KesloBot/1.0
You found us in your logs
That was our crawler. Somebody asked Keslo to audit a website — for speed, accessibility, security headers and other things — and to do that we had to read the pages. If it was your site, someone requested a report on it.
Nothing was changed, nothing was submitted, and nothing was kept that a visitor could not see. If you would rather we did not come back, the two lines that stop us are below and they work immediately.
Make it stop
Put this in your robots.txt. We read it before every crawl, so it takes effect on the next one — there is nothing to sign up for and nobody to email.
Block us entirely
User-agent: KesloBot
Disallow: /We will stop, and any scan of your site will report that it was disallowed rather than pretending it found nothing.
Or just slow us down
User-agent: KesloBot
Crawl-delay: 10Ten seconds between requests. Use this if the crawl itself was fine and the pace was not.
Blocking at your firewall or WAF works too, of course. If you do, match on the user agent below rather than on an IP — the address can change and the name will not.
How to spot us
Every request we make carries exactly this, and this page is generated from the same value — so if it does not match your logs, it was not us.
Mozilla/5.0 (compatible; KesloBot/1.0; +https://keslo.co.uk/bot)In robots.txt, match the token KesloBot — not the whole string.
What it does
- Reads robots.txt firstBefore anything else, and it obeys what it finds. If you disallowed us, we never asked for a second page.
- Honours crawl-delayAnd keeps a gap between requests to the same host even when you have not set one.
- Reads what a visitor readsPublic pages, their HTML, CSS, images and timings — the same things your browser fetches.
- Says who it isEvery request carries the name below and a link to this page. No pretending to be Chrome.
What it never does
- Log in, or try to. It has no credentials and never submits a form.
- Buy anything, sign up for anything, or touch a checkout.
- Wander off your domain. A scan stays on the hostname it was asked about.
- Hammer you. One request at a time per host, with a pause between them.
- Ignore a robots.txt rule because somebody paid us. Money never buys depth.
If it got something wrong
If the crawler took pages it should not have, came back after you disallowed it, or made enough requests to be a nuisance, that is a bug and we want to know. Tell us the hostname and roughly when, and we will find it in our logs.
Keslo is run by No Fear Tech Ltd, registered in England and Wales. There is a person at the other end of this.
Since you are here: KesloBot is the part of Keslo that gathers evidence. The rest of it turns that into a plain English report about what a website is doing wrong and what it costs. You can point it at your own site if you are curious what we saw.