We ran our listing checks against all 701 sites we list. The metadata was fine. Twenty-six would not let us read the page at all.

When somebody submits a tool here, we read their page and fill in the listing from it — name, description, categories, logo, screenshot. When that fails, they get an empty form and usually give up.

We had never asked how often it fails, or why. So we pointed the same checks at the 701 sites already in our catalogue and wrote down what happened.

The metadata is not the problem

Of the 673 sites that answered a plain request:

We expected this to be the story and it is not. If you ship a product in 2026, your build tool has already given you a title, a favicon and a meta description. The advice to "make sure you have a meta description" is real but it is aimed at a problem 4% of sites still have.

The one worth attention is og:image — 97 sites, 14%, do not have a usable one. That is the image that appears when somebody shares your link, and unlike the others nothing generates it for you by default.

Twenty-six sites would not let us read the page

This is the actual failure mode, and it is invisible until you go looking.

Twenty-six of the 701 returned HTTP 403 to our request. Two more failed for other reasons. So 4% of the catalogue could not be read at all — and no amount of good metadata helps, because nothing gets as far as reading it.

They split cleanly in two:

Eleven blocked our user agent. We asked with a custom one that identified itself as ours. When we asked again with an ordinary browser user agent, they returned the page. These sites are refusing things that look like robots, which is a defensible choice, and it means the block is a setting rather than a wall.

Fifteen refused either way. Fourteen of those returned a Cloudflare bot challenge — cf-mitigated: challenge in the response headers. That is not a ban. It is a demand for a browser that can run JavaScript and solve a puzzle, and a plain HTTP request cannot, by design.

Here is the part worth sitting with. The fifteen include ChatGPT, Claude, Canva, Midjourney, Perplexity, Lovable, Make, Ideogram, Leonardo, Looka and Magnific.

Every one of them is large enough that a human being will type their listing in by hand. We did. They are in this catalogue because someone decided they had to be, not because a form filled itself in.

Which is exactly why it matters more if you are small

A well-known product behind a bot challenge loses nothing. Directories list it anyway, journalists write about it anyway, and the challenge does its job of keeping scrapers off.

A tool nobody has heard of behind the same challenge is simply skipped. The directory's form comes back empty, the person submitting it shrugs, and the listing never happens. Nobody tells you this occurred. There is no error in your logs, because the request never reached your application — Cloudflare answered it for you.

If you are launching and you want to be listed in places, this is worth five minutes:

Check what your site returns to something that is not a browser. curl -I https://yoursite.com from a terminal is enough. A 200 means you are readable. A 403 means every automated lister, preview generator and link unfurler is getting the same answer.

If you are on Cloudflare, look at Bot Fight Mode and your WAF rules. The aggressive settings challenge everything that is not a real browser. You can keep protection on and still allow verified crawlers, which is usually what you actually wanted.

Decide deliberately, then leave it. Blocking robots is a legitimate choice, especially now. The failure is not choosing it — it is having it switched on by a default you never looked at, and wondering why nothing links to you.

What this says about our own tool

Our prefill reads HTML. If your page is behind a challenge, it cannot read it and the form comes back empty — we get this wrong for the same 15 sites as everyone else, and we did not build a way around it. We show what failed rather than pretending it worked, and the form still submits by hand, but that is a fallback, not a fix.

What we are not claiming

One request per site, from one machine, on 9 August 2026. Bot protection reacts to IP reputation and request patterns as well as user agent, so a different machine on a different day would get a slightly different list. The 4% is a floor for how often this happens, not a precise rate.

The duplicate check in our audit passed on all 673, which means nothing at all here — we ran it with no catalogue to compare against, so it could not have failed. It is left out of the table above rather than reported as a result.

Six checks, run by the same code that runs when you submit a tool. If your page is readable, most of the form fills itself.