Why you’re seeing RelvatoBot
Relvato does not crawl the web. RelvatoBot visits a website only when a Relvato customer — typically the site’s owner or their agency — has connected that exact site for monitoring, and proven they control it. There is no discovery, no link-following across domains, and no interest in your content.
What it does there is run that site’s configured monitors: loading key pages, completing a test checkout, signing in, measuring uptime and page speed, and comparing pages against an approved baseline so the owner hears about breakage before their customers do.
Relvato does not attempt to circumvent access controls. It does not solve CAPTCHAs, and it does not work around a bot-protection challenge. If your firewall blocks a request, the run fails and Relvato reports that block to the customer — who can then decide to allow it.
How to identify RelvatoBot
Cloudflare has verified RelvatoBot: it's listed as a verified bot in the Cloudflare Radar bots directory (Monitoring & Operations, operated by Relvato), with the signing key directory below on file. Verified bot — RelvatoBot →
Four signals, strongest first. The signature is the one that proves a request really came from Relvato; the rest are for matching and context.
| Signal | Details |
|---|---|
| Web Bot Auth signature | Every request is signed with an Ed25519 HTTP Message Signature (RFC 9421): the Signature, Signature-Input and Signature-Agent headers, tagged “web-bot-auth”. Signature-Agent points at Relvato’s public key directory below, so your CDN or WAF can verify the signature itself. This is the only signal that can’t be imitated. Cloudflare and AWS WAF can both validate it. |
| User-Agent | A real Chrome or Safari user agent — the engine genuinely is Chromium, and the site should render what a visitor sees — with Relvato’s product token appended. Match on the token; the browser part will change as the engine is updated. |
| X-Relvato-Token header | A per-site secret, unique to your site and shown in its Relvato settings. It is an authorisation credential, not proof of origin: use it to allow Relvato on your own site. Treat it as a secret — anyone holding it could send it. |
| Network origin | Requests come from Relvato-controlled infrastructure running Chromium. The addresses rotate, so don’t rely on them alone; the current ones are published for firewalls that can only match by address. |
User-Agent: RelvatoBot/1.0 (+https://www.relvato.com/bot)
Signing key directory: https://www.relvato.com/.well-known/http-message-signatures-directory
Cloudflare Radar: https://radar.cloudflare.com/bots/directory/relvatobot
Machine-readable identity: https://www.relvato.com/.well-known/relvato-bot.json
Current addresses: https://www.relvato.com/bot-ips.json
How RelvatoBot behaves
What the bot does on your server, so you can judge it without taking our word for it:
- Scope: only sites whose owner connected them to Relvato, and only that site’s own pages.
- Request rates: paced and jittered, one monitor at a time per domain, with a deliberate gap between the monitors of a full run. When a firewall blocks one monitor, the rest of that site’s queue is held back instead of walking into the same wall.
- 429 and 503: the Retry-After header is read and honoured — Relvato waits at least as long as your server asked.
- robots.txt: read on every monitored site and matched against RelvatoBot, with Crawl-delay honoured as a floor between requests. Enforcement of Disallow is currently being rolled out: during the rollout a disallowed path is recorded rather than skipped, so monitoring a customer deliberately configured doesn’t stop without warning. A site owner can also switch the rule off for their own site, since they are the one who set up the monitor.
- Challenges: never bypassed. No CAPTCHA solving, no evasion of bot protection; a blocked run is reported as blocked.
- Two exceptions worth disclosing, both only on a customer’s own connected site: the answer-engine readiness monitor asks the customer’s server whether it would serve GPTBot, Googlebot and similar, by sending those user agents; and the Signs of a hack monitor requests a few of the customer’s pages as Googlebot (with Relvato’s token still in the user agent) and as a visitor arriving from Google search, to catch hacks that show spam or a redirect only to Google. Those user agents are never used for other monitoring requests, and never on a site that isn’t connected to Relvato.
Allow it
If you run the site and want Relvato’s monitors to succeed behind a firewall or CDN, the quickest rule matches the X-Relvato-Token header against your site’s value — our step-by-step guide has the exact Cloudflare expression, plus Sucuri, Wordfence and host-level firewalls.
On a WAF that can verify Web Bot Auth (Cloudflare, AWS WAF Bot Control), you can allow the signature instead: no per-site secret to copy, and the verification is cryptographic. If your firewall can only allowlist by address, use the published list — but re-check it, because the addresses rotate.
Block it
If you don’t want Relvato visiting, there’s usually nothing to do: it only runs for sites its customers have connected and verified. If one of yours is being monitored and you didn’t authorise it, email us and we’ll stop it.
You can also block it at your firewall like any other client — by the product token in the user agent, by the signature, or by address. Relvato won’t route around it; the run simply fails and the customer is told it was blocked.
For security teams
RelvatoBot’s identity is published as data: name, operator, user-agent pattern, key directory, behaviour and contact. In Cloudflare’s Verified Bots model Relvato is a direct operator — we run the bot from our own infrastructure, nobody else can send requests presenting as RelvatoBot, and it only ever reaches sites whose owner connected and verified them. Each monitor is configured by that owner.
Security contact and policy are in our security.txt.
Independently checked
WebBotAuth.net grades published Web Bot Auth setups — key directory, signatures and agent card. This badge shows Relvato's current result; open the report to check it at the source.
Machine-readable identity: https://www.relvato.com/.well-known/relvato-bot.json
security.txt: https://www.relvato.com/.well-known/security.txt
Contact
Questions about the bot, or want it to stop visiting a site you control? Email us at contact@relvato.com.