Bot intelligence record
VaultPress
Usually allowUse the VaultPress identifier to separate Automattic security scanning or verification traffic from normal visitor requests in server logs.
User-Agent Pattern
AutomatticVaultPress
Robots.txt Snippet
Copy-readyUser-agent: VaultPress Disallow: /Handling Guidance
NoThis bot is usually safe to allow when the request source is verified and the traffic matches your site policy.
Security scanning, malware checks, abuse prevention, compliance review, or vulnerability monitoring.
Record Details
Structured data- Operator
- Automattic
- Family
- Automattic
- Type
- Security
- Purpose
- Security
- Identity type
- Verified Bot
- Confidence
- Medium
- Last verified
- 2026-04-01
- Last checked
- 2026-05-20
- Source type
- Verified Directory
- Spoofing risk
- User-agent strings can be spoofed. For allow-listing or low-friction rules, pair the published identifier with operator documentation or cryptographic verification when available.
Notes
VaultPress is listed in the Botcrawl directory as a security scanner from Automattic. The primary identifier for log review is VaultPress.
Identification
- User-agent pattern:
VaultPress - Family: Automattic
- Type: Security
- Kind: Scanner
Common use
Security scanning, malware checks, abuse prevention, compliance review, or vulnerability monitoring.
Verification and handling
Confirm the user-agent against server logs and use published operator documentation, IP ranges, reverse DNS, or other trust signals when available.
Directory guidance marks the risk level as Safe and the blocking decision as No. Do not rely on the user-agent string alone because user-agent strings can be copied or spoofed.
Robots.txt handling: No.
Evidence and Source
- Validate the identifying user-agent or signature against the operator documentation before creating hard allow rules.
- Match `VaultPress` as a case-insensitive substring in HTTP user-agent logs. Do not treat a user-agent match alone as proof of identity for allow-listing.
- Security scanning, malware checks, abuse prevention, compliance review, or vulnerability monitoring.
- User-agent strings can be spoofed. For allow-listing or low-friction rules, pair the published identifier with operator documentation or cryptographic verification when available.
WordPress Bot Protection
Bot Blocker for WordPress
Monitor bot traffic, review live activity, and control AI crawlers, scrapers, scanners, spam bots, and fake trusted bots from one clean WordPress dashboard.