Allowing dropIQ to audit your store

If your report says a page could not be captured, your bot protection stopped our auditor before it reached that page. Nothing is wrong with your store. We scored only what we could actually see, and left the rest blank rather than guessing.

Allowing us through takes about two minutes and gets you the full report. The rule matches a key issued to your site alone, it leaves the rest of your firewall untouched, and you can remove it once your audit has run.

If you previously added a rule matching X-DropIQ-Audit: 1, please remove it. That value was published on this page, so anyone could send it. Your key replaces it.

Ask us for your key

Email contact@dropiq.ai with your domain and we will send you a key for your site alone. Every request from our auditor to your site then carries it, as a header:

x-dropiq-key: your-key

We send it only to your site, never to anything else a page of yours loads, and only while an audit is running. It is yours: nobody else has it, and we will replace it whenever you ask.

Cloudflare

Go to Security → WAF → Custom rules and create a rule. Use the expression editor and paste, with your key in place of the placeholder:

(http.request.headers["x-dropiq-key"][0] eq "your-key")

Set the action to Skip, and tick Bot Fight Mode plus any custom rule of your own that challenges your category or product pages. Deploy it, then re-run your audit.

Leave Managed rules switched on. Those are your injection and exploit protections. The audit does not need them skipped, and no rule we suggest should ever turn them off.

On the free plan, Bot Fight Mode cannot be skipped by a WAF rule. Turn it off for the few minutes your audit takes, then turn it back on.

Shopify, WooCommerce and others

Most stores sit behind Cloudflare even when the platform does not say so, so the rule above is usually the right place to look. If you use a different WAF, allow requests carrying the x-dropiq-key header with your key, or ask your host to.

What we do while we are there

We view your homepage, one category page and one product page on a simulated phone, then leave. We do not add anything to a cart, submit any form, attempt checkout, or create an account. The audit is read-only.

Stuck, or would rather we sorted it out with you? Email contact@dropiq.ai and we will walk through it.