Plumb

PlumbScanner

You are probably here because you found this in a server log. 

PlumbScanner/1.0 (+https://plumbai.net/bot)

What it is

Plumb reads a business's own public marketing pages and reports what is out of true on them: claims that contradict each other, disclosures that are missing, trackers running before consent. It is a deterministic rule engine. There is no language model anywhere in it, and nothing it reads is used to train one.

What it does on your server

  • Reads /robots.txt first, and obeys it. If we cannot read it, we do not crawl. A robots.txt we cannot read is not a robots.txt that permits us.
  • Requests a handful of pages (eight by default, never more than twenty-five) a few at a time with a pause between them.
  • Is driven by a real Chrome, so it fetches the page's own subresources as a browser would.
  • Never signs in, never fills in a contact, booking or checkout form, and never requests a URL that changes anything on your server.

The exception: your chat widget

There is one case where we put something into your systems rather than taking a copy of something you already published, and it is the part of this page worth reading twice.

When a Plumb customer monitors a site as one of their properties, and that site has a chat widget, the scanner opens the widget and asks it up to five questions, then reads the answers: 

How much does it cost?
What are your opening hours?
What is your phone number?
Do you offer refunds?
How long does it take?

It asks because what a widget tells a customer is marketing too, and a widget that contradicts the page it sits on is one of the things Plumb exists to find. On the common vendors those messages arrive in a real inbox and may notify a real person. You should hear that from us rather than from your support queue on a Monday morning.

It does not happen on the free scan anyone can run from our home page. That reads pages and nothing else, because posting into a stranger's support queue is not ours to do. It happens on a monitored property, at that property's scan cadence. The Disallow stanza below stops it along with everything else: we read robots.txt before we open a browser tab on your site at all.

Blocking it

Put this in your robots.txt and we will stop: 

User-agent: PlumbScanner
Disallow: /

We read the group addressed to PlumbScanner in preference to the wildcard one, so that rule wins over anything you allow to *. For an unverified or third-party property, there is nothing to appeal: we will not ask for a rate limit instead, and we will not crawl anyway. A signed-in Plumb account owner can override the rule only after proving control of that exact hostname with a DNS TXT record or an exact same-host HTTPS verification file. The scan records that override.

Allowing it

If you are a Plumb customer and your own site is refusing us (usually a CDN or WAF rule rather than anything you set), the quickest fix is the same file: 

User-agent: PlumbScanner
Allow: /

That will not help if the refusal happens at the edge before your origin is reached, which is common with CloudFront and Cloudflare geo or reputation rules. In that case the allowlist has to be added wherever that edge is configured.

What it will not do

It does not rotate addresses to look like someone else, imitate another crawler's name, mimic a browser's TLS fingerprint, or attempt any challenge. If a site refuses us, the report says we could not read it. That is the whole product: we would rather report a gap than invent a number.

Questions, or a crawl that looked wrong to you: bot@plumbai.net.