If a run came back saying it was stopped before it reached your site, this is the two-minute fix. It is on your side because it has to be: the wall is your security control, on your property, and the supported way past it is for you to let a named thing in.
We could have tried to look like an ordinary visitor instead. We deliberately do not. Getting past somebody’s bot protection by pretending to be a person is not a feature, and it would be a strange thing for a product whose whole argument is that its findings can be checked. So we say who we are, which makes a wall more likely to stop us — and makes the rest of this page possible.
The order matters, and the first version of this page had it wrong. It said to match on our user agent, which works — and also means anyone who reads this page can set that user agent and walk through your WAF. That is not an integration, it is a hole with our name on it.
1. Our address. Every run comes from one machine, and an address cannot be faked:
2.28.26.31 2a01:4f8:c015:f3e2::1
This is the one to use if your edge lets you allowlist by IP. It is also the only one that stays safe if this page is read by somebody who means you harm.
2. Your own secret header. Every request your runs make carries a token that belongs to your account and nobody else’s:
X-CanaryFlock-Token: <the value on your domains page>
Find it under domains when you are signed in, where you can also rotate it. Allowlisting this is safe because guessing it is not feasible. Use it when allowlisting by address is impractical — a shared edge, or a rule that has to travel between environments.
3. The user agent. Every request also says who it is:
Mozilla/5.0 (…) CanaryFlock/1.0 (+https://canaryflock.com/bot)Useful for logging — it is how you tell our traffic apart in an access log. As an allow rule it is the weakest of the three, for the reason above. If you use it, pair it with the address so both must match.
Allow CanaryFlock.(ip.src eq 2.28.26.31) (http.request.headers["x-canaryflock-token"][0] eq "<your token>") (ip.src eq 2.28.26.31 and http.user_agent contains "CanaryFlock/1.0")
The shape is the same everywhere; only the screen’s name changes.
Akamai: a bot category exception under Bot Manager, or a network list of
one address. AWS WAF: an IPSetReferenceStatement with an
Allow action, placed above the bot control rule group.
Fastly, Imperva and DataDome all take either an address or
a header match.
If the run is against a staging URL — and it usually should be, at least the first time — turning the protection off for the length of the run is simpler than a rule you then have to remember. A run of thirty takes about four minutes.
The flock reads pages and clicks links. It fills in nothing unless you have proved you own the domain by publishing a DNS record we ask you for — because thirty simulated people completing a real signup would create thirty real accounts, and on somebody else’s product that is not a test.
It never touches a private address, a loopback address or a cloud metadata endpoint, and it re-checks that on every run rather than trusting a decision made once.