HarborBot

What it does

• Reads your public pages, sitemap and robots.txt for Site Health, topic ideas and research.
• On WordPress and Shopify sites it reads the public content feeds first (/wp-json/, /feed/, /products.json), because that is lighter on your server than loading every page.
• Checks that links and images in articles still work.
• Sends a few requests at a time and slows down when your server asks it to (HTTP 429).
• Never logs in, never submits forms, and never pretends to be a browser.

How to recognise it

Every request sends this user agent:

HarborBot/1.0 (+https://harborseo.ai/bot)

If your firewall matches on part of the user agent, use HarborBot.

IP addresses: HarborBot runs on cloud servers and has no fixed IP addresses, so please allow it by user agent rather than by IP.

If your server refuses HarborBot, Harbor may read your public pages through a third-party page reader instead. That is slower and less accurate, so allowing HarborBot gives you better results.

How to allow it

Cloudflare

1. Go to Security → WAF → Custom rules and create a rule.
2. Set the expression to (http.user_agent contains "HarborBot").
3. Choose the action Skip and tick all remaining custom rules, rate limiting, managed rules and Super Bot Fight Mode.
4. Save, and move the rule to the top of the list.

On the Free plan, Bot Fight Mode cannot be skipped by a rule. If Harbor is still blocked, turn Bot Fight Mode off under Security → Bots.

SiteGround

SiteGround's anti-bot system shows a captcha (sgcaptcha) to crawlers it does not know. Contact SiteGround support from your Site Tools and ask them to allow the user agent HarborBot for your site. If you use the SiteGround Security plugin, also check that it is not blocking it.

Vercel

If Attack Challenge Mode is on, Vercel shows a security checkpoint to every crawler. Turn it off when you are not under attack, or add a custom rule under Firewall → Rules that bypasses requests whose user agent contains HarborBot.

Simply.com and other hosts

Ask your host's support to allow the user agent HarborBot. You can send them a link to this page.

WordPress security plugins

In Wordfence, Sucuri, Imunify360 or similar, add HarborBot to the allowed user agents or bots. Keep the WordPress REST API (/wp-json/) available to public read requests if you can, as it is the lightest way for Harbor to read your content.

After you allow it

Run Site Health again from your Harbor dashboard. Pages that were blocked will be scanned normally.