YRA Monitor Accessibility Scanner

YRA Monitor is an accessibility- and compliance-monitoring platform (WCAG / EAA). Its scanner loads web pages in a real browser and runs an ensemble of open accessibility engines against them, on behalf of authorized users— typically a site’s own operators auditing their own site, or someone with the right to audit the target. We run it as a declared, identifiable bot on purpose, so you can recognize it, verify it, allow it through your WAF when you’ve authorized a scan, and reach us if anything looks wrong.

Operated by YRA Tech. Abuse or questions: [email protected].

Identifying our scanner

Do not identify us by User-Agent.The scanner emulates the device the operator configured (desktop, iPhone, Android…), so its User-Agent reflects that emulated device and varies from scan to scan. Identify us instead by:

• Source IP — from our published ranges at /scanner-ips.json. This is the verification anchor.
• A stable request header we send on every request: X-YRA-Scanner: YRA-Monitor/1.0; +https://yratech.com/scanner

Verifying a request is really us

The header, like any header, is spoofable — so verify by source IP, using either method:

• Published IP ranges. Allow a request only if its source IP is listed at /scanner-ips.json (updated when it changes).
• Reverse DNS. Our scanner IPs have scan-*.yratech.com PTR records, forward-confirmable (the same scheme used to verify Googlebot): reverse-lookup the source IP, confirm it resolves to a *.yratech.com host, then forward-resolve that host back to the same IP.

Allowing the scanner through your WAF

If you’ve authorized a YRA scan of your site and your WAF is challenging or blocking it, allowlist it by source IP (never by User-Agent, which varies by emulated device) — optionally also requiring the X-YRA-Scanner header. Per-vendor instructions (Cloudflare, Akamai, DataDome, AWS WAF) are available on request from [email protected].

robots.txt

For unauthorized/discovery crawling, the scanner honors robots.txt. For an authorized scan of your own site, the person requesting it has asserted the right to audit it, so such scans may proceed regardless of robots.txt — it is you auditing you. Want authorized scans to respect robots.txt too? Tell us and we’ll honor that per account.

Politeness & opting out

One page load per target for ad-hoc checks; scheduled scans run at a bounded, configurable rate. No credential stuffing, no form submission except on user-path scans you’ve explicitly configured, and no attempts to evade bot detection. To request exclusion of a domain, a slower rate, or robots.txt enforcement on authorized scans, email [email protected] with the domain and the behavior you want.

A separate research crawler for our accessibility-metatesting study uses a self-identifying YRA-100k-Study/1.0 User-Agent — see /100k.