What this does

When you train your bot from your website, Velaro's scanner visits your pages the way a browser would. Some sites protect themselves with a firewall or bot protection that turns the scanner away. Allowing Velaro's scanner takes a few minutes and lets the scan read your public pages.

When to do this

Do this when a website scan shows any of these signs:

• The scan finishes with blocked pages, a 403 (access denied) message, or very few or no pages.
• The activity log names a protection service such as Cloudflare, Akamai, Imperva, DataDome, Sucuri or ModSecurity.
• Pages come back empty or show a "verify you are human" or "checking your browser" message.

If the scan page shows a blocked message, the card named Allow Velaro to scan your site on the Web tab of Bot Training lists everything on this page.

What to allow

Give your web host or IT team these three details. Any one of them is enough, depending on what your firewall accepts.

The hostname scanner-ip.velaro.com always points to the scanner's IP address. If your firewall accepts hostnames, use it so you do not need to update anything if the address ever changes. If it accepts only numbers, use the IP address. The hostname is for firewall and allowlist settings only. Do not add it to a Content Security Policy.

Every Velaro customer's scans leave from this same address, so allowing it covers your site and nothing else is needed on Velaro's side.

How to allow it in common firewalls

The menu names differ, but the steps are the same idea everywhere.

1. Open your firewall, WAF or bot protection settings (for example Cloudflare, Akamai, Imperva, Sucuri, AWS WAF, Azure Front Door, or your web host's security panel).
2. Find the allow list, also called IP access rules, trusted IPs, exceptions or a bypass rule.
3. Add the IP address 20.237.33.166 with the action Allow (some products call it Bypass or Skip).
4. If the product allows rules by user agent, add a rule that allows requests whose user agent contains VelaroBot. Combine it with the IP address if you can, so only Velaro matches.
5. If your bot protection has a separate "bot fight" or "challenge" feature, make sure the same IP is excluded from it too. Allowing an IP in one place does not always cover the challenge page.
6. Save and wait for the change to apply. Most products apply it in a minute or two.

Your web host's support team can do this for you. Send them the table above.

Confirm it worked

1. Go to Bot Training and open the Web tab.
2. Start a new scan of the same pages, or rescan the job that was blocked.
3. Open the job's activity log. Pages should now be read with no blocked message, and the page count should rise.

If it still does not work

• Make sure the rule is on the exact site and the exact protection layer that returned the block. Some sites have a firewall at the host and another in front of it.
• Check that your bot protection does not also require a CAPTCHA for everyone. A scanner cannot answer a CAPTCHA.
• You can always train your bot from content instead. Open the pages in your browser, save them (File, Save Page As), and add them on the File Training tab.
• Still stuck? Contact Velaro support and include the name of the scan job and the website address. We can read the scan log and tell you which rule is blocking it.