How to allow Rejekto in your firewall

Some websites are protected by a firewall or bot protection that refuses our automated browser (for example HTTP 403 or a “Verify you are human” challenge). The scan then ends as blocked and is not scored. We do not circumvent such protection. The website's operator can allow the scanner, though, and that is no circumvention.

Allowing by a secret token (recommended)

Every agency in Rejekto has its own secret token. The scanner sends it in the X-Rejekto-Token header with every request to the scanned website's domain. A firewall rule that lets this header with your token through keeps working when our IP address changes and cannot be imitated like a User-Agent.

The owner of the agency's account finds the token in the Rejekto dashboard under Scanner access and gives it to the website's administrator.

The exception applies to the main page and its requests to your domain. The scanner never sends the token to third parties (advertising and analytics services), not even on a redirect. The free scan on the landing page does not send the token, so a website behind a firewall stays blocked there.

Keep the token secret: whoever knows it passes your rule. If it leaks, the agency generates a new one in the dashboard and the rule with the old token stops matching.

Cloudflare

Security → WAF → Custom rules: create a rule, use Edit expression with the expression below and the action Skip (the remaining custom rules, Super Bot Fight Mode and, if needed, managed rules and rate limiting). Replace YOUR_TOKEN with the token from the dashboard. Bot Fight Mode on the free plan cannot be skipped by an exception. Based on the Cloudflare documentation (Rules language: http.request.headers, WAF custom rules: Skip), November 2026.

any(http.request.headers["x-rejekto-token"][*] == "YOUR_TOKEN")

Apache (.htaccess)

Let a request with the correct header through alongside the website's other rules:

SetEnvIf X-Rejekto-Token "^YOUR_TOKEN$" rejekto
<RequireAny>
  Require env rejekto
  # the website's other rules
</RequireAny>

nginx

In the http block, create a variable from the header and use it in your own rule that blocks the scanner today:

map $http_x_rejekto_token $rejekto {
  default 0;
  "YOUR_TOKEN" 1;
}
# for example: if ($rejekto = 0) { <your bot blocking> }

The scanner's IP address

185.152.196.52

The second option: the Rejekto scanner always connects from these addresses. We announce a change here in advance.

User-Agent

The scanner uses an ordinary Chromium User-Agent with Rejekto/<version> added. A User-Agent is easy to imitate, so use it only together with the IP address, never instead of it.

Examples

Setting names differ between versions of these services. The examples are a guide and do not guarantee that the scan passes with every protection setting.

Cloudflare

Under Security → WAF → Custom rules, create a rule with the condition “IP Source Address is in” with the scanner's addresses and the action Skip (skip all remaining rules and Super Bot Fight Mode). Bot Fight Mode on the free plan cannot be bypassed by an exception; switch it off temporarily for a test.

(ip.src in {185.152.196.52})

Akamai

In Bot Manager or the WAF (App & API Protector), add the scanner's IP addresses to an allowlist and attach it to the website's policy. The steps depend on your configuration, so discuss them with your Akamai account manager if needed.

WordPress: Wordfence and Solid Security

Wordfence: Firewall → All Firewall Options → Allowlisted IP addresses. Solid Security (formerly iThemes Security): Settings → Global Settings → Authorized IPs. Add the scanner's IP addresses to the list.

Apache (.htaccess)

If the website only allows selected addresses or blocks robots by User-Agent, add an exception for the scanner's IP address:

<RequireAny>
  Require ip 185.152.196.52
  # the website's other rules
</RequireAny>

nginx

When access is limited by IP address, add the scanner before the deny rule:

allow 185.152.196.52;
# the website's other rules, e.g. deny all;

How to check it

Save the change in the firewall or the bot protection.
In the Rejekto dashboard, open the website and start a manual scan.
If the scan is blocked again, check that the rule also covers the address with and without www, and both desktop and mobile.

Back to the home page