Acceptable Use Policy

01What the Service is for

Testing systems you own, or that you are authorized in writing to test, within your plan’s limits:

• Availability, latency and capacity checks with HTTP requests.
• Rendering, navigation and console-error checks with automated browser sessions.
• Confirming that analytics tags load and fire the events you expect. Analytics hits are intercepted by default and never sent. Delivery is an explicit setting for end-to-end tag tests; send delivered hits to a test property, or filter them from reporting.
• Staging, preview and production environments that you control.

02Verified targets only

Campaigns run only against hostnames your organization has verified with a DNS TXT record or an HTTP file, and against their subdomains only if you enabled that. The rule holds at every step: redirects are checked again before they are followed, and browser navigations must stay on the verified domain.

Do not verify a hostname you do not control, keep testing one after your authority has ended, or try to reach an unverified host by another route. Attempts to target unverified, revoked or blocked destinations are refused, and repeated attempts open an abuse flag for review.

03Never permitted

• Unauthorized targets. Testing any system you do not own or have no written authorization to test, including competitors, former clients and third parties you mean to stress.
• Presenting automated sessions as people. Selling, reselling or reporting HTTP requests or automated browser sessions as visitors, users, audience, sessions or engagement, to clients, advertisers, investors, marketplaces or anyone else.
• Inflating metrics. Using test traffic to raise figures in GA4 or any other analytics product, or any advertising, search, affiliate or referral metric.
• Ad automation. Loading, viewing or clicking ads, sponsored placements, affiliate links or search results, or triggering impressions, conversions, leads or installs, on any site.
• Evading controls. Attempting to bypass CAPTCHAs, bot detection, firewall rules, rate limits or other access controls. The Service has no stealth plugins, fingerprint spoofing or proxy rotation, and you must not seek the same effect by other means. To let test traffic through the controls on your own site, allow it in your own configuration.
• Denial of service. Using the Service to degrade or overwhelm any system, sending more load than the system’s operator has approved, or spreading work across several accounts or organizations to exceed limits.
• Proxying and internal access. Using the Service as an open proxy, or to reach private networks, loopback or link-local addresses or cloud metadata endpoints, including through DNS rebinding or chains of redirects.
• Acting on real people. Using automated sessions to submit forms, create accounts, post content or complete transactions where that reaches real users or third parties.

04Identification

Every HTTP request and every browser session carries AutomatedTrafficTest/1.0 in its user agent, with a link to our documentation. The label cannot be switched off.

When you share results, keep them labelled as automated. Reports state test activity, analytics events observed and verified human visits as separate figures. The last is always zero and must not be restated as anything else.

05Enforcement

An abuse flag opens automatically when an organization repeatedly targets unverified or blocked destinations, and whenever someone files an abuse report. Platform staff review every flag and, depending on what they find, may:

• Cancel a campaign. New units stop within one unit. Units already in flight are recorded and disclosed in the report.
• Revoke a domain verification. The domain’s running campaigns are cancelled, and the organization cannot use or re-verify the hostname unless we restore it.
• Suspend a user or an organization. A suspended user is signed out everywhere. A suspended organization’s running campaigns are cancelled, and it cannot use the dashboard or its API tokens until the suspension is lifted.
• Add a host to the emergency denylist. The host is blocked for every customer: running campaigns against it are cancelled at once, and it can no longer be registered or targeted.

Where a third party is being harmed, staff act first and review afterwards. Every action is written to the append-only audit log with the person who took it and the reason. Actions concerning your organization also appear in its own audit log under Settings.

Credits consumed by units that already ran are not restored, and payments are not refunded, for activity that breached this policy. To contest a decision, write to us with your organization name and the campaign or domain concerned.

06Reporting abuse

If a system you operate is receiving traffic from AutomatedTraffic that you did not authorize, file an abuse report. Include the affected hostname or URL, the time window with its time zone, and anything that identifies the requests, such as the user agent or the source addresses. Each report opens an abuse flag and is read before other messages.

If you would like a hostname you control kept out of every customer’s campaigns, say so in the report and we can add it to the denylist. Security vulnerabilities can be reported the same way.