llms.txt
+20 −14
https://webupcheck.com/llms.txt
− > API security for AI-agent traffic, plus free incident diagnostics. WebUpCheck Protect is a behavioral gateway for your HTTPS API: verified agent identity (Web Bot Auth), per-caller limits, route-wide caps, timed lockdown and OAuth-secured MCP controls (see "Authenticated API protection" below). The free, keyless tools check websites, DNS and official AI/cloud provider status for people and agents; a result reflects the checked endpoint at the stated time and does not verify every application f− ## Documentation− ## Agent interfaces− ## Usage limits− ## Evidence and protection− ## Authenticated API protection− - [WebUpCheck Protect](https://webupcheck.com/protect): behavioral API abuse protection for human and AI-agent traffic on verified HTTPS API subdomains. Per-caller limits; failed-login, 404-probing and path-enumeration rules; 60-second automatic restrictions, manual blocks up to 1 hour and 5–240 minute emergency lockdown. Not a full WAF; no uptime guarantee.− - Plans: Free US$0 (1 hostname), Protect US$39/month (1 hostname), Scale US$199/month (5 hostnames), Enterprise by contract (up to 25). Fixed prices, no automatic overage charges.− - Caller identity: Web Bot Auth signatures are verified only for signer origins the customer trusts; a User-Agent name is unverified and shares the anonymous budget.− - [Security overview](https://webupcheck.com/security): controls in place and known gaps (no SOC 2, no completed third-party penetration test, no SLA, no SSO).− - [Protect agent guide](https://app.webupcheck.com/agents.html): private account-scoped API/MCP; distinct from the public keyless diagnostic tools. Never send control keys as URL parameters.− - [Protect MCP endpoint](https://app.webupcheck.com/mcp): Streamable HTTP with OAuth 2.1 sign-in (or a private key). Tools to read evidence, block or release callers, tune route limits and start an emergency lockdown.− - [Protect llms.txt](https://app.webupcheck.com/llms.txt) and [Protect OpenAPI](https://app.webupcheck.com/openapi.json). Listed in the official MCP Registry as com.webupcheck/protect.− - Emergency setup and response guide: https://webupcheck.com/under-attack+ > Website and API security for AI-agent traffic, plus free incident diagnostics. WebUpCheck Protect is a behavioral gateway for your website and API subdomains: verified agent identity (Web Bot Auth), per-caller limits, route-wide caps, timed lockdown and OAuth-secured MCP controls (see "Authenticated website and API protection" below). The free, keyless tools check websites, DNS and official AI/cloud provider status for people and agents; a result reflects the checked endpoint at the stated tim+ ## Authenticated website and API protection+ - [WebUpCheck Protect](https://webupcheck.com/protect): behavioral website and API abuse protection for human and AI-agent traffic on verified HTTPS hostnames, including roots with compatible DNS and www. Per-caller limits; failed-login, 404-probing and path-enumeration rules; 60-second automatic restrictions, manual blocks up to 1 hour and 5–240 minute emergency lockdown. Not a full WAF; no uptime guarantee.+ - Plans: Free US$0 (1 hostname), Protect US$49/month (1 hostname), Scale US$199/month (5 hostnames), Enterprise by contract (up to 25). Fixed prices, no automatic overage charges.+ - Caller identity: Web Bot Auth signatures are verified only for signer origins the customer trusts; a User-Agent name is unverified and shares the anonymous budget.+ - [Security overview](https://webupcheck.com/security): controls in place and known gaps (no SOC 2, no completed third-party penetration test, no SLA, no SSO).+ - [Protect agent guide](https://app.webupcheck.com/agents.html): private account-scoped API/MCP; distinct from the public keyless diagnostic tools. Never send control keys as URL parameters.+ - [Protect MCP endpoint](https://app.webupcheck.com/mcp): Streamable HTTP with OAuth 2.1 sign-in (or a private key). Tools to read evidence, block or release callers, tune route limits and start an emergency lockdown.+ - [Protect llms.txt](https://app.webupcheck.com/llms.txt) and [Protect OpenAPI](https://app.webupcheck.com/openapi.json). Listed in the official MCP Registry as com.webupcheck/protect.+ - Emergency setup and response guide: https://webupcheck.com/under-attack+ ### Website compatibility+ - Website route profiles support browser page loads, standard URL-encoded forms, multipart uploads, cookies and asset delivery. Choose Website explicitly; existing API route policies remain unchanged.+ - Website profile transport: GET, HEAD, POST, OPTIONS, PUT, PATCH and DELETE. Request limit 10 MiB with Content-Length; 1 MiB for unknown-length/chunked uploads. Streamed response25 MiB and 30-second deadline. API profile and paths outside Website prefixes retain GET/HEAD/POST/OPTIONS, JSON-only POST64 KiB, response1 MiB and10-second deadline. An API needing larger/binary payloads or PUT/PATCH/DELETE can explicitly choose Website profile.+ - Free Website profile: 120 requests per 10 seconds and 600 per minute per caller/route; enumeration threshold 200 distinct non-asset paths per minute. Free API profile retains 30/10 seconds, 120/minute and 40 distinct paths/minute. Shared public networks can share budgets.+ - Connect your verified domain or subdomain to a separate locked HTTPS origin. Root domains require DNS with CNAME flattening or ALIAS support. WebSockets, SSE and long-running streams are unsupported. Upload malware scanning and full OWASP exploit filtering are not included.+ - Emergency lockdown also refuses ordinary anonymous website visitors on configured routes. Application authentication and CSRF/upload validation remain the customer's responsibility.+ ## Free diagnostics documentation+ ## Free diagnostic agent interfaces+ ## Free diagnostic usage limits+ ## Diagnostic evidence and checking limits