Strategic AI Architects
Free Audit Join the Community

Reference

Answers

Each page here answers one question an agency owner actually asks, completely, in the first sentence — then shows the numbers and names the dated source behind every one. Where the law is unsettled, the page says so; where a performance claim is ours, it comes from a measurement we ran on a production site, including the tests that went against the "best practice." No windup, no pitch. For the fuller discussions, see The Playbook.

Last updated: August 19, 2026

Websites & Page Speed

What actually makes an insurance agency website fast — the three Core Web Vitals, the thresholds Google publishes, and why lab scores and field data disagree. These pages cite Google's own documentation with dates, and where we make a performance claim about our own builds, it comes from a measurement we ran, including the tests that contradicted the 'best practice.'

  • What PageSpeed score does an insurance agency website actually need? A mobile performance score of 90 or above is the working pass line, because Google's ranking systems assess the three Core Web Vitals underneath the score — LCP within 2.5 seconds, INP within 200 milliseconds, CLS within 0.1, each at the 75th percentile of real visits — and a site scoring in the 90s on mobile typically clears all three with room to spare. Our own production client builds measure 99-100 on mobile because that headroom survives the tags and content a real agency adds later.
  • What is Largest Contentful Paint (LCP) and what counts as good? LCP measures how long a page takes to render its largest visible image or text block after a visitor starts loading it, and Google's published threshold for good is 2.5 seconds or less, assessed at the 75th percentile of real page loads (web.dev). It is the loading metric of the three Core Web Vitals — the number that most closely tracks 'when did the page look loaded.'
  • What is Cumulative Layout Shift (CLS) and what causes it? CLS measures how much visible page content unexpectedly moves around while a visitor uses the page, scored as a unitless number where 0.1 or less at the 75th percentile of visits counts as good (web.dev). The usual causes are images without declared dimensions, late-loading ads, embeds, and fonts, and banners injected above content that has already rendered.
  • What is Interaction to Next Paint (INP)? INP measures how long a page takes to visually respond when a visitor clicks, taps, or presses a key — approximately the slowest such interaction across the whole visit — and 200 milliseconds or less at the 75th percentile counts as good (web.dev). It became a Core Web Vital on March 12, 2024, replacing First Input Delay, which only measured input delay on the first interaction.
  • Do Core Web Vitals affect Google rankings? Yes — Google's own Search Central documentation states Core Web Vitals 'are used by our ranking systems' — but as one signal among many, and the same page warns that good scores do not guarantee top rankings, because relevance and content quality carry more weight. The honest framing: poor vitals are a handicap and a conversion problem; perfect vitals are not a ranking shortcut.
  • Why does my site score differently in Lighthouse than in PageSpeed Insights? Because the two tests run under different conditions: Lighthouse in your own browser tests on your hardware, network, and open extensions, while PageSpeed Insights runs Lighthouse on Google's servers against a simulated mid-range phone with a throttled connection — and PSI additionally shows real-visitor field data from the Chrome UX Report, which is a different measurement entirely. One URL, three legitimate numbers.
  • Do font preloads make a website faster? Sometimes — and sometimes measurably slower: when we tested adding font preloads on one of our own production insurance sites, mobile LCP regressed by roughly one second, so that site ships without them. A preload moves the font request to the front of the bandwidth queue, and on a throttled mobile connection that bandwidth can come out of the LCP image; the only way to know which effect wins on your page is to measure before and after.
  • Can a real business website score 99+ on mobile PageSpeed? Yes — our production client builds measure 99-100 on mobile PageSpeed from clean builds: justinbrock.com at 100, brockpartners.com at 100, bobbybrockinsurance.com at 99, and a 15-page agency rebuild at 99 mobile on 14 of 15 pages with a CLS of 0. The requirement is architectural — static pre-rendered HTML, right-sized images, no render-blocking third-party scripts — not a plugin added to a slow platform.
  • Why are WordPress sites often slow, and what is the alternative? WordPress is not inherently slow, but it is statistically slow: on April 2026 HTTP Archive data, roughly 49% of WordPress sites passed all three Core Web Vitals — last of seven major platforms compared — because the typical install stacks a theme, a page builder, and a dozen plugins that each add render-blocking scripts to every page. The alternative is a static-first architecture that ships pre-rendered HTML with near-zero JavaScript by default, which is how our own builds measure 99-100 on mobile.
  • Do accessibility overlay widgets slow down a website? Yes, by construction: an overlay widget is a third-party JavaScript file added to every page, and every third-party script adds a network request and main-thread work — exactly the costs Lighthouse's 'Reduce the impact of third-party code' audit exists to measure. How much it moves your score depends on the site, so measure with and without; the better-documented problem is that overlays also do not deter the accessibility lawsuits they are bought to prevent.

HIPAA & Tracking

What the tracking tags on a health or Medicare insurance website are legally allowed to do — HIPAA, the FTC, CMS, and the state wiretapping statutes, each cited to the actual rule with a date. Where the law is unsettled, these pages say so instead of pretending it isn't.

  • Does a Meta Pixel on a Medicare quote form create HIPAA liability? It can, and even where HIPAA itself never attaches, the same pixel creates FTC, CMS, and state wiretapping exposure that has already produced multi-million-dollar penalties. Meta does not sign a Business Associate Agreement for the Pixel, so any health information the tag picks up on a quote form moves without one.
  • What does OCR's tracking-technology guidance actually say about insurance agency websites? That tracking vendors handling PHI on behalf of a HIPAA-regulated business are business associates requiring a signed BAA, and that pages where a visitor submits health information trigger the HIPAA Rules — while the one rule a federal court vacated in June 2024 (IP address + public health page visit = PHI, automatically) is no longer enforceable.
  • Which analytics tools can a health insurance agency legally use? Tools that keep visitor data on infrastructure the agency controls, or come from a vendor that signs a Business Associate Agreement — self-hosted Matomo, Piwik PRO's enterprise plan, Freshpaint — plus consent-gated server-side setups. GA4 and the Meta Pixel offer no BAA, so Google's own policy restricts them to pages that never touch health information.
  • Is Google Analytics 4 HIPAA-compliant without a BAA? No. Google's own policy states it does not offer Business Associate Agreements for Google Analytics and 'makes no representations that Google Analytics satisfies HIPAA requirements' — and instructs HIPAA-regulated customers to use it only on pages that are not HIPAA-covered.
  • What is a wiretapping (CIPA) claim against a website? A claim under California Penal Code section 631 that a website's chat widget, session-replay script, or tracking pixel 'intercepted' a visitor's communications and routed them to a third party without consent — with $5,000 per violation in statutory damages under section 637.2, no actual harm required. Courts are split on the theory, and the legislative fix stalled, so the claims keep coming.
  • Do consent banners make tracking pixels legal on health insurance sites? Only if the banner actually blocks every tracker until the visitor affirmatively consents — many fire the pixel while the banner is still on screen, which provides no defense at all. And even a correctly wired banner does not create the BAA that HIPAA requires or the one-to-one written consent CMS requires of Medicare marketers.
  • What is the difference between an NDA and a BAA? An NDA is a private promise between two parties not to share confidential information, on whatever terms they choose; a BAA (Business Associate Agreement) is a HIPAA-required contract containing a fixed list of provisions that a covered entity must have in place before a vendor creates, receives, maintains, or transmits protected health information on its behalf. Signing an NDA does not satisfy HIPAA's requirement — 45 CFR 164.504(e) names specific terms, including breach reporting, subcontractor flow-down, individual access and amendment rights, and availability of records to HHS, that a general confidentiality agreement almost never contains.

AEO & AI Search

How AI engines actually find, read, and cite websites — what the engines themselves publish about their crawlers and citation behavior, what llms.txt and WebMCP are and honestly aren't yet, and where a claim is ours, it comes from something we run in production: live agent-callable MCP endpoints on our own sites and two published studies of 1,000+ insurance agency websites.

  • What is the difference between SEO and AEO? SEO optimizes a website to rank as a blue link in a search results page; AEO (answer engine optimization) optimizes it to be read, quoted, and cited as a source inside an AI-generated answer — in ChatGPT, Perplexity, or Google's AI Overviews. The work overlaps heavily, because Google's own documentation says standard SEO best practices are what qualify a page for its AI features, but the unit of success changes from a click position to a citation.
  • What is an AEO score and how is it calculated? An AEO score is a tool-specific rating of how ready a page or site is to be cited by AI engines — there is no industry-standard formula, so every score is a methodology choice by whoever built the tool. Our own audit scores five categories — Content, Q&A, E-E-A-T, Schema, and Technical — because those map to what the engines' own documentation says they need: crawlable, structured, answer-shaped pages from identifiable sources.
  • How do AI engines decide which sites to cite? The engines publish the qualifying conditions but not a ranking formula: Google says a page must be indexed and snippet-eligible to appear in AI Overviews with no special markup required, OpenAI says allowing OAI-SearchBot is what surfaces a site in ChatGPT search, and Perplexity says the same of PerplexityBot. Beyond retrievability, the engines' guidance and observed citation behavior consistently reward answer-first structure, visible freshness dates, and identifiable source authority.
  • What is llms.txt and does your website need one? llms.txt is a proposed plain-markdown file at a website's root that gives AI systems a curated map of the site's most important content — proposed by Jeremy Howard of Answer.AI on September 3, 2024, and specified at llmstxt.org. No major AI engine has officially committed to reading it, and Google's documentation says no AI text file is required for its AI features — so it is a low-cost hedge, not a requirement; we serve one on every site we run because it costs one generated file.
  • What is WebMCP and what does it let an AI agent do on a website? WebMCP is the emerging pattern of a website exposing callable tools to AI agents — so an agent can run a calculator or look up live data instead of scraping prose — and it exists today in two forms: a W3C draft browser API (navigator.modelContext, co-authored by Google and Microsoft, in Chrome origin trial) and site-served MCP endpoints over HTTP. We run the second form in production: an agent can call a real life-insurance coverage calculator on bigsiouxlife.com/mcp and a real ICHRA savings lookup on ichrasavings.com/mcp right now.
  • Which AI crawlers should an insurance agency website allow? Allow the search and user-fetch agents that produce citations and referrals — OAI-SearchBot, ChatGPT-User, Claude-User, Claude-SearchBot, PerplexityBot, Perplexity-User, Googlebot, and Bingbot — because blocking them removes the agency from AI answers. The training-only crawlers (GPTBot, ClaudeBot, CCBot, meta-externalagent, and the Google-Extended token) are a business choice with no search-visibility penalty; for a local agency trying to be found, we allow those too.

Not sure where your own site stands? Run the free Audit — a live AEO audit plus a HIPAA tracking scan, in under a minute.