Allowlisting RegressionBot

RegressionBot is a visual regression testing service. It loads pages in a real Chromium browser, screenshots them, and compares each capture against the previous one to report what changed. If you have arrived here from a user-agent string in your access logs, this page tells you how to recognise that traffic and how to let it through.

Every request we make carries this token in its User-Agent header:

RegressionBot/1.0 (+https://regressionbot.com/docs/allowlist)

Match on a substring, not on equality.

The token is appended to the browser's own user-agent rather than replacing it, because sites branch on the browser identity and we need the page a real visitor would get. A rule written as User-Agent equals … will never fire. Match on RegressionBot appearing anywhere in the string.

The Chromium version in the prefix changes whenever our workers are rebuilt, so do not pin to it.

Two complete examples, one per device profile. These are the exact strings our workers send:

# Desktop profile
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.7727.15 Safari/537.36 RegressionBot/1.0 (+https://regressionbot.com/docs/allowlist)

# Mobile profile
Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.4 Mobile/15E148 Safari/604.1 RegressionBot/1.0 (+https://regressionbot.com/docs/allowlist)

Allowlist rules

Each of these matches the token anywhere in the user-agent and skips the bot challenge. Place them ahead of any managed bot rule, which is usually what blocks us.

Cloudflare — WAF custom rule, action Skip

(http.user_agent contains "RegressionBot")

AWS WAF — rule with action Allow, placed above AWSManagedRulesBotControlRuleSet

{
  "Name": "AllowRegressionBot",
  "Priority": 0,
  "Action": { "Allow": {} },
  "Statement": {
    "ByteMatchStatement": {
      "FieldToMatch": { "SingleHeader": { "Name": "user-agent" } },
      "SearchString": "RegressionBot",
      "PositionalConstraint": "CONTAINS",
      "TextTransformations": [{ "Priority": 0, "Type": "NONE" }]
    }
  },
  "VisibilityConfig": {
    "SampledRequestsEnabled": true,
    "CloudWatchMetricsEnabled": true,
    "MetricName": "AllowRegressionBot"
  }
}

Akamai — Bot Manager, custom-defined bot

Request Header  User-Agent  matches regex  RegressionBot\/[0-9.]+
→ Bot category: Monitoring / Site Health   → Action: Allow

nginx — if you rate-limit by agent

map $http_user_agent $is_regressionbot {
    default            0;
    "~*RegressionBot"  1;
}

What we do and do not request

Only the origin under test carries the token. The header is attached to same-origin requests only. Third-party hosts the page pulls in — CDNs, font providers, analytics endpoints — receive the browser's unmodified user-agent, because there is no reason to announce ourselves to services that are not the subject of the test. If your assets are served from a separate hostname with its own WAF, a rule keyed on this token will not cover them.
We render, we do not crawl. A run visits a fixed list of paths configured by the account holder, not every link it finds. Pages are loaded once per device profile per run.
GET only, no forms, no state. We do not submit forms, follow purchase flows, or attempt to log in unless the account holder has explicitly configured a credential for that origin.

What happens when we are blocked

Worth knowing because the failure is quiet in both directions. A bot challenge returns a page, and a page is exactly what we capture: the 403 interstitial screenshots successfully, compares cleanly against itself, and the run reports every URL as changed wholesale on the first occurrence and as unchanged thereafter. Nothing errors.

So if a run suddenly reports that every page on a site changed completely, check for a challenge page before checking anything else. The same shape appears when a staging origin's authentication expires — see Internal Environments.

Source addresses

We do not publish an IP range today. Captures run on ephemeral cloud workers in AWSus-east-1 whose addresses are not stable, so an address-based allowlist is not something we can support reliably. The user-agent token is the identifier to key on.

If you need traffic to arrive from a fixed address for a compliance rule, or you would like us to stop requesting a site, contact support.