Allow searchVIUbot in your firewall, WAF and CDN

  • For SEO team, IT, hosting and CDN teams
  • Updated 10 Nov 2026
  • Reading time 5 min
In short
  • searchVIU crawls from the fixed IP 35.190.196.200. The user agent contains the token searchVIUbot/2.0.
  • Allow the IP in your WAF, bot protection and rate limits, ideally together with the token. This applies to every host, including image, CDN and staging hosts.
  • Then just email info@searchviu.com. We check access and agree the crawl speed with you.

What the allowlisting covers

Everything searchVIU fetches for your project comes from this IP and with this token. One allowlisting therefore covers:

  • the weekly full crawl and Page Watch
  • checks of robots.txt, XML sitemaps and llms.txt
  • the check of outgoing links
  • crawls of your staging or DEV environment

Before you start

First collect all the hosts your website is served from. Each of them needs the allowlisting.

  • the main domain, with and without www
  • subdomains and country hosts, such as shop.example.com or example.at
  • hosts for images, CSS, JavaScript and fonts, including on the CDN
  • staging and DEV environments, if searchVIU should crawl them

When rendering, the crawler loads CSS, JavaScript, fonts and images like a browser. If these hosts are not allowed, parts of the page are missing from the result. The robots.txt must also be reachable for searchVIUbot on every host.

If there are several protection layers in a row, such as a CDN, a firewall at the hosting provider and a rate limit in the web server, each one needs the exception.

Three steps to the first crawl

  1. Create the allowlisting

    Pass these details on to your IT, hosting provider or CDN team.

    IP address

    35.190.196.200

    Token in the user agent

    searchVIUbot

    IP list as JSON

    https://www.searchviu.com/searchviubot-ips.json

    On every host, create a rule that lets this IP past your WAF, bot protection, rate limits and country blocks, where possible only together with the token. The guides per provider are below.

    In rules, check only for the token, because the Chrome version in the user agent goes up with every browser update. The IP list is structured like Google’s and can be read directly into automatic allowlists.

  2. Let us know

    Email info@searchviu.com with the hosts you have allowed and the provider in front of them. It also helps to know how many requests per minute your server can handle.

  3. We check access

    As a test, we fetch a few pages and tell you whether everything gets through. We agree the crawl speed with you before the first crawl.

The exception per provider

The menu paths come from the providers’ documentation, as of 10 Nov 2026. If an item has a different name for you, the linked documentation will help.

Cloudflare Free

On the Free plan, the crawler gets past Bot Fight Mode with an IP Access Rule and the Allow action.

  1. Open Security rules › Create rule › IP access rules.
  2. Enter the address 35.190.196.200 in the “IP, IP range, country name, or ASN” field.
  3. Choose “Allow” as the action and this website or all websites in the account as the scope.
  4. Add a note, such as searchVIUbot, and click “Create”.

With Allow, requests also get past custom rules, rate limiting rules and WAF managed rules. The rule only checks the address. That is enough, because only the searchVIU crawler uses it.

Documentation: developers.cloudflare.com/waf/tools/ip-access-rules/

Cloudflare Pro and higher

From Pro upwards, a custom rule also gets past Super Bot Fight Mode. It checks IP and token together and uses Skip to bypass the other protection rules.

  1. Open Security rules › Create rule › Custom rules and enter a name under “Rule name”, such as searchVIUbot.
  2. Enter this expression.
(ip.src eq 35.190.196.200 and http.user_agent contains "searchVIUbot")
  1. Under “Choose action”, select “Skip”.
  2. Tick “All remaining custom rules”, “All rate limiting rules”, “All Super Bot Fight Mode rules” and “All managed rules”. If you use other features such as Browser Integrity Check or Security Level, tick them too.
  3. Click “Deploy” and move the rule to the top of the list.

Documentation: developers.cloudflare.com/waf/custom-rules/skip/

Imperva

In Imperva Cloud Application Security, you create an allowlist in the website’s WAF settings.

  1. In my.imperva.com, open Application › Websites, select the website and then Website Settings › WAF.
  2. For the protection type that blocks searchVIUbot, click “Add allowlist”.
  3. Under “Add allowlist rule on”, choose IP, enter 35.190.196.200 and click “Add”.
  4. In the same rule, add User Agent with searchVIUbot, click “Add” and then “Confirm”.

The rule only applies when IP and token match together. If your account already works with policies (WAF Rules policy), you will find the settings there.

Documentation: docs-cybersec.thalesgroup.com › Cloud Application Security › WAF Settings

AWS WAF

In AWS WAF, you create an IP set and exclude it from Bot Control.

  1. In the AWS console, open AWS WAF › IP sets › Create IP set.
  2. Enter a name and choose the region, for CloudFront Global (CloudFront).
  3. Under “IP version” choose IPv4, enter 35.190.196.200/32 under “IP addresses” and click “Create IP set”.
  4. In the Bot Control rule set, add a scope-down statement that excludes requests from this IP set.
"ScopeDownStatement": { "NotStatement": { "Statement": { "IPSetReferenceStatement": { "ARN": "<ARN of your IP set>" } } } }

You need the same exception for rate-based rules. On request, we also set up a secret header that lets AWS recognise the crawler.

Documentation: docs.aws.amazon.com/waf/latest/developerguide/waf-ip-set-managing.html · …/waf-bot-control-example-scope-down-ip.html

Fastly

In Fastly’s Next-Gen WAF, a rule with the Allow action lets the request through even if other rules would block it.

  1. In the Fastly control panel, open Security › Next-Gen WAF › Rules and choose the workspace.
  2. Click “Add workspace rule” and choose Request under “Type”.
  3. Under “Conditions”, add a condition for the IP 35.190.196.200 and, with “Add condition”, a second one for a user agent containing searchVIUbot. Choose “All” so that both must match.
  4. Under “Actions” choose Allow and click “Create workspace rule”.

In the Next-Gen WAF’s own console, the rule is under Sites › Website › Rules › Site Rules › Add site rule.

Documentation: fastly.com/documentation/guides/next-gen-waf/rules/working-with-request-rules/

Sucuri

In Sucuri, you allow the IP in the website’s access control.

  1. In Sucuri’s WAF portal, open the website and the “Access Control” tab.
  2. Under “Allow IP Addresses”, enter 35.190.196.200 and click “Allow”.

Documentation: docs.sucuri.net/website-firewall/allowlist-and-blocklist/allow-an-ip-address/

Akamai

In Akamai’s Bot Manager, you set up searchVIUbot as a custom-defined bot and assign it to its own category. For this category you choose an action that lets the requests through. Bot Manager recognises the crawler most reliably by the IP 35.190.196.200, where possible together with the token searchVIUbot.

Documentation: techdocs.akamai.com/cloud-security/docs/detection-methods

Others and server firewall

With other providers and without a CDN, the same principle applies. Exclude the IP 35.190.196.200 wherever requests are blocked or slowed down, in the firewall, in the web server’s rate limit modules and in country blocks. If your hosting provider manages the firewall, send them the IP, the token and the link to the IP list.

In the access logs, you recognise searchVIU’s requests by the token searchVIUbot and the IP.

Allow staging and DEV environments

If searchVIU should crawl your staging or DEV environment, we set up access according to your requirements.

  • Password protection via Basic Auth. We enter the username and password in the project.
  • IP allowlisting. The staging environment lets 35.190.196.200 through, just like the live website.
  • Custom header. Your CDN or WAF recognises the crawler by a secret header, such as a bypass token.

If the staging environment’s robots.txt blocks everything, we can store a separate robots.txt for your crawls only on request. For search engines the block stays in place. More in the guide Staging environment and SEO.

Data protection

Without credentials, searchVIUbot only fetches publicly accessible pages. Credentials for the staging environment are never sent when the live website is crawled. The crawler runs in Google Cloud in the EU, and project data is stored in the EU too. More on the Security & GDPR page.

Troubleshooting

Many pages have status 403 or stop without a status code.

Your WAF, bot protection or firewall is still blocking. Check that the exception is in place on every host and in every protection layer, including the network firewall. Then just email info@searchviu.com for a new fetch.

Many pages are called “Just a moment…” and have hardly any content.

This is usually a challenge page from the bot protection with status 200. The WAF lets the crawler through, but the exception is still missing in the bot protection.

The crawl takes a long time and many pages have status 429.

A rate limit applies. Every 429 halves the crawl speed. Exclude the IP from the rate limit or tell us how many requests per minute your server can handle.

CSS, images or fonts are missing from the screenshot.

A host for files or images is blocking the crawler. Allow the IP on that host as well.

FAQ

Is it enough to allow the user agent?

No. Anyone can copy a user agent. Only the IP shows that a request really comes from searchVIU. The token narrows the rule down further.

Does the IP change?

searchVIU uses a fixed address. If it changes, we let you know. The creationTime field in the IP list shows the current version.

Why doesn’t searchVIUbot identify itself as Googlebot?

Cloudflare, Akamai and AWS WAF classify a Googlebot user agent that does not come from a Google address as a fake bot. In robots.txt, searchVIUbot still follows your rules for Googlebot as long as there is no separate group for it.

How can the crawler be slowed down?

We agree the crawl speed with you before the first crawl. If your server responds with HTTP 429, the whole crawl halves its speed. To stop a crawl completely, just email info@searchviu.com.

Does the crawl distort the analytics figures?

No. searchVIUbot blocks over 300 known tracking, analytics and advertising addresses before a request goes out.

Next steps

searchVIUbotUser agents, robots.txt rules and crawl speed in detail.Getting started in your projectWhere to find what after you first sign in.Guide: bot protection and SEOHow your bot protection lets customers, Googlebot and AI bots through.

Still have a question? Email us at info@searchviu.com or read on the SEO Crawler page what searchVIU does with the crawl data.