--- title: "Letting our agent through your CDN" source: "https://ottom.io/docs/cdn" summary: "Ottom’s agent identifies itself with a published user agent and reaches your store from a small set of published addresses. To let it through your CDN’s bot protection, add one rule that matches both and skips only the bot checks. These pages give that rule for Cloudflare, Fastly, Akamai, AWS, Azure, Google Cloud and Vercel." --- # Letting our agent through your CDN Ottom’s agent identifies itself with a published user agent and reaches your store from a small set of published addresses. To let it through your CDN’s bot protection, add one rule that matches both and skips only the bot checks. These pages give that rule for Cloudflare, Fastly, Akamai, AWS, Azure, Google Cloud and Vercel. ## What a block looks like in a report - Bot protection blocks the agent before the storefront loads (https://ottom.io/learn/stalls/bot-wall): Your CDN answered with a challenge page instead of your store, so the scan could not see a product at all. - The store refused the product page to the agent (https://ottom.io/learn/stalls/product-page-refused): A product page came back as a 403, 429 or 503 twice, ten minutes apart. A firewall rule or a rate limit usually explains it. - The store refused the agent’s add to cart (https://ottom.io/learn/stalls/cart-add-refused): Pages loaded, but the add to cart request was refused, often by a challenge on the cart endpoint alone. ## What to match - User agent starts with `OttomAgent/`. The full string is `OttomAgent/1.0 (+https://ottom.io/agent)`, with `Mobile` added when a check walks your store at phone size. - Source address is one of those in https://ottom.io/agent/ips.json, also listed at https://ottom.io/agent#addresses. ## The rule, on any provider - Match the user agent and the address together. A user agent is self declared and anyone can copy ours. Only our addresses send it from https://ottom.io/agent/ips.json. - Keep the addresses in a named list, filled from that file, rather than typed into the rule. When the list changes you edit one place. - Skip the bot checks, challenges and rate limits for requests that match. Keep the rules that look for attacks in the request itself, such as SQL injection, where your provider lets you keep them apart. - Put the rule first, or ahead of the bot and rate limit rules, so nothing earlier challenges the request before it is reached. - Do not match on the From header alone. We send agents@ottom.io on requests to your own pages, but not to assets on another host name, and it is as easy to copy as a user agent. - Run a scan afterwards. A report with no bot protection finding is the proof the rule works. ## Step by step, by provider - Allowing our agent through Cloudflare: https://ottom.io/docs/cdn/cloudflare. Custom rules with Skip, IP lists, Super Bot Fight Mode, and the free plan’s Bot Fight Mode. - Allowing our agent through Fastly: https://ottom.io/docs/cdn/fastly. Next-Gen WAF lists and request rules, and an ACL for VCL services. - Allowing our agent through Akamai: https://ottom.io/docs/cdn/akamai. Bot Manager custom bot categories, client lists, and activation. - Allowing our agent through AWS WAF and CloudFront: https://ottom.io/docs/cdn/aws. IP sets, an AND rule with Allow, rule priority, and a Bot Control scope down. - Allowing our agent through Azure Front Door: https://ottom.io/docs/cdn/azure-front-door. WAF policy custom rules, SocketAddr, priority, and the Bot Manager rule set. - Allowing our agent through Google Cloud Armor: https://ottom.io/docs/cdn/google-cloud-armor. Security policy rules, the rules language, and priority. - Allowing our agent through the Vercel Firewall: https://ottom.io/docs/cdn/vercel. Firewall custom rules with Bypass, for stores hosted on Vercel. ## Stores on Shopify and other hosted platforms Shopify, Wix, Squarespace and other hosted platforms run their own CDN and bot protection in front of every store, and a merchant cannot add rules to it. If a scan of a store on one of them reports bot protection, the block is the platform’s, not yours. Tell us from the report and we look at that scan. If you put your own CDN in front of a hosted platform, the guide for that CDN still applies to the part you control. ## Keeping the addresses current The addresses change rarely. When they do, https://ottom.io/agent/ips.json and our agent page change on the same deploy, because both read the same setting. Check the file when you review your firewall, or have a scheduled job read it and update your list. The file follows the shape Google and other crawler operators use for their own address lists (a creationTime and a list of prefixes), so a script that already reads one of those reads ours. A store under an Enterprise Plus contract with a dedicated address can allow that address instead: it is the one your contract names. ## Questions ### Do I have to allow your agent? No. A blocked scan is reported as a block, never as a pass or a stall it did not see. It is worth knowing that the same rule turns away every agent that identifies itself honestly, which is the kind you would probably want to admit. ### Is it safe to allow a bot by its user agent? Not by the user agent alone, which is why every rule here also matches the address. A request with our user agent from any other address is not us, and the rule leaves it to your bot protection as before. ### Will this let other AI agents through? No. The rule matches our user agent from our addresses and nothing else. Whether to admit other agents is a separate decision, made in your provider’s bot settings. ### Does the rule switch off my firewall for you? It should not, and the guides avoid it. They skip bot detection, challenges and rate limits, which are what turn an honest agent away, and keep the rules that inspect a request for attacks wherever the provider lets the two be separated. ### How many requests will the rule let through? No more than our own limits allow. Any one store gets a small number of agent journeys and retrieval checks a day, counted across everyone who asks. The limits page has the numbers.