our scanner

A considerate visitor, not a bot storm

Audera monitors your pharmaceutical sites from the outside, read-only, with nothing installed. This page explains exactly how our scanner behaves, how to recognise it in your access logs, and how to allowlist it if a security layer ever gets in its way.

fig. 01

pacing

One page at a time

A scan visits your pages strictly one page at a time, never concurrently, with a short randomised pause between each request. We never fan out parallel connections, so the load on your origin stays close to a single ordinary reader.

fig. 02

cadence

Daily, off-peak, jittered

Scheduled scans run at most a couple of times a day, in your site's local off-peak hours, with each scan's start time offset by a random amount so many sites never all begin at once.

fig. 03

scope

Read-only, outside-in

We only ever request pages a normal browser would, and we never submit forms, change data, or attempt to authenticate beyond credentials you've explicitly given us for a gated environment.

Identifying us in your logs

Every request Audera makes, from the lightweight status probe to our outbound link checks and the headless browser render, carries the same identification header so you can recognise and allowlist us in one rule:

request header

X-Audera-Monitor: +https://audera.app/scanner

If a WAF, bot-management product, or rate-limiter is blocking automated access, allow requests carrying that header through to your origin. When Audera can't reach a site, we tell you in one clear finding rather than flooding you with per-page errors. The underlying cause is almost always a security layer that hasn't been told we're friendly.

good citizenship

We honour redirects and stop at your site's own boundaries
We cap how much we download per page and never hammer an endpoint
We back off and surface a single finding rather than retrying in a loop

Something still not right? Email [email protected] and a person will help you allowlist us.

Copy-paste rules

Ready-made rules for the security layers we most often meet in front of pharmaceutical sites. Each one matches the header above and lets our scanner through. Safe to forward to a hosting or security team as-is.

Cloudflare

fig. 04

WAF → Custom rules → Create rule. Set the action to Skip, then tick all remaining custom rules, Bot Fight Mode and the managed rulesets.

rule expression

(http.request.headers["x-audera-monitor"][0] eq "+https://audera.app/scanner")

AWS WAF

fig. 05

Add to your web ACL ahead of your blocking rules, so the Allow short-circuits them.

rule JSON

{
  "Name": "AllowAuderaMonitor",
  "Priority": 0,
  "Action": { "Allow": {} },
  "Statement": {
    "ByteMatchStatement": {
      "FieldToMatch": { "SingleHeader": { "Name": "x-audera-monitor" } },
      "PositionalConstraint": "EXACTLY",
      "SearchString": "+https://audera.app/scanner",
      "TextTransformations": [{ "Priority": 0, "Type": "NONE" }]
    }
  },
  "VisibilityConfig": {
    "SampledRequestsEnabled": true,
    "CloudWatchMetricsEnabled": true,
    "MetricName": "AllowAuderaMonitor"
  }
}

Akamai

fig. 06

Bot Manager has no import format, so this is the match to recreate in the UI. Add the same header condition to your App & API Protector rate policies.

custom bot definition

Bot Manager → Custom bot categories → Add
  Name:   Audera monitor
  Match:  Request Header  X-Audera-Monitor
          is one of       +https://audera.app/scanner
  Action: Allow

nginx

fig. 07

For origin-level rate limiting. nginx does not count requests whose limit key is empty, so the monitor is exempt while ordinary visitors stay limited by IP.

nginx.conf (http block)

map $http_x_audera_monitor $rate_limit_key {
    "+https://audera.app/scanner"  "";
    default                  $binary_remote_addr;
}

limit_req_zone $rate_limit_key zone=site:10m rate=10r/s;

a note on trust

A request header can be set by anyone, so treat these rules as a way to stop blocking a known-good visitor, not as authentication. Keep them scoped to bot management and rate limiting, and never use the header to bypass a login or expose a non-public environment. If your security team would rather allowlist by source IP, email [email protected] and we will send you our current egress addresses.