StoreSweepBot

Who we are

StoreSweep watches an online store's purchase path for two things: scripts that appear on or change around the checkout page, which PCI DSS requirements 6.4.3 and 11.6.1 ask merchants to track, and accessibility problems measured against WCAG 2.1 AA. It is run by CtrlAltCreate LLC in Albuquerque, New Mexico. There is a person behind it, and you can reach him at hello@storesweep.app.

How to recognize it

Every request carries this User-Agent string. It is never hidden or rotated.

StoreSweepBot/0.1 (+https://storesweep.app/bot)

The full string starts with a normal desktop Chrome signature, because the visit happens in a real Chromium browser, and ends with the token above. We do not use residential proxies, rotating IP addresses, CAPTCHA solvers or browser fingerprint changes. If a store challenges the visit, the visit ends.

What a visit does

A visit reproduces what a shopper sees on the way to paying, and nothing more.

1. Reads robots.txt first and follows the rules described below.
2. Loads the home page, one category page and one product page.
3. Adds one unit of one product to the cart using the store's own button.
4. Loads the cart page and then the checkout page.
5. Records which scripts load on each page, which outside domains they come from, the security headers the pages send, and any accessibility violations the axe-core engine finds.
6. Closes the browser. The guest cart is abandoned.

Requests are spaced at least one second apart. A visit usually takes under two minutes.

What a visit never does

• It never types into a form field. No name, no email, no address, no card number, not even a test value.
• It never creates an account or logs in.
• It never places an order or starts a payment. The browser blocks order and payment endpoints before any request leaves, no matter what the page tries to do. Across every store we have ever visited, that count is zero.
• It never clicks subscribe, newsletter, apply, or contact buttons, and never submits a contact form.
• It blocks its own visit from analytics and session-recording tools, so it does not show up as a shopper in your reports.
• It never changes anything on your store.

How often it visits

Stores that are not customers: at most one visit every 90 days. Before that visit, a lighter check fetches your home page and a few public pages such as contact, about, privacy and terms, to confirm the store is live, US-based and on a platform we support, and to find a business contact address.

Stores that are customers: monthly, weekly or daily depending on plan, plus a single confirming re-visit when a scan sees something that changed. The store owner set this up and can see every visit in their account.

robots.txt

We check robots.txt on every page the bot itself requests. The rules we follow:

• Any rule addressed to User-agent: StoreSweepBot is followed exactly. If that group exists, it is the only group we read.
• A site-wide Disallow: / under User-agent: * is followed. We do not visit.
• A robots.txt that fails to load with a server error is treated as a full disallow.
• Path rules under User-agent: * that name only parts of the site, such as Disallow: /cart or Disallow: /checkout, are not applied. Almost every store platform ships those lines to keep search engines from indexing carts. Our visit is a single shopper-like session, not indexing, and honoring them would mean never seeing the checkout page, which is the only reason to visit. We say this plainly so nobody is surprised by it.

How to opt out

Either of these stops every future visit.

In robots.txt. Add this group. It takes effect at the next visit, which will read it and leave.

User-agent: StoreSweepBot
Disallow: /

By email. Write to hello@storesweep.app with your domain. A person adds it to a permanent do-not-visit list, and confirms.

If you received an email from us

Emails about a store's scan results come from an address at get-storesweep.com, are sent by a person's name, and carry our postal address. Reply STOP to any of them and you will not hear from us again, at that address or about that domain. There are no tracking pixels and no tracked links in them.

Questions

hello@storesweep.app. Include the domain and roughly when you saw the visit and we can tell you exactly what it did there.