square9.ai

My website square9.ai scored 11/100 on Good for Bots (Poor). Good for Bots measures one thing: whether a language model can read a site and cite it.

I need you to: let the Good for Bots crawler through the WAF.

The check it fails is "Serves our crawler without a challenge", a penalty taking 15 points off the score. What the scanner saw: A Cloudflare challenge identified by the cf-mitigated header. A model fetching this page gets the challenge, not the content.

The challenge is Cloudflare's. Bot Fight Mode and the Managed Challenge are the usual
culprits, and neither is switched off by marking anything as a verified bot. What works is
a WAF custom rule matching the user agent with the *Skip* action, with the boxes ticked
for Bot Fight Mode, rate limiting and the managed rules. Put it above the rules that issue
the challenge, because order decides which one fires.

When something in front of a site answers a crawler with an interstitial, a CAPTCHA or a
flat refusal, none of the work that site has done for machines is reachable. The same
thing happens to model crawlers, which is the part that matters: a challenge nobody can
solve is indistinguishable, from the other side, from having no content at all.

The crawler sends exactly one user agent on every request:

```
GoodForBotsBot/1.0 (+https://goodforbots.com/bot)
```

It makes roughly twenty requests per scan, sequentially, and it obeys `robots.txt`.

Add an allowlist rule for that user agent in whatever sits in front of this site:

- **Cloudflare**: a WAF custom rule matching the user agent with the *Skip* action,
  skipping Bot Fight Mode, Managed Challenge and rate limiting. A Bot Management
  "verified bot" exception is not enough on its own; the skip rule is.
- **AWS WAF**: a rule with `Allow` above the bot-control rule group, matching the
  `User-Agent` header.
- **Akamai**: a Bot Manager exception for the user agent; a rate policy alone is not
  enough.
- **Imperva / Incapsula**: an allowlist entry for the user agent under bot access
  control.
- **Vercel**: exclude the user agent from the Attack Challenge Mode or firewall rule.
- **Fastly, nginx, or a hand-rolled rule**: whatever matches on `User-Agent` before the
  challenge is issued.

If the intention is to block us, do that in `robots.txt` instead. A `Disallow` for this
crawler is honoured immediately and without argument, it costs no points, and it is the
honest way to say no. Only `robots.txt` counts as a refusal; a challenge is read as a
site a model cannot use.

Do not widen the rule beyond this one user agent, and do not disable bot protection
generally. One allowlist entry is the whole change.

The whole report, as markdown, is at https://goodforbots.com/r/square9.ai.md?scan=cmuthqdo800h501p3hlitccl5. Read it first: this prompt covers one finding, and the report has everything the scan saw.

When you are done, summarise what you changed and how to check it against a running instance. Do not try to run the Good for Bots scan yourself: it only sees what is already deployed, it is rate-limited, and re-running it is the site owner's call once the change ships.

My website square9.ai scored 11/100 on Good for Bots (Poor). Good for Bots measures one thing: whether a language model can read a site and cite it.

I need you to: serve the content as markdown at its own URLs.

The check it fails is "Serves markdown at its own URL", worth 12.5 points. What the scanner saw: No /llms-full.txt and no markdown versions linked from llms.txt.

A model that can only reach this site's content through HTML pays to parse markup and
loses structure doing it: navigation, cookie banners and script tags arrive alongside
the prose, and headings, tables and code blocks come out flattened. Markdown at its own
address removes HTML from the path entirely: what is fetched is the content and nothing
else.

Two routes satisfy this, and it is worth being clear about which one the specification
asks for. llmstxt.org asks for a markdown version of each page **at the same URL as the
original**, either with `.md` appended (`page.html.md`) or with the extension replaced
(`page.md`). `llms-full.txt`, the single bundle holding everything, does not appear in
the specification at all. It is a community convention that grew up around it and is
now widespread. Both are accepted here. The per-page form is the one the document
asks for.

Either of these passes:

- **The bundle.** `/llms-full.txt`, one document, real markdown rather than HTML,
  carrying the site's actual content rather than a placeholder.
- **Per-page mirrors.** A markdown twin for each page at `page.md` or `page.html.md`,
  **and linked from `/llms.txt`**. That second half is load-bearing: mirrors are counted
  from the links in the index, so twins that nothing points at are invisible to this scan
  and, more to the point, to anything crawling the site.

For the mirror route, the index carries them as ordinary link lines:

```markdown
## Docs

- [Quickstart](/docs/quickstart.md): create an account and take a first payment
- [Concepts](/docs/concepts.md): customers, subscriptions, invoices and proration
- [Webhooks](/docs/webhooks.md): events, signature verification, retry schedule
```

Both `/docs/quickstart` and `/docs/quickstart.md` have to answer 200: the HTML for
people, the markdown for everything else.

Serving markdown through content negotiation does **not** satisfy this, and that is
deliberate rather than an oversight. A negotiated response only exists for a client that
knows to send `Accept: text/markdown`, and most crawlers send no preference at all. A
`.md` address sits in the open: it is found by ordinary crawling, it can be linked to,
and it can be cited. If this site already negotiates markdown, the report says so in
these words: *"Markdown is served on request, but not at any URL a crawler would find on
its own"*. That is a different check passing on its own terms, not a contradiction.

Four things about how this is measured. The bundle is judged by size, by being markdown
rather than a page or JSON, and by not merely repeating `llms.txt`; its content is never
sampled beyond that, so a couple of kilobytes of boilerplate would pass. Do not take that
as permission, since the point of the file is the content in it. `.mdx` counts as markdown
although the specification names only `.md`, because excluding it would punish a large
part of the documentation ecosystem for its toolchain. The number of mirrors we want
before calling it a convention on this site is our judgement, not the specification's.
And the mirror URLs listed in the index are counted, never fetched, so a list of `.md`
addresses that 404 passes this check and helps nobody at all.

The whole report, as markdown, is at https://goodforbots.com/r/square9.ai.md?scan=cmuthqdo800h501p3hlitccl5. Read it first: this prompt covers one finding, and the report has everything the scan saw.

When you are done, summarise what you changed and how to check it against a running instance. Do not try to run the Good for Bots scan yourself: it only sees what is already deployed, it is rate-limited, and re-running it is the site owner's call once the change ships.

My website square9.ai scored 11/100 on Good for Bots (Poor). Good for Bots measures one thing: whether a language model can read a site and cite it.

I need you to: serve markdown through content negotiation on all public HTML routes.

The check it fails is "Serves markdown when asked for it", worth 10 points. What the scanner saw: Asking the homepage for markdown returned HTTP 403.

Implement content negotiation across all public HTML routes, including page types
outside the scan's sample. Put it in the shared response handling or the handlers
for each page type, so new pages receive it too. Agents need the content of any
page they follow, including pages the report did not name.

When a request arrives with `text/markdown` in its `Accept` header, the same URL that
serves HTML to a browser should return a markdown rendering of that page's content.
Requests without that header must keep getting the HTML exactly as they do now.

The response must:

- set `Content-Type: text/markdown; charset=utf-8`;
- include `Accept` in the `Vary` header, so shared caches never serve the markdown to a
  browser or the HTML to an agent (RFC 9110 says a server SHOULD send `Vary` whenever
  the representation depends on a request header);
- contain real markdown, not HTML with a different header on it;
- drop `ETag` and `Last-Modified` for the converted response, since a conditional request
  cannot be honoured against a body generated on the fly.

Work out how to do this in whatever stack this project uses. If the site is behind
Cloudflare on a paid plan, the "Markdown for Agents" zone setting does all of the above
and is the least invasive option. Otherwise implement it in the framework: middleware
inspecting the `Accept` header, a route handler that returns the markdown source, or
whatever fits the architecture here.

Strip navigation, headers, footers and cookie banners from the markdown. The point is the
content, without the page furniture around it.

Verify HTML and Markdown responses for each public page type, including URLs
outside the reported sample. Check that each Markdown response contains that
page's content and that ordinary browser requests still receive HTML.

The whole report, as markdown, is at https://goodforbots.com/r/square9.ai.md?scan=cmuthqdo800h501p3hlitccl5. Read it first: this prompt covers one finding, and the report has everything the scan saw.

When you are done, summarise what you changed and how to check it against a running instance. Do not try to run the Good for Bots scan yourself: it only sees what is already deployed, it is rate-limited, and re-running it is the site owner's call once the change ships.