Allowing Flip.to Scout
Meet Scout — Flip.to's friendly watchdog. Scout automatically loads your website and confirms your Flip.to integration (the Discovery component, tracking script, and booking links) is installed and working. If something breaks, Scout lets our team know so we can help you fix it quickly.
Scout is read-only and safe. It loads your pages the way a normal browser would. It never logs in, submits forms, makes bookings, or changes anything on your site.
Seeing this page because your bot protection is blocking Scout?
When a website firewall or bot-protection service (Cloudflare, Akamai, DataDome, Imperva, and similar) serves Scout a "challenge" or block page instead of your real site, Scout can't verify your integration. That produces false "integration missing" results on our side — and means you won't get a real alert if your integration actually breaks. Allowing Scout through fixes this.
How to identify Scout
Scout identifies itself in two ways — match on either, and ideally pair them (see the security note below).
A signed request identity
Scout runs on Cloudflare's browser platform, which automatically attaches a cryptographically signed Web Bot Auth identity to every request (Signature / Signature-Agent headers). Unlike a User-Agent, this signature cannot be spoofed — so it's the most secure way to recognize Scout.
For your security team: pair the FliptoScout User-Agent match with a source check (Scout's signed Web Bot Auth identity, or your provider's verified-bot category) rather than matching the User-Agent alone — a User-Agent on its own can be spoofed.
Do not allow by IP address. Scout runs on Cloudflare's shared browser platform and its egress IPs are not stable.
Allow Scout through your bot protection
Pick your provider below. In every case, the goal is the same: let requests whose User-Agent contains FliptoScout reach your site.
How you allow Scout depends on which Cloudflare bot product you use:
Bot Fight Mode (free plans) — Bot Fight Mode does not honor WAF skip/allow rules, so a User-Agent rule will not work. Either turn Bot Fight Mode off for your site, or upgrade to a plan with Super Bot Fight Mode / Bot Management.
Super Bot Fight Mode (Pro/Business) and Bot Management (Enterprise) — Add a WAF custom rule:
Go to Security → WAF → Custom rules → Create rule.
Set the field to User Agent, operator contains, value
FliptoScout.Set the action to Skip → All remaining custom rules (and Skip → Super Bot Fight Mode).
Because Scout sends a signed Web Bot Auth identity, you can also allow it as verified bot traffic for the strongest protection.
In your bot management / Bot Manager policy, add an allow (exception) rule that matches the User-Agent containing FliptoScout, so requests from Scout bypass bot mitigation.
In the DataDome dashboard, add a custom rule / allowlist entry matching the User-Agent containing FliptoScout, and set it to Allow.
In your Imperva (Incapsula) site security settings, add a Bot Access Control / allowlist exception for the User-Agent containing FliptoScout.
Any WAF or origin firewall that lets you write rules on the request User-Agent can allow Scout the same way: permit requests whose User-Agent contains FliptoScout.
After you've allowed Scout
That's it — there's nothing else you need to do. Scout re-runs automatically on its regular schedule, so once your rule is in place, its next visit should reach your live site and the integration check will clear on its own.
Need a hand, or want us to confirm Scout is getting through? Reach out to your Flip.to contact and we'll verify it together. 🐾
Last updated