WardzoBot

WardzoBot is the scanner behind Wardzo, a website monitoring service. It checks websites that a Wardzo user asked us to scan, using passive, non-intrusive requests only.

How to recognise it

Requests identify themselves with this user agent:

WardzoBot/1.0 (+https://wardzo.com/bot)

To compare what search engines and visitors see (cloaking detection), a scan also makes one homepage request with a browser user agent that includes WardzoBot/1.0, and one with a Googlebot user agent. That Googlebot-identified request comes from our servers, not Google.

What it does

• Fetches your homepage, robots.txt, your XML sitemap and up to 24 more same-site pages, following robots.txt rules for WardzoBot (and *).
• Downloads the JavaScript files those pages load, to look for leaked secret keys.
• Requests a short fixed list of well-known sensitive paths (such as /.env or /.git/HEAD) exactly once each, to check they are not public.
• Connects over TLS to read your certificate and checks HTTP response headers.
• For monitored sites: one homepage request every 15 minutes for uptime.

What it never does

• No port scanning, password guessing, form submission or exploit payloads.
• No requests to private or internal networks.
• No more than 2 parallel requests to a site, with pauses between page fetches, and responses capped in size.

Opting out

To stop WardzoBot from crawling pages, add this to your robots.txt:

User-agent: WardzoBot
Disallow: /

Note that a scan still reads robots.txt itself, the homepage response headers and certificate. To block scans of your domain entirely, or to report a problem, email support@wardzo.com and we will add it to our blocklist.