Allow Protego's scanner

What the bot does

ProtegoScanner runs only when a user requests a website security check and confirms permission. Checks are read-only: it inspects public responses, TLS certificates, DNS, security headers, cookies and exposed configuration. It does not log in, submit credentials or change your site. Deep Scan may send a read-only GraphQL introspection query using POST and harmless test parameters.

Standard checks request the supplied URL, HTTP/HTTPS redirects and /.well-known/security.txt. Optional Deep and Cloud checks can request /robots.txt, linked JavaScript bundles, common admin and API paths such as /admin, /wp-admin and /graphql, and exposure probes such as /.env, /.git/HEAD, /backup.zip and /package.json. This is a bounded check, not a recursive crawl.

Public daily allowances are three scans per anonymous IP or ten per signed-in user, resetting at midnight UTC. A scan makes multiple requests, some concurrently; optional checks make more requests. There is no fixed requests-per-second guarantee. A homepage request may be retried once. Blocked scans can receive up to three allowance refunds per day.

Exact User-Agent

Mozilla/5.0 (compatible; ProtegoScanner/1.0; +https://protego.me/scanner-bot)

Scans run from cloud infrastructure without fixed IP addresses. Allowlist by User-Agent rather than an IP list. The separate uptime checker identifies as ProtegoSiteCheck/1.0 and links to this page.

Anyone can spoof a User-Agent. Scope any exception tightly to your website and intended paths, enable it only for your scan, and remove the rule immediately afterward. Confirm the request in your firewall logs. An allowlist is not proof of scanner identity.

Cloudflare

Create a WAF custom rule with the expression below and action Skip. Select Super Bot Fight Mode and managed rules as needed, and applicable rate limiting rules if those caused the block. Place the exception before blocking custom rules. Bot Fight Mode, including on the free plan, cannot be skipped by custom rules: temporarily disable it during your scan if it is responsible.

(http.user_agent contains "ProtegoScanner")

Vercel Firewall

Create a custom rule: User Agent contains ProtegoScanner, action Bypass, before blocking rules. If Attack Challenge Mode still challenges the scanner, temporarily disable that mode for your scan. A custom rule does not bypass every platform mitigation.

User Agent contains ProtegoScanner → Bypass

Sucuri

Check your firewall access controls for Whitelisted user agents, if available in your plan, and temporarily allow ProtegoScanner. Otherwise review the block with Sucuri support or temporarily relax the specific protection responsible. Menu names vary; the block log identifies the setting to review.

ProtegoScanner

AWS WAF

Add a rule with a byte match statement inspecting the single header user-agent, positional constraint CONTAINS, search string ProtegoScanner, text transformation NONE, and action Allow. Give it a lower numeric priority than Bot Control and the rule that blocked the request. Scope the rule to your intended host and paths.

Single header: user-agent | CONTAINS: ProtegoScanner | Action: Allow

Wordfence

Use Live Traffic to identify the exact rule first. Firewall > All Firewall Options includes Allowlisted URLs for specific firewall false positives and Rate Limiting settings. URL exceptions do not bypass every rate limit. All Options > Allowlisted services is a predefined service list, not a general custom User-Agent allowlist; do not assume ProtegoScanner can be added there. If your configuration supports custom User-Agent exceptions, temporarily match ProtegoScanner; otherwise temporarily adjust the specific rate limit or ask Wordfence support. “Immediately block fake Google crawlers” does not apply to ProtegoScanner, which does not identify as Googlebot.

ProtegoScanner