The Recolor fetcher

Someone opened Recolor and loaded your page: they typed or pasted its address, opened a Recolor link that carries it, or clicked a link to it inside a page they were already previewing. Recolor shows the page to that person, in their browser, and repaints it in a color palette they are trying out. Nothing is published, nothing is indexed, and nobody else sees it. How the page is prepared is on How Recolor repaints a page.

The fetcher asks for the page's HTML with Accept: text/html,application/xhtml+xml;q=0.9,*/*;q=0.5, follows redirects, and then fetches the stylesheets the page links, so it can put them inline where the preview can read their colors. Fonts and CSS masks are fetched on the preview's behalf too, because a sandboxed preview cannot load them across sites (fonts from Google Fonts and Bunny Fonts excepted, which allow that). That is all: images, video and scripts are loaded by the person's own browser, with its own user agent and without a referrer.

A prepared page is cached for 60 seconds and fonts for an hour, so a reload does not reach your server again. The fetcher sends no cookies and passes on nothing from the person's browser, and it never fetches an address on a private network. What Recolor stores and fetches has the details, and Limits every size and time.

The Robots Exclusion Protocol is written for crawlers, programs that find pages by following links and fetch them on their own. The Recolor fetcher is not one: it fetches one page because one person asked for it, the way a browser or a link preview does, and it never follows a link by itself. Reading robots.txt would also not express what a site owner usually wants here; blocking the user agent does, and it takes effect at once.

Match the user agent on Recolor/ rather than the full string, since the version number changes with releases, and answer with 403. The person in Recolor then sees that your site refused the page, with the status you sent.

nginx, inside the server block:

if ($http_user_agent ~* "Recolor/") {
    return 403;
}

Apache, in .htaccess or the site configuration, with mod_rewrite:

RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} Recolor/ [NC]
RewriteRule ^ - [F]

Cloudflare, as a WAF custom rule with the action Block:

(http.user_agent contains "Recolor/")

Blocking it touches nothing else: search engines, browsers and other tools keep their access. People can still save your page from their own browser and upload it to Recolor, as Loading a page shows, because that never contacts your server.

Requests come from Cloudflare's IP ranges, since the fetcher runs as a Cloudflare Worker, with the user agent above, Accept-Language: en-US,en;q=0.9 and no cookies. The address after the + in the user agent leads to this page. A few seconds later the same person's browser may ask for your images, which is an ordinary visit. Which real sites load in Recolor, and how they behave, is in Which sites load.