The Vinny crawler

If you saw VinnyAudit or VinnyVerify in your logs, someone asked Vinny to check a website: a free audit, or a scan in someone's Vinny account (a site owner, an agency, or someone comparing sites).

What it is

• VinnyAudit loads pages in a real browser (Chromium) and checks accessibility, SEO, AI readiness and security headers, the way a visitor would see them. User agent: Mozilla/5.0 (compatible; VinnyAudit/1.0; +https://vinny.justwhat.net/bot/)
• VinnyVerify reads your home page once to look for the ownership tag when someone verifies your site in Vinny.

What it requests

• A free audit, which anyone can start: up to 5 pages, plus /robots.txt, /sitemap.xml and /llms.txt.
• A scan from a Vinny account, started by hand or on a schedule: pages from your sitemap and links, one at a time, up to the account's page limit, plus the scripts and stylesheets those pages load. If your robots.txt disallows VinnyAudit, it doesn't scan.
• Full security checks, only for sites the account verified as theirs or confirmed in writing it has the owner's permission to test: one request each to well-known addresses that should never be public (for example /.env, /.git/HEAD, database backups), plus /xmlrpc.php and /wp-json/wp/v2/users on WordPress. No logins, no forms submitted, nothing changed.

Vinny never submits forms, never tries passwords, and doesn't try to get around CAPTCHAs or firewalls. Requests come from Vercel's servers, so there's no fixed IP address; match on the user agent instead.

If your firewall blocks it

A scan stops and says so when a bot check answers instead of your site, so you never get a report about your firewall's page. To let your own scans through, allow requests whose user agent contains VinnyAudit:

• Vercel: Firewall → Configure → New rule: if User Agent contains VinnyAudit, then Bypass. Switch off Attack Challenge Mode while a scan runs.
• Cloudflare: Security → WAF → Custom rules: User Agent contains VinnyAudit, action Skip (Bot Fight Mode can't be skipped by a rule; switch it off briefly instead).
• WordPress security plugins (Wordfence, Solid Security): add VinnyAudit to the allowed user agents or switch off rate limiting while the scan runs.

To block it

Add this to your robots.txt; free audits of your site then stop there:

User-agent: VinnyAudit
Disallow: /

Questions or a problem with the crawler? Contact us.