Overview
BitSightBot retrieves website content while Bitsight evaluates externally visible web application security.
Bitsight documents the BitSightBot robots.txt token for its headless-browser security assessment process.
Identification: BitSightBot. Robots.txt token: BitSightBot.
Operator documentation: https://help.bitsighttech.com/hc/en-us/articles/21680878738967-Understanding-and-Troubleshooting-Web-Application-Security-Scanning.
Identity
- User-Agent Pattern
-
BitSightBot - Robots Token
- BitSightBot
- Identity Type
- Officially documented
- Evidence Method
- Verify the documented request signature or provider IP/network where available; a matching User-Agent string alone is not proof of origin.
Classification
- Type
- Security
- Kind
- Web security scanner
- Family
- Bitsight
- Purpose
- Website security assessment
Behavior and handling
- Common Use
- assessing external web application configurations and components
- Detection Notes
- Match HTTP User-Agent token BitSightBot; Full HTTP User-Agent format not published in referenced operator documentation; use documented robots token only.
- Respects robots.txt
- Yes
- Spoofing Risk
- The BitSightBot token can be spoofed in an HTTP User-Agent. Do not trust the token without independent corroboration.
- Risk
- Neutral
- Recommended Handling
- Depends
Rules and controls
- Robots.txt Snippet
-
User-agent: BitSightBot Disallow: /
Relationships
- Operator
- Bitsight Checked 2026-10-22
Relationships without an Evidence link are normalized from the canonical directory record. They should not be interpreted as independent proof of physical presence or request origin.