tech/auditor

// bot.info

TechAuditorBot

If you found TechAuditorBot in your logs, someone used Tech Auditor to check your website. This page explains what it requested and how to control it.

last updated // 19 October 2026

Why it visited

TechAuditorBot isn't a search crawler, and it doesn't wander the web. It only visits when a person asks it to: by entering your URL to scan, re-running an earlier report, or listing your site as a sample project in a dev team audit. Each scan is a single, short visit.

How to recognise it

Requests carry this user agent:

Mozilla/5.0 (compatible; TechAuditorBot/1.0; +https://tech-auditor.ny8.dev/bot) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36

The token to match in robots.txt or server rules is TechAuditorBot.

What a scan requests

A scan usually makes a few dozen requests and finishes within a minute. It covers:

  • the URL that was entered, following up to six redirects;
  • robots.txt, your sitemap and up to 20 child sitemaps;
  • up to 10 more of your pages, picked from the page's links and the sitemap, with at most four loading at once;
  • a capped sample of the page's scripts, stylesheets, images and fonts, and its social share image;
  • a few checks on how the site responds: a random address that should return 404, and the http:// and www. versions of the page, to test redirects;
  • DNS records and the TLS certificate;
  • up to 12 external links found on the page, to check whether they're broken.

Each request has a time limit and a size cap, so a slow or very large response is abandoned instead of retried.

robots.txt

Before it samples further pages, the bot reads your robots.txt and skips any path it disallows. A group that names TechAuditorBot takes priority over the * group. To stop it sampling any pages beyond the one requested: 

User-agent: TechAuditorBot
Disallow: /

The URL a person entered is still fetched, along with the checks on it listed above (its assets, the redirect tests and the 404 test). That's because someone asked for that page directly, much like opening it in a browser. robots.txt is meant for automated crawling, not for one-off requests made by a person. To block the bot completely, refuse its user agent at your server or firewall.

What it never does

  • Log in, submit forms, or send anything other than plain read requests.
  • Try to exploit vulnerabilities or get past access controls.
  • Accept URLs that point to local or private network addresses. Those are refused before the scan starts.
  • Come back on a schedule. There's no background crawling or monitoring.

Other visitors from a scan

Some optional checks come from tools with their own user agents:

  • Google PageSpeed Insights. When it's enabled, Google's Lighthouse loads the page from Google's servers, using Google's user agent.
  • Rendered checks. When they're enabled, the page loads once in headless Chrome to test contrast, focus, touch targets and consent behaviour. These requests carry the standard HeadlessChrome user agent.

Reports and removal

Scan results are saved as a report, which anyone with its link can view. Report pages aren't indexed by search engines. If a report concerns your site, you can delete it from the report page. You can also send us the link and we'll remove it: ny8.dev. The Privacy Policy explains what's stored.