Website Header & Crawl Preflight
Paste your site's response headers and get a transparent 100-point score, CORS red flags, and robots.txt and sitemap fixes. Website Header & Crawl-Policy Preflight is a pre-launch check for a site you own or are allowed to test. It tells you which curl commands to run, then reads the raw headers, robots.txt and sitemap you paste back. It is a header and crawl-policy preflight, not a security audit.
Example input
Use the Website Header & Crawl-Policy Preflight on this (a sample I wrote). I own example-shop.test and I'm launching Friday. --- Block 2: curl -sS -i -L https://example-shop.test/ (final response) --- HTTP/2 200 content-type: text/html; charset=utf-8 strict-transport-security: max-age=86400 x-content-type-options: nosniff x-frame-options: SAMEORIGIN referrer-policy: strict-origin-when-cross-origin set-cookie: session=REDACTED; Path=/; HttpOnly set-cookie: cart=REDACTED; Path=/; Secure; SameSite=Lax server: nginx --- Block 4: OPTIONS https://example-shop.test/api/ with Origin: https://not-my-site.test --- HTTP/2 204 access-control-allow-origin: https://not-my-site.test access-control-allow-credentials: true access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS access-control-allow-headers: content-type, authorization access-control-max-age: 600 --- robots.txt --- Sitemap: /sitemap.xml User-agent: * Disallow: /admin/ Disallow: /private-reports/ Disallow: /products/ Noindex: /thank-you/ --- sitemap.xml --- <?xml version="1.0" encoding="UTF-8"?> <urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9"> …
Example output
## Scope and permission - Site: example-shop.test (owner confirmed in the request; launching Friday). - Blocks received: Block 2 (`https://example-shop.test/`, final response, `HTTP/2 200`), Block 4 (CORS preflight `OPTIONS https://example-shop.test/api/`, `HTTP/2 204`), `robots.txt`, `sitemap.xml`. Blocks 1, 3, 5 and `curl -I` on sampled sitemap URLs were not provided. - This is a header and crawl-policy preflight, not a security audit or penetration test. It reads only what you pasted, and a good score does not mean the site is secure. ## Score Scored response: Block 2, `https://example-shop.test/`, `HTTP/2 200`. Cookie lines were pasted, so the score is out of 100. The cookie values are already `REDACTED`, which is correct. | Item | Earned/Max | Evidence line | |---|---|---| | Strict-Transport-Security | 10/20 | `strict-transport-security: max-age=86400` (about 1 day, below 15552000, so partial credit; no `includeSubDomains` or `preload`, which are not required) | | Content-Security-Policy | 0/25 | `header absent in block 2` (no `Content-Security-Policy` or `-Report-Only`) | | X-Content-Type-Options | 10/10 | `x-content-type-options: nosniff` | | Clickjacking protection | 15/15 | `x-frame-options: SAMEORIGIN` (valid on its own; no CSP `frame-ancestors` present, so nothing to conflict with it) | | Referrer-Policy | 10/10 | `referrer-policy: strict-origin-when-cross-origin` | | Permissions-Policy | 0/5 | `header absent in block 2` | | Cookie flags | 5/15 | `set-cookie: session=REDACTED; Path=/; HttpOnly` (missing `Secure` and `SameSite`, -10). See the note below on `cart`. | | **Total** | **50/100** | One response scored (Block 2). | Why the lost points matter: - HSTS: a one-day lifetime gives browsers little protection against downgrade to plain HTTP once the entry expires. - CSP: with no policy, the browser has no second line of defence if any page ever renders untrusted content. - Permissions-Policy: powerful browser features (camera, microphone, geolocation) are not explicitly switched off for a site that does not use them. - Cookies: the `session` cookie can be sent over plain HTTP (no `Secure`) and has no explicit cross-site rule (no `SameSite`). Cookie note: `set-cookie: cart=REDACTED; Path=/; Secure; SameSite=Lax` has no `HttpOnly`. I scored only `session`, since the rubric covers cookies holding session or login state. If `cart` also carries login or session state, it loses 5 more points (cookie row 0/15, total 45/100). Tell me if so. ## CORS findings …
Real output from running the skill on a sample problem, shortened. The skill file itself is not published here.