How to recognise it

Every request says who it's from. The User-Agent is:

TrillyBot/1.1 (+https://trilly.io/bot; hello@trilly.io)

In robots.txt it answers to TrillyBot. It only uses https on port 443. It never connects with plain http (port 80) and never falls back to it: a site that only works over http is simply skipped.

What it asks for on a company visit, in order

  1. Your robots.txt, to read your rules. If you don't have one (your server says 404 or 410), TrillyBot treats your site as having no rules. If your server refuses it (401 or 403), asks us to slow down (429), answers with any other error, or sends us to plain http, TrillyBot stays away from your site.
  2. Your home page: the website address listed for your company (on Wikidata, or the one you gave us), over https.
  3. Your llms.txt, but only if your home page or robots.txt points to it.
  4. Up to 3 pages your home page links to, such as developers, docs, pricing, security, status or integrations. Each one is judged by its own title or heading.

That's at most 8 requests in one visit, counting robots.txt files and redirects. On a company visit TrillyBot never guesses addresses and never asks for pages your site doesn't link to. It never follows links to other sites, and never downloads images, scripts or other files.

Pages that skill makers name

Some skills follow public rules, such as a tax office's GST rates. The maker of such a skill can name the pages those rules are on. TrillyBot reads each named page to see whether its words have changed, so Trilly can tell the maker. This is the only time TrillyBot asks for a page that your site's home page doesn't link to, and it asks for that one address only. The address comes from a skill's maker, not from Trilly guessing.

  1. Your robots.txt, read first, with the same rules as above.
  2. The one page the maker named, over https on port 443. It has no login and no "?" part, and TrillyBot does not follow links from it. A redirect is followed only within your own site.

It keeps a fingerprint of the page's words, never a copy of the page. A named page can be on any public site, not only a company's.

How often

  • Company visits: about once every four months for each site, and never more than once a month.
  • A page a skill's maker named: at most once a day for each page (a page that keeps failing is tried once a week). At most 25 pages are read in an hour, across all sites.
  • One request at a time to your site, at least 3 seconds apart, or longer if your robots.txt sets a Crawl-delay. If you ask for more than 30 seconds, we skip your site rather than keep you waiting.
  • Across every site together, no more than 2 requests a second.
  • Company visits are only to the sites of companies people come to Trilly for: companies that have claimed their page, are well known, or have an API or AI tools. Most small sites are never visited.
  • A named page is read only because a skill's maker named it, and only while that skill is published on Trilly.

What it keeps

For a named page it keeps only a fingerprint of the page's words, so it can tell whether they changed. For a company visit, it notes whether your site has a pricing page, documentation, a developer portal, a status page, a security page or an llms.txt file. Trilly shows those facts on your company's page, with the date we checked.

Facts about your site, not its content: the page title and description (kept for matching, never shown), links to the kinds of page above, the address of your favicon and logo, and the social profiles your site lists in its own structured data. We never copy the text of your pages.

How to stop it

Add these lines to your robots.txt:

User-agent: TrillyBot
Disallow: /

TrillyBot also follows the rules you set for all bots (User-agent: *) when there's no group for TrillyBot. To slow it down instead of stopping it, add Crawl-delay: 10 (or more) to that group.

Or email hello@trilly.io with your domain, and any IP ranges you'd like us to avoid. We'll add them to our do-not-visit list, usually within two working days. From then on TrillyBot won't contact that domain, any of its subdomains or those addresses, whatever your robots.txt says, for company visits and for named pages alike. If you'd also like your company's page on Trilly changed or taken down, say so in the same email.

What it never does

  • Log in, create accounts, or fill in or send forms.
  • Test your site for weaknesses, or guess addresses: it asks only for pages your home page links to, or for one page a skill's maker named.
  • Use plain http, or any port other than 443.
  • Visit private or internal addresses, even if a name points to one.
  • Run scripts or load your pages in a browser.

Report a problem with TrillyBot

If TrillyBot causes you any trouble, email hello@trilly.io. Tell us your domain and what you saw, with the time if you have it. We'll reply within two working days, and we'll stop visiting your site straight away if you ask.

This page was last checked against the bot on 28 October 2026. Companies can learn more about their page on Trilly at Trilly for companies.