For anyone about to ship a website or a web app
Launch ProofCheck a new site before it goes live - from what it actually serves.
Paste what the site serves: the response headers, the HTML head, robots.txt, the sitemap, llms.txt and the manifest. Your browser runs the launch checklist - security headers, SEO and GEO, Open Graph, favicons - reads robots.txt the way crawlers do (a bot with its own group ignores the * group), holds the AI crawlers to the right policy for your kind of site, and writes the files that need no judgement: robots.txt, the security headers for your host, manifest.json. Then the launch report, and the files that need words.
The site free
What the site serves free
Paste each one as it is served - from the staging or the live URL. Nothing leaves your browser unless you run or save.
Fill every box from one paste
Run this in a terminal (macOS, Linux or WSL). It only reads what the site serves, with plain curl.
The command
The checks free
What the page flags
AI crawlers, as robots.txt reads them
Phase by phase
The files that need no judgement free
Written from your settings and what the head loads - review them, then ship them.
robots.txt
Security headers
Replace {NONCE} with a per-request nonce from your framework - or loosen the level above if the site has inline scripts it cannot nonce.
manifest.json
The launch report metered
Pricing as soon as the session is ready...
Sign inThe reply could not be read. Here it is as it came back:
Caveats
Caveats
The page's check of this reply
Saved launches
How it works - and what is sourced
The checklist is the skill's phases 4 to 7. Security: a Content-Security-Policy at the chosen tightness with no 'unsafe-inline' scripts, HSTS for a year with includeSubDomains and preload, X-Frame-Options DENY, nosniff, a strict Referrer-Policy, a Permissions-Policy that denies camera, microphone, geolocation and payment, no version fingerprints and no secret keys in the page. SEO and GEO: robots.txt with the sitemap, the AI-crawler policy, a valid sitemap, llms.txt, JSON-LD, a 50-60 character title and a 150-160 character description, a canonical, no stray noindex, hreflang when multilingual. Social: the five Open Graph tags, a 1200 by 630 image with its alt, the Twitter card. Favicons: an SVG with a PNG fallback, an apple-touch-icon, a complete manifest, no deprecated tiles.
The AI-crawler policy follows the skill's decision matrix: doc sites and marketing sites allow the AI crawlers and block the low-value scrapers (Bytespider, Amazonbot); portfolios allow the four that cite (GPTBot, ClaudeBot, PerplexityBot, Google-Extended); paid courses and SaaS apps block them all; with no type chosen, the default is to block all and ask. robots.txt is read as crawlers read it - a crawler named in its own group ignores the * group entirely. What the page cannot see - an observatory grade, the JS bundle, a live share preview - is listed as a check to do by hand.