What Stripebot does
Stripebot is Stripe's automatic web crawler. It collects data from the websites of Stripe users in order to provide services to those users and to comply with financial regulations. It identifies itself with a browser-like user-agent string ending in Stripebot/{version} and a link to Stripe's documentation. Stripe states the crawler uses algorithms to minimize server traffic so it does not impair the speed and accessibility of the sites it visits.
How to control Stripebot
Target Stripebot in your robots.txt with the Stripebot token. Rules apply per bot, so you can allow this one while blocking others, or the reverse.
Allow Stripebot
User-agent: Stripebot
Allow: /Block Stripebot
User-agent: Stripebot
Disallow: /Genuine Stripebot requests can be verified with a reverse DNS lookup that resolves to a hostname under crawl.stripe.com, confirmed by a forward lookup, and Stripe notes that robots.txt caching may prevent the crawler from detecting file changes immediately.
How to identify Stripebot
Temso identifies Stripebottraffic by matching the request's User-Agent header against this pattern. User-agent strings can be spoofed, so treat a match as an indication, not proof.
StripebotStripebot FAQ
What is Stripebot?
Stripebot is the automatic web crawler of Stripe, the payments company. It collects data from the websites of Stripe users to provide services and to comply with financial regulations.
How do I block Stripebot?
Add a robots.txt group with "User-Agent: Stripebot" and Disallow rules for the paths you want excluded. Stripebot largely follows the RFC 9309 Robots Exclusion Protocol, prioritizing rules addressed to it and falling back to the wildcard (*) group if none exist. Note that caching may delay Stripebot from picking up robots.txt changes, and Stripe offers stripebot@stripe.com for crawler questions.
About Operational Bots
Monitoring, security scanning, link previews, webhooks, and feed fetchers: the utility traffic that keeps integrations and shared links working.
Most of this traffic is service-critical or user-triggered. Webhooks and previews don't follow robots.txt, and blocking them tends to break things you rely on.
