BilbyBot
Bilby is an AI mystery shopper that visits stores in a real browser and reports what a customer would hit — broken checkouts, slow pages, stale promos. This page is how you recognise it and control its access.
How it identifies itself
User-Agent
BilbyBot/1.0 (+https://navaal.ai/bilby/bot)
Every request Bilby makes carries this exact User-Agent. It runs a real Chromium browser, so it also renders JavaScript like a customer would.
Regions it scans from
Bilby scans from the region closest to your customers: Sydney, Virginia, Los Angeles, Toronto, London or Frankfurt. Paid monitoring lets you pin the region. Stable egress IP ranges for allowlisting are published here per region as the fleet is provisioned; until your monitoring goes live, allowlist by User-Agent above.
Allowlisting Bilby
If a firewall or bot-blocker challenges Bilby, add an allow rule for the User-Agent BilbyBot. On the common platforms:
- Cloudflare: Security → WAF → create a skip rule for
http.user_agent contains "BilbyBot". - Shopify: no action needed for the free scan; paid monitoring on a password-protected store needs the storefront password shared during onboarding.
Rules Bilby follows
- Respects
robots.txt— a disallow-all keeps Bilby out. - Free scans visit the buying path like a shopper — product, Add to cart, the cart and the first checkout page — and stop at the payment step. Nothing is ever ordered. The only form touched is the newsletter box, and only with an invalid address to check it is rejected.
- Paid monitoring runs only after you verify you own the site.
- Hard rate caps per site; never scans login-gated areas.
Opt out
To keep Bilby out entirely, add this to your robots.txt:
User-agent: BilbyBot Disallow: /
Or email support@navaal.ai and we'll block your domain at our end.