CurveballAuditBot.

The checker behind Curveball's website audits.

What it is

When someone asks Curveball to check a website, this bot reads it the way a search engine would. It identifies itself as CurveballAuditBot/0.1 (+https://www.curveballcreativestudio.com/bot). It only runs when a person asks for a check. It never crawls on a schedule.

What it reads

Public pages only: robots.txt, the sitemap, the homepage and up to 50 pages linked from it or listed in the sitemap. It also asks public services a few questions about the domain: its email settings in DNS, its security certificate, its registration date and Google's page speed test.

What it never does

It never fills in forms, never logs in, never looks for weak spots and never reads pages your robots.txt asks it to skip. It sends at most four requests at a time, a quarter of a second apart per site, and stops reading any page after 2MB.

How to block it

Add this to your robots.txt and it will leave your site alone:

User-agent: CurveballAuditBot
Disallow: /

Questions

If it did something it shouldn't have, email Troy.

Last updated September 2026.