🛡️ RTO Lock specification

Download `rto-lock.json` to block Remote Tab Opener automation

RTO Lock is a small, declarative JSON policy. It lets a website refuse active RTO automation globally or by path prefix, without relying on fragile keyword detection.

No JavaScript. No tracking. No secret routes required. Just a clear policy file that RTO can read before active commands run.

Download universal lock file Generate custom policy

🔐 How it works

Downloadrto-lock.json
Upload/.well-known/
RTO checksbefore commands
Deny winslocked

👋 Plain-language summary

A website-level “not here” signal for RTO

Some websites are public and safe to automate. Others contain accounts, payments, healthcare, identity or administration screens. RTO Lock gives webmasters a simple way to publish the boundary.

📦 Static fileEasy to upload.

🤖 Machine-readableRTO can enforce it.

🔒 Safe by designNo executable code.

RTO Lock

Clear boundaries, visible control

The policy is not a wall against people. It is a clear instruction for Remote Tab Opener to refuse active automation where the site owner says it should not run.

⚡ Fastest setup

Universal block-all file

Download this file when you want to block all active RTO automation on a website and its subdomains. This is the best default for sensitive portals.

Download rto-lock.json

🧩 Custom policy

Allow public, block sensitive

Use the generator to allow public pages while blocking login, account, payment, checkout or admin areas. It creates the JSON for you.

Generate and download

🏦 Sensitive-site guidance

For banks and sensitive portals: block everything, reveal nothing

For banking, insurance, government, healthcare, identity, tax, payment and customer-account portals, the recommended policy is the universal block-all file.

🚫 Use default deny

Block active RTO automation without publishing detailed allow or deny paths.

🕵️ Reveal no private routes

Do not list internal account folders, payment flows, private tools or protected routes.

🌐 Cover subdomains

Use subdomain coverage when login, account or payment areas live on separate hosts.

Download universal block file

📍 Install locations

Where RTO checks

For a target page on a subdomain, RTO checks the subdomain first and then the parent domain. The root fallback makes installation easier on simple hosting.

https://sub.example.com/.well-known/rto-lock.json
https://sub.example.com/rto-lock.json
https://example.com/.well-known/rto-lock.json
https://example.com/rto-lock.json

📄 Policy format

Small JSON, no executable code

The JSON file contains a document type, a schema version, policy decisions, optional subdomain protection and optional path rules.

🧾 Document type

Identifies the file as an RTO Lock policy.

⚖️ Deny priority

deny is stronger than allow.

🌐 Subdomains

Optional coverage for child domains.

🚫 No code

No JavaScript, regex engine or executable rule.

🧭 Path rules

Custom path policy

The optional path_policy lets a site block only sensitive areas or allow only public areas.

default can be allow or deny.
allow and deny contain path prefixes.
deny always wins over allow.
Path matching is prefix-based. No regex, no glob, no executable rule.

"path_policy": {
  "default": "allow",
  "deny": [
    "/login/",
    "/account/",
    "/checkout/",
    "/payment/",
    "/admin/"
  ]
}

🔒 Example

Block everything

For banks, insurance portals, identity services, payment portals, private dashboards and administration areas.

Download JSON

🌐 Example

Public pages allowed, sensitive paths blocked

For websites that allow RTO on public content but not on login, account, payment, checkout or admin pages.