Domain report: pipandbruno.com

Every fix, highest priority first

1. medium email No SPF record.
   How to fix

   This domain does not seem to send mail: publish TXT "v=spf1 -all".

   Check it worked:

   dig +short TXT pipandbruno.com | grep -i spf1

2. medium web No HSTS header.
   How to fix

   Send Strict-Transport-Security: max-age=31536000; includeSubDomains once every subdomain serves HTTPS.

   Check it worked:

   curl -sI 'https://pipandbruno.com/' | grep -iE '^(strict-transport-security|content-security-policy|x-content-type-options|referrer-policy|permissions-policy|x-frame-options|location|HTTP)'

3. medium web No Content-Security-Policy.
   How to fix

   Start with Content-Security-Policy-Report-Only listing your script/style sources, then enforce it.

   Check it worked:

   curl -sI 'https://pipandbruno.com/' | grep -iE '^(strict-transport-security|content-security-policy|x-content-type-options|referrer-policy|permissions-policy|x-frame-options|location|HTTP)'

4. medium web The site can be framed by other sites (clickjacking).
   How to fix

   Send X-Frame-Options: DENY (or SAMEORIGIN), or CSP frame-ancestors 'self'.

   Check it worked:

   curl -sI 'https://pipandbruno.com/' | grep -iE '^(strict-transport-security|content-security-policy|x-content-type-options|referrer-policy|permissions-policy|x-frame-options|location|HTTP)'

5. medium AI visibility Add an Organization (or LocalBusiness) JSON-LD item
   How to fix

   Engines and Google validate these types. The Organization JSON-LD in "Ready-to-paste fixes" is complete.

   Check it worked:

   curl -s 'https://pipandbruno.com/' | grep -c 'application/ld+json'   # >= 1; then paste the URL into https://validator.schema.org/

6. medium AI visibility Add dateModified and sitemap lastmod
   How to fix

   Add dateModified to Article/WebPage JSON-LD, send a real Last-Modified header, and keep <lastmod> in your sitemap accurate when pages change.

   Check it worked:

   curl -sI 'https://pipandbruno.com/' | grep -i last-modified; curl -s 'https://pipandbruno.com/' | grep -o '"dateModified"[^,}]*'

7. medium AI visibility Add sameAs links to your Organization JSON-LD
   How to fix

   List your official profiles (LinkedIn, X, GitHub, Crunchbase, Wikipedia/Wikidata, YouTube) in Organization.sameAs so engines can tie the site to one entity.

   Check it worked:

   curl -s 'https://pipandbruno.com/' | grep -c 'application/ld+json'   # >= 1; then paste the URL into https://validator.schema.org/

8. medium AI visibility Get a Wikidata item that points to your site
   How to fix

   If your organization meets Wikidata's notability policy, create an item with 'official website' (P856) set to your domain, then add it to Organization.sameAs. Don't create one if you're not notable; it will be deleted.

   Check it worked:

   curl -s 'https://www.wikidata.org/w/api.php?action=wbsearchentities&format=json&language=en&search=pipandbruno.com' | jq '.search[] | {id,label}'

9. low dns Add CAA records so only your certificate authorities can issue for this domain
   How to fix

   With no CAA record any public CA may issue a certificate for your domain (RFC 8659).

   Paste (CAA at pipandbruno.com):

   0 issue "letsencrypt.org"
   0 issuewild "letsencrypt.org"
   0 issue "pki.goog; cansignhttpexchanges=yes"
   0 issuewild "pki.goog; cansignhttpexchanges=yes"
   0 issue "ssl.com"
   0 issuewild "ssl.com"
   0 issue "sectigo.com"
   0 issuewild "sectigo.com"
   0 iodef "mailto:security@pipandbruno.com"

   DNS is on Cloudflare: Cloudflare adds these CAA records for Universal SSL automatically once you add any CAA record; listing them keeps edge certificates working. Add your own CA too if you use one at the origin.

   1. Add each line as a CAA record on the root (@): flags 0, tag issue/issuewild/iodef, value as shown.
   2. If a hostname is a CNAME, the target's CAA also applies; check it too.

   Check it worked:

   dig +short CAA pipandbruno.com

10. low dns DNSSEC is not on (not signed (no DS record)).
    How to fix

    Turn on DNSSEC at your DNS host and add the DS record at the registrar.

    Check it worked:

    dig +dnssec +short DS pipandbruno.com

11. low disclosure No /.well-known/security.txt, so researchers have no listed way to report a vulnerability.
    How to fix

    Publish /.well-known/security.txt with Contact: mailto:security@<domain> and an Expires: date within a year (RFC 9116).

    Check it worked:

    curl -s https://pipandbruno.com/.well-known/security.txt | grep -iE '^(contact|expires):'

12. low AI visibility Put your main content in the HTML
    How to fix

    AI crawlers mostly don't run JavaScript. Server-render or pre-render the page (SSR/SSG) so the raw HTML carries at least ~300 words that explain what you do, for whom, and why.

    Check it worked:

    curl -s -A 'Mozilla/5.0 (compatible; GPTBot/1.3; +https://openai.com/gptbot)' 'https://pipandbruno.com/' | sed -e 's/<script.*<\/script>//g' -e 's/<[^>]*>/ /g' | wc -w   # raw HTML word count; aim for 300+

13. low AI visibility Add /llms.txt
    How to fix

    Use the llms.txt draft in "Ready-to-paste fixes" below (llmstxt.org format).

    Check it worked:

    curl -s -o /dev/null -w '%{http_code}\n' 'https://pipandbruno.com/llms.txt'   # expect 200; then: curl -s 'https://pipandbruno.com/llms.txt' | head -1   # starts with '# '

14. low AI visibility Add question headings that match what people ask
    How to fix

    Add H2/H3 headings phrased as questions ("How much does X cost?", "What is X?") on your key pages, each followed by a direct answer.

    Check it worked:

    curl -s 'https://pipandbruno.com/' | grep -ioE '<h[23][^>]*>[^<]*\?</h[23]>'   # question headings in raw HTML

15. low AI visibility Answer each question in the first sentence or two
    How to fix

    Right under each question heading, put a 1-3 sentence answer (8-70 words) before details, tables or CTAs. Engines quote that first paragraph.

    Check it worked:

    curl -s 'https://pipandbruno.com/' | grep -ioE '<h[23][^>]*>[^<]*\?</h[23]>'   # question headings in raw HTML

16. low AI visibility Add Open Graph tags
    How to fix

    og:title, og:description and og:image control how links to you look in chats and AI answers that render previews.

    Check it worked:

    curl -s 'https://pipandbruno.com/' | grep -io '<meta[^>]*property="og:[^"]*"[^>]*>'   # og:title, og:description, og:image