Why you’re seeing Relvato
The Relvato bot only visits sites that a Relvato customer has explicitly connected to monitor — typically the site’s own owner or agency. It runs journeys like loading key pages, adding to cart, checking out, logging in, and measuring uptime and performance, so the owner is alerted the moment an update breaks something.
It identifies itself on every request (below) and honours your firewall: if a rule blocks it, the checks simply fail for that site — nothing is bypassed.
How to identify Relvato traffic
Every request the bot makes carries these signals, so you can recognise and allowlist it with confidence:
| Signal | Details |
|---|---|
| X-Relvato-Token header | A stable per-site secret, unique to your site (shown in the site’s Settings in Relvato). Match it in a firewall rule to let Relvato — and only Relvato — through. |
| Web Bot Auth signature | Every request is signed with Ed25519 HTTP Message Signatures (RFC 9421): the Signature, Signature-Input and Signature-Agent headers, tagged “web-bot-auth”. |
| Origin | Requests come from Relvato’s own infrastructure, running a headless Chromium browser. |
Signing key directory: https://www.relvato.com/.well-known/http-message-signatures-directory
Allow or block it
If you run the site and want Relvato’s checks to succeed behind a firewall or CDN (Cloudflare, Sucuri, Wordfence…), allowlist it — the quickest way is a rule matching the X-Relvato-Token header. Our step-by-step guide has the exact Cloudflare rule.
If you don’t want Relvato visiting, there’s nothing special to do — it only runs for sites its customers have connected. You can also block it at your firewall like any other client.
Contact
Questions about the bot, or want it to stop visiting a site you control? Email us at contact@relvato.com.