Machine-readable version:
/bot.jsonWe open a page in a real browser on an emulated device profile, wait for it to render, record load timing and screenshots, and leave. We request the page and its assets, the same as a visitor would.
We render and execute JavaScript.
The one exception is ads: we block requests to ad networks, so a check never loads them. Ad networks.
Example user agent string
Mozilla/5.0 (Linux; Android 13; SM-A536B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Mobile Safari/537.36 Panoptick/1.0 (+https://panoptick.com/bot)
The device and browser segment changes with the device profile we’re emulating and with browser updates.
Panoptick does not change.
Match on the substring Panoptick. Don’t match on the full string.
Our token is present in every request we make. We never send a device string without it.
We do not offer, and will not build, a mode that hides our identity from the sites we check.
We also send two headers on every request:
X-Panoptick-Bot: ruxX-Panoptick-Monitor: <opaque monitor id>X-Panoptick-Monitor is opaque. It deliberately carries no customer or account information, because the user agent and headers are visible to every host a page requests, including third-party scripts.
Because we render pages in a real browser, your analytics scripts run and their beacons fire. Our checks can appear as sessions. We publish our user agent specifically so this is easy to filter.
Match on: Panoptick
Don’t filter by IP. Our checks come from consumer connections that rotate, so IP filtering won’t work.
| We do | We never |
|---|---|
|
|
We do
We never
We block requests to ad networks, ad exchanges and banner scripts. A monitoring check that loaded your ads would generate impressions nobody saw and clicks nobody made. That would distort your reporting and cost advertisers money. We never generate an ad impression.
Ad scripts are often a significant share of real page weight. Timings from our checks exclude that weight, so they can be faster than what a visitor with ads loading experiences.
We’re planning authenticated monitoring: checking pages behind a login. If we add it, it will only ever use credentials supplied by a site owner for their own property. We’ll update this policy before it ships.
We respect robots.txt.
We fetch it before each check session and cache it for no longer than 60 minutes, so a Disallow rule takes effect within the hour.
User-agent: Panoptick Disallow: /
We ignore Crawl-delay. Our request rate is fixed and low. See Request rate and load.
Because we render the page in a real browser, one check requests every asset on the page. In your server logs a check looks like a visitor session, not a single HEAD request.
User agent matching is the only option. Our checks come from rotating consumer connections, and we don’t publish IP ranges.
A user agent match can be spoofed by anyone. If traffic claiming to be us looks wrong, report it to [email protected].
Create a WAF custom rule with this expression, and set the action to Skip so it bypasses challenges and rate limiting for our checks.
(http.user_agent contains "Panoptick")
Match the user agent in an nginx map block, then reference $is_panoptick_bot wherever you rate-limit or challenge requests.
map $http_user_agent $is_panoptick_bot {
default 0;
"~*Panoptick" 1;
}Set an environment variable with SetEnvIf, then reference it in your access or security module configuration to bypass it for our checks.
SetEnvIf User-Agent "Panoptick" is_panoptick_bot
Shopify doesn’t expose WAF rules directly. If a firewall, CDN or bot-management app sits in front of your store, add a rule there matching the token below in the User-Agent header.
Panoptick
Other WAF or firewall: match Panoptick as a substring of the User-Agent request header.
Stops us within an hour, requires no contact with us, and works whether or not you’re our customer.
User-agent: Panoptick Disallow: /
Takes effect immediately. Match Panoptick at your WAF or server — the same rules as Allowlisting us, with the action set to block instead of allow.
For anyone who wants us off a property entirely, and particularly for anyone who believes we’re monitoring a site they own and did not authorize.
Someone asking us to leave their site shouldn’t have to wait on our review to be left alone.
If you’re the site owner and monitoring was suspended in error, contact [email protected] and we’ll restore it once we’ve confirmed the request came from someone acting for the domain.
A blocked check is reported as Blocked, not as Down. We don’t retry aggressively, and the monitor auto-pauses after five consecutive blocks with the account notified. A monitor suspended by an abuse request shows as Suspended with a link to this section.
A check produces screenshots of the rendered page, load timing and Core Web Vitals, the request waterfall, and response headers.
Only the account that created the monitor can see its results.
Screenshots and request waterfalls are kept 7 days on free accounts and 30 days on paid accounts, then deleted.
Aggregated timing metrics are kept for up to 1 year.
Session data is never used to train machine learning models and is never shared between accounts.
See our Privacy Policy.
© 2026 Suprematic Technologies Lda. All rights reserved.