Let Scout through your bot protection
BetaScout signs every request it sends to your site as Flamio's, so your bot protection can recognize it and let it in — or keep it out.
Scout opens your site in a real Chrome browser, so its requests look like a visitor's. To tell them apart, Scout signs every request to your site with Flamio's key. It uses Web Bot Auth, the open standard for identifying automated visitors, built on HTTP Message Signatures (RFC 9421). Cloudflare checks these signatures.
What each request carries
| Header | What it holds |
|---|---|
Signature-Agent | "https://flamio.org" — who signed the request |
Signature-Input | What the signature covers: your site's host and the Signature-Agent header, when it was made and when it expires |
Signature | The signature itself |
Each signature is valid for one minute and only for the host it was sent to. Flamio's public key is published at https://flamio.org/.well-known/http-message-signatures-directory. That answer is signed with the same key, so only Flamio can publish it.
Let Scout in
Check what your protection supports
If your bot protection verifies Web Bot Auth signatures, it can identify Scout as Flamio on its own. Allow that bot in its settings.
Otherwise, allow requests signed with Flamio's key
Write a rule that verifies the signature against the key above before it lets the request in. Do not trust the Signature-Agent header alone: anyone can send it, but only Flamio can sign with its key.
Launch the run again
Open Flamio Scout and launch the audit again.
Keep Scout out
Refuse requests whose Signature-Agent is "https://flamio.org". Scout visits a site only during an audit run.
Limitations
- Scout does not solve CAPTCHAs — a signature does not answer one. Instead, point the run at an environment without the challenge, or allow Scout as above.
- Scout signs requests to your site — your domain and its subdomains. What the page loads from other domains (a CDN on its own domain, analytics, embeds) goes unsigned, so no third party receives Flamio's signature. Instead, allow those hosts separately if they sit behind the same protection.
- Scout signs what its browser sends. Its read of your sitemap (
/sitemap.xml) is not signed. Instead, keep the sitemap open, or Scout finds your pages through links alone.