scanned Aug 6, 2026
freecode.ai
Displays an error message when a user does not have permission to access a specific webpage.
Tier 2 · Basic Presence
Scored by asking 15 questions a buyer of a security product asks, then grading this site’s own pages: answered, hedged (partial or vague), or silent (no page answers it). How scoring works
15 buyer questions · graded against the site’s own pages
Goes silent · technical · high importance
Is the denial caused by missing authentication credentials, or does it require a specific authorization level beyond simply being logged in?
Goes silent · integration · medium importance
If an API key is required, what is the exact header name and token prefix format the endpoint expects?
This report is public. Own freecode.ai? Claiming is free: crawl every page, re-audit as you fix, and track your score over time.
Sign in to claim65 points sit between freecode.ai and 100: 11 open questions and 13 missing protocol checks, ordered by estimated payoff.
Point estimates are per fix under scoring v2. They are not additive to a promised total.
Is the denial caused by missing authentication credentials, or does it require a specific authorization level beyond simply being logged in?
No page on the site addresses this.
confidence high · grounding world-knowledge · weight 0.00 · Absent
If an API key is required, what is the exact header name and token prefix format the endpoint expects?
No page on the site addresses this.
confidence high · grounding synthesized · weight 0.00 · Absent
Are specific rate-limit headers included in the access denied response, and what are their default limit values?
Does the error response include a Retry-After header, and what is the maximum documented wait time before I can retry?
No page on the site addresses this.
confidence high · grounding synthesized · weight 0.00 · Absent
What is the exact JSON field name or error schema used when the denial is returned via API rather than as an HTML page?
Is there a known edge case where rapidly switching between /llms.txt and /lander with the same token triggers a false denial due to session caching?
Does the server return a WWW-Authenticate header specifying the required authentication scheme, and what realm does it declare?
No page on the site addresses this.
confidence high · grounding synthesized · weight 0.00 · Absent
If I am behind a corporate VPN or proxy, which specific forwarded headers must be present to avoid an IP-based access denial?
No page on the site addresses this.
If this domain will host a service, publish integration documentation that specifies required forwarded headers (e.g., X-Forwarded-For, X-Forwarded-Proto) for clients behind corporate VPNs or proxies.
confidence high · grounding world-knowledge · weight 0.00 · Absent
A buyer gets something, then has to guess the rest. Expand any row for the evidence and the fix.
Are the access rules for /lander documented separately from /llms.txt, and what specific permission scope is required to view it?
confidence high · grounding synthesized · weight 0.70 · Absent
What HTTP status code does the /lander endpoint return when access is denied — is it 401, 403, or a different code?
The retrieved content for the /lander endpoint shows an "Access Denied" page with the message "You don't have permission to access...", but it does not specify the numeric HTTP status code (whether 401, 403, or another).
Explicitly document the exact HTTP status code (e.g., 401, 403) returned by the /lander endpoint when access is denied.
Where we looked: /lander
confidence high · grounding stated · weight 0.80 · Vague
What is the exact Content-Type returned when the access denied page is requested with an Accept: application/json header instead of by a browser?
The retrieved chunks show that freecode.ai returns an Akamai/EdgeSuite "Access Denied" HTML page containing a reference number (e.g., "You don't have permission to access..."), but they do not specify the exact Content-Type returned when the page is requested with an Accept: application/json header.
Add technical documentation or an FAQ entry that specifies the Content-Type and response body format for the access denied page when requested with non-browser Accept headers such as application/json.
Where we looked: /lander
confidence high · grounding stated · weight 0.80 · Page missing
4 of 15. Answered with enough specificity for a buyer to act on. This is the bar the queue above is chasing.
Does the page indicate whether the denial is temporary, such as a rate limit, or permanent, and how can I tell the difference?
No. The page does not indicate whether the denial is temporary or permanent, nor does it explain how to tell the difference. The access denied message only states, “You don’t have permission to access ‘http://forsale.godaddy.com/forsale/freecode.ai?’ on this server,” and provides a reference number and an errors.edgesuite.net link. It does not mention rate limits, retry guidance, or any criteria for distinguishing a temporary block from a permanent one.
Source: /lander
confidence high · grounding stated · weight 1.00 · Answered
Does the access denied page display a direct support link or email address I can use to request permission?
No. The access denied page does not display a direct support link or email address. It only shows a reference number and a URL to errors.edgesuite.net.
Source: /lander
confidence high · grounding stated · weight 1.00 · Answered
What is the exact text of the main error message shown on the access denied page?
You don't have permission to access "http://forsale.godaddy.com/forsale/freecode.ai?" on this server.
Source: /lander
confidence high · grounding stated · weight 1.00 · Answered
Is there a unique error code or trace ID shown on the page, and what is its exact format or character length?
Yes. The page displays a Reference # trace ID. The exact value shown is `Reference #18.48a7cb17.1786024644.a10a033b`. The trace ID itself (excluding the "Reference #" prefix) is 31 characters long and follows a four-segment, dot-separated format: a 2-digit number, an 8-character hexadecimal string, a 10-digit number, and an 8-character hexadecimal string.
Source: /lander
confidence high · grounding stated · weight 1.00 · Answered
The other half of the score: 16 checks for the files and headers agents look for. The 13 below are installs, not judgment calls, and most are an afternoon. Expand any for the snippet and the standard it follows. They sit after the queue because none of them changes what your pages say.
Sitedex generates this file from your crawl. Grab it in Files from this audit below.
Standardllmstxt.orgCommunity spec
User-agent: * Content-Signal: search=yes, ai-input=yes, ai-train=no Allow: /
StandardCloudflare proposalVendor proposal
StandardSitedex metricSitedex metric
StandardRFC 9110 + 7763IETF RFC
StandardSitedex metricSitedex metric
Sitedex generates this file from your crawl. Grab it in Files from this audit below.
StandardModel Context ProtocolCommunity spec
StandardOpenAPI SpecIndustry standard
Sitedex generates this file from your crawl. Grab it in Files from this audit below.
StandardW3C WebMCP draftW3C / WHATWG
<link rel="canonical" href="https://freecode.ai/" />
StandardRFC 6596IETF RFC
<meta name="description" content="freecode.ai: [outcome you deliver] for [who you help]. One sentence, 50-160 characters." />
StandardHTML Living StandardW3C / WHATWG
<html lang="en">
StandardHTML LS + WCAG 2.1W3C / WHATWG
Sitedex generates this file from your crawl. Grab it in Files from this audit below.
StandardSchema.org + JSON-LDIndustry standard
Standardsitemaps.orgIndustry standard
Already passing 3 of 16: robots.txt, sitemap.xml, AI crawler access.
Sitedex already serves freecode.ai as an MCP endpoint. Ask freecode.ai anything an AI agent might ask, and see what its index returns. (To score your own site, use the form below.)
For developers and the engineer-on-call: copy these into your tools or your site.
Files from this audit
Built from this crawl. Download or copy each, then install it at the path noted.
Built from this crawl. Install at /llms.txt so agents start here.
Organization JSON-LD, pre-filled from this crawl. Wrap in a ld+json script.
MCP server card built from this crawl. Host at /.well-known/mcp/server-card.json.
WebMCP discovery manifest built from this crawl. Host at /.well-known/webmcp.json.
MCP endpoint
https://mcp.sitedex.dev/s/freecode-ai/mcp
The URL anyone's agent points at. Read-only; safe to share.
Claude Code
claude mcp add freecode --transport http https://mcp.sitedex.dev/s/freecode-ai/mcp
One command, then the agent has it.
Cursor / Continue
{
"mcpServers": {
"freecode": {
"url": "https://mcp.sitedex.dev/s/freecode-ai/mcp"
}
}
}Drop into mcp.json.
WebMCP: two parts
WebMCP-capable browsers run the widget at runtime. Crawlers without JS rendering need the discovery manifest to find your tool surface. Install both.
1 · Widget script
<script async src="https://sitedex.dev/widget.js"></script>
Drop in <head>. WebMCP-capable browsers (Chrome 146+ Origin Trial) call navigator.modelContext.provideContext() via this script.
2 · Discovery manifest
{
"$schema": "https://wellknownmcp.org/schemas/webmcp.json",
"name": "freecode.ai",
"tools": [
{ "name": "search", "description": "Search freecode.ai's indexed content." },
{ "name": "get_page", "description": "Fetch a page from freecode.ai as markdown." }
]
}Host alongside the script at /.well-known/webmcp.json. Crawlers that don't render JS rely on this.
Your turn
See which of these questions your site goes silent on.
Free, about 5 minutes. We crawl your site, test it against the buyer questions your category asks, and name what’s vague, contradictory, or missing, plus the files AI agents look for.