You found this because SEOTrackerForAI turned up in your logs.
We check whether websites can be found, read and used by AI assistants. If our crawler visited you, it was because someone asked us to look at that site. This page tells you exactly what we request, how to prove a request really came from us, and how to stop us if you would rather we did not.
The short version
We fetch your home page, your robots.txt and a handful of well known files, about a dozen requests once a day. We sign every request cryptographically, so you can tell a real visit from anything else using our name. If you want us gone, disallow SEOTrackerForAI-Readiness in robots.txt.
1What this crawler is
SEO Tracker for AI is a monitoring tool operated by Lumatech. Site owners add their own site and we report on whether an AI assistant could find it, fetch it, read it and act on it, alongside checks on certificates, security headers and email authentication.
We are not a search engine, we do not collect training data for a model, and we do not index or republish your content. We read a small number of files, score what we find and show the result to the person who asked. Nothing is passed on to anyone else.
2User agent strings
Two scans run, each with its own identity. Both point back at this page.
Mozilla/5.0 (compatible; SEOTrackerForAI-Readiness/1.0; +https://seotrackerforai.com/bot)
Mozilla/5.0 (compatible; SEOTrackerForAI-Security/1.0; +https://seotrackerforai.com/bot)
A user agent is only a claim, and anyone can copy one. Please do not use these strings alone to decide what to allow. The next section is how to know for certain.
3How to check it is really us
Every request we make is signed with Web Bot Auth, using HTTP Message Signatures (RFC 9421) with an Ed25519 key. A signed request carries three headers: Signature, Signature-Input with tag="web-bot-auth", and Signature-Agent naming our key directory.
Our public key is published, and signed with itself, at:
https://app.seotrackerforai.com/.well-known/http-message-signatures-directory
The key is Ed25519, and its RFC 7638 thumbprint, which appears as keyid in every signature we send, is:
2QIEe4Sga--gP012ml2J9rlA2A0_MIHDcZR_6vUAoJM
Because identity is proved by the signature rather than by the address the request came from, there is no IP range to allow and no list for you to keep up to date. A request that does not carry a valid signature from that key is not us, whatever its user agent says.
4What we request, and how often
Once a day, around 03:00 UTC, for each site a customer has added. About a dozen requests in total, one after another, with no crawling of links and no descent into your site.
We ask for your home page, /robots.txt, the sitemap your robots.txt points at, /llms.txt and /llms-full.txt, and these well known files: /.well-known/mcp.json, /.well-known/agents.json, /.well-known/ai-plugin.json, /.well-known/security.txt and /openapi.json. Most sites do not have most of those, and a 404 is a perfectly good answer.
The security scan additionally requests your home page over plain HTTP, to see whether it redirects, and looks up public DNS records. It does not fetch anything else.
We read at most the first 400KB of any response, we time out after 12 seconds, and we never submit forms, follow links, log in or attempt to change anything.
5Allowing us through a firewall or CDN
If you have added your site to SEO Tracker for AI and the scan reports that we are being blocked, your CDN or firewall is refusing us before the request reaches your server. This is common on Cloudflare, where the default bot rules turn away anything not on a verified list.
The fix is a rule that skips bot protection for our user agent, matching on SEOTrackerForAI. On Cloudflare that is a custom rule with the Skip action; on other providers it is usually called an allow list or exception. Because our requests are signed, you can also verify us properly rather than trusting the string.
6Telling us not to crawl
To stop the readiness scan, disallow our token in your robots.txt:
User-agent: SEOTrackerForAI-Readiness
Disallow: /
We check that before requesting anything else, and if it refuses us we stop without fetching your home page. An unreadable robots.txt is treated as permission, not refusal, so a temporary error on your server will not silently stop a scan someone is relying on.
One honest exception. If you have added a site to your own account, we scan it on your authority even if its robots.txt disallows crawlers, because you have asked us to and a blanket rule aimed at uninvited crawlers is not aimed at us. If you want that to stop, remove the site from your account and the scanning stops with it. We will not use robots.txt to override a site owner’s own explicit request about their own site, in either direction.
7Contact
If our crawler has caused you a problem, taken more than its share of your server, or you want it to stop and robots.txt is not practical for you, email bot@seotrackerforai.com and we will sort it out. A real person reads that address.