Antileak website and network security: how it works

One HTTP fetch, no JavaScript executed, and every number a statement about what that fetch returned.

Antileak measures a website the same way the biggest AI crawlers read it. GPTBot, ClaudeBot and PerplexityBot fetch a page's raw HTML and stop; they do not execute JavaScript. Anything a site assembles after that first response is invisible to them, so Antileak fetches the homepage once, without running JavaScript, and reports on the bytes that came back.

What one scan does

• robots.txt first. Fetched and parsed with the group-precedence rules the crawlers use — a group naming an agent beats the wildcard group — and the blocked AI crawlers are reported by name. Antileak announces itself as AntileakBot and does not scan a site that disallows it.
• The homepage, as an AI crawler receives it. One fetch, no JavaScript: how much readable text the HTML carries, whether the phone number, street address and opening hours appear in it at all, and whether the markup is an application shell that JavaScript fills in later.
• Structured data, field by field. JSON-LD is parsed and each field an AI answer is built from — name, address, telephone, opening hours, geo, price range — is reported as populated or empty. Empty markup is reported as empty.
• Fundamentals. HTTPS, mobile viewport, title, meta description, H1, response time, page weight, and broken links among the homepage's own links, under a fixed request budget.
• Email authentication. Public DNS lookups for SPF, DKIM and DMARC. No mail is sent; DNS is public.

What it refuses to claim

A check that cannot run reports nothing rather than a guess. Antileak does not render pages, so it never claims to know what a page looks like after JavaScript runs. It cannot read a certificate chain from the edge, so it reports the certificate's remaining days as unknown rather than estimating one. And a scan that never reached the homepage reports that it measured nothing, instead of returning zeros that would read as findings.

Questions people ask

Does Antileak run JavaScript when it scans my site?

No. It fetches the raw HTML once and reads that, which is exactly what GPTBot, ClaudeBot and PerplexityBot do. That is the point: if content only appears after JavaScript runs, those crawlers never see it, and neither does the scan.

How many requests does a scan make to my server?

At most thirteen, enforced by a counter rather than by convention: the homepage, robots.txt, llms.txt, up to eight of the homepage's own internal links, and one sitemap check only when robots.txt does not already declare one. A site that answers 403 or 429 ends the scan immediately.

Can I stop Antileak from scanning my site?

Yes. Disallow AntileakBot in your robots.txt and no scan is run. The check happens before any request is made to your server.

Does Antileak need an account or a login?

The free scan needs only a domain. It does not log in, does not submit forms, and does not read anything that is not publicly served.

Related

• Methodology — what the scan measures and how
• AntileakBot — what our crawler does and how to block it
• AI visibility, measured across scanned business websites