Kvali-review crawler

Kvali reviews merchants' public websites for payment service providers, before and after a merchant starts accepting cards: are the business, its policies and its prices shown honestly to customers. If you see Kvali-review in your logs, it is reading your public pages for that purpose, usually because your payment provider asked for a review.

How it behaves

• Reads public pages only: home, products, prices, policies, contact, and the cart up to the payment step.
• Never creates accounts, fills in or submits forms, or pays. It logs in only with a test account the merchant gave its payment provider for the review, and then only opens pages.
• Follows robots.txt, with one exception: when a payment provider reviews or monitors one of its own merchants, with that merchant's permission, Kvali reads the pages the review needs (policies, prices, the checkout) even where robots.txt asks crawlers to stay away. Everywhere else, including the free public website check and other organisations' websites, it follows robots.txt.
• Always identifies itself (below). Reads about 15 pages per review, one at a time, with pauses in between.
• Never tries to get around bot protection: if your site refuses it, the review says so and a person checks instead.

How to recognise it

• User-Agent: Kvali-review/1.0 (+https://aikvali.com/bot)
• Requests are signed with Web Bot Auth (HTTP Message Signatures): headers Signature-Agent: "https://aikvali.com", Signature-Input and Signature. Public keys: https://aikvali.com/.well-known/http-message-signatures-directory.
• Do not trust the User-Agent alone: anyone can copy it. Trust the signature.

How to allow it (Cloudflare)

1. Security → Events: filter on User-Agent "Kvali-review" to see which feature blocked it.
2. Pro plan and above: Super Bot Fight Mode → Verified bots = Allow, and a custom rule "Known Bots" → Skip, placed first.
3. Free plan with Bot Fight Mode: allow by IP address (ask us for the current one) together with the User-Agent, never the User-Agent alone.
4. Turn off "I'm Under Attack" for your public pages, then ask your payment provider to re-run the review.

Questions or opt-out

Write to bot@aikvali.com. Blocking the crawler in robots.txt stops the free public website check and every other read, but not a review your payment provider runs with your permission: to stop that, talk to your payment provider.