SWPanel bots
SWPanelBot-Web
Gathers the photos, icons and logo for the website or store the owner creates with AI.
Mozilla/5.0 (compatible; SWPanelBot-Web/1.1; +https://www.swpanel.com/bots/web)
Feature: AI websites and stores Operator: DeepThink Software SLU Contact: [email protected] Version: 1.1 Reviewed on: October 17, 2026
Technical sheet
Everything SWPanelBot-Web does
Taken from the module's code. If the bot changes what it does, this sheet and its version change.
Identity
- Name
-
SWPanelBot-Web. It is also its name for robots.txt. - Family
-
SWPanelBot: the common name of all SWPanel bots. - Version
- 1.1, the one in the User-Agent. The changes in each version are below.
- Type
- Direct: run and controlled by SWPanel, always on behalf of the service owner.
- Category
- Other
- Operator
- DeepThink Software SLU, owner of SWPanel. Legal information.
- Contact
- [email protected]
- Previous names
-
SWPanel-WebGenerator/1.0
When and how much
- When it visits
- Only when the owner creates or updates a website or store with AI.
- Frequency
- Once per website created or updated.
- Per website
- A few dozen requests, almost all to the photo and icon APIs.
- In parallel
- Never. One request after another.
How it requests
- What it requests
- Photos and icons from licensed banks: Unsplash, Openverse, Picsum and Iconify.
- Third-party websites
- It doesn't crawl websites. The only external address it may request is the logo's, and only if the owner provides it.
- Methods
- GET only.
- Cookies and JavaScript
- No.
- Origin
- In preparation From SWPanel's servers. We're reserving some outgoing IPs just for the bots; once they exist, we'll publish them here in a JSON file.
- Reverse DNS
-
In preparation
Each IP will have a name under
bots.swpanel.comthat resolves back to the same IP.
Standards it applies
- robots.txt
- Not applicable They are public APIs and, at most, an address given by the owner.
- If the website asks to slow down
- Not applicable It doesn't crawl websites: it calls APIs with their own limits and, at most, requests a logo once.
- Signature
- Compliant It signs the logo download with Web Bot Auth, the only request to an external website. To the photo and icon APIs it sends only the User-Agent.
- Contact in the request
-
Compliant
The logo download carries
From: [email protected].
What it does with the data
- What it stores
- The images the website uses, optimized, on the owner's hosting.
- How long
- For as long as the website uses them.
- What for
- For the owner's website or store. Nothing else.
- Privacy
- SWPanel's general privacy policy.
How it works
One pass, step by step
-
Reads the brief
It starts from what the owner tells about their business in the wizard.
-
Searches for photos
Requests licensed photos from Unsplash, Openverse and Picsum for each section.
-
Searches for icons
Requests the icons for services and benefits from Iconify.
-
Fetches the logo
If the owner gives the address of their logo, it downloads it from there.
-
Optimizes
Adjusts the size and format of each image so the website loads fast.
-
Publishes
Leaves the images on the owner's hosting, with the website.
In your logs
This is how SWPanelBot-Web looks
An example in Apache and Nginx combined format. The IP and domain are for documentation: yours will be different.
You'll only see it on your server if the owner of a new website has given the address of a logo hosted on it.
Verify
Is it really SWPanelBot-Web?
A User-Agent can be copied. That's why it must be checked together with everything else. The examples use a documentation IP.
Reverse DNS In preparation
The IP must resolve to a bots.swpanel.com name, and that name to the same IP. If only the first part holds, it isn't ours.
IP list In preparation
A JSON file in the JAFAR format proposed by the IETF, linked from this page.
Request signature Available
Web Bot Auth headers. The public key is at /.well-known/http-message-signatures-directory on www.swpanel.com: with it, any firewall that understands Web Bot Auth verifies the request is ours.
What it requests Available
Compare what you see with the sheet: the paths, the frequency and the volume. A bot called SWPanelBot-Web that does something else isn't ours.
If you doubt a visit, write to us at [email protected] with the domain, the time with its time zone, the IP and the log line, and we'll check it.
Stopping it
The owner requests it. The owner turns it off.
Our bots only visit websites of active SWPanel services, only for the functions their owner has active, and stop visiting as soon as the service is cancelled.
If you are the owner
Not necessary: it only acts while the owner creates or updates their website.
If you are not
If the domain is no longer in SWPanel you shouldn't receive any scheduled visit. If you do, write to us at [email protected] and we'll stop it.
In the firewall
To let it through, use the name together with the IP or the signature, not just the name. Watch out for generic rules: a pattern like “bot” also matches SWPanelBot.
If you block it
The new website will end up without the logo its owner specified.
robots.txt doesn't stop it: we explain this in Standards. Its owner stops it, from SWPanel.
Standards
What the standards ask for, and how SWPanelBot-Web is doing
Our situation on each point, without embellishment.
| What they ask for | Status |
|---|---|
| A proper name in the User-Agent, with the address of its page RFC 9110, 10.1.5, and IETF draft “Crawler best practices”, 2.2 | Compliant |
| A valid name for robots.txt: letters, hyphens and underscore RFC 9309, 2.2.1 | Compliant |
| Read and respect robots.txt RFC 9309 and “Crawler best practices”, 2.1. The draft allows documented exemption for crawlers that work on commission. It only calls APIs. | Not applicable |
| Don't hinder the website: one request at a time, page and time limits, and short waits “Crawler best practices”, 2.3 | Compliant |
| Slow down if the website answers 429 or 503 “Crawler best practices”, 2.3, and RFC 9110, 15.6. It doesn't crawl websites. | Not applicable |
| A contact in the request: From header RFC 9110, 10.1.2 | Compliant |
| Publish the outgoing IPs in JSON, linked from this page “Crawler best practices”, 2.5, with the JAFAR format | In preparation |
| Reverse DNS that can be confirmed Practice of Google, Bing and Cloudflare for verifying bots | In preparation |
| Sign requests (Web Bot Auth) IETF draft “HTTP Message Signatures for Bots”, September 2026 | Compliant |
| Public page with what it does, what it stores, contact, how to stop it and the exemptions “Crawler best practices”, 2.6 | Compliant |
Partially: compliant with a caveat, explained in the row. In preparation: depends on the network, such as dedicated IPs and their reverse DNS. Pending: no date yet.
Versions
What has changed
The version goes in the User-Agent. When the bot changes what it does, the version and this sheet change.
| Version | Date | Change |
|---|---|---|
| 1.0 | 12-10-2026 | New name, SWPanelBot-Web, with the link to the bots page. Replaces SWPanel-WebGenerator. |
| 1.1 | 17-10-2026 | Links to this sheet. The logo download carries From and is signed. |
Frequently asked questions
Questions about SWPanelBot-Web
The other bots
Each one, with its own sheet
-
SEO reports and tracking
SWPanelBot-SEOCrawls the customer's website, like a search engine, for their SEO report and tracking.
See the technical sheet -
Availability monitoring
SWPanelBot-UptimeChecks about four times a day that the website responds and alerts if it goes down or runs slow.
See the technical sheet -
Security 360
SWPanelBot-SecurityReviews from outside the certificate, the headers and files that should never be public.
See the technical sheet -
Code analysis
SWPanelBot-CodeChecks whether the CMS, plugins and themes are up to date and looks for live JavaScript errors.
See the technical sheet