Our scanner
BCDRPulse's free tools (the Security Headers, SSL Certificate, Response Time and Down checkers) fetch a page only when a person asks for that page to be checked. A check makes a few requests: the page itself (three timed samples for the Response Time Checker), plus the plain HTTP or www form of the address where the check needs it. Never a crawl.
How to recognise it
- User-Agent:
Mozilla/5.0 (compatible; BCDRPulseHeaders/0.1; +https://bcdrpulse.com/bot). The tokenBCDRPulseHeadersis always present, so one allow rule covers every tool. Each tool adds its own token after it:BCDRPulseSecHeaders,BCDRPulseSSL,BCDRPulseSpeedorBCDRPulseUptime. - Cookies: within one check, cookies the site sets on a redirect are sent back on the next hop, as a browser does. Nothing is kept between checks.
- Origin: Amazon Web Services. The main scanner runs in us-east-1 (N. Virginia) and leaves through one fixed IPv4 address,
100.60.18.5, and over IPv6 from2600:1f10:4c41:dd00::/56; the same list for machines is at /bot-ips.json. A check asked for from every region also comes from AWS Lambda in eu-west-1 (Ireland) and ap-south-1 (Mumbai), and the HTTP/3 timing from a second function in us-east-1; those use Lambda's shared addresses, which change. The User-Agent is the same from all of them, so a rule on the User-Agent covers every check. - Requests: plain GET to ports 80 and 443, following redirects one at a time (up to 10). No forms, no logins, no JavaScript. Bodies are read only to look for firewall pages and, for HTML, meta tags and script tags. Two things happen only when the person checking asks for them: the SSL Certificate Checker can start TLS on one of twelve other ports (mail, directory, database and remote-desktop ports) to read the certificate, and sends nothing more; and the Response Time Checker's API mode sends the method, headers and body its user entered, to that one address.
- Never: private, internal or cloud-metadata addresses; any port other than 80, 443 and those twelve.
Allowing it through a firewall
Cloudflare: Security > WAF > Custom rules > Create rule. Field User Agent, operator contains, value BCDRPulseHeaders, action Skip. On the Free plan, Bot Fight Mode cannot be skipped by a rule: switch it off while you scan, then back on.
Vercel: Firewall > add a rule for User Agent contains BCDRPulseHeaders with Bypass, and turn Attack Challenge Mode off for the scan.
Wordfence, Sucuri and other security plugins: allow the User-Agent, or pause the rate limit while you scan.
ModSecurity: SecRule REQUEST_HEADERS:User-Agent "@contains BCDRPulseHeaders" "id:1009001,phase:1,pass,nolog,ctl:ruleEngine=Off"
Opting out
If you do not want your site checked by these tools, block the User-Agent, or write to support@bcdrpulse.com and we will refuse scans of your domain.