Zigzag: A Lightweight Web Browser for Mac

No frame-embedding restriction was observed (neither CSP frame-ancestors nor X-Frame-Options).

HTTPS protects what visitors send you, and response headers limit what a hostile page can do in their browser. It is there, but weaker than this check expects.

Send Content-Security-Policy: frame-ancestors 'self' (or 'none', or a list of partner origins), or X-Frame-Options: SAMEORIGIN. It stops other sites from framing your pages to trick visitors into clicking (clickjacking).

No Content-Security-Policy detected.

HTTPS protects what visitors send you, and response headers limit what a hostile page can do in their browser. It is there, but weaker than this check expects.

Configure an enforced policy for script and resource origins; use report-only monitoring to prepare changes safely.

No explicit restriction on sensitive browser features was observed.

HTTPS protects what visitors send you, and response headers limit what a hostile page can do in their browser. It is there, but weaker than this check expects.

Disable unused camera, microphone, or geolocation access using Permissions-Policy.

No HTML forms were found.

HTTPS protects what visitors send you, and response headers limit what a hostile page can do in their browser. This check does not apply to the features observed in this sample.

Check JavaScript-generated form transport separately if present.

No enabled, named password inputs in sampled HTML.

HTTPS protects what visitors send you, and response headers limit what a hostile page can do in their browser. This check does not apply to the features observed in this sample.

Review authentication forms separately when applicable.

Site serves over HTTPS.

HTTPS protects what visitors send you, and response headers limit what a hostile page can do in their browser. The inspected source provides this signal.

Nothing to do here.

http:// permanently redirects to https://./

HTTPS protects what visitors send you, and response headers limit what a hostile page can do in their browser. The inspected source provides this signal.

Nothing to do here.

HSTS is set: max-age=31536000.

HTTPS protects what visitors send you, and response headers limit what a hostile page can do in their browser. The inspected source provides this signal.

Nothing to do here.

No Referrer-Policy is set, so browsers apply their default, strict-origin-when-cross-origin, which sends only the origin to other sites.

HTTPS protects what visitors send you, and response headers limit what a hostile page can do in their browser. The inspected source provides this signal.

Nothing to do here.

nosniff is set.

HTTPS protects what visitors send you, and response headers limit what a hostile page can do in their browser. The inspected source provides this signal.

Nothing to do here.

No insecure subresources detected.

HTTPS protects what visitors send you, and response headers limit what a hostile page can do in their browser. The inspected source provides this signal.

Nothing to do here.

No X-Powered-By disclosure.

HTTPS protects what visitors send you, and response headers limit what a hostile page can do in their browser. The inspected source provides this signal.

Nothing to do here.

No /llms.txt file.

This is what an AI assistant relies on when deciding whether it can quote your page. It is there, but weaker than this check expects.

Optional: publish an llms.txt index of useful pages. This proposal is not a requirement for Google AI features, and its absence does not reduce the core score.

Only 1% of 137 H2/H3 headings are question-shaped.

This is what an AI assistant relies on when deciding whether it can quote your page. It is there, but weaker than this check expects.

Phrase key subheadings as the questions users actually ask ("How much does X cost?"). This improves the measured question-heading signal; the audit does not guarantee citations.

The opening paragraph doesn't define what the site/topic is: "The lightweight browser for Mac. Free and open source.…"

This is what an AI assistant relies on when deciding whether it can quote your page. It is there, but weaker than this check expects.

"X is a Y that does Z for W" in the first paragraph gives answer engines a liftable definition of you. Write it once, benefit everywhere.

No dateModified schema or visible 'updated' dates found.

This is what an AI assistant relies on when deciding whether it can quote your page. It is there, but weaker than this check expects.

For content where dates matter, show the actual update date and mirror it in dateModified. Do not invent dates or change them without a substantive update. Missing dates alone do not prove stale content.

Only 2 of 4 provenance signal types were found: author, contact.

This is what an AI assistant relies on when deciding whether it can quote your page. It is there, but weaker than this check expects.

Add the missing author, date, breadcrumb, or contact signal so machines can identify provenance and site structure.

• https://zigzagbrowser.com/
• https://zigzagbrowser.com/release-notes/
• https://zigzagbrowser.com/download/

No markdown copy answered at /index.md or /release-notes/index.md or /index.html.md.

This is what an AI assistant relies on when deciding whether it can quote your page. It is there, but weaker than this check expects.

Publish a clean markdown copy of each key page at /page.md (or /page.html.md). It strips navigation and scripts, so a retriever spends its budget on your content.

• https://zigzagbrowser.com/
• https://zigzagbrowser.com/release-notes/

No /llms-full.txt.

This observation could not be established from the available evidence. Resolve the collection limit or inspect the relevant source before deciding whether a change is needed.

Optional companion to llms.txt containing your full content as one markdown file — useful for sites whose pages are JS-heavy.

No Article/BlogPosting schema found.

This observation could not be established from the available evidence. Resolve the collection limit or inspect the relevant source before deciding whether a change is needed.

Add Article schema with author and datePublished so the page exposes clear provenance for retrieval. This audit does not measure or guarantee citations or rankings.

11 concrete figures across 583 words.

This observation could not be established from the available evidence. Resolve the collection limit or inspect the relevant source before deciding whether a change is needed.

Good — keep facts specific and current, and date-stamp them.

No readable llms.txt was available to inspect for Markdown links.

This observation could not be established from the available evidence. Resolve the collection limit or inspect the relevant source before deciding whether a change is needed.

Publish a readable llms.txt, then link its important pages with same-origin Markdown URLs.

No readable /llms.txt, so its structure cannot be checked.

This observation could not be established from the available evidence. Resolve the collection limit or inspect the relevant source before deciding whether a change is needed.

Publish llms.txt first — the llms.txt check covers that — then this one verifies the structure.

The homepage answered Accept: text/markdown with text/html; charset=utf-8.

This is what an AI assistant relies on when deciding whether it can quote your page. This check does not apply to the features observed in this sample.

Optional: return a stripped markdown body when the request asks for text/markdown. Some hosts and CDNs do this for you; a plain HTML answer is not a defect.

No OpenAPI interface was advertised by sampled HTML.

This is what an AI assistant relies on when deciding whether it can quote your page. This check does not apply to the features observed in this sample.

An API is optional. Add a service-desc link if you already publish a machine-readable API specification.

The audited URL is allowed for evaluated answer-search crawlers.

This is what an AI assistant relies on when deciding whether it can quote your page. The inspected source provides this signal.

Nothing to do here.

FAQ/QA schema found.

This is what an AI assistant relies on when deciding whether it can quote your page. The inspected source provides this signal.

Nothing to do here.

Semantic structure present: main×1, section×8, nav×1, header×1, footer×1.

This is what an AI assistant relies on when deciding whether it can quote your page. The inspected source provides this signal.

Nothing to do here.

Paragraphs get to the point without preamble.

This is what an AI assistant relies on when deciding whether it can quote your page. The inspected source provides this signal.

Nothing to do here.

Paragraphs average 14 words, lists present — chunk-friendly.

This is what an AI assistant relies on when deciding whether it can quote your page. The inspected source provides this signal.

Nothing to do here.

18 outbound reference(s) across crawled pages.

This is what an AI assistant relies on when deciding whether it can quote your page. The inspected source provides this signal.

Nothing to do here.

Brand declared: og:site_name "Zigzag" + identity schema.

This is what an AI assistant relies on when deciding whether it can quote your page. The inspected source provides this signal.

Nothing to do here.

Meta description works as a standalone summary.

This is what an AI assistant relies on when deciding whether it can quote your page. The inspected source provides this signal.

Nothing to do here.

The site is consistently named "Zigzag" and 2 identity URL(s) stay on zigzagbrowser.com.

This is what an AI assistant relies on when deciding whether it can quote your page. The inspected source provides this signal.

Nothing to do here.

1 concise answer block(s) follow 1 question-shaped heading(s).

This is what an AI assistant relies on when deciding whether it can quote your page. The inspected source provides this signal.

Nothing to do here.

No privacy policy page is linked or crawlable.

A publisher review looks for this before it accepts a site. Right now the sampled pages don't provide it.

Publish an accessible privacy policy that discloses cookies and data use by Google and other third-party ad vendors.

1/3 editorial pages expose fewer than 250 publisher words; those 3 pages hold 10812 publisher words in total.

A publisher review looks for this before it accepts a site. It is there, but weaker than this check expects.

Review whether each page fully serves its purpose. Expand incomplete editorial content with useful information; keep concise navigation and tool pages when they help visitors.

• https://zigzagbrowser.com/download/

No terms of use page found.

A publisher review looks for this before it accepts a site. It is there, but weaker than this check expects.

Consider adding terms that identify the service rules and publisher. This is a transparency heuristic, not an AdSense requirement.

No about page found.

A publisher review looks for this before it accepts a site. It is there, but weaker than this check expects.

Add an About page that identifies the publisher, site purpose, and relevant experience. This supports content transparency but is not a standalone AdSense requirement.

2/3 crawled pages don't link to the privacy policy.

A publisher review looks for this before it accepts a site. It is there, but weaker than this check expects.

Place the privacy link in shared navigation or footer markup so users can reach disclosures from any sampled entry page.

• https://zigzagbrowser.com/release-notes/
• https://zigzagbrowser.com/download/

Contact email does not align with zigzagbrowser.com: a@zigao.wang.

A publisher review looks for this before it accepts a site. It is there, but weaker than this check expects.

Use an address on the publisher's domain when practical so readers can verify the publisher identity. This is a practitioner trust heuristic, not an AdSense requirement.

1/1 sampled editorial pages lack detectable author attribution.

A publisher review looks for this before it accepts a site. It is there, but weaker than this check expects.

Identify who created editorial content with a visible byline, author link, or matching Article author markup. This is a transparency heuristic, not an AdSense approval rule.

• https://zigzagbrowser.com/release-notes/

A privacy page was not present in the crawl sample, so its disclosures could not be verified.

This observation could not be established from the available evidence. Resolve the collection limit or inspect the relevant source before deciding whether a change is needed.

Confirm the policy explains cookies or similar storage, Google or advertising vendors, and third-party data use.

No ads.txt yet.

This observation could not be established from the available evidence. Resolve the collection limit or inspect the relevant source before deciding whether a change is needed.

When AdSense provides your publisher entry, publish it exactly at /ads.txt and monitor authorization status in your account.

No cookie-consent banner or CMP script detected.

This observation could not be established from the available evidence. Resolve the collection limit or inspect the relevant source before deciding whether a change is needed.

Before serving Google ads in the EEA, UK, or Switzerland, implement a Google-certified consent management platform that integrates with the IAB TCF.

Domain age isn't visible from the site itself.

This observation could not be established from the available evidence. Resolve the collection limit or inspect the relevant source before deciding whether a change is needed.

Do not use age as a content-quality proxy. Verify ownership and account eligibility in AdSense; Google's general eligibility page publishes no domain-age threshold.

No attributed editorial page was available for an author-background check.

This observation could not be established from the available evidence. Resolve the collection limit or inspect the relevant source before deciding whether a change is needed.

Add attribution first; the separate author check lists affected pages.

No article-shaped page was found on this site, so there is nothing to read.

This observation could not be established from the available evidence. Resolve the collection limit or inspect the relevant source before deciding whether a change is needed.

Publish articles under a path such as /blog/… and list them in the sitemap. This check then reads the newest one.

No article-shaped page was found on this site, so there is nothing to read.

This observation could not be established from the available evidence. Resolve the collection limit or inspect the relevant source before deciding whether a change is needed.

Publish articles under a path such as /blog/… and list them in the sitemap. This check then reviews its style signals.

No article-shaped page was found on this site, so there is nothing to read.

This observation could not be established from the available evidence. Resolve the collection limit or inspect the relevant source before deciding whether a change is needed.

Publish articles under a path such as /blog/… and list them in the sitemap. This check then looks for its byline and date.