403 - Your Sitemap Is Blocking Our Tool
What's happening
We tried to access your sitemap, but your website or security layer blocked our request with a 403 Forbidden response.
This usually means your sitemap is protected by a firewall, bot protection system, CDN, or security plugin that doesn't recognise our scanner as trusted traffic.
Common causes include tools like Cloudflare, Wordfence, Sucuri, hosting firewalls, or server-level security rules.
Because we can't access your sitemap, we may miss pages during scanning or fail to complete the scan entirely.
The fix
Instead of allowlisting IP addresses, our platform uses a custom authentication header to identify trusted scanner traffic.
You'll need to:
Log in to your AccessibilityChecker.org account.
Navigate to the Domain Settings section.
Click on Advanced Settings.
Scroll to the Custom Headers section.
You will now see a custom Header name and Header value field, which you will need to complete. For Shopify customers, you have the ability to add multiple custom headers, which is a requirement for your setup.
Example:
Header name (use a non-standard header):
X-MyScanner-AuthHeader value (random, hard-to-guess):
7f3b9e2a-4c1d-4d2b-9f6e-1a2b3c4d5e6f
Other formats that work:
Name:
X-Custom-AccessValue:
scanner-access--2025-09-26--R4nd0m
Tips:
Use a header name that starts with
X-or is clearly custom to avoid conflicts.Make the value long and random (UUID or cryptographic token).
Don’t use sensitive personal info in the header value.
You will now need to add these exact values to your security platform so requests containing the header bypass security checks.
The exact setup steps depend on which security tool you're using.
Platform-specific instructions
Please follow the same setup instructions from the main:
article for your platform.
The exact rule configuration is identical. The only difference is that the blocked request is happening on your sitemap instead of regular page scans.
Important note
Some websites intentionally block sitemap access to bots or unauthenticated traffic.
If your sitemap is protected behind authentication or custom server rules, you may need your developer or hosting provider to add an exception for requests containing our custom authentication header.
Still not working?
Our team has already been notified about the sitemap access issue on your domain.
If you'd like help troubleshooting faster, reply to the error email you received with:
a screenshot of your firewall or security settings
the rule you've created
the sitemap URL being blocked (if known)
We'll help you identify exactly what's causing the 403 response.