MerchantSecurityScanner
recommended: allowMerchantSecurityScanner scans Stripe merchant websites for common security vulnerabilities, including exposed credentials and unprotected administrative pages. Stripe uses the findings to notify affected merchants and protect compromised accounts.
What it does
MerchantSecurityScanner's cadence depends on how the scan is configured. Continuous monitoring may run daily or hourly, while a one-time or internet-wide scan may sweep once and disappear.
How to identify it
User-agent contains any of:
MerchantSecurityScanner
robots.txt
Well-behaved crawlers honor robots.txt. To control MerchantSecurityScanner:
Allow full access
User-agent: MerchantSecurityScanner
Allow: /Block entirely
User-agent: MerchantSecurityScanner
Disallow: /
Grey-area scrapers ignore robots.txt. Botscope enforces your policy at the edge or origin regardless —
see how →
See MerchantSecurityScanner on your own site
Botscope shows every bot and AI agent hitting your site — and lets you allow, challenge, or block each one. Observe first, enforce when you're ready.
Start free — connect in minutes