The Plain Fetch viewer

In short

The viewer requests a URL the way a plain-fetch agent does: no JavaScript, one request for HTML, one for markdown, one for llms.txt and one for a path that should not exist. It shows the initial HTML on the left, the readable text on the right, and seven flags underneath.

Pre-loaded with www.wikipedia.org, read 4 November 2026. Type any public URL to run your own.

GET https://unpkg.com/ answered 200 with text/html, 23 KB, read 8 November 2026, 13:19 UTC.

Permalink: /viewer/?url=https://unpkg.com/

The page answers a plain fetch: 5 of 6 checks found.

Initial HTML what a plain fetch receives

<!DOCTYPE html>
<html lang="en" class="bg-paper dark:bg-dark-page">
<head>
<meta charset="utf-8"/>
<meta name="viewport" content="width=device-width, initial-scale=1"/>
<meta name="description" content="UNPKG is a fast, global content delivery network for everything on npm. Load any file from any package by URL. Files are served from Cloudflare's edge."/>
[... 17 more head elements folded ...]
<link rel="canonical" href="https://unpkg.com/"/>
<link rel="alternate" type="text/markdown" href="https://unpkg.com/index.md"/>
[... 7 more head elements folded ...]
<title>UNPKG — The CDN for everything on npm
</title>
[... 2 more head elements folded ...]
</head>
<body class="bg-paper dark:bg-dark-page dark:text-dark-foreground">
<header class="sticky top-0 z-10 bg-paper dark:bg-dark-page border-b border-hairline dark:border-dark-border">
<div class="mx-auto lg:max-w-screen-md px-8 py-4 flex items-center justify-between gap-6"><a href="/" class="text-2xl font-black text-ink dark:text-dark-foreground" aria-label="UNPKG home">UNPKG</a>
<nav aria-label="Site">
<ul class="flex flex-wrap items-center gap-x-5 gap-y-1 text-base text-slate-600 dark:text-dark-secondary">
<li><a href="/network" class="hover:text-slate-900 dark:hover:text-dark-foreground hover:underline">Network</a>
</li>
<li><a href="/guides" class="hover:text-slate-900 dark:hover:text-dark-foreground hover:underline">Guides</a>
</li>
<li><a href="/status" class="hover:text-slate-900 dark:hover:text-dark-foreground hover:underline">Status</a>
</li>
<li><a href="/about" class="hover:text-slate-900 dark:hover:text-dark-foreground hover:underline">About</a>
</li>
<li><a href="https://shield.unpkg.com/" class="hover:text-slate-900 dark:hover:text-dark-foreground hover:underline">Shield</a>
</li>
<li><button type="button" id="theme-toggle" aria-label="Toggle dark mode" title="Toggle dark mode" class="block p-1.5 rounded-md hover:bg-paper-alt dark:hover:bg-dark-panel focus-visible:outline focus-visible:outline-2 focus-visible:outline-accent-deep">
<svg class="theme-icon-moon w-5 h-5" aria-hidden="true" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="1.8"><path stroke-linecap="round" stroke-linejoin="round" d="M21 12.8A9 9 0 1 1 11.2 3a7 7 0 0 0 9.8 9.8Z"></path>
</svg>
<svg class="theme-icon-sun w-5 h-5" aria-hidden="true" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="1.8">[... 220 characters folded ...]
</svg></button>
</li>
</ul>
</nav>
</div>
</header>
<header class="mx-auto lg:max-w-screen-md px-8 text-slate-900 dark:text-dark-secondary">
<h1 class="mt-24 text-7xl text-center font-black text-ink dark:text-dark-foreground">UNPKG
</h1>
<p class="mt-8 text-center text-xl text-slate-900 dark:text-dark-secondary leading-relaxed">The CDN for everything on <a class="inline-link text-accent dark:text-dark-link hover:underline" href="https://www.npmjs.com/">npm</a>. Load any file from any package by URL. Files are served from Cloudflare's edge.
</p>
<p class="mt-10 flex flex-wrap items-center justify-center gap-3"><a class="inline-block px-5 py-2.5 rounded-md bg-accent-deep text-white font-semibold hover:bg-accent focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-accent-deep" href="/guides">Get started</a><a class="inline-block px-5 py-2.5 rounded-md border border-hairline-strong dark:border-dark-border-strong bg-white dark:bg-dark-panel text-ink dark:text-dark-foreground font-semibold hover:border-accent dark:hover:borde [... 139 characters folded ...]>Browse a package</a>
</p>
<p class="mt-10 p-4 text-center bg-paper-alt dark:bg-dark-panel"><code class="text-sm sm:hidden">unpkg.com/:pkg@:ver/:file</code><code class="text-sm hidden sm:block">https://unpkg.com/:package@:version/:file</code>
</p>
<div class="mt-8">
<div data-hydrate="{&quot;key&quot;:&quot;UrlBuilder&quot;,&quot;props&quot;:{&quot;esmOrigin&quot;:&quot;https://esm.unpkg.com&quot;,&quot;origin&quot;:&quot;https://unpkg.com&quot;}}">
<div class="border border-hairline-strong dark:border-dark-border-strong bg-white dark:bg-dark-panel p-4 text-slate-900 dark:text-dark-secondary"><label class="block text-base font-semibold text-ink dark:text-dark-foreground" for="url-builder-package">Try it: build a URL</label><input id="url-builder-package" type="text" value="preact" placeholder="package name, e.g. react" class="mt-2 w-full px-3 py-2 text-base bg-paper dark:bg-dark-page border border-hairline-strong dark:border-dark-border-st [... 122 characters folded ...]>
<ul class="mt-3 text-base space-y-1.5">
<li>File: <a class="inline-link text-accent dark:text-dark-link hover:underline break-all" href="/preact">https://unpkg.com/preact</a>
</li>
<li>Metadata: <a class="inline-link text-accent dark:text-dark-link hover:underline break-all" href="/preact/?meta">https://unpkg.com/preact/?meta</a>
</li>
<li>ES module: <a class="inline-link text-accent dark:text-dark-link hover:underline break-all" href="https://esm.unpkg.com/preact">https://esm.unpkg.com/preact</a>
</li>
</ul>
</div>
</div>
</div>
</header>
<main class="mx-auto lg:max-w-screen-md text-lg text-slate-900 dark:text-dark-secondary leading-relaxed max-w-full px-8"><dl class="mt-12 grid grid-cols-1 sm:grid-cols-2 lg:grid-cols-4 border border-hairline-strong dark:border-dark-border-strong bg-white dark:bg-dark-panel shadow-[0_1px_2px_rgba(14,26,35,0.06)] text-base">
<div class="p-4 border-b sm:border-b-0 lg:border-r border-hairline dark:border-dark-border">
<svg class="w-6 h-6 text-accent dark:text-dark-link" aria-hidden="true" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="1.6">[... 181 characters folded ...]
</svg><dt class="mt-2.5 font-semibold text-ink dark:text-dark-foreground">Global edge</dt><dd class="mt-1 text-[0.95rem] leading-snug text-slate-600 dark:text-dark-secondary">Served from Cloudflare's network, close to browsers everywhere. <a class="inline-link text-accent dark:text-dark-link hover:underline" href="/network">Network</a></dd>
</div>
<div class="p-4 border-b sm:border-b-0 lg:border-r border-hairline dark:border-dark-border">
<svg class="w-6 h-6 text-accent dark:text-dark-link" aria-hidden="true" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="1.6">[... 328 characters folded ...]
</svg><dt class="mt-2.5 font-semibold text-ink dark:text-dark-foreground">11 origin regions</dt><dd class="mt-1 text-[0.95rem] leading-snug text-slate-600 dark:text-dark-secondary">Files are fetched from origin machines across the Americas, Europe, Asia, and Australia.</dd>
</div>
<div class="p-4 border-b sm:border-b-0 lg:border-r border-hairline dark:border-dark-border">
<svg class="w-6 h-6 text-accent dark:text-dark-link" aria-hidden="true" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="1.6">[... 129 characters folded ...]
</svg><dt class="mt-2.5 font-semibold text-ink dark:text-dark-foreground">Verified bytes</dt><dd class="mt-1 text-[0.95rem] leading-snug text-slate-600 dark:text-dark-secondary">Every file is digest-checked before it is cached, and corrupt entries heal themselves.</dd>
</div>
<div class="p-4">
<svg class="w-6 h-6 text-accent dark:text-dark-link" aria-hidden="true" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="1.6">[... 214 characters folded ...]
</svg><dt class="mt-2.5 font-semibold text-ink dark:text-dark-foreground">Supply-chain defense</dt><dd class="mt-1 text-[0.95rem] leading-snug text-slate-600 dark:text-dark-secondary"><a class="inline-link text-accent dark:text-dark-link hover:underline" href="https://shield.unpkg.com/">UNPKG Shield</a> pins or swaps compromised packages at the edge.</dd>
</div></dl>
<section id="quickstart">
<h2 class="mt-20 mb-6 text-xl font-semibold text-slate-900 dark:text-dark-foreground">Start in one line
</h2>
<p>Point a script tag at a package file. Pin the full version in production so the response comes straight from the edge cache:
</p>
<div class="mt-6">
<div class="hljs-frame border border-hairline-strong dark:border-dark-border-strong bg-white dark:bg-dark-page">
<div class="hljs-dark-listing p-4 font-mono text-sm leading-6 whitespace-pre overflow-x-auto" style="tab-size:2;"><span class="hljs-tag">&lt;<span class="hljs-name">script</span> <span class="hljs-attr">src</span>=<span class="hljs-string">&quot;https://unpkg.com/preact@10.26.4/dist/preact.min.js&quot;</span>&gt;</span><span class="hljs-tag">&lt;/<span class="hljs-name">script</span>&gt;</span>
</div>
</div>
</div>
<p class="mt-6">In a module, load the browser-ready build from <a class="inline-link text-accent dark:text-dark-link hover:underline" href="https://esm.unpkg.com/">esm.unpkg.com</a>:
</p>
<div class="mt-6">
<div class="hljs-frame border border-hairline-strong dark:border-dark-border-strong bg-white dark:bg-dark-page">
<div class="hljs-dark-listing p-4 font-mono text-sm leading-6 whitespace-pre overflow-x-auto" style="tab-size:2;"><span class="hljs-tag">&lt;<span class="hljs-name">script</span> <span class="hljs-attr">type</span>=<span class="hljs-string">&quot;module&quot;</span>&gt;</span><span class="language-javascript">
  <span class="hljs-keyword">import</span> <span class="hljs-title class_">React</span> <span class="hljs-keyword">from</span> <span class="hljs-string">&quot;https://esm.unpkg.com/react@18.3.1&quot;</span>;
</span><span class="hljs-tag">&lt;/<span class="hljs-name">script</span>&gt;</span>
</div>
</div>
</div>
<p class="mt-6">Need to know what's inside a package first? Append <a class="inline-link text-accent dark:text-dark-link hover:underline" href="/guides/metadata-api"><code class="text-sm bg-paper-alt dark:bg-dark-panel">?meta</code></a> to any package URL for JSON metadata.
</p>
</section>
<section id="ways-to-use">
<h2 class="mt-20 mb-6 text-xl font-semibold text-slate-900 dark:text-dark-foreground">Ways to use UNPKG
</h2>
<ul class="ml-6 list-disc list-outside">
<li class="marker:pr-2"><a class="inline-link text-accent dark:text-dark-link hover:underline" href="/guides/loading-files">Load files from npm</a>: any file, any package, one URL. Versions, entry points, and exports resolution explained.
</li>
<li class="marker:pr-2 mt-2"><a class="inline-link text-accent dark:text-dark-link hover:underline" href="/guides/nobuild-apps">Build apps with no build step</a>: import maps turn a plain HTML file into a working app.
</li>
<li class="marker:pr-2 mt-2"><a class="inline-link text-accent dark:text-dark-link hover:underline" href="/guides/browser-modules">Use native browser modules</a>: esm.unpkg.com converts packages into modules browsers load directly.
</li>
<li class="marker:pr-2 mt-2"><a class="inline-link text-accent dark:text-dark-link hover:underline" href="/guides/inline-scripts">Run inline TypeScript and JSX</a>: the <code class="text-sm bg-paper-alt dark:bg-dark-panel">/run</code> helper transforms inline scripts in the page.
</li>
<li class="mt-2"><a class="inline-link text-accent dark:text-dark-link hover:underline" href="/guides/metadata-api">Inspect packages programmatically</a>: file listings, sizes, and integrity hashes as JSON, for tools and agents.
</li>
</ul>
<div class="mt-10" id="live-demo">
<div class="hljs-frame border border-hairline-strong dark:border-dark-border-strong bg-white dark:bg-dark-page">
<div class="hljs-dark-listing p-4 font-mono text-sm leading-6 whitespace-pre overflow-x-auto" style="tab-size:2;"><span class="hljs-tag">&lt;<span class="hljs-name">script</span> <span class="hljs-attr">type</span>=<span class="hljs-string">&quot;module&quot;</span> <span class="hljs-attr">src</span>=<span class="hljs-string">&quot;https://unpkg.com/run

Shown with 18 long blocks (scripts, styles, long tags) folded into a marker that says how many characters they hide; line breaks added before block tags because the source is minified; the pane stops after the first 200 words; the page is 23 KB.

Reading view the text a plain-fetch client can extract

title: UNPKG — The CDN for everything on npm

UNPKG

UNPKG Network Guides Status About Shield UNPKG The CDN for everything on npm . Load any file from any package by URL. Files are served from Cloudflare's edge. Get started Browse a package unpkg.com/:pkg@:ver/:filehttps://unpkg.com/:package@:version/:file Try it: build a URL File: https://unpkg.com/preact Metadata: https://unpkg.com/preact/?meta ES module: https://esm.unpkg.com/preact Global edgeServed from Cloudflare's network, close to browsers everywhere. Network 11 origin regionsFiles are fetched from origin machines across the Americas, Europe, Asia, and Australia. Verified bytesEvery file is digest-checked before it is cached, and corrupt entries heal themselves. Supply-chain defense UNPKG Shield pins or swaps compromised packages at the edge. Start in one line Point a script tag at a package file. Pin the full version in production so the response comes straight from the edge cache: <script src="https://unpkg.com/preact@10.26.4/dist/preact.min.js"></script> In a module, load the browser-ready build from esm.unpkg.com : <script type="module"> import React from "https://esm.unpkg.com/react@18.3.1"; </script> Need to know what's inside a package first? Append ?meta to any package URL for JSON metadata. Ways to use UNPKG Load files from npm : any file, any package, one URL. Versions, entry points, and exports resolution explained. Build apps with no build step : import maps turn a plain HTML file into a working app.

359 more words follow in the initial HTML.

5 found, 0 missing, 2 notes, from 7 checks run

H1Found
200 wordsFound
llms.txtNote
MarkdownFound
Missing pathFound
JSON-LDFound
OpenAPINote

What a plain fetch found on unpkg.com
Check	Result	Detail
H1 in the initial HTML	Found one H1	First H1: UNPKG
First 200 words in the initial HTML	Found 200 of 200 words	The initial HTML carries 559 words of visible text; the first 200 are marked in the left pane.
llms.txt present and linked	Note present, not linked	2004 bytes, 13 links. Structure grade A (6 of 6). Nothing on the home page points to it. Ora's lab found 86 percent of llms.txt fetches arrived through a link.
Markdown on request	Found text/markdown	Accept: text/markdown returned 200 with text/markdown; charset=utf-8. Vary: Accept is set.
Status of a made-up path	Found 404	/agent-ready-html-missing-path-check returned 404: a real status code for a missing page.
JSON-LD types	Found Organization, WebPage, WebSite	3 schema.org types in JSON-LD blocks on the home page: Organization, WebPage, WebSite.
OpenAPI link	Note none on the home page	No OpenAPI link on the home page. It matters only for a site that ships an API.

Run the full check

The viewer read one page with four requests. The full check we recommend next is Ora's scan. Its Access layer runs 42 checks worth 30 of its 100 points, among them content without JavaScript, bot detection, llms.txt, markdown on request, JSON-LD and the sitemap (Ora's check catalogue, contract 1.38.0, read 5 November 2026). Open Ora's report for unpkg.com.

Limits: Ora reads public URLs only, says two runs of one scan land within a couple of points without publishing repeat-scan data, and keeps the product that fixes what it finds behind a waitlist. Cloudflare's scanner at isitagentready.com is a quick free alternative, and Mintlify's score covers documentation.

What the viewer does

It sends four plain GET requests with the user agent Mozilla/5.0 (compatible; agent-readiness-crawl/1.0): the URL itself, the same URL with Accept: text/markdown, /llms.txt on the same host, and a made-up path at the root. It runs no JavaScript. The left pane is the first bytes of the HTML as text, with long scripts and styles folded into a marker that says how many characters they hide. The H1 and the first 200 words of visible text are marked in both panes. The flags under the panes say what the four responses added up to.

Limits

Ten seconds for all four requests together, 1.5 MB read from the home page, at most five redirects, each one checked again.
http and https only, default ports only. Private, local and internal addresses and names are refused.
Ten runs per address per minute. The counter lives in memory on the edge function, so it is per instance rather than global. Past ten you get a 429 with a Retry-After header.
Results are cached for 24 hours by the response headers. Nothing is written to a database: the viewer keeps the first 200 words and the extracted fields for the length of the request and keeps no page body beyond that.

What it does not tell you

A plain fetch from this server is not a real agent. Bot protection weighs the source address more than the user agent, so a page that answers 200 here can still refuse an agent, and the reverse. Ora's lab found (2026-10-19) that returning 403 to agent user agents and hiding the answer in JavaScript were the only two of 19 configurations that stopped retrieval; the viewer can see the second, and can only hint at the first. The initial HTML reference covers both. The server logs and the published crawler address ranges settle the first.

The seven flags

H1 in the initial HTML: Whether the HTML the server sends already contains an H1. It is the cheapest sign that the page does not depend on scripts to say what it is.
First 200 words in the initial HTML: Whether at least 200 words of visible text arrive in the initial HTML. Under 40 words with an app root element is flagged as a JavaScript shell.
llms.txt present and linked: Whether /llms.txt answers with a plain-text file, whether the home page links it (an anchor, a link element or a Link header), and the structure grade the index uses.
Markdown on request: Whether a request with Accept: text/markdown comes back as text/markdown. Cloudflare Radar found 3.9 percent of scanned top sites passing this at its April 2026 launch.
Status of a made-up path: Whether a path that should not exist returns 404 or 410. A 200 is a soft 404 and reads as a live page.
JSON-LD types: The schema.org types found in JSON-LD blocks on the page. Ora's lab found JSON-LD made no difference when the answer was already in the HTML.
OpenAPI link: Whether the page links an OpenAPI file, by an anchor or a service-desc link relation. It matters only for a site that ships an API.

Sources

Ora: AgentReady launch post (Ora's lab findings) https://ora.ai/blog/agentready-launch, read 4 November 2026
Ora check catalogue, contract 1.38.0 (132 checks, 42 in the Access layer) https://ora.ai/api/checks, read 5 November 2026
Ora home page (the fixing product is behind a waitlist) https://ora.ai/, read 5 November 2026
Ora: Introducing Deep Scan (repeat scans) https://ora.ai/blog/introducing-deep-scan, read 5 November 2026
Ora llms.txt (public URLs only) https://ora.ai/llms.txt, read 5 November 2026
Vercel: Make your site readable by AI agents https://vercel.com/kb/guide/make-your-site-readable-by-ai-agents, read 4 November 2026
llms.txt proposal (llmstxt.org) https://llmstxt.org/, read 4 November 2026

Last reviewed 5 November 2026