The requests Checkbox makes to your site — the synthetic shopper, the read-only scan, the policy fetcher, the preflight page fetcher and the domain check — how to recognize them, what they do and how to opt out.

If you see Checkbox in your logs, it is one of these. All of them only fetch public addresses (private and internal IPs are refused at connect time, on every redirect), and only for sites registered in a Checkbox account.

#Synthetic shopper

A real Chromium browser that visits your checkout the way a customer would — as a shopper in each configured state (that state's timezone and browser location, plus regional proxies where the deployment configures them) and on desktop and mobile — completes a sign-up when you configured one (for example with a 100%-off code or a test subscription), and tries to cancel online. It identifies as a current desktop or mobile Chrome, because the point is to see exactly what customers see. Scans run when you ask (createScan, verifySite), on the site's monitoring schedule, and when the snippet reports a changed page.

#Read-only scan

User agent: a current desktop Chrome followed by CheckboxScanner/1.0 (+https://checkbox.site/docs/bots#read-only-scan).

Before a site's owner has verified the domain, Checkbox may look at the site's own public pages once a day at most with a real browser: the homepage and its links to pricing, Terms, privacy, refund, cancellation, account and sign-up pages, at most 20 pages, all on the site's own domain. It only loads pages: it never clicks, types, submits a form, creates an account or opens a checkout, and every request other than GET is refused inside the browser. It reads robots.txt first and honors the CheckboxScanner group (or *). What it reads is kept only as an unverified scan for the account that registered the site; it is not published anywhere.

#Policy fetcher

User agent: CheckboxPolicyFetcher/1.0 (+https://checkbox.site/docs/policy-fetcher).

Fetches the Terms of Service, refund, cancellation and privacy pages registered for a site (or linked from its footer), with GET only: up to 10 seconds and 2 MB per page, HTML or plain text, every redirect re-checked. The text is stored in the site's evidence vault and checked for consistency with the law and the checkout (for example "no cancellations" or a refund policy that contradicts a money-back promise). It runs when the policies are registered, when a setup session is verified and when a policy task is verified. Before the site's domain is verified, a setup session reads the site's own homepage and policy pages once as an unverified preview: the same GET, redirects only within the site's own domain, nothing stored.

#Preflight page fetcher

User agent: CheckboxPreflight/1.0 (+https://checkbox.site/docs/preflight).

Fetches one page when an activated live account calls checkPage with a url, or verifies a page task: GET, up to 10 seconds, 1 MB and 5 redirects. The HTML is checked and not stored.

#Domain check

User agent: Checkbox-DomainVerification/1.0.

When an account verifies a domain, Checkbox looks up the _checkbox-verify TXT record, fetches /.well-known/checkbox-verify.txt, and loads the homepage once (GET, redirects only within the domain) to look for the site's Checkbox snippet or a checkbox-verify meta tag. It repeats this for a pending verification for up to 72 hours, backing off from once a minute to once every 30 minutes.

#Opting out

To keep Checkbox from visiting your website before you have verified it (read-only scans), disallow CheckboxScanner in your robots.txt, or email support@checkbox.site from an address at your domain and we add it to the opt-out list (it covers its subdomains). Once someone has verified the domain — proving they control it — Checkbox scans it for that account as configured.

#Blocking or allow-listing

If a bot wall or WAF blocks the synthetic shopper, scans report the page as not reachable and checks stay needs_review rather than passing. Allow the user agents above, or run a test subscription, which needs no access to your production site.

Checkbox is compliance software, not a law firm; nothing in these docs is legal advice (details). You remain solely responsible for your subscription program, and Checkbox takes on no legal liability for it (Terms). Checkbox is a System1 company; Trust center · Status. For AI agents: every page is available as Markdown at the same URL plus .md; the index is /llms.txt.