PixGuardBot

When PixGuardBot visits

• Free page check. Someone enters a page address in the no-signup scanner on pixguard.io. PixGuardBot fetches that one page, may request up to 30 of its images to compare their sizes, and downloads up to 3 of the largest.
• Website scan. A signed-in PixGuard user enters a site address. PixGuardBot fetches that page to estimate the size of the scan, then follows links across up to 50 pages and downloads the images it analyzes.
• Scheduled re-scans. On the Pro and Business plans, a user can have PixGuard re-scan a site every week, or every day on Business. Each run works like a website scan.
• Single pages. The PixGuard WordPress plugin and API can ask PixGuardBot to fetch one page and its images.

PixGuard doesn't check who owns a site before scanning it, so the person who started a scan may not be the site owner.

What it reads

• The HTML your server returns. PixGuardBot doesn't run JavaScript, so it doesn't see images that a script adds after the page loads.
• Images in <img> tags: the src attribute, or data-src and data-lazy-src when src is empty.
• Background images set in an element's inline style attribute.
• Links in <a href> tags, which a website scan follows to find more pages.

It doesn't read robots.txt, sitemap.xml, srcset, <picture> sources, stylesheets, og:image tags or linked PDFs. It ignores data: URIs, and it skips SVG and .ico files in <img>tags. It doesn't log in, so it only sees what a signed-out visitor sees.

Where it goes and how fast

• It stays on the exact host that was entered. www.example.com and example.com count as different hosts, and subdomains aren't followed.
• It drops query strings and #fragments from links, so /blog?page=2 is fetched as /blog.
• A website scan fetches at most 50 pages. The free page check fetches only the page that was entered.
• It pauses for half a second after each page it reads, and a crawl stops after 10 minutes even if pages remain.
• If your server answers with 429 or 503, it waits and tries again, up to 3 attempts per request. It honors a Retry-After header given in seconds, waiting at most 15 seconds at a time.
• It downloads the images it analyzes a few at a time, not all at once.

User agent

Page requests, and the image downloads that follow them in a scan, send this user agent:

Mozilla/5.0 (compatible; PixGuardBot/1.0; +https://www.pixguard.io/bot)

Image downloads in the free page check send:

PixGuardBot/1.0 (+https://www.pixguard.io/bot; copyright detection scan)

Both contain PixGuardBot. Match on that word rather than the full string, which changes when the version number does. Other software can copy a user agent, so if traffic calling itself PixGuardBot doesn't behave as this page describes, let us know.

Allow PixGuardBot

If a scan of your own site fails because the site blocked PixGuard, allow requests whose user agent contains PixGuardBot in your firewall, CDN or security plugin.

PixGuardBot can't complete JavaScript or CAPTCHA challenges. If the first page it requests returns a challenge page or an error such as 403, the scan stops with a message saying why. Later pages that fail are skipped.

On Cloudflare, check your bot settings (such as Bot Fight Mode) and any managed challenge, not only your custom WAF rules. A custom rule that allows PixGuardBot doesn't help if a bot setting still challenges it.

PixGuard doesn't publish a list of IP addresses for PixGuardBot. If your setup needs one, email us.

Block PixGuardBot

A robots.txt rule won't stop PixGuardBot, because it doesn't read robots.txt. To keep it off your site, return 403 to requests whose user agent contains PixGuardBot. A scan of your site then stops at the first page with a message that the site blocked it.

Contact

Questions about PixGuardBot, or requests to your site that don't match this page? Email [email protected] with your site's address and, if you can, the times and paths of the requests.