The requests Checkbox makes to your site — the synthetic shopper, the policy fetcher and the preflight page fetcher — how to recognize them and what they do.

If you see Checkbox in your logs, it is one of these. All of them only fetch public addresses (private and internal IPs are refused at connect time, on every redirect), and only for sites registered in a Checkbox account.

#Synthetic shopper

A real Chromium browser that visits your checkout the way a customer would — from each configured state (through regional proxies) and on desktop and mobile — completes a sign-up when you configured one (for example with a 100%-off code or a test subscription), and tries to cancel online. It identifies as a current desktop or mobile Chrome, because the point is to see exactly what customers see. Scans run when you ask (createScan, verifySite), on the site's monitoring schedule, and when the snippet reports a changed page.

#Policy fetcher

User agent: CheckboxPolicyFetcher/1.0 (+https://checkbox.site/docs/policy-fetcher).

Fetches the Terms of Service, refund, cancellation and privacy pages registered for a site (or linked from its footer), with GET only: up to 10 seconds and 2 MB per page, HTML or plain text, every redirect re-checked. The text is stored in the site's evidence vault and checked for consistency with the law and the checkout (for example "no cancellations" or a refund policy that contradicts a money-back promise). It runs when the policies are registered, when a setup session is verified and when a policy task is verified.

#Preflight page fetcher

User agent: CheckboxPreflight/1.0 (+https://checkbox.site/docs/preflight).

Fetches one page when an activated live account calls checkPage with a url, or verifies a page task: GET, up to 10 seconds, 1 MB and 5 redirects. The HTML is checked and not stored.

#Blocking or allow-listing

If a bot wall or WAF blocks the synthetic shopper, scans report the page as not reachable and checks stay needs_review rather than passing. Allow the user agents above, or run a test subscription, which needs no access to your production site.

Checkbox is compliance software, not a law firm; nothing in these docs is legal advice (details). For AI agents: every page is available as Markdown at the same URL plus .md; the index is /llms.txt.