Agentic SEO Improvements & Security Enhancements — August 24, 2026

Today, I set out to improve the agentic SEO capabilities and security measures of my platform, focusing on enhancing user experience while addressing a few lingering bugs. In a solid five-hour session, I shipped 11 commits, including 10 feature improvements and one critical fix. The work was driven by a blend of necessity and ambition—my goal is to ensure that the platform not only meets current standards but also anticipates future needs as I build toward a billion-dollar valuation with this one-man show.

One of the standout features I implemented was the addition of a comprehensive LLMS directory with the new `/llms-full.txt` endpoint. This was vital as agents have been increasingly probing this endpoint first. The new directory provides a complete public portal directory with links to per-portal LLMs, along with a full cost/metro/industry URL matrix, all fetched in one go. I believe this enhancement will significantly improve the efficiency of user queries and bolster the overall agentic web experience.

While I was pleased with this addition, I ran into a significant issue with the Content Security Policy (CSP). I had to allowlist certain scripts from `static.cloudflareinsights.com` and Jitsi for video functionalities. This was necessary because my previous policy was blocking essential scripts, which was evident in the console logs. I spent a fair amount of time debugging these CSP issues, which highlighted the importance of a robust security framework while still ensuring that user experience remains seamless. It’s a constant balancing act.

Another task I tackled was improving the sitemap functionality. I noticed that the last modified timestamps were being incorrectly stamped on static routes, causing Google to distrust the `lastModified` field where it was genuinely applicable. I decided to stop stamping `lastmod=now` on these static routes. This change will help maintain trust with search engines and improve the crawling process, ultimately benefiting the platform's discoverability.

Security also took center stage today, as I added a proper 404 error page with an accurate 404 status. Previously, my site redirected all dead or mistyped URLs to a soft-404 page that was robots-disallowed, which was detrimental for both users and search engines. Now, users will see a map and a home link instead of a dead end, while crawlers will receive an honest status code, improving the overall SEO health of the site.

In addition to these improvements, I made some necessary adjustments to the authentication system. I addressed a major oversight where the `/api/auth/me` endpoint was responding with a 200 status and a `{user:null}` object for anonymous users instead of a proper 401. This was causing unnecessary console errors on every page for signed-out visitors, which I’ve now resolved. This fix not only cleans up the console logs but also ensures that my application behaves as expected, providing a more polished user experience.

Lastly, I spent time optimizing performance by stopping the minting of `geo_portal_session` in middleware. This was causing every HTML response to be marked as uncacheable, which is not ideal for performance. By offloading this to a beacon that already exists, I streamlined the process and made my application more efficient.

Reflecting on today’s work, it’s a reminder of how crucial it is to stay vigilant about both SEO and security. Each step I take to refine these elements is a step toward building a platform that not only serves users effectively but also positions itself as a leader in the agentic web space. My solo journey, with AI like Claude Code assisting me in VS Code, makes it possible to tackle these challenges without the overhead of a large team. Each commit is a building block toward my ambitious vision, and while the bugs can be relentless, the progress feels rewarding. I’m excited about the future and the potential of what I’m creating here.