Free tool · #3

Agent Trap Check

AI agents read the raw page, not what's on your screen. That means text hidden with a bit of CSS, tucked in a comment, or spelled out in invisible characters can give an agent orders. Paste a page and we'll show you anything like that.

Why it matters

This is how “prompt injection” gets in: someone hides instructions where only the AI will read them. It can happen on your site through a plugin, a comment form or a hacked page.

What we check

The page's HTML: hidden elements, <noscript> blocks, HTML comments, alt and title text, meta tags, and invisible Unicode (zero-width, direction-flipping and “tag” characters).

What we can't see

Text that JavaScript adds after the page loads, and rules in separate stylesheet files. A clean result means the page itself is clean, not that every visitor sees the same thing.

Only scan your own stuff

This reads one public page, but please point it at sites you own or have permission to test. 5 scans per hour.

What is prompt injection? A plain-English guide →