Our reader
Bondstone's reader
If you found Bondstone in your server's logs, this is what it is, what it asked your site for, and how to stop it.
What it is
Bondstone reads what office businesses in UK cities publish about their own email and certificates, and gives the IT support firms near them a ranked list, with the fix for each finding. Every request it makes says who is asking:
Bondstone/0.1 (+https://bondstone.app/bot; mailto:[email protected])
What it asks for
- The domain's public DNS. Its A, AAAA, MX, NS, CAA and TXT records, the TXT record at _dmarc, DKIM keys at 16 common selector names, and its MTA-STS, TLS reporting and BIMI records. One question also goes to Cloudflare's public resolver, to see whether the domain signs its DNS.
- The certificate the domain presents in one TLS handshake on port 443: subject, issuer and expiry.
- The home page, over https:// and over http:// (to see whether a visitor is moved to https://), and once more as a request from another site, to read the headers it answers with. Its response headers and the cookies it sets are read from these.
- Up to six more of its own pages, to find a phone number, a postal address, a contact mailbox and a company number: first the pages the home page links to about contact, about or team, then these common addresses, whether or not the site links them: /contact /contact-us /contactus /contact.html /contact-us.html /about /about-us /aboutus /about.html /team /our-team /staff /people /leadership /locations /location /find-us /get-in-touch /enquiries /reach-us /impressum /legal /imprint.
- Its privacy, terms, cookie and data processing pages, where the home page links them.
- Its robots.txt, sitemap.xml and llms.txt. Whether each is there, and what it says.
- Its careers page, the one the home page links to, or /careers when it links none, and up to two public job boards that page or the home page links to.
- The domain's registration record, from the public RDAP service.
Every page request keeps to robots.txt: a path it closes to Bondstone, or to every crawler, is not fetched. robots.txt itself, the sitemap, llms.txt, the registration record and a job board are asked for directly. Each request says who is asking, and this page says how to stop it. No port is scanned, no file a site keeps private is asked for, no form is submitted, and nothing is logged into.
How to stop it
Add these two lines to your robots.txt. No page of your site is fetched once the file is next read, which is within six hours.
User-agent: Bondstone Disallow: /
Your public DNS records and the certificate your site presents are public records, and robots.txt does not cover them. To be left out of everything, including every IT firm's pack, write to us and your business goes on our do-not-contact list, for every channel.
Who to write to
[email protected]. A person answers on a weekday morning, UK time: the same morning, or the next one if you write after midday. The method says what is kept from each read and for how long it counts.