Saw PenguinaStudyBot in your logs? Here's what it is.
PenguinaStudyBot/1.0 is the scanner for a research study by the Penguina team at penguina.website. It looks only at what any visitor can already see on a website, and it never names a website, business or person.
A study of what visitors see on small-business websites.
The scanner is run by the Penguina team, a website care service at penguina.website. Every request it sends carries the user agent PenguinaStudyBot/1.0 and a link to this page.
It is for a research study of what any visitor can see on small-business websites in the US, the UK, Canada and Australia. We publish the results as totals only. No website, business or person is ever named.
When it runs
The first run is a pilot that starts on Monday 26 October 2026. After that, the study runs again on a schedule, so the scanner may come back to your site in a later wave.
The full study method will have its own page. We'll link it here once it's live.
What it asks your website for, and nothing else.
Three things per site. Anything not on this list, it never touches.
What it requests
- Your robots.txt file.
- Your homepage, over http and over https, following up to 5 redirects.
- One secure-connection (TLS) check.
What it never does
- Open login or admin pages.
- Fill in or send forms.
- Guess page addresses.
- Scan ports or run any security test.
What it notes down, and what we keep.
Only things your website already shows to every visitor.
What it reads
- Whether the security certificate is valid, and when it expires.
- Whether the http address moves visitors to https.
- The platform: WordPress, Shopify, Wix, Squarespace, Webflow, GoDaddy builder, Joomla, Drupal or other.
- Any software or PHP version the site itself shows publicly.
- The copyright year in the footer.
- Whether the page is set up for phones (mobile viewport).
- Whether there is a link to a privacy policy.
- The page language.
- Images without alt text.
What we keep
- A random ID for each site.
- The country and the industry.
- The coded results and the dates.
- We never collect names, email addresses, phone numbers or postal addresses.
- We never store copies of your pages.
- The private list of sites is deleted 12 months after the first wave. The public dataset never contains website addresses.
Slow and polite, on purpose.
The scanner is built so your website never notices the load.
5 seconds apart
At least 5 seconds between requests to the same website.
1 per second overall
At most 1 request per second across every site in the study.
Stops when asked
If your site answers 429 (too many requests) or 503 (busy), it stops.
Two ways to keep your site out of the study.
1. Add a robots.txt rule
The scanner reads your robots.txt file first and follows the robots.txt standard (RFC 9309). Add these two lines to your robots.txt file and we skip your site completely:
User-agent: PenguinaStudyBot
Disallow: /
2. Email us
Email hello@penguina.website with your website address. We delete your site's record from the study at once.
Our privacy policy covers how Penguina handles information more broadly.
What is PenguinaStudyBot?
PenguinaStudyBot/1.0 is the scanner for a research study by the Penguina team at penguina.website. It looks at what any visitor can see on small-business websites in the US, UK, Canada and Australia. Results are published as totals only, and no website, business or person is ever named.
Why is PenguinaStudyBot visiting my website?
Your website is one of the small-business sites in the study. The scanner asks for your robots.txt file and your homepage, and runs one secure-connection check. It does not log in, fill in forms or test your security.
How do I stop PenguinaStudyBot visiting my website?
Add a robots.txt rule for the user agent PenguinaStudyBot, and we skip your site completely. Or email hello@penguina.website and we delete your site's record from the study at once.
Does PenguinaStudyBot collect personal details?
No. We never collect names, email addresses, phone numbers or postal addresses, and we never store copies of your pages. We keep a random ID, the country, the industry, the coded results and the dates.
Will my website be named in the results?
No. Results are published as totals only. The public dataset never contains website addresses, and the private list of sites is deleted 12 months after the first wave.