How the website scan works
When someone starts an X-ray for a business, we read a few of its public pages, once, the way an AI agent or AI search engine would.
What it does
- Reads the home page and up to five more public pages, such as About, Services and Contact.
- Reads robots.txt, sitemap.xml and llms.txt if they exist.
- Follows robots.txt. If a page is disallowed, we do not fetch it.
- Makes fewer than ten requests in total and does not come back unless a new X-ray is started.
What it never does
- Log in, submit forms or try anything behind a login.
- Test security. It is a readiness review, not a security test.
- Run for a site unless the person starting it confirms they represent the business.
What it checks
- Whether AI crawlers such as GPTBot, ClaudeBot, PerplexityBot and Google-Extended are allowed or blocked.
- Whether there is an llms.txt summary for AI tools.
- Structured data: schema.org markup for the organisation, services and contact details.
- Discoverability: sitemap, titles, descriptions and canonical URLs.
- Whether key content is in the page itself, not only there after scripts run.
- Whether contact, booking and enquiry routes are machine-readable.
- Basic speed and accessibility.
If you run the site
The scan identifies itself as XynAGI-XrayExpress. To stop it reading your site, disallow that user agent in robots.txt. If you think a scan was started for your site by someone who does not represent you, write to privacy@xynagi.ai.