SWPanel

SWPanel bots

SWPanel's bots

SWPanel is the platform our customers use to manage their IT infrastructure. To provide them with SEO reports, security alerts and availability monitoring, it automatically visits those same customers' websites, only while their service is active. If you have seen one of these names in your logs, here is what it is, what it requests, how often it visits and how to check it is us.

Operator: DeepThink Software SLU Contact: [email protected] Reviewed on: October 17, 2026

The bots

Five bots, one technical sheet each

Each sheet explains in full detail what it requests, how often, how it looks in the logs, how to verify it is ours and how to stop it.

Identification

One name, one function

All introduce themselves with the same pattern: the name SWPanelBot, a hyphen with the function, the version and the address of their sheet. The name also serves as a robots.txt token.

Mozilla/5.0 (compatible; SWPanelBot-SEO/1.1; +https://www.swpanel.com/bots/seo) Mozilla/5.0 (compatible; SWPanelBot-Uptime/1.1; +https://www.swpanel.com/bots/uptime) Mozilla/5.0 (compatible; SWPanelBot-Security/1.1; +https://www.swpanel.com/bots/security) Mozilla/5.0 (compatible; SWPanelBot-Code/1.1; +https://www.swpanel.com/bots/code) Mozilla/5.0 (compatible; SWPanelBot-Web/1.1; +https://www.swpanel.com/bots/web)

Previous names, which may still appear in old logs or in a module that is still changing over:

  • SWPanelBot-*/1.0, which linked to /bots
  • SWPanelSEO
  • SWPanel/SEOAnalyzer
  • SWPanel/SEOAnalyzer/1.0; headless
  • SWPanel-SOC
  • SWPanel-Uptime
  • SWPanel-CodeAnalyzer
  • SWPanel-WebGenerator

What each one requests

The summary, and how often

The data comes from each module's code. The full detail is on each bot's sheet.

SEO reports and tracking

SWPanelBot-SEO

Crawls the website as a search engine would for the SEO report and tracking: titles, descriptions, headings, links, response codes, canonical, hreflang and structured data.

Category: SEO SWPanelBot-SEO technical sheet
When it visits
Scheduled, on websites with the SEO module active, and every time the owner requests a report. A user can also manually request the report of a website that isn't in SWPanel.
Frequency
Every 30 days on the Basic plan and every 7 days on Professional and Premium, plus reports requested manually.
What it requests
GET of the home page, of /robots.txt, of the sitemap (the one robots.txt declares or /sitemap.xml) and of the HTML pages on the same domain that it finds by following links.
Volume and pace
Up to 10, 100 or 200 pages per pass depending on the plan, at most 5 clicks from the home page. One request at a time, never in parallel, and a maximum of 15 minutes per website. It slows down if the website answers 429 or 503. It doesn't re-download pages that haven't changed.
robots.txt
It requests it under its name and stores it for 24 hours at most. It first looks for the SWPanelBot-SEO group and, if there isn't one, the SWPanelBot group, and if not, the * group, as RFC 9309 dictates. If robots.txt returns 404, it understands it can crawl everything; if it returns a 5xx error or doesn't answer, it doesn't crawl.
What it stores
Titles, descriptions, headings and metrics of each page, and the list of problems, in the owner's SWPanel.

The Premium report also asks PageSpeed Insights to measure the home page: that visit arrives under Google's name, not ours.

Availability monitoring

SWPanelBot-Uptime

Checks that the website responds and alerts the owner if it goes down or runs slow.

Category: Monitoring SWPanelBot-Uptime technical sheet
When it visits
Scheduled, on services with availability monitoring.
Frequency
About four times a day per website: it goes through all services in batches of about 200 every 5 minutes, and a full round takes about 6 hours.
What it requests
A GET to the home page over HTTPS and, if it doesn't answer, over HTTP. If something goes wrong, it repeats once after 1.5 seconds. It doesn't check the certificate.
Volume and pace
One or two requests per website and pass. It waits at most 5 seconds to connect and 8 for the response.
robots.txt
It doesn't consult it: it's a single request to the home page, like any availability monitor.
What it stores
Only the incidents: when, what failed and how long it took. It doesn't store the page content.

The same monitoring opens a connection to the mail (25 or 587) and FTP (21) ports to read the server's greeting, without logging in. Those connections carry no User-Agent.

Security 360

SWPanelBot-Security

Looks at the website from outside, as an attacker would see it: the certificate and encryption, security headers and whether there are files that should never be public. It also confirms that a security fix has been applied.

Category: Security testing SWPanelBot-Security technical sheet
When it visits
In Security 360 SOC and code analysis scans, and when applying or undoing a fix.
Frequency
Once per scheduled analysis of the service, and once per fix that is applied or undone.
What it requests
A GET to the home page to read the headers, a TLS connection to port 443 and a GET, without following redirects, to these paths: /.git/config, /.git/HEAD, /.env, /wp-config.php.bak, /phpinfo.php, /server-status, /.svn/entries and /adminer.php. To verify a fix it requests the home page with a ?swsoc= parameter and without cache.
Volume and pace
About ten requests per analysis, one after another, with maximum waits of 3 to 8 seconds.
robots.txt
It doesn't consult it. They are one-off checks commissioned by the owner, and the paths are exactly those that shouldn't be readable.
What it stores
Only the result: which path responded and with what signature, for the alert. If it finds an exposed file, it doesn't store its content.

In your logs these requests may look like a scan. If they carry this name and match this list, it's us checking the website on behalf of its owner.

Code analysis

SWPanelBot-Code

Finds out whether the website's CMS, plugins and themes are up to date, for code analysis and audit.

Category: Other SWPanelBot-Code technical sheet
When it visits
When requesting a code analysis or audit, and in SOC analyses.
Frequency
Once per analysis.
What it requests
The code is read on the server itself, not over the web. Under this name it only queries public version APIs: api.wordpress.org, api.github.com and endoflife.date.
Volume and pace
One query per component. It waits at most 10 seconds to connect and 25 for the response.
robots.txt
Doesn't apply to APIs. Live JavaScript analysis doesn't consult it: the owner commissions it.
What it stores
The versions found and, from the live analysis, the JavaScript errors and failing addresses.

Live JavaScript analysis opens up to 20 pages (the home page, the most visited according to the logs and those in the sitemap) in a windowless Chromium. It does so under this same name and without touching the cookie notice.

AI websites and stores

SWPanelBot-Web

Gathers the photos, icons and logo for the website or store the owner creates with AI.

Category: Other SWPanelBot-Web technical sheet
When it visits
Only when the owner creates or updates a website or store with AI.
Frequency
Once per website created or updated.
What it requests
It doesn't crawl websites. It downloads photos and icons from licensed banks (Unsplash, Openverse, Picsum and Iconify) and, if the owner provides the address of their logo, downloads it from there.
Volume and pace
A few dozen requests per website created.
robots.txt
Doesn't apply: they are public APIs and an address given by the owner.
What it stores
The images the website uses, optimized, on the owner's hosting.

Verify

Is it really a SWPanel bot?

A User-Agent can be copied. That's why it must be checked together with everything else. Each sheet includes the commands to do so.

Is it really a SWPanel bot?
The User-Agent Starts with SWPanelBot and links to its sheet. Available
What it requests Matches the technical sheet of its function: the paths, the frequency and the volume. Available
The IP We will publish the outgoing IPs here in a JSON file in the format proposed by the IETF. In preparation
The reverse DNS Each IP will have a name under bots.swpanel.com that resolves back to the same IP. In preparation
The signature Requests carry the Web Bot Auth headers, signed with the public key at /.well-known/http-message-signatures-directory. Any firewall that understands Web Bot Auth can verify them. Available

If you doubt a visit, write to us at [email protected] with the domain, the time with its time zone, the IP and the log line, and we'll check it.

How to stop them

The owner requests them. The owner turns them off.

Our bots only visit websites of active SWPanel services, only for the functions their owner has active, and stop visiting as soon as the service is cancelled.

If you are the owner

Disable the function in your SWPanel: the SEO module, availability monitoring, Security 360 or code analysis. The bot stops visiting.

If you are not

If the domain is no longer in SWPanel you shouldn't receive any scheduled visit. If you do, write to us at [email protected] and we'll stop it.

With robots.txt

For SWPanelBot-SEO, with a User-agent: SWPanelBot-SEO or User-agent: SWPanelBot group. There is an example in its sheet. Uptime and Security don't consult it: they are one-off checks commissioned by the owner.

If you block them

The website stays the same, but SWPanel goes blind: empty SEO reports, a false outage and unconfirmed fixes.

Watch out for very generic custom rules in other firewalls: a pattern like “bot” also matches SWPanelBot. How Security 360 bot blocking works.

Standards

What the standards ask for, and where we stand

There is no law for bots, but there are IETF standards and practices followed by Google, Bing and Cloudflare. This is our situation on each point, without embellishment.

What the standards ask for, and where we stand
A proper name in the User-Agent, with the address of its page RFC 9110, 10.1.5, and IETF draft “Crawler best practices”, 2.2 Compliant
A valid name for robots.txt: letters, hyphens and underscore RFC 9309, 2.2.1 Compliant
Visit only websites of active SWPanel services, and stop as soon as the service is cancelled SWPanel's own commitment. Except for the report a user requests manually. Compliant
That the windowless browser identifies itself by name and doesn't accept cookies Same rules: honest identity and not acting on behalf of a visitor. Live code analysis. Compliant
Read and respect robots.txt RFC 9309 and “Crawler best practices”, 2.1. The draft allows documented exemption for crawlers that work on commission. SWPanelBot-SEO. Uptime, Security and Code, exempt with justification. Compliant
Respect Crawl-delay Outside RFC 9309, but Bing applies it and Cloudflare asks verified bots for it. SWPanelBot-SEO Compliant
Don't hinder the website: one request at a time, page and time limits, and short waits “Crawler best practices”, 2.3 Compliant
Slow down if the website answers 429 or 503 “Crawler best practices”, 2.3, and RFC 9110, 15.6. All, except the browser for live analysis. Compliant
Respect the HTTP cache “Crawler best practices”, 2.4, and RFC 9111. SWPanelBot-SEO, the only one that crawls pages. Compliant
A contact in the request: From header RFC 9110, 10.1.2. All, except the browser for live analysis. Compliant
Publish the outgoing IPs in JSON, linked from this page “Crawler best practices”, 2.5, with the JAFAR format In preparation
Reverse DNS that can be confirmed Practice of Google, Bing and Cloudflare for verifying bots In preparation
Sign requests (Web Bot Auth) IETF draft “HTTP Message Signatures for Bots”, September 2026. All, except the browser for live analysis. Compliant
Public page with what it does, what it stores, contact, how to stop it and the exemptions “Crawler best practices”, 2.6 Compliant

Exempt, with justification: Uptime and Security perform one-off checks requested by the owner, like what Google calls “user-triggered fetchers”, and Code and Web query public APIs. Partially: compliant with a caveat, explained in the row. In preparation: depends on the network. Pending: no date yet.

Frequently asked questions

Questions about SWPanel's bots

Because the service owner has a feature that needs it: SEO reports, Security 360, availability monitoring, code analysis or building a website with AI. It is launched by their own SWPanel, not by a third party.

To check that they cannot be read from the Internet. It looks in the response for a specific signature, such as “[core]” in .git/config, and if it finds it, it alerts the owner. It does not store the file's content.

Only websites of active SWPanel services, and they stop visiting as soon as the service is cancelled: they check this before every request. The only exception is the SEO report a user requests manually, which may be for a website that is not on SWPanel; even then it respects robots.txt.

SWPanelBot-SEO does: it follows the SWPanelBot-SEO group, then SWPanelBot and, if neither exists, the * group. Uptime, Security and Code do not read it: they run one-off checks requested by the owner. To stop them, the owner turns off the feature in their SWPanel.

It identifies itself with a User-Agent that starts with SWPanelBot, requests only what its datasheet says and signs every request with Web Bot Auth, with the key published at www.swpanel.com. If you have doubts about a visit, write to us with the domain, the time, the IP and the log line, and we will check it.

Not yet. Requests are already signed with Web Bot Auth, which is what Cloudflare checks; we still have to register. In the meantime, if your website is behind Cloudflare and you have bot protection on, you can let SWPanelBot through with a custom rule.

It is used only for the report, the alert or the website of that service's owner. Some reports use AI models to write the conclusions from that data. It is not used to train AI models, nor sold or passed on to third parties.

You can, but SWPanel will no longer be able to analyse the website: SEO reports will come out empty, monitoring will report it as down and security checks will not be able to confirm anything. That is why the bot blocking in Security 360 does not let you block them.

Write to us at [email protected] with the domain, the time and the log line, and we will look into it.