▶ /audit — BOT-RESILIENCE CONSOLE

How exposed is a site to bots?

Point it at a website and measure its defenses against automated abuse — WAF / anti-bot detection, rate limiting, exposed GraphQL, path surface, and bot-vs-human handling.// Runs server-side from this site. Bounded, polite probes — never a flood.

TARGET URLI confirm I own this target, or am explicitly authorized to test it. Active tests (crawl, rate-limit probe, signal differential, GraphQL) send real requests to it.

BOT-DEFENSE POSTURE

WAF / anti-bot / CDN fingerprint, security headers, cookies, IP reputation. Passive.

PATH TREE + STATUS MAP[active]

Bounded, robots-respecting crawl → directory tree with every status code.

RATE-LIMIT PROBE[active]

Bounded detection probe — stops on the first limit. Per-path rules diff.

[CHECK THE BOX ↑]

BOT-SIGNAL DIFFERENTIAL[active]

Same request, varied UA/headers/cookies — does the site detect automation?

GRAPHQL ANALYSIS[active]

Endpoint detection, introspection, operation & type enumeration.

PER-IP TEST (DUAL EGRESS)[active]

Fires from 2 IPs (Vercel + Cloudflare relay) → is the limit per-IP or global? Needs relay configured.

[CHECK THE BOX ↑]

Bounded probes with hard caps · SSRF-guarded · private/internal targets blocked · scan only what you're authorized to.