Skip to main content

Verified Bots

Osano uses Web Bot Auth to sign compliance check requests, so your firewall can verify Osano's identity. Signing is enabled by default for customer organizations. Requests to the monitored hostname and its leading www alias carry the OsanoBot User-Agent and a signature.

Configure access​

For Cloudflare, use the Verified Bots setup guide. For other providers, add Custom Headers and configure a header-based access rule. The requests remain signed.

Osano's signing identity is https://bots.osano.com. The OsanoBot identity page explains the signing headers and provides the public key directory for verification.

Allow access in robots.txt​

Signed scans follow the OsanoBot rules in your site's robots.txt. Add a group for the pages you want scanned, and allow the scanner to retrieve /robots.txt through your firewall.

To allow the whole site:

User-agent: OsanoBot
Allow: /

To exclude a specific path:

User-agent: OsanoBot
Allow: /
Disallow: /private/

Check the result​

Run a new compliance check after saving your settings. The Cloudflare guide explains how to confirm that Cloudflare recognizes the requests as verified bots.