OUR BOT
Meet the Shopsteddy bot.
Shopsteddy checks online stores on behalf of the people who run them. This page explains who operates the bot, what it is there to do, and how we keep its traffic predictable.
What the bot is for
Our job is to spot problems before they affect customers. That can include broken pages, missing assets, product or variant issues, buttons that stop working, or a checkout journey that no longer behaves as expected.
We use a clearly identifiable bot rather than hiding automated traffic inside normal customer traffic.
How we behave on your site
We respect robots.txt
We read the site's robots rules before ordinary crawling. If a path is disallowed for NBTBot, we don't crawl that path.
We stay on your site
We crawl only pages that are within your approved domain and validated first-party scope. Links to other websites may be recorded as references, but we do not turn them into new crawl targets.
We back off when asked
If a site rate-limits, blocks or challenges us, we slow down or stop. We don't rotate identities or keep retrying just to get around the site's controls.
We keep evidence of the scan
We keep enough evidence to confirm what Shopsteddy checked, when it checked it and what happened. That helps us investigate a problem or verify a scan if you contact us. We avoid keeping large or sensitive captures when a smaller record is enough.
Every scan has its own ID
Shopsteddy sends an opaque scan identifier with its requests using the Shopsteddy-Scan-Id header. If you see traffic you did not expect, send us that ID and the approximate time. We can use it to trace the Shopsteddy run, when it was requested and the account or process that started it.
Shopsteddy-Scan-Id: 7d9f1d4e-2b58-4f1d-b90a-9b9e4dce1234The scan ID is deliberately just an identifier. It does not contain customer data or account details.
How a store approves Shopsteddy
Most Shopsteddy checks use the same public storefront that your customers see, so they do not need a Shopify password or API key. If a check needs access to Shopify account data or another protected area, approval should happen through Shopify's standard app authorisation flow with only the permissions that check needs.
We will not ask you to email us your Shopify password or paste a private Admin API access token into a support message. Access should be explicit, limited and revocable from Shopify.
Shopsteddy direct crawler requests use Web Bot Auth with an Ed25519 key published in our public signing-key directory. Cloudflare BotBase verification is a separate registration process; until Cloudflare approves that registration, we do not describe Shopsteddy as a Cloudflare Verified Bot.
Useful links
Verify a request
See the identifiers we use and how to check traffic claiming to be Shopsteddy.
How to verify Shopsteddy →Control where we crawl
See how Shopsteddy uses robots.txt and what happens when a path is blocked.
robots.txt guide →Something doesn't look right?
Send us the request details and we'll help you check whether the traffic is ours.
Contact us →