The ScanTower Security Scanner
This page identifies the automated requests ScanTower makes against websites, so that site owners, WAFs, and bot-management providers can recognise, allowlist, rate limit, or block them with confidence. It exists in support of our Cloudflare Verified Bot submission.
ScanTower (scantower.io) is an external website security monitoring service. See About ScanTower for what the product does.
Every request the scanner makes is triggered by a specific ScanTower customer asking us to scan a specific site, either their own domain, or one they have declared they are authorised to test. ScanTower does not run an independent, self-directed crawl of the web the way a search engine does: the target is always chosen by the end user driving the scan, and the request is made by ScanTower's own infrastructure on their behalf.
How to identify it
Every request the scanner makes against a scan target carries the same, single User-Agent string:
This is deliberately the only identity our target-facing traffic uses, so that a single WAF rule or bot-management allowlist entry covers every scan type: header checks, DNS and SSL checks, CMS/version probes, and the misconfiguration and hardening scans. Requests made to third-party infrastructure we depend on (DNS resolvers, WHOIS/RDAP registries, vulnerability feeds) are not part of this identity and are not requests to your site.
What it does
- •Fetches publicly accessible pages and resources: the homepage, common CMS and framework version-detection endpoints, security-relevant headers, and a bounded list of paths used to check for accidentally exposed files.
- •Runs each scan against one target at a time, kicked off by that target's own ScanTower customer, with a bounded concurrency against that single host and a request timeout so nothing hangs a connection open indefinitely.
- •Never attempts to log in, guess credentials, brute force anything, or bypass authentication, CAPTCHAs, or WAF/rate-limit protections.
- •Never sends data anywhere other than back to the customer who requested the scan.
Allowlisting, rate limits, and blocking
If you run ScanTower against your own site and want your WAF or bot-management provider to stop challenging or blocking the scan, allowlist the exact User-Agent string above, or look for us in your provider's verified bot/agent directory.
If you are seeing scan traffic against a site you own and did not expect, or you would like us to stop scanning a domain, contact us at scantower.io/contact with the domain in question and we will investigate.