On a hosted site builder you do not control the server, and a good part of this rubric is about the server. That is not a reason to give up on the score. It is a reason to sort the checks into three piles before spending an afternoon on them: the ones the dashboard reaches, the ones that need a workaround, and the ones out of reach on the platform as it stands. This post does that sorting for Squarespace and Wix, and says where to stop.
Two caveats first. The specifics below describe documented default behaviour as of this writing; confirm anything you are about to rely on against the Squarespace developer documentation or the Wix developer documentation. And the two platforms are not the same: Wix exposes more of the site to a developer than Squarespace does, so a workaround that exists on one may not exist on the other.
Pile one, reachable from the dashboard
The checks below are ordinary page settings on both platforms, and they add up.
Titles, descriptions and Open Graph (B4, three points). Both platforms give every page a title and description field and generate the Open Graph tags from them plus a chosen image. The scanner wants a unique title of 15 to 70 characters and a description of 50 to 160 on every crawled page, with og:title, og:description and og:image all present. Blank description fields are the usual finding; the fallback the platform generates is rarely the right length.
Alt text (B6, two points). Both editors have an alt-text field on images. B6 wants 80% of content images captioned, so this is a pass through the image library.
Policies (D3, four points) and contact details (D2, two of four points). A privacy page and a terms page, or shipping and returns pages for a shop, linked from the footer. The check looks for links whose href contains words like privacy, terms, shipping and returns, so name the pages plainly. A contact page or a mailto: link covers half of D2.
Canonical and host hygiene (B7, three points). By default both platforms emit a rel=canonical on each page and redirect the www and non-www variants to whichever you chose as primary. Check the redirect after connecting a custom domain.
Headings (B3, part of four points). The template decides the landmarks; you decide the headings. Using the heading picker for size rather than structure produces pages that jump from h1 to h3, and one h1 per page covers the rules.
Robots and sitemap (A1, A2, A3, eleven points). Both platforms generate a sitemap and a robots.txt by default. Wix documents a robots.txt editor in its SEO settings; Squarespace generates the file for you, and as of this writing you should check the current documentation for whether it can be edited. Either way, fetch the live file: A2 wants none of the six named agents disallowed, and A3 wants the sitemap referenced from it.
Structured data (B1, B2, ten points), partly. Wix documents structured data fields in its per-page SEO settings, and both platforms may emit some JSON-LD for certain page types by default. Whether it is valid and whether it includes the types B2 wants is something to read off the typesFound list in the scan evidence rather than assume. Where a platform offers a head-code field, a fixed Organization block with a sameAs array covers the sitewide half of B2 and the other half of D2, once, for every page.
Pile two, needs a workaround
These are the checks the platforms were not designed for. Each is a file served at an exact path on your own domain.
llms.txt (A4, four points). Neither platform documents a way to place an arbitrary text file at the root of the domain by default; what both document is a redirect manager and a way to upload a file. Squarespace serves uploaded files at a path under /s/ on your domain, and its URL mappings accept a source path and a destination. Wix hosts uploads on its own media domain. In both cases the workaround is the same shape: upload the file, then map /llms.txt to it with a 301.
Our scanner follows redirects when it fetches root files, so what A4 scores is the body at the end of the chain. It wants three or more links in this form, a Markdown link followed by a colon and a description:
- [Pricing](https://example.com/pricing): Plans and what each includes.
Fewer than three scores one point of four. Whether a given redirect manager accepts a source path with a file extension, and whether it will redirect to another host, is something to test on your own site. If the mapping is refused, this check moves to pile three.
security.txt (D6, two points). Same workaround, with the additional question of whether the redirect manager accepts a source path beginning with /.well-known/. The file itself is five lines; security.txt in ten minutes has the template. The scanner wants a Contact: line and an Expires: line with a date in the future. If the redirect route works for llms.txt, try it here next; if the leading dot is rejected, stop.
agents.json (C4, part of five points). A static JSON file at the root that parses. The redirect route serves it, but the harder question is whether you have anything true to put in it. C4 also credits a homepage link to API documentation or a discoverable OpenAPI spec; a shop or a services firm on a site builder usually has neither, and the honest score is zero.
Pile three, out of reach as of this writing
Response headers (D1, one of four points). The Strict-Transport-Security header is set by the platform's servers. If your platform does not send it, there is no setting to change; check the current documentation, because this is the sort of default that improves quietly.
Machine endpoints beyond a static file (C4). An MCP server or an OpenAPI-described API runs somewhere, and that somewhere is not a site builder. If your business has a product with an API elsewhere, link its documentation from the homepage footer; the check looks for a link whose href contains /docs or points at a developers. subdomain. If it does not, this check is where you stop.
Anything the platform injects. A consent banner the platform adds to every page is checked by A6 in the rendered HTML; whether it trips the check depends on whether its markup carries one of the identifiers the scanner looks for, and the markers field in the evidence tells you. If the banner cannot be turned off, the point is not yours to recover.
When to stop trying
Add up piles two and three honestly before starting pile two. The checks that most often stay out of reach on a hosted builder are A4, D6 and C4, which together are eleven points, plus the HSTS point under D1. With all twelve of those points at zero and everything in pile one at full marks, the ceiling is 88, which is inside the A band; the band starts at 85. That is a respectable position for a business whose website is a brochure, and every point recovered from pile two is a bonus rather than a requirement.
The calculation changes when the site is the product. A shop whose checkout is on the platform is scored on C5, and whether an agent can reach a cart and a price without logging in is decided by the platform's commerce layer, not by your settings. A developer product needs the endpoints C4 rewards, and a site builder is the wrong place for them. In those cases the budget is better spent on a move than on redirects, and the three tiers of fixes is the framework for that call.
The rule of thumb: do pile one in full, try pile two once and take whatever the redirect manager allows, and do not fight pile three.
Check your own site
Run the free scan and sort the findings by the piles above; the checks marked Low effort on the report are pile one. The definitions are on the methodology page under discovery and access, actionability and trust and freshness, and the pricing page says what the paid audit adds if you would rather someone read the templates for you.