KlotiBot
KlotiBot is the reader that Kloti uses to look at a website when somebody asks it to. This page is for site operators: what it is, when it visits, how to recognise it, and how to stop it.
What it does, and when
Kloti helps somebody make a post about their own work. When a person signs in and gives us the address of a website, KlotiBot fetches that one page so Kloti can learn what the place does and how it describes itself. Nothing is written from a link nobody read.
It is directed by a person, one page at a time. It is not a crawler: it does not follow links, it does not walk a site, and it does not go looking for addresses nobody gave it.
- One page per website. The home page, or whichever address was given.
- Up to two stylesheets from that page, to read the colours and typefaces the site already uses.
- Once. The reading is kept, so a visit is not repeated on every use. A failed reading is retried after ten minutes, and a person can ask for a fresh read.
- Bounded. Twelve seconds, two megabytes, at most five redirects.
We do not read social media, we do not collect email addresses, and nothing fetched here is used to train a model.
How to recognise it
Two ways, and the second is the one to trust.
- The user agent
- Every request carries this string, and it does not change:
KlotiBot/1.0 (+https://kloti.co/klotibot)
- A signature
- Every request is signed with an Ed25519 key using HTTP Message Signatures, tagged
web-bot-auth. A user agent is a claim anybody can copy. A signature is not.
The public half of that key is published here, and the request points at it in its
Signature-Agent header:
https://kloti.co/.well-known/http-message-signatures-directory
The signature covers the authority of the site being asked, so it is bound to that request and cannot be replayed against anybody else.
How to stop it
Say so in your robots.txt and KlotiBot will not read your site:
User-agent: KlotiBot Disallow: /
That is the whole of it. We do not work around a refusal: we do not solve challenges, we do not disguise the request as a browser, and we do not route around a block. If your site says no, the person who asked us is told plainly that we could not read it, and Kloti writes their post from what they gave it instead.
Who runs it
Kloti, at kloti.co. If KlotiBot has done something you did not expect, or you want it kept away from a site for any reason at all, write to us at kloti.co/support and we will sort it out.