CMS

Laravel Website Audit

Laravel audit: cookies, Livewire, and nginx in front of PHP

2026-08-19 · Configuration notes, not a newsroom.

SiteRune fingerprints laravel_session, XSRF-TOKEN, and Livewire. Marketing pages should not inherit the app's no-store session layout.

What SiteRune checks on this stack

CMS / framework fingerprint from HTML, headers, cookies, and generator tags — fingerprint-based, not a plugin inventory
Titles, meta descriptions, canonicals, H1, and robots on the homepage and walked interiors
Security headers a crawler can see: HTTPS, HSTS, CSP, framing, nosniff, Referrer-Policy, Permissions-Policy
HTML TTFB, compression, and Cache-Control on the document — not a Lighthouse filmstrip
AI-bot robots policy, llms.txt, and Organization / FAQ / Article JSON-LD

Common problems

Marketing homepage looks finished; interior templates ship empty titles or leftover noindex
Hosted CMS cannot set HSTS/CSP, so the brief tells you to put a proxy in front instead of inventing an admin UI
A security plugin's 'block AI' preset Disallows GPTBot on a site that wanted citations
Session cookies or no-store on every anonymous GET, so the CDN never caches HTML

If every public URL sets laravel_session and Cache-Control: no-store, perf-cache and TTFB follow. Split the marketing site or stop starting a session on anonymous GET. Livewire on the homepage is a SPA with extra steps.

Headers at the vhost

nginx add_header, or middleware that only runs on public routes. Ship files include nginx when headers are missing. llms.txt in public/. Blade can emit Organization JSON-LD. We are not going to generate a WordPress mu-plugin for Laravel.

FAQ

How do you know this is my stack?

Fingerprints in HTML, headers, cookies, and generator tags. Confidence is a score, not a certificate. Unknown stacks stay generic — we will not invent a CMS.

Do I need an account?

Three guest scans, no card. Create a free account when you want history and more interiors.

Run it on a live URL

Same scan engine. Guest scans stay free.