Websites that search engines, AI crawlers, and people can actually read
I audit, fix, build, secure, and write for the web — at the server and CDN level, where the causes usually live. From a crawler audit that needs nothing but your domain, to a complete WordPress site with long-form content and every source verified.
John Patzi · Chile · English and Spanish
fetch / as each crawler
| Crawler | Status | Result |
|---|---|---|
| Googlebot | 200 | allowed |
| Bingbot | 200 | allowed |
| GPTBot | 403 | refused |
| ClaudeBot | 403 | refused |
| PerplexityBot | 200 | allowed |
- robots.txt
- all five welcome
- the edge
- two refused
Nothing in your dashboard will tell you
I recently found a well-known developer site returning 403 to Bingbot, GPTBot and ClaudeBot. Its robots.txt said, in writing, that all search engines and AI crawlers were welcome.
Nobody had set that block up on purpose. A managed CDN rule ships switched on, and the gap between what a site says and what it does is invisible from the inside. It takes one request per crawler to find it.
What I do
Eight services, one thread: everything is measurable before and after, by you. Start with the free check of your homepage, which needs nothing from you but the domain.
Website builds
Complete WordPress sites, crawlable from day one: theme, caching, CDN, security, legal pages, structured data and analytics. The three sites further down this page are mine, and so is the one you are reading — built exactly this way. Open them and inspect anything.
Crawler and AI readiness audit
I fetch your site as Googlebot, Bingbot, GPTBot, ClaudeBot and PerplexityBot and report the real status code each one receives — plus robots.txt, sitemaps, structured data, llms.txt and Markdown negotiation. It needs your domain and nothing else: no credentials, no plugin, no access.
Technical SEO
Canonical tags, redirect chains, index coverage, render weight, and content that survives without JavaScript. Fixed at the server, CDN and cache layers — the ones that quietly fight your changes when you only touch the CMS.
Cloudflare security and performance
Full (strict) TLS, DNSSEC, HSTS, WAF rules that protect the login without blocking legitimate crawlers, and cache rules verified request by request. Security tuned so that protection never costs you visibility.
Web consulting
A second pair of eyes on your stack: hosting, DNS, TLS, email deliverability (SPF, DKIM, DMARC), caching, plugin decisions and migrations. You get the exact change, the file it goes in, and the reason — whether I apply it or your developer does.
Business email routing and deliverability
Mail that bounces, mail that arrives nowhere and is never reported, and a domain that cannot prove it sent anything. MX, SPF, DKIM and DMARC read from outside, and the routing tested against your own mail server — without opening a single message of yours.
Long-form articles, sources verified
Individual posts of 3,000+ words, in English or Spanish, where every claim links to a source that was checked before publishing. Structured data included. No filler, no invented references — if a claim cannot be sourced, it does not go in.
Ongoing care
Updates applied after a backup, logs read weekly, crawler access re-tested from outside, and two posts written a month. Priced per site, cancel any month. What it does not cover is stated as plainly as what it does.
I did all of this to my own sites first
I run four WordPress sites on my own VPS — server, CDN, cache, security and content. Every service on this page exists because I needed it myself first, and every check I sell was written because something broke on one of them and cost me hours to find.
On 24 August this same audit found my own site returning 403 to Googlebot and Bingbot. The cause was a managed CDN rule nobody had touched by hand.
And on 8 September I switched off a feature that raises the score on the agent-readiness scanner at isitagentready.com — Cloudflare’s, by the copyright in its footer — because I measured that it only worked while the page was uncached. Two days earlier that scanner rated this site Level 5, “Agent-Native”. Today it rates it Level 2, on the strength of that one check. Eleven of its fifteen checks still pass and every Markdown route still serves Markdown to anything that asks — what changed is that the site stopped advertising a behaviour it only sometimes had.
I am not going to publish endpoints that do not exist, or keep a conditional feature switched on, to move a number. And I do not display that score as a badge, for a reason I measured rather than assumed: ask the same scanner a single question and it will return its top level for a site that fails the only check it ran.
activeforgepro.com
Evidence-based training and nutrition guides.
readystatesupply.com
Emergency preparedness, for people who lose power.
barmanexpresschool.com
Bartending courses, in Spanish.
How an engagement works
Send me your domain. That is the whole intake — no discovery call, no form with twelve fields.
You get findings and a number. Every finding carries the request and the response that produced it, so you can repeat the test yourself.
Implementation, if you want it. Never without a verified backup, an agreed window and a written rollback plan.
What I will not promise
That you will appear in ChatGPT, Perplexity or AI Overviews. Nobody controls what those systems surface, and anyone selling it is guessing with your money.
What I deliver is a site that is readable and not turning crawlers away — measurable before and after, by you. That rule covers every service on this page, content included: no invented sources, no invented clients.
Notes from the server
I write up the failures that took me hours to find — the ones that leave no trace in any log, and that no dashboard reports. If you want an email when there is a new one, leave your address. One of them works through what the DNS-AID check actually requires, and the two records I rejected because they would have been false.
Send me your domain
I only need the URL to start. No access to your site is needed for the audit — I make the same public requests any visitor makes. If what you need is a build, an article or a security review instead, say so in one line and you will get a number, not a discovery call.