munar-ke.vercel.app

Google can usually render JavaScript, but it does so on a delay and inconsistently. Most AI assistant crawlers do not render JavaScript at all — they read the raw HTML and move on. That means the machines increasingly deciding which businesses to recommend see a blank page where your content should be.

Move to server-side rendering or static generation so the content is present in the initial HTML. In Next.js this is the default behaviour and typically means moving data fetching out of client components.

An attacker can load your site invisibly inside their own page and trick your visitors into clicking your buttons — submitting a form or authorising an action they cannot see. It is also used to host convincing copies of login pages.

Add X-Frame-Options: SAMEORIGIN, or a frame-ancestors directive in your Content Security Policy.

Most sites are reachable at several addresses — with and without www, with and without a trailing slash, http and https. Without a canonical tag telling Google which is the real one, your ranking strength is split between duplicates instead of concentrated on one page.

Add a canonical link tag to every page pointing at its single preferred address.

A Content Security Policy tells the browser which scripts it is allowed to run. Without one, if an attacker manages to inject code into a page — through a comment field, a compromised plugin, or a third-party script that gets hijacked — the browser executes it without question. This is the mechanism behind most card-skimming attacks on small e-commerce sites.

Add a Content-Security-Policy header listing the domains permitted to serve scripts, styles and frames. Roll it out in report-only mode first so you can see what would break before enforcing it.

Without this header, browsers may guess the type of a file rather than trusting what the server declares. An uploaded image that actually contains script can then be executed as script.

Add the header X-Content-Type-Options: nosniff. It is a one-line server configuration change.

The browser stops building the page and waits for each of these to download and run before showing anything. Each one adds directly to how long a visitor stares at a blank screen.

Add defer (or async, where order does not matter) to these tags, or move them to the end of the document.

Structured data is the machine-readable summary of who you are, what you sell, where you are and when you are open. Google uses it for rich results, and ChatGPT, Perplexity and Google AI Overviews lean on it heavily when deciding which business to name in an answer. Without it, an AI assistant asked to recommend a supplier in your category has to guess from your prose — and it will more often name a competitor whose details it can read cleanly.

Add Organization and LocalBusiness schema with your name, address, phone, hours and service area, plus Product or Service schema on the relevant pages and FAQPage schema on any question-and-answer content.

DMARC reporting is how you find out that someone is trying to send email as your company, and which of your own tools are misconfigured. Without a reporting address, that intelligence is discarded.

Add an "rua=mailto:" address to the DMARC record and review the aggregate reports.

Without a referrer policy, the full address of the page a visitor came from — which may contain private identifiers or search terms — is passed to every external site they click through to.

Add Referrer-Policy: strict-origin-when-cross-origin.

Referencing the sitemap from robots.txt is the standard way crawlers discover the full list of your pages without having to find each by following links.

Add a Sitemap: line to robots.txt with the full sitemap URL.

When someone shares your link on WhatsApp, LinkedIn or Facebook, these tags decide whether it appears as a rich preview with an image and headline, or as a bare grey URL. In a market where WhatsApp is the main sharing channel, this directly affects how many people click a link a customer forwards.

Add og:title, og:description and og:image (1200x630px) to every page, plus the Twitter card equivalents.

If your business runs on a free consumer email address rather than one at your own domain, it costs you credibility on every quote you send, and it means you do not control your own business correspondence — if that account is lost or locked, the history goes with it.

Set up business email on your own domain (Google Workspace or Microsoft 365), then configure SPF, DKIM and DMARC at the same time.