TrakisBot

We read /robots.txt before anything else and obey it. Two lines and we stop coming, on the next visit and every one after:

User-agent: TrakisBot
Disallow: /

We do not keep a second identity and we do not fall back to a browser user agent when we are turned away. Blocking this name blocks us.

• At most 3 requests at a time, with at least 300 ms between them, per host.
• On a 429, a 503, or response times that keep climbing, we narrow that ourselves before you have to.
• HTML only, and at most 2 MB per page, with a 15-second timeout. No images, no fonts, no video.
• A redirect that leaves your domain is recorded and not followed. We do not crawl a site because another site pointed at it.
• By default we do not run your JavaScript. When an audit is asked to render, we load scripts but still refuse images, fonts and stylesheets.

Anyone can put that name in a header, and some will. The audits people ask for come from one address:

45.77.64.192

A request that calls itself TrakisBot from anywhere else was not one of them. The control that works is still robots.txt and your own rate limits; the address is for telling us apart, and for the next section.

Bot protection can stop us before robots.txt has a say: a Cloudflare challenge (“Just a moment…”), or a rule that challenges cloud networks. We do not disguise ourselves to get past it — the browser we read pages with carries the same name. The pages it stops are left out of the audit, and the report says how many — so the grade is not lowered for a page we never saw, and those pages are not audited either.

To have them audited, let through the requests that come from our address and carry our name. On Cloudflare, a custom rule with the action Skip, placed first:

(ip.src eq 45.77.64.192 and starts_with(http.user_agent, "TrakisBot"))

Or add and ip.src ne 45.77.64.192 to the rule that challenges. Elsewhere, the same two conditions in your firewall’s allow list.

Someone with a Trakis account added it: its owner, an agency working on it, or a business that follows it as a competitor of its own site. Adding a site means confirming you own it or may have it audited, and a site an account follows is read again on the schedule that account chose.

We cannot verify that confirmation. That is the honest position, and it is why blocking us takes two lines rather than a conversation with us.

The pages we read, and what the rules found in them. We do not submit forms, we do not log in, we do not follow links that ask us not to, and we have no interest in anything behind a password.

Write to bot@trakis.io if we got something wrong, took too much, or you want us to stop without touching your robots.txt. A real person reads it.