Which user-agent strings identify Qualys?

The following user-agent strings identify Qualys: cf-qualys-scanner.

Does Qualys respect robots.txt rules?

According to official documentation, Qualys does not respect robots.txt rules.

How can I verify Qualys traffic with live traffic data?

You can verify Qualys requests by checking your server access logs for the documented user-agent strings. For accurate verification, correlate user-agent patterns with IP ranges or verification methods provided by Qualys.

What is Qualys?

Direct Answer: Qualys bot, operated by Qualys, crawls and tests web applications for vulnerabilities.

Operator: Qualys Type: Security Scanner Purpose: Vulnerability scanning and web application security testing

The Qualys Web Application Scanner is a cloud-based service that provides automated crawling and testing of custom web applications to identify vulnerabilities including cross-site scripting (XSS) and SQL injection.

User-Agent Identification

The following user-agent strings identify Qualys in your live traffic data:

cf-qualys-scanner

robots.txt Rules for Qualys

Respects robots.txt: No

Use the following robots.txt rules to control Qualys access:

# Block Qualys
User-agent: cf-qualys-scanner
Disallow: /

# Allow Qualys
User-agent: cf-qualys-scanner
Allow: /

This bot does not commit to following robots.txt

Qualys does not officially follow robots.txt directives. The only reliable way to control access is through server-side blocking (IP filtering, user-agent rules in your web server config) combined with log monitoring to verify effectiveness.

Need continuous verification across 500+ bots? Can AI See It automates this.

Crawl Behavior

Frequency:Not Documented

Request Pattern:Not Documented

Crawl Activity Index

Relative crawl activity for Qualys over the past 28 days. Higher values indicate increased crawling intensity compared to the period baseline.

View recent activity data (last 7 days)

Date	Activity Index
Mar 26, 2026	88.0
Mar 27, 2026	82.7
Mar 28, 2026	83.1
Mar 29, 2026	81.8
Mar 30, 2026	87.3
Mar 31, 2026	90.2
Apr 1, 2026	88.9

Source: Cloudflare Radar

Why track Qualys traffic?

Identify and classify unknown crawler activity. Qualys may appear in your live traffic data with varying frequency. Tracking its behavior helps you decide whether to allow, throttle, or block it based on actual data.

Protect your crawl budget. Every bot request consumes server resources. Understanding what Qualys crawls helps you prioritize the crawlers that matter.

Log Verification

To verify Qualys traffic in your live traffic data:

Search access logs for the user-agent strings listed above
Check if the IP addresses match documented ranges (if provided by Qualys)
Verify the crawl pattern matches documented behavior
Use reverse DNS lookup for additional verification if available

Note: Observed behavior in production environments may differ from official documentation. Live traffic monitoring provides the only reliable verification of actual bot behavior.

Undocumented Information

The following information is not officially documented for Qualys:

crawl frequency
request pattern
IP verification
JavaScript rendering

Official Documentation

View Official Qualys Documentation →

Information sourced from official documentation. Content generated with AI assistance.