Owner tools

For the owner of Verpetas (verpetas.com).

Ownership

This launch is unclaimed.

Claim this launch to get an owner link, re-scan after fixes, track your score improvements, or remove your site from StackScope entirely.

Claim this launch

Start here

Three fast-win fixes from the list below, ordered by impact. Each is a drop-in change you can finish in under 30 minutes.

Add a robots.txt file
Add a sitemap.xml
Add Open Graph tags Missing on your page: all three Open Graph tags.

4 more score-affecting fixes below, plus advisory items.

Fixes that improve your score

Security

HIGHAdd the missing security response headers
Missing 5 of 6 standard browser headers. Start with Referrer-Policy, X-Content-Type-Options, and X-Frame-Options (one line each), then roll out CSP in Report-Only mode.
WhyEach header limits a class of browser-side attack: clickjacking, XSS, MIME sniffing, plaintext fallback. Missing headers leave default-permissive behaviour in place.
WhereMost are one line each in your server config, reverse proxy, CDN, or framework headers.
Learn more
Why this matters & sources
Per-header consequence:
- Content-Security-Policy: Controls which scripts, styles, and fonts are allowed to run on your pages. Without it, an injected <script> tag runs with full access to your users' sessions and cookies.
- X-Frame-Options: Stops other sites loading yours inside an invisible iframe to trick users into clicking buttons they can't see (clickjacking).
- X-Content-Type-Options: Tells browsers not to guess file types. Without it, a user-uploaded image can be sniffed as JavaScript and executed.
- Referrer-Policy: Controls how much of the current URL is sent to third-party sites and analytics. The default leaks the full path, including query strings that may contain tokens or user IDs.
- Permissions-Policy: Turns off browser features your site doesn't use (camera, microphone, geolocation, payment) so an injected script can't trigger them.
CSP rollout: Content-Security-Policy is the hardest to get right. Start with Content-Security-Policy-Report-Only, which logs violations without blocking. Open DevTools Console, reload each page, and relax the policy until the console is clean. Rename the header to Content-Security-Policy to enforce. For real-user monitoring, point a report-to directive at a free collector (report-uri.com, Sentry, or a /api/csp-report route).

Discoverability

MEDIUMAdd a robots.txt file
WhyTells search engines and bots which pages to crawl and which to skip. Without one, crawlers default to indexing everything they can reach, including admin paths and staging URLs.
WhereCreate /robots.txt at the site root. Most frameworks have a built-in path (Next.js app/robots.ts, Astro public/robots.txt).
Learn more
MEDIUMAdd a sitemap.xml
WhyHelps search engines discover all your pages, including deep-linked ones not in the navigation. Without one, only pages reachable via crawl-from-homepage get found.
WhereGenerate /sitemap.xml and reference it from robots.txt with a Sitemap: line. Frameworks usually generate it (Next.js app/sitemap.ts, Astro @astrojs/sitemap).
Learn more

Page basics & SEO

MEDIUMAdd Open Graph tags
Missing on your page: all three Open Graph tags.
WhyWithout og:title, og:description, and og:image, links to your site render as bare text on Facebook, LinkedIn, and most chat apps instead of rich previews with an image.
WhereAdd <meta property="og:title" content="..."> (and the other two) to each page's <head>. Frameworks usually have a metadata API for this.
Learn more
MEDIUMAdd a canonical link
No <link rel="canonical"> was detected on your page.
WhyTells search engines which URL is the canonical version when the same content is reachable via multiple paths (with/without trailing slash, query strings, www vs apex).
WhereAdd <link rel="canonical" href="https://your-domain.com/this-page"> to each page's <head>.
Learn more
MEDIUMSet a custom title and meta description
Missing on your page: a custom <title> and a <meta name="description">.
WhyThese are the first things users see in search results. They're the only chance to earn a click before someone visits.
WhereAdd <title> and <meta name="description"> to each page's <head>.
Learn more
MEDIUMAdd Twitter card meta tags
No Twitter card tags were detected on your page.
WhyWithout them, links shared on X render as bare text instead of a rich preview card with image, title, and description. Rich cards have meaningfully higher CTR.
WhereAdd <meta name="twitter:card" content="summary_large_image">, plus twitter:title, twitter:description, and twitter:image to your <head>.
Learn more

Starter Content-Security-Policy

We didn't see a Content-Security-Policy header on your site. Here's a starter policy built from the 2 third-party vendors we detected (firebase, google-fonts).

Content-Security-Policy-Report-Only:
default-src 'self';
script-src 'self' 'unsafe-inline' https://apis.google.com https://www.gstatic.com;
style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;
font-src 'self' https://fonts.gstatic.com;
connect-src 'self' https://*.firebaseio.com https://*.googleapis.com https://firestore.googleapis.com wss://*.firebaseio.com;
frame-ancestors 'none';
base-uri 'self';
form-action 'self';

Test before enforcing. This is a starting point based on what we could detect from a public crawl, not a finished policy. Deploy as Content-Security-Policy-Report-Only first (as shown above), walk through your site with DevTools Console open, and relax the policy until no CSP violations fire. Only then rename the header to Content-Security-Policy to enforce.

We probably don't cover everything. Vendors that only load behind auth, self-hosted scripts, custom analytics, and anything we haven't fingerprinted yet won't appear here. Inline scripts work because we've included 'unsafe-inline'; you can tighten that later with nonces once the basic policy is stable. The Report-Only walkthrough will flag anything we missed. That's the whole point of starting there.

Optional improvements

These don't change your StackScope score but cover SEO, agent-readiness, security-researcher discoverability, and compliance items worth addressing.

Security

LOWAdd /.well-known/security.txt
WhyLets security researchers report vulnerabilities responsibly through a published contact channel.
WhereCreate /.well-known/security.txt with a Contact: email and Expires: date.
Learn more

Email security

MEDIUMMove DMARC from p=none to quarantine or reject
DMARC policy is p=none (monitoring only).
Whyp=none lets receivers log failures but still deliver spoofed mail. Real protection only kicks in at quarantine or reject.
WhereAfter reviewing a few weeks of rua= reports and confirming your real senders pass, change to p=quarantine (sends spoofs to spam) and then p=reject (blocks them outright).
Learn more
MEDIUMConfigure DKIM with your email provider
No DKIM record found at the common selectors we check.
WhyDKIM signs your outbound mail with a cryptographic key receivers can verify. Without it, receivers can't tell your real mail from a spoof.
WhereAsk your email provider for their DKIM setup. It's usually one TXT record at {selector}._domainkey.{your-domain}.
Learn more
Why this matters & sources
Selectors we probe: Resend, SendGrid, Postmark, Mailchimp, Brevo, Mailgun, HubSpot, Customer.io, ConvertKit, Cloudflare Email. If you use Google Workspace, Microsoft 365, or self-hosted email with a custom selector, you may already have DKIM published and we just don't see it.
LOWAdd MTA-STS
No MTA-STS DNS record published.
WhyPrevents mail to your domain being downgraded to plaintext mid-flight by a network attacker. Most launches don't have this, so deploying it puts you a tier above generic email-security checks.
WherePublish a TXT record at _mta-sts.{your-domain} plus a policy file at https://mta-sts.{your-domain}/.well-known/mta-sts.txt.
Learn more
LOWAdd a TLS-RPT record
No TLS-RPT record at _smtp._tls.{domain}.
WhyReceivers can tell you when STARTTLS handshakes to your mail server fail. Without it, silent TLS failures are invisible.
WherePublish one TXT record at _smtp._tls.{your-domain} like v=TLSRPTv1; rua=mailto:[email protected].
Learn more

Agent / AI

LOWAdd an llms.txt file
WhyHelps AI models understand your site's content and how to use it. Not yet a standard but gaining adoption.
WhereCreate /llms.txt at the site root with a brief overview and key URLs.
Learn more
LOWDeclare a Content-Signal in robots.txt
WhyStates how you'd like AI systems to use your content (training, search, agent input). Without it, AI crawlers fall back to whatever default policy each vendor applies.
WhereAdd a Content-Signal: line to your robots.txt.
Learn more
LOWAdd Link response headers
WhyLets agents discover your sitemap, privacy policy, and docs without parsing HTML, which most lightweight agents skip.
WhereSet Link: response headers in your server config or framework middleware.
Learn more

If a tip looks wrong (for example it says "add a consent banner" and you already have one) the detection's the bug, not you. StackScope sees what's public from the outside: HTTP response, rendered HTML, cookies, and DNS. We can miss vendors that load behind consent, are self-hosted, or use an install shape we haven't fingerprinted yet. Email [email protected] and we'll look into it.

Copy into Cursor, Claude, or ChatGPT

This prompt includes the detected stack and only the fixes StackScope found. It asks the AI to make concrete file-level changes, not a vague website review.

Score-affecting basics only. Ask your AI to handle these first; come back for the optional hardening once they're done.

Everything: score-affecting fixes plus optional email security, agent metadata, and best-practice items. Longer prompt, more for an "all in one" agent run.

I own https://verpetas.com. StackScope (https://stackscope.dev) analysed it on 10 April 2026 and scored it 3.8/10 against their production-readiness checklist. Please help me apply the fixes below. These are the score-affecting basics. We'll circle back to the optional hardening (email security, advanced agent metadata) later.

Tech stack StackScope detected on the site (use this when suggesting where each fix lives in the codebase):
cloudflare, cloudflare-bot-management, fastly, firebase, firebase-email, google-fonts, hostinger, hostinger-email, hsts, http3, paddle, profitwell, tailwindcss, vite

Score-affecting fixes (these improve the StackScope score; [HIGH] = most impact):
- [HIGH] Add the missing security response headers. Missing 5 of 6 standard browser headers. Start with `Referrer-Policy`, `X-Content-Type-Options`, and `X-Frame-Options` (one line each), then roll out CSP in `Report-Only` mode. Why: Each header limits a class of browser-side attack: clickjacking, XSS, MIME sniffing, plaintext fallback. Missing headers leave default-permissive behaviour in place. Where: Most are one line each in your server config, reverse proxy, CDN, or framework headers. (https://owasp.org/www-project-secure-headers/)
- [MEDIUM] Add a robots.txt file. Why: Tells search engines and bots which pages to crawl and which to skip. Without one, crawlers default to indexing everything they can reach, including admin paths and staging URLs. Where: Create `/robots.txt` at the site root. Most frameworks have a built-in path (Next.js `app/robots.ts`, Astro `public/robots.txt`). (https://developers.google.com/search/docs/crawling-indexing/robots/intro)
- [MEDIUM] Add a sitemap.xml. Why: Helps search engines discover all your pages, including deep-linked ones not in the navigation. Without one, only pages reachable via crawl-from-homepage get found. Where: Generate `/sitemap.xml` and reference it from `robots.txt` with a `Sitemap:` line. Frameworks usually generate it (Next.js `app/sitemap.ts`, Astro `@astrojs/sitemap`). (https://developers.google.com/search/docs/crawling-indexing/sitemaps/overview)
- [MEDIUM] Add Open Graph tags. Missing on your page: all three Open Graph tags. Why: Without `og:title`, `og:description`, and `og:image`, links to your site render as bare text on Facebook, LinkedIn, and most chat apps instead of rich previews with an image. Where: Add `<meta property="og:title" content="...">` (and the other two) to each page's `<head>`. Frameworks usually have a metadata API for this. (https://ogp.me/)
- [MEDIUM] Add a canonical link. No `<link rel="canonical">` was detected on your page. Why: Tells search engines which URL is the canonical version when the same content is reachable via multiple paths (with/without trailing slash, query strings, www vs apex). Where: Add `<link rel="canonical" href="https://your-domain.com/this-page">` to each page's `<head>`. (https://developers.google.com/search/docs/crawling-indexing/consolidate-duplicate-urls)
- [MEDIUM] Set a custom title and meta description. Missing on your page: a custom `<title>` and a `<meta name="description">`. Why: These are the first things users see in search results. They're the only chance to earn a click before someone visits. Where: Add `<title>` and `<meta name="description">` to each page's `<head>`. (https://developers.google.com/search/docs/appearance/title-link)
- [MEDIUM] Add Twitter card meta tags. No Twitter card tags were detected on your page. Why: Without them, links shared on X render as bare text instead of a rich preview card with image, title, and description. Rich cards have meaningfully higher CTR. Where: Add `<meta name="twitter:card" content="summary_large_image">`, plus `twitter:title`, `twitter:description`, and `twitter:image` to your `<head>`. (https://developer.mozilla.org/en-US/docs/Web/HTML/Element/meta/name)

For each item, tell me exactly which file to create or which code to change, and where it lives in a project using the stack above. If my framework has a native API for the task (e.g. Next.js metadata exports, `app/sitemap.ts`, Astro layouts, Nuxt `useHead`), prefer that over raw HTML or server config.

Full analysis: https://stackscope.dev/launch/0au61r8y/verpetas

I own https://verpetas.com. StackScope (https://stackscope.dev) analysed it on 10 April 2026 and scored it 3.8/10 against their production-readiness checklist. Please help me apply the fixes below. This is a checklist, not a blocker list; Score-affecting fixes are the ones that move the number, Optional items are nice-to-haves with zero score impact that I can skip for an MVP.

Tech stack StackScope detected on the site (use this when suggesting where each fix lives in the codebase):
cloudflare, cloudflare-bot-management, fastly, firebase, firebase-email, google-fonts, hostinger, hostinger-email, hsts, http3, paddle, profitwell, tailwindcss, vite

Score-affecting fixes (these improve the StackScope score; [HIGH] = most impact):
- [HIGH] Add the missing security response headers. Missing 5 of 6 standard browser headers. Start with `Referrer-Policy`, `X-Content-Type-Options`, and `X-Frame-Options` (one line each), then roll out CSP in `Report-Only` mode. Why: Each header limits a class of browser-side attack: clickjacking, XSS, MIME sniffing, plaintext fallback. Missing headers leave default-permissive behaviour in place. Where: Most are one line each in your server config, reverse proxy, CDN, or framework headers. (https://owasp.org/www-project-secure-headers/)
- [MEDIUM] Add a robots.txt file. Why: Tells search engines and bots which pages to crawl and which to skip. Without one, crawlers default to indexing everything they can reach, including admin paths and staging URLs. Where: Create `/robots.txt` at the site root. Most frameworks have a built-in path (Next.js `app/robots.ts`, Astro `public/robots.txt`). (https://developers.google.com/search/docs/crawling-indexing/robots/intro)
- [MEDIUM] Add a sitemap.xml. Why: Helps search engines discover all your pages, including deep-linked ones not in the navigation. Without one, only pages reachable via crawl-from-homepage get found. Where: Generate `/sitemap.xml` and reference it from `robots.txt` with a `Sitemap:` line. Frameworks usually generate it (Next.js `app/sitemap.ts`, Astro `@astrojs/sitemap`). (https://developers.google.com/search/docs/crawling-indexing/sitemaps/overview)
- [MEDIUM] Add Open Graph tags. Missing on your page: all three Open Graph tags. Why: Without `og:title`, `og:description`, and `og:image`, links to your site render as bare text on Facebook, LinkedIn, and most chat apps instead of rich previews with an image. Where: Add `<meta property="og:title" content="...">` (and the other two) to each page's `<head>`. Frameworks usually have a metadata API for this. (https://ogp.me/)
- [MEDIUM] Add a canonical link. No `<link rel="canonical">` was detected on your page. Why: Tells search engines which URL is the canonical version when the same content is reachable via multiple paths (with/without trailing slash, query strings, www vs apex). Where: Add `<link rel="canonical" href="https://your-domain.com/this-page">` to each page's `<head>`. (https://developers.google.com/search/docs/crawling-indexing/consolidate-duplicate-urls)
- [MEDIUM] Set a custom title and meta description. Missing on your page: a custom `<title>` and a `<meta name="description">`. Why: These are the first things users see in search results. They're the only chance to earn a click before someone visits. Where: Add `<title>` and `<meta name="description">` to each page's `<head>`. (https://developers.google.com/search/docs/appearance/title-link)
- [MEDIUM] Add Twitter card meta tags. No Twitter card tags were detected on your page. Why: Without them, links shared on X render as bare text instead of a rich preview card with image, title, and description. Rich cards have meaningfully higher CTR. Where: Add `<meta name="twitter:card" content="summary_large_image">`, plus `twitter:title`, `twitter:description`, and `twitter:image` to your `<head>`. (https://developer.mozilla.org/en-US/docs/Web/HTML/Element/meta/name)

Optional best-practice improvements (no score impact):
- [MEDIUM] Move DMARC from p=none to quarantine or reject. DMARC policy is `p=none` (monitoring only). Why: p=none lets receivers log failures but still deliver spoofed mail. Real protection only kicks in at quarantine or reject. Where: After reviewing a few weeks of `rua=` reports and confirming your real senders pass, change to `p=quarantine` (sends spoofs to spam) and then `p=reject` (blocks them outright). (https://dmarc.org/overview/)
- [MEDIUM] Configure DKIM with your email provider. No DKIM record found at the common selectors we check. Why: DKIM signs your outbound mail with a cryptographic key receivers can verify. Without it, receivers can't tell your real mail from a spoof. Where: Ask your email provider for their DKIM setup. It's usually one TXT record at `{selector}._domainkey.{your-domain}`. (https://www.cloudflare.com/learning/dns/dns-records/dns-dkim-record/)
- [LOW] Add /.well-known/security.txt. Why: Lets security researchers report vulnerabilities responsibly through a published contact channel. Where: Create `/.well-known/security.txt` with a `Contact:` email and `Expires:` date. (https://securitytxt.org/)
- [LOW] Add an llms.txt file. Why: Helps AI models understand your site's content and how to use it. Not yet a standard but gaining adoption. Where: Create `/llms.txt` at the site root with a brief overview and key URLs. (https://llmstxt.org/)
- [LOW] Declare a Content-Signal in robots.txt. Why: States how you'd like AI systems to use your content (training, search, agent input). Without it, AI crawlers fall back to whatever default policy each vendor applies. Where: Add a `Content-Signal:` line to your `robots.txt`. (https://contentsignals.org/)
- [LOW] Add Link response headers. Why: Lets agents discover your sitemap, privacy policy, and docs without parsing HTML, which most lightweight agents skip. Where: Set `Link:` response headers in your server config or framework middleware. (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Link)
- [LOW] Add MTA-STS. No MTA-STS DNS record published. Why: Prevents mail to your domain being downgraded to plaintext mid-flight by a network attacker. Most launches don't have this, so deploying it puts you a tier above generic email-security checks. Where: Publish a TXT record at `_mta-sts.{your-domain}` plus a policy file at `https://mta-sts.{your-domain}/.well-known/mta-sts.txt`. (https://datatracker.ietf.org/doc/html/rfc8461)
- [LOW] Add a TLS-RPT record. No TLS-RPT record at `_smtp._tls.{domain}`. Why: Receivers can tell you when STARTTLS handshakes to your mail server fail. Without it, silent TLS failures are invisible. Where: Publish one TXT record at `_smtp._tls.{your-domain}` like `v=TLSRPTv1; rua=mailto:tls-reports@yourdomain.com`. (https://datatracker.ietf.org/doc/html/rfc8460)

For each item, tell me exactly which file to create or which code to change, and where it lives in a project using the stack above. If my framework has a native API for the task (e.g. Next.js metadata exports, `app/sitemap.ts`, Astro layouts, Nuxt `useHead`), prefer that over raw HTML or server config.

Full analysis: https://stackscope.dev/launch/0au61r8y/verpetas

Using an autonomous agent?

Point the agent at this SKILL.md URL and ask it to follow the skill. The framing stops agents defaulting to an open-ended page review.

https://stackscope.dev/launch/0au61r8y/skill.md

Share your score

Your score card renders automatically when you share the link.

Or embed a badge

Two badge options. Pick whichever fits your story.

Current score

Shows the latest score and updates within a few minutes of any recrawl. Best for ongoing display: if you fix something and recrawl, the badge reflects the new score automatically.

<a href="https://stackscope.dev/launch/0au61r8y/verpetas"><img src="https://stackscope.dev/badge/0au61r8y/current.svg" alt="StackScope score for Verpetas" height="24" /></a>

Launch score

Pinned to your launch-day snapshot and never changes. Marked with a small gold corner ribbon. Best for press kits, launch retrospectives, or anywhere you want a permanent record of how you shipped.

<a href="https://stackscope.dev/launch/0au61r8y/verpetas"><img src="https://stackscope.dev/badge/0au61r8y.svg" alt="StackScope launch score for Verpetas" height="24" /></a>

Using a Content-Security-Policy? Both badges are <img> tags from our domain, so your CSP needs to allow them. Add stackscope.dev to your img-src directive (example: img-src 'self' stackscope.dev;). Without it, browsers silently block the badge and visitors see a broken image.