QuomerceBot

What it does

It shops. An audit is one browser, driven page by page through the things a customer does, with a screenshot at every step.

• Opens a storefront and works through it the way a shopper would: a category, a product, the cart, the payment step.
• Takes screenshots and records a replay of its own session, so the report can show you what it saw instead of describing it.
• Reads pages. It never saves files — the browser refuses downloads outright, so a link to a large file is noted and left alone.
• On an EU withdrawal-compliance check, and only there, it places exactly one test order and then withdraws from it. That is the thing being checked.

What it never does

• It does not index your shop. Nothing it reads is published, resold, or used to train a model.
• It does not scan for vulnerabilities, probe admin paths, or try credentials.
• It does not run two audits of the same shop at once.

Why it is on your site

Because someone paid for an audit of it — a shop owner, or an agency working for one. There is no crawl of the open web behind this bot: the only addresses it visits are ones a customer typed into a checkout.

If you did not order an audit and this bot is on your site, that is worth an email. Tell us the domain and we will stop. hello@quomerce.com

How it classifies

Under Cloudflare's bot taxonomy:

Agent

A user-directed agent. One run happens because one customer asked for it.

SEO

Site auditing: usability, conversion and accessibility checks across a storefront.

Transact

One test order, on the EU withdrawal-compliance check only. Never on a UX audit.

Intermediary

We run the software on our own infrastructure, but each run is started by a different customer — so the operator and the end user are not the same party.

Under the earlier category list, the closest match is Search engine optimization.

How to identify it

By user agent

Every request carries a real Chrome or Safari string with our token appended — the same shape Googlebot uses, so that a shop which serves different pages to different browsers still shows this bot what a shopper would see. The browser version moves; the token does not, and the token is the part to match on.

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 QuomerceBot/1.0 (+https://quomerce.com/bot)

A user agent alone proves nothing, of course — anyone can send this string. Use one of the two methods below to check.

By signature (Web Bot Auth)

Requests are signed with an Ed25519 key using HTTP Message Signatures (RFC 9421), tagged web-bot-auth. The public key is published in our key directory:

https://quomerce.com/.well-known/http-message-signatures-directory

Verify the Signature and Signature-Input headers against the key whose thumbprint the request names. Cloudflare does this for you if you use its bot management.

By IP address

We do not currently publish a fixed IP list, because a published range must be one the bot uses exclusively and ours is not yet. Until it is, verify by signature instead — the endpoint below exists and returns an empty list rather than a wrong one.

https://quomerce.com/bot/ips.json

By reverse DNS

Reverse DNS verification is not available yet, for the same reason as the IP list. Verify by signature instead.

How it behaves

These are guarantees in code, not a policy someone remembers to follow.

robots.txt is obeyed

It is fetched once per site at the start of a run and applied to every navigation, click and keypress after that. Matching is RFC 9309: a group naming QuomerceBot wins over the wildcard group, the longest matching Allow or Disallow decides, and Allow takes a tie.

Crawl-delay is honoured

If your robots.txt asks for a delay, that becomes the gap between requests. Above 60 seconds we do not audit the site at all rather than go faster than you asked — the customer is told why.

One request per second, at most

An audit runs several browser sessions at once, and they share one request budget per site rather than each getting their own. A shop sees one steady stream, not a dozen.

A disallowed path is not fetched

And the audit says so, in the report, instead of concluding your site is broken. A page we were told to stay out of is never a finding against you.

No downloads

The browser refuses them at the protocol level. Nothing is ever written to disk from your site.

No forms, with one exception

Nothing is submitted anywhere except the single test order of a withdrawal-compliance check, described below.

If you ordered an audit: how to let it in

A line like Disallow: /checkout under User-agent: * is aimed at search engines, and it will also keep this audit out of your checkout — the bot cannot tell your own site apart from anyone else's. Give it its own group and it will follow that instead:

User-agent: QuomerceBot
Allow: /

A group naming the bot beats the wildcard group, so this opens the audit without changing anything for search engines.

Behind Cloudflare or another WAF

A challenge page is a page the audit cannot get past, and it will show up in your report as a shop nobody can buy from. Add a skip rule for the user agent above for the day of the audit, or allow it permanently — it only ever visits when you have paid for it to.

How to block it

Add this to your robots.txt and the bot will not fetch a single page:

User-agent: QuomerceBot
Disallow: /

It takes effect on the next run; robots.txt is read fresh each time. You can also block the user agent at your CDN — we will not work around either.

If you block it and you have ordered an audit, the audit comes back empty. That is the whole of what blocking does.

The one test order

The EU withdrawal-compliance check verifies Article 11a of Directive 2011/83/EU — the withdrawal button a shop must offer from 19 June 2026. You cannot check a withdrawal button without something to withdraw from, so that check, and only that check, places one real order.

• It prefers a delivery and payment method that charges nothing up front — cash on delivery, transfer, collection in person.
• Where none exists, it applies a QUOMERCE discount code, which the shop owner creates at 100% off as part of ordering the check. Nothing is ever paid for with a card; we hold no card details.
• It then withdraws from the order immediately, which is the behaviour being measured.
• One order per audit, no matter how many storefront languages were bought.

Problems, questions, rate limits

If this bot is doing something you did not expect — too many requests, a page it should not be on, traffic you cannot account for — write to us with the domain and roughly when. We answer, usually the same day, and we can slow a run down or stop it.