Evidence: security probe returned HTTP 403. Cloudflare header(s): cf-ray, server. URL: https://magicshot.ai/.env
Review Cloudflare WAF, bot protection, rate-limit, and challenge rules for public marketing/content routes. Allow safe public scans and legitimate search or AI user-fetch crawlers to reach public pages while keeping admin, authenticated, preview, and private paths protected.
Speed Insights
Grade N/A
Not captured
https://magicshot.ai
LCP
N/A
Largest paint
TBT
N/A
Blocking time
CLS
N/A
Layout shift
78
out of 100
88
out of 100
100/114 rule points
83
out of 100
63/76 rule points
57
out of 100
54/94 rule points
83
out of 100
91/110 rule points
Category point breakdown
Biggest score-losing checks
axe found 1 violation rule(s), including 0 serious or critical rule(s). Top rules: region (1).
FreeScan.app reached the public page with HTTP 200. robots.txt blocks Googlebot, Bingbot, DuckDuckBot, and 9 more for this page path.
Detected labels or accessible names for 3 of 4 form control(s).
Detected 2 of 5 common public security headers. Present: x-content-type-options, referrer-policy. Missing: strict-transport-security, content-security-policy, x-frame-options.
Unblock public crawlers
-14 rule ptsWhat failed
The public page appears blocked for FreeScan.app or for important search and AI crawler user agents.
Evidence
FreeScan.app reached the public page with HTTP 200. robots.txt blocks Googlebot, Bingbot, DuckDuckBot, and 9 more for this page path.
Priority
Priority 2: fix before sharing the page publicly.
Why it matters
If crawlers cannot access the page, search engines and answer engines may not discover, index, or summarize the launch page correctly.
How to fix it
Review robots.txt, Cloudflare/WAF bot rules, rate limits, and security challenges. Allow legitimate search and AI crawler access to public launch pages while keeping private, admin, and authenticated paths protected.
Agent Prompt
## Role
Act as a focused technical SEO, AEO, and crawlability remediation expert who can inspect the public page and safely improve the underlying implementation.
## Inputs
- Primary context: Improve magicshot.ai at https://magicshot.ai.
- Scanner check ID: seo_crawler_access.
- Fix title: Unblock public crawlers.
- Scanner check: Crawler access.
- Category: SEO / AEO.
- Status: fail.
- Severity: critical.
- Priority: 2; lower numbers are more urgent.
- Score impact: 14 rule points lost.
- Evidence: FreeScan.app reached the public page with HTTP 200. robots.txt blocks Googlebot, Bingbot, DuckDuckBot, and 9 more for this page path.
- What needs attention: The public page appears blocked for FreeScan.app or for important search and AI crawler user agents.
- Why it matters: If crawlers cannot access the page, search engines and answer engines may not discover, index, or summarize the launch page correctly.
- Status-specific guidance: A public check reported a failure. Reproduce or inspect the issue first, then make the smallest safe fix.
- Audience or recipient: The site owner, builder, or marketing team responsible for improving this public page.
- Constraints, examples, or source material: Treat the live URL as the public target to inspect, not as the only source of truth. When repository, CMS, or hosting access is available, use that implementation context before changing anything.
- Target outcome: After the fix is deployed and the public page is rescanned, this specific check should improve or pass without lowering other SEO / AEO, security, accessibility, or design signals.
- Likely places to inspect: robots.txt rules for the scanned path and common search or AI crawler user agents; CDN, WAF, bot protection, rate-limit, firewall, and security challenge rules that apply to public pages; server responses for unauthenticated HEAD and GET requests to the scanned URL; metadata/head configuration, canonical URL logic, robots and sitemap routes, structured data blocks, page copy, headings, and internal navigation; the route, template, component, CMS entry, theme file, or static page that renders the scanned URL; shared layout, metadata, routing, middleware, server, CDN, or hosting configuration if the issue is not in page content; existing tests, build scripts, preview commands, and deployment notes before choosing verification steps.
## Task
Use the provided context to safely complete this workflow: Review robots.txt, Cloudflare/WAF bot rules, rate limits, and security challenges. Allow legitimate search and AI crawler access to public launch pages while keeping private, admin, and authenticated paths protected.
First reproduce or verify the issue from the public page and available implementation source. Then make the smallest stack-appropriate change that fixes the scanner signal and improves the real user experience.
Use this check-specific implementation guide:
- Identify exactly which crawler group or HTTP/security layer is blocking access before changing rules.
- Allow legitimate public-page crawling with narrow path, user-agent, or verified-bot rules instead of disabling bot protection globally.
- Keep admin, account, staging, preview, API, and private paths blocked or authenticated.
- Keep all metadata, headings, schema, canonical URLs, and visible copy consistent with the same public facts.
- Use accurate, crawlable, human-visible content as the source for search and answer-engine improvements.
- Keep the implementation stack-appropriate: use the existing framework, CMS, hosting provider, design system, and deployment workflow already in the project.
Acceptance criteria for this fix:
- A fresh unauthenticated request to the scanned public URL no longer returns crawler-blocking HTTP statuses such as 401, 403, 429, or 503.
- robots.txt does not disallow the scanned public path for the intended search and AI crawler user agents.
- Security controls still protect private and authenticated areas.
- The public URL exposes the corrected crawl/search/answer signal in rendered HTML or reachable public files.
- The change should be visible to a fresh unauthenticated request and likely improve the related FreeScan SEO / AEO check on rescan.
- A fresh FreeScan rescan should show this check improved or passing after deployment.
## Output
Return a structured response with these headings: Findings, Changes Made, Verification Results, Rescan Expectation, Rollback Notes, Assumptions.
## Rules
- Ask a clarifying question when required context is missing.
- Preserve the user's intent and avoid inventing facts.
- Verify the issue exists before changing code or content. If the issue is not reproducible, explain what you checked and recommend no code change.
- If the live URL and implementation source disagree, trust the implementation source for edits and use the live URL only to understand current public behavior.
- Keep the change narrowly scoped to this fix unless another change is required to avoid a regression.
- Match the existing framework, style, design system, routing patterns, and content conventions.
- Preserve existing URLs, forms, analytics, SEO metadata, accessibility semantics, and conversion flows unless the fix explicitly requires changing them.
- Do not perform broad refactors, dependency upgrades, redesigns, rewrites, migrations, file deletions, route changes, or destructive commands unless they are explicitly required and approved.
- Make changes that are easy to review and roll back.
- Prefer editing the canonical source of the page over patching built output, generated files, CDN-cached HTML, or minified assets.
- Do not make a cosmetic or placeholder change just to satisfy the scanner; the public page should be materially better for visitors, crawlers, or assistive technology.
- Verify the result with the smallest reliable test, build, browser check, or manual inspection available.
## Safety
- Do not request, expose, or reproduce sensitive data.
- Redact private details from examples unless the user explicitly says they are safe to include.
- Do not use credentials, cookies, authenticated data, hidden form values, or private response bodies.
- Do not weaken security headers, authentication, authorization, privacy controls, accessibility, or error handling to make the scan pass.Fix rendered axe accessibility violations
-18 rule ptsWhat failed
The rendered page has accessibility rule violations detected by axe-core.
Evidence
axe found 1 violation rule(s), including 0 serious or critical rule(s). Top rules: region (1).
Priority
Priority 5: fix before sharing the page publicly.
Why it matters
axe checks the actual browser-rendered page, so these issues can affect people using keyboards, screen readers, or other assistive technology.
How to fix it
Fix the top axe rule IDs first, especially critical and serious violations around names, roles, labels, headings, contrast, landmarks, and keyboard-accessible controls.
Agent Prompt
## Role
Act as a focused web accessibility remediation expert who can inspect the public page and safely improve the underlying implementation.
## Inputs
- Primary context: Improve magicshot.ai at https://magicshot.ai.
- Scanner check ID: accessibility_axe_violations.
- Fix title: Fix rendered axe accessibility violations.
- Scanner check: Rendered axe accessibility violations.
- Category: Accessibility.
- Status: fail.
- Severity: high.
- Priority: 5; lower numbers are more urgent.
- Score impact: 18 rule points lost.
- Evidence: axe found 1 violation rule(s), including 0 serious or critical rule(s). Top rules: region (1).
- What needs attention: The rendered page has accessibility rule violations detected by axe-core.
- Why it matters: axe checks the actual browser-rendered page, so these issues can affect people using keyboards, screen readers, or other assistive technology.
- Status-specific guidance: A public check reported a failure. Reproduce or inspect the issue first, then make the smallest safe fix.
- Audience or recipient: The site owner, builder, or marketing team responsible for improving this public page.
- Constraints, examples, or source material: Treat the live URL as the public target to inspect, not as the only source of truth. When repository, CMS, or hosting access is available, use that implementation context before changing anything.
- Target outcome: After the fix is deployed and the public page is rescanned, this specific check should improve or pass without lowering other SEO / AEO, security, accessibility, or design signals.
- Likely places to inspect: axe violation details, affected selectors, rendered DOM, component source, and interaction state that triggered the issue; semantic markup, labels, landmarks, headings, focus states, image rendering, form controls, and browser-rendered accessibility output; the route, template, component, CMS entry, theme file, or static page that renders the scanned URL; shared layout, metadata, routing, middleware, server, CDN, or hosting configuration if the issue is not in page content; existing tests, build scripts, preview commands, and deployment notes before choosing verification steps.
## Task
Use the provided context to safely complete this workflow: Fix the top axe rule IDs first, especially critical and serious violations around names, roles, labels, headings, contrast, landmarks, and keyboard-accessible controls.
First reproduce or verify the issue from the public page and available implementation source. Then make the smallest stack-appropriate change that fixes the scanner signal and improves the real user experience.
Use this check-specific implementation guide:
- Fix each reported accessibility violation at the semantic source.
- Avoid suppressing automated checks unless there is a documented false positive.
- Fix the semantic or interaction source of the issue rather than hiding warnings with ARIA or visual-only workarounds.
- Keep keyboard, screen reader, and touch users in the verification path.
- Keep the implementation stack-appropriate: use the existing framework, CMS, hosting provider, design system, and deployment workflow already in the project.
Acceptance criteria for this fix:
- Critical and serious axe issues tied to this page are resolved or clearly documented as non-reproducible.
- Fixes do not introduce new keyboard, label, contrast, or landmark regressions.
- The affected UI remains usable by keyboard and assistive technology and does not introduce heading, label, focus, or contrast regressions.
- The change can be checked in the browser or with an accessibility audit tool when available.
- A fresh FreeScan rescan should show this check improved or passing after deployment.
## Output
Return a structured response with these headings: Findings, Changes Made, Verification Results, Rescan Expectation, Rollback Notes, Assumptions.
## Rules
- Ask a clarifying question when required context is missing.
- Preserve the user's intent and avoid inventing facts.
- Verify the issue exists before changing code or content. If the issue is not reproducible, explain what you checked and recommend no code change.
- If the live URL and implementation source disagree, trust the implementation source for edits and use the live URL only to understand current public behavior.
- Keep the change narrowly scoped to this fix unless another change is required to avoid a regression.
- Match the existing framework, style, design system, routing patterns, and content conventions.
- Preserve existing URLs, forms, analytics, SEO metadata, accessibility semantics, and conversion flows unless the fix explicitly requires changing them.
- Do not perform broad refactors, dependency upgrades, redesigns, rewrites, migrations, file deletions, route changes, or destructive commands unless they are explicitly required and approved.
- Make changes that are easy to review and roll back.
- Prefer editing the canonical source of the page over patching built output, generated files, CDN-cached HTML, or minified assets.
- Do not make a cosmetic or placeholder change just to satisfy the scanner; the public page should be materially better for visitors, crawlers, or assistive technology.
- Verify the result with the smallest reliable test, build, browser check, or manual inspection available.
## Safety
- Do not request, expose, or reproduce sensitive data.
- Redact private details from examples unless the user explicitly says they are safe to include.
- Do not use credentials, cookies, authenticated data, hidden form values, or private response bodies.
- Do not weaken security headers, authentication, authorization, privacy controls, accessibility, or error handling to make the scan pass.Add common public security headers
-13 rule ptsWhat failed
Several basic browser protection headers were not visible.
Evidence
Detected 2 of 5 common public security headers. Present: x-content-type-options, referrer-policy. Missing: strict-transport-security, content-security-policy, x-frame-options.
Priority
Priority 5: fix before sharing the page publicly.
Why it matters
These headers reduce avoidable browser-side risk and show a baseline of care before launch.
How to fix it
Configure headers such as Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, and Referrer-Policy.
Agent Prompt
## Role
Act as a focused public web security remediation expert who can inspect the public page and safely improve the underlying implementation.
## Inputs
- Primary context: Improve magicshot.ai at https://magicshot.ai.
- Scanner check ID: security_common_headers.
- Fix title: Add common public security headers.
- Scanner check: Common security headers.
- Category: Security.
- Status: fail.
- Severity: high.
- Priority: 5; lower numbers are more urgent.
- Score impact: 13 rule points lost.
- Evidence: Detected 2 of 5 common public security headers. Present: x-content-type-options, referrer-policy. Missing: strict-transport-security, content-security-policy, x-frame-options.
- What needs attention: Several basic browser protection headers were not visible.
- Why it matters: These headers reduce avoidable browser-side risk and show a baseline of care before launch.
- Status-specific guidance: A public check reported a failure. Reproduce or inspect the issue first, then make the smallest safe fix.
- Audience or recipient: The site owner, builder, or marketing team responsible for improving this public page.
- Constraints, examples, or source material: Treat the live URL as the public target to inspect, not as the only source of truth. When repository, CMS, or hosting access is available, use that implementation context before changing anything.
- Target outcome: After the fix is deployed and the public page is rescanned, this specific check should improve or pass without lowering other SEO / AEO, security, accessibility, or design signals.
- Likely places to inspect: hosting headers, server middleware, edge/proxy config, CDN rules, and framework security header configuration; server, edge, CDN, hosting, proxy, form action, asset URL, cookie, and public file access configuration; the route, template, component, CMS entry, theme file, or static page that renders the scanned URL; shared layout, metadata, routing, middleware, server, CDN, or hosting configuration if the issue is not in page content; existing tests, build scripts, preview commands, and deployment notes before choosing verification steps.
## Task
Use the provided context to safely complete this workflow: Configure headers such as Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, and Referrer-Policy.
First reproduce or verify the issue from the public page and available implementation source. Then make the smallest stack-appropriate change that fixes the scanner signal and improves the real user experience.
Use this check-specific implementation guide:
- Add missing common browser protection headers with values appropriate for the site.
- Treat an existing CSP frame-ancestors directive as valid frame protection; preserve the directive and its allowed origins exactly instead of adding or substituting X-Frame-Options.
- Test CSP or frame policies carefully so they do not break scripts, images, analytics, payments, embeds, or auth.
- Prefer narrow, production-safe security configuration changes over blanket disables or permissive rules.
- Preserve authentication, authorization, private paths, and sensitive file protections while fixing the public launch page.
- Keep the implementation stack-appropriate: use the existing framework, CMS, hosting provider, design system, and deployment workflow already in the project.
Acceptance criteria for this fix:
- Important security headers are visible on the public response.
- Any existing CSP frame-ancestors directive and its allowed origins remain unchanged.
- The page still renders and key flows still work after header changes.
- The public URL keeps legitimate visitors and assets working while removing the reported browser-side or public exposure risk.
- The change does not weaken security headers, authentication, authorization, or private route protections.
- A fresh FreeScan rescan should show this check improved or passing after deployment.
## Output
Return a structured response with these headings: Findings, Changes Made, Verification Results, Rescan Expectation, Rollback Notes, Assumptions.
## Rules
- Ask a clarifying question when required context is missing.
- Preserve the user's intent and avoid inventing facts.
- Verify the issue exists before changing code or content. If the issue is not reproducible, explain what you checked and recommend no code change.
- If the live URL and implementation source disagree, trust the implementation source for edits and use the live URL only to understand current public behavior.
- Keep the change narrowly scoped to this fix unless another change is required to avoid a regression.
- Match the existing framework, style, design system, routing patterns, and content conventions.
- Preserve existing URLs, forms, analytics, SEO metadata, accessibility semantics, and conversion flows unless the fix explicitly requires changing them.
- Do not perform broad refactors, dependency upgrades, redesigns, rewrites, migrations, file deletions, route changes, or destructive commands unless they are explicitly required and approved.
- Make changes that are easy to review and roll back.
- Prefer editing the canonical source of the page over patching built output, generated files, CDN-cached HTML, or minified assets.
- Do not make a cosmetic or placeholder change just to satisfy the scanner; the public page should be materially better for visitors, crawlers, or assistive technology.
- If an existing Content-Security-Policy contains a frame-ancestors directive, preserve that directive exactly, including its allowed origins, unless the site owner explicitly asks to change it. Do not replace it with X-Frame-Options merely to satisfy this scan.
- Verify the result with the smallest reliable test, build, browser check, or manual inspection available.
## Safety
- Do not request, expose, or reproduce sensitive data.
- Redact private details from examples unless the user explicitly says they are safe to include.
- Do not use credentials, cookies, authenticated data, hidden form values, or private response bodies.
- Do not weaken security headers, authentication, authorization, privacy controls, accessibility, or error handling to make the scan pass.Label public form fields
-14 rule ptsWhat failed
Some form controls do not have a detectable label or accessible name.
Evidence
Detected labels or accessible names for 3 of 4 form control(s).
Priority
Priority 7: fix during launch polish.
Why it matters
Unlabeled inputs make email capture, demo requests, and signups harder for assistive technology users.
How to fix it
Connect each input to a visible label or an accurate aria-label/aria-labelledby value.
Agent Prompt
## Role
Act as a focused web accessibility remediation expert who can inspect the public page and safely improve the underlying implementation.
## Inputs
- Primary context: Improve magicshot.ai at https://magicshot.ai.
- Scanner check ID: accessibility_form_labels.
- Fix title: Label public form fields.
- Scanner check: Form labels.
- Category: Accessibility.
- Status: fail.
- Severity: high.
- Priority: 7; lower numbers are more urgent.
- Score impact: 14 rule points lost.
- Evidence: Detected labels or accessible names for 3 of 4 form control(s).
- What needs attention: Some form controls do not have a detectable label or accessible name.
- Why it matters: Unlabeled inputs make email capture, demo requests, and signups harder for assistive technology users.
- Status-specific guidance: A public check reported a failure. Reproduce or inspect the issue first, then make the smallest safe fix.
- Audience or recipient: The site owner, builder, or marketing team responsible for improving this public page.
- Constraints, examples, or source material: Treat the live URL as the public target to inspect, not as the only source of truth. When repository, CMS, or hosting access is available, use that implementation context before changing anything.
- Target outcome: After the fix is deployed and the public page is rescanned, this specific check should improve or pass without lowering other SEO / AEO, security, accessibility, or design signals.
- Likely places to inspect: inputs, selects, textareas, custom form controls, search fields, newsletter embeds, and generated form components; semantic markup, labels, landmarks, headings, focus states, image rendering, form controls, and browser-rendered accessibility output; the route, template, component, CMS entry, theme file, or static page that renders the scanned URL; shared layout, metadata, routing, middleware, server, CDN, or hosting configuration if the issue is not in page content; existing tests, build scripts, preview commands, and deployment notes before choosing verification steps.
## Task
Use the provided context to safely complete this workflow: Connect each input to a visible label or an accurate aria-label/aria-labelledby value.
First reproduce or verify the issue from the public page and available implementation source. Then make the smallest stack-appropriate change that fixes the scanner signal and improves the real user experience.
Use this check-specific implementation guide:
- Connect each control to a visible label, aria-label, or aria-labelledby that accurately describes the input.
- Keep labels available to assistive technology and preserve validation/error messaging.
- Fix the semantic or interaction source of the issue rather than hiding warnings with ARIA or visual-only workarounds.
- Keep keyboard, screen reader, and touch users in the verification path.
- Keep the implementation stack-appropriate: use the existing framework, CMS, hosting provider, design system, and deployment workflow already in the project.
Acceptance criteria for this fix:
- Every public form control has a detectable accessible name.
- Keyboard and screen reader users can understand and complete the form.
- The affected UI remains usable by keyboard and assistive technology and does not introduce heading, label, focus, or contrast regressions.
- The change can be checked in the browser or with an accessibility audit tool when available.
- A fresh FreeScan rescan should show this check improved or passing after deployment.
## Output
Return a structured response with these headings: Findings, Changes Made, Verification Results, Rescan Expectation, Rollback Notes, Assumptions.
## Rules
- Ask a clarifying question when required context is missing.
- Preserve the user's intent and avoid inventing facts.
- Verify the issue exists before changing code or content. If the issue is not reproducible, explain what you checked and recommend no code change.
- If the live URL and implementation source disagree, trust the implementation source for edits and use the live URL only to understand current public behavior.
- Keep the change narrowly scoped to this fix unless another change is required to avoid a regression.
- Match the existing framework, style, design system, routing patterns, and content conventions.
- Preserve existing URLs, forms, analytics, SEO metadata, accessibility semantics, and conversion flows unless the fix explicitly requires changing them.
- Do not perform broad refactors, dependency upgrades, redesigns, rewrites, migrations, file deletions, route changes, or destructive commands unless they are explicitly required and approved.
- Make changes that are easy to review and roll back.
- Prefer editing the canonical source of the page over patching built output, generated files, CDN-cached HTML, or minified assets.
- Do not make a cosmetic or placeholder change just to satisfy the scanner; the public page should be materially better for visitors, crawlers, or assistive technology.
- Verify the result with the smallest reliable test, build, browser check, or manual inspection available.
## Safety
- Do not request, expose, or reproduce sensitive data.
- Redact private details from examples unless the user explicitly says they are safe to include.
- Do not use credentials, cookies, authenticated data, hidden form values, or private response bodies.
- Do not weaken security headers, authentication, authorization, privacy controls, accessibility, or error handling to make the scan pass.Fix rendered layout ergonomics
-9 rule ptsWhat failed
The browser-rendered page has layout or tap-target issues.
Evidence
Horizontal overflow: 0px. Small tap targets: 90.
Priority
Priority 13: fix during launch polish.
Why it matters
Horizontal overflow and tiny tap targets make the page feel broken on real devices, especially for mobile visitors.
How to fix it
Remove elements wider than the viewport, add responsive constraints, and make important links, buttons, inputs, and controls at least 40px tall and wide where possible.
Agent Prompt
## Role
Act as a focused conversion-focused frontend quality remediation expert who can inspect the public page and safely improve the underlying implementation.
## Inputs
- Primary context: Improve magicshot.ai at https://magicshot.ai.
- Scanner check ID: design_rendered_layout.
- Fix title: Fix rendered layout ergonomics.
- Scanner check: Rendered layout ergonomics.
- Category: Design.
- Status: fail.
- Severity: medium.
- Priority: 13; lower numbers are more urgent.
- Score impact: 9 rule points lost.
- Evidence: Horizontal overflow: 0px. Small tap targets: 90.
- What needs attention: The browser-rendered page has layout or tap-target issues.
- Why it matters: Horizontal overflow and tiny tap targets make the page feel broken on real devices, especially for mobile visitors.
- Status-specific guidance: A public check reported a failure. Reproduce or inspect the issue first, then make the smallest safe fix.
- Audience or recipient: The site owner, builder, or marketing team responsible for improving this public page.
- Constraints, examples, or source material: Treat the live URL as the public target to inspect, not as the only source of truth. When repository, CMS, or hosting access is available, use that implementation context before changing anything.
- Target outcome: After the fix is deployed and the public page is rescanned, this specific check should improve or pass without lowering other SEO / AEO, security, accessibility, or design signals.
- Likely places to inspect: mobile viewport, horizontal overflow sources, tap target sizes, fixed-position elements, menus, forms, and embeds; page layout, responsive CSS, component states, copy hierarchy, CTA placement, spacing tokens, rendered console output, and performance-sensitive assets; the route, template, component, CMS entry, theme file, or static page that renders the scanned URL; shared layout, metadata, routing, middleware, server, CDN, or hosting configuration if the issue is not in page content; existing tests, build scripts, preview commands, and deployment notes before choosing verification steps.
## Task
Use the provided context to safely complete this workflow: Remove elements wider than the viewport, add responsive constraints, and make important links, buttons, inputs, and controls at least 40px tall and wide where possible.
First reproduce or verify the issue from the public page and available implementation source. Then make the smallest stack-appropriate change that fixes the scanner signal and improves the real user experience.
Use this check-specific implementation guide:
- Constrain overflowing elements and increase small important tap targets where possible.
- Preserve layout intent while making the rendered page usable on real devices.
- Improve the actual rendered page at mobile and desktop sizes, not only the source code shape.
- Preserve core conversion flows while making layout, hierarchy, readability, or runtime health better.
- Keep the implementation stack-appropriate: use the existing framework, CMS, hosting provider, design system, and deployment workflow already in the project.
Acceptance criteria for this fix:
- The rendered page has no meaningful horizontal overflow.
- Important links, buttons, inputs, and controls are comfortably tappable.
- The rendered page is visually stable and usable on mobile and desktop viewports.
- The fix does not hide content, break CTAs, introduce console errors, or reduce clarity for visitors.
- A fresh FreeScan rescan should show this check improved or passing after deployment.
## Output
Return a structured response with these headings: Findings, Changes Made, Verification Results, Rescan Expectation, Rollback Notes, Assumptions.
## Rules
- Ask a clarifying question when required context is missing.
- Preserve the user's intent and avoid inventing facts.
- Verify the issue exists before changing code or content. If the issue is not reproducible, explain what you checked and recommend no code change.
- If the live URL and implementation source disagree, trust the implementation source for edits and use the live URL only to understand current public behavior.
- Keep the change narrowly scoped to this fix unless another change is required to avoid a regression.
- Match the existing framework, style, design system, routing patterns, and content conventions.
- Preserve existing URLs, forms, analytics, SEO metadata, accessibility semantics, and conversion flows unless the fix explicitly requires changing them.
- Do not perform broad refactors, dependency upgrades, redesigns, rewrites, migrations, file deletions, route changes, or destructive commands unless they are explicitly required and approved.
- Make changes that are easy to review and roll back.
- Prefer editing the canonical source of the page over patching built output, generated files, CDN-cached HTML, or minified assets.
- Do not make a cosmetic or placeholder change just to satisfy the scanner; the public page should be materially better for visitors, crawlers, or assistive technology.
- Verify the result with the smallest reliable test, build, browser check, or manual inspection available.
## Safety
- Do not request, expose, or reproduce sensitive data.
- Redact private details from examples unless the user explicitly says they are safe to include.
- Do not use credentials, cookies, authenticated data, hidden form values, or private response bodies.
- Do not weaken security headers, authentication, authorization, privacy controls, accessibility, or error handling to make the scan pass.SEO / AEO
Severity mix: 1 critical, 7 high, 3 medium, 2 low.
Crawler access
-14 rule ptsFreeScan.app reached the public page with HTTP 200. robots.txt blocks Googlebot, Bingbot, DuckDuckBot, and 9 more for this page path.
Security
Severity mix: 2 critical, 3 high, 0 medium, 0 low.
Common security headers
-13 rule ptsDetected 2 of 5 common public security headers. Present: x-content-type-options, referrer-policy. Missing: strict-transport-security, content-security-policy, x-frame-options.
Accessibility
Severity mix: 0 critical, 3 high, 5 medium, 0 low.
Rendered axe accessibility violations
-18 rule ptsaxe found 1 violation rule(s), including 0 serious or critical rule(s). Top rules: region (1).
Form labels
-14 rule ptsDetected labels or accessible names for 3 of 4 form control(s).
Basic contrast
-8 rule pts1 of 100 rendered text color sample(s) missed WCAG contrast targets. Worst rendered ratio: 1.04.
Design
Severity mix: 0 critical, 3 high, 6 medium, 2 low.
Text density
-10 rule ptsDetected about 2786 visible word(s).
Rendered layout ergonomics
-9 rule ptsHorizontal overflow: 0px. Small tap targets: 90.
Failed checks
These checks need attention.
Crawler access
0/14FreeScan.app reached the public page with HTTP 200. robots.txt blocks Googlebot, Bingbot, DuckDuckBot, and 9 more for this page path.
Failed: earned 0 of 14 points.
Priority: Priority 2: fix before sharing the page publicly.
Why it matters: If crawlers cannot access the page, search engines and answer engines may not discover, index, or summarize the launch page correctly.
Fix: Review robots.txt, Cloudflare/WAF bot rules, rate limits, and security challenges. Allow legitimate search and AI crawler access to public launch pages while keeping private, admin, and authenticated paths protected.
Agent Prompt
## Role
Act as a focused technical SEO, AEO, and crawlability remediation expert who can inspect the public page and safely improve the underlying implementation.
## Inputs
- Primary context: Improve magicshot.ai at https://magicshot.ai.
- Scanner check ID: seo_crawler_access.
- Fix title: Unblock public crawlers.
- Scanner check: Crawler access.
- Category: SEO / AEO.
- Status: fail.
- Severity: critical.
- Priority: 2; lower numbers are more urgent.
- Score impact: 14 of 14 rule points lost.
- Evidence: FreeScan.app reached the public page with HTTP 200. robots.txt blocks Googlebot, Bingbot, DuckDuckBot, and 9 more for this page path.
- What needs attention: The public page appears blocked for FreeScan.app or for important search and AI crawler user agents.
- Why it matters: If crawlers cannot access the page, search engines and answer engines may not discover, index, or summarize the launch page correctly.
- Status-specific guidance: A public check reported a failure. Reproduce or inspect the issue first, then make the smallest safe fix.
- Audience or recipient: The site owner, builder, or marketing team responsible for improving this public page.
- Constraints, examples, or source material: Treat the live URL as the public target to inspect, not as the only source of truth. When repository, CMS, or hosting access is available, use that implementation context before changing anything.
- Target outcome: After the fix is deployed and the public page is rescanned, this specific check should improve or pass without lowering other SEO / AEO, security, accessibility, or design signals.
- Likely places to inspect: robots.txt rules for the scanned path and common search or AI crawler user agents; CDN, WAF, bot protection, rate-limit, firewall, and security challenge rules that apply to public pages; server responses for unauthenticated HEAD and GET requests to the scanned URL; metadata/head configuration, canonical URL logic, robots and sitemap routes, structured data blocks, page copy, headings, and internal navigation; the route, template, component, CMS entry, theme file, or static page that renders the scanned URL; shared layout, metadata, routing, middleware, server, CDN, or hosting configuration if the issue is not in page content; existing tests, build scripts, preview commands, and deployment notes before choosing verification steps.
## Task
Use the provided context to safely complete this workflow: Review robots.txt, Cloudflare/WAF bot rules, rate limits, and security challenges. Allow legitimate search and AI crawler access to public launch pages while keeping private, admin, and authenticated paths protected.
First reproduce or verify the issue from the public page and available implementation source. Then make the smallest stack-appropriate change that fixes the scanner signal and improves the real user experience.
Use this check-specific implementation guide:
- Identify exactly which crawler group or HTTP/security layer is blocking access before changing rules.
- Allow legitimate public-page crawling with narrow path, user-agent, or verified-bot rules instead of disabling bot protection globally.
- Keep admin, account, staging, preview, API, and private paths blocked or authenticated.
- Keep all metadata, headings, schema, canonical URLs, and visible copy consistent with the same public facts.
- Use accurate, crawlable, human-visible content as the source for search and answer-engine improvements.
- Keep the implementation stack-appropriate: use the existing framework, CMS, hosting provider, design system, and deployment workflow already in the project.
Acceptance criteria for this fix:
- A fresh unauthenticated request to the scanned public URL no longer returns crawler-blocking HTTP statuses such as 401, 403, 429, or 503.
- robots.txt does not disallow the scanned public path for the intended search and AI crawler user agents.
- Security controls still protect private and authenticated areas.
- The public URL exposes the corrected crawl/search/answer signal in rendered HTML or reachable public files.
- The change should be visible to a fresh unauthenticated request and likely improve the related FreeScan SEO / AEO check on rescan.
- A fresh FreeScan rescan should show this check improved or passing after deployment.
## Output
Return a structured response with these headings: Findings, Changes Made, Verification Results, Rescan Expectation, Rollback Notes, Assumptions.
## Rules
- Ask a clarifying question when required context is missing.
- Preserve the user's intent and avoid inventing facts.
- Verify the issue exists before changing code or content. If the issue is not reproducible, explain what you checked and recommend no code change.
- If the live URL and implementation source disagree, trust the implementation source for edits and use the live URL only to understand current public behavior.
- Keep the change narrowly scoped to this fix unless another change is required to avoid a regression.
- Match the existing framework, style, design system, routing patterns, and content conventions.
- Preserve existing URLs, forms, analytics, SEO metadata, accessibility semantics, and conversion flows unless the fix explicitly requires changing them.
- Do not perform broad refactors, dependency upgrades, redesigns, rewrites, migrations, file deletions, route changes, or destructive commands unless they are explicitly required and approved.
- Make changes that are easy to review and roll back.
- Prefer editing the canonical source of the page over patching built output, generated files, CDN-cached HTML, or minified assets.
- Do not make a cosmetic or placeholder change just to satisfy the scanner; the public page should be materially better for visitors, crawlers, or assistive technology.
- Verify the result with the smallest reliable test, build, browser check, or manual inspection available.
## Safety
- Do not request, expose, or reproduce sensitive data.
- Redact private details from examples unless the user explicitly says they are safe to include.
- Do not use credentials, cookies, authenticated data, hidden form values, or private response bodies.
- Do not weaken security headers, authentication, authorization, privacy controls, accessibility, or error handling to make the scan pass.Common security headers
5/18Detected 2 of 5 common public security headers. Present: x-content-type-options, referrer-policy. Missing: strict-transport-security, content-security-policy, x-frame-options.
Failed: earned 5 of 18 points from partial coverage.
Priority: Priority 5: fix before sharing the page publicly.
Why it matters: These headers reduce avoidable browser-side risk and show a baseline of care before launch.
Fix: Configure headers such as Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, and Referrer-Policy.
Agent Prompt
## Role
Act as a focused public web security remediation expert who can inspect the public page and safely improve the underlying implementation.
## Inputs
- Primary context: Improve magicshot.ai at https://magicshot.ai.
- Scanner check ID: security_common_headers.
- Fix title: Add common public security headers.
- Scanner check: Common security headers.
- Category: Security.
- Status: fail.
- Severity: high.
- Priority: 5; lower numbers are more urgent.
- Score impact: 13 of 18 rule points lost.
- Evidence: Detected 2 of 5 common public security headers. Present: x-content-type-options, referrer-policy. Missing: strict-transport-security, content-security-policy, x-frame-options.
- What needs attention: Several basic browser protection headers were not visible.
- Why it matters: These headers reduce avoidable browser-side risk and show a baseline of care before launch.
- Status-specific guidance: A public check reported a failure. Reproduce or inspect the issue first, then make the smallest safe fix.
- Audience or recipient: The site owner, builder, or marketing team responsible for improving this public page.
- Constraints, examples, or source material: Treat the live URL as the public target to inspect, not as the only source of truth. When repository, CMS, or hosting access is available, use that implementation context before changing anything.
- Target outcome: After the fix is deployed and the public page is rescanned, this specific check should improve or pass without lowering other SEO / AEO, security, accessibility, or design signals.
- Likely places to inspect: hosting headers, server middleware, edge/proxy config, CDN rules, and framework security header configuration; server, edge, CDN, hosting, proxy, form action, asset URL, cookie, and public file access configuration; the route, template, component, CMS entry, theme file, or static page that renders the scanned URL; shared layout, metadata, routing, middleware, server, CDN, or hosting configuration if the issue is not in page content; existing tests, build scripts, preview commands, and deployment notes before choosing verification steps.
## Task
Use the provided context to safely complete this workflow: Configure headers such as Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, and Referrer-Policy.
First reproduce or verify the issue from the public page and available implementation source. Then make the smallest stack-appropriate change that fixes the scanner signal and improves the real user experience.
Use this check-specific implementation guide:
- Add missing common browser protection headers with values appropriate for the site.
- Treat an existing CSP frame-ancestors directive as valid frame protection; preserve the directive and its allowed origins exactly instead of adding or substituting X-Frame-Options.
- Test CSP or frame policies carefully so they do not break scripts, images, analytics, payments, embeds, or auth.
- Prefer narrow, production-safe security configuration changes over blanket disables or permissive rules.
- Preserve authentication, authorization, private paths, and sensitive file protections while fixing the public launch page.
- Keep the implementation stack-appropriate: use the existing framework, CMS, hosting provider, design system, and deployment workflow already in the project.
Acceptance criteria for this fix:
- Important security headers are visible on the public response.
- Any existing CSP frame-ancestors directive and its allowed origins remain unchanged.
- The page still renders and key flows still work after header changes.
- The public URL keeps legitimate visitors and assets working while removing the reported browser-side or public exposure risk.
- The change does not weaken security headers, authentication, authorization, or private route protections.
- A fresh FreeScan rescan should show this check improved or passing after deployment.
## Output
Return a structured response with these headings: Findings, Changes Made, Verification Results, Rescan Expectation, Rollback Notes, Assumptions.
## Rules
- Ask a clarifying question when required context is missing.
- Preserve the user's intent and avoid inventing facts.
- Verify the issue exists before changing code or content. If the issue is not reproducible, explain what you checked and recommend no code change.
- If the live URL and implementation source disagree, trust the implementation source for edits and use the live URL only to understand current public behavior.
- Keep the change narrowly scoped to this fix unless another change is required to avoid a regression.
- Match the existing framework, style, design system, routing patterns, and content conventions.
- Preserve existing URLs, forms, analytics, SEO metadata, accessibility semantics, and conversion flows unless the fix explicitly requires changing them.
- Do not perform broad refactors, dependency upgrades, redesigns, rewrites, migrations, file deletions, route changes, or destructive commands unless they are explicitly required and approved.
- Make changes that are easy to review and roll back.
- Prefer editing the canonical source of the page over patching built output, generated files, CDN-cached HTML, or minified assets.
- Do not make a cosmetic or placeholder change just to satisfy the scanner; the public page should be materially better for visitors, crawlers, or assistive technology.
- If an existing Content-Security-Policy contains a frame-ancestors directive, preserve that directive exactly, including its allowed origins, unless the site owner explicitly asks to change it. Do not replace it with X-Frame-Options merely to satisfy this scan.
- Verify the result with the smallest reliable test, build, browser check, or manual inspection available.
## Safety
- Do not request, expose, or reproduce sensitive data.
- Redact private details from examples unless the user explicitly says they are safe to include.
- Do not use credentials, cookies, authenticated data, hidden form values, or private response bodies.
- Do not weaken security headers, authentication, authorization, privacy controls, accessibility, or error handling to make the scan pass.Form labels
0/14Detected labels or accessible names for 3 of 4 form control(s).
Failed: earned 0 of 14 points.
Priority: Priority 7: fix during launch polish.
Why it matters: Unlabeled inputs make email capture, demo requests, and signups harder for assistive technology users.
Fix: Connect each input to a visible label or an accurate aria-label/aria-labelledby value.
Agent Prompt
## Role
Act as a focused web accessibility remediation expert who can inspect the public page and safely improve the underlying implementation.
## Inputs
- Primary context: Improve magicshot.ai at https://magicshot.ai.
- Scanner check ID: accessibility_form_labels.
- Fix title: Label public form fields.
- Scanner check: Form labels.
- Category: Accessibility.
- Status: fail.
- Severity: high.
- Priority: 7; lower numbers are more urgent.
- Score impact: 14 of 14 rule points lost.
- Evidence: Detected labels or accessible names for 3 of 4 form control(s).
- What needs attention: Some form controls do not have a detectable label or accessible name.
- Why it matters: Unlabeled inputs make email capture, demo requests, and signups harder for assistive technology users.
- Status-specific guidance: A public check reported a failure. Reproduce or inspect the issue first, then make the smallest safe fix.
- Audience or recipient: The site owner, builder, or marketing team responsible for improving this public page.
- Constraints, examples, or source material: Treat the live URL as the public target to inspect, not as the only source of truth. When repository, CMS, or hosting access is available, use that implementation context before changing anything.
- Target outcome: After the fix is deployed and the public page is rescanned, this specific check should improve or pass without lowering other SEO / AEO, security, accessibility, or design signals.
- Likely places to inspect: inputs, selects, textareas, custom form controls, search fields, newsletter embeds, and generated form components; semantic markup, labels, landmarks, headings, focus states, image rendering, form controls, and browser-rendered accessibility output; the route, template, component, CMS entry, theme file, or static page that renders the scanned URL; shared layout, metadata, routing, middleware, server, CDN, or hosting configuration if the issue is not in page content; existing tests, build scripts, preview commands, and deployment notes before choosing verification steps.
## Task
Use the provided context to safely complete this workflow: Connect each input to a visible label or an accurate aria-label/aria-labelledby value.
First reproduce or verify the issue from the public page and available implementation source. Then make the smallest stack-appropriate change that fixes the scanner signal and improves the real user experience.
Use this check-specific implementation guide:
- Connect each control to a visible label, aria-label, or aria-labelledby that accurately describes the input.
- Keep labels available to assistive technology and preserve validation/error messaging.
- Fix the semantic or interaction source of the issue rather than hiding warnings with ARIA or visual-only workarounds.
- Keep keyboard, screen reader, and touch users in the verification path.
- Keep the implementation stack-appropriate: use the existing framework, CMS, hosting provider, design system, and deployment workflow already in the project.
Acceptance criteria for this fix:
- Every public form control has a detectable accessible name.
- Keyboard and screen reader users can understand and complete the form.
- The affected UI remains usable by keyboard and assistive technology and does not introduce heading, label, focus, or contrast regressions.
- The change can be checked in the browser or with an accessibility audit tool when available.
- A fresh FreeScan rescan should show this check improved or passing after deployment.
## Output
Return a structured response with these headings: Findings, Changes Made, Verification Results, Rescan Expectation, Rollback Notes, Assumptions.
## Rules
- Ask a clarifying question when required context is missing.
- Preserve the user's intent and avoid inventing facts.
- Verify the issue exists before changing code or content. If the issue is not reproducible, explain what you checked and recommend no code change.
- If the live URL and implementation source disagree, trust the implementation source for edits and use the live URL only to understand current public behavior.
- Keep the change narrowly scoped to this fix unless another change is required to avoid a regression.
- Match the existing framework, style, design system, routing patterns, and content conventions.
- Preserve existing URLs, forms, analytics, SEO metadata, accessibility semantics, and conversion flows unless the fix explicitly requires changing them.
- Do not perform broad refactors, dependency upgrades, redesigns, rewrites, migrations, file deletions, route changes, or destructive commands unless they are explicitly required and approved.
- Make changes that are easy to review and roll back.
- Prefer editing the canonical source of the page over patching built output, generated files, CDN-cached HTML, or minified assets.
- Do not make a cosmetic or placeholder change just to satisfy the scanner; the public page should be materially better for visitors, crawlers, or assistive technology.
- Verify the result with the smallest reliable test, build, browser check, or manual inspection available.
## Safety
- Do not request, expose, or reproduce sensitive data.
- Redact private details from examples unless the user explicitly says they are safe to include.
- Do not use credentials, cookies, authenticated data, hidden form values, or private response bodies.
- Do not weaken security headers, authentication, authorization, privacy controls, accessibility, or error handling to make the scan pass.Basic contrast
0/81 of 100 rendered text color sample(s) missed WCAG contrast targets. Worst rendered ratio: 1.04.
Failed: earned 0 of 8 points.
Priority: Priority 20: lower-risk cleanup after urgent launch blockers.
Why it matters: Low contrast makes a launch page feel less polished and can exclude users with low vision.
Fix: Review key text, buttons, and links against a 4.5:1 contrast target for normal text.
Agent Prompt
## Role
Act as a focused web accessibility remediation expert who can inspect the public page and safely improve the underlying implementation.
## Inputs
- Primary context: Improve magicshot.ai at https://magicshot.ai.
- Scanner check ID: accessibility_contrast.
- Fix title: Improve detectable color contrast.
- Scanner check: Basic contrast.
- Category: Accessibility.
- Status: fail.
- Severity: medium.
- Priority: 20; lower numbers are more urgent.
- Score impact: 8 of 8 rule points lost.
- Evidence: 1 of 100 rendered text color sample(s) missed WCAG contrast targets. Worst rendered ratio: 1.04.
- What needs attention: The scanner found text/background color pairs that may be hard to read, or could not verify contrast.
- Why it matters: Low contrast makes a launch page feel less polished and can exclude users with low vision.
- Status-specific guidance: A public check reported a failure. Reproduce or inspect the issue first, then make the smallest safe fix.
- Audience or recipient: The site owner, builder, or marketing team responsible for improving this public page.
- Constraints, examples, or source material: Treat the live URL as the public target to inspect, not as the only source of truth. When repository, CMS, or hosting access is available, use that implementation context before changing anything.
- Target outcome: After the fix is deployed and the public page is rescanned, this specific check should improve or pass without lowering other SEO / AEO, security, accessibility, or design signals.
- Likely places to inspect: CSS variables, design tokens, theme config, text/background combinations, buttons, links, badges, and disabled states; semantic markup, labels, landmarks, headings, focus states, image rendering, form controls, and browser-rendered accessibility output; the route, template, component, CMS entry, theme file, or static page that renders the scanned URL; shared layout, metadata, routing, middleware, server, CDN, or hosting configuration if the issue is not in page content; existing tests, build scripts, preview commands, and deployment notes before choosing verification steps.
## Task
Use the provided context to safely complete this workflow: Review key text, buttons, and links against a 4.5:1 contrast target for normal text.
First reproduce or verify the issue from the public page and available implementation source. Then make the smallest stack-appropriate change that fixes the scanner signal and improves the real user experience.
Use this check-specific implementation guide:
- Adjust foreground/background colors or font treatment where contrast is too low.
- Preserve brand feel while making text readable in real viewport states.
- Fix the semantic or interaction source of the issue rather than hiding warnings with ARIA or visual-only workarounds.
- Keep keyboard, screen reader, and touch users in the verification path.
- Keep the implementation stack-appropriate: use the existing framework, CMS, hosting provider, design system, and deployment workflow already in the project.
Acceptance criteria for this fix:
- Important text and controls meet reasonable contrast targets in rendered states.
- No new low-contrast states are introduced.
- The affected UI remains usable by keyboard and assistive technology and does not introduce heading, label, focus, or contrast regressions.
- The change can be checked in the browser or with an accessibility audit tool when available.
- A fresh FreeScan rescan should show this check improved or passing after deployment.
## Output
Return a structured response with these headings: Findings, Changes Made, Verification Results, Rescan Expectation, Rollback Notes, Assumptions.
## Rules
- Ask a clarifying question when required context is missing.
- Preserve the user's intent and avoid inventing facts.
- Verify the issue exists before changing code or content. If the issue is not reproducible, explain what you checked and recommend no code change.
- If the live URL and implementation source disagree, trust the implementation source for edits and use the live URL only to understand current public behavior.
- Keep the change narrowly scoped to this fix unless another change is required to avoid a regression.
- Match the existing framework, style, design system, routing patterns, and content conventions.
- Preserve existing URLs, forms, analytics, SEO metadata, accessibility semantics, and conversion flows unless the fix explicitly requires changing them.
- Do not perform broad refactors, dependency upgrades, redesigns, rewrites, migrations, file deletions, route changes, or destructive commands unless they are explicitly required and approved.
- Make changes that are easy to review and roll back.
- Prefer editing the canonical source of the page over patching built output, generated files, CDN-cached HTML, or minified assets.
- Do not make a cosmetic or placeholder change just to satisfy the scanner; the public page should be materially better for visitors, crawlers, or assistive technology.
- Verify the result with the smallest reliable test, build, browser check, or manual inspection available.
## Safety
- Do not request, expose, or reproduce sensitive data.
- Redact private details from examples unless the user explicitly says they are safe to include.
- Do not use credentials, cookies, authenticated data, hidden form values, or private response bodies.
- Do not weaken security headers, authentication, authorization, privacy controls, accessibility, or error handling to make the scan pass.Rendered axe accessibility violations
0/18axe found 1 violation rule(s), including 0 serious or critical rule(s). Top rules: region (1).
Failed: earned 0 of 18 points.
Priority: Priority 5: fix before sharing the page publicly.
Why it matters: axe checks the actual browser-rendered page, so these issues can affect people using keyboards, screen readers, or other assistive technology.
Fix: Fix the top axe rule IDs first, especially critical and serious violations around names, roles, labels, headings, contrast, landmarks, and keyboard-accessible controls.
Agent Prompt
## Role
Act as a focused web accessibility remediation expert who can inspect the public page and safely improve the underlying implementation.
## Inputs
- Primary context: Improve magicshot.ai at https://magicshot.ai.
- Scanner check ID: accessibility_axe_violations.
- Fix title: Fix rendered axe accessibility violations.
- Scanner check: Rendered axe accessibility violations.
- Category: Accessibility.
- Status: fail.
- Severity: high.
- Priority: 5; lower numbers are more urgent.
- Score impact: 18 of 18 rule points lost.
- Evidence: axe found 1 violation rule(s), including 0 serious or critical rule(s). Top rules: region (1).
- What needs attention: The rendered page has accessibility rule violations detected by axe-core.
- Why it matters: axe checks the actual browser-rendered page, so these issues can affect people using keyboards, screen readers, or other assistive technology.
- Status-specific guidance: A public check reported a failure. Reproduce or inspect the issue first, then make the smallest safe fix.
- Audience or recipient: The site owner, builder, or marketing team responsible for improving this public page.
- Constraints, examples, or source material: Treat the live URL as the public target to inspect, not as the only source of truth. When repository, CMS, or hosting access is available, use that implementation context before changing anything.
- Target outcome: After the fix is deployed and the public page is rescanned, this specific check should improve or pass without lowering other SEO / AEO, security, accessibility, or design signals.
- Likely places to inspect: axe violation details, affected selectors, rendered DOM, component source, and interaction state that triggered the issue; semantic markup, labels, landmarks, headings, focus states, image rendering, form controls, and browser-rendered accessibility output; the route, template, component, CMS entry, theme file, or static page that renders the scanned URL; shared layout, metadata, routing, middleware, server, CDN, or hosting configuration if the issue is not in page content; existing tests, build scripts, preview commands, and deployment notes before choosing verification steps.
## Task
Use the provided context to safely complete this workflow: Fix the top axe rule IDs first, especially critical and serious violations around names, roles, labels, headings, contrast, landmarks, and keyboard-accessible controls.
First reproduce or verify the issue from the public page and available implementation source. Then make the smallest stack-appropriate change that fixes the scanner signal and improves the real user experience.
Use this check-specific implementation guide:
- Fix each reported accessibility violation at the semantic source.
- Avoid suppressing automated checks unless there is a documented false positive.
- Fix the semantic or interaction source of the issue rather than hiding warnings with ARIA or visual-only workarounds.
- Keep keyboard, screen reader, and touch users in the verification path.
- Keep the implementation stack-appropriate: use the existing framework, CMS, hosting provider, design system, and deployment workflow already in the project.
Acceptance criteria for this fix:
- Critical and serious axe issues tied to this page are resolved or clearly documented as non-reproducible.
- Fixes do not introduce new keyboard, label, contrast, or landmark regressions.
- The affected UI remains usable by keyboard and assistive technology and does not introduce heading, label, focus, or contrast regressions.
- The change can be checked in the browser or with an accessibility audit tool when available.
- A fresh FreeScan rescan should show this check improved or passing after deployment.
## Output
Return a structured response with these headings: Findings, Changes Made, Verification Results, Rescan Expectation, Rollback Notes, Assumptions.
## Rules
- Ask a clarifying question when required context is missing.
- Preserve the user's intent and avoid inventing facts.
- Verify the issue exists before changing code or content. If the issue is not reproducible, explain what you checked and recommend no code change.
- If the live URL and implementation source disagree, trust the implementation source for edits and use the live URL only to understand current public behavior.
- Keep the change narrowly scoped to this fix unless another change is required to avoid a regression.
- Match the existing framework, style, design system, routing patterns, and content conventions.
- Preserve existing URLs, forms, analytics, SEO metadata, accessibility semantics, and conversion flows unless the fix explicitly requires changing them.
- Do not perform broad refactors, dependency upgrades, redesigns, rewrites, migrations, file deletions, route changes, or destructive commands unless they are explicitly required and approved.
- Make changes that are easy to review and roll back.
- Prefer editing the canonical source of the page over patching built output, generated files, CDN-cached HTML, or minified assets.
- Do not make a cosmetic or placeholder change just to satisfy the scanner; the public page should be materially better for visitors, crawlers, or assistive technology.
- Verify the result with the smallest reliable test, build, browser check, or manual inspection available.
## Safety
- Do not request, expose, or reproduce sensitive data.
- Redact private details from examples unless the user explicitly says they are safe to include.
- Do not use credentials, cookies, authenticated data, hidden form values, or private response bodies.
- Do not weaken security headers, authentication, authorization, privacy controls, accessibility, or error handling to make the scan pass.Text density
0/10Detected about 2786 visible word(s).
Failed: earned 0 of 10 points.
Priority: Priority 21: lower-risk cleanup after urgent launch blockers.
Why it matters: Too little copy can leave visitors confused; too much copy can bury the value proposition.
Fix: Add concise sections for value, proof, how it works, and next steps, then remove repetitive copy.
Agent Prompt
## Role
Act as a focused conversion-focused frontend quality remediation expert who can inspect the public page and safely improve the underlying implementation.
## Inputs
- Primary context: Improve magicshot.ai at https://magicshot.ai.
- Scanner check ID: design_text_density.
- Fix title: Balance landing page copy.
- Scanner check: Text density.
- Category: Design.
- Status: fail.
- Severity: medium.
- Priority: 21; lower numbers are more urgent.
- Score impact: 10 of 10 rule points lost.
- Evidence: Detected about 2786 visible word(s).
- What needs attention: The page has too little or too much detectable text for a useful launch page.
- Why it matters: Too little copy can leave visitors confused; too much copy can bury the value proposition.
- Status-specific guidance: A public check reported a failure. Reproduce or inspect the issue first, then make the smallest safe fix.
- Audience or recipient: The site owner, builder, or marketing team responsible for improving this public page.
- Constraints, examples, or source material: Treat the live URL as the public target to inspect, not as the only source of truth. When repository, CMS, or hosting access is available, use that implementation context before changing anything.
- Target outcome: After the fix is deployed and the public page is rescanned, this specific check should improve or pass without lowering other SEO / AEO, security, accessibility, or design signals.
- Likely places to inspect: long sections, paragraphs, feature lists, cards, FAQ blocks, and mobile line lengths; page layout, responsive CSS, component states, copy hierarchy, CTA placement, spacing tokens, rendered console output, and performance-sensitive assets; the route, template, component, CMS entry, theme file, or static page that renders the scanned URL; shared layout, metadata, routing, middleware, server, CDN, or hosting configuration if the issue is not in page content; existing tests, build scripts, preview commands, and deployment notes before choosing verification steps.
## Task
Use the provided context to safely complete this workflow: Add concise sections for value, proof, how it works, and next steps, then remove repetitive copy.
First reproduce or verify the issue from the public page and available implementation source. Then make the smallest stack-appropriate change that fixes the scanner signal and improves the real user experience.
Use this check-specific implementation guide:
- Break dense copy into scannable headings, shorter paragraphs, lists, or progressive disclosure.
- Keep important details while reducing cognitive load.
- Improve the actual rendered page at mobile and desktop sizes, not only the source code shape.
- Preserve core conversion flows while making layout, hierarchy, readability, or runtime health better.
- Keep the implementation stack-appropriate: use the existing framework, CMS, hosting provider, design system, and deployment workflow already in the project.
Acceptance criteria for this fix:
- The page is easier to scan without hiding essential offer, pricing, trust, or support information.
- Text remains readable on mobile and desktop.
- The rendered page is visually stable and usable on mobile and desktop viewports.
- The fix does not hide content, break CTAs, introduce console errors, or reduce clarity for visitors.
- A fresh FreeScan rescan should show this check improved or passing after deployment.
## Output
Return a structured response with these headings: Findings, Changes Made, Verification Results, Rescan Expectation, Rollback Notes, Assumptions.
## Rules
- Ask a clarifying question when required context is missing.
- Preserve the user's intent and avoid inventing facts.
- Verify the issue exists before changing code or content. If the issue is not reproducible, explain what you checked and recommend no code change.
- If the live URL and implementation source disagree, trust the implementation source for edits and use the live URL only to understand current public behavior.
- Keep the change narrowly scoped to this fix unless another change is required to avoid a regression.
- Match the existing framework, style, design system, routing patterns, and content conventions.
- Preserve existing URLs, forms, analytics, SEO metadata, accessibility semantics, and conversion flows unless the fix explicitly requires changing them.
- Do not perform broad refactors, dependency upgrades, redesigns, rewrites, migrations, file deletions, route changes, or destructive commands unless they are explicitly required and approved.
- Make changes that are easy to review and roll back.
- Prefer editing the canonical source of the page over patching built output, generated files, CDN-cached HTML, or minified assets.
- Do not make a cosmetic or placeholder change just to satisfy the scanner; the public page should be materially better for visitors, crawlers, or assistive technology.
- Verify the result with the smallest reliable test, build, browser check, or manual inspection available.
## Safety
- Do not request, expose, or reproduce sensitive data.
- Redact private details from examples unless the user explicitly says they are safe to include.
- Do not use credentials, cookies, authenticated data, hidden form values, or private response bodies.
- Do not weaken security headers, authentication, authorization, privacy controls, accessibility, or error handling to make the scan pass.Rendered layout ergonomics
0/9Horizontal overflow: 0px. Small tap targets: 90.
Failed: earned 0 of 9 points.
Priority: Priority 13: fix during launch polish.
Why it matters: Horizontal overflow and tiny tap targets make the page feel broken on real devices, especially for mobile visitors.
Fix: Remove elements wider than the viewport, add responsive constraints, and make important links, buttons, inputs, and controls at least 40px tall and wide where possible.
Agent Prompt
## Role
Act as a focused conversion-focused frontend quality remediation expert who can inspect the public page and safely improve the underlying implementation.
## Inputs
- Primary context: Improve magicshot.ai at https://magicshot.ai.
- Scanner check ID: design_rendered_layout.
- Fix title: Fix rendered layout ergonomics.
- Scanner check: Rendered layout ergonomics.
- Category: Design.
- Status: fail.
- Severity: medium.
- Priority: 13; lower numbers are more urgent.
- Score impact: 9 of 9 rule points lost.
- Evidence: Horizontal overflow: 0px. Small tap targets: 90.
- What needs attention: The browser-rendered page has layout or tap-target issues.
- Why it matters: Horizontal overflow and tiny tap targets make the page feel broken on real devices, especially for mobile visitors.
- Status-specific guidance: A public check reported a failure. Reproduce or inspect the issue first, then make the smallest safe fix.
- Audience or recipient: The site owner, builder, or marketing team responsible for improving this public page.
- Constraints, examples, or source material: Treat the live URL as the public target to inspect, not as the only source of truth. When repository, CMS, or hosting access is available, use that implementation context before changing anything.
- Target outcome: After the fix is deployed and the public page is rescanned, this specific check should improve or pass without lowering other SEO / AEO, security, accessibility, or design signals.
- Likely places to inspect: mobile viewport, horizontal overflow sources, tap target sizes, fixed-position elements, menus, forms, and embeds; page layout, responsive CSS, component states, copy hierarchy, CTA placement, spacing tokens, rendered console output, and performance-sensitive assets; the route, template, component, CMS entry, theme file, or static page that renders the scanned URL; shared layout, metadata, routing, middleware, server, CDN, or hosting configuration if the issue is not in page content; existing tests, build scripts, preview commands, and deployment notes before choosing verification steps.
## Task
Use the provided context to safely complete this workflow: Remove elements wider than the viewport, add responsive constraints, and make important links, buttons, inputs, and controls at least 40px tall and wide where possible.
First reproduce or verify the issue from the public page and available implementation source. Then make the smallest stack-appropriate change that fixes the scanner signal and improves the real user experience.
Use this check-specific implementation guide:
- Constrain overflowing elements and increase small important tap targets where possible.
- Preserve layout intent while making the rendered page usable on real devices.
- Improve the actual rendered page at mobile and desktop sizes, not only the source code shape.
- Preserve core conversion flows while making layout, hierarchy, readability, or runtime health better.
- Keep the implementation stack-appropriate: use the existing framework, CMS, hosting provider, design system, and deployment workflow already in the project.
Acceptance criteria for this fix:
- The rendered page has no meaningful horizontal overflow.
- Important links, buttons, inputs, and controls are comfortably tappable.
- The rendered page is visually stable and usable on mobile and desktop viewports.
- The fix does not hide content, break CTAs, introduce console errors, or reduce clarity for visitors.
- A fresh FreeScan rescan should show this check improved or passing after deployment.
## Output
Return a structured response with these headings: Findings, Changes Made, Verification Results, Rescan Expectation, Rollback Notes, Assumptions.
## Rules
- Ask a clarifying question when required context is missing.
- Preserve the user's intent and avoid inventing facts.
- Verify the issue exists before changing code or content. If the issue is not reproducible, explain what you checked and recommend no code change.
- If the live URL and implementation source disagree, trust the implementation source for edits and use the live URL only to understand current public behavior.
- Keep the change narrowly scoped to this fix unless another change is required to avoid a regression.
- Match the existing framework, style, design system, routing patterns, and content conventions.
- Preserve existing URLs, forms, analytics, SEO metadata, accessibility semantics, and conversion flows unless the fix explicitly requires changing them.
- Do not perform broad refactors, dependency upgrades, redesigns, rewrites, migrations, file deletions, route changes, or destructive commands unless they are explicitly required and approved.
- Make changes that are easy to review and roll back.
- Prefer editing the canonical source of the page over patching built output, generated files, CDN-cached HTML, or minified assets.
- Do not make a cosmetic or placeholder change just to satisfy the scanner; the public page should be materially better for visitors, crawlers, or assistive technology.
- Verify the result with the smallest reliable test, build, browser check, or manual inspection available.
## Safety
- Do not request, expose, or reproduce sensitive data.
- Redact private details from examples unless the user explicitly says they are safe to include.
- Do not use credentials, cookies, authenticated data, hidden form values, or private response bodies.
- Do not weaken security headers, authentication, authorization, privacy controls, accessibility, or error handling to make the scan pass.Share preview
magicshot.ai website audit report
Close to ready: 78/100 overall, with prioritized fixes for SEO, security, accessibility, and design.
Public reports expose the scanned public URL, safe scores, sanitized public evidence, and fix guidance. They do not include credentials, cookies, hidden form values, or sensitive response bodies.
