01 · Operator
Who operates Riddler
- Company
- F-Secure
- Type
- Monitoring bot
- Official docs
- riddler.io
02 · Behavior
What Riddler does
Riddler crawls web pages and scans ports of publicly reachable systems. It runs on many machines worldwide, so visits can come from different IPs. It aims to fetch one copy of each page per visit.
03 · Impact
Why Riddler matters for your site
If you allow it
- Respects robots.txt
- Low request rate per site
If you block it
- No search or traffic benefit
- Part of network reconnaissance and port scanning
04 · Allow
How to allow Riddler
robots.txt
User-agent: Riddler
Allow: /Cloudflare
# Security › WAF › Custom rules › Create rule
Expression: (http.user_agent contains "Riddler")
Action: Skip › All Super Bot Fight Mode rules
# Also check Security › Bots: "Block AI bots" can block it regardless of robots.txt.WordPress
# WordPress serves a virtual robots.txt. Edit it with your SEO plugin:
# Yoast: SEO › Tools › File editor · Rank Math: General Settings › Edit robots.txt
User-agent: Riddler
Allow: /nginx
# nginx serves every user agent by default.
# Make sure no rule like this blocks it:
# if ($http_user_agent ~* "Riddler") { return 403; }Apache
# Apache serves every user agent by default.
# Make sure .htaccess has no rule like this:
# RewriteCond %{HTTP_USER_AGENT} Riddler [NC]
# RewriteRule .* - [F,L]05 · Block
How to block Riddler
Riddler follows robots.txt, so one rule is enough. Use a server or CDN rule only to stop spoofed copies.
robots.txt
User-agent: Riddler
Disallow: /Cloudflare
# Security › WAF › Custom rules › Create rule
Expression: (http.user_agent contains "Riddler")
Action: BlockWordPress
# WordPress serves a virtual robots.txt. Edit it with your SEO plugin:
# Yoast: SEO › Tools › File editor · Rank Math: General Settings › Edit robots.txt
User-agent: Riddler
Disallow: /nginx
# In your server { } block:
if ($http_user_agent ~* "Riddler") {
return 403;
}Apache
# .htaccess
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} Riddler [NC]
RewriteRule .* - [F,L]
</IfModule>06 · User agents
User agents we see for Riddler
The user agent published by the operator:
Riddler (http://riddler.io/about)07 · Verification
Is it really Riddler?
Riddler’s operator publishes no IP ranges or hostnames, so requests cannot be verified. Treat the user agent as a claim, and watch your logs for unusual request rates.
FAQ
Questions about Riddler
How do I block Riddler?
Add "User-agent: Riddler" with "Disallow: /" to robots.txt. The operator says the crawler respects it.
Can I exclude my network from Riddler's port scans?
Yes. Contact sir@riddler.io and verify ownership through whois data.
Why does Riddler come from many IP addresses?
Riddlerbot runs on multiple machines worldwide, some placed near target sites.
Last reviewed Oct 8, 2026