For the complete documentation index, see llms.txt. This page is also available as Markdown.

Allowing Flip.to Scout

Meet Scout — Flip.to's friendly watchdog. Scout automatically loads your website and confirms your Flip.to integration (the Discovery component, tracking script, and booking links) is installed and working. If something breaks, Scout lets our team know so we can help you fix it quickly.

Scout, the Flip.to integration watchdog

How to identify Scout

Scout identifies itself in two ways — match on either, and ideally pair them (see the security note below).

Scout sniffing out the integration
1

A User-Agent token

Every request Scout makes includes FliptoScout in its User-Agent string:

Mozilla/5.0 (...) Chrome/... Safari/537.36 FliptoScout/1.0 (+https://www.flip.to/scout)

Match on the FliptoScout token — the Chrome version changes over time, so don't match the whole string.

2

A signed request identity

Scout runs on Cloudflare's browser platform, which automatically attaches a cryptographically signed Web Bot Auth identity to every request (Signature / Signature-Agent headers). Unlike a User-Agent, this signature cannot be spoofed — so it's the most secure way to recognize Scout.

For your security team: pair the FliptoScout User-Agent match with a source check (Scout's signed Web Bot Auth identity, or your provider's verified-bot category) rather than matching the User-Agent alone — a User-Agent on its own can be spoofed.

Do not allow by IP address. Scout runs on Cloudflare's shared browser platform and its egress IPs are not stable.

Allow Scout through your bot protection

Pick your provider below. In every case, the goal is the same: let requests whose User-Agent contains FliptoScout reach your site.

How you allow Scout depends on which Cloudflare bot product you use:

  • Bot Fight Mode (free plans) — Bot Fight Mode does not honor WAF skip/allow rules, so a User-Agent rule will not work. Either turn Bot Fight Mode off for your site, or upgrade to a plan with Super Bot Fight Mode / Bot Management.

  • Super Bot Fight Mode (Pro/Business) and Bot Management (Enterprise) — Add a WAF custom rule:

    1. Go to Security → WAF → Custom rules → Create rule.

    2. Set the field to User Agent, operator contains, value FliptoScout.

    3. Set the action to Skip → All remaining custom rules (and Skip → Super Bot Fight Mode).

Because Scout sends a signed Web Bot Auth identity, you can also allow it as verified bot traffic for the strongest protection.

After you've allowed Scout

That's it — there's nothing else you need to do. Scout re-runs automatically on its regular schedule, so once your rule is in place, its next visit should reach your live site and the integration check will clear on its own.

Scout, happy to be let through

Need a hand, or want us to confirm Scout is getting through? Reach out to your Flip.to contact and we'll verify it together. 🐾

Last updated