What Detectify does
Detectify is a web application security scanner that runs scans configured by Detectify customers. By default its requests identify with the user agent 'Mozilla/5.0 (compatible; Detectify) +https://detectify.com/bot/{token}', and visiting that link shows who initiated the scan and when it occurred. The scanner's device setting controls both the user agent it sends and the screen size used during crawling, and customers can configure custom user agents, so a given scan's requests may not carry the default string. It keeps the same device for the duration of a single scan but can use different devices across separate scans or scan profiles.
How to control Detectify
Target Detectify in your robots.txt with the Detectify token. Rules apply per bot, so you can allow this one while blocking others, or the reverse.
Allow Detectify
User-agent: Detectify
Allow: /Block Detectify
User-agent: Detectify
Disallow: /Detectify's default user agent contains a per-scan link (detectify.com/bot/{token}) that reveals who initiated the scan and when, but the documentation does not publish IP ranges or describe robots.txt handling.
How to identify Detectify
Temso identifies Detectifytraffic by matching the request's User-Agent header against this pattern. User-agent strings can be spoofed, so treat a match as an indication, not proof.
DetectifyDetectify FAQ
What is Detectify?
Detectify is an application security scanner that crawls and tests websites on behalf of the Detectify customer who configured the scan. It normally identifies itself with the user agent 'Mozilla/5.0 (compatible; Detectify)' followed by a link that shows who initiated the scan and when.
How do I block Detectify?
You can add a robots.txt group with 'User-agent: Detectify' and 'Disallow: /'. The documentation does not state whether the scanner obeys robots.txt, and customers can replace the default user agent with a custom one, so scan traffic will not always contain the Detectify token.
About Operational Bots
Monitoring, security scanning, link previews, webhooks, and feed fetchers: the utility traffic that keeps integrations and shared links working.
Most of this traffic is service-critical or user-triggered. Webhooks and previews don't follow robots.txt, and blocking them tends to break things you rely on.
