The Hyperspeed Web Bot
Our bot measures the speed of Shopify stores that use Hyperspeed and watches them for changes that affect their cached optimizations. It only visits your own store, and it stops once you uninstall Hyperspeed.
At a Glance
- Operator
- Hyperspeed, made by Rvere Inc. in Toronto, Canada
- Purpose
- Speed monitoring and cache change monitoring for stores that use Hyperspeed
- Sites it visits
- Only your own store, the one that installed Hyperspeed
- Identified by
- A Web Bot Auth signature with
Signature-Agent: "https://api.hyperspeed.me" - Public keys
- api.hyperspeed.me/.well-known/http-message-signatures-directory
- Opt out
- Uninstall Hyperspeed and the bot stops. You can also email us (see How to Opt Out)
- Contact
- [email protected]
What It Does
Merchants install Hyperspeed to make their Shopify store faster. The bot does two jobs for them.
Speed Monitoring
It measures how fast a store's pages load, using Google Lighthouse audits and the browser's own Largest Contentful Paint (LCP) data. Merchants see their scores before and after optimizing, and Hyperspeed learns which image to preload.
Cache Change Monitoring
Hyperspeed keeps a cache of optimizations for each store, such as deferred app scripts, hero image preloads and critical CSS. The bot re-checks the storefront for new apps and a new hero image, and re-renders pages after theme changes, so that cache stays in step with the live store.
When It Visits
Each check requests a handful of pages from one store. Scheduled checks run every few hours at most. The rest run only when a merchant builds or updates their optimizations.
App change check
Fetches the HTML of the home page, /collections/all and one product page, without a browser, to see which app scripts and app embeds the store loads.
Hero image check
Opens the home page and one product page in headless Chrome at a mobile (380×844) and a desktop (1920×1080) size to find the LCP image. One plain request first checks that the store isn't password-protected or closed.
Preview link check
Requests the store's Hyperspeed theme preview link. If the link has expired, it opens the preview in headless Chrome to get a new one.
Speed audits
Runs Google Lighthouse a few times each on the home page, /collections/all and one product page. This happens when a store is first optimized, after optimizations are applied and when a new report is requested.
Script inventory
Opens the home page in headless Chrome, scrolls to the bottom so late-loading apps appear, then lists the page's scripts. This happens when optimizations are built.
Critical CSS
Renders the store's main page templates at a mobile and a desktop size to extract the CSS needed above the fold. This happens when optimizations are built and after theme changes.
A check that fails may be retried a few times. When headless Chrome opens a page, it also loads the assets that page needs, as a shopper's browser would, so analytics tools that don't filter bots may count these visits.
What It Doesn't Do
No Crawling
It only visits stores that installed Hyperspeed, and only the pages listed above. It doesn't follow links.
No Shopping
It never signs in, adds to cart, submits forms or starts a checkout.
No Shopper Data
It browses as a logged-out visitor, so it never sees customer accounts or orders.
How to Verify It
Most of the bot's requests are signed with Web Bot Auth, an HTTP Message Signature made with an Ed25519 key. Signed requests carry these headers:
Signature-Agent: "https://api.hyperspeed.me"
Signature-Input: sig1=("@authority" "signature-agent");created=1790365000;keyid="LXEu3Aw6iOSA87WIiCGPgSff6GnOpwsVdcWS9YXXRuk";alg="ed25519";expires=1790365300;nonce="...";tag="web-bot-auth"
Signature: sig1=:...:To check that a request really came from Hyperspeed:
- Fetch our public keys from https://api.hyperspeed.me/.well-known/http-message-signatures-directory.
- Find the key whose JWK thumbprint matches the
keyid. - Check that the signature covers your hostname (
@authority) and theSignature-Agentheader, and thatexpireshasn't passed. Signatures are valid for 5 minutes.
Don't rely on the user agent or IP address. The bot uses a standard Chrome user agent so pages render exactly as they do for shoppers, and its requests don't come from a fixed set of IP addresses.
A signature only verifies on the hostname it was made for. Requests that reach another host, such as after a redirect or when headless Chrome loads a page's assets, may carry the same headers without verifying there.
Some checks aren't signed, including Lighthouse audits and critical CSS rendering. Lighthouse audits usually run on Google PageSpeed Insights, so those requests come from Google.
How to Opt Out
Store Owners
The bot only visits your own store, and only while Hyperspeed is installed. It stops once you uninstall Hyperspeed from the Apps section of your Shopify admin.
To keep Hyperspeed but stop the scheduled checks, email [email protected] with your store's .myshopify.com address.
Other Website Operators
If the bot reaches a site you run and you'd like it to stop, email [email protected] with the domain and we'll stop our checks from requesting it.
You can also block requests that carry Signature-Agent: "https://api.hyperspeed.me" at your firewall or CDN.
Because the bot only visits a store on its owner's behalf, it doesn't read robots.txt. Use one of the options above instead.
Questions or Concerns?
If you think the bot is causing a problem, or you have a question about it, email us. If you can, include the domain, the time of the requests and their Signature-Input header. We'll get back to you within 1 business day (often much sooner).
Want a faster Shopify store?
4.9 
on 
Shopify Try Free Now