WebSentry
Log inSign up free

The WebSentry scanner

What our scanner is, what it requests, and how to let it through your firewall.

How to identify it

Every request the scanner makes carries this user agent:

WebSentry/1.0 (+https://websentry.dev/bot)

Its IP addresses are not fixed, so match on the user agent rather than an address.

What it does

Requests your home page, and robots.txt, to read the headers you serve.
Follows redirects, up to five, staying on public addresses only.
Reads DNS records for SPF, DMARC, DKIM, CAA and DNSSEC.
Runs only when someone asks for a scan, or on a schedule a customer set up.

It does not crawl your site, submit forms, attempt logins, or test for vulnerabilities. It reads what any visitor's browser would receive.

Why your report may be incomplete

Bot protection answers with a challenge page instead of your site. That page carries none of your headers — so we cannot see your CSP, HSTS or cookie settings, and we say so rather than report them as missing.

Checks we could not run are marked Not scanned and left out of your score, so the grade reflects what we could actually reach.

Letting it through

Vercel

Firewall → Custom Rules → new rule. Condition: User-Agent contains WebSentry. Action: Bypass.

Cloudflare

Security → WAF → Custom rules. Expression: http.user_agent contains "WebSentry". Action: Skip, and tick the managed rulesets you want skipped.

Anything else

Allow requests whose user agent contains WebSentry. A scan makes a handful of requests, so no rate limit needs changing.

Seeing something you did not expect?

If traffic claiming to be WebSentry looks wrong, tell us at our contact page with the timestamp and we will check it against our logs. Anyone can put a string in a user agent, and we would rather know.