing pages what an agent could read on each
| page | status | title | description | one h1 | canonical | a price in text | offer markup | a way to buy |
|---|---|---|---|---|---|---|---|---|
| /pricing · pricing | 200 | yes | yes | yes | yes | yes | no | yes |
Addresses an agent guessed that answered 404
https://wicketry.com/mcp
The full report — coming soon
Every one of the 73 checks explained, the 7 things an agent could not read and how to fix each one — steps, a verify line, the WordPress and hand-built variants.
One item of the full report, unredacted — this site's heaviest miss
An MCP door answers at /mcp (200, or a deliberate 401/403/405)
POST /mcp tools/list → 404
This is the one optional check in the report. An MCP door lets an agent read your data under a key instead of scraping pages. Not having one is a legitimate choice; having one that nothing points at is the waste.
What to change: Optional: an MCP endpoint lets an agent read your data under a key. If you have one, say so in the agent card.
How to fix it
- Decide whether you want one at all. Most sites do not need a door, and this finding is marked optional for that reason — a failing row here is not a fault.
- If you run one, answer at
/mcp. A 200 is expected; a deliberate 401, 403 or 405 also counts, because refusing an unauthenticated request is a working door saying no. - Name it in the agent card. A door nothing advertises will only be found by a client that probes for it, and most do not.
- Do not answer 404 at
/mcpwhile advertising an endpoint elsewhere. That is the site disagreeing with itself and the client believes the 404. - If you have no door, say so in agents.md and point at the alternatives — the data download, the API description. An explicit no is worth more than a silence.
Tell me when it opensOne email when it opens, nothing else; a person reads the request.
Later: monitoring — a fresh scan on a schedule and a note when a grade moves.
The badge
It says the grade and the date of the last scan and links to this page. It is re-drawn from the newest scan at every build, so it can never say more than the scan did. Embed:
<a href="https://wicketry.com/doorman/sites/wicketry.com"><img src="https://wicketry.com/doorman/badge/wicketry.com.svg" alt="Doorman by Wicketry: agent-readiness A, scanned 13 Sep 2026" height="28"></a>
How this scan behaved
This scan identified itself as DoormanScanner/1.0 (+https://wicketry.com/doorman/etiquette; an agent-readiness check; reads public pages only), made 30 requests at least 0.5 s apart (budget 40), read robots.txt first (status 200), executed no JavaScript, set no cookies and submitted no forms. robots.txt asked it to skip nothing it wanted to read.
The requests made, in order
The walk, as it happened30 requests · ≥0.5 s apart · DoormanScanner/1.0
| 13:45:08.334 | 200 | https://wicketry.com/robots.txt | robots.txt | |
| 13:45:09.248 | +0.84s | 200 | https://wicketry.com/ | home page |
| 13:45:09.973 | +0.91s | 301 | http://wicketry.com/ | http → https redirect? |
| 13:45:10.892 | +0.72s | 200 | https://wicketry.com/sitemap.xml | sitemap |
| 13:45:11.860 | +0.92s | 200 | https://wicketry.com/llms.txt | llms.txt |
| 13:45:12.793 | +0.97s | 200 | https://wicketry.com/.well-known/agent.json | the agent card (who you are, for agents; JSON) |
| 13:45:14.189 | +0.93s | 200 | https://wicketry.com/.well-known/api-catalog | the API catalogue (RFC 9727, a linkset of service-desc/service-doc) |
| 13:45:14.945 | +1.40s | 200 | https://wicketry.com/agents.md | agents.md (how an agent should use the site) |
| 13:45:15.740 | +0.76s | 200 | https://wicketry.com/.well-known/security.txt | security.txt (RFC 9116) |
| 13:45:16.537 | +0.80s | 200 | https://wicketry.com/security.txt | security.txt at the root (the older place) |
| 13:45:17.624 | +0.80s | 200 | https://wicketry.com/pricing | a pricing page at the obvious path |
| 13:45:18.461 | +1.09s | 200 | https://wicketry.com/legal | legal at the obvious path |
| 13:45:19.259 | +0.84s | 200 | https://wicketry.com/terms | terms at the obvious path |
| 13:45:20.035 | +0.80s | 200 | https://wicketry.com/privacy | privacy at the obvious path |
| 13:45:20.826 | +0.78s | 200 | https://wicketry.com/support | support at the obvious path |
| 13:45:21.960 | +0.79s | 200 | https://wicketry.com/contact | contact at the obvious path |
| 13:45:23.022 | +1.13s | 200 | https://wicketry.com/status | a status page |
| 13:45:24.220 | +1.06s | 200 | https://wicketry.com/changelog | a changelog |
| 13:45:25.334 | +1.20s | 200 | https://wicketry.com/docs | documentation |
| 13:45:26.382 | +1.11s | 200 | https://wicketry.com/for-agents | a page written for agents |
| 13:45:27.154 | +1.05s | 200 | https://wicketry.com/api/openapi.json | an OpenAPI description |
| 13:45:27.934 | +0.77s | 200 | https://wicketry.com/.well-known/openapi.json | OpenAPI at the well-known path |
| 13:45:28.707 | +0.78s | 200 | https://wicketry.com/data-for-agents | downloadable data for agents |
| 13:45:29.551 | +0.77s | 404 | https://wicketry.com/mcp | an MCP door (POST tools/list) |
| 13:45:30.354 | +0.84s | 301 | https://www.wicketry.com/ | does www.wicketry.com answer, and where does it land? |
| 13:45:31.137 | +0.80s | 404 | https://wicketry.com/doorman-probe-no-such-page-9f3a | a URL that should not exist |
| 13:45:31.889 | +0.78s | 200 | https://wicketry.com/pricing/ | /pricing with a trailing slash |
| 13:45:32.649 | +0.75s | 200 | https://wicketry.com/data-for-agents | a link from llms.txt |
| 13:45:33.403 | +0.76s | 200 | https://wicketry.com/data/wicketry-record.json | a link from llms.txt |
| 13:45:34.205 | +0.75s | 200 | https://wicketry.com/data/wicketry-record.csv | a link from llms.txt |
Operate this site? Ask for a fresh scan (one per site per day) or read the etiquette, including how to opt out.