Generative Metrics logo
Checking…Create account

Allow the Generative Metrics scanner

A blocked scan is a measurement problem, not a verdict about your site. Here is how to let the scanner through without opening your site to everything.

Audit

Record what each named protocol observed.

Diagnose

Trace each production finding to evidence.

Verify

Re-run the protocol required by the remediation.

Why your page can be blocked

CDNs, WAFs, and bot-management services deliberately challenge automated clients. When our scanner is challenged or denied, the audit reports that it could not measure the page — it does not blame your content. To measure a protected page, allow the scanner as a known, verified client.

What the scanner sends

Direct HTTP evidence (no JavaScript)
A branded user agent: GenerativeMetrics/1.0 (+https://generativemetrics.com)
Browser-rendered capture and protected scans
A normal browser user agent plus the registered scan-token header: X-GM-Scan-Token: <your token>

The token is scoped to your domain and is never forwarded to any other host during redirects. Named AI-crawler probes are separate: they send that crawler's own published token, because they measure the crawler's access, not ours. A machine-readable copy of this identity is published at /.well-known/gm-scanner.json.

Allow the scanner in two minutes

  1. 1. Create a free account and open Protected Sites.
  2. 2. Add your domain and choose your provider. You get a one-time scan token — copy it immediately, it is shown only once.
  3. 3. Add the allow rule below to your WAF or bot management, above any block or challenge rule.
  4. 4. Press Verify Setup. When it succeeds, the domain is marked active and future scans carry the token.

Cloudflare

  1. Log in to Cloudflare and select your domain.
  2. Go to Security > WAF > Custom Rules.
  3. Create or edit a rule named "Allow Generative Metrics Scanner".
  4. Set expression: any(http.request.headers["x-gm-scan-token"][*] eq "YOUR_TOKEN_HERE")
  5. Set action to Skip.
  6. Under components to skip, select "All remaining custom rules".
  7. Place this rule above any block or challenge rule for the domain, then save and deploy.

Akamai

  1. Open your Akamai security configuration for this property.
  2. Add an allow/bypass rule for requests with a custom header match.
  3. Condition: X-GM-Scan-Token equals "YOUR_TOKEN_HERE".
  4. Set action to allow/bypass bot and WAF checks, then activate the property.

DataDome

  1. Open your DataDome dashboard for this protected domain.
  2. Create an allow rule based on an HTTP header.
  3. Condition: X-GM-Scan-Token equals "YOUR_TOKEN_HERE".
  4. Apply and deploy the rule so scanner requests bypass blocking challenges.

Generic WAF

  1. Open your WAF or firewall dashboard for this domain.
  2. Create a new allow/bypass rule using a custom request header match.
  3. Condition: X-GM-Scan-Token equals "YOUR_TOKEN_HERE".
  4. Save and deploy the rule.

If you cannot add a rule

  • Some hosts gate custom firewall rules behind a higher plan. If your WAF cannot match request headers, allow the branded scanner user agent on the paths you want audited, or ask your provider to allowlist the scanner as a verified client.
  • The token changes whether we can measure the page. It never changes what the audit reports, and it does not affect other crawlers or visitors.
  • Removing the token or disabling the domain restores your original access controls immediately.
Create free accountRead scope FAQContact support