Allowlist the Pinpress crawler

Pinpress needs to read your sitemap and pages to turn them into Pinterest pins. If your site sits behind Cloudflare, a WAF, or a "bot fight" rule, our crawler can be blocked before it reaches your content — usually showing up as "Could not fetch or parse sitemap" on your Site detail page.

Add the rule below and we'll get through.

How to identify our crawler

Every request we send carries this User-Agent string:

Mozilla/5.0 (compatible; PinpressBot/1.0; +https://pinpress.io/docs/crawler-access/)

The unique identifier is PinpressBot. Match on that substring in your firewall and you'll catch every request we make, even if we bump the version later.

Cloudflare

  1. In the Cloudflare dashboard, open your site and go to Security → WAF → Custom rules.
  2. Click Create rule and name it something like "Allow PinpressBot".
  3. Build the expression:
    • Field: User Agent
    • Operator: contains
    • Value: PinpressBot
  4. Set the action to Skip, then check every option under "WAF components to skip" (Managed Rules, Rate Limiting, Bot Fight Mode, etc.).
  5. Deploy the rule. Changes take effect within a minute.

If you have Super Bot Fight Mode on, also turn off the "Definitely automated" challenge — bot challenges run before WAF skips on some Cloudflare plans, so the skip rule alone isn't enough.

Other firewalls and security plugins

The same User-Agent works with every WAF we've seen. Look for an "Allowed bots", "Whitelist", or "User-Agent exceptions" section and add a rule matching PinpressBot.

Common places this lives:

  • Wordfence (WordPress): Wordfence → All Options → Whitelisted Services / Allowlisted user agents.
  • Sucuri: Settings → Access Control → Whitelist User-Agent.
  • SiteGround Security / LiteSpeed WAF: look for a "Trusted bots" or "User-Agent whitelist" panel.
  • WP Rocket, Rank Math, and other crawler blockers: add PinpressBot to the user-agent allow list.

Verifying it worked

  1. Open your Site in Pinpress and click Re-scan on the sitemap recovery card.
  2. If it still fails, paste your sitemap URL directly (e.g. https://yoursite.com/sitemap.xml) into the recovery card — that bypasses robots.txt discovery, which is the most common allowlist tripwire.
  3. In Cloudflare, check Security → Events: a request from PinpressBot should now appear with a 200 response.

Still stuck?

Email us at [email protected] with your site URL and the rule you tried. We'll look at the response we're getting and tell you exactly which rule is blocking the fetch.