Allowlist the AccessibilityRef scanner

How we identify ourselves

Every scanner request carries both a self-identifying User-Agent and a custom request header. Match on either, or both for stricter allowlisting.

Cloudflare

In Security → WAF → Custom rules, create a rule named Allow AccessibilityRef with action Skip (skipping Bot Fight Mode, managed rules, and rate limits as needed) and this expression:

(http.user_agent contains "AccessibilityRefBot") or (http.request.headers["x-accessibilityref-scanner"][0] eq "accessibilityref-bot-v1")

If you also run Bot Fight Mode or Super Bot Fight Mode, add this Skip rule before them in the rule order:

# Cloudflare Bot Fight Mode is on?
# Add a WAF Skip rule with this expression and skip:
#   - Super Bot Fight Mode
#   - Bot Fight Mode
#   - Managed challenge
(http.user_agent contains "AccessibilityRefBot") or (http.request.headers["x-accessibilityref-scanner"][0] eq "accessibilityref-bot-v1")

AWS WAF

Add this rule to your Web ACL with Priority 0 so it evaluates before any managed rule group that might block us:

{
  "Name": "AllowAccessibilityRefBot",
  "Priority": 0,
  "Action": { "Allow": {} },
  "Statement": {
    "OrStatement": {
      "Statements": [
        {
          "ByteMatchStatement": {
            "FieldToMatch": { "SingleHeader": { "Name": "user-agent" } },
            "PositionalConstraint": "CONTAINS",
            "SearchString": "AccessibilityRefBot",
            "TextTransformations": [{ "Priority": 0, "Type": "NONE" }]
          }
        },
        {
          "ByteMatchStatement": {
            "FieldToMatch": { "SingleHeader": { "Name": "x-accessibilityref-scanner" } },
            "PositionalConstraint": "EXACTLY",
            "SearchString": "accessibilityref-bot-v1",
            "TextTransformations": [{ "Priority": 0, "Type": "NONE" }]
          }
        }
      ]
    }
  },
  "VisibilityConfig": {
    "SampledRequestsEnabled": true,
    "CloudWatchMetricsEnabled": true,
    "MetricName": "AllowAccessibilityRefBot"
  }
}

nginx

Use a map block to flag scanner requests, then reference the flag in your rate-limit or bot-protection logic:

# AccessibilityRef scanner allowlist
# Bypass any rate limit / bot block when our UA or header is present.
map $http_user_agent $is_accessibilityref_bot {
    default 0;
    "~*AccessibilityRefBot" 1;
}
map $http_x_accessibilityref_scanner $is_accessibilityref_header {
    default 0;
    "accessibilityref-bot-v1" 1;
}
# In your server { } block:
#   if ($is_accessibilityref_bot = 1) { set $skip_ratelimit 1; }
#   if ($is_accessibilityref_header = 1) { set $skip_ratelimit 1; }

Apache

Wrap any restrictive directives in an <If> condition that excludes our requests:

# AccessibilityRef scanner allowlist (.htaccess or vhost)
<If "%{HTTP_USER_AGENT} =~ /AccessibilityRefBot/ || %{HTTP:X-Accessibilityref-Scanner} == 'accessibilityref-bot-v1'">
    Require all granted
    # If you have mod_security or similar, also disable rule engines here:
    # SecRuleEngine Off
</If>

robots.txt

robots.txt is advisory, not a security control, but if you maintain a strict crawler policy you can name us explicitly. We respect Disallow directives that match our UA or *:

# Allow the AccessibilityRef accessibility scanner full access.
# See https://www.accessibilityref.eu/bot for verification details.
User-agent: AccessibilityRefBot
Allow: /

Other WAFs and CDNs

For any other system (Akamai, Fastly, Imperva, Sucuri, F5, Fortinet, etc.), the pattern is the same: match on UA contains AccessibilityRefBot OR header X-Accessibilityref-Scanner equals accessibilityref-bot-v1, and create an Allow / Skip / Trust rule.

IP allowlisting (not recommended)

AccessibilityRef runs on Vercel's global edge network. The IP pool is large, changes without notice, and is shared with tens of thousands of other Vercel-hosted apps. IP allowlisting is unstable and would also admit unrelated traffic, so we publish UA and header signals instead.

Verifying a request is genuinely ours

The custom header is the canonical signal. If you receive a request claiming to be us but with no X-Accessibilityref-Scanner header, treat it as a spoofed User-Agent.

If you need stronger assurance, scans run from your AccessibilityRef dashboard always carry a request ID surfaced back in the scan UI. Contact support@accessibilityref.eu with the request ID and we can confirm whether a given log entry was ours.