The RightBlogger Bot

RightBlogger makes requests only for websites a customer has added to their own RightBlogger account. Some requests read, publish, or update content through an authorized CMS connection. Site Scan separately crawls public pages on the project's website to build private, searchable knowledge. RightBlogger does not roam the open web or collect website content for model training.

How to identify it

  • Connected CMS requests: RightBlogger/1.0 (https://rightblogger.com)
  • Site Scan: discovery requests use CloudflareBrowserRenderingCrawler/1.0. Page-indexing requests use Mozilla/5.0 (compatible; RightBloggerScan/1.0; +https://rightblogger.com).
  • Link exchange checks: Mozilla/5.0 (compatible; RightBloggerExchangeVerify/1.0; +https://rightblogger.com)
  • Web Bot Auth signatures: connected CMS requests are signed with an Ed25519 key (IETF HTTP Message Signatures), carrying Signature, Signature-Input (tag web-bot-auth), and Signature-Agent: "https://rightblogger.com" headers.
  • Public key directory: https://rightblogger.com/.well-known/http-message-signatures-directory

What it does

  • Publishes and updates posts on a site the user connected (e.g. via the RightBlogger WordPress plugin or a WordPress, Ghost, or Webflow integration).
  • Reads existing posts, authors, and taxonomies on connected sites to format content correctly.
  • Crawls public pages when a customer starts Site Scan for one of their projects.
  • Checks the health of a connection so the user knows publishing is working.

Connected CMS requests require a connection key or credential the site owner generated. Site Scan does not use CMS credentials; it only reads public pages from the primary website on a customer's project. Requests are tied to user actions and scheduled refreshes.

Why you might see it

You, or someone on your team, connected this website to RightBlogger and asked it to publish or manage content. If you believe a connection was made in error, you can disconnect the site from inside your RightBlogger account, or revoke the plugin connection key.

How to allow it

If your firewall is blocking RightBlogger, publishing to your own site will fail. To allow it:

  • Cloudflare: Create a custom WAF rule that matches the relevant exact User-Agent above, then use Cloudflare's Skip action only for the security features blocking it. RightBlogger has submitted for Cloudflare verified-bot status but is not listed as verified yet, so do not match on cf.bot_management.verified_bot.
  • Other WAFs / security plugins: allow the exact User-Agent for the RightBlogger action that is failing.

A User-Agent can be copied, so treat it as a routing signal rather than proof by itself. For connected CMS traffic, the signed headers above provide stronger verification.

Contact

Questions about the RightBlogger bot? Email contact@rightblogger.com.