SEOFlagSEOFlag

For site owners

About SEOFlagBot

If this user agent appeared in your logs, someone asked SEOFlag to analyse one page of your site. Here is exactly what the scanner does and how to control it.

How it identifies itself

Every request carries this user agent:

SEOFlagBot/1.0 (+https://seoflag.com/bot)

How to verify it is really us

Every request is signed with an Ed25519 key using HTTP Message Signatures (RFC 9421) in the Web Bot Auth profile: the Signature-Agent header names this site and the public key is published at /.well-known/http-message-signatures-directory. A user agent string can be faked; a valid signature cannot.

What it fetches

  • The single page URL a user submitted — one GET request, following up to five redirects.
  • Your /robots.txt and, if it is not referenced there, a check for /sitemap.xml.
  • Nothing else: no crawling of other pages, no images, scripts or stylesheets, no form submissions, no repeated visits unless a user re-scans.

Each request times out after 6 seconds and reads at most 3 MB. A page is fetched at most 5 times per day per anonymous visitor and 20 for signed-in users, so the load on your site is negligible.

What it does with the page

It runs on-page SEO checks — title, meta description, headings, canonical, Open Graph, structured data, content length and similar — and shows the result to the person who requested the scan. Performance figures come from Google’s PageSpeed Insights, which fetches the page separately as Googlebot-like traffic.

Allowing it through a firewall

Bot protection such as Cloudflare often blocks automated visitors with HTTP 403. To let SEOFlag analyse your pages, allow requests whose user agent contains SEOFlagBot:

  • Cloudflare: Security → WAF → Custom rules → create a rule with User Agent contains SEOFlagBot, action Skip (skip Bot Fight Mode, Managed Challenge and remaining custom rules).
  • Other firewalls / WAFs: add a user-agent allow rule for SEOFlagBot. Scans run from serverless infrastructure without fixed IP addresses, so allow by user agent rather than by IP.

Blocking it

The scanner honours robots.txt: a Disallow for SEOFlagBot or for *stops it before the page is fetched, and the person who asked for the scan is told why. To stop scans entirely, add User-agent: SEOFlagBot / Disallow: / to your robots.txt, block the user agent in your firewall, or email info@seoflag.com.

← Back to SEOFlag