The ScriptPatrol scanner
ScriptPatrol runs an automated, read-only scanner that checks web pages for client-side security problems: unauthorized JavaScript changes and weakened security headers. If you reached this page from a User-Agent in your access logs, here is everything your security and network teams need to identify it, let it through cleanly, or block it.
Seeing ScriptPatrolIndex in your logs? That is a different crawler, the one that measures Czech and Slovak online shops for the ScriptPatrol Index. It has its own page.
Scanner identity
ScriptPatrol/1.0 (+https://scriptpatrol.com/bot)The token we add so you can recognize legitimate scans in your access logs. Match on the “ScriptPatrol/1.0” token instead of the whole string. A User-Agent is spoofable, so treat it as a recognition aid and pair it with the header below for an actual allow decision.
X-ScriptPatrol-VerifyA per-site secret we send on every scan so you can identify us independently of IP. The value is unique to your site and generated in your dashboard. It is the surest way to recognize us.
How the scanner behaves
What the scanner does, and what it will never do.
Read-only, always
The scanner issues read-only GET requests. It never submits forms, never logs in with a username and password, never completes a purchase, creates an account, or changes anything on your site. For pages behind a mutually-authenticated (mTLS) endpoint, an owner can optionally configure a client certificate so the scanner can complete the TLS handshake. It still only reads the page.
Inspects scripts, never visitors
It loads the page the way a browser does, executing JavaScript, so it can see the scripts and security headers that actually run. It records each script’s URL, SHA-256 hash and content (up to 250 KB per script, deduplicated by hash), which is the evidence that proves exactly what changed. It never records visitor data.
Scheduled and polite
Scans run on a schedule, and the scanner rate-limits itself per domain. It is built to be a quiet, predictable visitor.
A security tool, on request
ScriptPatrol watches the client-side layer for unauthorized JavaScript changes and weakened security headers. It is used by site owners to monitor their own pages, and to produce client-side security assessments.
Letting us through cleanly
If a WAF or bot-management rule challenges or blocks the scanner, your monitoring can show gaps. To allow legitimate scans while everything else stays protected, use either lever. The rule is “IP or header”, so one is enough:
- Recommended: the secret header. Allow any request carrying
X-ScriptPatrol-Verify. It is fixed per site and independent of our IP. - Or our IP address. If your firewall or security plugin only understands addresses, your dashboard shows ours under Settings, Scanner Access, and your access log shows it beside the User-Agent token. It is a shared address that can change, so the header above is the more reliable lever.
Monitoring a site you own? Your dashboard generates your token, a ready-to-paste Cloudflare rule, and a one-click verify check under Settings → Scanner Access.
If you would rather we did not
We are a security tool and have no interest in scanning a site whose owner does not want us there. You can stop the scanner at any time:
- The surest way is to tell us. Email support@scriptpatrol.com and we will stop scanning your domain.
- You can also block our egress IP or User-Agent token at your edge.
Questions from a security or network team?
We are happy to confirm any of the above in writing, or to work through your specific edge configuration. Real people answer.