Pattern preview · 12 of 4,089 sample rules shown · site-specific intelligence stays private
We don't publish
your competitive advantage.
AgentMinds' cross-site pattern pool is the moat. Site-specific learned patterns — the things our agents discovered after fixing real production issues across the network — are never shown publicly. They are delivered, filtered, and personalised to YOUR stack only when YOUR site is connected. The 12 examples below are tier-1 generic web hygiene rules; they're here so you can sanity-check the format. The real value lives behind your API key.
Sample rules shown
12
Categories
2258
Tier-1 (public)
4,089
Tier-2 (your patterns)
private to your site
security
security-security-site-missing-permissions-policy-header-724230ad
IFSite missing Permissions-Policy header
THENAdd a Permissions-Policy header restricting browser features your site doesn't use. Even a baseline policy blocks unused features and improves the security score.
Tier 1Verified99%
security
security-security-site-missing-referrer-policy-header-4550db61
IFSite missing Referrer-Policy header
THENAdd a Referrer-Policy header to control how much referrer info leaks to other origins. strict-origin-when-cross-origin is the modern default.
Tier 1Verified99%
security
security-security-site-missing-x-content-type-options-header-d1bbaadd
IFSite missing X-Content-Type-Options header
THENAdd X-Content-Type-Options: nosniff to prevent MIME-type sniffing attacks. Single-line, no downside.
Tier 1Verified99%
security
security-security-site-missing-x-frame-options-header-4d4da3fa
IFSite missing X-Frame-Options header
THENAdd X-Frame-Options: DENY (or SAMEORIGIN if you embed yourself) to prevent clickjacking. Modern alternative is the frame-ancestors CSP directive — set both for defense in depth.
Tier 1Verified99%
security
security-security-site-missing-hsts-strict-transport-security-header-39631536
IFSite missing HSTS (Strict-Transport-Security) header
THENAdd HSTS to force HTTPS on subsequent visits. Start with a short max-age, increase to 1 year once stable. Required for hsts-preload submission.
Tier 1Verified99%
security
security-security-site-missing-content-security-policy-header-723cd178
IFSite missing Content-Security-Policy header
THENAdd a Content-Security-Policy header to block XSS and data exfiltration. Start in report-only mode to find violations before enforcing.
Tier 1Verified99%
security
security-security-site-missing-coop-coep-corp-cross-origin-isolation-d7f5a934
IFSite missing COOP / COEP / CORP cross-origin isolation headers
THENAdd Cross-Origin-Opener-Policy + Cross-Origin-Embedder-Policy + Cross-Origin-Resource-Policy to enable cross-origin isolation. Required for SharedArrayBuffer + high-resolution timers, also blocks Spectre-style cross-site attacks.
Tier 1Verified99%
security
security-security-mixed-content-detected-http-resources-on-https-pag-4c88b653
IFMixed content detected (HTTP resources on HTTPS page)
THENFind every HTTP <script>, <img>, <link>, <iframe> reference and switch to https:// (or protocol-relative //). Modern browsers block active mixed content silently — passive mixed content (images) downgrades the lock icon and breaks SEO trust.
Tier 1Verified99%
accessibility
accessibility-accessibility-no-skip-to-content-link-7b2b0bdf
IFNo skip-to-content link
THENAdd a visually-hidden skip link as the first focusable element in <body>. Keyboard users (and screen readers) need a single Tab keystroke to bypass the nav and jump to main content.
Tier 1Verified99%
accessibility
accessibility-accessibility-no-main-landmark-5fd68a86
IFNo <main> landmark
THENWrap your primary content in <main> (or set role="main" on the wrapper). Without a main landmark screen-reader users have to scan past every header/nav to find content on every page.
Tier 1Verified99%
accessibility
accessibility-accessibility-no-nav-landmark-6c402c53
IFNo <nav> landmark
THENWrap your primary navigation links in <nav aria-label="…">. The aria-label is required when you have more than one <nav> on the page (e.g. main nav + footer nav).
Tier 1Verified99%
seo
seo-seo-site-has-no-json-ld-structured-data-3f48e1ca
IFSite has no JSON-LD structured data
THENAdd JSON-LD structured data to homepage. Minimum: Organization + WebSite. Without this, AI engines (ChatGPT, Perplexity, Claude) can't extract facts about your site.
Tier 1Verified99%
Connect your site → query the full pool
What you see here is the public tier-1 slice. The full pool — tier-2 fixes derived from solved patterns at peer sites + tier-3 reference patterns — opens up once you connect. You filter by stack / agent / category through the API; auto-personalisation is on the roadmap.
Connect a site