PrimafonteBot

Where it comes from

A scan comes from two different places. The download of the page, the robots.txt and the sitemap runs on Vercel infrastructure, from addresses that rotate and that we cannot publish. The real browsing, the part that executes JavaScript, always arrives from the fixed address shown below. That is why, if you want to allow us, do it by User-agent: authorising only that IP leaves out the part that downloads your page.

IPv4 address: 62.238.60.218

If this address changes, it will be announced here before it is used.

How to allow PrimafonteBot

If your firewall or your CDN returns a block, the scan never gets to read your site and the report comes out with no score. Allowing us is done by user-agent and not by IP address, for the reason the previous section gives: the part that downloads your page comes from rotating addresses.

With Cloudflare in front, this is the rule. It is created under Security → WAF → Custom rules, placed first in the list and given the «Skip» action over the remaining rules, the WAF managed rules and Super Bot Fight Mode. Rate Limiting is left untouched: the crawler already limits itself to five scans an hour.

Cloudflare rule

(http.user_agent contains "PrimafonteBot" or ip.src eq 62.238.60.218)
and not starts_with(http.request.uri.path, "/api/")

• The second line is not spare. Anyone can forge a user-agent, so without it the rule hands a firewall bypass to whoever sends that header, your API included. With it, the worst an impersonation achieves is reading pages that are already public.
• On Cloudflare's free plan, «Bot Fight Mode» cannot be skipped with WAF rules. If it is on, the rule may not be enough: check it under Security → Bots.
• Testing it with curl from a home connection proves nothing, because from there the site is most likely already answering normally. The only valid check is to scan the domain again on primafonte.org.

How to block PrimafonteBot

With two lines in your robots.txt. PrimafonteBot respects it, so it will stop requesting your site even if someone types your domain into the scan form. There is no need to touch your firewall or to write to us: the change takes effect on the next attempt, and it is undone by removing those same two lines.

User-agent: PrimafonteBot
Disallow: /