Crawler identity

Allow Foglift through your firewall

Every Foglift audit request includes the stable token FogliftBot. One user-agent rule can recognize site audits, checks, and monitoring fetches without depending on a version number that may change.

User-agent identities

Most requests use the standard identity. A small set of compatibility checks uses a browser-shaped identity for origins that reject non-browser requests. Both contain the same bare token.

FogliftBot (+https://foglift.io/bot)Mozilla/5.0 (compatible; FogliftBot; +https://foglift.io/bot)

What FogliftBot fetches and when

Requested audits

Public pages, redirects, robots.txt, sitemaps, and guidance files are fetched when a user runs a Technical Audit or free checker.

Full-site audits

Entitled workspaces can inspect up to 100 public pages in a run. Automatic full-site coverage runs no more than weekly; manual runs have a seven-day availability window.

Monitoring and setup

Tracked pages are fetched only on the workspace's configured schedule. Setup and diagnostic probes run only when a user requests them.

Allowlist FogliftBot

Match FogliftBot with a case-sensitive contains rule. Keep the exception as narrow as your platform permits, then rerun the same URL to verify it.

Cloudflare expression

(http.user_agent contains "FogliftBot")

Cloudflare

Create a custom WAF rule using the expression below. Choose Skip and select the remaining custom rules and bot controls that blocked the request. Scope the rule to the hostname or paths you want Foglift to inspect.

AWS WAF

Add a byte-match statement for the User-Agent header, use Contains string, and match FogliftBot. Give the matching rule an Allow action and place it before the rule that blocks automated traffic.

Akamai

In Property Manager or App & API Protector, match the request header User-Agent when it contains FogliftBot. Exclude matching requests from the bot or deny behavior that stopped the audit, then activate the property version.

Fastly

Add an edge condition for req.http.User-Agent containing FogliftBot, then route matching requests around the blocking ACL or bot rule. Activate the service version and rerun the audit against the same URL.

Why we do not publish IP ranges

Foglift runs on serverless infrastructure with shared serverless egress. We do not control a dedicated outbound IP range or its reverse DNS, so publishing the hosting provider's shared ranges would create an overly broad exception that also admits unrelated services. We do not imply that an IP allowlist is available or coming.

Still blocked? Send the target URL and observed HTTP status through our contact form.