Kvali-review crawler

Kvali reviews merchants' public websites for payment service providers, before and after a merchant starts accepting cards: are the business, its policies and its prices shown honestly to customers. If you see Kvali-review in your logs, it is reading your public pages for that purpose, usually because your payment provider asked for a review.

How it behaves

• Reads public pages only: home, products, prices, policies, contact, and the cart up to the payment step.
• Never creates accounts, logs in, fills in or submits forms, or pays.
• Respects robots.txt. Reads about 15 pages per review, one at a time.
• Never tries to get around bot protection: if your site refuses it, the review says so and a person checks instead.

How to recognise it

• User-Agent: Kvali-review/1.0 (+https://aikvali.com/bot)
• Requests are signed with Web Bot Auth (HTTP Message Signatures): headers Signature-Agent: "https://aikvali.com", Signature-Input and Signature. Public keys: https://aikvali.com/.well-known/http-message-signatures-directory.
• Do not trust the User-Agent alone: anyone can copy it. Trust the signature.

How to allow it (Cloudflare)

1. Security → Events: filter on User-Agent "Kvali-review" to see which feature blocked it.
2. Pro plan and above: Super Bot Fight Mode → Verified bots = Allow, and a custom rule "Known Bots" → Skip, placed first.
3. Free plan with Bot Fight Mode: allow by IP address (ask us for the current one) together with the User-Agent, never the User-Agent alone.
4. Turn off "I'm Under Attack" for your public pages, then ask your payment provider to re-run the review.

Questions or opt-out

Write to bot@aikvali.com. Blocking the crawler in robots.txt also works; your payment provider will then review the site by hand.