NarraSightBot

The crawler identity behind NarraSight's free Alt-Text Health Score · Last updated 1 October 2026

Who runs it

NarraSight Ltd, a company incorporated in Scotland (company number SC857212), registered office Graham Hill Building, 50 Richmond Street, Glasgow G1 1XP. NarraSight writes image descriptions (alt text) for websites. The free Alt-Text Health Score at narrasight.com/score lets anyone paste a web address and see how many of that page's images would say nothing to a blind visitor. NarraSightBot is what fetches the page.

A person answers mail sent to hello@narrasight.com. There is no ticket queue behind it.

How to recognise it

Every Health Score page fetch sends this user agent, character for character:

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 NarraSightBot/1.0 (+https://narrasight.com/bot)

The token to match on is NarraSightBot/1.0. The Chrome prefix in front of it is there because some sites serve an empty shell or a 403 to anything that does not look like a browser, and we would rather be told that a page is blocked than be handed a blank one. We are not trying to hide behind it: the token, the version and this page's address are in the same string, and they are the last thing in it, which is where a log line is least likely to truncate them.

Every request NarraSight makes at your site declares itself. Three paths send the string above, from one shared definition: the plain HTTPS GET for a page's HTML, the headless Chromium render, and the fetch of an individual image when our model checks a description against the picture. A test in our own build asserts all three against one shared definition and fails if a hand-written browser string reappears in any of the three fetchers, so dropping the disclosure again would be a deliberate act with a failing test attached to it. Several other request types exist, and none of them is a public scan: a signed-in organisation scanning or re-scanning a site it has configured, which sends the string above, and calls to a content system an organisation has connected to us, which go to that system's API rather than to a web page. The check we run when an organisation connects one sends the shorter NarraSightBot/1.0 (+https://narrasight.com/bot) with no browser prefix.

The Chromium render loads the page as a visitor's browser would, including its own scripts, stylesheets and images, because rendering it is the only way to see what a visitor sees. It sends the same user agent as everything else. It also scrolls the page for up to four seconds, because that is what makes lazy-loaded images load. Requests to private or internal addresses are refused by us before they leave, so a page that loads from an internal host will render with those requests missing.

Exactly what it does

Two things fetch pages, and they behave differently. Both begin with a person asking us for something, and the second one reads more than one page and may come back to the site twice afterwards, so it is set out separately rather than folded into the first.

The free score check: one page

• It reads one page of your site, and only when a person has typed that address into our score page and pressed the button. It does not follow links out of it and it does not come back on its own. A page is requested twice in two cases. If the plain fetch succeeds but the page looks JavaScript-built, we open it in the browser as well, because that is the only way to see the images the scripts add. If the plain fetch is refused or times out, we try once more in a headless browser, or, when no browser is free and the first attempt timed out, with a second plain fetch on the rest of the time budget. Both requests send the same user agent, and there is never a third. A signed-in organisation can also schedule repeat scans of one address it configures. We do not verify that it owns that address, so if you see scheduled traffic you did not expect, write to us and we will tell you what is configured and stop it.
• It reads the HTML for image elements and their text alternatives: plain, lazy-loaded, responsive and noscript variants. For a sample of those images it fetches the image file so a model can check whether the existing description matches the picture.
• It follows at most five redirects. One fifteen second budget covers the whole fetch, redirects and download together. Where a browser is standing by to try a page that will not answer us, the first attempt is cut short at about six seconds so that the browser can start sooner, and if the browser is busy the plain fetch gets the rest of the fifteen seconds for a second attempt. A page opened in the browser adds up to thirty-five seconds more.
• It accepts at most eight scans a minute from any one visitor, and at most two hundred a minute across everyone. Results are cached by web address, so scanning the same page twice does not fetch it twice.
• It reports back a score, the images it flagged, what a description would say instead, and a short written summary of what the gaps mean. Where we could read only part of a page, it says so and why, and where a scan failed it says what the plain fetch ran into, whether a browser was tried and, if so, what that ran into. That is the whole output.

The fuller site report: up to twenty pages

When someone asks us to email them the fuller report on a site, we look at more than the one page they pasted. This is the part a webmaster is most likely to notice, so here it is in full.

• It reads the home page and takes the internal links on it. It also asks for /sitemap.xml, and for /sitemap_index.xml if the first is not there, and follows at most two child sitemaps.
• From that list it fetches at most twenty pages of the site in total, waiting four hundred milliseconds between them. The sitemap requests above come on top of that, and a page that looks JavaScript-built is opened a second time in the browser, so a handful of those twenty may be requested twice.
• A person started it, by asking for a report on that site, but nobody approves each page individually. On any reasonable definition this one is a crawl, bounded at twenty pages, and we are not going to call it anything else.
• It uses the same fetcher, so every one of those requests carries the user agent above.

What it does not do

This is the part we would want to read first if it were our logs, so it is stated plainly and we will stand behind every line of it.

• It does not go past twenty pages of a site. If you asked us for a report and agreed to hear from us again, we come back at most twice afterwards, about four and ten days on, to see whether anything changed before we write to you again, and each time we read only the page you scanned and the home page. There is no continuous crawl of anybody's site and no index being built.
• It does not solve CAPTCHAs, and it has no CAPTCHA-solving service behind it.
• It does not use residential, rotating or anonymising proxies. Requests come from servers we rent and control, never third-party proxies.
• It runs no anti-detection or stealth tooling. The headless browser is stock Chromium with the user agent above set on it, and nothing else is masked.
• It does not log in, does not submit forms, does not accept cookies for the purpose of getting past anything, and never reads a page that needs an account.
• It does not write to your site, and it does not change anything on it. The paid product writes alt text into a content management system, but only for an organisation that has connected its own site to us. Every description is held for a person to approve, unless that organisation has deliberately turned on automatic publishing above a confidence level it sets itself.
• It does not keep a copy of your page, and your page's words are read to write the summary and are not kept. For a free score, what we keep is the address scanned, the score and the counts behind it, for twelve months, and then they are deleted. The full result sits in a cache for at most an hour and then goes. What our model said about an individual picture is kept for a day, so that scanning the same image again costs nothing, and the address it belongs to is stored only as a one-way hash. If you asked us to email you a report, we also keep that report: the addresses of the images it names, the alt text they carry today and the descriptions we wrote, so we can send it again and answer you about it. Ask us and we will delete it.
• If a plain fetch is refused or times out, it tries once more in a headless browser that sends the same user agent, where one is free, and it never tries a third time. If a site rate-limits us it does not open a browser at all, because a rate limit applies to a browser too: it tells the person to try again in a few minutes, which is what your server asked for. It only tells the person that a site turns automated visitors away when the site did that: when it answered with a refusal, or held both attempts open without answering. A missing page or a server error is reported as what it is, and when the failure was on our side, such as our own browser failing to load the page, it does not put that on the site.

robots.txt

NarraSightBot does not read robots.txt today. We are not going to imply otherwise on the page you would judge us against, and we are not going to dress it up: for the single page a person pastes into the score check the argument for not needing it is reasonable, and for a twenty-page report crawl it is thin. This is the part of our behaviour we are least comfortable with, it is a known gap rather than a position, and it is being looked at properly rather than quickly.

Until it is closed, the two methods below both work today and take effect immediately. If your policy is that every automated fetch must consult robots.txt, write to us and say so, and tell us the host, because we would rather hear it from you than be blocked for it.

How to allow it

Allow requests whose user agent contains NarraSightBot/1.0. In Cloudflare that is a WAF skip rule on http.user_agent contains "NarraSightBot". In Akamai it is an entry in the Bot Manager custom bot category matched on the same string. There is no fixed IP range to allowlist, so please match on the user agent rather than an address.

How to block it

Block requests whose user agent contains NarraSightBot/1.0, at your edge or in your server configuration. That is immediate, it needs nothing from us, and it is the method we would choose ourselves.

If you would rather we simply never fetched your domain, email hello@narrasight.com with the host name. We will add it to our refusal list and confirm, by hand, from a person. We would rather tell you that it is a manual list than imply a system we have not built. You do not have to give a reason.

One exception, and it is the one we would want told to us. Where we cannot get usable pixels for an image ourselves, we pass the image's address to our model provider and their fetcher requests it from your site. That request is theirs, not ours, and it does not carry NarraSightBot, so blocking our user agent will not stop it. The free alt text generator and the live demo work this way whenever they are given an image's address rather than the file itself. If that matters to you, write to us with the host name.

Why any of this matters to us

NarraSight was founded in Glasgow by Abdul Eneser, who is blind and uses a screen reader every day. The score exists because most websites have images that say nothing at all to someone browsing by ear, and the only way to show a site owner that is to read their page. We would rather be a bot you recognise and can switch off in one rule than one you have to work out from your logs.