GoodspringPlumbBot

If you found this page in your server logs, this explains exactly what the request was, what it did and didn't do, and how to stop it in one line.

What it is

GoodspringPlumbBot is the crawler behind Goodspring Plumb, operated by Goodspring LLC. It reads public storefront pages to assess page performance, structured data, and product-page completeness, the same things any SEO crawler looks at. The result is a short written diagnostic, sent to the store's owner.

How to identify it

Requests carry this user-agent:

GoodspringPlumbBot/1.0 (+https://good-spring.com/scan; hello@good-spring.com)

Browser-rendered requests carry the real Chromium engine string with the same token appended, so the operator is identifiable either way. Requests are additionally signed with Web Bot Auth (RFC 9421 HTTP message signatures); the public key directory is at /.well-known/http-message-signatures-directory on this domain.

What it does

Requests robots.txt first, and obeys it, including Disallow rules that make the assessment less complete.
Reads the homepage, up to three product pages, sitemap.xml, and /.well-known/ucp if present.
Waits 10–15 seconds between page loads, one page at a time per store.
Stops entirely after roughly 60 page requests, or 15 minutes, whichever comes first.

What it never does

No account is created and no form is submitted.
No payment field is ever focused or filled. This is enforced in code and covered by automated tests, not left to intention.
No checkout is entered and no order is placed without the merchant's explicit prior authorization.
No personal data about any individual is collected or stored.
No attempt is made to evade bot detection: no user-agent rotation, no proxy rotation, no fingerprint spoofing, no CAPTCHA solving.
If the store returns 403 or 429, it backs off once and then stops permanently.

How to block it

Add this to your robots.txt. It is honored on the next request, and no appeal or workaround is attempted:

User-agent: GoodspringPlumbBot
Disallow: /

Prefer to be removed from the list entirely rather than blocked at the edge? Email hello@good-spring.com with the domain and it goes on a permanent suppression list: no further requests of any kind, and no marketing contact.

Request logs

Every request is logged with a timestamp, URL, outcome, and whether it counted against the request budget. If you want the complete log of what was requested from your domain, ask and it will be sent: the whole file, not a summary.