AIPAxBot

AIPA is a patient assistant used by UK community pharmacies. A pharmacy signs up, we read their published website once, and the assistant then answers patient questions using that content instead of guessing. AIPAxBot is the reader that does that.

It is not a search engine crawler and it is not collecting data to sell. It only ever reads the site of a pharmacy that has asked us to.

• Only pages that are already published and visible to any visitor. Opening hours, services, branch pages, about and contact pages, policies.
• It finds those pages from the site's own sitemap and from the links on the site's own pages. It also tries a short list of conventional addresses such as/our-branches/in case a branch list is not linked from the home page.
• If a page will not load normally and the site runs WordPress, it asks the site's own public WordPress API for the same page, at/wp-json/. Same page, same published content, read a different way.
• Before the assistant gives a patient a link to one of the pharmacy's pages, it checks the page is still there, so nobody is sent to a dead link. That is one request for the page's headers, cached for several hours.
• It never signs in, never submits a form, never buys anything and never follows links off the pharmacy's own domain.
• It makes ordinary GET requests, a handful at a time, and a whole site is normally finished in a few minutes. The link check above uses HEAD instead, which asks for the headers and not the page.

The full read happens when a pharmacy is set up with us and whenever they ask for a fresh read. Straight after each of those we also check their policy pages and look for broken links on the site, which is a second short burst of requests rather than another crawl.

The link check is the one that can appear at any hour. When the assistant is about to give a patient a link to one of the pharmacy's pages, it first checks the page is still there, so a few single requests can arrive while somebody is in the middle of a conversation. Each answer is remembered for several hours, so this stays occasional rather than steady.

Separately, if pharmacy staff set their logo in AIPA from a web address, we fetch that one image when they click the button. It is the same identification as everything else.

Match on the user agent above. That is the only reliable way to identify us.

There is no list of addresses to allow instead. AIPA runs on Cloudflare, so our outbound requests come from address ranges shared with a very large part of the internet. Allowing those ranges would not be safe for the pharmacy and would not specifically allow us. The user agent is the thing to match on.

The common places this needs changing are a security plugin such as Wordfence, a Cloudflare or WAF bot rule, or an nginx or Apache user-agent rule. Once the change is made, the pharmacy can run the scan again from their AIPA dashboard.

One request is not ours to label, and we would rather say so. Near the start of a scan we ask a third-party crawling service to list the addresses on the site, and that service gives us no way to put our name on it, so it arrives under theirs. It only asks which pages exist and never reads one. Everything that reads an actual page, during a scan or afterwards, carries the identification above.

When a page is refused we ask for it again from our own servers, sending the same user agent as above. If that is refused too, the scan stops there and we tell the pharmacy their site is turning us away, with the rule on this page for them to forward to you.

We do not go further than that on our own. If the pharmacy whose site it is then asks us to try anyway, we make a small, fixed number of further attempts from a different network address, and we record who asked and when. That is their decision about their own website rather than ours, and allowing the user agent above is what stops it being needed at all.

AIPAxBot does not currently read robots.txt. We would rather say that plainly than claim otherwise on a page web hosts are being asked to trust. It reads a site only when that site's own pharmacy, or our staff acting for them, starts a scan, so the read is requested by the site owner rather than discovered by crawling the web.

To stop it, block the user agent above at your firewall, or email us at support@pharmacymentor.com and we will stop reading the site. If a page is refused we retry it a small number of times and then record the site as blocked and give up; we do not keep hammering a host that has said no.

Email support@pharmacymentor.com and say which website you look after. We can tell you exactly which pages we asked for and what your server answered.