Download

Damdit in your server logs

If you see Damdit/ in a User-Agent, someone is auditing a website with the Damdit app.

What Damdit is

Damdit is a desktop app for checking a website's accessibility, SEO and technical health. A person starts each audit on their own computer, usually the site's owner, developer or agency. Damdit is not a search engine and doesn't crawl the web on its own.

The User-Agent is the browser's own, with a Damdit token at the end:

Mozilla/5.0 (…) Chrome/… Safari/537.36 Damdit/1.0.0 (+https://damdit.com/bot)

What it requests

  • It only reads. Requests are GET. It doesn't submit forms, sign in, or change anything on the site.
  • It opens pages in a browser to check accessibility. On a page it presses Tab once to test keyboard focus. It doesn't click links or buttons.
  • One audit opens at most 500 pages in a browser and reads up to 5,000 addresses of the site in all, a few requests at a time. It also requests robots.txt, sitemaps, images and other files the pages use.
  • To check that the site has a real 404 page, it asks for an address that cannot exist, at the root and in the largest section.
  • Links to other websites are each asked once, at most 1,000 per audit, never two at a time to one host.
  • It retries a server error (5xx) once, about a second later. When the site answers 429 Too Many Requests, it stops asking for that address and records it as not checked.
  • It keeps no cookies after the audit ends.

Asking Damdit not to audit your site

Damdit follows robots.txt rules written for Damdit:

User-agent: Damdit
Disallow: /

With Disallow: /, the audit doesn't start, and the person running it is told why. A narrower rule, such as Disallow: /private/, leaves those paths out of the audit.

Rules for all robots (User-agent: *) don't apply to Damdit, because a person starts each audit, as with Lighthouse or PageSpeed Insights. You can also block the Damdit token in your firewall or bot settings.

Allowing Damdit through bot protection

Damdit doesn't try to get past challenges or CAPTCHAs. If bot protection (Cloudflare, Akamai, Imperva, DataDome, Sucuri and others) stops it on the start page, the audit ends as Blocked: no score, and nothing from the challenge page is reported as your website. If only some pages are stopped, the audit lists them as not checked.

To audit the site, allow requests whose User-Agent contains Damdit/ in your firewall or bot settings, for example with a skip rule in Cloudflare's WAF, then run the audit again.

Questions

Write to support@damdit.com. Please include the time of the requests and the address that was audited.