# Checkbox's crawlers

> The requests Checkbox makes to your site — the synthetic shopper, the policy fetcher and the preflight page fetcher — how to recognize them and what they do.

If you see Checkbox in your logs, it is one of these. All of them only fetch public addresses (private and internal IPs
are refused at connect time, on every redirect), and only for sites registered in a Checkbox account.

## Synthetic shopper {#synthetic-shopper}

A real Chromium browser that visits your checkout the way a customer would — from each configured state (through
regional proxies) and on desktop and mobile — completes a sign-up when you configured one (for example with a 100%-off
code or a test subscription), and tries to cancel online. It identifies as a current desktop or mobile Chrome, because
the point is to see exactly what customers see. Scans run when you ask (`createScan`, `verifySite`), on the site's
monitoring schedule, and when the snippet reports a changed page.

## Policy fetcher {#policy-fetcher}

User agent: `CheckboxPolicyFetcher/1.0 (+https://checkbox.site/docs/policy-fetcher)`.

Fetches the Terms of Service, refund, cancellation and privacy pages registered for a site (or linked from its footer),
with GET only: up to 10 seconds and 2 MB per page, HTML or plain text, every redirect re-checked. The text is stored in
the site's evidence vault and checked for consistency with the law and the checkout (for example "no cancellations" or a
refund policy that contradicts a money-back promise). It runs when the policies are registered, when a setup session is
verified and when a policy task is verified.

## Preflight page fetcher {#preflight-fetcher}

User agent: `CheckboxPreflight/1.0 (+https://checkbox.site/docs/preflight)`.

Fetches one page when an activated live account calls [`checkPage`](https://checkbox.site/docs/api/checks#checkPage) with a `url`, or
verifies a page task: GET, up to 10 seconds, 1 MB and 5 redirects. The HTML is checked and not stored.

## Blocking or allow-listing {#allow-list}

If a bot wall or WAF blocks the synthetic shopper, scans report the page as not reachable and checks stay
`needs_review` rather than passing. Allow the user agents above, or run a [test subscription](https://checkbox.site/docs/guides/test-runs),
which needs no access to your production site.