# Scan policy

URL: https://code4x.dev/scan-policy

Last updated October 25, 2026

Our crawler reads only public pages: the same responses a browser or search crawler would get. It identifies itself, follows robots.txt, and signs in only with a test account you give us, inside an engagement.

## What the crawler requests

A check reads what any visitor could read without an account. That means:

- Your public pages, fetched as served and again after running JavaScript
- robots.txt, your sitemap and other files at standard locations, such as llms.txt, agents.json and the files under /.well-known/
- Your /ask endpoint, if your site has one
- If your site runs an MCP server, its initialize and tools/list requests, which list what it offers and change nothing
- The markup of forms and buttons, which we read but never submit

## How it identifies itself

Most requests carry the user agent Code4XBot/1.0, so you can find our visits in your logs. Two checks use a different identity, because they test how your site treats other visitors:

- Your homepage, fetched as ChatGPT-User, to see whether your firewall lets ChatGPT through
- The pages where people act, such as forms, opened as the Code4X agent, to see whether anti-bot tools stop it

## How to block or slow it down

The crawler follows robots.txt and Crawl-delay. To block it across your whole site, add this to robots.txt:

```
User-agent: Code4XBot
Disallow: /
```

If your site blocks the crawler, the check stops and says so. It never works around the rule.

## Live agent testing

Live agent testing is different. A real AI agent runs the flows you choose, like booking a demo or adding to cart, 3 times each, on a test setup you give us. Nothing real is submitted, booked or paid. It runs only inside an agreed engagement. Sign-in tests work the same way, with a test account you provide.

## What we store, and for how long

- **Results.** The website, the date and what each check found. A free check result stays at its link for 30 days.
- **Server logs.** The IP address, user agent and time of requests to code4x.dev, kept for a short period for security.
- **Nothing about your visitors.** The crawler reads your pages. It never reads analytics, cookies or anything behind a login.

## Who can see a result

Each result lives at its own link with an ID no one can guess. The website’s address never appears in the link, and the link never shows who asked for the check.

If you're a client, your score, the date it was checked and what's already working may appear on our homepage. Never what's broken. Ask and we'll take it down.

## Report a problem

If our crawler caused trouble on your site, tell us and we’ll stop checking it. Write to us through the [Talk to an engineer](https://code4x.dev/contact) form and say what your message is about. We reply by email.

## Find out how AI reads your site. Then let our engineers take it from there.

- Free check: [Am I AI-ready?](https://code4x.dev/am-i-ai-ready)
- [Talk to an engineer](https://code4x.dev/contact)