About FormExposedBot

Last updated: 16 October 2026

User-agent: FormExposedBot/1.0 (+https://formexposed.com/bot)
Token in robots.txt: FormExposedBot

What FormExposedBot is

FormExposedBot is the crawler of formexposed. formexposed checks whether contact forms are protected against automated spam and work reliably. If you have found this user-agent in your server logs, someone has started a check of your website:

• a visitor to formexposed who entered your domain in the free check – without an account, read-only;
• a customer who has your domain in their account and states that they run or look after the website, or someone who has installed our plugin on your website;
• an agency that has your website checked, read-only, as a potential client;
• we ourselves, for a study from which we publish only aggregated figures without the names of websites;
• someone who entered your home page in our free header check (headers only, without a browser).

On request, we will tell you which of these types a check was; who started it, only to the extent that data protection law permits. In doing so, we act at the instigation of that person; for domains for which a customer has provided proof of control, on that customer’s behalf.

What happens during a check

• Before the check, the bot reads your robots.txt (see below).
• It loads your home page and up to seven further pages on the same host (with or without www., no other subdomains), at most eight in total. Pages with words such as contact, imprint or support come first. It skips login, account, basket and checkout pages, feeds, PDFs and images.
• It uses a real headless browser with JavaScript enabled and loads the pages one after another, not in parallel. A page may take at most 20 seconds; after about three minutes the check stops.
• It reads the forms: field names and types, labels, required fields, embedded CAPTCHAs, hidden traps, tokens and headers. During this read-only check, it does not enter anything.
• For at most three pages with a form, it loads the page a second time and clicks “Reject” in the cookie banner – never “Accept”. This shows us whether the form still works after a rejection.
• For at most three pages with a form, it loads the page in a phone view, without clicking. The user-agent stays the same; we do not pretend to be a smartphone.
• It determines the type of a form with rules and, where they are not enough, with a language model running on our own server. Nothing leaves our servers in the process.

Without proof of control over the domain (below), FormExposedBot fetches only pages that are publicly accessible without logging in, and submits nothing. It does not circumvent any access protection, does not guess login credentials and does not solve CAPTCHAs. Anything beyond that – test submissions, the search for exposed files and the check behind a login with a test account – takes place only for domains with this proof or for formexposed’s own test and demo domains.

Via the free check on our website, we check the same domain at most once every seven days; anyone who enters it again sees the existing report. Customers can have the domains in their account checked by hand, with a waiting time; domains with proof of control are also checked regularly at the frequency of their plan, a full check at most once a day. The light requests made without a browser (below) come more often.

Test submissions only for verified domains

For customers, something is submitted only if a customer has proven that they are entitled to control the domain (DNS record, meta tag, file or plugin); without this proof, we actively check only our own test and demo domains. Even then:

• only one form per check, and only one that has been reliably identified as a general contact form; the language model can never release a form for submission;
• at most five submissions per check, for example without a CAPTCHA response, with the trap field filled in or with an altered token;
• never order, booking, login, registration, newsletter, support, payment or upload forms, never forms with required fields for telephone, postal address or company details, never websites that we recognise from the domain or page title as a public authority, court, university, school or healthcare institution.

The bot recognises the form type and the type of website from features of the page; in individual cases, this recognition may be wrong. The list describes how the bot is built and is not a guarantee. If you do not want test submissions, exclude the domain (below): no check in which anything could be submitted will then start.

Every submission is labelled. Sender name “FormExposed Security Scanner”, sender address dummy@formexposed.com, subject “[formexposed.com] Automated security test — no action required”. The text is in the language of your page (German, English or Polish); in English:

This message was sent by an automated testing service to check whether this form sends e-mail without bot protection. No data was stored and no action is required.
Details: https://formexposed.com/bot
Permanently exclude this domain: https://formexposed.com/opt-out
Scan ID: …

The sentence “No data was stored” is too broad. What is correct: we store nothing from your visitors or from your mailbox in the process. To evaluate the test, however, we do store your server’s response to the submission, namely the status code, the first 300 characters of the response page and a screenshot of it (see “What is stored”).

The bot fills in other required fields with “FormExposed security test”. It ticks checkboxes without which the form cannot be submitted, for example for consent. The labelling shows that there is no person and no declaration by a person behind it.

The header injection check inserts only a harmless header X-FormExposed-Injection-Test, never a recipient. The address validation check uses an address under .invalid, which cannot exist.

Further requests for customers

For verified domains in a customer account, the following are added at the customer’s request:

• Browser journeys: A browser (Chromium or WebKit) opens a form page chosen by the customer at phone size and checks whether the form appears and can be operated up to the submit button; to do so, it fills in required fields with test values that do not leave the browser. It sends only GET and HEAD requests; submitting is technically blocked.
• Scan behind the login: only with a test account that the website operator has created themselves, at most five pages, without submitting, without screenshots, never logout, deletion or cancellation addresses. If the login carries a CAPTCHA, the bot stops.
• Light requests without a browser: form pulse (up to three form pages, every 10, 15 or 30 minutes depending on the plan), check of the proof of control, header check and search for exposed files. They use the same user-agent with a suffix such as pulse, ownership-verification, headers or exposed-files.

In addition, anyone can have the headers of your home page fetched with our free header check: one request each via https and http to your home page, plus any redirects within your domain, without a browser and without a form.

What is stored

Only what describes the finding: addresses and titles of the pages checked, the structure of the forms (field names, types, labels and the like, no field values; the beginnings of pre-filled hidden fields up to 24 characters and of data- attributes up to 60 characters are read by the bot only during the check and are not stored), protection measures detected, headers, the hosts of embedded services, checksums of the scripts (not their content; for embedded scripts, also the first 80 characters, with identifiers made unrecognisable), the names of cookies set, screenshots of the visible area of the home page and of the forms and, after a test submission, of the response page; of that response, also the status code and the first 300 characters. These screenshots from the check are not redacted; they show what can be seen on the public page. Only browser journeys produce a small image of the form with the input fields covered. If a form contains a recipient address, we store only its domain.

Where the requests come from

FormExposedBot runs on our own servers in Poland. We do not publish the IP addresses because they can change. If you want to know whether a request really came from us, write to us with the time and IP address from your log; we will tell you whether it came from us. For the cross-check before an outage alert, a second location with another provider may be added; it too uses the FormExposedBot user-agent.

How to exclude your domain

robots.txt:

User-agent: FormExposedBot
Disallow: /

The bot first looks in your robots.txt for a group for FormExposedBot, otherwise for the group for all (*). If a Disallow covers the home page, no check takes place. If your server responds to the request for robots.txt with a server error or not at all, we also do not check, as a precaution; if the file is missing (404), the website is treated as allowed. We currently do not evaluate individual blocked subdirectories separately – if you do not want to be checked at all, block the home page. The light requests without a browser and the header check do not read robots.txt.

Opt-out: Enter your domain on the page Exclude your domain. It applies to the domain and its www. variant, not to other subdomains. It takes effect for every check that starts after the entry, permanently, also against paying customers with a verified domain, and also covers the header check. Ongoing monitoring in a customer account ends with the next check that is due; until then, light requests such as the form pulse may still come. If you want these to end sooner as well, write to us.

Data protection

The controller is LW IT Solutions Company Lukas Wójcik, al. Tadeusza Kościuszki 80/82, lok. 301, 90-437 Łódź, Poland, contact@lukaswojcik.com. When a customer checks their own domain, we act on their behalf.

• Data and source: We collect personal data only to the extent that it appears on the checked pages of your website and becomes visible in a page address, a page title, a form label or a screenshot, such as a name in the imprint or next to the form. The source is your website. We do not search for such data.
• Purpose and legal basis: security checks of forms; for the free check, the prospect check and the study, on the basis of our legitimate interest and the interest of our users (Art. 6(1)(f) GDPR).
• Recipients: whoever started the report or holds the link to it – the link opens the report without logging in; for domains in a customer account, also the alert destinations the customer has chosen; from the study, only totals. No external AI service is involved.
• Storage period: report without an account 30 days, prospect check 90 days, checks in a customer account up to 13 months, the most recent result for each domain for as long as the domain exists, study until publication.
• Your rights: access, rectification, erasure, restriction and objection under Art. 21 GDPR – fastest via the opt-out – and the right to lodge a complaint with a supervisory authority, for us the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) in Warsaw.

Everything else is in the Privacy Policy. How we deal with misuse is set out in Acceptable Use and Abuse.

Contact

Questions or complaints: contact@lukaswojcik.com or via the contact page. Please state your domain and, if available, the scan ID or the report link. Please report security vulnerabilities in formexposed itself via our vulnerability reporting page.