Security home RTO Lock spec Generator Audit form Results What is checked
RTO Lock audit

Audit your rto-lock.json installation

Check whether a public website exposes a valid RTO Lock policy. The audit confirms whether the file is reachable and valid without displaying private path lists or the raw policy content.

Enter domainPass local CAPTCHAGet private result
Audit
1Check public locations.well-known + root
2Validate JSONrto.lock
3Keep details privateno raw policy
4Report resultvalid / invalid
Audit form

Audit your domain

Enter the public website address to confirm that an RTO Lock policy is installed and valid. The public result stays deliberately simple: valid, missing or invalid.

The audit rejects local, private and reserved network targets. It does not execute remote code and does not display the raw policy file.

Security code

Confirm the audit

Copy the 5 digits shown in the image into the boxes below, then run the audit.

Security code

Minimal tested-domain statistics are stored outside the public website root.

What the audit checks

The tool checks the recommended public RTO Lock policy locations and validates the JSON structure, the document_type, the schema_version, policy values, the subdomain flag and optional path rules.

It does not execute remote code, does not show the raw policy and rejects local, private or reserved network targets.

For sensitive services such as banking, insurance, identity, healthcare, payment and government portals, the recommended policy is a simple universal block-all file with no internal path lists.

Recommended next step

Need a valid file?

Download the universal block file or generate a custom policy, then run this audit again after uploading it to your website.

Download universal block fileGenerate custom file