SWPanel bots
SWPanelBot-Security
Looks at the website from outside, as an attacker would see it: the certificate and encryption, security headers and whether there are files that should never be public. It also confirms that a security fix has been applied.
Mozilla/5.0 (compatible; SWPanelBot-Security/1.1; +https://www.swpanel.com/bots/security)
Feature: Security 360 Operator: DeepThink Software SLU Contact: [email protected] Version: 1.1 Reviewed on: October 17, 2026
Technical sheet
Everything SWPanelBot-Security does
Taken from the module's code. If the bot changes what it does, this sheet and its version change.
Identity
- Name
-
SWPanelBot-Security. It is also its name for robots.txt. - Family
-
SWPanelBot: the common name of all SWPanel bots. - Version
- 1.1, the one in the User-Agent. The changes in each version are below.
- Type
- Direct: run and controlled by SWPanel, always on behalf of the service owner.
- Category
- Security testing
- Operator
- DeepThink Software SLU, owner of SWPanel. Legal information.
- Contact
- [email protected]
- Previous names
-
SWPanel-SOC/1.0no name (default HTTP client)
When and how much
- When it visits
- In Security 360 SOC and code analysis scans, and when applying or undoing a fix.
- Frequency
- Once per analysis, scheduled or manual, and once per fix that is applied or undone.
- Per analysis
- A TLS connection to port 443, a GET to the home page and a GET to each of the 8 sensitive paths: about ten requests.
- In parallel
- Never. One request after another.
How it requests
- Paths it tests
-
/.git/config,/.git/HEAD,/.env,/wp-config.php.bak,/phpinfo.php,/server-status,/.svn/entriesand/adminer.php. - How it decides
-
It looks in the response for a specific signature of each file, such as “[core]” in
.git/config. A 200 without that signature doesn't count as exposed. - Verifying a fix
-
It requests the home page with
?swsoc=and the fix number, without cache, to check it has been applied. - Methods
- GET. For the certificate, only the TLS handshake, without requesting any page.
- Redirects
- It follows them to read the home page headers. Not on sensitive paths: only what that path itself returns counts.
- Certificate
- It reads it for the report: protocol, cipher, issuer and expiry. It doesn't cut the visit short if it's bad.
- Cookies and JavaScript
- No.
- Waits
- 5 seconds for the TLS handshake, 4 and 6 for the home page, 3 and 5 for each path, and up to 20 to verify a fix.
- Origin
- In preparation From SWPanel's servers. We're reserving some outgoing IPs just for the bots; once they exist, we'll publish them here in a JSON file.
- Reverse DNS
-
In preparation
Each IP will have a name under
bots.swpanel.comthat resolves back to the same IP.
Standards it applies
- robots.txt
- Exempt, with justification It doesn't consult it. They are one-off checks commissioned by the owner, and the paths are exactly those that shouldn't be readable.
- Which websites it visits
- Compliant It only visits websites of active SWPanel services and stops as soon as the service is cancelled: it checks before every request.
- If the website asks to slow down
-
Compliant
On 429 or 503 it waits as long as
Retry-Aftersays if it's 60 seconds or less (10 if it doesn't say). If it asks for more, it leaves the website until the next analysis. After 3 consecutive 5xx errors, it also leaves it. - HTTP cache
- Not applicable It needs the current response. Verifying a fix requests without cache on purpose.
- Signature
-
Compliant
It signs every request with Web Bot Auth (RFC 9421, Ed25519):
Signature,Signature-InputandSignature-Agentheaders. The public key is athttps://www.swpanel.com/.well-known/http-message-signatures-directory. - Contact in the request
-
Compliant
It carries
From: [email protected], as RFC 9110 asks of automated clients.
What it does with the data
- What it reads
- The home page headers, the certificate data and, for each path, the response code and whether the signature appears.
- What it stores
- Only the result: which path responded and with what signature. If it finds an exposed file, it doesn't store its content.
- How long
- With the service's analysis history, in the owner's SWPanel.
- What for
- To alert the owner and propose the fix.
- Privacy
- SWPanel's general privacy policy.
For the report it also queries public sources that don't touch your website: crt.sh certificate logs and Google DNS.
How it works
One pass, step by step
-
Looks at the certificate
Opens a TLS connection to port 443 and reads the protocol, cipher, issuer and expiry.
-
Reads the headers
Requests the home page and reviews HSTS, CSP, X-Frame-Options and the other security headers.
-
Tests the paths
Requests, without following redirects, each of the 8 paths that should never be public.
-
Looks for the signature
In each response it looks for the file's signature. If it isn't there, there is no alert, even if the path answers 200.
-
Alerts
If it finds something, it leaves it in Security 360 with the fix it proposes.
-
Verifies the fix
When applying or undoing it, it requests the home page without cache to confirm it ended up that way.
In your logs
This is how SWPanelBot-Security looks
An example in Apache and Nginx combined format. The IP and domain are for documentation: yours will be different.
It looks like a scan, but it's only these paths, under this name, one after another. The last line is the verification of a fix.
Verify
Is it really SWPanelBot-Security?
A User-Agent can be copied. That's why it must be checked together with everything else. The examples use a documentation IP.
Reverse DNS In preparation
The IP must resolve to a bots.swpanel.com name, and that name to the same IP. If only the first part holds, it isn't ours.
IP list In preparation
A JSON file in the JAFAR format proposed by the IETF, linked from this page.
Request signature Available
Web Bot Auth headers. The public key is at /.well-known/http-message-signatures-directory on www.swpanel.com: with it, any firewall that understands Web Bot Auth verifies the request is ours.
What it requests Available
Compare what you see with the sheet: the paths, the frequency and the volume. A bot called SWPanelBot-Security that does something else isn't ours.
If you doubt a visit, write to us at [email protected] with the domain, the time with its time zone, the IP and the log line, and we'll check it.
Stopping it
The owner requests it. The owner turns it off.
Our bots only visit websites of active SWPanel services, only for the functions their owner has active, and stop visiting as soon as the service is cancelled.
If you are the owner
Disable the service's Security 360 analyses in your SWPanel.
If you are not
If the domain is no longer in SWPanel you shouldn't receive any scheduled visit. If you do, write to us at [email protected] and we'll stop it.
In the firewall
To let it through, use the name together with the IP or the signature, not just the name. Watch out for generic rules: a pattern like “bot” also matches SWPanelBot.
If you block it
Security 360 won't be able to confirm anything or verify its fixes.
robots.txt doesn't stop it: we explain this in Standards. Its owner stops it, from SWPanel.
Standards
What the standards ask for, and how SWPanelBot-Security is doing
Our situation on each point, without embellishment.
| What they ask for | Status |
|---|---|
| A proper name in the User-Agent, with the address of its page RFC 9110, 10.1.5, and IETF draft “Crawler best practices”, 2.2 | Compliant |
| A valid name for robots.txt: letters, hyphens and underscore RFC 9309, 2.2.1 | Compliant |
| Visit only websites of active SWPanel services, and stop as soon as the service is cancelled SWPanel's own commitment | Compliant |
| Read and respect robots.txt RFC 9309 and “Crawler best practices”, 2.1. The draft allows documented exemption for crawlers that work on commission. The owner requests it and it is a one-off check. | Exempt, with justification |
| Don't hinder the website: one request at a time, page and time limits, and short waits “Crawler best practices”, 2.3 | Compliant |
| Slow down if the website answers 429 or 503 “Crawler best practices”, 2.3, and RFC 9110, 15.6 | Compliant |
| Respect the HTTP cache “Crawler best practices”, 2.4, and RFC 9111. It needs the current response. | Not applicable |
| A contact in the request: From header RFC 9110, 10.1.2 | Compliant |
| Publish the outgoing IPs in JSON, linked from this page “Crawler best practices”, 2.5, with the JAFAR format | In preparation |
| Reverse DNS that can be confirmed Practice of Google, Bing and Cloudflare for verifying bots | In preparation |
| Sign requests (Web Bot Auth) IETF draft “HTTP Message Signatures for Bots”, September 2026 | Compliant |
| Public page with what it does, what it stores, contact, how to stop it and the exemptions “Crawler best practices”, 2.6 | Compliant |
Partially: compliant with a caveat, explained in the row. In preparation: depends on the network, such as dedicated IPs and their reverse DNS. Pending: no date yet.
Versions
What has changed
The version goes in the User-Agent. When the bot changes what it does, the version and this sheet change.
| Version | Date | Change |
|---|---|---|
| 1.0 | 12-10-2026 | New name, SWPanelBot-Security, with the link to the bots page. Replaces SWPanel-SOC and the checks that went out unnamed. |
| 1.1 | 17-10-2026 | Links to this sheet. Slows down on 429 and 503, signs requests, carries the From header and only visits active services. |
Frequently asked questions
Questions about SWPanelBot-Security
The other bots
Each one, with its own sheet
-
SEO reports and tracking
SWPanelBot-SEOCrawls the customer's website, like a search engine, for their SEO report and tracking.
See the technical sheet -
Availability monitoring
SWPanelBot-UptimeChecks about four times a day that the website responds and alerts if it goes down or runs slow.
See the technical sheet -
Code analysis
SWPanelBot-CodeChecks whether the CMS, plugins and themes are up to date and looks for live JavaScript errors.
See the technical sheet -
AI websites and stores
SWPanelBot-WebGathers the photos, icons and logo for the website or store the owner creates with AI.
See the technical sheet