CresvaBot

Why it visited your site

One of four things happened.

Someone asked for a free growth audit of that URL. The audit is run on request and reads the page there and then, so a single visit with no follow-up is almost always this.

Or a merchant using the Cresva browser extension asked it to read one of your product pages, to compare what a shopper sees with what an AI shopping assistant can read. Those reads carry the same user agent as every other CresvaBot request.

Or your storefront is in the public AI Shopper Index, which Cresva re-measures on a schedule. A brand already in the index is re-read roughly once a week.

Or the store's owner connected it to Cresva. A store connected by its owner is re-read daily. These last two are the only cases in which CresvaBot returns on its own.

What it requests

The submitted URL

The page itself, for the readability and tracking checks the audit reports on.

/robots.txt

Parsed to tell the brand which assistant crawlers their own rules block.

/sitemap.xml

Checked for presence and for how many URLs it declares.

/products.json, /collections.json, /meta.json

Public Shopify endpoints. Read to see whether an assistant can enumerate the catalogue.

/products/<handle> and /products/<handle>.js

A sample of product pages, to check the structured data a shopping assistant would read.

How it behaves

• •CresvaBot reads pages. The one exception is the agent test, which adds one item to an anonymous cart and never places an order.
• •One request at a time per site. There is no parallel fan-out across your pages.
• •Each request times out at 15 seconds, and storefront probes at 8 seconds.
• •Responses are read up to 5MB and then dropped.
• •At most 3 redirects are followed before the request is abandoned.
• •Public addresses only. Hosts that resolve to private, link-local, or cloud metadata addresses are rejected before any connection is opened.
• •Only pages reachable without a login. CresvaBot holds no credentials, and the one cookie it keeps is that anonymous cart's, only for the agent test.

How to check it is really us

Every GET and HEAD request CresvaBot sends is signed with Web Bot Auth (HTTP Message Signatures, RFC 9421, with an Ed25519 key). Each request carries a Signature-Agent header naming https://cresva.ai, and a signature over the host it asked and that header.

The public key is published, and itself signed, at the address below. A request that claims to be CresvaBot and does not verify against it is not from us.

How to stop it

CresvaBot does not currently consult your robots.txt before requesting a page. It reads that file to report on it, not to take instruction from it, so a robots.txt rule will not turn CresvaBot away. We would rather say that here than let you write a rule that does nothing.

Two things do work. Deny the CresvaBot user agent at your CDN or firewall, which takes effect immediately and is entirely in your hands. Or email us and we will remove your domain from the index registry so the scheduled re-read stops.