CMS
Contentful: we saw the CDN. The origin is still your framework.
· Configuration notes, not a newsroom.
ctfassets.net is a fingerprint, not a CMS you configure in our UI. SiteRune still scores the Next/Nuxt/Astro (or unknown) origin that embeds Contentful.
Headless is not a get-out-of-headers card
If images come from Contentful and HTML from Next.js, the Next.js playbook applies. We may list Contentful in the ecosystem. Missing HSTS is still an origin/CDN problem.
What Contentful will not do for you
It will not publish llms.txt, robots.txt, or security.txt. Those are origin files. JSON-LD is your template. SiteRune will not tell you to 'optimize the Contentful space' as a security finding.
Run it on a live URL
The brief will name your CMS and attach the files. Three guest scans, no card.