DomainScores Bot: What It Is & How to Block It

01 · Operator

Who operates DomainScores

Company: Pragmatic Security Ltd
Type: Monitoring bot
Official docs: domainscores.net

02 · Behavior

What DomainScores does

DomainScores grades domains on DNS, email authentication, TLS, web security headers and registration hygiene. It reads response headers from a single request to the homepage. It does not follow links, fetch assets or index content, and scans each domain at most once per hour.

03 · Impact

Why DomainScores matters for your site

If you allow it

Very low load: one request to the homepage per scan
Gives public visibility into your domain's security setup

If you block it

Scans do not bring visitors
You may not want third-party security grades published

04 · Allow

How to allow DomainScores

robots.txt

User-agent: DomainScores
Allow: /

Cloudflare

# Security › WAF › Custom rules › Create rule
Expression: (http.user_agent contains "DomainScores")
Action:     Skip › All Super Bot Fight Mode rules

# Also check Security › Bots: "Block AI bots" can block it regardless of robots.txt.

WordPress

# WordPress serves a virtual robots.txt. Edit it with your SEO plugin:
# Yoast: SEO › Tools › File editor · Rank Math: General Settings › Edit robots.txt
User-agent: DomainScores
Allow: /

nginx

# nginx serves every user agent by default.
# Make sure no rule like this blocks it:
# if ($http_user_agent ~* "DomainScores") { return 403; }

Apache

# Apache serves every user agent by default.
# Make sure .htaccess has no rule like this:
# RewriteCond %{HTTP_USER_AGENT} DomainScores [NC]
# RewriteRule .* - [F,L]

05 · Block

How to block DomainScores

Start with robots.txt. If DomainScores keeps showing up in your logs, block it at your CDN or web server.

robots.txt

User-agent: DomainScores
Disallow: /

Cloudflare

# Security › WAF › Custom rules › Create rule
Expression: (http.user_agent contains "DomainScores")
Action:     Block

WordPress

# WordPress serves a virtual robots.txt. Edit it with your SEO plugin:
# Yoast: SEO › Tools › File editor · Rank Math: General Settings › Edit robots.txt
User-agent: DomainScores
Disallow: /

nginx

# In your server { } block:
if ($http_user_agent ~* "DomainScores") {
    return 403;
}

Apache

# .htaccess
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} DomainScores [NC]
RewriteRule .* - [F,L]
</IfModule>

06 · User agents

User agents we see for DomainScores

The user agent published by the operator:

Mozilla/5.0 (compatible; DomainScores/2.1; +https://www.domainscores.net/headers)

07 · Verification

Is it really DomainScores?

DomainScores’s operator publishes no IP ranges or hostnames, so requests cannot be verified. Treat the user agent as a claim, and watch your logs for unusual request rates.

FAQ

Questions about DomainScores

What is DomainScores?

DomainScores is a public security-grading service for domains. It checks DNS, email authentication, TLS and web security headers.

Why does DomainScores request my homepage?

It reads response headers from one request to / to score HTTPS and security headers. It does not follow links or index content.

How often does DomainScores scan a domain?

The operator states at most one scan per domain per hour, regardless of who triggers it.

DomainScores is Pragmatic Security Ltd’s monitoring bot