On this page
In short
- GaldrikBot is the web reader of Galdrik, a customer-support workspace for small businesses.
- It visits a website only after a business using Galdrik adds that website as a source for its assistant; it never crawls the open web on its own.
- It reads public pages only. It respects robots.txt, never logs in and never fills in forms.
- The only exception: a business that has proved it owns a website can explicitly ask us to read pages that its own robots.txt blocks. We check that proof again before every visit to those pages.
- Every request it sends carries a cryptographic signature, so a firewall that supports it can tell the real GaldrikBot from an impostor. Cloudflare has approved GaldrikBot as a verified bot.
- To block it, add two lines to your robots.txt (shown below). To ask us to stop, write to us.
What GaldrikBot is
Businesses use Galdrik to answer their customers on WhatsApp and other channels. To answer with the right prices, policies and opening details, a business can ask us to read its own website. GaldrikBot is the program that does that reading.
It identifies itself with this User-Agent: GaldrikBot/1.0 (+https://galdrik.com/bot).
When it visits
- When a business adds a website address in Galdrik as a source for its assistant. A business can confirm that the website is its own, which unlocks extra features; unconfirmed websites are read the same way but their text is only used to suggest facts for review.
- Again on the schedule that business chooses (every week, every month or only when they ask), to keep the facts up to date.
- Never on its own initiative: it does not crawl the web, and it never follows links to other websites.
It reads a few pages at a time, waits between requests and obeys the Crawl-delay of your robots.txt, up to 3 minutes between requests. If you ask for a longer delay, GaldrikBot treats that as a request not to read your website at all: it never reads faster than you ask. If a website answers that it is busy (HTTP 429 or 503), GaldrikBot slows down, waits as long as the website says and tries again later. The number of pages it reads is capped by the business’s plan.
What it reads
- The visible text of public pages, the sitemap and robots.txt.
- Not pages behind a login, not forms, not comments or reviews left by visitors, and not text hidden from people.
What it reads becomes suggestions that a person at the business reviews before their assistant uses anything. Text that looks like instructions to an AI is ignored and reported to that business.
How to block it
Add these two lines to the robots.txt file at the root of your website. GaldrikBot checks robots.txt before every visit, so the change applies from its next visit.
User-agent: GaldrikBot
Disallow: /How to tell it is really us
Anyone can copy a User-Agent, so every request GaldrikBot sends is also signed with a private key that only Galdrik holds (the Web Bot Auth standard, built on HTTP Message Signatures, RFC 9421). The request names where the matching public key is published, and a firewall or web server that understands the standard can check the signature.
The public key is at galdrik.com/.well-known/http-message-signatures-directory. A signature proves who is asking; it does not give GaldrikBot any extra access, and it still follows robots.txt. Cloudflare lists GaldrikBot in its directory of verified bots.
If your firewall blocks it
Some websites answer GaldrikBot with «Sorry, you have been blocked» (an HTTP 403 page from a firewall or bot-protection service such as Cloudflare). GaldrikBot never tries to get around that: it says so to the business that added the website. If you want it to read your site, allow it:
- If your firewall can allow bots by their signature (for example Cloudflare’s verified bots and signed agents), use that: it is the most reliable rule, because a signature cannot be copied.
- Otherwise, in your firewall, add a rule that allows requests whose User-Agent contains GaldrikBot (in Cloudflare: Security → WAF → Custom rules → action Skip, or add it to your allowed bots).
- If your firewall can allow by source address, write to us and we will send the address GaldrikBot currently visits from; that is stricter than the User-Agent, which anyone can copy.
- Or add your pages as documents instead (save them as PDF from your browser): nothing needs to be unblocked for that.
The one exception to robots.txt
We respect robots.txt. There is one exception: when a business using Galdrik has proved that it owns a website, it can explicitly ask us to read pages that its own robots.txt blocks. It chooses this itself, on a screen where it sees which pages are affected, and it can turn any page, or the whole choice, off at any time.
We confirm that the website is still verified before every visit to those pages. If the proof lapses, we stop reading them. Without that explicit request, a page blocked by robots.txt is never read.
Ask us to stop
If GaldrikBot is reading a website you own and you did not ask for it, write to [email protected] with the website address. We stop reading it and delete the pages we stored from it.
How we handle personal information is described in our privacy policy.
Last updated October 13, 2026.