PulsekitBot

If you saw this user agent in your logs:

Mozilla/5.0 (compatible; PulsekitBot/1.0; +https://getpulsekit.com/bot)

PulsekitBot is operated by Pathnext Industries, LLC, the company behind Pulsekit. Seeing it means someone ran a Pulsekit scan of your site, you subscribe to one, we ran a checkup ourselves (for research, or before contacting your business), a business near you ran a competitor comparison that included your public website, or your domain name looks like a subscriber's domain (see the lookalike domain check below). Every web (HTTP) request we send to your site carries exactly this user agent (TLS handshakes and DNS lookups have no user agent), except when we load your homepage the way a phone would, which uses this one:

Mozilla/5.0 (compatible; Mobile; PulsekitBot/1.0; +https://getpulsekit.com/bot)

One outside service may also visit your homepage under its own name when a scan asks it to: Google PageSpeed Insights (a speed lab test), which fetches the page from Google's servers with Google's own user agent. Our security-header grade comes from Mozilla's open-source MDN HTTP Observatory, which runs on our servers and sends about 4 requests (http and https homepage, robots.txt, one CORS check) with the PulsekitBot user agent above. Neither runs for a site on our do-not-scan list.

Our own checkups (research and prospecting)

We sometimes check businesses that didn't ask us to, for research (for example, aggregate statistics) or before contacting them about Pulsekit. Those checkups read public pages only, honor robots.txt and never request admin or login paths. Research checkups may run the same public checks as a free scan (email DNS records (SPF, DMARC, MX, MTA-STS, TLS-RPT and BIMI, plus lookups of common DKIM selectors), one HTTPS request for the MTA-STS policy file on the mta-sts subdomain, the TLS certificate (one normal handshake and one legacy TLS 1.0/1.1 handshake), the HTTPS redirect and HSTS, security headers, cookie flags and mixed content on the homepage, security.txt, domain registration and DNSSEC (RDAP), CAA records, certificate-transparency logs (crt.sh), Google Web Risk and the Mozilla Observatory header grade); public findings show on the report, while CMS/plugin version and admin/login path checks need a plan. Prospect checkups before we contact a business skip the Web Security & Trust checks. To stop them, use the opt-out below.

What it does

• Honors robots.txt (user agent PulsekitBot or *).
• Reads public pages of your site like a visitor would. Pages reached by following links are fetched one after another, 250 ms apart. It also reads robots.txt, your sitemap (up to 7 sitemap files), /llms.txt and /.well-known/security.txt, and checks whether the http:// address of your homepage redirects.
• Loads the homepage once in a headless browser to measure speed and accessibility. Like any browser, that also loads the page's images, styles and scripts. A few pricing or careers pages may be loaded the same way when their content only appears after JavaScript runs.
• Only for sites on a Pulsekit plan when you've confirmed you own the site: requests up to 10 well-known admin or login paths once each to see whether a login page is exposed, skipping any path your robots.txt disallows. It never tries a password. Free checkups, competitor comparisons and Pulsekit's own research or prospect checkups never request these paths.
• Checks the links on the pages it read to find broken ones, 4 at a time.
• Several checks run side by side, and a scan runs in a few separate batches. So you may see a few requests at the same moment, and your homepage, robots.txt and some pages may be requested more than once in a scan.
• Never submits forms, solves CAPTCHAs, logs in or bypasses access controls.
• Refuses private and internal network addresses.
• Lookalike domain check (part of a monthly pulse we're preparing; not on sale yet): we make a list of names that look like a subscriber's domain (typos, swapped or missing letters, other endings) and look them up in public DNS and domain registration (RDAP) records. If your domain is on that list and registered, we may request your robots.txt and, only if it allows, your homepage, once for each monthly report (over https, or http if https doesn't answer), with the same user agent. We look at up to 40 registered lookalikes per report. It's to see whether the page is parked, sends visitors to the subscriber's site, uses the subscriber's name, or asks for a password or card details. Most lookalikes are harmless, like parked names or other businesses with a similar name; a report marks one as “worth checking” only when it's on Google's phishing and malware lists, or it asks for a password or card details on a page that uses the subscriber's name. We don't contact you, and we don't do takedowns or report sites. If your domain was listed by mistake, email hello@getpulsekit.com and we'll correct it. Month to month we keep your domain name, how we classified it and when we first saw it.
• In a competitor comparison, reads only public pages of your site that robots.txt allows: robots.txt, your homepage and up to 2 menu or pricing pages (to note offers, listed prices and whether advertising tags are present), and in a monthly report your sitemap (up to 5 sitemap addresses and 4 child sitemaps, to spot new pages). A menu or pricing page may also be loaded once in a headless browser when its prices only appear after JavaScript runs. It doesn't contact you, and it stops if robots.txt asks it to.

The most one scan reads on your site

Not counted above: robots.txt and the other standard files listed earlier, redirects, the security-header test (about 4 requests), and the images, styles and scripts the headless browser loads with a page. These are limits, not typical amounts: a site with fewer pages and links gets fewer requests.

If your firewall blocks PulsekitBot

• When a firewall or bot protection (Cloudflare, Sucuri, Akamai, Wordfence and others) shows us a challenge, we skip the page checks that need your HTML and still score everything else (email and DNS, TLS, domain, Google listing, AI answers, job posts, Places, CrUX and so on). A pulse is fully “blocked” only when none of its checks could run. If a monthly pulse is still blocked 3 days after its first blocked run, we pause billing for that pulse until it's unblocked and credit the blocked days on your next invoice.
• We never retry with a disguised browser user agent, solve challenges or route around your firewall.
• To let us in, allow requests whose user agent contains PulsekitBot and that carry your site's private X-Pulsekit-Verify header. A user agent alone can be faked by anyone, so don't allow on the user agent alone. Customers see their header value and step-by-step instructions for their firewall at /unblock. We send the header only to your own site.
• Our scanner runs on cloud infrastructure without fixed IP addresses, so IP allowlists won't work.

Opt out or contact us

Add User-agent: PulsekitBot / Disallow: / to robots.txt, or email hello@getpulsekit.com and we stop visiting your site within 2 business days. We may still look up public DNS and domain registration records. To be scanned again later, email us from the same address. If you're a subscriber and ask us, from your account's email address, to stop scanning your own website, we treat it as cancelling that website's subscription under "Cancelling or removing a pulse" in our Terms. The one-month minimum applies: if you ask during your first month, the full first month is still billed. We stop scanning it right away, billing stops at the end of the period you've paid for (or at the end of the one-month minimum, if that's later), your existing reports stay available until then, and no refund is due. A robots.txt rule blocking PulsekitBot isn't a cancellation request; it's handled as a blocked check, and billing for the affected pulses pauses under the same 3-day rule as a firewall block. To be scanned again, email us from the same address.