About HigherSelfScan

If you found this page in your server logs, this is the honest, complete account of what requested your pages, what it did, what it will never do, and how to make it go away.

What it is

HigherSelfScan is a small crawler operated by HigherSelf Systems (HigherSelf Forge Limited, Company No. 14045104). It reads the public pages of a small number of UK business websites to check for specific, observable problems: broken forms, unreachable pages, misconfigured email authentication, wording that needs checking against the GB nutrition and health claims register, and similar. If it finds something significant, the finding goes privately to the business it concerns, with the steps to reproduce it. Nothing it finds is ever published.

How it identifies itself

Every request carries this user agent, exactly:

HigherSelfScan/1.0 (+https://higherself.ai/scanner)

It never impersonates a browser, never rotates user agents and never rotates IP addresses. If you see a request claiming to be a browser, it was not this scanner.

What it does

• Fetches only pages reachable from your site’s own public links, pages listed in your public sitemap, your robots.txt file, and public DNS records.
• Uses GET and HEAD requests only.
• Sends at most one request every two seconds to your host, and reads at most 50 pages per site per run.
• Backs off on HTTP 429 or 503, and abandons the run after two consecutive throttling responses.
• Parses robots.txt first and honours Disallow rules addressed to HigherSelfScan or *.
• Logs every run: target, timestamp, pages fetched, bytes transferred, errors.

What it never does

• It never submits forms. POST is never used. Forms are inspected by reading the served markup only, so nothing ever enters your systems from this scanner.
• It never attempts to log in to anything, never uses, guesses or replays credentials, sessions or cookies.
• It never probes for admin paths, hidden endpoints or unlinked URLs, never enumerates directories, never fuzzes parameters, and never sends exploit or injection payloads of any kind.
• It never bypasses any technical control. If something is blocked, it stays blocked.
• It stores no personal data from your pages except business contact details your company itself publishes, each recorded with its source URL and date, handled as described in the privacy notice.

How to block it

Two ways, both permanent:

Add this to your robots.txt, and the scanner will never fetch another page from your site:

User-agent: HigherSelfScan
Disallow: /

Or email david@higherself.ai with your domain, and I will add it to the exclusion list by hand, usually the same day. You do not need to give a reason.

What happened on its first real list

The honest version. The scanner’s first full list covered 51 verified UK companies, of which 13 were confirmed as sendable contacts. It generated three findings for outreach. Before any email went out, each finding was re-verified by hand in a browser, and all three were wrong:

• A DMARC record reported as missing did reproduce after all.
• A Cloudflare email-obfuscation endpoint was misread as a broken link.
• An uninterpolated JavaScript template literal was misread as a broken link.

The scanner was wrong three times out of three, and the hand check caught all three before they reached a stranger. No email carrying any of those findings was ever sent. That is why nothing the scanner produces is reported without a human reproducing it first, and it is why the re-verification step is the product, not the scanner.

Questions

If you want to know exactly what the scanner did on your site, email me and I will send you the log for your domain: every URL fetched, when, and what came back. A human reads that mailbox, and the human is the person who runs the scanner.