Requested audits
Public pages, redirects, robots.txt, sitemaps, and guidance files are fetched when a user runs a Technical Audit or free checker.
Crawler identity
Allow Foglift through your firewall
Every Foglift audit request includes the stable token FogliftBot for identification in logs and routing. A user-agent can be spoofed, so a safe WAF exception must also require the private X-Foglift-Verify credential shown in your workspace settings.
User-agent identities
Most requests use the standard identity. A small set of compatibility checks uses a browser-shaped identity for origins that reject non-browser requests. Both contain the same bare token.
FogliftBot (+https://foglift.io/bot)Mozilla/5.0 (compatible; FogliftBot; +https://foglift.io/bot)What FogliftBot fetches and when
Full-site audits
Entitled workspaces can inspect up to 100 public pages in a run. Automatic full-site coverage runs no more than weekly; manual runs have a seven-day availability window.
Monitoring and setup
Tracked pages are fetched only on the workspace's configured schedule. Setup and diagnostic probes run only when a user requests them.
Allowlist FogliftBot
Never create a broad bypass from the user agent alone. Match FogliftBot and your privateX-Foglift-Verify value together, scope the exception to your hostname, then use Verify my allowlist in Portal Settings.
Cloudflare expression
(http.user_agent contains "FogliftBot" and http.request.headers["x-foglift-verify"][0] eq "<your workspace token>")Cloudflare
Copy your workspace-specific expression from Portal Settings. Choose Skip for Super Bot Fight Mode, Browser Integrity Check, and only the remaining custom rules that blocked the request.
AWS WAF
Require both a User-Agent header containing FogliftBot and anX-Foglift-Verify header exactly matching your private workspace credential. Only that combined condition should bypass the blocking rule.
Akamai
In Property Manager or App & API Protector, require User-Agent containingFogliftBot and X-Foglift-Verify exactly matching your workspace credential. Exclude only that combined match from the policy that stopped the audit.
Fastly
Add an edge condition requiring req.http.User-Agent to contain FogliftBot andreq.http.X-Foglift-Verify to equal the workspace credential. Route only that combined match around the blocking ACL or bot rule.
Why we do not publish IP ranges
Foglift runs on serverless infrastructure with shared serverless egress. We do not control a dedicated outbound IP range or its reverse DNS, so publishing the hosting provider's shared ranges would create an overly broad exception that also admits unrelated services. We do not imply that an IP allowlist is available or coming.
Still blocked? Include the target URL and observed HTTP status when you email Foglift support.