If your site scored BLOCKED on Site Check, the most important thing to know is: BLOCKED is not BROKEN. It means our walk couldn’t get past your bot wall. Real users on real browsers are unaffected.
What BLOCKED actually means
When 50% or more of our requests come back as 403, 429, 451, or 503 — the rejection codes used by Cloudflare Bot Management, Akamai Bot Manager, HUMAN Sightline, DataDome, and similar — we mark the verdict BLOCKED rather than BROKEN. Calling Tesco BROKEN would be obviously wrong; calling it BLOCKED is honest.
This is most common on:
- Major retailers (Tesco, Sainsbury’s, John Lewis)
- Banks and financial services
- Travel and ticketing
- Government and education sites
- Anyone who’s recently been hit by automated abuse
Why we get rejected
Our walk is an automated cloud browser visiting your pages at sub-second intervals from a single IP. From a bot manager’s perspective that’s a textbook scraping pattern. The same software that protects you from credential stuffing protects you from us.
Three ways to get a real reading
1. Allowlist us at the edge
Add ContextaSiteCheck/1.0 (our User-Agent) to your bot manager’s allowlist, or whitelist our outbound IPs (publish a /bots manifest at /.well-known/contexta-crawler.json — we honour it). Two minutes in Cloudflare, a bit longer in Akamai. Then re-run Site Check.
2. Use the bookmarklet (real-browser path, free)
When the verdict comes back BLOCKED, the report shows a “drag this bookmark to your toolbar” link. You visit your site, click the bookmark, and your real browser collects PerformanceObserver timings + resource timings + status codes and POSTs them back to us. Zero infrastructure cost, zero install, works behind auth walls. Currently rolling out — watch the report card.
3. Skip the perf test, run the security scan
The 12-check security analysis runs over getaddrinfo() and a small set of HTTP probes that bot managers usually let through. You can still get a security verdict even when the perf scan is blocked.
A note on enterprise sites
If you’re testing a site that’s not yours and it’s behind serious bot protection, BLOCKED is the right answer. We don’t have the access to bypass it, and we shouldn’t try — that would make us indistinguishable from a real attacker. The bookmarklet path is the polite way to ask the site to measure itself.
For a deeper conversation, head to the Troubleshooting Community board.