Allowlisting TagAudit

One firewall rule, on a domain you have verified, so your scans see your real site instead of a bot challenge.

Who this is for

Domains you have verified you control. We do not publish this as a general bypass and we cannot allowlist ourselves — the rule lives in your infrastructure and only you can add it.

If you have not verified the domain yet, do that first; it is a DNS TXT record or a meta tag and takes about two minutes.

The address

Not assigned yet — and here is how to get it.

The scanner's address is issued when the service goes live. We are not printing a placeholder here, because an address you open a firewall to has to be right.

What to do now: verify the domain — a DNS TXT record or a meta tag, about two minutes. Verified domains get the address the moment it exists. Everything below tells you exactly which setting the rule goes in, so you can line it up with whoever owns the firewall before you need it.

Why you would bother

A bot-protection product cannot tell our scanner from any other automated client, because at the network level there is no difference. When it challenges us, the page we receive is the challenge — not your site. The scan then reports what it actually saw, which is a page with almost no tracking on it.

That failure is visible in your report rather than silent: the scan is marked incomplete and withholds a score rather than publishing a clean-looking result from a page that was never yours. It is still a wasted scan, and allowlisting is what recovers it.

Signs you are hitting this: a stack that is far emptier than you know it to be, a score withheld with a capture warning, or a report whose page title is your security vendor's rather than yours.

Where this sits in the tiers

Free scan — no cooperation. Any public URL, nothing to install, nothing to configure. Works on sites you do not own, which is the point: prospect research, competitor teardowns, a client who has not onboarded yet. Subject to whatever bot protection sits in front.

Paid audit — one firewall rule. ← you are here. Verify the domain, allowlist one address, and the scanner reaches your real site consistently. This is the only thing we ask you to change, and it is reversible in the same click that made it.

Deep scan — opt-in, and only if you ask. Logged-in journeys, checkout and purchase confirmation cannot be reached from outside at all. Covering them means running the collection inside your own session, which we do only on request. It is never the default and it is never switched on quietly.

The ask goes up with what it unlocks, and it stops where you stop it.

Adding the rule

Menu names move around between releases, so what matters is what the rule has to do: allow this one address, scoped to your site, ahead of whatever is currently challenging it. Below is where that setting lives today in the products we see most.

Cloudflare

Security → WAF → Custom rules. Create a rule matching ip.src equal to the address above, and set the action to Skip. Skip lets you name what to bypass — select the managed rules, rate limiting and, importantly, Bot Fight Mode / Bot Management, which is usually what challenges a scanner. Order it above your blocking rules.

The older Tools → IP Access Rules path with an Allow action also works and is quicker, but it does not always take precedence over bot management. If the scan still returns a challenge page, move it to a Skip rule.

AWS WAF

Create an IP set containing the address (as a /32), then add a rule to your web ACL referencing that set with the Allow action, at a lower priority number than the rules doing the blocking — priority is evaluated ascending, so a lower number runs first.

Wordfence (WordPress)

Wordfence → Firewall → All Firewall Options → Allowlisted IP addresses. Add the address on its own line. If you also run Wordfence's rate limiting, add it to "Whitelisted 404 URLs / IPs that bypass rate limiting" as well — the firewall allowlist and the rate limiter are separate settings and only allowlisting one of them is the usual reason a scan still fails.

Sucuri

Firewall (WAF) → Access Control → Allowlist IP addresses. Add the address. Sucuri caches aggressively; allow a few minutes before re-running.

Akamai, Imperva, DataDome, and similar

All support an IP allow or exception list, but the setting is usually in a policy your hosting or security team owns rather than in a self-serve panel. The request to send them: "Please add an allow/exception entry for this IP on the bot-protection policy for this hostname."

nginx or Apache, self-managed

If you are blocking at the server rather than at an edge vendor, allow the address ahead of the deny. In nginx that is allow <address>; before deny all; in the relevant location block. If you run ModSecurity, the address needs a rule exclusion, not just a network allow.

Check that it worked

Re-run the scan and look at the report header. A scan that got through names your site and returns a populated stack; a scan still being challenged is marked incomplete and withholds the score. If it is still incomplete after a few minutes, the usual causes in order are: a second product also filtering (a CDN in front of an origin firewall), a rate limiter that was a separate setting from the firewall allowlist, or an edge cache still serving the challenge.

Scope it, do not widen it

Worth saying plainly, because we are asking you to open something:

Scope the rule to the hostname you are scanning, not to your whole account or every property you manage.
Skip only what is in the way. Bot management and rate limiting are usually enough. There is no reason to disable your managed rule set for us — we send ordinary page requests.
An allowlist is not access. It removes a challenge for one address; it does not grant a login, and it does not let us reach anything a logged-out visitor could not already reach.
We scan when you ask. Allowlisting does not schedule anything or give us standing permission to run.

Removing it

Delete the rule wherever you added it. Nothing on our side depends on it and nothing breaks except that scans go back to being challenged. If you stop using us, remove it — see below for why that matters more than it sounds.

If the address ever changes

We will tell verified customers before it does, and this page is the canonical copy — check here rather than an old email.

The reason this is not just housekeeping: cloud providers recycle addresses. If we release this one and you have left the rule in place, it eventually belongs to someone else, and your firewall is holding an exception for a stranger. A stale allowlist entry is a hole with our name on it and somebody else behind it. That is true of every vendor who asks you to do this; most do not mention it.