Does FlawPilot change my site automatically?

No. FlawPilot generates the fix and explains it, but a human always stays in the loop - it never applies a change to your server or code on its own.

Can I use my own AI assistant instead?

Yes. Every finding includes a "Copy prompt" option that gives you a ready-made prompt to paste into ChatGPT, Claude, or Cursor, so your own tool can generate or apply the fix.

Do I need a security background to apply these?

No. Each fix is written in plain English with the exact steps and copy-paste config. Most are a header, a DNS record, or a config line - not a rewrite.

Is the fix included in the free scan?

The fix for the top issue in every pillar (security, performance, infrastructure, SEO) is included free. Deeper, per-finding fixes and a full-site remediation roadmap are available beyond the free report.

AI recommendations

Every finding comes with the fix, written for you

Knowing what's broken is only half the job. For each finding, FlawPilot generates a ready-to-apply fix - the exact header, config, DNS record, or code patch - with a plain-English explanation of why it happens and how to verify it. Stop researching; start shipping.

Scan my site View documentation

AI fixes are generated per finding on your scan report. No security background required - each fix is explained in plain language.

MEDIUM

Your site can't use the strongest isolation

This works alongside the opener policy to fully separate your pages from other sites' resources.

Security

AI-generated fix · Ready

Add the Cross-Origin-Embedder-Policy HTTP response header with a value of require-corp or credentialless.

Full explanation, step-by-step remediation, and copy-paste config below.

See an AI fix in action

This is exactly what you get on the report for a real finding - the fix, the reasoning, the steps, and copy-paste config.

MEDIUM

Your site can't use the strongest isolation

This works alongside the opener policy to fully separate your pages from other sites' resources.

Security

AI-generated fix · Ready

Add the Cross-Origin-Embedder-Policy HTTP response header with a value of require-corp or credentialless.

Why this happens

The response does not include a Cross-Origin-Embedder-Policy (COEP) header, so the browser cannot enforce cross-origin isolation for the page. Without COEP, the page is more vulnerable to cross-origin side-channel attacks (such as Spectre) and cannot access high-resolution timers or SharedArrayBuffer in a fully isolated context.

How to fix it

1Choose a COEP policy: use require-corp for full cross-origin isolation (all cross-origin resources must opt in via CORP or CORS); use credentialless to block no-credential cross-origin resources without requiring CORP changes.
2Configure your web server, CDN, or application to send Cross-Origin-Embedder-Policy on every HTML response.
3If you use require-corp, verify every cross-origin subresource sets Cross-Origin-Resource-Policy: cross-origin or is served with appropriate CORS headers.
4For full isolation (SharedArrayBuffer, etc.), also set Cross-Origin-Opener-Policy: same-origin.
5Deploy and test with curl -I https://example.com/ and the DevTools Network panel to confirm the header is present.
6Monitor for broken cross-origin resources and switch to credentialless if require-corp is too restrictive.

Apply this

# Nginx: add to the server or location block
add_header Cross-Origin-Embedder-Policy "require-corp" always;

# Alternative value if you do not need full cross-origin isolation for subresources:
# add_header Cross-Origin-Embedder-Policy "credentialless" always;

Prefer your own AI tool?

Copy a ready-made prompt for this finding into ChatGPT, Claude, or Cursor.

What gets copied

I'm fixing a security finding on my website.

Finding: Your site can't use the strongest isolation (MEDIUM, Security)
Detail: The response does not include a Cross-Origin-Embedder-Policy (COEP) header, so the browser cannot enforce cross-origin isolation for the page.
Recommended fix: Add the Cross-Origin-Embedder-Policy HTTP response header with a value of require-corp or credentialless.

My stack: Nginx in front of a Next.js app.

Give me the exact config change, tell me where it goes, and explain what could break for cross-origin resources so I can test it before shipping.

What an AI fix gives you

The exact fix, not just the problem

A concrete change to apply - the header value, the DNS record, the config block - not a vague "add a security header" pointer.

Why it happens, in plain English

A short explanation of the root cause and the risk, so you understand the fix instead of pasting it blindly.

Copy-paste ready

Config for Nginx, Apache, or your platform, plus a one-click copy. Or copy a ready-made prompt to run in ChatGPT, Claude, or Cursor.

How it works

Step 01

Run a scan

Scan your live URL. FlawPilot finds security, performance, infrastructure, and SEO issues across your public surface.

Step 02

Open any finding

Each finding on the report carries an AI-generated fix: what to change, why it matters, and step-by-step remediation.

Step 03

Apply and verify

Copy the ready-made config or code, apply it, and use the included verify step (a curl command or DevTools check) to confirm it's live.

Good to know

AI fixes are generated on your scan report - run a scan to see them.
The top fix in every pillar is included in the free report.
A human stays in the loop: FlawPilot never auto-applies a change to your site.

Questions about AI fixes

For each finding: the exact change to make (a header value, DNS record, config block, or code patch), a plain-English explanation of why the issue happens and its risk, step-by-step remediation, copy-paste config for common servers, and a way to verify the fix is live.

Ready when you are

Turn findings into fixes

Scan your site and get a ready-to-apply fix for every issue - explained, prioritized, and copy-paste ready.

Scan my site, free