When your firewall blocks us

Many sites sit behind a security layer (Cloudflare, Sucuri, Imperva, a host's firewall, a WordPress security plugin) that challenges or refuses automated visitors by default. You didn't set anything up wrong, and your address is fine. When it refuses us, the scan says:

Your site's security layer refused our reader.

It names the layer when it can tell (Cloudflare, Vercel, Fastly, Netlify or CloudFront). A scan that fails this way is not charged.

What we try first

We read your site as ourselves, by name. If the answer looks like a firewall's challenge page or a block, we try again through a real browser from an ordinary home internet connection, which gets through most challenges. Only when both are refused does the scan stop. Nothing retries the whole scan on its own: retry the scan once you've made a change.

Letting us in

Allow our reader's user agent in your firewall or security plugin:

ResilientNiche-CitationReadinessBot/1.0 (+https://resilientniche.com/ai-visibility-tracker)

Match on the text ResilientNiche-CitationReadinessBot, so a future version number still matches.

• Cloudflare: add a WAF custom rule where the user agent contains ResilientNiche-CitationReadinessBot, with the action Skip. Bot Fight Mode on Cloudflare's free plan ignores these rules, so if the rule doesn't let us in, turn Bot Fight Mode off.
• Wordfence, Solid Security and other WordPress plugins: add the user agent to the plugin's allowlist.
• Your host's firewall: send them the user agent above and ask them to allow it.

There is no IP list to allow. We read from cloud servers whose addresses change, and the browser route uses ordinary home connections, so an allowlist by IP can't work. Allow the user agent instead.

While you're in there, check that the AI tools themselves (ChatGPT, Claude, Perplexity) aren't blocked too. A firewall that refuses us usually refuses them, and then no AI engine can read your pages either.

Other places a block shows up

• The page checks. We look for each page you publish on your site every day. A blocked site's pages are never found, so record each one's address yourself on the Publish tab.
• Recording an address says "We couldn't reach that URL". Allow the user agent, then try again.
• Check now on the Publish tab says the page didn't load when we asked for it.
• WordPress connecting may say the site isn't WordPress, or that its REST API is blocked. See Connecting WordPress.

If it still won't read after you've allowed us, press the Help button and tell us your site's address. We'll look at what your firewall sent back.