Go-http-client is a bot in the HTTP clients and libraries category, operated by Go project.
Go-http-client is the default user agent of the HTTP client in the Go standard library. Any Go program that does not set its own user agent sends it, from API clients to scanners and scrapers.
HTTP clients are programming libraries and command line tools. Developers use them for scripts, integrations and scrapers. Real browsers never send these user agents, so treat them as automated traffic and block them on pages meant for people.
Sample user agent strings sent by Go-http-client:
Go-http-client/2.0Go-http-client/1.1Anyone can copy a user agent string. Transfon Security also checks where each request comes from, so a request that claims to be a known crawler but comes from the wrong network is treated as a fake, not as the real crawler.
Share of Go-http-client requests to sites protected by Transfon Security in the 7 days to 27 October 2026.
| Singapore | 20% |
| Finland | 17% |
| France | 17% |
| United States | 15% |
| The Netherlands | 6% |
| Germany | 6% |
| Hetzner Online GmbH AS24940 | 17% |
| OVH SAS AS16276 | 17% |
| F.N.S. HOLDINGS LIMITED AS206092 | 11% |
| GSL Networks Pty LTD AS137409 | 9% |
| Shenzhen Tencent Computer Systems Company Limited AS132203 | 7% |
Go-http-client does not read robots.txt. The rules below record your policy, but they will not stop it. To actually block Go-http-client, use a WAF rule as shown in the next section.
User-agent: Go-http-client Disallow: /
User-agent: Go-http-client Disallow: /private/ Disallow: /search
User-agent: Go-http-client Allow: /blog/ Disallow: /
User-agent: Go-http-client Allow: / User-agent: * Disallow: /
User-agent: Go-http-client group, Go-http-client ignores your User-agent: * rules, so repeat any that should still apply.Go-http-client from Go-http-client's user agent; check Go project's own documentation if it publishes a different robots.txt name.Treat robots.txt as a statement of your policy, and enforce it where requests arrive.
Go-http-client is a common tool for scrapers. Real readers never use it, so block it on article pages and keep it out of ad requests.
Transfon Security for publishersTraffic from Go-http-client on landing pages is automated. It inflates clicks and visits, so filter it from campaign data and raise it with the ad network.
Transfon Security for advertisersPrice scrapers, stock checkers and card testing scripts often run on Go-http-client. Block it on product, cart and checkout pages.
Transfon Security for e-commerceGo-http-client is normal for API clients but not for your web app. Allow it only on API routes that need a key, and rate limit it there.
Transfon Security for SaaS and APIsGo-http-client ignores robots.txt, so it has to be stopped when the request arrives. Transfon Security shows Go-http-client by name in the Top Bots report, so you can see how often it visits and which pages it reads. Block or allow it with a User Agent rule, or slow it down with a rate limit decision rule.
Transfon Security
Go-http-client is a bot in the HTTP clients and libraries category, operated by Go project. Go-http-client is the default user agent of the HTTP client in the Go standard library. Any Go program that does not set its own user agent sends it, from API clients to scanners and scrapers.
No. Go-http-client does not follow robots.txt, so a Disallow rule will not stop it. Block it by user agent at your server, CDN or WAF instead.
Block requests whose user agent contains "Go-http-client" at your server, CDN or WAF, because Go-http-client does not read robots.txt. In Transfon Security that is one User Agent block rule.
No. robots.txt is voluntary, so Go-http-client may not follow it, and anyone can send Go-http-client's user agent, so a fake Go-http-client ignores your rule. Enforce the rule where requests arrive, at your WAF, and check the source network.
HTTP clients are programming libraries and command line tools. Developers use them for scripts, integrations and scrapers. Real browsers never send these user agents, so treat them as automated traffic and block them on pages meant for people.
Transfon Security identifies every bot in this directory in your traffic reports, flags fake search crawlers, and lets you allow, block or rate limit each bot.
Privacy, security, monetization, and performance insights. A few emails a month, no spam.