The Plain Fetch viewer

In short

The viewer requests a URL the way a plain-fetch agent does: no JavaScript, one request for HTML, one for markdown, one for llms.txt and one for a path that should not exist. It shows the initial HTML on the left, the readable text on the right, and seven flags underneath.

Pre-loaded with www.wikipedia.org, read 4 November 2026. Type any public URL to run your own.

GET https://duosecurity.com/ answered 200 with text/html, 133 KB, 1 redirect, read 8 November 2026, 13:40 UTC. Final URL: https://duo.com/.

Permalink: /viewer/?url=https://duosecurity.com/

The page answers a plain fetch: 4 of 6 checks found.

Initial HTML what a plain fetch receives

<!doctype html>
<html lang="en" dir="ltr">
    <head>
<meta charset="utf-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">
<meta http-equiv="origin-trial" content="AnYZ51inVqSnlX5MQR3lAJyqQZCwud6PdGFXVAfmF5krWAbEFiXlV6cEhi1Lp/71qSgpvTugEN2yhtzni3JSBAIAAABHeyJvcmlnaW4iOiJodHRwczovL2R1by5jb206NDQzIiwiZmVhdHVyZSI6IldlYk1DUCIsImV4cGlyeSI6MTc5NDg3MzYwMH0=">
<meta name="robots" content="index, follow, archive">
<title>IAM & MFA Identity Security for Business, Humans, AI | Cisco Duo</title>
[... 4 more head elements folded ...]
<meta name="description" content="Cisco Duo secures workforce access and defends against advanced identity threats with IAM, phishing-resistant MFA, SSO, passwordless, and device trust.">
[... 7 more head elements folded ...]
<link rel="canonical" href="https://duo.com">
[... 49 more head elements folded ...]
</head>
    
    <body id="top" class="production no-js">
        <a class="skpnav" href="#main-content">Skip navigation</a>
        <div id="site-container">
            <div class="top-navigation-container">
                
                <div id="utility-bar" class="utility-bar background-navy-50" aria-label="Utility navigation">
    <div class="section-wrap">
        <div class="content-wrap">
            <ul class="unstyled">
                
                
                <li>
    <a class="" href="/search" >
        
            <i class="icon-magnifier"></i>
        
        <span>Search</span>
    </a>

</li>
                
                <li>
    <a class="" href="/support" >
        
        <span>Support</span>
    </a>

</li>
                
                <li>
    <a class="" href="https://admin.duosecurity.com/" target="_blank" >
        
            <i class="icon-user"></i>
        
        <span>Admin Login</span>
    </a>

</li>
                
                
            </ul>
        </div>
    </div>
</div>

                
                
<header id="site-header" class="site-header">
    <div class="section-wrap">
        <div class="content-wrap nav-bar">
            <div class="logo-container">
                <a href="/" class="logo">
                    <img src="/images/duo-logo.svg" alt="Cisco Duo logo">
                </a>
                
                <div class="mobile-menu-toggle-container">
                    <button id="nav-icon" class="nav-icon background-color-white" aria-expanded="false" aria-label="Toggle navigation menu">
                        <i class="icon-hamburger"></i>
                        <i class="icon-close" hidden></i>
                    </button>
                </div>
                
            </div>
            
            <nav class="nav-menu" role="navigation">
                <div class="main-menu-container">
                    <div class="scrollable-menu-container">
    <ul class="top-level-items unstyled">
        
        <li class="top-level-item">
            <a href="/product" class="top-level-link" aria-expanded="false" aria-haspopup="true">Products
                <i class="icon-chevron-down"></i>
            </a>
            
            <div class="nav-dropdown layout-one">
                <div class="box-shadow-container section-wrap">
                    <div class="grid-container content-wrap">
                        <div class="submenu-section">
                            <div class="submenu-summary">
                                
                                <img src="/img/asset/aW1nL21lbnUtaW1hZ2VzL3Byb2R1Y3QtbWVudS1pbWFnZS5wbmc/product-menu-image.png?s=873c087b590762e6fc813f04e78cf486" width="294" height="196" alt="Woman using smartphone with floating icons for biometrics, facial recognition, and global connectivity.">
                                
                                <p>A comprehensive overview of Duo's product capabilities.</p>
                            </div>
                            <ul class="unstyled">
                                
                                <li>
                                    
    <a class="secondary-link button button-link no-underline" href="/product" >
        
        <span>Capabilities Overview</span><i class="icon-chevron-right"></i><i class="icon-arrow-right"></i>
    </a>


                                </li>
                                
                            </ul>
                            <hr>
                        </div>
                        <div class="submenu-section">
                            <ul class="column-menu unstyled">
                                
                                <li>
    
    <span>IDENTITY AND ACCESS MANAGEMENT</span>


    
</li>
                                
                                <li>
    
    <a class="" href="/product/duo-directory" >
        
        <span>Duo Directory</span>
    </a>


    
</li>
                                
                                <li>
    
    <a class="" href="/product/multi-factor-authentication-mfa" >

Shown with 20 long blocks (scripts, styles, long tags) folded into a marker that says how many characters they hide; the pane stops after the first 200 words; the page is 133 KB.

Reading view the text a plain-fetch client can extract

title: IAM & MFA Identity Security for Business, Humans, AI | Cisco Duo

You know our MFA. Meet our IAM.

Skip navigation Search Support Admin Login Products A comprehensive overview of Duo's product capabilities. Capabilities Overview IDENTITY AND ACCESS MANAGEMENT Duo Directory Multi-Factor Authentication (MFA) Single Sign-On (SSO) Duo IAM PHISHING-RESISTANT MFA Passwordless Duo Passport Device Trust IDENTITY INTELLIGENCE Cisco Identity Intelligence Identity Threat Detection and Response (ITDR) Identity Security Posture Management (ISPM) Solutions Comprehensive, customizable identity solutions tailored for all. Solutions Overview FOR WHOM Small and Medium Business Enterprise Federal, State, and Local Government Managed Service Providers (MSP) USE CASES Security-First IAM End-to-End Phishing Resistance Compliance Solutions Access Management Zero Trust Security Active Directory Defense NEW Agentic IAM NEW INDUSTRIES Higher Education K-12 Education Finance Legal Retail Technology Healthcare Docs and Resources Browse hundreds of Duo assets. Top Resources RESOURCES OVERVIEW Docs Events and Webinars Ebooks Demos Blogs NEW CISO Perspectives NEW OUR COMPANY About Duo Why Choose Duo? Customer Success Duo ROI Calculator NEW SUPPORT Duo Support For Admins For Users Pricing CompareDuo Editions Affordable editions for teams of all sizes Compare Editions Buy Now Duo ROI Calculator DuoEssentials Essential authentication for broader organizational security. $3/user/month View Essentials DuoAdvantage Most Popular Comprehensive control over user and device security. $6/user/month View Advantage DuoPremier The most security coverage for any

1354 more words follow in the initial HTML.

4 found, 1 missing, 2 notes, from 7 checks run

H1Found
200 wordsFound
llms.txtNote
MarkdownMissing
Missing pathFound
JSON-LDFound
OpenAPINote

What a plain fetch found on duosecurity.com
Check	Result	Detail
H1 in the initial HTML	Found one H1	First H1: You know our MFA. Meet our IAM.
First 200 words in the initial HTML	Found 200 of 200 words	The initial HTML carries 1554 words of visible text; the first 200 are marked in the left pane.
llms.txt present and linked	Note present, not linked	256000 bytes, 1083 links. Structure grade C (4 of 6). Nothing on the home page points to it. Ora's lab found 86 percent of llms.txt fetches arrived through a link.
Markdown on request	Missing 200 text/html	Accept: text/markdown returned 200 with text/html; charset=utf-8. The server ignores the header.
Status of a made-up path	Found 404	/agent-ready-html-missing-path-check returned 404: a real status code for a missing page.
JSON-LD types	Found Brand, ContactPoint, ImageObject, Offer and 8 more	12 schema.org types in JSON-LD blocks on the home page: Brand, ContactPoint, ImageObject, Offer, Organization, Person, Product, Review, SoftwareApplication, Thing, WebPage, WebSite.
OpenAPI link	Note none on the home page	No OpenAPI link on the home page. It matters only for a site that ships an API.

Run the full check

The viewer read one page with four requests. The full check we recommend next is Ora's scan. Its Access layer runs 42 checks worth 30 of its 100 points, among them content without JavaScript, bot detection, llms.txt, markdown on request, JSON-LD and the sitemap (Ora's check catalogue, contract 1.38.0, read 5 November 2026). Open Ora's report for duosecurity.com.

Limits: Ora reads public URLs only, says two runs of one scan land within a couple of points without publishing repeat-scan data, and keeps the product that fixes what it finds behind a waitlist. Cloudflare's scanner at isitagentready.com is a quick free alternative, and Mintlify's score covers documentation.

What the viewer does

It sends four plain GET requests with the user agent Mozilla/5.0 (compatible; agent-readiness-crawl/1.0): the URL itself, the same URL with Accept: text/markdown, /llms.txt on the same host, and a made-up path at the root. It runs no JavaScript. The left pane is the first bytes of the HTML as text, with long scripts and styles folded into a marker that says how many characters they hide. The H1 and the first 200 words of visible text are marked in both panes. The flags under the panes say what the four responses added up to.

Limits

Ten seconds for all four requests together, 1.5 MB read from the home page, at most five redirects, each one checked again.
http and https only, default ports only. Private, local and internal addresses and names are refused.
Ten runs per address per minute. The counter lives in memory on the edge function, so it is per instance rather than global. Past ten you get a 429 with a Retry-After header.
Results are cached for 24 hours by the response headers. Nothing is written to a database: the viewer keeps the first 200 words and the extracted fields for the length of the request and keeps no page body beyond that.

What it does not tell you

A plain fetch from this server is not a real agent. Bot protection weighs the source address more than the user agent, so a page that answers 200 here can still refuse an agent, and the reverse. Ora's lab found (2026-10-19) that returning 403 to agent user agents and hiding the answer in JavaScript were the only two of 19 configurations that stopped retrieval; the viewer can see the second, and can only hint at the first. The initial HTML reference covers both. The server logs and the published crawler address ranges settle the first.

The seven flags

H1 in the initial HTML: Whether the HTML the server sends already contains an H1. It is the cheapest sign that the page does not depend on scripts to say what it is.
First 200 words in the initial HTML: Whether at least 200 words of visible text arrive in the initial HTML. Under 40 words with an app root element is flagged as a JavaScript shell.
llms.txt present and linked: Whether /llms.txt answers with a plain-text file, whether the home page links it (an anchor, a link element or a Link header), and the structure grade the index uses.
Markdown on request: Whether a request with Accept: text/markdown comes back as text/markdown. Cloudflare Radar found 3.9 percent of scanned top sites passing this at its April 2026 launch.
Status of a made-up path: Whether a path that should not exist returns 404 or 410. A 200 is a soft 404 and reads as a live page.
JSON-LD types: The schema.org types found in JSON-LD blocks on the page. Ora's lab found JSON-LD made no difference when the answer was already in the HTML.
OpenAPI link: Whether the page links an OpenAPI file, by an anchor or a service-desc link relation. It matters only for a site that ships an API.

Sources

Ora: AgentReady launch post (Ora's lab findings) https://ora.ai/blog/agentready-launch, read 4 November 2026
Ora check catalogue, contract 1.38.0 (132 checks, 42 in the Access layer) https://ora.ai/api/checks, read 5 November 2026
Ora home page (the fixing product is behind a waitlist) https://ora.ai/, read 5 November 2026
Ora: Introducing Deep Scan (repeat scans) https://ora.ai/blog/introducing-deep-scan, read 5 November 2026
Ora llms.txt (public URLs only) https://ora.ai/llms.txt, read 5 November 2026
Vercel: Make your site readable by AI agents https://vercel.com/kb/guide/make-your-site-readable-by-ai-agents, read 4 November 2026
llms.txt proposal (llmstxt.org) https://llmstxt.org/, read 4 November 2026

Last reviewed 5 November 2026