How to unblock the Findrix scanner
Your firewall or CDN served our scanner a bot-challenge page instead of your real content. Allowlist the Findrix scanner, then re-run the scan.
What to allowlist
Add an allow (or “skip” / “bypass”) rule for requests whose User-Agent contains Findrix-Audit. The full User-Agent we send is:
Findrix-Audit/0.1 (+https://findrix.ai)
Allowlist by User-Agent, not by IP. Our scanner runs on shared serverless infrastructure with rotating IPs — there is no fixed range we can hand you, so the User-Agent is the reliable signal to key your rule on. If your security policy strictly requires an IP-based rule, contact us and we’ll work with you.
How to recognize our traffic
So your security team can verify it’s us before allowing it:
Requests: plain HTTPS GET only — no logins, no form posts, no writes.
Pages: your homepage plus /robots.txt, /llms.txt, /sitemap.xml, and up to ~50 public pages from your sitemap.
Volume: one scan is a short burst of up to ~60 requests, then it stops. Performance metrics (PageSpeed / Core Web Vitals) come from Google’s infrastructure, not ours.
Platform quick-reference (allow the Findrix-Audit User-Agent)
Cloudflare — WAF → Custom rules → add a rule: when User-Agent contains "Findrix-Audit" → action Skip (or Allow). Also confirm Bot Fight Mode / Under Attack Mode isn’t challenging it.
AWS WAF / CloudFront — Add an Allow rule matching the User-Agent header contains "Findrix-Audit", placed above your block and bot rules.
Akamai — Add "Findrix-Audit" to your Bot Manager allowlist, or create a bypass rule for that User-Agent.
Fastly — Add an allow / bypass condition for requests whose User-Agent contains "Findrix-Audit".
Imperva (Incapsula) — Security → Bot Access Control → add "Findrix-Audit" to the good-bot allowlist.
DDoS-Guard — In your DDoS-Guard dashboard, add "Findrix-Audit" to the whitelist and disable the JS-challenge for it.
StormWall — In your StormWall dashboard, whitelist the "Findrix-Audit" User-Agent and exempt it from the JS-challenge.
ServicePipe — In your ServicePipe dashboard, add "Findrix-Audit" to the whitelist and turn off the challenge for it.
nginx / Apache / app-level — If you filter by User-Agent in your server or app code, add an exception so requests containing "Findrix-Audit" pass through.
Still blocked? Check rate limiting
A scan fetches your homepage and up to ~50 pages in a short burst. Aggressive rate-limiting or an “I’m Under Attack” / managed-challenge mode can still stop us even after a User-Agent allowlist. Exempt the Findrix-Audit User-Agent from those rules too, then retry.
Bonus: let AI search engines in too
The same kind of firewall rule is often what keeps ChatGPT, Claude, and Perplexity from reading your site — which is exactly what hurts your AI visibility. If your audit flagged “AI crawlers blocked,” allow these bots in both your robots.txt and your firewall / CDN. Match on the token (e.g. GPTBot), not the version string.
OpenAI: GPTBot, OAI-SearchBot, ChatGPT-User
Anthropic (Claude): ClaudeBot, Claude-SearchBot, Claude-User
Perplexity: PerplexityBot, Perplexity-User
Meta: Meta-ExternalAgent
Other crawlers: Amazonbot, Applebot-Extended, CCBot, Bytespider
Google AI: Google-Extended — robots.txt only — Google-Extended has no separate crawler User-Agent, so you can’t allow it at the firewall.
In robots.txt, make sure you’re not disallowing them:
User-agent: GPTBot Allow: / User-agent: OAI-SearchBot Allow: / User-agent: ClaudeBot Allow: / User-agent: PerplexityBot Allow: / User-agent: Google-Extended Allow: /
Confirm it worked
Re-run the scan. If it still fails, the challenge is almost always coming from a “bot fight” / managed-challenge mode rather than a User-Agent rule — turn that off for Findrix-Audit and try once more.