The Percelia scanner

The signature

Anyone can put a name in a user agent, which is why a firewall is right not to believe one. So every request we make signs itself, cryptographically, with a key whose public half sits under our own domain. Your firewall can verify for itself that the request really came from us, without asking us and without taking our word for it. The method is an open standard (Web Bot Auth, built on RFC 9421) and Cloudflare, AWS and Akamai check it.

A signature is valid for one minute and only for the exact host the request went to, so it cannot be captured and reused elsewhere. That cuts both ways, deliberately: if you want to keep us out, this lets you keep out precisely us and nobody else.

What the scanner does

• It loads pages like a browser, with CSS and JavaScript, and then measures what someone using a screen reader, a keyboard or strong magnification would find.
• It only runs when someone starts a scan: a free test, a commissioned audit, an agreed monitoring schedule. It does not crawl the web on its own initiative.
• It visits representative templates rather than every address - a home page, a category, a product, a form. That is a handful of requests, not a thousand.
• It writes nothing. When it triggers a form to check the error messages, it aborts every outgoing request that would change something. No order, no account, no record is created.
• It does not collect your content for anything else: no training, no resale. For audits behind a login, credentials and personal data are stripped from everything we keep.
• If your server answers HTTP 429, it waits the interval you named and asks at most once more. If a bot check or a captcha stands in front of the page, it stops and reports that to whoever ordered the scan. We do not circumvent protection mechanisms.

If you would rather not have us

Add this to your robots.txt. We read it before every run and honour it.

User-agent: PerceliaScanner
Disallow: /

One exception, so it holds no surprise: if the site is yours and you order the scan yourself, your order governs. You can have your own site audited even when your robots.txt excludes bots.

If you want to let us through

If your firewall blocks us, there is no result at all, neither a good one nor a bad one. The cleanest route is to verify the signature: anything that supports Web Bot Auth lets us through without a rule of your own. Otherwise, in Cloudflare, AWS WAF, Akamai or Fastly, add an exception for the identity above, optionally together with our IP address. We always ask for that exception rather than working around it.