The crawler behind Go Voltic, and how it behaves on your site.
Last updated 2026-08-08
This page is the documentation our user-agent strings point to, and the page we name for any directory or verification service that asks for one. It describes what reads your site when Go Voltic runs a scan, how to confirm a request really came from us, what it will and will not do, and how to keep it off your site entirely.
1Go Voltic operates one crawler, and this page is its documentation.
Go Voltic is a website review service. When a visitor starts a free scan on this site, or when a customer buys a paid Deep Scan, our software reads the target site's public pages the way a visitor's browser would, and scores what it finds. Every request it makes carries one of the user-agent strings below, so it can be told apart from a person in a browser.
Go Voltic is operated from Charleston, South Carolina. Questions about this policy, or about a specific request you saw in your logs, go to hello@go-voltic.com.
2GoVolticScanner is live. GoVolticBenchmark is planned and not yet running.
Every request Go Voltic makes to a website today carries the first string below. A second identity is planned, so it is listed here ahead of time rather than showing up in your logs unexplained.
| User-agent | What it does | Status |
|---|---|---|
GoVolticScanner/1.0 (+https://go-voltic.com/scan) | Reads a site's home page, plus up to 3 further pages on a free scan. On a paid Deep Scan it reads up to 40 pages, fetched through Cloudflare's Browser Rendering service rather than as a direct request. See Section 3 for what that changes about verification. | In service |
GoVolticBenchmark/1.0 | A second identity, planned for a separate scanning pass distinct from the on-demand scan above. It will be described here in full once it starts making requests. | Not yet in service |
If a request arrives with a name other than these two, it did not come from Go Voltic.
3Every free-scan request carries a signature you can check.
On the free-scan path, GoVolticScanner signs its own requests under Web Bot Auth, RFC 9421 HTTP Message Signatures. The signature covers @authority and signature-agent, carries the tag web-bot-auth, and uses Ed25519.
The public key is published at go-voltic.com/.well-known/http-message-signatures-directory. Look for the key with id BzaVmlHFF0Npufgq0tpQ9kYURkMH4sk85gKvLsbWq-s, and verify the signature against it with Ed25519.
A paid Deep Scan is different. Those pages are fetched through Cloudflare's Browser Rendering service rather than by a direct request from our own servers, and Cloudflare attaches its own Web Bot Auth signature and its own Signature-Agent to that traffic. On that path, the signature identifies Cloudflare's rendering infrastructure, not Go Voltic, and our key above does not cover it. The user-agent string is what identifies a Deep Scan request as ours.
4It honors robots.txt as a hard stop, and holds to one request per second.
GoVolticScanner checks a site's robots.txt before reading anything else, on both the free scan and the Deep Scan. A Disallow ends the run on the spot. There is no retry, and no attempt to work around it.
A refusal on the page you asked us to scan ends the run. That means HTTP 401, 403, 406, 418, 429 or 503, and the same is true of a CAPTCHA or a login wall. A refusal anywhere else in that scan, on robots.txt, on the sitemap, or on a linked inner page, is recorded as not scored and skipped: the walk continues without it, and nothing refused is retried. A Deep Scan is looser still. It aborts early only once every page it has opened so far comes back refused.
Requests to a single host are held to one per second, at most. A free scan reads a site's home page and up to 3 further pages. A paid Deep Scan reads up to 40 pages.
Every scan we run is against a site the customer has told us, under our Terms, Section 4, that they own or are authorized to have reviewed.
5It never signs in, submits a form, or opens an account.
- It never signs in. Everything it reads is what a first-time visitor with no account can see.
- It never accepts or stores credentials. Nobody offers it a password and it does not ask for one.
- It never submits a form.
- It never completes a transaction. No purchase, no checkout, no booking.
- It never creates an account on the site it is reading.
A report built from a scan carries noindex, nofollow, noarchive in its own header. It is never listed in search results.
6A robots.txt Disallow takes effect on our next visit, with no email needed.
The mechanism you already control is the fastest one. Add a Disallow rule for GoVolticScanner, or a blanket User-agent: * rule, to your site's robots.txt. The scanner reads robots.txt before every scan, on both the free and paid paths, and a Disallow stops it on our very next visit. Nothing has to be sent to us first, and nothing here needs our confirmation to take effect.
If you would rather reach a person, or you do not control robots.txt directly, email hello@go-voltic.com and name the domain. A person reads every message, typically within one business day.
7A monitored inbox reads every report of a suspected violation.
If a request from GoVolticScanner ignored robots.txt, arrived faster than one per second, or otherwise behaved differently from what this page describes, write to hello@go-voltic.com. Include the timestamp, the requesting IP address, and the log line if you have one, so we can look at the same request you saw.
The same address is where any other complaint about this crawler's behavior on your site should go.
8Every scan runs under Terms you can read in full.
Authorization to scan a site, what we can reach, and the rest of what governs a Go Voltic scan are set out in the Terms & Conditions, particularly Section 4. What we collect during a scan and how long we keep it is covered in Legal.