🚫 Default deny
Install one public policy file and set automation, dom, forms and file_transfer to deny.
🛡️ Responsible browser automation opt-out
Use RTO Lock to protect sensitive website areas
RTO Lock is a machine-readable browser automation opt-out policy for websites. Publish a small rto-lock.json file and Remote Tab Opener can refuse active automation before commands run.
It is designed for banking portals, insurance services, healthcare areas, identity pages, account screens, checkout flows, admin dashboards and any site that needs a clear automation boundary.
Clear signal, no hidden script.RTO Lock is declarative JSON. It tells RTO what must not be automated; it does not execute code on your website.
Download JSONUpload to siteRTO respects it
RTO Lock
Website-level automation opt-out
/.well-known/rto-lock.json
⚡ Fastest setup
Download the universal block-all file
Use this ready-made file when your website should refuse all Remote Tab Opener active automation, including DOM automation, form automation, flows and file-transfer capabilities.
Upload the downloaded file to /.well-known/rto-lock.json or /rto-lock.json.
🧩 Custom policy
Generate a tailored policy file
Allow public pages while protecting login, account, checkout, payment or admin paths. The generator downloads the file directly; no manual JSON editing is required.
Open RTO Lock Generator
🏦 Sensitive services
Sensitive websites should use the universal block-all file
For banks, insurance portals, government platforms, healthcare services and identity providers, the safest policy is often the simplest one.
🕵️ Do not expose private paths
Avoid listing internal account paths, protected workflows or private naming conventions. A minimal default-deny policy is enough.
🌐 Cover subdomains
Enable subdomain coverage when sensitive services are spread across login, account, payment or admin subdomains.
👁️ Why it matters
Good automation needs visible boundaries
Browser automation is useful when it is visible, local and user-controlled. Sensitive websites also need a clear way to say: not here.
📥 Download-first workflow
The webmaster downloads a ready-to-install file or generates a custom one.
🤖 Machine-readable policy
RTO can enforce the refusal before active automation commands run.
🔒 No executable code
The file is declarative JSON, not JavaScript.
🧭 Custom path rules
Public content can stay available while sensitive paths are blocked.
✅ Audit
Check your installation
After uploading rto-lock.json, run the PHP audit tool to confirm that the file is reachable, valid and interpreted as expected.
🛠️ Generator
Create a custom file
The generator runs locally in the browser and downloads a valid file. Use it when you need allowed and denied path prefixes or subdomain protection.
Create and download my policy
📌 Install
How to install RTO Lock
Installation is deliberately simple: publish a static JSON file at a predictable location.
- Download the universal file or generate a custom policy.
- Upload it to
/.well-known/rto-lock.json. - Fallback: if
.well-knownis not available, upload it to/rto-lock.json. - Serve it over HTTPS with public read access.
- RTO checks the policy before active automation.
❓ FAQ
Common questions
Is RTO Lock a replacement for robots.txt?
No. It is a dedicated opt-out signal for Remote Tab Opener browser automation.
Does it block normal visitors?
No. It only tells RTO to refuse active automation. It does not block browsers, users or search engines.
Can I block only sensitive paths?
Yes. Use the generator to create a policy with denied prefixes such as /login/, /account/, /checkout/ or /admin/.
No-Code workflow builder is in preparation
Remote Tab Opener is also preparing a visual no-code layer for supervised browser workflows. The public release will follow the same security principles: visible actions, explicit allow-list boundaries, protected sensitive fields, marked overlays, and respect for RTO Lock policies.
No public no-code product link is exposed yet. For now, use the SDK, examples, Copilot, documentation, and this RTO Lock security page.