About TirelessLabsScanner/1.0

If you are reading this, you probably found this URL in your access logs. Here is everything about the thing that made that request.

What it is

An accessibility checker. It arrives at your site in one of exactly two ways, and which one it was decides everything below.

• A free single-page check. Somebody — possibly you, possibly a stranger — pasted a URL on your site into wcagwatch.tirelesslabs.com, and we loaded that one page in a real Chromium browser and ran axe-core against the WCAG 2.0 and 2.1 level A and AA rule sets. One page, one request, on demand. This is the common case.
• A paid monitoring crawl. Somebody paid for monitoring of this site and confirmed, in a stored written attestation, that they own it or are authorised to have it tested. That subscription gets a same-origin crawl of up to 150 pages, about once a week. If you did not expect this and you are the owner, the “how to block it” section below stops it immediately and completely.

Its full user-agent string

TirelessLabsScanner/1.0 (+https://wcagwatch.tirelesslabs.com/bot.html)

We never disguise the scanner as a browser or as another crawler. If a request claims to be this scanner from an address you do not expect, it is not ours to defend — but the string above is the only one we send.

What it actually requests

Always, whichever mode it is in:

• The page itself plus the subresources that page loads (CSS, images, fonts, scripts), because the checks need the page as a browser sees it.
• No form submissions, no logins, no POSTs — it is a GET of a page and then a set of read-only DOM checks.
• Same origin only. Exact scheme, host and port. A link to another host is never followed.

On a free single-page check: one page, the exact URL that was submitted. It does not follow links, it does not read your sitemap, and it does not queue anything it discovers. Rate limited to five free scans per day per visitor, with a global daily ceiling on top.

On a paid monitoring crawl: it reads /robots.txt and /sitemap.xml, then walks the site breadth-first from the subscriber's starting URL, capped at 150 pages per scan and about 45 minutes of wall-clock. One page at a time — never parallel — with a pause of at least a second between pages, so roughly one request per second at the very most. A given site is crawled about once every seven days.

What we keep

The URL, the findings, and the CSS selectors of the elements that failed — per page, so a crawl keeps one such row for each page it reached. We do not store a copy of your page, we do not take screenshots, and we do not resell anything. Details are in the privacy policy.

How to block it

Block the user-agent at your edge, WAF or server. A 403 is a perfectly good answer: we stop, and we report it to the person who asked as "the site refused the request" rather than pretending we found nothing.

# nginx
if ($http_user_agent ~* "TirelessLabsScanner") { return 403; }

What we do with robots.txt

Stated exactly, because a half-answer here is worse than none.

• A rule that names us is honoured absolutely. Put this in your robots.txt and the crawl stops before it fetches a single page — including for a paying subscriber:

  User-agent: TirelessLabsScanner
  Disallow: /

  Narrower rules in a block that names us are honoured too: Disallow: /admin keeps us out of /admin, with longest-match Allow: overrides working the normal way.
• A rule aimed at * is not treated as a refusal for a paid monitoring crawl. That is a deliberate choice and here is the reasoning: a subscriber has told us in a stored, written attestation that this is their site and asked us to test it, and blanket * rules are overwhelmingly aimed at search indexers and scrapers rather than at a tool the owner is paying to run. If we honoured them anyway, a paid subscription would quietly do nothing. If you disagree, name us — one line, and it wins over everything.
• The free single-page check does not read robots.txt at all. It is one fetch triggered by a person who typed a URL and pressed a button, in the same category as a browser, a link preview or the W3C validator.

If you would rather not reason about any of this, the user-agent block above is absolute and we would rather you use it than be misled about what we honour.

How to allow it

Many hosts and WAFs block datacentre traffic wholesale, which is where this scanner runs, so a refusal is usually a default rather than a decision. If you want scans of your own site to work, allow the user-agent string above.

Something went wrong

If the scanner misbehaved — too many requests, an unexpected path, anything that looks like a bug — write to wcagwatch@mail.tirelesslabs.com and it gets acted on.