VulscanBot

VulscanBot is the security-research crawler operated by Vulscan. It performs passive, external-only security checks on websites — no logins, no form submissions, no intrusion attempts. The crawler identifies itself in server logs with a User-Agent header containing VulscanBot.

I don't want my site scanned

We honour the standard robots.txt opt-out. To stop VulscanBot from visiting your site, add the following to your /robots.txt:

User-agent: VulscanBot
Disallow: /

A blanket disallow for every bot (User-agent: * with Disallow: /) is honoured too — if you already have one, nothing else is needed. The version-suffixed token as it appears in your access logs (User-agent: VulscanBot/1.0) is recognised as well.

What happens after you opt out

• VulscanBot skips your site — no security scan runs.
• Without a scan there are no findings, so you won't receive any email notifications either.
• The opt-out applies to both bulk research and the public scanner at vulscan.app — an opted-out site can't even be tested through the web form.

The robots.txt check runs on every scan, so changes take effect immediately. If you later want to test your site yourself, just remove the entry from robots.txt.

I want my own site monitored, but I block all bots

Paying for monitoring does not override an opt-out — Vulscan Watch honours robots.txt exactly like the public scanner does, so a site with a blanket Disallow: / is skipped there too. To let VulscanBot through while keeping every other bot out, add an explicit exception above the blanket rule:

User-agent: VulscanBot
Allow: /

User-agent: *
Disallow: /

The named group wins over the blanket one, so only VulscanBot is let in. Monitoring resumes by itself on the next daily check — nothing to re-configure on our side. Only whoever controls the domain can publish this, which is exactly why we treat it as the permission to scan.

One catch: the exception overrides any broader group — a blanket User-agent: *, a partial token such as User-agent: vulscan, or a version-suffixed User-agent: VulscanBot/1.0 — because the exact-token group wins. What it cannot override is another exact User-agent: VulscanBot group: repeated groups for the same user-agent are merged, so an Allow added next to an existing Disallow: / changes nothing, whichever order they appear in. If you have one, remove its whole-site Disallow: / (rules for a subpath, e.g. Disallow: /wp-admin/, were never the blocker and can stay).

Questions or complaints

Email hello@vulscan.app — we can also remove your site from the research set manually on request.