Overview
Stripebot is Stripe’s documented automated web crawler.
Stripe states that it collects data from its users’ websites to provide services and comply with financial regulations. Its documented user agent contains Stripebot/{version} and links to Stripe’s crawler documentation.
Verify Stripebot with forward-confirmed reverse DNS: the source address should resolve to a hostname under crawl.stripe.com, and that hostname should resolve back to the original address.
Stripebot mostly follows the RFC 9309 Robots Exclusion Protocol and recognizes rules for the Stripebot token.
Identity
- User-Agent Pattern
-
Stripebot - HTTP Agent Examples
-
Mozilla/5.0 (X11; Linux {version}) AppleWebKit/{version} (KHTML, like Gecko) Chrome/{version} Safari/{version} (Stripebot/{version}; +https://docs.stripe.com/stripebot-crawler) - Robots Token
- Stripebot
- Identity Type
- Officially documented
- Evidence Method
- Match the documented `Stripebot` user-agent component and use forward-confirmed reverse DNS. The source address should resolve under `crawl.stripe.com`, and the hostname should resolve back to the original address.
Classification
- Type
- Ecommerce
- Kind
- Crawler
- Family
- Stripe
- Purpose
- Service and compliance data collection
Behavior and handling
- Common Use
- Collects data from Stripe users’ websites to provide Stripe services and support financial-regulation compliance.
- Detection Notes
- Do not rely on the user agent alone. Verify a `crawl.stripe.com` reverse-DNS hostname and confirm the forward lookup returns the original source address.
- Respects robots.txt
- Yes
- Spoofing Risk
- Low after successful forward-confirmed reverse-DNS verification; high when identified only by user agent.
- Risk
- Safe
- Recommended Handling
- Do not block
Rules and controls
- Robots.txt Snippet
-
# This agent may ignore robots.txt. Use authenticated access controls or network policy when blocking is required.
Relationships
- Operator
- Stripe Checked 2026-08-05
Relationships without an Evidence link are normalized from the canonical directory record. They should not be interpreted as independent proof of physical presence or request origin.