The scanner
What visits your site, and how to stop it.
When someone grades a page, a real browser in Cloudflare's network loads it, up to three times, and records what happens. It is a bounded visit, not a crawl.
What it does
- Loads the page that was entered, plus the cookie or privacy policy page it links to, to check the policy mentions the cookies we saw. It does not follow other links, log in or fill in forms.
- Visit 1 loads the page and clicks nothing. Visit 2 clicks Reject if the banner has one. Visit 3 clicks Accept if it has one. Each visit starts with an empty browser.
- Records request addresses, cookie names, how long cookies last, and how much of each script runs. It never stores cookie values or anything typed into a form.
- It visits from the United States or from Europe (near Frankfurt), whichever the person chose, because many sites only show a consent banner to European visitors. The report says where the browser really ran.
- A public scan of the same page from the same place is shown again for six hours instead of loading it a second time. Each page of a watched site is scanned once a week. Adding a page is the only way it gets visited.
How to allow it
The scanner identifies itself as an automated browser. Its requests use a HeadlessChrome user agent and carry a Signature-Agent header that names Cloudflare's browser service. We cannot hide
this, and we do not try to. If your firewall or bot protection blocks it, the report says "We were blocked" and no grade is given. To let it in, create a rule that allows requests with a user agent containing
HeadlessChrome that also carry a Signature-Agent header, then scan again.
Opt out
There are two ways. Either one stops every scan of the site, including weekly scans someone already set up, before any browser starts.
By email
Enter your domain and an email address at it. We send that address a link, and the opt-out starts when you press the button it opens. The address is how we know the site is yours, so it has to be at the domain, like you@yourstore.com.
With robots.txt
Add this to your site's robots.txt. We read it before every scan, so it works from the next one and stops when you remove it.
User-agent: TrackerGrade Disallow: /
Use a narrower path, like Disallow: /checkout, to keep the scanner off just those pages. Only rules that name TrackerGrade count. A rule for every robot (User-agent: *) is meant for crawlers, and a scan is one visit a person asked for, the same as a page-speed test.