Domain report for pipandbruno.com (2026-10-20 22:06 UTC): https://aeoinspector.com/d/j37hya8utoso8jig
Site security grade D (63/100) | AEO grade C (77/100) | 16 fixes
========================================================================
1. [medium] [email] No SPF record.
   This domain does not seem to send mail: publish TXT "v=spf1 -all".
   Verify:
     dig +short TXT pipandbruno.com | grep -i spf1

2. [medium] [web] No HSTS header.
   Send Strict-Transport-Security: max-age=31536000; includeSubDomains once every subdomain serves HTTPS.
   Verify:
     curl -sI 'https://pipandbruno.com/' | grep -iE '^(strict-transport-security|content-security-policy|x-content-type-options|referrer-policy|permissions-policy|x-frame-options|location|HTTP)'

3. [medium] [web] No Content-Security-Policy.
   Start with Content-Security-Policy-Report-Only listing your script/style sources, then enforce it.
   Verify:
     curl -sI 'https://pipandbruno.com/' | grep -iE '^(strict-transport-security|content-security-policy|x-content-type-options|referrer-policy|permissions-policy|x-frame-options|location|HTTP)'

4. [medium] [web] The site can be framed by other sites (clickjacking).
   Send X-Frame-Options: DENY (or SAMEORIGIN), or CSP frame-ancestors 'self'.
   Verify:
     curl -sI 'https://pipandbruno.com/' | grep -iE '^(strict-transport-security|content-security-policy|x-content-type-options|referrer-policy|permissions-policy|x-frame-options|location|HTTP)'

5. [medium] [AI visibility] Add an Organization (or LocalBusiness) JSON-LD item
   Engines and Google validate these types. The Organization JSON-LD in "Ready-to-paste fixes" is complete.
   Verify:
     curl -s 'https://pipandbruno.com/' | grep -c 'application/ld+json'   # >= 1; then paste the URL into https://validator.schema.org/

6. [medium] [AI visibility] Add dateModified and sitemap lastmod
   Add dateModified to Article/WebPage JSON-LD, send a real Last-Modified header, and keep <lastmod> in your sitemap accurate when pages change.
   Verify:
     curl -sI 'https://pipandbruno.com/' | grep -i last-modified; curl -s 'https://pipandbruno.com/' | grep -o '"dateModified"[^,}]*'

7. [medium] [AI visibility] Add sameAs links to your Organization JSON-LD
   List your official profiles (LinkedIn, X, GitHub, Crunchbase, Wikipedia/Wikidata, YouTube) in Organization.sameAs so engines can tie the site to one entity.
   Verify:
     curl -s 'https://pipandbruno.com/' | grep -c 'application/ld+json'   # >= 1; then paste the URL into https://validator.schema.org/

8. [medium] [AI visibility] Get a Wikidata item that points to your site
   If your organization meets Wikidata's notability policy, create an item with 'official website' (P856) set to your domain, then add it to Organization.sameAs. Don't create one if you're not notable; it will be deleted.
   Verify:
     curl -s 'https://www.wikidata.org/w/api.php?action=wbsearchentities&format=json&language=en&search=pipandbruno.com' | jq '.search[] | {id,label}'

9. [low] [dns] Add CAA records so only your certificate authorities can issue for this domain
   With no CAA record any public CA may issue a certificate for your domain (RFC 8659).
   Paste (CAA at pipandbruno.com):
     0 issue "letsencrypt.org"
     0 issuewild "letsencrypt.org"
     0 issue "pki.goog; cansignhttpexchanges=yes"
     0 issuewild "pki.goog; cansignhttpexchanges=yes"
     0 issue "ssl.com"
     0 issuewild "ssl.com"
     0 issue "sectigo.com"
     0 issuewild "sectigo.com"
     0 iodef "mailto:security@pipandbruno.com"
   Note: DNS is on Cloudflare: Cloudflare adds these CAA records for Universal SSL automatically once you add any CAA record; listing them keeps edge certificates working. Add your own CA too if you use one at the origin.
   - Add each line as a CAA record on the root (@): flags 0, tag issue/issuewild/iodef, value as shown.
   - If a hostname is a CNAME, the target's CAA also applies; check it too.
   Verify:
     dig +short CAA pipandbruno.com

10. [low] [dns] DNSSEC is not on (not signed (no DS record)).
   Turn on DNSSEC at your DNS host and add the DS record at the registrar.
   Verify:
     dig +dnssec +short DS pipandbruno.com

11. [low] [disclosure] No /.well-known/security.txt, so researchers have no listed way to report a vulnerability.
   Publish /.well-known/security.txt with Contact: mailto:security@<domain> and an Expires: date within a year (RFC 9116).
   Verify:
     curl -s https://pipandbruno.com/.well-known/security.txt | grep -iE '^(contact|expires):'

12. [low] [AI visibility] Put your main content in the HTML
   AI crawlers mostly don't run JavaScript. Server-render or pre-render the page (SSR/SSG) so the raw HTML carries at least ~300 words that explain what you do, for whom, and why.
   Verify:
     curl -s -A 'Mozilla/5.0 (compatible; GPTBot/1.3; +https://openai.com/gptbot)' 'https://pipandbruno.com/' | sed -e 's/<script.*<\/script>//g' -e 's/<[^>]*>/ /g' | wc -w   # raw HTML word count; aim for 300+

13. [low] [AI visibility] Add /llms.txt
   Use the llms.txt draft in "Ready-to-paste fixes" below (llmstxt.org format).
   Verify:
     curl -s -o /dev/null -w '%{http_code}\n' 'https://pipandbruno.com/llms.txt'   # expect 200; then: curl -s 'https://pipandbruno.com/llms.txt' | head -1   # starts with '# '

14. [low] [AI visibility] Add question headings that match what people ask
   Add H2/H3 headings phrased as questions ("How much does X cost?", "What is X?") on your key pages, each followed by a direct answer.
   Verify:
     curl -s 'https://pipandbruno.com/' | grep -ioE '<h[23][^>]*>[^<]*\?</h[23]>'   # question headings in raw HTML

15. [low] [AI visibility] Answer each question in the first sentence or two
   Right under each question heading, put a 1-3 sentence answer (8-70 words) before details, tables or CTAs. Engines quote that first paragraph.
   Verify:
     curl -s 'https://pipandbruno.com/' | grep -ioE '<h[23][^>]*>[^<]*\?</h[23]>'   # question headings in raw HTML

16. [low] [AI visibility] Add Open Graph tags
   og:title, og:description and og:image control how links to you look in chats and AI answers that render previews.
   Verify:
     curl -s 'https://pipandbruno.com/' | grep -io '<meta[^>]*property="og:[^"]*"[^>]*>'   # og:title, og:description, og:image

========================================================================
AEO paste kit (robots.txt, llms.txt, JSON-LD):

+==================================================================================+
|  AEO INSPECTOR  ·  INSPECTED 2026-10-20                                          |
|  pipandbruno.com                                                                 |
|  AEO score 77/100 (grade C)  ·  AI crawler access 100/100  ·  Agent-ready 0/100  |
|  https://aeoinspector.com/d/j37hya8utoso8jig                                     |
+==================================================================================+

AEO Inspector: ready-to-paste fixes for pipandbruno.com
Score 77/100 (C), checked 2026-10-20 22:06 UTC. Full result: https://aeoinspector.com/d/j37hya8utoso8jig
Review each block before publishing; they are drafts built from what we found on your site.

========================================================================
1. /llms.txt (save as a plain-text file at the site root)
========================================================================
# Pip and Bruno

> Original kids music videos for ages 4 to 8. Pip is a girl with ginger pigtails and a yellow raincoat. Bruno is a brown moose with a green scarf. This site is for parents.

## Main pages
- [Pip and Bruno — songs for parents](https://pipandbruno.com/)
- [Privacy — Pip and Bruno](https://pipandbruno.com/privacy/)
- [Pip and Bruno — Blast Off](https://pipandbruno.com/songs/blast-off/)
- [Pip and Bruno — Stack It Up](https://pipandbruno.com/songs/stack-it-up/)
- [Pip and Bruno — Snow Day Wiggle](https://pipandbruno.com/songs/snow-day-wiggle/)

## Common questions
- What this site does not do: No shop, no payments, and no merch checkout. No analytics cookies and no advertising trackers. No accounts for kids, and no intentional collection of information from children.

## Optional
- [Sitemap](https://pipandbruno.com/sitemap.xml): every public page
- [robots.txt](https://pipandbruno.com/robots.txt)

========================================================================
2. /robots.txt
========================================================================
# Replaces your current robots.txt. Rules for other crawlers are kept as they were.
# AI crawlers: allowed, with the same private-path rules as before.

User-agent: OAI-SearchBot
User-agent: ChatGPT-User
User-agent: Claude-SearchBot
User-agent: Claude-User
User-agent: PerplexityBot
User-agent: Perplexity-User
User-agent: Googlebot
User-agent: Bingbot
User-agent: Applebot
User-agent: DuckAssistBot
User-agent: Meta-ExternalFetcher
User-agent: MistralAI-User
Allow: /
Allow: /songs/blast-off
Allow: /songs/snow-day-wiggle
Allow: /songs/stack-it-up
Allow: /privacy

# AI training crawlers. Delete this group if you don't want your content used for model training.
User-agent: GPTBot
User-agent: ClaudeBot
User-agent: Google-Extended
User-agent: Applebot-Extended
User-agent: CCBot
User-agent: Bytespider
User-agent: meta-externalagent
User-agent: Amazonbot
User-agent: cohere-ai
Allow: /
Allow: /songs/blast-off
Allow: /songs/snow-day-wiggle
Allow: /songs/stack-it-up
Allow: /privacy

# Your existing rules for every other crawler, unchanged.

User-agent: *
Allow: /
Allow: /songs/blast-off
Allow: /songs/snow-day-wiggle
Allow: /songs/stack-it-up
Allow: /privacy

Sitemap: https://pipandbruno.com/sitemap.xml

========================================================================
3. JSON-LD for the homepage <head>: Organization and WebSite
========================================================================
<!-- We found no profile links. Add a sameAs array with your official LinkedIn, X, GitHub, Crunchbase or Wikidata URLs. -->
<script type="application/ld+json">
{
  "@context": "https://schema.org",
  "@type": "Organization",
  "@id": "https://pipandbruno.com/#organization",
  "name": "Pip and Bruno",
  "url": "https://pipandbruno.com/",
  "logo": "https://pipandbruno.com/favicon.svg",
  "description": "Original kids music videos for ages 4 to 8. Pip is a girl with ginger pigtails and a yellow raincoat. Bruno is a brown moose with a green scarf. This site is for parents."
}
</script>
<script type="application/ld+json">
{
  "@context": "https://schema.org",
  "@type": "WebSite",
  "@id": "https://pipandbruno.com/#website",
  "name": "Pip and Bruno",
  "url": "https://pipandbruno.com/",
  "publisher": {
    "@id": "https://pipandbruno.com/#organization"
  },
  "inLanguage": "en"
}
</script>

========================================================================
4. FAQPage JSON-LD
========================================================================
<!-- Built from 1 question heading(s) with short answers found on your pages. Put it only on the page that shows those questions and answers. -->
<script type="application/ld+json">
{
  "@context": "https://schema.org",
  "@type": "FAQPage",
  "mainEntity": [
    {
      "@type": "Question",
      "name": "What this site does not do",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "No shop, no payments, and no merch checkout. No analytics cookies and no advertising trackers. No accounts for kids, and no intentional collection of information from children."
      }
    }
  ]
}
</script>

========================================================================
5. Cloudflare
========================================================================
This site is behind Cloudflare and every user agent we tried got the page.

WAF custom rule "Allow verified AI and search crawlers"
  1. Security rules page > Create rule > Custom rules
  2. Rule name: Allow verified AI and search crawlers
  3. Edit expression: paste the expression
  4. Choose action: Skip, then tick the skip options listed
  5. Place it first in the list, then save

Expression (answer engines and search):
(cf.verified_bot_category in {"AI Search" "AI Assistant" "Search Engine Crawler"})

Expression that also lets training crawlers through:
(cf.verified_bot_category in {"AI Search" "AI Assistant" "Search Engine Crawler" "AI Crawler"})

Action: Skip. Skip: All remaining custom rules, All Super Bot Fight Mode rules, All managed rules, All rate limiting rules, User Agent Blocking, Browser Integrity Check, Security Level.
Where: First in your custom rules list. The AI Crawl Control rule is added at the end, so a Skip rule above it lets verified crawlers past it.
Phase: http_request_firewall_custom (WAF custom rules), which runs before Super Bot Fight Mode, managed rules and rate limiting.
It can't bypass: Bot Fight Mode (Free plan feature; it doesn't run on the Ruleset Engine, so turn it off instead); Products outside the Ruleset Engine that aren't in the Skip products list.
Note: cf.verified_bot_category only matches bots Cloudflare has verified (by IP and signature), so a spoofed user agent doesn't match.
Note: "AI Crawler" is the training category (GPTBot, Google-Extended). Use the second expression only if you also want training crawlers through.
Note: "AI Search" is kept for older rules; Cloudflare files new search crawlers under Search, which this legacy field reports as "Search Engine Crawler" (inference from Cloudflare's category notes).
Note: Turn on logging for the rule and check Security Events after a day to confirm crawler requests match it.
Docs: https://developers.cloudflare.com/waf/custom-rules/skip/options/

========================================================================
Agent-ready fixes (agent-ready score 0/100)
========================================================================
## Publish /llms.txt
A Markdown file at your site root that tells agents what you are and links your key pages, docs, API and pricing (llmstxt.org). The full draft is in Paste-ready drafts.

# Pip and Bruno
> One sentence on what Pip and Bruno does and for whom.

## Key pages
- [Pricing](https://pipandbruno.com/pricing): plans and prices
- [Docs](https://pipandbruno.com/docs): how it works

## For agents
- [OpenAPI](https://pipandbruno.com/openapi.json)
- [MCP server card](https://pipandbruno.com/.well-known/mcp/server-card.json)


## Offer an MCP server (if agents should act on your service)
If you have an API agents could use, run an MCP server (streamable HTTP) and publish a server card at /.well-known/mcp/server-card.json so clients and registries can discover it without connecting first (MCP server card proposal, SEP-1649). Skip this if you have nothing for agents to call.

{
  "$schema": "https://static.modelcontextprotocol.io/schemas/v1/server-card.schema.json",
  "name": "com.pipandbruno/pip-and-bruno",
  "version": "1.0.0",
  "title": "Pip and Bruno",
  "description": "What agents can do with Pip and Bruno.",
  "websiteUrl": "https://pipandbruno.com/",
  "remotes": [
    {
      "type": "streamable-http",
      "url": "https://pipandbruno.com/mcp"
    }
  ]
}

## Publish an OpenAPI document (if you have an API)
Serve your API description at /openapi.json and point to it from the homepage with a service-desc link (RFC 8631), so agents can learn your endpoints without reading docs. Skip if you have no public API.

<link rel="service-desc" href="/openapi.json" type="application/openapi+json">

{
  "openapi": "3.1.0",
  "info": {
    "title": "Pip and Bruno API",
    "version": "1.0.0"
  },
  "servers": [
    {
      "url": "https://pipandbruno.com"
    }
  ],
  "paths": {
    "/api/v1/example": {
      "get": {
        "summary": "Describe one endpoint",
        "responses": {
          "200": {
            "description": "OK"
          }
        }
      }
    }
  }
}

## Let agents pay per request with x402 (if you sell API access)
Answer unpaid calls to a paid endpoint with HTTP 402 and a PAYMENT-REQUIRED header (x402 v2), and list the paid URLs at /.well-known/x402 so agents can find them. Skip if you don't sell anything agents can buy per call.

{
  "version": 1,
  "resources": [
    "https://pipandbruno.com/api/v1/example"
  ],
  "instructions": "Call a resource without payment to receive an x402 v2 challenge (HTTP 402, PAYMENT-REQUIRED header), then retry with PAYMENT-SIGNATURE."
}

## State your prices in JSON-LD
Add an Offer with price and priceCurrency to your pricing or product page, so agents comparing options can read your price without parsing the page. Use your real plan names and prices.

<script type="application/ld+json">
{
  "@context": "https://schema.org",
  "@type": "Product",
  "name": "Pip and Bruno Pro",
  "offers": {
    "@type": "Offer",
    "price": "29.00",
    "priceCurrency": "USD",
    "url": "https://pipandbruno.com/pricing",
    "availability": "https://schema.org/InStock"
  }
}
</script>

## Publish a Web Bot Auth key directory (only if you run a bot or agent)
If your service sends its own crawler or agent to other sites, sign its requests (HTTP Message Signatures, RFC 9421) and publish the public keys at /.well-known/http-message-signatures-directory with content type application/http-message-signatures-directory+json, per draft-ietf-webbotauth-httpsig-protocol. Sites and CDNs can then verify it's really you. If you don't run a bot, ignore this.

# Response headers
Content-Type: application/http-message-signatures-directory+json
Cache-Control: max-age=86400

# Body (your Ed25519 public key as a JWK)
{
  "keys": [
    {
      "kty": "OKP",
      "crv": "Ed25519",
      "x": "<base64url public key>"
    }
  ]
}

========================================================================
Prioritized fix list
========================================================================
1. [medium] Add an Organization (or LocalBusiness) JSON-LD item (+4 pts)
   Engines and Google validate these types. The Organization JSON-LD in "Ready-to-paste fixes" is complete.
   Verify:
     curl -s 'https://pipandbruno.com/' | grep -c 'application/ld+json'   # >= 1; then paste the URL into https://validator.schema.org/
2. [medium] Add dateModified and sitemap lastmod (+4 pts)
   Add dateModified to Article/WebPage JSON-LD, send a real Last-Modified header, and keep <lastmod> in your sitemap accurate when pages change.
   Verify:
     curl -sI 'https://pipandbruno.com/' | grep -i last-modified; curl -s 'https://pipandbruno.com/' | grep -o '"dateModified"[^,}]*'
3. [medium] Add sameAs links to your Organization JSON-LD (+3.5 pts)
   List your official profiles (LinkedIn, X, GitHub, Crunchbase, Wikipedia/Wikidata, YouTube) in Organization.sameAs so engines can tie the site to one entity.
   Verify:
     curl -s 'https://pipandbruno.com/' | grep -c 'application/ld+json'   # >= 1; then paste the URL into https://validator.schema.org/
4. [medium] Get a Wikidata item that points to your site (+3.5 pts)
   If your organization meets Wikidata's notability policy, create an item with 'official website' (P856) set to your domain, then add it to Organization.sameAs. Don't create one if you're not notable; it will be deleted.
   Verify:
     curl -s 'https://www.wikidata.org/w/api.php?action=wbsearchentities&format=json&language=en&search=pipandbruno.com' | jq '.search[] | {id,label}'
5. [low] Put your main content in the HTML (+2.5 pts)
   AI crawlers mostly don't run JavaScript. Server-render or pre-render the page (SSR/SSG) so the raw HTML carries at least ~300 words that explain what you do, for whom, and why.
   Verify:
     curl -s -A 'Mozilla/5.0 (compatible; GPTBot/1.3; +https://openai.com/gptbot)' 'https://pipandbruno.com/' | sed -e 's/<script.*<\/script>//g' -e 's/<[^>]*>/ /g' | wc -w   # raw HTML word count; aim for 300+
6. [low] Add /llms.txt (+2 pts)
   Use the llms.txt draft in "Ready-to-paste fixes" below (llmstxt.org format).
   Verify:
     curl -s -o /dev/null -w '%{http_code}\n' 'https://pipandbruno.com/llms.txt'   # expect 200; then: curl -s 'https://pipandbruno.com/llms.txt' | head -1   # starts with '# '
7. [low] Add question headings that match what people ask (+1.5 pts)
   Add H2/H3 headings phrased as questions ("How much does X cost?", "What is X?") on your key pages, each followed by a direct answer.
   Verify:
     curl -s 'https://pipandbruno.com/' | grep -ioE '<h[23][^>]*>[^<]*\?</h[23]>'   # question headings in raw HTML
8. [low] Answer each question in the first sentence or two (+1.5 pts)
   Right under each question heading, put a 1-3 sentence answer (8-70 words) before details, tables or CTAs. Engines quote that first paragraph.
   Verify:
     curl -s 'https://pipandbruno.com/' | grep -ioE '<h[23][^>]*>[^<]*\?</h[23]>'   # question headings in raw HTML
9. [low] Add Open Graph tags (+0.3 pts)
   og:title, og:description and og:image control how links to you look in chats and AI answers that render previews.
   Verify:
     curl -s 'https://pipandbruno.com/' | grep -io '<meta[^>]*property="og:[^"]*"[^>]*>'   # og:title, og:description, og:image