DealerHandshakeBot

Dealer Handshake Inc. operates a free tool that reads a dealership website the way an AI assistant would, and reports back what such an assistant can and cannot see. A scan runs when someone types a domain into that tool. Anyone can run one, including you, on your own site.

Our crawler identifies itself on every request:

DealerHandshakeBot/1.0 (+https://dealerhandshake.com/bot)

One scan fetches, at most:

• your homepage, twice — once as our crawler and once with the control string printed in section 5, which is how we tell whether your site treats browsers and crawlers differently;
• /robots.txt and /llms.txt;
• six /.well-known/ addresses, to see whether you publish a machine-readable description of your dealership;
• up to three sitemaps named in your robots.txt (or /sitemap.xml), and up to four sitemap files they link to;
• one inventory listing page, and — only when that page links a next page of results — that one page, to see whether it serves different vehicles;
• three individual vehicle pages, chosen deterministically from your sitemap — first, middle and last of the sorted list, never at random — plus one of them requested a second time asking for a Markdown version, to see whether you serve one, and — only when that page links a Markdown alternate from its <head> — that one address. When the ChatGPT check is on, two more vehicle pages (the quarter and three-quarter points of the same sorted list) and at most two replacements when a sampled page shows no VIN, so that we can ask ChatGPT about five of your cars by VIN.
• when your /.well-known/agent-card.json declares a lead skill, one GET to the interface it names, to see that something answers there. Nothing is submitted.

We send GET requests only. We never submit a form, never follow a checkout or contact flow, and never sign in.

Scans run in the background. Each attempt has a limit of 100 outbound requests, including policy reads, redirects and retries. A job has a six-hour limit, including queue time. An interrupted attempt can restart up to twice; the last request time and required interval are stored so a restart cannot reset the wait. Never more than three page requests at the same time from one scan. We honor Retry-After and the applicable Crawl-delay; a wait that exceeds the job limit ends the scan without an overall score.

A domain cannot start another job while one is running or for 24 hours after a report completes. The status link reconnects to the existing job without crawling again.

We read your /robots.txt first and follow it. If a group named DealerHandshakeBot exists we obey that group; otherwise we obey User-agent: *. We do not combine the two.

We fetch /robots.txt before content on each origin, including redirect destinations. Then we read the homepage, inventory listing and sampled vehicle pages. Optional /llms.txt, discovery files and protocol checks come afterwards. An address that the applicable policy disallows is not requested.

If you disallow us from everything, that is what the scan finds: those checks report as not-checked rather than as failures, so nothing you blocked is ever counted against you.

A Crawl-delay in the group that governs us is honored from the first content request, per origin. We show the declared interval and an approximate completion time. A long interval is a pacing choice, not a policy violation; we never shorten it to fit our scan. If the job cannot finish, its result says insufficient data and has no overall score. If the policy cannot be read, we do not request that origin’s pages.

We never send another company's crawler name. We do not identify as GPTBot, ClaudeBot, PerplexityBot or any other operator's agent, and we never will.

Our two probes are the crawler above and a control request that measures whether your site serves browsers and machines differently. The control requests one page — your homepage — and sends this exact string, a mainstream browser signature with our name and this page's address appended, so every log line it leaves still identifies us:

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 DealerHandshakeControl/1.0 (+https://dealerhandshake.com/bot)

It exists only to compare the two responses. It is not an attempt to pass as a person.

Where we can, we prove it rather than assert it. Our crawler signs each request with an Ed25519 key using HTTP Message Signatures (RFC 9421), carrying Signature, Signature-Input and Signature-Agent headers. The public half of that key is published at /.well-known/http-message-signatures-directory on api.platform.dealerhandshake.com. If your edge supports Web Bot Auth, it can check the signature against that directory and know the request is ours rather than taking the User-Agent's word for it. Requests are signed only for the crawler above, never for the control probe.

This also bounds what our report is allowed to say. When your robots.txt names a third-party crawler, we quote your own file back to you, with the line number. When our own crawler is refused, we report that our crawler was refused — never that someone else's was.

Extracted facts only: counts, statuses, the resulting score, and short quoted lines from files you publish for crawlers — the directive and line number from your robots.txt, and small marked-up fragments such as a <meta name="robots"> tag or a canonical link, so the report can show you the exact line it is talking about. Quotes are capped at 512 characters. We do not store your pages. Fetched pages exist in memory for the length of the scan and are never written down.

A report is kept for twenty-four hours after completion and then deleted automatically. Its link is unlisted and marked noindex, so it does not enter search results unless the dealership itself chooses to publish it.

One thing outlives the report: a summary row — your domain, the date, the catalogue version, the score and tier, which checks passed or failed as identifiers rather than text, and the two vehicle counts the report shows you (how many your site advertises and how many reached our crawler). No quotes, no page content, no personal data. We keep it to measure how the dealership web as a whole reads to AI assistants, and to tell website platforms which of their defaults are costing every dealership they host. If you would rather we did not, write to support@dealerhandshake.com and we will delete it and stop scanning the domain.

Two different subjects, and this page is about one of them. Everything above concerns a scanned domain — a business's public web configuration, with no person in it. We do not record who ran a scan: no account, no identifier, and the internal note that a domain was scanned carries the domain, the score and the tier and nothing else. What someone chooses to tell us about themselves — a name and a contact left in the form on our website — is a separate matter, described in the Privacy Notice.

Add this to your /robots.txt:

User-agent: DealerHandshakeBot
Disallow: /

We will stop on the next scan. Nothing else is needed and no request to us is required.

To ask us to delete a report, or to block your domain from being scanned at all, email support@dealerhandshake.com with the domain. We honour removal requests.