AI agent access audit checklist for webmasters and CTOs
Work through this list to see what an AI agent could reach on your site. Most items take minutes. SynthTrail automates several of them.
$9.99 a month. No contract. Cancel any time.
Public files and routes
Open /.env, /.git/config, /backup.zip, /db.sql, /phpinfo.php and /server-status on your own site. None should return content. Check /admin, /api/export and /api/users: each should need sign-in.
Page source
View source on key pages. Look for keys, tokens, passwords in comments, hidden form fields with secrets and long lists of email addresses. Also check that no scripts or images load over plain http.
Cookies, storage and logs
Make sure session cookies are HttpOnly and Secure, and that tokens are not left in browser storage. Review server logs for AI agent names and compare against your robots.txt. Then add a snippet to see browser-driven agents too.
The short checklist
- No environment, backup or source-history files public
- Admin and data routes need sign-in
- No secrets in page source or comments
- HTTPS everywhere, session cookies HttpOnly and Secure
- robots.txt reviewed and agent logs read weekly
- A snippet installed to see browser-driven agents
Follow the trail on your own site
Paste one snippet and see the synthetic visitors that use your site. Card details are entered on Stripe, never on this site.
More from SynthTrail
- Understand how RAG crawlers retrieve your content
- Hidden content and rendering audits for AI crawlers
- What to look for in AI agent tracking software
- Bot management versus synthetic traffic auditing
- Server-side versus client-side synthetic visitor verification
- AI crawler and agent user-agent directory
- All guides