Last updated September 30, 2026
The TestRuna bot: a real browser testing web apps
testruna/0.1 (+https://testruna.com/bot) at the end of a user agent in your logs, a person asked TestRuna to test a web app on your site. This page explains what the TestRuna bot does, how much it loads and how to stop it.What the TestRuna bot is
TestRuna tests web apps for the people who build them, often with AI app builders. It uses a real Chrome browser and says so: the tag above is appended to the browser's own headless Chrome user agent, and we never hide or rotate it. Every visit is started by a signed-in TestRuna user for an address they typed in. Our terms only allow testing apps the user owns or is authorized to test.
How to recognize a visit
A full user agent looks like this; the version number changes as we update the browser:
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/153.0.0.0 Safari/537.36 testruna/0.1 (+https://testruna.com/bot)The browsers run on cloud servers in the eastern United States. Their addresses change, so match the testruna tag in the user agent rather than an IP range. Visits come in bursts of a few minutes when someone runs a scan or a test, not as a steady crawl. If the person testing added a test account, the bot signs in with it like any other user, so its activity also shows up under that account in your own app.
What it does on your site
- Scanning: it opens the address it was given and follows links on the same site, up to 20 pages, one page at a time.
- Testing: it runs up to three tests at once. A test clicks, types test data and reads the result. Tests that submit forms which create or change data only run when the person testing has said the site is a test or staging site.
- Your analytics stay clean: it does not send requests to common analytics and tracking services, so it will not show up as visitors in your statistics.
- It never tries to get past puzzles or other anti-bot checks, never guesses passwords and only signs in with a test account the person testing gave it. It does not leave the site it was pointed at.
How much traffic to expect
A scan loads each page the way a visitor's browser would, with its images, scripts and styles, so twenty pages mean twenty page views plus their assets. A test run repeats the steps of each test, three at a time, and most runs finish within a few minutes. Replays of recorded tests make the same requests again. A run of 20 tests on a small app usually means twenty short sessions that each open a few pages. Nothing runs on a schedule of ours: every run is started by the person testing, from the TestRuna workspace, their coding agent or their own CI after a deploy.
What the TestRuna bot keeps about your site
Screenshots, page text and the steps of each test are stored for the user who started them, so they can see the results: 30 days on the Free plan, 90 days on Pro, and the latest result of each test until they delete the app. Page text and screenshots are sent to AI models only through providers that keep no copy and do not train on them. Nothing is published, indexed or shown to other users. The privacy policy has the details.
Why it does not read robots.txt
It is not a crawler: it does not index anything or build a search engine, and each visit is a person testing a specific app, much like opening it in their own browser. To stop it, use one of the options below.
How to block the TestRuna bot
- Tell us. If you own the site and did not authorize the testing, email support@testruna.com with the domain. We block it for every TestRuna user, usually within a day, and look into the account that tested it.
- Block it yourself. Reject requests whose user agent contains
testrunain your firewall, CDN or server configuration. Some examples:
| Where | Rule |
|---|---|
| Cloudflare (Security › WAF › Custom rules, action Block) | (http.user_agent contains "testruna") |
| nginx (inside the server block) | if ($http_user_agent ~* "testruna") { return 403; } |
| Apache (.htaccess) | RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} testruna [NC]
RewriteRule .* - [F,L] |
Testing your own site behind bot protection
If you use TestRuna on a site you own that sits behind Cloudflare or another bot shield, the TestRuna bot may be stopped at the first page: settings such as Cloudflare's Bot Fight Mode often challenge headless browsers. Allow it only where you need it: add a rule that skips the check for requests whose user agent contains testruna, ideally on a staging hostname, and remove it when you are done. Anyone can copy a user agent, so do not rely on it to protect pages that must stay private.
TestRuna bot questions
Is the TestRuna bot a security scanner?
No. It uses an app the way a visitor would, clicking and typing through its features to check that they work. It does not probe for vulnerabilities, send attack payloads or try to get around access controls, and our terms forbid anyone from using it that way.
Can it create accounts or orders on my site?
Only when the person testing has allowed data changes for that app, which our terms reserve for sites they own, ideally a test or staging copy. Deleting, paying and sending messages to people never run on their own.
Who started the visit?
A signed-in TestRuna user who typed in your address. We do not publish who that is, but if you did not authorize the testing, write to support@testruna.com and we will look into the account and block your domain for every user.
How is the TestRuna bot different from a search engine crawler?
A crawler visits on its own schedule to index pages for search. The TestRuna bot only visits when a person asks it to test a specific app, loads at most 20 pages for a scan, and keeps what it sees private to that person. It never adds your pages to a search index.
Does it run JavaScript?
Yes. It is a full browser, so it runs your scripts, loads your fonts and images and renders pages as Chrome would. That is why it sees the same bugs your visitors do, and why it also makes the background requests, such as API calls, that your pages make when they load.
Does it keep cookies from my site?
Only for the length of a run. Every run starts with an empty browser, and the cookies and storage your site sets are thrown away when it ends, including the session of any test account it signed in with.