Uncanny Automator

For site owners, hosts and firewalls

Requests from the Uncanny Automator platform

The Uncanny Automator platform calls a WordPress site on behalf of the Automator plugin installed on it, and only after the site's owner connects the plugin.

How our requests look

User-Agent
UncannyAutomatorPlatform/1.0 (+https://api.automatorplugin.com/bot) A name, not proof. Anyone can send it, so never allow a request on the User-Agent alone.
Signature
Every request carries a signature only we can make (Web Bot Auth), which Cloudflare checks for you. Our public keys: /.well-known/http-message-signatures-directory
Where on your site
The Automator plugin's own REST routes, under /wp-json/automator/
Operated by
Uncanny Owl Inc., the makers of Uncanny Automator

Why we call your site

Site check

When the plugin connects your site, we check that the site is really at its address.

App events

When an app action a recipe started finishes later, we send your site the result.

Triggers you subscribe to

When an app sends an event your site subscribed to, we pass it on.

What we don't do

  • We don't crawl. No pages, no links, no sitemaps.
  • We don't call a site whose owner hasn't connected the plugin.
  • We can't pass a browser challenge, so one stops your recipes.

Let us through your firewall

Allow us on Cloudflare's verified-bot check, which nobody else can fake. It matches us once Cloudflare has verified our requests. Keep every other protection on.

Cloudflare, Pro plan and above

  1. Open your site in the Cloudflare dashboard, then Security › Security rules, and create a custom rule.
  2. Choose Edit expression and paste:
(cf.client.bot
 and starts_with(http.request.uri.path, "/wp-json/automator/"))
  1. Set the action to Skip and tick All remaining custom rules and All Super Bot Fight Mode rules. Leave managed rules and rate limiting on.
  2. Place the rule First and deploy it.

Cloudflare, Free plan

Bot Fight Mode takes no exceptions from rules. If it stops us, write to us and we'll help you sort it out.

WordPress security plugins

A plugin that closes the REST API to visitors who aren't signed in blocks us too. Allow the Automator plugin's routes under /wp-json/automator/.

Another firewall or host

Write to us and we'll work out with your host how to tell our requests apart.

A request you don't think is ours?

Write to us with the time and the path. We'll tell you whether we sent it.

Contact support