These demos show the two defenses that gate who can be indexed: the page itself must opt in, and the request must come from the page’s own origin.

Non-participating page

What it tries to do: Index a page that has no OP markup — no <meta name="octo-policy">, no <link rel="octo:index">, no preload or badge pointing at the instance, no <octo-thorpe> elements.

Trigger:

fetch('https://octothorp.es/index?uri=https://www.ideastore.dev/plain-page.html')

Expected defense: Page has not opted in to indexing.

Run it

Cross-origin indexing

What it tries to do: Request indexing of a page whose origin differs from the requesting page — i.e., from demo.ideastore.dev, try to index https://someone-else.example.com/page.

Trigger:

fetch('https://octothorp.es/index?uri=https://someone-else.example.com/page')

Expected defense: Error containing different origin.

Run it