If your report says a page could not be captured, your bot protection stopped our auditor before it reached that page. Nothing is wrong with your store. We scored only what we could actually see, and left the rest blank rather than guessing.
Allowing us through takes about two minutes and gets you the full report. The rule is narrow, and you can remove it once your audit has run.
Every request from our auditor carries this header. Nothing else on the internet sends it, so matching on it affects only us.
X-DropIQ-Audit: 1Go to Security → WAF → Custom rules and create a rule. Use the expression editor and paste:
(http.request.headers["x-dropiq-audit"][0] eq "1")Set the action to Skip, and tick All remaining custom rules, Bot Fight Mode, and Managed rules. Deploy it, then re-run your audit.
On the free plan, Bot Fight Mode cannot be skipped by a WAF rule. Turn it off for the few minutes your audit takes, then turn it back on.
Most stores sit behind Cloudflare even when the platform does not say so, so the rule above is usually the right place to look. If you use a different WAF, allow requests carrying the X-DropIQ-Audit header, or ask your host to.
We view your homepage, one category page and one product page on a simulated phone, then leave. We do not add anything to a cart, submit any form, attempt checkout, or create an account. The audit is read-only.
Stuck, or would rather we sorted it out with you? Email contact@dropiq.ai and we will walk through it.