Help
Allowlisting our agent
Our agent declares itself in a published user agent, reaches your store from a fixed set of published egress addresses, and respects your robots rules. That means it can be admitted by verified identity rather than by turning bot protection down, which is a much narrower opening and the one your security team is likely to accept.
Our agent is built to be admitted narrowly rather than to get through by looking like a browser. It declares itself, it comes from a fixed set of published addresses, and it follows your robots rules. Our agent page sets out exactly which requests it checks against them.
What to allow
The current user agent string and the egress addresses are published on our agent disclosure page. Take them from there rather than from a support article, because that page is the one that gets updated.
Match on the user agent and corroborate against the addresses. A user agent alone is self declared and copyable; the pair is what makes the identity checkable.
Where the rule usually has to go
- Your CDN or WAF bot rules, which are enforcement and usually the thing actually blocking.
- Your robots.txt, which is a request rather than enforcement but should agree with the layer above it.
- Any rate limiting that would treat a short burst of page requests as abusive.
When the two layers disagree, the CDN wins and your robots file is describing a policy you do not have. See how to let honest agents through bot protection.
If you would rather not
That is a legitimate decision and the scan will report being blocked rather than pretending otherwise. It is worth knowing that the same rule applies to every other agent that identifies itself honestly, which is the population you would probably want to admit.
Questions
Where do I find the current user agent and addresses?
On the agent disclosure page, which is the authoritative source and is updated when anything changes. Read it there rather than copying the values into a rule you will not revisit.
Do I have to allowlist you to be scanned?
No, and a scan that is blocked is itself a finding: if we are turned away, so is every other well behaved agent that respects the same rules. Allowlisting removes us as a variable so the rest of the journey can be measured.