About the Sigila scanner

What visits your site when Sigila scans it, and how to keep it out if you prefer.

What it is

Sigila checks public web pages for accessibility failures against WCAG 2.1 AA. A scan opens the page in a real Chrome browser, waits, closes the cookie dialog the way a visitor would, scrolls through the page and runs automated checks. It never signs in, never submits a form, and does not try to get past bot protection: if your site shows it a challenge, the scan stops and reports that.

When it visits

• Someone asked for it. A visitor ran a free scan of one page, or a subscriber has their own site scanned weekly. These scans look like an ordinary Chrome browser.
• A research sample. On our own initiative we scan the front pages of public sites, for example Finnish municipalities, at night and one page per site, and publish only aggregated statistics; no site is named without its permission. These scans respect robots.txt and carry the identifier below.

How to recognise it

Every scan comes from the address 94.237.112.217. Research scans add this to the browser's User-Agent string:

SigilaScanner/1.0 (+https://getsigila.com/bot)

How to keep it out

Research scans obey your robots.txt. To exclude them, add:

User-agent: SigilaScanner
Disallow: /

To exclude your site from every scan, including ones visitors ask for, write to us through the support form (topic "Do not scan my site") from an email address at your site's own domain. We then block the site and its subdomains.

What the scanner changes on your page

Almost nothing, and it says so here: before your own scripts run, the scanner keeps a small diary of what the page listens for (which events it registers, and whether it tries to lock the screen orientation), because criteria such as motion actuation cannot be judged any other way. The diary records; it changes nothing, adds no behaviour and is not sent anywhere — it is read back by the scanner at the end of the visit, like the rest of the results. In the paid report the scanner also presses a few single letter keys with nothing focused, to see whether the page reacts to keyboard shortcuts the way a visitor would trigger them.

What is stored

A screenshot of the page, the HTML of the elements that fail a check, and technical details of the page load. Free-scan results are deleted after 30 days, research scans after 24 months; screenshots are never published. The privacy notice has the details, including what happens if a person is visible on a scanned page.