# Sample report: cror.link **What this is.** Before paying for a check, it is reasonable to see exactly what you would get. This is not an invented example - it is the real report on our own site, published with the findings it produced. | | | |---|---| | **Subject** | `https://cror.link` | | **Observed** | 5 August 2026 | | **Check contract version** | 0.15 | | **Evaluated crawler** | Googlebot, plus a matrix of 10 declared AI crawler tokens | | **Method** | deterministic observation of the public surface. No score, no grade, no model opinion | --- ## 1. What was observed | Check | Observation | |---|---| | Response | HTTP 200, 23,944 bytes, no redirects | | Robots policy (Googlebot) | allowed · `noindex` absent · `nofollow` absent · `nosnippet` absent | | Canonical | 1 declared, self-referential, resolves | | `hreflang` | 0 - not applicable, single-language site | | **Sitemap** | **declared by convention at `/sitemap.xml` → HTTP 404** | | `llms.txt` | not present | | Structured data | 1 JSON-LD block, parsed, 0 syntax errors | | `Organization` schema | present | | **`sameAs`** | **absent** | | Open Graph | 5 tags · **3 of 4 basic properties, `og:image` absent** | | Visible text | 1,594 bytes of 23,944 (6.7%), script and style 3,540 bytes | | Internal links | 1 (checked, responds 200) | | **Security headers** | **0 of 6** | | **AI crawler access** | **7 of 10 declared tokens blocked** | --- ## 2. Findings Five observations rise to findings. Each states what was observed, what it affects, and who can change it. ### F1. The declared sitemap returns 404 `https://cror.link/sitemap.xml` responds `404` with an empty body. A search or AI crawler following the conventional path finds nothing, so page discovery falls back entirely to link-following. Owner: us. Effort: small. Separately embarrassing: our own launch plan lists "submit `/sitemap.xml` to Search Console" as step one, and the file is not there. That is exactly the class of gap this check exists to catch - not a subtle strategy error, but a thing everyone assumes is done. ### F2. The site is closed to most AI crawlers Of ten declared tokens, **seven are blocked**: `GPTBot`, `ClaudeBot`, `Google-Extended`, `CCBot`, `meta-externalagent`, `Applebot-Extended`, `Bytespider`, `Amazonbot`. Allowed: `OAI-SearchBot` and `PerplexityBot`. Googlebot is allowed. This is the default behaviour of the platform the site runs on, not a setting we chose - and that is the point of the finding. **An access policy exists whether or not anyone decided it.** For a company that works on machine readability, finding this on its own site is the clearest possible illustration of why the check is worth running. Worth stating plainly: this is **not necessarily a defect**. Closing access to model training can be a deliberate decision. But a decision, not a default. ### F3. `Organization` is declared with no `sameAs` The entity exists in structured data and points nowhere. `sameAs` is how a declared entity is tied to the same entity elsewhere - company registry, professional profiles, directories. Without it the declaration is an island: machine-readable, but corroborated by nothing outside our own control. Owner: us. Effort: small, but genuinely blocked on something real - the corroborating profiles have to exist before they can be linked. ### F4. `og:image` is absent Three of four basic Open Graph properties are present. When the URL is shared into a chat, a messenger or a social post, there is no card image. Owner: us. Effort: small. ### F5. None of the six observed security headers Absent: `strict-transport-security`, `content-security-policy`, `x-content-type-options`, `x-frame-options`, `referrer-policy`, `permissions-policy`. Presence is observed, not sufficiency: "CSP present" is an observation, "CSP is weak" is a judgement, and there is none here. Several of these headers are meaningful only for certain kinds of resource. --- ## 3. What this check cannot establish Stated as plainly as the findings, because a check that hides its limits is not evidence. - It observes **one URL**, not the whole site. Other pages may differ. - It observes the **public surface**, not what AI systems actually answer about the organisation. Absence of a problem here is not proof of correct representation there. - Robots policy is evaluated **per token**, and the token list is explicit and versioned. A token absent from the matrix was not checked - that is not the same as having no policy. - It observes what is **declared** in robots.txt. Whether a given crawler honours that declaration is outside the observation. - `not applicable` is a real outcome, distinct from `pass`. Where a check does not apply, we say so rather than crediting ourselves a point. - It does not check whether the business claims on the page are **true**. That is different work with a different method. - The text-to-document ratio is **a number with no threshold**. A meaningful cutoff would require a calibrated corpus and a sampling method; there is none, so there is no cutoff. --- ## 4. Why there is no overall score Folding this into "73 out of 100" is technically easy and commercially tempting. We do not do it for one reason: **a composite score hides what it is made of.** Different outcomes - "declared and working", "declared and not working", "not applicable", "could not be checked" - become indistinguishable once summed into a single number. Worse, the unchecked is usually counted as zero, so the score drops not because something was measured but because it was not. Hence five named findings instead of one number. Each can be disputed on its own. --- ## 5. What happens in paid work This sample stops at observation, which is where a free check should stop. Paid work continues: 1. **Truth set** - which public claims about the business must be correct: price, availability, certification, territory, contact, product specification. 2. **Source map** - where each claim is published today, and which of those sources you actually control. 3. **Findings** - where the surfaces disagree with each other or with the internal system of record. 4. **Fix** - corrections applied to sources you own; requests prepared for sources you do not. 5. **Verification** - publication confirmed, then a **comparable recheck** under the same conditions. 6. **Change record** - what was observed, what was changed, what was verified, what remains unverified, and the date the evidence should be rechecked. Steps 1-6 are the offer. Step 0, the check above, is free and stays free. --- *Produced with Evidence, check contract version 0.15. Observations are reproducible: the same URL, the same token and the same date give the same result. A free access check for your own site is at `evidence.bycror.com/tools/source-access-check`.* **Evidence by Bycror** · [evidence.bycror.com](https://evidence.bycror.com)