TapplyBot
If you found TapplyBot in your server logs, someone entered your website into the free app readiness check on tapply.tech. Here’s what it did and how to stop it.
How to recognise it
Every request carries this user agent:
TapplyBot/1.0 (+https://tapply.tech/bot)
Requests come from our hosting provider’s servers in Frankfurt. We don’t publish a fixed IP range, so please match on the user agent.
When it visits
Only when a person types your address into the check on tapply.tech. It doesn’t crawl the web on its own, follow links to other pages or come back on a schedule.
What it fetches
One check makes about ten small requests:
| What | Why |
|---|---|
| Your homepage, or the page that was entered | Title, description, icon, colors, mobile viewport, platform |
| /manifest.json or the linked web app manifest | App name, icons and display mode |
| /robots.txt and /sitemap.xml | A rough idea of the site’s size |
| /.well-known/apple-app-site-association | Whether an iOS app already exists |
| /.well-known/assetlinks.json | Whether an Android app already exists |
| /sw.js or /service-worker.js | Whether the site works offline |
| Your largest icon | To show it on the phone in the report |
It follows at most 5 redirects, gives up after 6 seconds and reads no more than 2 MB of the homepage. It doesn’t run JavaScript, log in, fill in forms or download anything else.
How often
Results are cached for 24 hours, so your site is checked at most once a day, however many people enter it. Each visitor can only run a few checks a minute, and the checker as a whole is rate limited too.
Opting out
Email hello@tapply.tech from an address at your domain, or tell us how you’re connected to the site, and we’ll add it to our blocklist, usually within one business day. After that, the check won’t fetch anything from it. You can also block the user agent above on your server.
What happens to the data
We store what the check found together with the request, and our team may review it by hand. Details are in our privacy policy.