SWPanel

SWPanel bots

SWPanelBot-Code

Finds out whether the website's CMS, plugins and themes are up to date, for code analysis and audit.

User-Agent Mozilla/5.0 (compatible; SWPanelBot-Code/1.1; +https://www.swpanel.com/bots/code)

Feature: Code analysis Operator: DeepThink Software SLU Contact: [email protected] Version: 1.1 Reviewed on: October 17, 2026

Technical sheet

Everything SWPanelBot-Code does

Taken from the module's code. If the bot changes what it does, this sheet and its version change.

Identity

Name
SWPanelBot-Code. It is also its name for robots.txt.
Family
SWPanelBot: the common name of all SWPanel bots.
Version
1.1, the one in the User-Agent. The changes in each version are below.
Type
Direct: run and controlled by SWPanel, always on behalf of the service owner.
Category
Other
Operator
DeepThink Software SLU, owner of SWPanel. Legal information.
Contact
[email protected]
Previous names
SWPanel-CodeAnalyzer/2026 SWPanel/SEOAnalyzer/1.0; headless

When and how much

When it visits
When requesting a code analysis or audit, and in SOC analyses.
Frequency
Once per analysis.
Per analysis
One query to the APIs per component (CMS, plugin or theme) and, in live analysis, up to 20 pages of the website.
In parallel
Never. One page at a time.

How it requests

The code
It's read on the server itself, with the SWPanel agent. It doesn't go through the web.
Versions
Queries api.wordpress.org, api.github.com and endoflife.date. Waits 10 seconds to connect and 25 for the response.
Live analysis
Opens up to 20 pages: the home page, the most visited according to the server logs and those in the sitemap.
The browser
A windowless Chromium (Playwright), with a 1920 × 1080 screen. It runs JavaScript and loads everything the page requests: images, styles, scripts and third-party services.
Browser name
Compliant It identifies itself as SWPanelBot-Code.
Cookie notice
Compliant It doesn't touch it: it neither accepts nor rejects it, so it doesn't load the website's analytics or leave a consent nobody gave.
Waits
Up to 25 seconds per page, for the network to go quiet. If a first-party script fails, it requests it again, with an 8-second wait, to read the error fragment.
Origin
In preparation From SWPanel's servers. We're reserving some outgoing IPs just for the bots; once they exist, we'll publish them here in a JSON file.
Reverse DNS
In preparation Each IP will have a name under bots.swpanel.com that resolves back to the same IP.

Standards it applies

robots.txt
Exempt, with justification It doesn't consult it. Live analysis is requested by the owner, like Google's “user-triggered fetchers”, and APIs have no robots.txt to apply.
Which websites it visits
Compliant It only visits websites of active SWPanel services and stops as soon as the service is cancelled: it checks before every request.
If the website asks to slow down
Pending The live-analysis browser doesn't yet slow down on 429 and 503. It compensates by going slowly: one page at a time and 20 at most.
HTTP cache
Not applicable Each analysis must see the page as a visitor sees it today.
Signature
Pending The live-analysis browser doesn't sign yet. Version queries go to public APIs, not to your website.
Contact in the request
Pending The live-analysis browser doesn't yet carry From: [email protected].

What it does with the data

What it reads
The versions of the CMS, plugins and themes and, live, the JavaScript errors, the failing requests and a screenshot of the page.
What it stores
The versions found and the errors, with the fragment of first-party code where each one fails.
How long
With the analysis report, in the owner's SWPanel.
What for
For the code analysis and audit of the service owner.
Privacy
SWPanel's general privacy policy.

How it works

One pass, step by step

  1. Reads the code

    The SWPanel agent reads on the server which CMS, plugins and themes are present, and in which version.

  2. Queries versions

    Asks the public APIs what the latest version of each is and whether it is still supported.

  3. Picks pages

    The home page, the most visited according to the logs and those in the sitemap, up to 20.

  4. Opens them

    One at a time, in a windowless browser, and waits for it to finish loading. It doesn't touch the cookie notice.

  5. Collects the errors

    JavaScript errors, exceptions and failing requests, and separates those of the website itself from third-party ones.

  6. Leaves the report

    With what needs updating and each error with its code fragment.

In your logs

This is how SWPanelBot-Code looks

An example in Apache and Nginx combined format. The IP and domain are for documentation: yours will be different.

203.0.113.40 - - [17/Oct/2026:12:30:10 +0200] "GET / HTTP/1.1" 200 48211 "-" "Mozilla/5.0 (compatible; SWPanelBot-Code/1.1; +https://www.swpanel.com/bots/code)" 203.0.113.40 - - [17/Oct/2026:12:30:10 +0200] "GET /wp-content/themes/tema/style.css HTTP/1.1" 200 18320 "https://example.com/" "Mozilla/5.0 (compatible; SWPanelBot-Code/1.1; +https://www.swpanel.com/bots/code)" 203.0.113.40 - - [17/Oct/2026:12:30:11 +0200] "GET /wp-content/themes/tema/js/app.js HTTP/1.1" 200 9120 "https://example.com/" "Mozilla/5.0 (compatible; SWPanelBot-Code/1.1; +https://www.swpanel.com/bots/code)" 203.0.113.40 - - [17/Oct/2026:12:30:12 +0200] "GET /wp-content/uploads/2026/10/portada.webp HTTP/1.1" 200 88450 "https://example.com/" "Mozilla/5.0 (compatible; SWPanelBot-Code/1.1; +https://www.swpanel.com/bots/code)" 203.0.113.40 - - [17/Oct/2026:12:30:36 +0200] "GET /tienda/ HTTP/1.1" 200 30554 "-" "Mozilla/5.0 (compatible; SWPanelBot-Code/1.1; +https://www.swpanel.com/bots/code)"

Live analysis loads each page with everything it carries, like a browser. Version queries go to the APIs and don't appear in your logs.

Verify

Is it really SWPanelBot-Code?

A User-Agent can be copied. That's why it must be checked together with everything else. The examples use a documentation IP.

Reverse DNS In preparation

$ host 203.0.113.10 10.113.0.203.in-addr.arpa domain name pointer crawl-203-0-113-10.bots.swpanel.com. $ host crawl-203-0-113-10.bots.swpanel.com crawl-203-0-113-10.bots.swpanel.com has address 203.0.113.10

The IP must resolve to a bots.swpanel.com name, and that name to the same IP. If only the first part holds, it isn't ours.

IP list In preparation

$ curl -s https://www.swpanel.com/bots/ips.asp {"formatVersion": "1.0", "creationTime": "…", "prefixes": [{"ipv4Prefix": "203.0.113.0/28", "service": "SWPanelBot"}]}

A JSON file in the JAFAR format proposed by the IETF, linked from this page.

Request signature Pending

Signature-Agent: "https://www.swpanel.com" Signature-Input: sig1=("@authority" "signature-agent"); created=1792224000;expires=1792224300; keyid="…";alg="ed25519";tag="web-bot-auth" Signature: sig1=:…:

Web Bot Auth headers. The public key is at /.well-known/http-message-signatures-directory on www.swpanel.com: with it, any firewall that understands Web Bot Auth verifies the request is ours.

What it requests Available

Compare what you see with the sheet: the paths, the frequency and the volume. A bot called SWPanelBot-Code that does something else isn't ours.

If you doubt a visit, write to us at [email protected] with the domain, the time with its time zone, the IP and the log line, and we'll check it.

Stopping it

The owner requests it. The owner turns it off.

Our bots only visit websites of active SWPanel services, only for the functions their owner has active, and stop visiting as soon as the service is cancelled.

If you are the owner

Disable the service's code analysis in your SWPanel.

If you are not

If the domain is no longer in SWPanel you shouldn't receive any scheduled visit. If you do, write to us at [email protected] and we'll stop it.

In the firewall

To let it through, use the name together with the IP or the signature, not just the name. Watch out for generic rules: a pattern like “bot” also matches SWPanelBot.

If you block it

Live analysis won't find the JavaScript errors.

robots.txt doesn't stop it: we explain this in Standards. Its owner stops it, from SWPanel.

Standards

What the standards ask for, and how SWPanelBot-Code is doing

Our situation on each point, without embellishment.

What the standards ask for, and how SWPanelBot-Code is doing
A proper name in the User-Agent, with the address of its page RFC 9110, 10.1.5, and IETF draft “Crawler best practices”, 2.2 Compliant
A valid name for robots.txt: letters, hyphens and underscore RFC 9309, 2.2.1 Compliant
Visit only websites of active SWPanel services, and stop as soon as the service is cancelled SWPanel's own commitment Compliant
That the windowless browser identifies itself by name and doesn't accept cookies Same rules: honest identity and not acting on behalf of a visitor Compliant
Read and respect robots.txt RFC 9309 and “Crawler best practices”, 2.1. The draft allows documented exemption for crawlers that work on commission. The owner requests it and it is a one-off check. Exempt, with justification
Don't hinder the website: one request at a time, page and time limits, and short waits “Crawler best practices”, 2.3 Compliant
Slow down if the website answers 429 or 503 “Crawler best practices”, 2.3, and RFC 9110, 15.6. The live-analysis browser, not yet. Pending
Respect the HTTP cache “Crawler best practices”, 2.4, and RFC 9111. It needs the current response. Not applicable
A contact in the request: From header RFC 9110, 10.1.2 Pending
Publish the outgoing IPs in JSON, linked from this page “Crawler best practices”, 2.5, with the JAFAR format In preparation
Reverse DNS that can be confirmed Practice of Google, Bing and Cloudflare for verifying bots In preparation
Sign requests (Web Bot Auth) IETF draft “HTTP Message Signatures for Bots”, September 2026. Today it signs the API queries; the live-analysis browser, not yet. Pending
Public page with what it does, what it stores, contact, how to stop it and the exemptions “Crawler best practices”, 2.6 Compliant

Partially: compliant with a caveat, explained in the row. In preparation: depends on the network, such as dedicated IPs and their reverse DNS. Pending: no date yet.

Versions

What has changed

The version goes in the User-Agent. When the bot changes what it does, the version and this sheet change.

What has changed
1.0 12-10-2026 New name, SWPanelBot-Code, in version queries. Replaces SWPanel-CodeAnalyzer.
1.1 17-10-2026 Links to this sheet. The live-analysis browser identifies itself as SWPanelBot-Code and no longer accepts the cookie notice. It only visits active services.
Next No date The live-analysis browser will start signing, slowing down on 429 and 503 and carrying the From header.

Frequently asked questions

Questions about SWPanelBot-Code

No. The code is read on the server itself, with the SWPanel agent. Through the website it only opens public pages to look for JavaScript errors.

The live analysis can, because it is a browser that runs JavaScript. It is at most 20 pages per analysis.

No. Until 17-10-2026 it clicked “Accept” to see the page as a visitor would; now it does not touch the notice, so it does not load the website's analytics nor leave a consent that nobody has given.

The other bots

Each one, with its own sheet