Aller au contenu principal
Bêta privéeL'app Shopify qui rend vos produits lisibles et vérifiables par l'IA.App Shopify : soyez lisible par l’IAJe veux un accès

Verity Score Audit Bot

VerityScoreAudit is the crawler used by the Verity Score GEO audit platform (verityscore.io) to analyze public e-commerce pages on behalf of merchants who request a free audit of their own store. Full audit runs are intended for owner-operated or owner-authorized submissions. Any unauthenticated public preview remains bounded, robots-aware, and does not imply that Verity has verified store ownership.

Purpose

When a Shopify merchant submits their store URL to Verity Score, our bot fetches a limited set of publicly accessible pages (homepage, 3 to 5 product pages, policy pages, robots.txt, sitemap.xml, llms.txt, schema.org JSON-LD) to produce a GEO readiness report. We do not scrape catalogs at scale, we do not train AI models on fetched content, and we do not redistribute fetched data.

Identification

  • User-Agent: VerityScoreAudit/1.0 (+https://verityscore.io/bot; audit tool - politely paced)
  • Operator: Verity Score - verityscore.io
  • Contact: [email protected] (abuse / blocklist requests), [email protected] (general)
  • Bot category: Site Analytics / SEO / AI Readiness Diagnostic

Current verification status

VerityScoreAudit is designed to be verifiable by User-Agent, robots.txt behavior, published IP ranges, reverse DNS, and Web Bot Auth signatures. Cloudflare Verified Bot submission must wait until the IP list contains real static egress ranges, reverse DNS is forward-confirmed, and production logs prove outbound signature coverage. Until then, the public files below are discovery and validation artifacts, not a claim that Cloudflare has already verified the bot.

IP ranges

The canonical list of outbound IP addresses used by the audit bot is published at:

This file follows the same format as Googlebot's googlebot.json and is updated whenever our infrastructure changes. It includes the creationTime so you can detect updates. Cloudflare, firewall vendors, and site operators may consume this file to allow-list our traffic once it contains non-placeholder static egress IPs. If the file contains 0.0.0.0/32, static IP allow-listing is not ready yet and that placeholder must not be allow-listed.

Requests are designed to be signed with Web Bot Auth (draft-meunier, RFC 9421 HTTP Message Signatures). The public key directory is available at /.well-known/http-message-signatures-directory, so verifiers can cryptographically confirm signed requests once outbound signing is enabled and observed in production logs. Unsigned requests should still be evaluated through User-Agent, robots behavior, rate limits, IP/rDNS when available, and manual merchant authorization.

Reverse DNS

Reserved audit egress IPs should resolve to hostnames under bot.verityscore.io (e.g. crawl-01.bot.verityscore.io), and the forward DNS of each hostname should resolve back to the same IP. This is the target verification model before Cloudflare Verified Bot submission and matches the Googlebot verification procedure.

Rate limits and politeness

  • Fewer than 1 request per 2 seconds per target host (via pacedFetch).
  • Maximum 13 pages per audit per host (homepage + PDPs + policy pages + technical endpoints).
  • One audit per domain per 24 hours unless explicitly re-triggered by the site owner.
  • No parallel requests to the same origin. No headless browser automation of interactive checkouts or forms.
  • Timeouts: 15s per request, 120s hard deadline per audit.
  • Respects 503, 429, and Retry-After.

robots.txt

The bot respects RFC 9309 (robots.txt). We also honor the draft Content-Signal directive. To block us, add one of the following to your robots.txt: 

# Block Verity Score audit bot
User-agent: VerityScoreAudit
Disallow: /

A 403 response, a Cloudflare WAF rule, or a Disallow directive will all stop the crawl. We cache blocklist decisions for 24 hours to avoid retrying blocked origins.

What we don't do

  • We do not bypass paywalls, login walls, or region blocks.
  • We do not submit forms, add to cart, or simulate purchases.
  • We do not store PII (names, emails, phone numbers) extracted from audited pages.
  • We do not resell, syndicate, or train models on fetched content. Audits are generated on demand for the requesting merchant only.
  • We do not ignore noindex, nofollow, or X-Robots-Tag.

Security and abuse

If you believe the bot is misbehaving, please email [email protected] with the timestamp, source IP, and a sample User-Agent. We respond within 2 business days and will block the offending audit. Our security disclosure policy is at /.well-known/security.txt.

Version francaise

VerityScoreAudit est le crawler utilise par la plateforme d'audit GEO Verity Score pour analyser les pages publiques des boutiques Shopify dont le proprietaire a demande un audit.

Le bot respecte RFC 9309 (robots.txt), pace les requetes (moins d'1/s par host), n'extrait jamais de PII, ne soumet aucun formulaire et n'entraine aucun modele IA sur le contenu recupere.