Allow Greadme Scans Through Your Firewall — Securely
Greadme is a legitimate SEO and performance audit platform. If your WAF or firewall blocks automated scanners, we offer Organization Auth: a per-organization secret key that your security infrastructure can validate, so only real Greadme requests get through.
Why a secret key instead of a user-agent?
User-Agent allowlisting
- Anyone can set
User-Agent: GreadmeBot— it is trivially spoofed - Provides no proof that the request actually came from Greadme
- One allowlist rule lets in anyone who copies the string
Organization Auth (X-Greadme-Key)
- A cryptographically random key known only to Greadme and your team
- Cannot be guessed or brute-forced (64 random hex characters)
- Unique per organization — a key from another company does not work for yours
- Regenerate at any time if the key is ever compromised
How to set it up
- 1Sign in to Greadme
Go to Settings → Integrations and open the Organization Auth section.
- 2Enter your organization name and generate a key
Greadme creates a cryptographically random secret key tied to your account.
- 3Copy the key and configure your WAF
Create a rule in your firewall that lets through any request whose X-Greadme-Key header matches your key. On Cloudflare that is a custom rule with the Skip action, placed first, skipping the remaining custom rules, rate limiting, managed rules, Super Bot Fight Mode, Browser Integrity Check and Security Level.
- 4Run your scan
Run it while signed in to the same Greadme account. The requests Greadme itself sends to that domain carry your key, and your rule lets them through — within the limits below.
Frequently asked questions
Is Organization Auth required?
No. It is optional. Most users whose sites are publicly accessible do not need it. It is designed for enterprises and organizations that run strict WAF rules that would otherwise block automated scanners.
Does it work with Cloudflare's Bot Fight Mode?
No. Cloudflare does not let any custom rule skip Bot Fight Mode, the bot setting on its Free plan, so the key cannot get a request past it. Bot Fight Mode targets automated traffic from cloud hosting providers, which is where Greadme runs. Turn it off while you scan, or on a paid Cloudflare plan use Super Bot Fight Mode, which a Skip rule can skip. Cloudflare's IP Access rules (country blocks made with them included) are not on Cloudflare's list of what a Skip rule can skip either, and “I'm Under Attack” mode is exempted with a Configuration Rule (Security Level off) rather than a custom rule.
Which Greadme requests carry the key?
The requests Greadme's own servers send to your domain during a Page Audit, Site Audit (all but its robots.txt request) or Content Audit, and when the AI Visibility Checker reads your page to suggest questions — on scans run while signed in to the account that holds the key, scheduled ones included. Only over HTTPS: a plain http:// request never carries it, so a page reached over HTTP gets the key once it redirects to HTTPS. If your domain redirects a scan to another site, the key is not sent there, or anywhere after it. Not the Page Audit's speed test: Google PageSpeed Insights loads your page from Google's servers, and Greadme cannot add a header to that request. Not the Schema Validator or the AI Access Checker. And not scans by other Greadme users or by visitors without an account.
What happens if I regenerate my key?
The old key is immediately invalidated. Any WAF rule still checking for the old key will start blocking Greadme scans. Update your WAF rule before regenerating if you want uninterrupted scanning.
Can I use both the user-agent and the key together?
Yes. Greadme always sends its GreadmeBot user-agent alongside the key. You can configure your WAF to check either or both — though the key alone is sufficient and more secure.
Does this prove the request came from Greadme's servers?
It proves the request was made by the Greadme account holder who owns that key. Keep the key confidential — treat it like an API key.
Do subdomains need their own key?
Yes. Keys are matched by exact hostname. A key for apple.com will not cover shop.apple.com — Greadme will not inject the header for that subdomain unless you add a separate key for it in Settings → Integrations.
Ready to set up Organization Auth?
Go to your Greadme settings and generate your key in under a minute.
Open Settings → Integrations