01 · Operator
Who operates XRay
- Type
- Other bot
- Official docs
- github.com
02 · Behavior
What XRay does
It fetches a URL and parses feeds (Atom, RSS, JSONFeed) or microformats such as h-entry and h-card. IndieWeb tools use it to verify incoming webmentions and discover feeds. It fetches pages on demand, not by crawling.
03 · Impact
Why XRay matters for your site
If you allow it
- Used for webmention verification in IndieWeb sites
- Fetches single URLs on demand
- Open-source and documented
If you block it
- No benefit if you do not use webmentions or microformats
- robots.txt handling is not documented
04 · Allow
How to allow XRay
robots.txt
User-agent: XRay
Allow: /Cloudflare
# Security › WAF › Custom rules › Create rule
Expression: (http.user_agent contains "XRay")
Action: Skip › All Super Bot Fight Mode rules
# Also check Security › Bots: "Block AI bots" can block it regardless of robots.txt.WordPress
# WordPress serves a virtual robots.txt. Edit it with your SEO plugin:
# Yoast: SEO › Tools › File editor · Rank Math: General Settings › Edit robots.txt
User-agent: XRay
Allow: /nginx
# nginx serves every user agent by default.
# Make sure no rule like this blocks it:
# if ($http_user_agent ~* "XRay") { return 403; }Apache
# Apache serves every user agent by default.
# Make sure .htaccess has no rule like this:
# RewriteCond %{HTTP_USER_AGENT} XRay [NC]
# RewriteRule .* - [F,L]05 · Block
How to block XRay
Start with robots.txt. If XRay keeps showing up in your logs, block it at your CDN or web server.
robots.txt
User-agent: XRay
Disallow: /Cloudflare
# Security › WAF › Custom rules › Create rule
Expression: (http.user_agent contains "XRay")
Action: BlockWordPress
# WordPress serves a virtual robots.txt. Edit it with your SEO plugin:
# Yoast: SEO › Tools › File editor · Rank Math: General Settings › Edit robots.txt
User-agent: XRay
Disallow: /nginx
# In your server { } block:
if ($http_user_agent ~* "XRay") {
return 403;
}Apache
# .htaccess
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} XRay [NC]
RewriteRule .* - [F,L]
</IfModule>06 · User agents
User agents we see for XRay
The operator does not publish a full user agent string. Requests contain the token “XRay”.
07 · Verification
Is it really XRay?
XRay’s operator publishes no IP ranges or hostnames, so requests cannot be verified. Treat the user agent as a claim, and watch your logs for unusual request rates.
FAQ
Questions about XRay
What is XRay in my server logs?
It is an open-source parser that fetches a URL and returns structured data, often to verify a webmention linking to your site.
Who runs xray.p3k.io?
The XRay project is maintained by Aaron Parecki on GitHub under the MIT license. xray.p3k.io links to that repository.
What formats does XRay parse?
It parses Atom, RSS, JSONFeed and microformats such as h-entry, h-card and h-event.
Last reviewed Oct 8, 2026