For site owners and firewall admins

About OutreachWizardBot

If you're reading this because a firewall log, a Wordfence alert, or a Cloudflare event flagged traffic from OutreachWizardBot, this page tells you exactly what it is, what it does, and how to allow it through.

Identification

The user-agent string

Our crawler always identifies itself honestly. It never spoofs a browser or Googlebot user-agent - that is a firm policy, not a technical limitation. Every request our crawler makes carries this exact user-agent string:

Mozilla/5.0 (compatible; OutreachWizardBot/1.0; +https://wizardofoutreach.com.au)

If you see this string in your access logs or firewall dashboard, it is genuinely us - not a spoofed or malicious bot pretending to be us.

What it does

A client-authorised SEO audit crawler

OutreachWizardBot is the crawler behind The Wizard of Outreach's SEO platform. It only visits a domain when the domain's owner has engaged us (as a paying client or via our free audit tool) to analyse their own site. We do not crawl domains without the owner's authorisation.

Respects robots.txt
Every crawl checks robots.txt before requesting a page and honours disallow rules exactly as written.
Politeness delay
Requests to the same host are spaced out and run under a shared global rate-limit - we never hammer a server.
SSRF-guarded
Every target is resolved and checked against a private/internal IP blocklist before each request and every redirect hop - it can never be tricked into fetching internal infrastructure.
No auth probing
It never attempts logins, brute-forces forms, or probes for vulnerabilities. It reads public pages (and, for WordPress sites, the standard public REST API) - nothing else.
Why you might see it

Common reasons this bot visited your site

  • You are our client: we run weekly technical audits, rank tracking support crawls, and competitor research for every active client's own domain.
  • You requested a free audit: our free SEO audit tool crawls the domain you submitted, at your request.
  • You are a client's competitor: as part of a client's competitor analysis, we crawl a small number of public pages on domains that rank for the client's target keywords - always politely, always robots.txt-respecting, never at volume.
If none of these apply
If you don't recognise any of the above and want the traffic stopped, add a Disallow rule for our user-agent in your robots.txt (or block the UA at your firewall) and email us at the address below - we will confirm and make sure our systems respect it.
Whitelisting

How to allow OutreachWizardBot through your firewall

Some web application firewalls block unrecognised bot user-agents by default. If you are our client (or considering becoming one) and want our audits to complete cleanly, whitelist the exact user-agent string above using whichever of the following applies to your site.

Wordfence (WordPress)
Wordfence > All Options > Rate Limiting > "Whitelisted URLs, IPs and User-Agents". Add a User-Agent rule matching OutreachWizardBot, or use Wordfence > Blocking > Allowlisted to permanently allow the string.
Cloudflare
Security > WAF > Custom rules. Create a rule: if User Agent contains "OutreachWizardBot" then Skip (select the relevant managed rules / rate limiting to skip, or set Action to Allow).
Sucuri
Firewall > Settings > Whitelist. Add the user-agent string under "Whitelist User Agent" so Sucuri's WAF stops treating it as unrecognised bot traffic.
Generic UA allow-list
Most firewalls and security plugins support a simple substring match on User-Agent. Match on OutreachWizardBot (not the full string) so version bumps don't break the rule.

You can also allow it via robots.txt without any firewall change - add an explicit Allow rule for our user-agent (our crawler already respects robots.txt, so an Allow entry for it, alongside a Disallow for others, is honoured):

User-agent: OutreachWizardBot
Allow: /

Still have questions?

Email us at hello@wizardofoutreach.com.au and a real person will confirm whether the traffic you saw is genuinely ours.