Antileak is a website scanner that reads a site the way an AI assistant reads it — one fetch of the homepage, with no JavaScript executed — and reports what ChatGPT, Claude and Perplexity do and do not get from it. Alongside that it checks the ordinary things that keep a small site out of results and out of inboxes: HTTPS, security headers, page speed, broken links, structured data, and the domain's public email-authentication records. Everything it reports is a restatement of something it observed on that scan; nothing is estimated.
You enter a domain, and the scanner makes a short, read-only sequence of requests to that server — robots.txt first, then the homepage, then a handful of follow-ups — and reads only what comes back. In order:
GET /robots.txt, before anything else. We advertise ourselves as AntileakBot, so the rule has to be read before the first request to the site, not alongside it. If it disallows us from /, the scan stops there and reports that it was blocked. The file is parsed with the same group-precedence rules the crawlers use — a group naming an agent wins outright over the * group.GET /, the homepage, with no JavaScript executed. The response is streamed and read as it arrives: no browser, no DOM, no rendering. These are the same bytes GPTBot, ClaudeBot and PerplexityBot receive, because none of them execute JavaScript either.HEAD /llms.txt — whether the site publishes one.HEAD on up to eight of the homepage's own internal links, one at a time, to find broken ones.HEAD /sitemap.xml, and only sometimes. If robots.txt carried a Sitemap: line, that already answered the question and no request is made at all.Requests are made one at a time, in that order, so at most one connection is ever open against your server. Redirects are followed manually — at most five hops — and every hop is re-checked before it is fetched.
Six groups of checks, all of them read from the requests above.
<noscript> block asking the visitor to enable JavaScript, and the page is thin, we say the page is likely client-rendered — and only then.LocalBusiness-style markup we report which of the seven fields AI answers are built from — name, address, telephone, opening hours, geo, price range and url — actually carry a value. Markup that exists but is empty is reported as missing, because that is what it is worth to an assistant.<title>, a meta description, an H1, how fast the server answered, how many bytes the page weighed, and how many of the eight sampled internal links returned a 404 or a 5xx.<img> elements carry no alt attribute at all. An alt="" is not counted as missing — that is the correct way to mark an image decorative, and we are not going to tell anyone to break it.The scanner also names the CMS when the page says so: WordPress, Wix, Squarespace, Drupal, Joomla and Shopify are recognised from the generator tag or the response headers.
No. Antileak never scans a network. It does not probe ports, fingerprint services, test a firewall, attempt a login, submit a form, or send anything that could be mistaken for an attack. The only traffic it sends to you is a handful of ordinary read-only GET and HEAD requests to public URLs — the same ones any search crawler makes. Everything else it knows comes from your public DNS records, looked up through a public resolver that never touches your infrastructure.
"Security" here means the security posture a visitor's browser and a mail server can already see from outside: how you serve the page, and how you authenticate your email. It is not a penetration test and is not sold as one.
Five response headers and the transport, all read from the homepage response we already fetched, plus the three email records below. The headers are:
Strict-Transport-Security — whether browsers are told to refuse plain HTTP for your domain.Content-Security-Policy — whether the page constrains what it is allowed to load and execute.X-Content-Type-Options — whether browsers are told not to guess at content types.X-Frame-Options — whether the page can be framed by someone else. A Content-Security-Policy that covers framing counts instead.Referrer-Policy — how much of your URLs leak to the sites you link to.Together with HTTPS and the email records, those produce a 0–100 security score and a letter grade from A to F: 90 and above is an A, 80 a B, 70 a C, 60 a D, and anything below that an F.
Partly, and it is worth being exact about which part: Antileak confirms that the homepage is served over HTTPS and that the certificate chain validated when we fetched it — but it does not report how many days are left before your certificate expires.
That is a platform limit, not an oversight. The scanner runs inside a Cloudflare Worker, and a Worker cannot read the peer certificate of an outbound request; the expiry date is simply not available to it. So the days-remaining field is reported as unknown rather than filled with a guess. If you need expiry monitoring, use a tool that opens its own TLS connection — we would rather point you at one than invent a number.
Yes — all three, on every scan, by public DNS lookup. No mail is sent to test any of it.
v=spf1.default, google, zmail, s1, selector1 and selector2. A key at any one of them counts as present. A negative result means we found no key at those six selectors — not that none exists anywhere, and the report says it that way._dmarc. on the domain, beginning v=DMARC1.Lookups are made against the domain with any leading www. stripped, so www.example.com and example.com return the same answer. Without DMARC, anyone can send email that appears to come from you, and your own mail is likelier to land in spam.
Thirteen, at the absolute maximum, and that is a hard limit enforced in code rather than a description of what usually happens. Twelve read-only requests at most, plus one more if http:// redirects to https://.
Every request to your server spends from a single budget of thirteen — retries and redirect hops included — and when the budget runs out the scan stops, whatever is left in the queue. A typical scan uses fewer: the sitemap request is skipped entirely when robots.txt already declares one, and sites with fewer than eight internal links on the homepage spend less. The number published on antileak.io/bot is the same thirteen, and a test fails the build if the page and the code ever disagree.
It should not. Thirteen read-only requests at most, sent one at a time, and the scan stops the moment your server pushes back.
429 Too Many Requests ends the scan. It is not retried — retrying a 429 is pushing a server that has just asked to be pushed less.403 Forbidden ends the scan. A refusal is a refusal, whether it comes from robots.txt, a WAF or a firewall.503 Service Unavailable gets at most two short retries (0.5s, then 1s), honouring Retry-After when it asks for three seconds or less. A longer Retry-After, or a third 503, ends the scan.When a scan is stopped this way, you get told it was stopped. You are never shown results we did not collect.
The health score is a weighted 0–100 roll-up of the measured checks, and nothing else feeds it. Points come off for missing title, meta description, H1 or structured data; for broken links found among the eight sampled; for no HTTPS; for no mobile viewport; for a slow response; for a weak security score; for each AI crawler your robots.txt blocks; and for a homepage whose content is not in the HTML crawlers read.
It is our scale, computed only from our own measurements, and it exists to make one site comparable to itself over time. A score is never published against a named business — the aggregate figures on the data pages cover groups of at least 30 sites and identify nobody.
It does not render your page in a browser, so it cannot tell you what appears after JavaScript runs — only what is present before. It also does not:
Add two lines to your robots.txt. AntileakBot reads it before every scan and honours it.
User-agent: AntileakBot
Disallow: /Blocking by user agent at your firewall or CDN works too, and so does a 403 or a 429 from anywhere. For a permanent exclusion, email services@antileak.io and the domain goes on a suppression list that is checked before any request is made — that also removes any stored report for it. The scanner identifies itself as AntileakBot/1.0; the full details are on antileak.io/bot.
The scan is free and needs no account and no card — just a domain. A paid plan exists for people who want their own site under watch over time, with a verified domain and scan history attached to an account; what it includes and what it costs is on the pricing page, and anything not yet built is labelled there as not built.
Each scan produces a report link that lasts 90 days, and the same address can be re-scanned once every three minutes. The report link is unlisted: results are shown to whoever ran the scan and to no one else.