Custom headers add a header name and value to Osano's signed scan requests. Your firewall can match that value to allow access, including when it does not support Osano's verified identity.

Create a header group

1. Open Compliance Check → Custom headers in Osano.
2. Select New header group, enter a group name, header name, and value, then save.
3. Select Assign domains and assign the group to your monitored domain.

You can also edit an existing group. Reveal its masked header value when you copy it into your firewall rule. If the Custom headers button is missing, contact Osano Support.

Configure the firewall rule

Create an exception that matches your hostname and the exact header value you saved in Osano. For example:

(host is example.com OR www.example.com)AND (X-Osano-Scan equals your configured value)

Replace the hostname, header name, and value with your settings. Header names are case-insensitive; values must match exactly. Use a dedicated name such as X-Osano-Scan for the header.

Osano's domain assignment covers the domain and its leading www alias, so include both in your rule. Allow the pages and resources needed by the scan, including /robots.txt and /.well-known/gpc.json when present.

Use your provider's instructions to create the exception and place it before the rule that blocks the scan:

• Cloudflare: Create a custom rule with the Skip action. Use lowercase header names in expressions and select the protections to skip. Skip supports Super Bot Fight Mode; see the available options for product limitations.
• AWS WAF: Combine single-header conditions with an exact string match, using OR for the hostnames and AND for the header value. The Allow action stops later evaluation, so put protections that must still apply earlier in the rule order.

Keep the header value private when sharing settings or collecting logs. AWS WAF data protection covers logs and sampled requests; log redaction requires separate sampling protection.

Check the result

Run a new compliance check after saving the rule. In your firewall events, confirm that the header exception matched and the expected pages loaded. Use the overview for troubleshooting and support details.