What is cf-qualys-scanner?
cf-qualys-scanner is a cloud-based web application security scanner that provides automated crawling and vulnerability testing to identify security flaws including XSS, SQL injection, and OWASP Top 10 vulnerabilities. You can set up Agent Analytics to see when cf-qualys-scanner visits your website.
Category
| Operated By | Qualys |
| Source | Official Website |
| Triggered By | Scheduled or requested scan |
| Used for AI Model Training | Not expected |
| Affects AI Chat & Search Visibility | Not directly |
| Expected To Follow Robots.txt | Yes |
Why Is cf-qualys-scanner Visiting My Website?
cf-qualys-scanner is scanning your site for vulnerabilities, either as part of an internet-wide sweep or because someone requested an assessment of your domain. Recurring visits often indicate that a monitoring service has added your site to its checks.
Should I Block cf-qualys-scanner?
Usually not, unless you already run your own security scans and want cleaner logs. cf-qualys-scanner checks for exposed vulnerabilities, and some services report their findings to site owners at no cost. For context, 7% of the top websites we track currently have robots.txt rules for cf-qualys-scanner.
How Do I Block cf-qualys-scanner Using Robots.txt?
Add this rule to your robots.txt file to block cf-qualys-scanner from accessing your website, or use Automatic Robots.txt to block all security scanners at once. You can customize which pages are blocked by swapping out / for a different path.
User-agent: cf-qualys-scanner # https://knownagents.com/agents/cf-qualys-scanner
Disallow: /Insights for cf-qualys-scanner
As of October 30, 2026, this data reflects agent visits measured across thousands of websites using Agent Analytics, combined with daily scans of the top 1000 websites and their robots.txt files.
Robots.txt Compliance
Country of Origin
Robots.txt Blocked Percentage
cf-qualys-scanner Traffic
Frequently Asked Questions
What Traffic Patterns Should I Expect From cf-qualys-scanner?
cf-qualys-scanner's cadence depends on how the scan is configured. Continuous monitoring may run daily or hourly, while a one-time or internet-wide scan may sweep once and disappear.
Does cf-qualys-scanner Follow Robots.txt Rules?
cf-qualys-scanner is expected to follow robots.txt rules, so a disallow rule is the appropriate first step if you want to block it. Automatic Robots.txt can add and maintain that rule, while Agent Analytics lets you verify whether cf-qualys-scanner respects it.
Is cf-qualys-scanner Used for AI Model Training?
Not ordinarily. cf-qualys-scanner is not categorized as an AI training scraper or data provider, so AI model training is not its expected purpose.
Does Blocking cf-qualys-scanner Affect AI Search or Citations?
Not directly. cf-qualys-scanner's expected purpose is not to supply an AI search index or retrieve pages for AI-generated answers.
Does cf-qualys-scanner Access Private Content?
It deliberately looks for exposed private content. cf-qualys-scanner tests login pages, admin panels, and API endpoints for vulnerabilities. Probing does not mean it gained access, but you should expect requests to sensitive paths in your logs.
How Can I Verify a Request From cf-qualys-scanner?
Agent Analytics tracks cf-qualys-scanner visits in real time. You can also check your server logs for requests whose user-agent string contains "cf-qualys-scanner". Look for bursts of requests to uncommon paths that ordinary visitors rarely access. Because cf-qualys-scanner does not publish a verification method, any client can claim its identity and a log match is only a clue.
How Is cf-qualys-scanner Different From Other Qualys Agents?
Qualys operates separate agents for different purposes, so each agent should be evaluated and controlled independently.
- Qualys: Qualys is a developer helper operated by Qualys.
- Qualys SSL Scanner: Qualys SSL Scanner is a developer helper operated by Qualys.
- SSL Labs: SSL Labs is Qualys' free online SSL/TLS security testing service that performs deep analysis of SSL web server configurations on the public Internet to identify security …