# AgentMarket

> Storefront for AI products we build. Each live product has its own site on a subdomain of agentmarket.lol. This catalog is where we list them.

- Site: https://agentmarket.lol/
- Contact: hello@agentmarket.lol
- Support: support@agentmarket.lol

## Live products

- [Web Scan](https://web-scan.agentmarket.lol/): site-health checker. 85+ checks across SEO, GEO (what AI answer engines can read), security headers, and performance. Paste-ready fixes for Claude, Cursor, or another coding agent. No AgentMarket account required to scan.
- [Job Search Agent](https://job-search.agentmarket.lol/): searches 500+ job sources, scores roles against a resume, tailors resume and cover letter per job, and prepares interview material. Sign in with Google. No credit card required to start.

## Free guides

- [Where to Launch](https://agentmarket.lol/where-to-launch): 15 places to launch a startup or side project, with a plain-English guide for each: what it costs, when it goes live, what to prepare, the rules, and the important links. Agent-readable copy of every guide in one file: https://agentmarket.lol/where-to-launch.md
- [How to Market](https://agentmarket.lol/how-to-market): 10 ways to market your product without an ad budget, with a plain-English guide for each: how it works, what to prepare, step by step, the rules, a template, and what to measure. Agent-readable copy of every guide in one file: https://agentmarket.lol/how-to-market.md

## Coming soon

- Talk to Your Customer: answer everyday customer questions from product knowledge; hand hard cases back to a human. Not live.
- Watch the Internet: watch competitors, Reddit, and Hacker News; filter to what is useful. Not live.

## Pricing

A shared plan is coming so one subscription covers products on this platform. Until it ships, live products are free to use. Pricing cards on the homepage are a preview, not a charge.

## What AgentMarket is not

Not a directory of other people's AI apps. We build what we list. Coming soon means it is not out yet.

## FAQ



### What is AgentMarket?

AgentMarket is a storefront for AI products we build. Each live product has its own site on a subdomain of agentmarket.lol. This catalog is where we list them so you do not have to hunt for links. We are not a directory of other people's apps. You pick a product, open it, and use it there.

### What is Web Scan?

Web Scan is a site-health checker at web-scan.agentmarket.lol. Paste a URL and it runs 85+ checks across SEO, GEO (what AI answer engines can actually read on the page), security headers, and performance. Failed checks come back with the specific change to make, plus prompts you can paste into Claude, Cursor, or another coding agent. You can run a scan without creating an AgentMarket account.

### What is Job Search Agent?

Job Search Agent lives at job-search.agentmarket.lol. It searches 500+ job sources, scores roles against your resume, helps tailor your resume and cover letter for each job, and prepares interview material. You sign in with Google on that site. No credit card is required to start.

### What products are coming soon?

Talk to Your Customer is meant to answer everyday customer questions from your product knowledge and hand the hard ones back to you. Watch the Internet is meant to watch competitors, Reddit, and Hacker News, then filter down to what is useful. Neither is live. They stay marked coming soon on this page until they ship.

### How much does AgentMarket cost?

A shared plan is coming soon. One plan will let you use different products on this platform. Until that ships, every live product is free to use. The pricing cards on this page are blurred on purpose: they are a preview of that plan, not a charge today.

### Do I need one account for every product?

Not yet. Each live product has its own site and its own sign-in if it needs one. Job Search Agent uses Google. Web Scan lets you run a scan without an AgentMarket account. Shared login is part of the work still in progress. We will not pretend it is done.

### Do I need to install anything?

No. Open the product in your browser. Web Scan and Job Search Agent both run on the web. There is no desktop download and no browser extension for AgentMarket itself.

### How do I get in touch?

Email hello@agentmarket.lol for product ideas, partnerships, or questions about the shelf. For help with something already live, use support@agentmarket.lol. If the bug is inside a product, that product's own site is often the fastest place to start.

## Where to launch (one Markdown guide per site)

- [How to launch on Product Hunt](https://agentmarket.lol/where-to-launch/product-hunt/guide.md): The biggest launch day on the internet. One 24-hour race. Cost: Free.
- [How to launch on Hacker News (Show HN)](https://agentmarket.lol/where-to-launch/hacker-news/guide.md): Engineers who try things and say exactly what they think. Cost: Free.
- [How to launch on Reddit](https://agentmarket.lol/where-to-launch/reddit/guide.md): Huge niche communities. Help first, then share. Cost: Free.
- [How to launch on Indie Hackers](https://agentmarket.lol/where-to-launch/indie-hackers/guide.md): Solo founders who love real numbers and honest stories. Cost: Free.
- [How to launch on Peerlist Launchpad](https://agentmarket.lol/where-to-launch/peerlist/guide.md): A weekly launch for builders. Starts every Monday. Cost: Free.
- [How to launch on BetaList](https://agentmarket.lol/where-to-launch/betalist/guide.md): For startups before launch. Grow your early-access list. Cost: Paid.
- [How to launch on Uneed](https://agentmarket.lol/where-to-launch/uneed/guide.md): Daily launches that stay listed after the day ends. Cost: From $14.99.
- [How to launch on DevHunt](https://agentmarket.lol/where-to-launch/devhunt/guide.md): Product Hunt, but only for developer tools. Weekly. Cost: Free, or $19 to pick your week.
- [How to launch on MicroLaunch](https://agentmarket.lol/where-to-launch/microlaunch/guide.md): A month-long launch with real feedback, not a one-day spike. Cost: Free, paid Pro option.
- [How to launch on Fazier](https://agentmarket.lol/where-to-launch/fazier/guide.md): Daily launches. Free if you add their badge to your site. Cost: Free with badge, or from $29.
- [How to launch on TinyLaunch](https://agentmarket.lol/where-to-launch/tinylaunch/guide.md): A weekly launch for small products, with a free queue. Cost: Free, or $39 to skip the queue.
- [How to launch on Open-Launch](https://agentmarket.lol/where-to-launch/open-launch/guide.md): An open-source Product Hunt. Daily launches at 08:00 UTC. Cost: Free queue, or a small fee.
- [How to launch on There's An AI For That](https://agentmarket.lol/where-to-launch/theres-an-ai-for-that/guide.md): The biggest directory of AI tools. People search it by task. Cost: Free only if your tool is free.
- [How to launch on AlternativeTo](https://agentmarket.lol/where-to-launch/alternativeto/guide.md): Show up when people search for an alternative to a big app. Cost: Free.
- [How to launch on SaaSHub](https://agentmarket.lol/where-to-launch/saashub/guide.md): A software directory buyers use to compare tools. Cost: Free.

## How to market (one Markdown guide per play)

- [Build in public on X](https://agentmarket.lol/how-to-market/build-in-public-on-x/guide.md): Share your progress every day. People follow the journey, then try the product.
- [Post on LinkedIn as the founder](https://agentmarket.lol/how-to-market/linkedin-founder-posts/guide.md): Your personal profile reaches far more people than a company page.
- [Answer questions in communities](https://agentmarket.lol/how-to-market/answer-questions-in-communities/guide.md): Find people asking for help with your problem, and genuinely help them.
- [Write pages people search for](https://agentmarket.lol/how-to-market/seo-pages/guide.md): One helpful page per question your buyers type into Google.
- [Get recommended by ChatGPT, Claude and Perplexity](https://agentmarket.lol/how-to-market/get-recommended-by-ai/guide.md): More people ask AI which tool to use. Make sure it knows about yours.
- [Give away a free tool](https://agentmarket.lol/how-to-market/free-tool/guide.md): Build a small free tool that solves one step. It brings visitors for years.
- [Cold email that doesn't land in spam](https://agentmarket.lol/how-to-market/cold-email/guide.md): Short, personal emails to a small list of perfect-fit people.
- [Build an email list](https://agentmarket.lol/how-to-market/email-newsletter/guide.md): The one audience no algorithm can take away from you.
- [Make short videos](https://agentmarket.lol/how-to-market/short-videos/guide.md): 30-second clips of your product solving one problem. Post them everywhere.
- [Start a referral or affiliate program](https://agentmarket.lol/how-to-market/referrals-and-affiliates/guide.md): Pay happy customers and creators to bring you more customers.

## Pages

- [Home](https://agentmarket.lol/)
- [Where to launch](https://agentmarket.lol/where-to-launch)
- [How to market](https://agentmarket.lol/how-to-market)
- [Blog](https://agentmarket.lol/blog)
- [About](https://agentmarket.lol/about)
- [Contact](https://agentmarket.lol/contact)
- [Privacy Policy](https://agentmarket.lol/privacy)
- [Terms of Service](https://agentmarket.lol/terms)

---

# The SEO checklist for websites built with AI coding tools

URL: https://agentmarket.lol/blog/seo-checklist-for-ai-built-websites
Published: 2026-10-03

> Built your site with Cursor, Claude Code, Lovable or Bolt? Here are the SEO basics AI tools skip: rendering, meta tags, Open Graph, sitemaps, and crawler access.

You built a site in a weekend with Cursor, Claude Code, Lovable, Bolt or v0. It looks great. Then you share the link on X and the preview card is blank, or you search for your own product name on Google and nothing comes up.

That is normal. AI coding tools are very good at what you can see and much less careful about what you cannot: the metadata, the files crawlers read, and how the HTML is rendered. This checklist covers the parts they most often skip, in the order we would fix them.

## 1. Make sure the HTML actually contains your content

Open your site, press **View Page Source** (not Inspect), and search for your headline. If you see an almost empty `<div id="root"></div>` and a pile of script tags, your page is client-side rendered. The text only exists after JavaScript runs.

Google can render JavaScript, but it does so in a second pass that can be delayed, and many other crawlers, including a lot of AI crawlers, read only the raw HTML. The fix is to ship pre-rendered HTML:

- **Static site generation (SSG):** pages are built to HTML at deploy time. Best for marketing pages, docs and blogs. This site uses it.
- **Server-side rendering (SSR):** HTML is built per request. Use it when the content is personal or changes every minute.
- **Client-side rendering (CSR):** fine behind a login, poor for anything you want found.

In Next.js, a page with no request-time data is static by default, and `output: "export"` turns the whole site into plain files. In Vite or Create React App projects, consider a prerender step or moving the public pages to a framework that renders HTML.

## 2. Give every page a unique title and description

Each URL needs its own `<title>` and `<meta name="description">`. AI tools often set one title in the root layout and forget the rest, so every page shows up in search with the same name.

- Keep titles under about 60 characters and put the specific thing first: "Pricing | YourApp", not "YourApp | Pricing".
- Write descriptions of about 140 to 160 characters that say what the page does. Google may rewrite them, but a good one is used more often.
- Skip `<meta name="keywords">`. Google has ignored it for many years.

## 3. Fix your link previews (Open Graph and X cards)

When you paste a link into X, LinkedIn, Slack or iMessage, the preview comes from Open Graph tags: `og:title`, `og:description`, `og:image`, `og:url` and `og:type`, plus `twitter:card` set to `summary_large_image` for the big card on X.

Here is a bug we shipped ourselves. Our root layout had a complete set of Open Graph tags. The homepage then set `openGraph: { url }` to add its own URL. In Next.js, nested metadata objects are **replaced, not merged**, so that one line silently removed `og:image`, `og:type` and `og:site_name` from the homepage only. Every other page was fine. If you use the Next.js Metadata API, build page metadata from one shared helper instead of patching single fields.

Check it: paste your URL into a card validator or view source and search for `og:image`. The image should be an absolute URL, 1200 by 630 pixels, and under about 5 MB.

## 4. Add a canonical URL

`<link rel="canonical">` tells search engines which URL is the real one when the same page is reachable as `/about`, `/about/`, `?ref=x` or `www.`. Without it, ranking signals can split across duplicates. Every indexable page should point to itself with an absolute URL.

## 5. Ship robots.txt and a sitemap

- `/robots.txt` tells crawlers what they may fetch. The most common AI-tool mistake is leaving a staging rule like `Disallow: /` in production. Make sure that line is gone.
- `/sitemap.xml` lists every page you want indexed, with a last-modified date. Reference it from robots.txt and submit it in Google Search Console.

Generate both from code if your framework allows it, so new pages are added automatically.

## 6. Check what your CDN does to bots

This one is easy to miss. Hosting and CDN providers increasingly offer one-click settings that block AI crawlers or challenge "bot-like" traffic. Some are on by default for new domains. Your robots.txt can say "welcome" while the CDN returns 403 to the same crawler.

Test it from a terminal by sending a request with a crawler's user agent, such as `curl -A "GPTBot" -I https://yoursite.com`. A 403 or a challenge page means the crawler cannot read you, whatever your robots.txt says. Decide on purpose which crawlers you want and set the CDN to match.

## 7. Add structured data

JSON-LD in a `<script type="application/ld+json">` block describes the page to machines: an `Organization` with your logo and contact, a `WebSite`, `SoftwareApplication` for products, `FAQPage` for real FAQs, `BlogPosting` for articles and `BreadcrumbList` for navigation. It does not guarantee rich results, but it removes guesswork for search engines and for AI systems that summarize your page.

## 8. Get the basics of speed and accessibility right

- Serve images at the size they are shown, in WebP or AVIF, with `width` and `height` set so the layout does not jump.
- Lazy-load images below the fold. Do not lazy-load the hero.
- Use one `<h1>` per page and headings in order.
- Give every meaningful image real `alt` text and give decorative images `alt=""`.
- Make the page readable at 320 pixels wide, with no sideways scrolling.

## 9. Verify, then tell Google

Add your domain to Google Search Console (a DNS TXT record is the cleanest way), submit the sitemap, and use URL Inspection on the homepage to request indexing. New sites can take days to weeks to appear. Search Console will show you what Google actually saw.

## The short version

1. Ship real HTML, not an empty div.
2. Give each page a unique title, description and canonical URL.
3. Set a complete Open Graph image and card.
4. Add robots.txt and sitemap.xml, and remove any staging `Disallow`.
5. Make sure your CDN is not blocking crawlers you want.
6. Add JSON-LD.
7. Verify in Search Console.

If you would rather not check all of this by hand, [Web Scan](https://web-scan.agentmarket.lol/) runs 85+ checks across SEO, GEO, security and performance on any URL. Each failed check comes with a fix you can paste straight into Claude, Cursor or another coding agent. It is free, and you do not need an account.

---

# What is GEO? How to get your site cited by ChatGPT, Claude and Perplexity

URL: https://agentmarket.lol/blog/what-is-generative-engine-optimization
Published: 2026-10-03

> Generative Engine Optimization (GEO) explained: how AI answer engines pick sources, which crawlers to allow, and a practical checklist to get your pages cited.

More and more people ask ChatGPT, Claude, Perplexity or Google's AI answers instead of scrolling ten blue links. Those systems read the web, pick a few sources and write an answer, sometimes with citations. **Generative Engine Optimization (GEO)** is the practice of making your pages easy for them to find, read, trust and quote.

The term comes from a 2023 research paper, "GEO: Generative Engine Optimization", by researchers at Princeton and other institutions. It found that how content is written and structured changes how often generative engines cite it. The field moves fast, but the fundamentals are stable, and most of them are just good SEO done carefully.

## How GEO differs from SEO

Traditional SEO is about ranking a URL for a query. GEO is about being **used as a source** inside a generated answer. The two overlap heavily, because most AI answer engines pull candidates from a search index first. But a few things matter more in GEO:

- **Extractability.** Can a model lift a clear, self-contained answer from your page? Answers buried in long intros or spread across tabs are harder to quote.
- **Raw HTML access.** Many AI crawlers do not run JavaScript. If your content only appears after client-side rendering, it may as well not exist for them.
- **Crawler access.** AI companies use their own user agents. If robots.txt or your CDN blocks them, you are invisible to that engine.
- **Specificity.** Concrete numbers, named steps, and definitions are more quotable than marketing language.

## Know the crawlers

Each AI company runs more than one bot, and they do different jobs. Most separate **training** (collecting data to train future models) from **search and retrieval** (fetching pages to answer a question right now):

- **OpenAI:** `GPTBot` (training), `OAI-SearchBot` (ChatGPT search), `ChatGPT-User` (fetches a page when a user asks).
- **Anthropic:** `ClaudeBot` (training), `Claude-SearchBot` (search), `Claude-User` (user-initiated fetches).
- **Perplexity:** `PerplexityBot` (indexing), `Perplexity-User` (user-initiated fetches).
- **Google:** `Googlebot` crawls for Search, including AI Overviews. `Google-Extended` is a robots.txt token, not a separate crawler, that controls whether your content is used for Gemini models.
- **Apple:** `Applebot`, with `Applebot-Extended` controlling use in Apple's AI models.
- **Common Crawl:** `CCBot`, whose public dataset is used by many model builders.

If you want to show up in AI answers, the search and user bots matter most. Whether you also allow training bots is a business decision. Allowing them is how a small brand ends up "known" to future models.

## A practical GEO checklist

### 1. Let them in

Check robots.txt **and** your CDN or firewall. Some hosts block AI crawlers by default with a toggle that robots.txt cannot override. Test with a request using the crawler's user agent and confirm you get a 200, not a 403 or a challenge page.

### 2. Serve real HTML

Use static generation or server rendering for every public page. View the page source. Your headline, product description and pricing should be there as text.

### 3. Answer the question in the first two sentences

Put the definition or the answer at the top of the section, then explain. "Web Scan is a site-health checker that runs 85+ checks on any URL" is easier to quote than three paragraphs of build-up.

### 4. Use headings that match real questions

Write `## How much does it cost?` rather than `## Our philosophy`. Question-shaped headings line up with how people prompt AI tools, and FAQ sections give models ready-made question and answer pairs.

### 5. Be specific and consistent

State facts the same way everywhere: product names, prices, limits, what is live and what is not. Inconsistent claims across your site, docs and social posts make it harder for a model to trust any one version.

### 6. Add structured data

JSON-LD for `Organization`, `SoftwareApplication`, `FAQPage` and `BlogPosting` gives machines an unambiguous summary of who you are and what you offer.

### 7. Publish an llms.txt

An `/llms.txt` file is a short Markdown briefing about your site for language models. It is a proposed convention, not a standard, and support varies, but it costs ten minutes. We wrote a [separate guide to llms.txt](/blog/llms-txt-guide).

### 8. Earn mentions elsewhere

Answer engines weigh what other sites say about you: reviews, forum threads, comparison posts, docs that link to you. GEO does not replace being worth talking about.

## How to measure it

There is no Search Console for AI answers yet. Practical signals:

- Ask the engines directly what your product is, and note whether they cite you.
- Watch referral traffic from `chatgpt.com`, `perplexity.ai`, `claude.ai` and similar domains in your analytics.
- Check your server or CDN logs for the AI user agents above, to confirm they are actually crawling.

## Check your site in one click

[Web Scan](https://web-scan.agentmarket.lol/) includes GEO checks alongside SEO, security and performance. It looks at what an AI answer engine can actually read on your page, flags what is missing, and gives you a fix you can paste into Claude, Cursor or another coding agent. No account needed.

---

# llms.txt explained: what it is, what it isn't, and how to add one

URL: https://agentmarket.lol/blog/llms-txt-guide
Published: 2026-10-03

> A practical guide to llms.txt and llms-full.txt: the format, a working example, how to generate it in Next.js, and how to make sure AI crawlers can reach it.

`llms.txt` is a plain Markdown file at the root of your site, at `/llms.txt`, that gives large language models a short, clean briefing: what the site is, what matters on it, and where to find the details. Think of it as a README for AI.

It was proposed in September 2024 by Jeremy Howard of Answer.AI. The reasoning is simple. Web pages are full of navigation, scripts and layout that waste a model's limited context. A curated Markdown summary is cheaper to read and harder to misunderstand.

## What it is not

Be clear-eyed about this before you spend time on it:

- **It is not a standard.** It is a proposal with growing but uneven adoption.
- **It does not control access.** That is robots.txt's job. llms.txt describes. It does not allow or block anything.
- **It is not a ranking factor.** No major search engine has said it uses llms.txt for ranking, and no AI company has committed to always reading it.

Why bother, then? It takes ten minutes, it cannot hurt, and when an agent or a user's AI tool fetches your site to answer a question, a clean summary gives it the right facts instead of guesses. Developer tools, documentation sites and coding agents already use it.

## The format

The proposal defines a simple structure:

1. An `# H1` with the name of the site or project. This is the only required part.
2. A `> blockquote` with a one or two sentence summary.
3. Optional paragraphs or lists with more context.
4. `## H2` sections containing Markdown link lists, each link optionally followed by a colon and a note.
5. An optional section titled `## Optional` for links that can be skipped when context is short.

Here is a minimal example:

```
# Acme Analytics

> Privacy-friendly web analytics for small sites. No cookies. Free up to 10k views a month.

## Product

- [Pricing](https://acme.example/pricing): Free, Pro $9/mo, Team $29/mo
- [Docs](https://acme.example/docs): install snippet and API reference

## Optional

- [Changelog](https://acme.example/changelog)
```

## llms-full.txt

Many sites also publish `/llms-full.txt`: the full text of the important pages concatenated into one Markdown file, so a model can read everything in a single request. It is useful for docs and blogs. Keep `llms.txt` short and put the bulk in `llms-full.txt`.

## Writing a good one

- **Lead with facts.** What the product does, who it is for, what it costs, what is live and what is not.
- **Use the same names everywhere.** If your homepage says "Job Search Agent", do not call it "JobBot" in llms.txt.
- **Say what you are not.** "We are not a directory of third-party tools" prevents a common misreading.
- **Use absolute URLs.** Agents may read the file out of context.
- **Keep it current.** A stale llms.txt is worse than none. Generate it from the same data as your site if you can.
- **Skip marketing language.** Models do not need "revolutionary".

## Generating it in Next.js

If you use Next.js with static export, you can build `llms.txt` from code with a route handler, so new pages and posts show up automatically:

```
// app/llms.txt/route.ts
export const dynamic = "force-static";

export function GET() {
  const body = ["# Your Site", "", "> One-line summary."].join("\n");
  return new Response(body, {
    headers: { "Content-Type": "text/plain; charset=utf-8" },
  });
}
```

At build time this becomes a plain `llms.txt` file in the output folder. No server is needed.

## Make sure crawlers can reach it

An llms.txt that AI crawlers cannot fetch does nothing. Check two things:

1. **robots.txt** does not disallow the crawlers you care about, such as `OAI-SearchBot`, `ChatGPT-User`, `Claude-SearchBot`, `Claude-User` and `PerplexityBot`.
2. **Your CDN or firewall** does not block them. Some providers block AI crawlers with a dashboard toggle that overrides robots.txt. Test with `curl -A "ClaudeBot" -I https://yoursite.com/llms.txt`.

You can link to the file from your HTML head with `<link rel="alternate" type="text/plain" href="/llms.txt">` and mention it in a robots.txt comment so it is easy to discover.

## See ours

AgentMarket publishes both: [llms.txt](https://agentmarket.lol/llms.txt) and [llms-full.txt](https://agentmarket.lol/llms-full.txt), generated from the same data as this site. To check whether your own site is readable by AI answer engines, [Web Scan](https://web-scan.agentmarket.lol/) includes GEO checks and gives fixes you can paste into a coding agent.

---

# Security headers for small websites: the ones that matter

URL: https://agentmarket.lol/blog/security-headers-for-small-websites
Published: 2026-10-03

> HSTS, nosniff, frame protection, Referrer-Policy, Permissions-Policy and CSP: what each security header does, safe values to copy, and which ones to skip.

HTTP security headers are instructions your server sends with every response telling the browser how to behave: only use HTTPS, do not let other sites frame you, do not guess file types. They cost nothing, take minutes to add, and close off whole classes of attacks. Most sites built quickly, by hand or with AI tools, ship none of them.

These are the ones worth adding on a small site, ordered from easy and safe to powerful but careful.

## 1. Strict-Transport-Security (HSTS)

```
Strict-Transport-Security: max-age=31536000
```

Tells browsers to use HTTPS for your domain for the next year, even if someone types `http://` or follows an old link. It stops downgrade attacks on public Wi-Fi.

**Be careful with `includeSubDomains`.** It applies the rule to every subdomain, including any that still serve plain HTTP. Add it only when you are sure every subdomain has a certificate. Add `preload` only if you understand that removal from browser preload lists takes months.

## 2. X-Content-Type-Options

```
X-Content-Type-Options: nosniff
```

Stops browsers from "sniffing" a file and treating it as a different type than you declared, for example running an uploaded text file as a script. There is no downside. Add it everywhere.

## 3. Frame protection

```
X-Frame-Options: DENY
Content-Security-Policy: frame-ancestors 'none'
```

Stops other sites from loading your pages in an invisible iframe and tricking users into clicking things (clickjacking). `frame-ancestors` is the modern version. `X-Frame-Options` covers older browsers. Use `SAMEORIGIN` or `'self'` if you frame your own pages.

## 4. Referrer-Policy

```
Referrer-Policy: strict-origin-when-cross-origin
```

Controls how much of your URL is sent to other sites when users click away. With this value, other sites see only your domain, not full paths that might contain tokens or search terms. It is the default in modern browsers, but setting it explicitly is cheap.

## 5. Permissions-Policy

```
Permissions-Policy: camera=(), microphone=(), geolocation=()
```

Turns off powerful browser features your site never uses, so injected scripts or embedded third parties cannot request them.

## 6. Content-Security-Policy (CSP)

CSP is the most powerful header and the easiest to get wrong. It lists which sources may load scripts, styles, images and connections. A strict CSP is the strongest defense against cross-site scripting, but a wrong one silently breaks your analytics, fonts or payment widget.

Start in report-only mode, which logs violations without blocking anything:

```
Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self' https://www.googletagmanager.com; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'
```

Watch the browser console, adjust, and switch to enforcing only when the reports are clean. Frameworks that inject inline scripts usually need nonces or hashes for a strict policy, so check your framework's CSP guide.

## Headers you can skip

- **X-XSS-Protection** is deprecated. Modern browsers ignore it, and the old filter it controlled could itself be abused. Use CSP instead.
- **Expect-CT** is obsolete. Certificate Transparency is enforced by browsers now.
- **Public-Key-Pins (HPKP)** is removed from browsers and dangerous to use.

## How to add them

- **Cloudflare Workers or Pages static assets:** a `_headers` file in your output folder.
- **Netlify:** a `_headers` file or `netlify.toml`.
- **Vercel:** the `headers` option in your project configuration.
- **Next.js on a Node server:** `headers()` in `next.config`. Note that this does not apply to a static export, so use your host's mechanism instead.
- **Nginx:** `add_header` directives. Add `always` so they are sent on error responses too.

A Cloudflare `_headers` example:

```
/*
  Strict-Transport-Security: max-age=31536000
  X-Content-Type-Options: nosniff
  X-Frame-Options: DENY
  Referrer-Policy: strict-origin-when-cross-origin
  Permissions-Policy: camera=(), microphone=(), geolocation=()
```

## Check your result

Open your browser's developer tools, go to the Network tab, click the main document and read the response headers. Or let a scanner do it. [Web Scan](https://web-scan.agentmarket.lol/) checks security headers alongside SEO, GEO and performance, and gives each missing header as a fix you can paste into your coding agent. Only scan sites you own or are allowed to test.

---

# How to tailor your resume to every job with AI, without making things up

URL: https://agentmarket.lol/blog/tailor-resume-to-job-description-with-ai
Published: 2026-10-03

> A step-by-step way to tailor your resume and cover letter to each job description with AI: pull requirements, map real experience, and stay ATS-friendly.

Sending the same resume to every job is the most common reason good candidates hear nothing back. Recruiters skim, applicant tracking systems (ATS) filter, and a generic resume makes both work harder to see that you fit. Tailoring fixes that. AI makes it fast, as long as you use it to **reframe what is true** and not to invent what is not.

## First, a myth about ATS

You will often read that "75% of resumes are rejected by robots before a human sees them." There is no solid source for that number. Most ATS software stores, parses and ranks applications. Recruiters search and filter it, and a person usually makes the call.

What is true is that recruiters search for specific skills and titles, and an ATS has to parse your resume correctly to match them. So the goal is not to "beat the robot". It is to make sure the right words are present, the file parses cleanly, and a human skimming for 30 seconds sees the match.

## Step 1: Pull the requirements out of the job description

Paste the job description into an AI assistant and ask it to list:

- the must-have skills, tools and qualifications
- the nice-to-haves
- the main outcomes the role is responsible for
- the exact wording used for each, such as "stakeholder management" or "cross-functional collaboration"

That list is your target. Wording matters because recruiters often search with the employer's own terms.

## Step 2: Map your real experience to it

Now give the AI your master resume, meaning everything you have done, and ask it to match each requirement to evidence from your experience. Ask it to flag requirements with **no** evidence instead of filling the gap.

A useful prompt:

> For each requirement, quote the line from my resume that best supports it. If nothing supports it, write "no evidence". Do not invent experience.

The "no evidence" rows are valuable. Either you have relevant experience you forgot to write down, which you should add honestly, or it is a real gap that you can address in the cover letter or interview.

## Step 3: Rewrite bullets in the employer's language

For the bullets that matter, ask the AI to rewrite them so they:

- lead with a strong verb
- use the job description's terminology where it is accurate
- include a concrete result, such as a number, scale, or before and after
- stay truthful to what you did

For example, "Helped with the website redesign" can become "Led front-end rebuild of the marketing site in Next.js; cut page load time from 4.1s to 1.3s." That only works if you did lead it and those are your numbers. Check every number the AI writes.

## Step 4: Reorder for the role

Tailoring is not only rewording. Move the most relevant role, project or skill group to the top. Cut bullets that do not support this application. A focused one-page resume for an early-career role beats a complete two-page history.

## Step 5: Keep the format ATS-friendly

- Use a single column with standard section headings: Experience, Education, Skills.
- Avoid putting key information in tables, text boxes, headers, footers or images.
- Submit a PDF exported from a text document, or a .docx if requested, not a scanned image.
- Spell out acronyms once, as in "search engine optimization (SEO)", so both versions match.

## Step 6: Write a short, specific cover letter

Three short paragraphs are enough:

1. The role, and the one reason you fit it best.
2. One or two concrete examples tied to their top requirements.
3. Why this company specifically, and a clear close.

AI drafts these well. Your job is to remove generic lines that would fit any company.

## Where AI goes wrong

- **Invented details.** Models sometimes add skills, titles or metrics you never gave them. Read every line before you send it. You are responsible for what you submit, and a fabricated claim can cost you an offer later.
- **Keyword stuffing.** Repeating terms unnaturally reads badly to the human who decides.
- **Same voice as everyone else.** Recruiters notice AI phrasing such as "spearheaded", "leveraged" and "dynamic". Edit it toward how you actually talk.
- **Privacy.** Before pasting your resume into any AI tool, check how that tool stores and uses your data.

## Doing this for every application

Tailoring takes 20 to 40 minutes per job by hand. Doing it across dozens of applications is where an agent helps. [Job Search Agent](https://job-search.agentmarket.lol/) searches 500+ job sources, scores each role against your resume, drafts a tailored resume and cover letter for the jobs you pick, and prepares interview material. You sign in with Google, and no credit card is needed to start. As with any AI tool, review everything before you send it.