Your site is down right now. Here's what to tell your host, and what we found when it was up.

Not a neglected brochure site. Most reviews open by telling you your site is broken: yours mostly isn't.

Yoast SEO is complete (meta + breadcrumb schema on every page) with a full XML sitemap set. The Insights blog is genuinely current, latest article April 13, 2026, and the federal pages were maintained this year (SDVOSB touched 2026-02-08).

The contact form is real and structured, with a honeypot and Cloudflare Turnstile, a step above the mailto links most competitors still use. And the positioning is sharp: dedicated SDVOSB, SSHO, and Caltrans pages naming USACE, NAVFAC, VA, EM 385-1-1, and your set-aside/IDIQ questions directly.

The findings below are one specific gap, the machine-readable layer for AI discovery, plus one real bug worth fixing.

Renew the origin certificate → you stop losing every single visitor, today. Right now anyone who types your address gets a blank error page, so every dollar you have ever spent on being findable is being spent to deliver people to nothing. This is the one fix that pays for itself before lunch.

Structured federal credentials → you get shortlisted when a buyer's AI searches by capability. The UEI, CAGE, agencies, and EM 385-1-1 that decide a bid sit in prose today, so an assistant hunting an SDVOSB safety sub can't surface you: making those facts machine-readable puts you in the answer instead of off the list.

Fix the homepage/contact JavaScript error → leads stop bouncing off a broken conversion page. The error throws on the very page where inquiries convert, and the day it silently breaks the form or menu on a phone is the day a lead quietly leaves; a one-line fix protects that.

A one-screen AI front door → an assistant asked "who does SDVOSB EM 385 safety" can actually name you. There's no single machine-readable answer to that question today, so the firm whose whole pitch is "find us by capability" is invisible to the tool now doing the finding.

A capability-matched intake form → "we'll get back to you" becomes "we already know your agency and the certified pro who fits." The form can't take the answers your own SDVOSB page asks for, so every federal lead arrives half-qualified; capturing agency, vehicle, and certs turns inbound into faster, better-matched bids.

Ask an AI to "find an SDVOSB safety sub with EM 385-1-1 experience and a CHST for a USACE project, verified in SAM.gov", and your most valuable facts are unreadable to it.

Your SDVOSB status, UEI Z1RTBMG8T735, CAGE 8KXF8, NAICS 541620/541690, and EM 385-1-1 live only as prose plus a bare Yoast Organization node: no address, no areaServed, no identifier for UEI/CAGE, no knowsAbout, no Service. The SSHO, SDVOSB, and Caltrans pages all emit the same generic graph.

$ curl -s ehsanalytical.com/federal-contracting-sdvosb/ | grep -o 'UEI: Z1RTBMG8T735'
UEI: Z1RTBMG8T735          # the fact is on the page, in prose
schema @type on /, /ssho-services-california/, /federal-contracting-sdvosb/:
  WebPage · WebSite · Organization · BreadcrumbList · ImageObject   # and only here
grep for "identifier" / "areaServed" / "makesOffer" / "knowsAbout":  0 matches

Federal procurement is quietly moving to AI-assisted capability search. The firm whose UEI, CAGE, agencies, and EM 385 competency are structured data gets surfaced; the firm whose facts sit in paragraphs does not. Cheapest to fix, compounding value.

On the homepage and the contact page, your conversion page, a JavaScript error throws on every load, desktop and mobile: elementorFrontendConfig is not defined.

A script runs before Elementor's frontend config is defined (a load-order conflict). At best it's noise; at worst it silently breaks interactive widgets: accordions, sliders, the mobile menu, form behaviors. This isn't a strategy gap; it's a bug, on the page where leads convert.

$ playwright  page.on('pageerror')
  https://ehsanalytical.com/          -> elementorFrontendConfig is not defined
  https://ehsanalytical.com/contact/  -> elementorFrontendConfig is not defined  (desktop + mobile)

A one-line defer/ordering fix. It costs nothing to leave, until the day it breaks the form or the menu on a phone and a lead bounces. Worth closing regardless of the rest.

No llms.txt, the plain-text file AI assistants increasingly read first to learn what a business does. For a firm whose whole pitch is find us by capability, there's no one-screen answer naming the two lanes, the credentials, the agencies, and how to engage.

$ curl -s -o /dev/null -w '%{http_code}\n' ehsanalytical.com/llms.txt
404

One static file. The Agent Kit page drafts it for you from your own published facts.

Your form is structured and protected (credited above), but it asks only name, email, phone, company, subject, message. It can't capture what lets a federal or state buyer self-qualify: agency, contract vehicle / IDIQ, location, dates, certifications, EM 385 scope, prime-vs-sub, set-aside type.

Your own SDVOSB page poses the buyer's questions, "What federal contract vehicles or IDIQs are you on?", yet the form can't take the answers.

form fields on /contact/:  name · email · phone · company · subject · message
missing for a federal lead:  agency · vehicle/IDIQ · location · dates · certs · EM385 scope · prime/sub

A short capability-matched intake turns "we'll get back to you" into "we already know your agency, your vehicle, and which certified pro fits", and creates the data spine any automation stands on.

The HSTS header is present but set to max-age=0, so HTTPS isn't actually pinned. There's no Content-Security-Policy, X-Frame-Options, Referrer-Policy, or Permissions-Policy (though X-Content-Type-Options: nosniff is present, good).

Stated from your own public response headers; nothing was tested, and this is not a vulnerability claim.

$ curl -sSI ehsanalytical.com | grep -i strict-transport-security
strict-transport-security: max-age=0; includeSubDomains; preload