AppleAppSiteAssociation is a bot in the social media marketing bots category, operated by Apple.
The Apple App Site Association is used to support "Universal Links" that can open in native iOS apps. The bot requests a specific path for a given hostname, which returns metadata that associates certain URL patterns with native iOS apps.
Social media marketing bots read pages for social scheduling, listening and app linking tools. Allow the tools your team uses and block the rest.
AppleAppSiteAssociation identifies itself with this user agent string:
AASA-Bot/1.0.0Anyone can copy a user agent string. Transfon Security also checks where each request comes from, so a request that claims to be a known crawler but comes from the wrong network is treated as a fake, not as the real crawler.
We have not confirmed whether AppleAppSiteAssociation follows robots.txt. Add a rule, then check your logs to see that it stopped. robots.txt is a plain text file at the root of your domain, such as https://example.com/robots.txt.
User-agent: AASA-Bot Disallow: /
User-agent: AASA-Bot Disallow: /private/ Disallow: /search
User-agent: AASA-Bot Allow: /blog/ Disallow: /
User-agent: AASA-Bot Allow: / User-agent: * Disallow: /
User-agent: AASA-Bot group, AppleAppSiteAssociation ignores your User-agent: * rules, so repeat any that should still apply.AASA-Bot from AppleAppSiteAssociation's user agent; check Apple's own documentation if it publishes a different robots.txt name.Treat robots.txt as a statement of your policy, and enforce it where requests arrive.
AppleAppSiteAssociation fetches pages when your links are shared or syndicated. Keep it allowed so previews and feeds work, but leave it out of page views and ad requests.
Transfon Security for publishersWhen ads or posts are shared, AppleAppSiteAssociation fetches the landing page. Those hits are not clicks, so keep them out of campaign reports.
Transfon Security for advertisersProduct links shared in chats and feeds are fetched by AppleAppSiteAssociation. Keep it allowed so previews show the right image and price.
Transfon Security for e-commerceAllow AppleAppSiteAssociation on public pages so shared links preview well, and keep it off the app.
Transfon Security for SaaS and APIsrobots.txt is a request, not an enforcement. Transfon Security shows AppleAppSiteAssociation by name in the Top Bots report, so you can see how often it visits and which pages it reads. Block or allow it with a User Agent rule, or slow it down with a rate limit decision rule.
Transfon Security
AppleAppSiteAssociation is a bot in the social media marketing bots category, operated by Apple. The Apple App Site Association is used to support "Universal Links" that can open in native iOS apps. The bot requests a specific path for a given hostname, which returns metadata that associates certain URL patterns with native iOS apps.
We have not confirmed whether AppleAppSiteAssociation follows robots.txt. Add a robots.txt rule, then check your logs to see that it stopped, and block it by user agent if it did not.
Add "User-agent: AASA-Bot" followed by "Disallow: /" to the robots.txt file at the root of your site. To enforce it, block requests whose user agent contains "AASA-Bot/" at your WAF. In Transfon Security that is one User Agent block rule.
No. robots.txt is voluntary, so AppleAppSiteAssociation may not follow it, and anyone can send AppleAppSiteAssociation's user agent, so a fake AppleAppSiteAssociation ignores your rule. Enforce the rule where requests arrive, at your WAF, and check the source network.
Social media marketing bots read pages for social scheduling, listening and app linking tools. Allow the tools your team uses and block the rest.
Transfon Security identifies every bot in this directory in your traffic reports, flags fake search crawlers, and lets you allow, block or rate limit each bot.
Privacy, security, monetization, and performance insights. A few emails a month, no spam.