ExaSearchBot-Images

Exa is a search engine. ExaSearchBot-Images is the robot Exa uses to fetch the images that appear on pages ExaSearchBot has crawled, so search results can show them.

Below is information on ExaSearchBot-Images and how you can set your site preferences to enable or limit its access to your images.

Purpose

ExaSearchBot-Images fetches images referenced by pages on the public web. Each image is reduced to at most 560 pixels on its longest side for display as a thumbnail in search results.

Images Exa fetches on a user's request, rather than by crawling, go out as ExaUser-Images.

Identification

ExaSearchBot-Images sends this user-agent:

ExaSearchBot-Images

Its robots.txt product token is ExaSearchBot-Images; without a group for it, it follows your ExaSearchBot rules (below).

Each image is a single GET request for the image URL, with an Accept header listing image types and a Referer set to the origin of a page showing the image, or to the image's own origin.

User-agent strings can be spoofed, so don't trust the string alone — verify cryptographically (below).

Verification

Every ExaSearchBot-Images request is cryptographically signed using HTTP Message Signatures (RFC 9421), following the Web Bot Auth scheme. Each request carries Signature, Signature-Input, and a Signature-Agent header identifying Exa.

On Cloudflare, Akamai, and other providers that support Web Bot Auth, ExaSearchBot-Images is validated automatically at the edge — nothing to configure on your side.

To verify it yourself: fetch our public key directory and validate the request signature per RFC 9421. ExaSearchBot-Images' Ed25519 keys are published at:

https://images.crawler.exa.ai/.well-known/http-message-signatures-directory

ExaSearchBot-Images does not fetch from the same IP addresses as ExaSearchBot. Because verification is cryptographic, it holds regardless of the request's IP address.

Respecting robots.txt

ExaSearchBot-Images respects the Robots Exclusion Protocol, applying the robots.txt of the host that serves the image, which may differ from the host of the page showing it. When choosing which rules to follow, it looks for a group addressed to ExaSearchBot-Images. If you haven't provided one, it follows your ExaSearchBot group; failing that, the rules you've set for major search engines; otherwise the * group.

Give ExaSearchBot-Images its own rules (takes precedence):

User-agent: ExaSearchBot-Images
Disallow: /private/

Block ExaSearchBot-Images from your whole site:

User-agent: ExaSearchBot-Images
Disallow: /

How ExaSearchBot-Images behaves

Respects robots.txt

Checked against the image's host before fetch: its own group, then ExaSearchBot's, then the fallbacks above.

Signs requests

So you can confirm a request is genuinely us.

Fetches politely

Rate-limited per host to avoid putting load on your servers.

Images only

One GET per image URL. It does not attempt to bypass logins, paywalls, or CAPTCHAs, and submits no forms.

Contact

If you have questions or need assistance, please reach out to support@exa.ai. If possible, please reach out from an email that includes the domain you are contacting us about, which facilitates verification.