The Skiplink bot

You have found this because Skiplink/1.0 appeared in your logs. Here is what it is, in the order you probably want it.

What it was doing

Somebody asked us to check a page on your site for accessibility problems. We loaded it once in a headless Chromium, ran the open-source axe-core engine against the rendered markup, and returned a list of findings to whoever asked.

It is not a crawler. It does not follow links, it does not spider, and it does not come back on its own — unless someone configured a scheduled monitor, in which case it is once a day or once a week for that specific URL and nothing else.

How to identify it

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/131.0.0.0 Safari/537.36 Skiplink/1.0 (+https://skiplink.dev/bot)

It presents as Chrome because it is Chrome — accessibility results depend on how a real browser lays the page out, so pretending otherwise would change the answer. The Skiplink/1.0 token is the part to match on.

Blocking it

Match Skiplink/1.0 in your user agent rules and return whatever you like. We do not rotate the token to evade blocks, and we will not.

It respects a Disallow for its own token in robots.txt. It does not currently treat a general User-agent: * block as a refusal, on the reasoning that a site owner scanning their own staging site should not have to edit robots.txt to do it — but if that reasoning does not hold for you, block the token and it will stop.

The load it puts on you

One page load per scan, with a hard timeout, a response size cap and no repeat requests. It is one visitor with an empty cache, not a crawl.

If you are seeing volume that does not match that, something is wrong or somebody is abusing the service. Either way we want to know.

If it is unwanted

Using Skiplink against a site you are not authorised to scan breaks our acceptable use policy, and it is the one thing we suspend accounts for without waiting to hear back.

Email hi@skiplink.dev with the timestamps and the requested paths from your logs. We can identify which account made the request and stop it. Please do send this — the person being scanned is not a party to any agreement with us, and you are the only one who can tell us it is happening.