A11yBirdBot/1.0

A11yBird loads a page in a real browser and runs automated accessibility checks against it. If you have seen us in your logs, this is what we were doing.

How we identify ourselves

Every request carries this user agent. We do not disguise ourselves as a browser and we do not rotate identities.

A11yBirdBot/1.0 (+https://a11ybird.com/bot)

What we actually do

• One page per request. A person pastes a URL and asks for it to be tested. We fetch that page and nothing else.
• We do not crawl. We do not follow links, read sitemaps, or discover further URLs. One request in, one page out.
• A fresh, isolated browser session every time. No cookies, storage or cache carry between scans, and nothing persists afterwards.
• We give up quickly. Navigation times out after 20 seconds. We do not retry in a loop.
• We only read. We do not submit forms, click through flows, or attempt to sign in.

robots.txt

We want to be precise here rather than reassuring.

It depends which of the two things we are doing.

A single-page scan does not read robots.txt. Its crawl directives govern automated discovery — a robot deciding for itself which URLs to visit. A single scan does not do that: it fetches exactly one page, named explicitly by a person, in direct response to their request. That is closer to someone opening the page in their own browser than to crawling. If you want us to stay away from a URL entirely, block the user agent above; that works today and we will not route around it.

A whole-site Flight does read robots.txt, because that genuinely is automated discovery. We read your Sitemap: entries, honour Disallow: rules, and wait for the interval named by Crawl-delay: if you set one.

Two user agents, and why

This is the part most likely to waste your time if we do not spell it out.

We prefer your sitemap, and when we read it the request comes from A11yBirdBot/1.0 as you would expect. But if a site has no usable sitemap we fall back to following links, and that stage runs on Cloudflare’s crawling infrastructure, which identifies itself as:

CloudflareBrowserRenderingCrawler/1.0

We cannot change that string, and it is the one your robots.txt will be matched against during link discovery. So a rule naming only A11yBirdBot/1.0 will not apply to that stage — in either direction. If you want to allow us, allow both. If you want to block us, blocking A11yBirdBot/1.0 stops the scanning, and we would rather tell you plainly that the discovery stage travels under a different name than have you find out from your logs.

Whole-site crawls

A Flight visits many pages of one site rather than a single page. If you have seen a burst of our traffic rather than one request, this is what it was.

• We only crawl domains someone has proven they control. Before a Flight runs, a DNS record, a file at /.well-known/a11ybird.txt, or a meta tag has to carry a token we issued. We are not a crawler anyone can point at a site they do not own.
• Two requests at a time, at most. Roughly twenty pages a minute. We deliberately run slower than our own infrastructure allows, because the risk we care about is your server, not our throughput.
• We read robots.txt and honour Disallow and Crawl-delay. If you set a delay, we wait for it.
• We prefer your sitemap. When one exists we read it instead of following links, which is fewer requests for you and a more accurate list for us.
• We only read. No forms, no sign-in, and we skip cart, checkout, admin and logout URLs by default.

If you are on Cloudflare

This is the easiest way to let us through, and it needs no user-agent matching. Our traffic carries Cloudflare bot detection IDs, and a WAF skip rule on them is precise:

• 119853733 — page scanning
• 128292352 — link discovery

Allowlist both. They correspond to the two user agents above, and permitting only one produces the confusing half-failure where we can find your pages but not test them, or the reverse.

Letting us through

Bot protection frequently blocks us. When that happens we report it as “we couldn’t reach this page” and produce no result at all, because scoring a security-check page would describe something you never asked about.

To allow us, add a rule matching the user agent above — in Cloudflare that is a WAF skip rule; most providers have an equivalent. For a whole-site Flight, add the same rule for CloudflareBrowserRenderingCrawler/1.0, for the reason described above.

We cannot give you an IP range. Our browsers run on shared infrastructure and the addresses change without notice. Anyone publishing a fixed list for a service like ours is publishing something that will quietly stop being true.

Contact

If A11yBirdBot is causing you a problem, we would rather hear about it than have you block it silently. Write to bot@a11ybird.com.