Agent view · Findings · 2026-09-23

Correction: the owner's own scans came back locked

This is the response this server returns to a client that asks for Accept: text/markdown at https://crawlcheck.io/blog/the-owner-could-not-read-his-own-scans: fetched when you opened this page, shown byte for byte. An assistant, a crawler that negotiates markdown, or anything reading our feed gets exactly this. The markdown leaves signed (RFC 9421, key in our key directory), so a crawler can prove the page it read is the page this server sent; the check is shown below.

Findings · 2026-09-23 · By [VSNARY | Emmanuel Orta](/author)

# Correction: the owner's own scans came back locked

For a time the site owner's scans came back gated like a stranger's while the report page showed everything. No score or customer was affected. The lesson is about testing gated content.

On 23 September 2026 the owner of crawlcheck.io found that a scan run from the homepage came back the way a stranger's does, with the top finding in full and the rest locked, while the report page for the same scan opened in full. Two parts of the site decided separately who may see a full result, and one of them did not recognise the owner. Both now use one decision. No score, stored record or customer was affected.

On this page

- What was seen
- What was wrong
- What changed
- The lesson for anyone running gated content

## What was seen #

On the evening of 23 September the owner reported that his access did not work on scans. The site recognised him everywhere else. A scan he ran from the homepage still returned the most severe finding in full and every other finding as a locked title. A second later, the report page for the same scan showed everything.

| Where | Owner's view before | After |
| --- | --- | --- |
| Report page | full | unchanged |
| Scan result on the homepage | top finding in full, the rest locked | full |
| Anonymous visitor, either place | gated | gated, unchanged |

## What was wrong #

The scan result and the report page each decided, in their own way, who may see a full result. The report page counted owner access; the scan result did not. Each was consistent with itself, and they disagreed with each other. The stored record was always complete, so nothing measured or saved was wrong, only what one screen showed.

## What changed #

There is now one access decision, and every place that shows a result reads it. The fix was tested both ways before it shipped: the owner's scan had to come back in full, and an anonymous scan had to stay gated exactly as before. Both held, and the same two readings were repeated on the live site after release. What a licence opens is on [the pricing page](/pricing).

## The lesson for anyone running gated content #

Request the same record, as the same person, through every route that returns it, and compare the results. Then add one request that should be refused. An unlock that passes only an allowed-reader test has not shown it is an unlock; it may be a gate that stopped working. Testing each surface on its own is how this hid: every existing test passed. It is the same rule as [measuring the thing the label claims, not the label](/blog/our-audit-labelled-one-page-and-measured-another), and the same family as [the paywall that said a site was clean](/blog/the-paywall-that-said-your-site-was-clean).

Written by

[Emmanuel Orta](/author) · VSNARY

I build CrawlCheck and write everything published here, from measurements the verification layer took. Where a post got something wrong, the correction stays in the post.

[Every post, and where I got it wrong →](/author) · [Follow on LinkedIn →](https://www.linkedin.com/in/emmanuelorta)

Share this finding: [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fcrawlcheck.io%2Fblog%2Fthe-owner-could-not-read-his-own-scans%3Futm_source%3Dlinkedin%26utm_medium%3Dsocial%26utm_campaign%3Dshare)[X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fcrawlcheck.io%2Fblog%2Fthe-owner-could-not-read-his-own-scans%3Futm_source%3Dx%26utm_medium%3Dsocial%26utm_campaign%3Dshare&text=Correction%3A%20the%20owner)[Email](mailto:?subject=Correction%3A%20the%20owner)[Follow Emmanuel on LinkedIn](https://www.linkedin.com/in/emmanuelorta)

## Questions this post answers

### Why did the owner's scans come back locked?

The scan result and the report page decided separately who may see a full result. The report page recognised owner access and the scan result did not, so the owner's scan was gated like a stranger's.

### Did this change any score or stored record?

No. The stored record was always complete. Only what one screen showed the owner was affected.

### Were paying customers affected?

No. Licence holders and signed-in customers were always recognised. The only reader wrongly refused was the site owner.

### How should gated content be tested?

Request the same record as the same person through every route that returns it, and include one request that should be refused, so the test proves both that the gate opens for the right reader and stays shut for everyone else.

## Related findings

[2026-08-26 Lighthouse scores vary between runs: two runs, 225% apart Two Lighthouse runs of an unchanged page, minutes apart: blocking time 2,643 ms then 812 ms. How to find your noise floor before a](/blog/one-lighthouse-run-cannot-support-a-finding-225-percent-variance)[2026-09-17 Correction: our paywall said sites with findings were clean For about forty minutes our locked reports said “Nothing to fix” for sites that had findings. What went wrong, what changed, and h](/blog/the-paywall-that-said-your-site-was-clean)[2026-09-08 Unquoted HTML attributes: why we said a viewport was missing Minified HTML with unquoted attributes read as having no viewport, canonical or description. All three were there. What was wrong](/blog/the-viewport-was-there-all-along)

The main product

Found this on your own site? **We fix it for $100.**

Scan free to see where you stand. The fix is one site, every finding implemented and re-measured, with a sealed before and after.

[Fix it all — $100](https://buy.stripe.com/4gM00j7OjawhdLEdyR2VG0v)
[What it covers](/pricing#fix) · [scan first, it is free](/)

Free browser extension

Check this on any site you open, **without leaving the page.**

CrawlCheck for Chrome grades every site you visit A–F and shows, from your own browser, what search engines and AI assistants are actually served. Free, no account.

[Add to Chrome — free](https://chromewebstore.google.com/detail/plgjengobhbdmbgckiiaaflgiepdbcpi?utm_source=crawlcheck.io&utm_medium=post)
[What it does](/extension)

Write for the library

Measured something yourself? **Submit an article.**

Send your finding, the data and the method. A person reads every submission and replies by email; accepted articles are published under your name with a link to your study. Free to submit, and placement is never for sale.

[Submit an article](/submit-finding#send)
[How it works](/submit-finding) · a reply within about a week

Spotted a mistake or a bug on this page? [Report an error](/report-error?k=article). Confirmed errors are fixed and logged on the [corrections page](/corrections).

## Comments

Comments are read before they appear. Nothing is published automatically, and no account is needed. An AI agent with a published signing key can post without the queue: it signs the request and the signature is checked against its own domain ([how](/api/comment/signed)). Those appear at once, marked *verified*.

Send for review

Writing about this? [Facts, live figures and marks](/press) — every number on that page is dated and traceable to a scan.

[All findings](/blog) · [The dataset](/data) · [How the dataset works](/policy)

We read your site the way crawlers do, from our own network, and every report says exactly what was asked for and what came back. [Who runs this](/author) · [Press kit](/press) · [Videos](/videos) · [Evidence for disputes](/evidence) · [YouTube](https://www.youtube.com/@crawlcheck) · [hello@crawlcheck.io](mailto:hello@crawlcheck.io)

#### How we measure, and our own machine files

CrawlCheck reads every site as itself. Its crawler-identity tests send named user-agent strings from its own network, never from an operator’s published range, so a site that verifies crawlers can tell them apart; every report says so. Results reflect what an anonymous non-browser client receives. [What we collect and how to opt out](/policy) · [how every report is timestamped](/proof) · [who runs this](/author) · [press kit](/press) · [hello@crawlcheck.io](mailto:hello@crawlcheck.io).

**Second vantage:** the [browser extension](/extension) measures what crawlers are served from your own address and after your JavaScript runs — the half this server cannot see. From 1.0.0 it sends the domain you ask about, on one button, and anonymous usage counts you can switch off; from 1.0.3 a footer switch turns off the hostname lookup for the grade on the icon; from 1.0.4 a share switch, on by default, sends a signed Two-vantages reading (status, size, words and a hash per identity; never page text); from 1.0.16 chips send the hostnames of search results and AI citations while the chips and grade switches are on; from 1.0.17 a readings switch, on by default, sends one signed page reading a day (numbers, the hostname and the page address with the query removed; never in incognito; at most 40 a day) and only while the share and grade switches are also on. Earlier versions send nothing.

**Our own machine layer for the agentic web:** [llms.txt](/llms.txt) · [llms-full.txt](/llms-full.txt) · [agents.md](/agents.md) · [SKILL.md](/SKILL.md) · [entitymap.json](/entitymap.json) · [media kit](/.well-known/media-kit.json) · [MCP server card](/.well-known/mcp/server-card.json) · [API catalog](/.well-known/api-catalog) · [OpenAPI](/openapi.json) · [robots.txt](/robots.txt) · [sitemap.xml](/sitemap.xml) · [security.txt](/.well-known/security.txt) — every one named in robots.txt, which is exactly what we check for on yours.

**Pages:** [Certificates](/certificates) | **Registry:** [MCP: Operator](/registry/mcp/operator) · [LLMs](/registry/llms) · [Agents](/registry/agents) · [mostly.ai](/registry/mostly.ai) · [pictory.ai](/registry/pictory.ai) · [seovendor.co](/registry/seovendor.co) · [unstructured.io](/registry/unstructured.io) · [objekts.ai](/registry/capabilities/objekts.ai) | **Certificates:** [deepl.com](/certificate/deepl.com) · [osteriafrancescana.it](/certificate/osteriafrancescana.it) · [who.int](/certificate/who.int)

[Contact](/contact) · [Partnerships](/partnerships) · [Terms of service](/terms) · [Refund policy](/refunds) · [Trust center](/trust) · [Report an error](/report-error)

Same body as a file: /blog/the-owner-could-not-read-his-own-scans.md · as data: /feed.json · what we tell agents site-wide: /llms.txt, /agents.md. To see any other site this way, from your own browser, after its JavaScript runs: the browser extension.