Websites evolve. Flowpane keeps them aligned.
Flowpane continuously monitors what the outside world sees, detects drift and inconsistencies, and keeps every site aligned, regardless of CMS.
Free during the beta. Flowpane never signs in to your site.
Northwind Outdoor
Verifiednorthwind.example · Checked 14 min ago · Every 6 hours
security.txt
Read by security researchers · weight 12 of 100
- IssueExpires passed 11 days ago. Under RFC 9116 the file no longer counts.
- AdviceAdd Canonical and Preferred-Languages so researchers can trust the source.
What it reads
Eight small files decide how the web treats your site.
Each one is read by someone who will not tell you when it is wrong. Every file gets its own score, and the site score weights them by what they cost you.
Read by search engines
The list of what you want found. When it names pages that are gone and misses the ones that exist, search engines learn to ignore it.
How it failsRead by search and ai crawlers
One stray Disallow can hide a whole section overnight. It is also where you answer every named AI crawler, whether you meant to or not.
How it failsRead by security researchers
Tells a researcher where to report a vulnerability. The day its Expires date passes, the file stops counting under RFC 9116.
How it failsRead by regulators, browsers, visitors
Trackers that load before consent are visible to anyone who looks. You see the same outside evidence they would.
How it failsRead by ad exchanges and buyers
Declares who may sell your inventory. Seller lines drift as the ad stack changes, and buyers quietly stop bidding.
How it failsRead by ai assistants
A curated map of your site for language models. Without one, assistants guess which of your pages matter.
How it failsRead by ai training and scraping
States whether models may train on, quote, or scrape your content. When it disagrees with robots.txt, you have two policies.
How it failsRead by people
Who builds and maintains the site. Small, and a visible sign that someone owns the origin.
How it failsWhy they rot
An audit is true on the day it runs.
Then a deploy overwrites robots.txt, security.txt passes its expiry date, and a campaign sitemap outlives the campaign. Nothing in your product breaks, so nobody notices.
Ninety days on one site
Day 12 · robots.txt
A release ships the staging robots.txt. Disallow: /
Day 38 · security.txt
Expires passes. The file stops counting.
Day 61 · sitemap.xml
Retired campaign pages are still declared.
Quarterly audit
checks twice
Flowpane
checks daily
159 days
Combined exposure when the next audit is the first to look.
Under a day each
With daily checks, each change surfaces at the next run.
01
Nobody owns them
They sit between SEO, security, legal and engineering. Every team assumes another team checks.
02
They fail silently
No error page, no failed build. The cost arrives weeks later as lost pages, lost bids, or an audit finding.
03
Scale multiplies it
Ten sites times eight files is eighty things drifting on their own schedules. That is where a spreadsheet dies.
Checked against each other
The expensive mistakes live between files.
Each file can be valid on its own and still contradict another. Flowpane runs sixteen cross-file rules, so you find out that your policies disagree before a crawler does.
All sixteen rules, explainedrobots.txt
Disallow: /products/
sitemap.xml
<loc>/products/tents/</loc>
You ask search engines to index pages you forbid them to crawl.
ai.txt
AI-Training: no
robots.txt
User-agent: GPTBot Allow: /
Your two AI policies say opposite things.
llms.txt
- [Guides](/guides/)
robots.txt
Disallow: /guides/
You point AI assistants at pages they are not allowed to read.
How it works
From a URL to a record you can defend.
- File/.well-known/flowpane-verify-…txtDNSTXT _flowpane.northwind.exampleMeta<meta name="flowpane-site-verification" …>
Step 1
Add and verify
Paste one URL, a list, or a CSV. Prove ownership with a file, a DNS record, or a meta tag. The first full check runs straight away.
- GET/robots.txt2003 groupsGET/sitemap_index.xml2006 childrenGET/.well-known/security.txt200expiredGET/llms.txt404missingGET/ads.txtskipn/a
Step 2
Check and score
Every artefact is fetched, parsed, assessed and scored. Each run is immutable, so the history cannot be rewritten after the fact.
- security.txt · current vs proposedvalidated
Contact: mailto:security@…
- Expires: 2026-09-18T00:00:00Z
+ Expires: 2027-03-31T00:00:00Z
+ Canonical: https://northwind…
You publish. The next check scores it.Step 3
Fix and prove
Proposed files start from safe defaults and never invent a contact or a policy. You publish them. The next public check is the only thing that moves the score.
See what your sites are claiming.
Add an origin and get a score, the gaps, and the evidence behind each one. Then Flowpane keeps checking, so the answer stays current.
Free during the beta. Flowpane never signs in to your site.