ClirCymruBot

A check only ever runs when the person responsible for that website asks for it. They sign in, enter their own address and press the button. Nobody can point Clir at a website they do not own without being asked to by the owner.

So when you see ClirCymruBot turned away by a security system, it is the site owner's own tool being stopped from reading the site owner's own pages.

Clir Cymru is a free accessibility checking service for small businesses in Wales, made by MWT Cymru. When a business asks for a check, ClirCymruBot reads the public pages of their own website and reports back to them on things like colour contrast, text size, headings, links and picture descriptions.

It is a checking tool, not a visitor and not a scraper.

It always says who it is. Requests carry this user agent:

ClirCymruBot/1.0 (+https://clircymru.com/bot; accessibility check for Welsh small businesses)

Requests from a mobile sized window carry the same name with "mobile viewport" on the end. We never disguise the tool as an ordinary browser, never pretend to be a normal visitor and never try to get around bot protection. If we are turned away, we tell the business owner so and stop.

Every request we send is signed with our own key, using the Web Bot Auth method (HTTP Message Signatures, RFC 9421). Three headers travel with each request: Signature-Agent, Signature-Input and Signature. The Signature-Agent header is always:

"https://clircymru.com"

Our public key is published here, and only here:

https://clircymru.com/.well-known/http-message-signatures-directory

The key is Ed25519 and its identifier is 9DBKY8n5fhfspUVq0-JlZMzzusvScNvHuhs6uU7hMsY. Anything claiming to be ClirCymruBot without a signature that checks out against that key is not us.

If you look after a website that uses Cloudflare, you can ask Cloudflare to recognise ClirCymruBot as a verified bot. The form is at: Protect & Connect, Application Security, BotBase, Submission form. The direct link is:

https://dash.cloudflare.com/?to=/:account/application-security/botbase

Fill in each field as follows. We cannot promise Cloudflare will approve it, but the information is accurate and matches how ClirCymruBot behaves.

Bot name

ClirCymruBot

Bot documentation URL

https://clircymru.com/bot

Operator

Enter the person who owns or runs ClirCymruBot and can answer Cloudflare's questions.

Name: Zoe
Email: zoe@mwtcymru.co.uk

Ownership

Tick "I own this bot" if you are submitting it on behalf of MWT Cymru.

Short description

ClirCymruBot reads public pages for Clir Cymru, a free accessibility checking service run by MWT Cymru for small businesses in Wales. It checks colour contrast, text size, headings, links and picture descriptions. It runs only when a site owner asks for a check, reads a handful of pages, and stops.

Access type

Choose Direct. ClirCymruBot is run by a single operator from its own infrastructure.

Categories

Pick the closest match. "Monitoring & analytics" or "Accessibility" fit if they are available. If neither appears, choose the category that best describes a good-faith accessibility checker.

Content use

Pages are read to produce a private accessibility report for the site owner only. Nothing is passed to any other company. The bot does not sign in, fill in forms, place orders, post content or change anything on the site.

Identity attestation method

Choose Request Signature or Web Bot Auth (the exact label may vary). Cloudflare will check the signed headers on our requests.

Public key / key directory URL

https://clircymru.com/.well-known/http-message-signatures-directory

Key identifier (kid)

9DBKY8n5fhfspUVq0-JlZMzzusvScNvHuhs6uU7hMsY

Additional information

Every request from ClirCymruBot is signed using HTTP Message Signatures (RFC 9421) with an Ed25519 key. The Signature-Agent header is always "https://clircymru.com". The public key directory is itself signed with the same key. The bot follows robots.txt, is rate-limited, and never disguises itself as a normal browser or tries to work around bot protection.

Match on the user agent, not on an address. Our checks run on hosted infrastructure that does not give us one permanent address yet, so an allowlist built on IP addresses will stop working without warning.

We are working on a fixed set of addresses. When they are settled they will be published here, on this page, and nowhere else, so you can always check this address to see the current list. Until then, this section is the honest answer: we cannot give you a fixed address today.

It reads publicly available pages only. It does not sign in, does not fill in forms, does not place orders or bookings, does not post anything and does not change anything on the website.

It reads your robots file first and follows it. Rules written for everyone, and rules written for ClirCymruBot by name, are both obeyed. A handful of pages are read, a few seconds apart, and then it stops. It does not crawl continuously.

Nothing from the website is passed to any other company. Pages are read from our own server and our own browser.

Security, WAF, Custom rules, Create rule. Name it "Allow ClirCymruBot", use the expression editor and paste:

(http.user_agent contains "ClirCymruBot")

Set the action to Skip and tick: All remaining custom rules, Super Bot Fight Mode, Managed challenge, Rate limiting rules. Deploy it and place it above any rule that challenges unknown agents. If the zone uses Bot Fight Mode rather than Super Bot Fight Mode, that setting cannot be skipped by a rule and has to be turned off, or the zone moved to Super Bot Fight Mode.

Wix does not expose a firewall rule for this. The setting that matters is Settings, SEO, Robots.txt editor. Add:

User-agent: ClirCymruBot
Disallow:

If the site also sits behind Cloudflare or another proxy on a custom domain, that layer is where the block usually comes from, so apply the Cloudflare rule above as well.

Settings, Developer tools, robots.txt, and add the same two lines as for Wix. Squarespace also throttles unknown agents at its edge, which we handle by reading only a handful of pages several seconds apart. If checks are still turned away after the robots change, the block is at the CDN and Squarespace support has to lift it for the user agent above.

Wordfence: Tools, Live Traffic to confirm the block, then Firewall, All Firewall Options, Allowlisted 404 URLs is not the one you want. Use Firewall, Blocking, and remove any rule matching our user agent, then add ClirCymruBot to Wordfence's list of verified crawlers under Firewall Options, Whitelisted services and custom user agents.

Sucuri: Firewall (WAF), Access Control, Whitelist, add a User-Agent entry containing ClirCymruBot.

All In One WP Security: WP Firewall, Internet Bots, uncheck Block Fake Googlebots or add ClirCymruBot to the permitted list. iThemes or Solid Security: Settings, Banned Users, and make sure the HackRepair agent blocklist does not match our name.

Whichever plugin, the rule is the same: allow requests whose user agent contains ClirCymruBot.

With ModSecurity: add a whitelist rule to the user's configuration, for example

SecRule REQUEST_HEADERS:User-Agent "@contains ClirCymruBot" "id:1000001,phase:1,allow,nolog,ctl:ruleEngine=Off"

With Imunify360 or CSF: add ClirCymruBot to the allowed user agents list rather than allowing an IP address, because our address can change. In cPanel, ModSecurity rules live under Security, ModSecurity Tools; on WHM they live under Security Center, ModSecurity Configuration.

Also add the robots lines shown above if the host serves a shared robots file.

Tell the owner and ask them to run their check again. If it is still turned away, the block is coming from a second layer, usually a CDN in front of the host. We report honestly when we cannot get in, and we never try to work around it.

If you would like to confirm any of this before allowing it, please get in touch with MWT Cymru. You can also read how Clir handles website information on the privacy page.