Agentic Web AEO Enhancements & Security Fixes — August 24, 2026

Today, I focused on enhancing the agentic web experience through a series of AEO improvements and crucial security fixes. The primary features I shipped included an expanded LLMs directory and significant updates to our Content Security Policy (CSP). These changes were vital to streamline user interactions and bolster security across the platform, and the work took a solid five hours to complete.

The most exciting addition was the new '/llms-full.txt' endpoint that provides a comprehensive public portal directory. This feature enables agents to probe for a complete list of LLMs, along with a cost/metro/industry URL matrix. This is a big step forward as agents increasingly prioritize this endpoint over the previous '/llms.txt'. I co-authored this with Claude, and it’s already looking like a game-changer for our agentic SEO strategy, allowing for better indexing and retrieval of information.

On the security front, I made significant strides in refining our CSP. I allowed 'static.cloudflareinsights.com' for Real User Monitoring (RUM) scripts and added the Jitsi host to the script-src directive. Both adjustments were crucial after the first-enforce-day console showed multiple blocked scripts, which could disrupt user experience. It’s interesting to note how a simple configuration oversight can lead to user-facing issues, but I learned a lot about the intricacies of CSP management during this process.

Another crucial fix was addressing the soft-404 issue that had been plaguing our site. Previously, a misconfigured redirect turned every dead or mistyped URL into a soft-404, feeding Google Search Console with noise and undermining our SEO efforts. Now, with a real 404 page that returns the correct status, users will encounter a more intuitive experience, while search engines will finally receive honest signals. This change was long overdue and, despite the time it took to implement, it felt rewarding to see it through.

I also tackled the performance implications of our cookie management. I stopped minting 'geo_portal_session' in middleware, which had been marking every HTML response as uncacheable. This was a significant bottleneck, as caching is essential for performance. By ensuring that our responses are cacheable, I can provide a faster experience for users while still maintaining the necessary functionality.

During this session, I also addressed some technical debt related to our authentication process. I fixed an issue where the '/api/auth/me' endpoint responded with a 200 status and a 'user: null' object for anonymous users. This was causing unnecessary console errors and could lead to confusion. Now, the endpoint correctly returns a 401 status for unauthenticated users, streamlining the user experience and reducing noise in the console logs.

The depth of these changes really highlights the importance of rigorous testing and auditing. I ran an npm audit fix that reduced our advisories from 60 to 34. While these remaining advisories are non-critical, they do require some sign-in testing to ensure there are no issues lurking beneath the surface. I’m grateful for the assistance of Claude throughout this process, as having AI support for mundane tasks allowed me to focus on the more complex aspects of development.

Overall, my work today exemplifies the one-man-show mentality I’m striving for with this project. Each feature and fix contributes to the larger vision of building a billion-dollar company on the agentic web. While the road is fraught with challenges, the progress we’re making is tangible, and each commit brings me one step closer to realizing that vision.