A leave-behind from a current customer · passive recon only

You already bet on being found by AI. The bet is right: two quiet leaks are keeping it from paying off.

ClickSafety is the original OSHA-authorized online outreach provider: 25+ years, 8 million courses, DOL-carded, and one of the very few training sites that ships an llms.txt to guide AI to its catalog. That instinct is exactly right: the next wave of "get my crew OSHA-30 certified" starts inside an assistant. This is a passive, respectful read of what a shopper's browser (and an AI crawler) actually receives today: five findings, each with the exact proof, and one through-line: the machine-readable layer stops at a list of links, and the plumbing under it has two fixable leaks.

🛡 Framed as leaking enrollments, not "broken." The operator is a current ClickSafety customer who holds and is earning certs here: this is a leave-behind for a conversation he can start himself, not a pitch or a cold callout. Every claim below is reproducible from ClickSafety's own public responses; nothing was logged into, submitted, or probed.

How we looked (passive only)

Standard browsing + public GETs, no more. We drove five public pages in real Chrome (Playwright, 2× DPI): home, the OSHA-30 course page, the full course catalog, Business Accounts, and the cart, capturing rendered-DOM structured-data, console/page errors, and the third-party host inventory. We fetched only public discovery files any crawler reads: robots.txt, /llms.txt, /sitemap.xml, /.well-known/*, and a handful of the site's own static-asset URLs. No account, no form submission, no endpoint probing, no scanning, no wall routed around. Recon date: 2026-07-12. Platform confirmed: Adobe Commerce (Magento), backend host prd-magento.ascendlearning.com, ClickSafety is an Ascend Learning company (its own About page and its infrastructure both say so).

The bottom line, in plain English

No jargon: you already bet on AI discovery; here's what each fix is worth in enrollments.

Fix the sitemap that's a photo → search engines and AI can find every course you sell. Right now the map you hand crawlers is a picture, so courses that ready buyers are searching for simply don't get indexed — the fix puts your whole catalog back on the shelf.

The 404-ing script on the enrollment path → already fixed, and worth saying so. Core page JavaScript was failing right where people enroll. Re-checked 2026-07-30: the static content version has been redeployed and those assets now return 200, with zero page errors on the OSHA-30 page. This one is closed.

Structured course data → an assistant asked "which OSHA course do I need" can name and price yours. The pages that answer that exact question carry nothing a machine can read, so when a shopper asks their AI, it summarizes whoever structured theirs and your course never enters the answer.

Trim the tracking mesh on the money pages → a faster, tighter checkout. Around 50 third-party origins load on the pages where people pay, including checkout; lightening that load speeds the one flow where every lost second costs an enrollment.

Turn your llms.txt from a list into a menu → an assistant can enroll a crew, not just find you. You already ship the file AI reads first — rare and right — but it stops at links; making it actionable is the small step between being found and being booked.

Your sitemap is a broken image, at both the standard path and the one your own robots.txt points to.

A sitemap is how search engines and AI indexers learn every course URL you have. ClickSafety's is not XML: it's a photo.

GET /sitemap.xml returns HTTP 200 with content-type: image/jpeg, a 1,692-byte, 262×262 JPEG. And your robots.txt explicitly directs crawlers to Sitemap: /media/clicksafety_sitemap.xml, which returns the identical 1,692-byte JPEG. So both the path a crawler tries by convention and the path you hand it resolve to the same picture, not a URL map.

proof curl -sI (2026-07-12)

# the conventional discovery path
$ curl -sI https://www.clicksafety.com/sitemap.xml
HTTP/2 200   content-type: image/jpeg   content-length: 1692

# the path your OWN robots.txt declares
$ curl -s https://www.clicksafety.com/robots.txt | grep -i sitemap
Sitemap: https://www.clicksafety.com/media/clicksafety_sitemap.xml
$ curl -sI https://www.clicksafety.com/media/clicksafety_sitemap.xml
HTTP/2 200   content-type: image/jpeg   content-length: 1692
$ file <that response> → JPEG image data, JFIF, 262x262, progressive

The actual 262x262 JPEG returned when a crawler requests the ClickSafety sitemap — Both **/sitemap.xml** and the robots-declared **/media/clicksafety_sitemap.xml** serve this identical image instead of an XML sitemap.

Why it costs enrollments: a catalog business lives or dies on being fully indexed. When your declared sitemap is an image, new and updated course URLs have no authoritative discovery path: search and AI crawlers fall back to guessing your structure, and pages that should rank for "OSHA 30 online" quietly don't.

On the enrollment path, core page JavaScript was 404-ing. Re-checked 2026-07-30: fixed.

Closed, 2026-07-30. This finding is kept on the page for the record, not as a live issue. On re-check the static content version had been redeployed (static/version1784862428, theme path frontend/BORN/Clicksafety) and the core RequireJS assets return 200; the OSHA-30 page rendered with zero page errors and zero script 404s. Nothing below is being asserted as current.

Every page's HTML tells the browser to load its JavaScript from a versioned path. On the course and cart pages, that path returned "not found."

All five pages reference static assets under static/version1783652806/…. Fetch the core Magento JavaScript at that version: requirejs/require.js, requirejs-config.js, mage/common.js, Magento_Ui/js/core/app.js, js/clicksafety-main.js, js/theme.js, and every one returns HTTP 404 as text/html (verified by plain curl, 6-of-6 consecutive hits on require.js). In real Chrome, the OSHA-30 page, the Business Accounts page, and the cart logged "Refused to execute script … MIME type ('text/html') is not executable" plus RequireJS "Script error" for those exact modules.

proof curl + rendered-Chrome console (2026-07-12)

# every page references this static version…
/ , /osha-30-construction , /courses/all-courses/ , /checkout/cart → static/version1783652806

# …and the core JS at that version 404s (independent curl, not our crawler):
$ curl -sI .../version1783652806/frontend/BORN/Clicksafety/en_US/requirejs/require.js   → 404 text/html
$ curl -sI .../mage/common.js  → 404   $ curl -sI .../Magento_Ui/js/core/app.js → 404
$ curl -sI .../js/clicksafety-main.js → 404   (require.js: 404 on 6/6 hits)

# real Chrome, on /osha-30-construction and /checkout/cart:
Refused to execute script from '…/mage/common.js' because its MIME type ('text/html') is not executable
Error: Script error for "Magento_Ui/js/core/app"  (requirejs.org/docs/errors.html#scripterror)

Why it costs enrollments: this is the exact enroll → cart path, where conversions are won or lost. JavaScript that 404s throws errors and forces RequireJS fallbacks precisely where a buyer is deciding to pay: the friction that quietly drops checkouts.

The honest caveat (why we call it a 5-minute check, not an alarm): it's intermittent: the home and full-catalog pages rendered clean (zero page errors) in the same session, which points to a stale or partially-propagated static_content_version across CDN cache nodes rather than a hard outage. We can't see the full logged-in impact passively. But it reproduces from any terminal, and it's worth your ops team confirming the deployed static version matches what's live on the edge.

The pages that answer "which OSHA course do I need" carry zero machine-readable course data.

Your prices, durations, and DOL-card details are on the page, but only as human text. There's no structured data an assistant can trust and cite.

Rendered-DOM check across the money pages: the home page, the full course catalog (/courses/all-courses/), and the flagship OSHA-30 page all return ld+json = 0 (schema.org/JSON-LD, the invisible labels search engines and AIs read): no schema.org/Course, no Offer, no Product. Prices render as plain text ($189 and $79 on OSHA-30; $65–$489 across the catalog), as do course length, DOL-card issuance, prerequisites, and state-specific variants. The OSHA-30 page does carry OpenGraph tags (social cards work), but OG isn't product data.

proof rendered-DOM structured-data check (2026-07-12)

page                         ld+json   og    prices (text only)
/                              0       0    $391 $489 $189 $89 $140
/courses/all-courses/          0       0    $200 $89 $189 $391 $140 $300 $275 $65
/osha-30-construction          0       5    $189 $79        # og present, but 0 Course/Offer schema

ClickSafety OSHA 30-Hour Construction course page rendered at 2x DPI — The flagship **OSHA 30-Hour Construction** page as rendered (2× DPI, 2026-07-12). The $189 price, the DOL-card promise, and the course scope are all here for a human, and all invisible to a machine: **zero `schema.org/Course` or `Offer`** behind any of it.

Why it costs enrollments: when a shopper asks ChatGPT, Gemini, or Perplexity "cheapest OSHA-30 with a DOL card" or "which course do I need for a scaffolding job in California," the assistant needs structured price/card/duration data to answer with a citation. With none on your pages, it summarizes a training provider who structured theirs, or guesses, and your $189 course never enters the answer.

A ~50-origin tracking mesh loads on the money pages, including checkout, while the CSP's own guardrails are wildcarded open.

A lot of engineering effort went into watching human visitors. Very little went into the machine-readable product layer, and the security header meant to contain all that has holes in it.

The live Content-Security-Policy on every page (checkout included) allowlists dozens of advertising, analytics, and session-replay origins: the full HubSpot suite, LuckyOrange session-replay (incl. a live checkout websocket wss://realtime.luckyorange.com), ZoomInfo, Microsoft Clarity, Optimizely, The Trade Desk, DoubleClick, Meta, LinkedIn, Bing, Rubicon. And the CSP weakens itself: form-action and frame-src each include a bare * wildcard, so the directive that's supposed to constrain where a form can post or what can be framed is effectively open.

proof response header + rendered third-party hosts (2026-07-12)

# from the live content-security-policy header (excerpt):
form-action … www.paypal.com *.cardinalcommerce.com * *.hubspot.com … 'self';
frame-src   … player.vimeo.com *.doubleclick.net * *.hubspot.net … 'self';
connect-src … wss://realtime.luckyorange.com/mqtt *.zoominfo.com *.clarity.ms *.adsrvr.com …

# third-party hosts that actually loaded on the cart render:
optimizely · hsforms · hs-scripts · newrelic · braintreegateway · googletagmanager · ensighten · nc0.co

Credit where due, the checkout fundamentals are solid: the session cookie is Secure; HttpOnly; SameSite=Lax, HSTS is on, X-Frame-Options: SAMEORIGIN, and object-src 'none'. This isn't a sloppy store: it's a well-built one carrying more tracking weight than its product data.

Why it costs enrollments: every one of those origins is latency on the highest-margin step (enroll → pay), a wide privacy surface on a page taking card details, and a CSP whose * wildcards blunt the protection it's meant to provide.

You already ship an llms.txt, but it's a map, not a menu. That gap is the whole opportunity.

This is the finding that turns the other four into an opening. You did the hard part: deciding to be legible to AI. You stopped about a hundred feet short of the payoff.

GET /llms.txt returns HTTP 200, 3,065 bytes: a genuinely thoughtful, brand-aware file that points assistants at your courses and Business-Account pages. That puts ClickSafety ahead of ~99% of training sites, which serve nothing. But it's a list of URLs. No prices, no course durations, no DOL-card facts, no "which course for which job or state" mapping, and no way to act: /.well-known/agent-card.json is a 404, and there are no callable tools. So an assistant learns where your OSHA-30 page is, then still has to hand the shopper back to a human to actually enroll a crew.

proof curl (2026-07-12)

$ curl -sI https://www.clicksafety.com/llms.txt            → 200  text/plain  3065 bytes  ✓ authored, brand-aware
$ curl -sI https://www.clicksafety.com/.well-known/agent-card.json → 404  # no way for an agent to act
   llms.txt contents: course + business URLs only, no prices · no durations · no DOL-card data · no tools

Why it costs enrollments: "enroll my 12-person crew in HAZWOPER" and "which course for CA scaffolding" are exactly the high-margin, agent-shaped questions coming next, and today they dead-end at a link. The fix isn't a rebuild; it's finishing what you started. That's what the next two pages show.

Credited baseline: what's genuinely well-built

The instinct is right. An authored, brand-aware llms.txt, a bet on AI discovery that almost no competitor has made.

Checkout security fundamentals hold. Secure + HttpOnly + SameSite=Lax session cookie, HSTS, X-Frame SAMEORIGIN, object-src 'none'.

The build is clean where it counts. Home and full-catalog pages rendered with zero page errors; a real robots.txt with sensible disallows.

Real authority behind it. The first OSHA-authorized online outreach provider, 25+ years, 8M courses, DOL cards: the substance AI answers want to cite.

Honesty note: our raw crawl logged extra "net::ERR_FAILED" console lines: those were induced by our own webfont blocking during screenshotting, not ClickSafety defects, and are excluded from every finding above. The meaningful signals are the reproducible curl statuses and the rendered-DOM counts.

The through-line

Seal two leaks, finish the AI layer you already started, and own "get my crew certified."

None of this is a rebuild. A working sitemap and a matched static-content version are ops fixes. Structured course data and a callable agent layer are additive: they sit on top of the Adobe Commerce store you already run. Do them and the next shopper's assistant answers "cheapest OSHA-30 with a DOL card" with your $189 course, then books the whole crew. The next page shows it in your own brand.

See the fix, in ClickSafety orange → Back to the hub