Vigensa crawler

This is the published identity of the Vigensa static crawler. If it showed up in your logs, this page is the full account of what it is, what it fetches, and how to stop it.

Who operates it

The operator is Vigensa. There is no separate legal entity behind the name. A human reads both mailboxes below.

Primary

[email protected] for blocks, abuse, or a request to stop

Secondary

[email protected] for identification or allowlisting questions

Origin

https://www.vigensa.com

What it is

Vigensa records facts about a website: headers, redirects, TLS, robots rules, sitemaps, conventional legal links, and a small sample of HTML pages. It does not grade those facts. It does not apply law. The user agent below is this crawler and only this crawler.

User-Agent:

Vigensa/1.0 (+https://www.vigensa.com/bot)

What it requests

GET only, same host as the scan target, no cookies, no credentials.

• The seed URL of the scan
• Pages listed in the sitemap or linked from pages already fetched, within the budget
• Four conventional paths: /robots.txt, /sitemap.xml, /.well-known/security.txt, /llms.txt

Authorized scans, which require the site owner to verify the domain, may add a short configured list of conventional exposure paths. That list is empty unless the owner asked for it. Free scans never use it.

What it never requests

• Authentication of any kind. No login forms, no tokens, no Authorization header, no cookies
• Form submissions. Nothing is POSTed
• Vulnerability probes, payload injection, or parameter fuzzing
• Path guessing beyond the four conventional paths above
• Hosts outside the target origin, including third-party analytics, CDNs, and payment providers
• A request rate above the budget in the table below

robots.txt

The crawler reads /robots.txt first and honours it. A Disallow for this product token, or for *, skips that path and records why. The run is still valid. It does not try to get around a disallow.

Product token: Vigensa.

To block the crawler:

User-agent: Vigensa
Disallow: /

To allow it, do not disallow that token, or name it and allow the paths you want scanned:

User-agent: Vigensa
Allow: /

If you filter on User-Agent, match the string above. If you filter on HTTP Message Signatures, the key directory is linked below. Cloudflare Verified Bots and other verifiers can treat a valid signature as this crawler.

Request rate

These are the defaults the crawler holds itself to. An operator can lower them. They cannot raise concurrency above 2 or the authorized request cap above 200.

Free scans are unsolicited. One request per second, twenty-five requests, two minutes. Authorized scans are requested by the site owner and still stay well below a browser session.

Key directory

Requests are signed with HTTP Message Signatures (RFC 9421) using the Web Bot Auth profile. The public key used in those signatures is published here:

https://www.vigensa.com/.well-known/http-message-signatures-directory

This page: https://www.vigensa.com/bot