scanned Aug 6, 2026

Access Denied

allys.ai

securityVisit site →

Displays an error message when a user does not have permission to access a specific webpage.

39/100

Tier 2 · Basic Presence

Content answers48/100

Protocol plumbing19/1003 of 16 checks pass

Re-audit364h ago· 1 credit

Scored by asking 15 questions a buyer of a security product asks, then grading this site’s own pages: answered, hedged (partial or vague), or silent (no page answers it). How scoring works

15 buyer questions · graded against the site’s own pages

6 of 15 come back answered. 2 get a hedge. 7 meet silence.

6 answerable2 half-answers7 silent

Goes silent · technical · medium importance

Does the error response include a machine-readable error code in the headers or JSON body so I can handle it programmatically?

Goes silent · limits · medium importance

If I'm hitting this denial because of rate limiting, what is the exact request quota or burst limit I exceeded?

This report is public. Own allys.ai? Claiming is free: crawl every page, re-audit as you fix, and track your score over time.

The fix queue

61 points sit between allys.ai and 100: 9 open questions and 13 missing protocol checks, ordered by estimated payoff.

Point estimates are per fix under scoring v2. They are not additive to a promised total.

01technical · importance mediumGoes silent+7 content pts est.

Does the error response include a machine-readable error code in the headers or JSON body so I can handle it programmatically?

What the pages say

No page on the site addresses this.

Source: /lander, /llms.txt

confidence high · grounding synthesized · weight 0.00 · Absent

02limits · importance mediumGoes silent+7 content pts est.

If I'm hitting this denial because of rate limiting, what is the exact request quota or burst limit I exceeded?

What the pages say

No page on the site addresses this.

The fix

If allys.ai is an operational service, publish API documentation or a dedicated limits page specifying rate limits, request quotas, and burst thresholds. Currently, the site only shows a domain-for-sale listing with no technical documentation.

Where we looked: /lander, /llms.txt

confidence high · grounding synthesized · weight 0.00 · Absent

03security · importance lowGoes silent+7 content pts est.

If I'm using a crawler or specific user-agent, are there known bot protections that trigger this 403, and how do I get exempted?

What the pages say

No page on the site addresses this.

Source: /lander, /llms.txt, /lander

confidence high · grounding synthesized · weight 0.00 · Absent

04operations · importance lowGoes silent+7 content pts est.

Are there firewall or egress configuration examples showing how to whitelist my IP range so my server stops getting blocked?

What the pages say

allys.ai does not provide firewall or egress configuration examples. According to the site's llms.txt file, allys.ai is a domain name currently listed for sale on GoDaddy's aftermarket and has no active product or technical documentation.

The fix

If allys.ai represents an active vendor, publish technical documentation that includes firewall rules, egress configuration examples, and IP whitelisting instructions.

Where we looked: /llms.txt

confidence high · grounding stated · weight 0.00 · Absent

05technical · importance lowGoes silent+7 content pts est.

Does the documentation list the exact HTTP headers I need to send—like a specific Authorization scheme or custom header—to avoid the Access Denied on /lander?

What the pages say

No. The site does not contain any documentation listing HTTP headers, Authorization schemes, or custom headers for /lander. The retrieved chunks show that allys.ai is a domain listed for sale on GoDaddy, and the /lander endpoint returns a generic Access Denied error page without any accompanying developer documentation or guidance on required headers.

Source: /lander, /llms.txt

confidence high · grounding synthesized · weight 0.00 · Absent

06technical · importance lowGoes silent+7 content pts est.

For automation, does the 403 response return JSON with a structured error type, or is it only an HTML page?

What the pages say

No page on the site addresses this.

The fix

If allys.ai offers an automation API or developer platform, publish endpoint documentation that specifies error response formats (e.g., whether 403s return JSON with structured error types).

Where we looked: /lander, /llms.txt

confidence high · grounding synthesized · weight 0.00 · Absent

07security · importance lowGoes silent+7 content pts est.

If my token expired, does the error specify that the credential is invalid versus missing the required scope for /lander?

What the pages say

No page on the site addresses this.

The fix

If /lander is an API endpoint, publish documentation describing authentication error codes and messages, including distinctions between expired tokens, invalid credentials, and missing scopes.

Where we looked: /lander, /llms.txt, /lander

confidence high · grounding synthesized · weight 0.00 · Absent

Hedged · 2 of 15 questions

A buyer gets something, then has to guess the rest. Expand any row for the evidence and the fix.

08Does the /lander endpoint return a 403 Forbidden or 401 Unauthorized when it blocks me, and is that status documented anywhere?technicalHedges+2 pts est.

Does the /lander endpoint return a 403 Forbidden or 401 Unauthorized when it blocks me, and is that status documented anywhere?

What the pages say

The retrieved chunks show that the /lander endpoint returns a page titled "Access Denied" with the message "You don't have permission to access 'http://forsale.godaddy.com/forsale/allys.ai?' on this server." However, the chunks do not specify whether the HTTP response status is 403 Forbidden or 401 Unauthorized, and no retrieved chunk documents this status code behavior elsewhere on the site.

The fix

Explicitly state the HTTP status code returned by the /lander endpoint (e.g., 403 Forbidden) in an API or status documentation page, or include it in the error response body.

Where we looked: /lander, /lander

confidence high · grounding synthesized · weight 0.70 · Vague

09Are there IP allowlists or geo-restrictions documented that explain why my requests to /lander are being rejected?securityThin on specifics+2 pts est.

Are there IP allowlists or geo-restrictions documented that explain why my requests to /lander are being rejected?

What the pages say

No. allys.ai does not document IP allowlists or geo-restrictions. The /lander endpoint returns an EdgeSuite 'Access Denied' error, but the site provides no documentation explaining whether the rejection is caused by IP allowlists, geo-restrictions, or other security controls.

The fix

Add a security, support, or status page that documents any IP allowlists, geo-restrictions, or WAF rules affecting the site, and provides guidance for users seeing 'Access Denied' errors.

Where we looked: /lander, /llms.txt

confidence high · grounding synthesized · weight 0.70 · Absent

What the pages already answer cleanly

6 of 15. Answered with enough specificity for a buyer to act on. This is the bar the queue above is chasing.

securityAnswered

Do I need a specific API key, OAuth scope, or org role to get past the Access Denied page on /lander, and which one is missing?

What the pages say

No — you do not need an API key, OAuth scope, or org role, and none is missing. The /lander page returns a GoDaddy/EdgeSuite "Access Denied" error (Reference #18.48a7cb17.1786024745.a10ce566) because allys.ai is a domain listed for sale on GoDaddy; there is no underlying application to authenticate to.

Source: /lander, /llms.txt

confidence high · grounding synthesized · weight 0.95 · Answered

supportAnswered

Is there a support link or email on the error page I can use to request access to whatever is behind /lander?

What the pages say

No. The /lander error page does not contain a support link or email address. It only displays an 'Access Denied' message, a reference number (e.g., Reference #18.48a7cb17.1786024745.a10ce566), and a generic EdgeSuite error URL (https://errors.edgesuite.net/18.48a7cb17.1786024745.a10ce566).

Source: /lander

confidence high · grounding stated · weight 1.00 · Answered

operationsAnswered

Is the access denial tied to a closed beta, admin role, or required entitlement that I can request from my dashboard?

What the pages say

No. The “Access Denied” page on allys.ai is an Akamai/EdgeSuite server error (Reference #18.48a7cb17.1786024745.a10ce566) when attempting to reach the GoDaddy for-sale listing URL, not a product access control. The site’s llms.txt states that allys.ai is simply a domain name listed for sale on GoDaddy’s aftermarket, so there is no underlying product with closed beta access, admin roles, or dashboard entitlements to request.

Source: /lander, /llms.txt

confidence high · grounding synthesized · weight 0.95 · Answered

integrationAnswered

Is there a public alternative like /llms.txt that gives me the data without needing the permissions /lander requires?

What the pages say

Yes. While https://allys.ai/lander returns an access denied error requiring permissions, https://allys.ai/llms.txt is publicly accessible and provides the domain data, including that allys.ai is listed for sale on GoDaddy's aftermarket with Buy-It-Now, Make-an-Offer, or Lease-to-Own options, plus escrow and transfer details.

Source: /lander, /llms.txt

confidence high · grounding synthesized · weight 0.95 · Answered

technicalAnswered

Does the page tell me whether this is a temporary block with a Retry-After header, or a permanent lack of permission?

What the pages say

The page indicates a permanent lack of permission. It displays "Access Denied" and states "You don't have permission to access..." It does not mention a Retry-After header or describe the block as temporary.

Source: /lander

confidence high · grounding stated · weight 1.00 · Answered

operationsAnswered

Is there a status page or incident note linked from the denial page explaining whether /lander is down for maintenance?

What the pages say

No. The /lander denial page does not link to a status page or incident note explaining maintenance. It only displays an "Access Denied" message and a link to https://errors.edgesuite.net/18.48a7cb17.1786024745.a10ce566.

Source: /lander

confidence high · grounding stated · weight 1.00 · Answered

Protocol plumbing · 19/1003 of 16 checks pass · each fix +6 protocol pts est.

The other half of the score: 16 checks for the files and headers agents look for. The 13 below are installs, not judgment calls, and most are an afternoon. Expand any for the snippet and the standard it follows. They sit after the queue because none of them changes what your pages say.

llms.txtDiscoverability+6 pts est.

Sitedex generates this file from your crawl. Grab it in Files from this audit below.

Standardllmstxt.orgCommunity spec

Content signalAccess+6 pts est.

Install snippet

User-agent: *
Content-Signal: search=yes, ai-input=yes, ai-train=no
Allow: /

StandardCloudflare proposalVendor proposal

Clean crawlAccess+6 pts est.

StandardSitedex metricSitedex metric

Markdown negotiationRendering+6 pts est.

StandardRFC 9110 + 7763IETF RFC

Server-rendered contentRendering+6 pts est.

StandardSitedex metricSitedex metric

MCP cardInteraction+6 pts est.

Sitedex generates this file from your crawl. Grab it in Files from this audit below.

StandardModel Context ProtocolCommunity spec

OpenAPI specInteraction+6 pts est.

StandardOpenAPI SpecIndustry standard

WebMCP widgetInteraction+6 pts est.

Sitedex generates this file from your crawl. Grab it in Files from this audit below.

StandardW3C WebMCP draftW3C / WHATWG

Canonical URLsHygiene+6 pts est.

Install snippet

<link rel="canonical" href="https://allys.ai/" />

StandardRFC 6596IETF RFC

Meta descriptionsHygiene+6 pts est.

Install snippet

<meta name="description" content="allys.ai: [outcome you deliver] for [who you help]. One sentence, 50-160 characters." />

StandardHTML Living StandardW3C / WHATWG

HTML lang attributeHygiene+6 pts est.

Install snippet

<html lang="en">

StandardHTML LS + WCAG 2.1W3C / WHATWG

Organization schemaIdentity+6 pts est.

Sitedex generates this file from your crawl. Grab it in Files from this audit below.

StandardSchema.org + JSON-LDIndustry standard

Sitemap lastmodDiscoverability+6 pts est.

Standardsitemaps.orgIndustry standard

Already passing 3 of 16: robots.txt, sitemap.xml, AI crawler access.

Ask this site’s index

Sitedex already serves allys.ai as an MCP endpoint. Ask allys.ai anything an AI agent might ask, and see what its index returns. (To score your own site, use the form below.)

Snippets & configs

For developers and the engineer-on-call: copy these into your tools or your site.

Files from this audit

Built from this crawl. Download or copy each, then install it at the path noted.

llms.txt

Built from this crawl. Install at /llms.txt so agents start here.

organization.json

Organization JSON-LD, pre-filled from this crawl. Wrap in a ld+json script.

server-card.json

MCP server card built from this crawl. Host at /.well-known/mcp/server-card.json.

webmcp.json

WebMCP discovery manifest built from this crawl. Host at /.well-known/webmcp.json.

MCP endpoint

https://mcp.sitedex.dev/s/allys-ai/mcp

The URL anyone's agent points at. Read-only; safe to share.

Claude Code

claude mcp add allys --transport http https://mcp.sitedex.dev/s/allys-ai/mcp

One command, then the agent has it.

Cursor / Continue

{
  "mcpServers": {
    "allys": {
      "url": "https://mcp.sitedex.dev/s/allys-ai/mcp"
    }
  }
}

Drop into mcp.json.

WebMCP: two parts

WebMCP-capable browsers run the widget at runtime. Crawlers without JS rendering need the discovery manifest to find your tool surface. Install both.

1 · Widget script

<script async src="https://sitedex.dev/widget.js"></script>

Drop in <head>. WebMCP-capable browsers (Chrome 146+ Origin Trial) call navigator.modelContext.provideContext() via this script.

2 · Discovery manifest

{
  "$schema": "https://wellknownmcp.org/schemas/webmcp.json",
  "name": "allys.ai",
  "tools": [
    { "name": "search", "description": "Search allys.ai's indexed content." },
    { "name": "get_page", "description": "Fetch a page from allys.ai as markdown." }
  ]
}

Host alongside the script at /.well-known/webmcp.json. Crawlers that don't render JS rely on this.

Your turn

See which of these questions your site goes silent on.

Free, about 5 minutes. We crawl your site, test it against the buyer questions your category asks, and name what’s vague, contradictory, or missing, plus the files AI agents look for.

ComingEmbeddable grade badgeScore history and deltasOpt-in public board