WebzodScanner
If you found WebzodScanner in your server logs, someone asked webzod to check your domain. This page says who we are, what we request and how to make us stop.
How to recognise it
- User-Agent
- WebzodScanner/1.0 (+https://webzod.com/bot)
- Reverse DNS
- scanner.webzod.com
- robots.txt token
- WebzodScanner
The address a request comes from has a reverse DNS name of scanner.webzod.com. If it does not, it is not us.
Passive only
On a domain whose owner has not verified it, webzod only does what any visitor or the public
internet already does. It does not scan ports, request paths nobody links to (such as .git, .env or admin panels), send
payloads, try to log in or guess passwords. Every request is a plain GET or HEAD.
What it requests from your server
- The homepage over http:// and https://, following its redirects.
- /robots.txt, and the robots.txt of another site when your homepage redirects there.
- /.well-known/security.txt. Only when that is missing, the legacy /security.txt location, so the report can say where the file is.
- The www or bare-domain counterpart of your host, and one request for the homepage with a foreign Origin header to see how CORS answers.
- /sitemap.xml, or the sitemap files your robots.txt lists on your own domain (a few files at most).
- /llms.txt.
- https://mta-sts.<your domain>/.well-known/mta-sts.txt, the mail policy file.
- Up to ten script files your homepage itself links, on your domain or a well-known public CDN, read only far enough to find a library version in a banner comment.
- TLS handshakes with your server, to read the certificate, protocol versions and ciphers. A handshake requests no page.
What it looks up elsewhere
- DNS queries for your domain (records, DNSSEC, mail and certificate-authority records), sent to public DNS resolvers and your nameservers. They receive the domain name.
- RDAP registration data and the crt.sh certificate transparency log, which receive the domain name.
- Google PageSpeed Insights receives your homepage address, and Google then loads your homepage from its own servers to measure it. Those requests come from Google, not from WebzodScanner, so the robots.txt block below does not name them; webzod only asks Google for this when your robots.txt allows the scan.
- Google Web Risk receives your homepage address (and the address it redirects to, if any) to check it against its lists of unsafe sites.
- Public vulnerability lists (OSV, CISA KEV, retire.js) are downloaded in full and matched on our side; they receive nothing about your site.
How to opt out
Add this to your robots.txt. WebzodScanner reads that file
before it requests anything else, and when it finds the block the scan ends and no page of
your site is fetched.
User-agent: WebzodScanner Disallow: /
A rule for User-agent: * does not opt you out, because those rules
are meant for crawlers and WebzodScanner reads one page like a visitor. The named block does. DNS
and registration lookups never touch your server, so robots.txt cannot govern them; with the block
in place webzod does not ask PageSpeed Insights or Web Risk about your site either.
Problems and abuse
If the scanner misbehaves, or you want a domain excluded for good, write to [abuse@webzod.com] with the domain and the time of the requests (UTC) and we will look at it. The terms and the privacy notice say what else we do and keep.