QualiBooth Bot

QualiBooth Bot is the browser that QualiBooth uses to run accessibility scans. This page explains what it does, how to identify it, and how to allow or block it on your site.

What it is

QualiBooth is a web accessibility testing platform. QualiBooth Bot visits pages that QualiBooth customers have configured for accessibility scanning: scheduled scans, on-demand scans and Deep Scan.

It only visits URLs that a customer has added to a scan configuration. It does not crawl the web or follow links to sites that no customer has added.

Behavior

• Real browser. Each page is loaded and rendered in a Chromium-based browser, including JavaScript, CSS and images, so the scan sees the page as a visitor does.
• Desktop and mobile. Each URL is checked at a desktop and a mobile viewport, so a single scan usually produces more than one request per URL.
• Screenshots. Deep Scan takes screenshots of the rendered page as evidence for the issues it finds.
• Limited interaction. To test dialogs, focus handling and dynamic content, Deep Scan clicks and presses keys on the page in a limited way. It never activates anything that looks like it deletes, removes, signs out, unsubscribes, pays, checks out, places an order, publishes or archives.
• No login unless configured. The bot only signs in when the customer has added credentials for a dedicated test account to the scan configuration.
• Schedule. Scans run when the customer starts them, or on the daily, weekly or monthly schedule the customer chooses.
• Request rate. The customer can limit how fast pages are scanned, from 10 pages per second down to 1 page every 10 seconds.

User-agent

QualiBooth Bot sends this user-agent string:

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 (compatible; QualiBooth/1.0; +https://qualibooth.com)

The Chrome version number changes when the browser is updated. To identify the bot, match the QualiBooth/ token rather than the full string.

IP addresses

Requests from QualiBooth Bot come from the IP addresses listed in:

https://docs.qualibooth.com/bot/ips.json

The current addresses are:

35.242.192.27
34.40.42.164

This list is kept up to date. If you allowlist the bot by IP address, read the list from that URL instead of copying the addresses by hand.

Customer proxies

A QualiBooth customer can choose to run their scans through their own proxy server. Those requests come from the customer's proxy, not from the addresses in ips.json.

How to verify a request

A request comes from QualiBooth Bot only if both of these are true:

1. The User-Agent header contains QualiBooth/.
2. The source IP address is in ips.json.

The user-agent alone is not enough, because anyone can send any user-agent string.

How to allow it

In each example, qualibooth_bot is an IP list that you create from the addresses in ips.json.

Cloudflare

1. Go to Manage Account → Configurations → Lists and create an IP list named qualibooth_bot that holds the addresses from ips.json.

2. In your zone, go to Security → WAF → Custom rules and create a rule with this expression:

   (http.user_agent contains "QualiBooth/" and ip.src in $qualibooth_bot)

3. Set the action to Skip, and select the features to skip, such as Super Bot Fight Mode, rate limiting rules and managed rules.

4. Place the rule above any rules that block or challenge bots.

Vercel

In your project, go to Firewall → Configure and add a custom rule:

• If IP Address matches any address from ips.json, and User Agent contains QualiBooth/
• Then Bypass

Turn on Bypass system-level mitigations if Vercel's bot protection is challenging the bot.

Akamai

In Bot Manager, add the addresses from ips.json to an allowlist, and set it to allow requests that match both those addresses and a user-agent containing QualiBooth/. If you use App & API Protector rate controls, exclude the same list from them.

Other firewalls and WAFs

Allow inbound HTTP and HTTPS traffic from the addresses in ips.json. If your firewall can match headers, also require the User-Agent header to contain QualiBooth/.

robots.txt

QualiBooth Bot does not follow robots.txt. It isn't a crawler: it loads only the specific pages a customer has asked it to test, and it is meant to experience those pages the way a human visitor does, so that accessibility testing reflects what real people see. Adding User-agent: QualiBooth rules to robots.txt has no effect.

How to block it

QualiBooth Bot only visits sites that a QualiBooth customer has added. If you don't want your site to be scanned:

• Ask the person or organization that added your site to remove it from their QualiBooth scan configuration.
• Block requests whose user-agent contains QualiBooth/, or whose source IP is in ips.json.
• Contact us and we will look into it.

Contact

For questions about QualiBooth Bot, or to report a problem, email support@qualibooth.com. If you're reporting unwanted traffic, include the affected domain and the approximate time of the requests.