Let Pulsekit in

Let PulsekitBot past your firewall

If a firewall or bot protection stops our scanner, those checks show as "blocked" instead of a Pulse Score. These steps let PulsekitBot past your bot checks. Most firewalls take a few minutes.

We always say who we are, and we never solve CAPTCHAs, disguise our scanner or sneak around your firewall. How PulsekitBot behaves.

Not your job? If someone else looks after your website or hosting, send them this page. Everything they need is here.

1. Copy these values

User-Agent containsPulsekitBot

Header nameX-Pulsekit-Verify

Header value: your site's private verify code is shown only to its signed-in owner, so nobody else can pretend to be PulsekitBot to get past your firewall. Sign in or add your site to see it. Once it's in your account, our crawler and headless browser add it to their HTTPS requests to your site's own hosts (not to DNS lookups, TLS handshakes or other sites).

Full user agent:

Mozilla/5.0 (compatible; PulsekitBot/1.0; +https://getpulsekit.com/bot)

When we load your homepage the way a phone would:

Mozilla/5.0 (compatible; Mobile; PulsekitBot/1.0; +https://getpulsekit.com/bot)

Matching on “PulsekitBot” covers both.

2. Add the rule in Sucuri Website Firewall

We couldn't tell which firewall it was; pick yours. Not right? Cloudflare · Vercel Firewall · AWS WAF (CloudFront / ALB) · Akamai · Imperva (Incapsula) · Wordfence (WordPress) · DataDome / HUMAN bot protection · Any other firewall or host

Where: Sucuri dashboard → Website Firewall → your site

Sucuri allowlists by IP or URL path; our scanner runs on cloud infrastructure without fixed IPs, so an IP allowlist won't work.
Open a Sucuri support ticket asking them to allow requests whose User-Agent contains “PulsekitBot” and that carry header x-pulsekit-verify with your token.

3. Check it's right

☐ The rule matches the user agent and the X-Pulsekit-Verify header (a user agent alone can be faked by anyone).
☐ It skips only bot checks, JavaScript challenges and CAPTCHAs (your other firewall rules stay on), and sits above the bot-check rules.
☐ The rule lets in requests that carry both our user agent and your site's private verify code, and only skips bot checks. Keep the code private: anyone who has it can pass the rule. If you think it's been exposed, delete the rule and tell us.
☐ It's deployed on the live domain.
☐ robots.txt doesn't disallow PulsekitBot (we always honor it). If your robots.txt disallows PulsekitBot from your homepage, we count your monthly pulses as blocked, just like a firewall block: they get no Pulse Score, we retry daily, and the same billing pause applies. It isn't a cancellation.
☐ No IP allowlist: our scanner's IP addresses change.

4. Re-run the blocked checks

After adding the rule, run a scan.

What you pay while we're blocked

A blocked check has no Pulse Score and isn't a delivered report. We retry daily.
If a monthly pulse is still blocked 3 days after its first blocked run, we pause billing for that pulse until it's unblocked and credit the blocked days on your next invoice. Pulses that aren't blocked keep running as usual; a bundle keeps its discount on them.
If billing paused, it resumes automatically after the first run that gets through, whether that's your re-run here or our daily retry.
A blocked one-time report isn't delivered until it runs; re-run it here at no charge. If we still can't get in after 14 days, we refund it in full to your original payment method within 10 business days. If only some pulses in a one-time report stay blocked, we refund those pulses' share. One-time reports are otherwise refunded only if we can't deliver the report.