formconfirmed
FormExposedBot Exclude a domain

Before you exclude your domain: FormExposedBot does no harm.

It behaves like a careful visitor: it reads what anyone can see and leaves again. An exclusion protects you from nothing – it only means that nobody, not even you, can check your forms with formexposed any more.

Check your form instead → I still want to exclude my domain
× What FormExposedBot never does
  • Submit a form without the verified owner's consent
  • Store what your visitors enter
  • Click “Accept” on your cookie banner
  • Load more than eight pages or several at once
01

It only reads

It loads at most eight public pages, one after another, like a visitor with a browser. Nothing is entered and nothing is sent.

02

Tests only with the owner

A single, clearly labelled test submission happens only after the owner of the domain has verified it in their account.

03

No personal data from your forms

Field contents are never stored. The report describes the protection of the form, not the people who use it.

04

It works in your favour

A check shows whether your form lets spam through or has stopped working – before your customers notice.

! What it costs you

An exclusion is permanent and applies to everyone.

Including you and the people who look after your website. You can only lift it later by contacting us and proving control of the domain.

Only want to keep the crawler away for now? Block it in your robots.txt – you can undo that yourself at any time: robots.txt

  • No free check of your domain any more – not even by you.
  • No monitoring, even if you or your agency verify the domain and pay for it.
  • Agencies can no longer show you what they found on your forms.
  • A broken or spam-flooded form is only noticed by your customers.

Still want to exclude your domain?

1 Domain2 DNS record3 Done

In the next step you confirm the exclusion with a DNS record. We record the domain, the time, your IP address, its country and your browser identification.

Details, scope and data protection

Last updated: 31 October 2026

You do not want formexposed to check your website? There are two ways to prevent it. Both require that you control the domain – through the file on your web server or through a DNS record – and both take effect, without you having to contact us, for every check that starts afterwards. What exactly they cover and what they do not is set out below.

Option 1: robots.txt

Add the following to https://your-domain/robots.txt:

User-agent: FormExposedBot
Disallow: /

FormExposedBot reads the file before every check. It observes a Disallow rule that covers the home page; it does not currently evaluate blocks that apply only to individual subdirectories. The rule stays in your hands and you can remove it again at any time. The entry stops all checks by the crawler, but not the light requests made without a browser, such as the header check. Details are on the page About FormExposedBot.

Option 2: the form below

Enter the domain, for example example.com. Giving a reason is optional. In the next step we show you a TXT record – name _formexposed.your-domain, value formexposed-optout= followed by a code for your domain – which you add at your DNS provider. As soon as we find it, the domain is excluded; you can then delete the record again. DNS changes can take up to an hour. If you have no access to DNS, use option 1. The form excludes more than robots.txt does and continues to apply even if the file is later lost.

What the exclusion does

  • No more free check, header check or prospect check by agencies for this domain.
  • In no check that starts after the entry does the crawler fetch any page of the domain, analyse a form or submit anything. This also applies to customers who have the domain in their account and have verified it – including on paid plans.
  • Monitoring in the customer account switches itself off as soon as the next check is due. This also ends the form pulse and the other regular requests; until then, they may still take place. If you want them to end sooner, write to us.
  • We do not include the domain in future studies.

The exclusion does not cover a single request by which a customer has their proof of control over the domain checked (identifier ownership-verification, see About FormExposedBot).

Anything already checked remains stored until the end of the period stated in the Privacy Policy. If you would like us to delete existing reports on your domain earlier, write to us; we treat this as a request under Art. 17 and 21 GDPR and reply within one month (Art. 12(3) GDPR).

Which addresses are covered

We store the domain without www.. The entry example.com applies to example.com and www.example.com. Other subdomains such as shop.example.com are not included – please enter them individually. We strip paths and https://.

What data we store

  • Permanently, for as long as the exclusion exists: the domain, the time and the reason, if you give one. Please do not put any personal data in the reason.
  • For 12 months: your IP address, the country derived from it and your browser identification. This lets us trace an exclusion if there is any doubt about it later. After that we delete these details; the exclusion remains.
  • For seven days: a log entry with the domain entered, IP address, country and a checksum of your session (not the session itself), for the limits against mass entries and unsuccessful DNS checks.

The form is protected by Google reCAPTCHA, our own form protection formconfirmed, a hidden trap and a timing check. reCAPTCHA loads only when you submit. The legal basis is our legitimate interest in carrying out your request and detecting misuse of the form (Art. 6(1)(f) GDPR); if you mean the exclusion as an objection under Art. 21 GDPR, we implement it this way. More in the Privacy Policy.

Only a few domains per day can be entered from one IP address, and on days with a very high number of requests the form may reject an entry. If an entry fails or you want to exclude many domains, for example as a hosting provider or agency, send us the domain or the list at contact@lukaswojcik.com.

Lifting an exclusion

You cannot lift an exclusion yourself, so that nobody can undo someone else’s exclusion. Write to us at contact@lukaswojcik.com or via the contact page. We lift it if you show that you control the domain, for example with a DNS record or a file that we specify. This also applies if your domain was excluded before 31 October 2026, when no proof was required yet, and your monitoring has stopped as a result. We record who lifted an exclusion, when and for what reason. If you set the exclusion via robots.txt, simply remove the rule.

More about the crawler: FormExposedBot. How we deal with misuse: Acceptable Use and Abuse.