Connect your server logs.

Check compatibility before subscribing

You need access to configure Vercel Drains on Pro or Enterprise, or Cloudflare HTTP Logpush on Enterprise. Cloudflare Free, Pro and Business do not include this HTTP Logpush integration. Other hosts are not supported here yet. Your provider may charge separately for exporting logs.

Provider availability checked September 9, 2026: Vercel Drains · Cloudflare Logpush. If unsure, email alex+monitor@midnightdev.dev before paying.

Vercel

1. Open your report email from ReadableByAI. The section CONNECT YOUR LOGS has your endpoint URL and your drain secret. They are issued once, in the first report after you subscribe.
2. In the Vercel dashboard go to Team Settings → Drains (older dashboards call this Log Drains) and choose Add Drain.
3. Projects: the project that serves the monitored domain. Sources: Static, Function, and Edge. Delivery format: JSON. Environment: Production. Sampling: 100%.
4. Endpoint: paste the URL from the email. Custom header: name x-readablebyai-drain-secret, value the secret from the email. Save. Vercel sends a verification request; the endpoint answers it.

If your Vercel plan does not show Drains, check your plan and team permissions. The Cloudflare path below requires a separate eligible Cloudflare configuration; it is not a workaround available on every site.

Cloudflare (Logpush)

1. Open your report email. Under CONNECT YOUR LOGS, the Cloudflare block has a line labelled HTTP endpoint: your endpoint with the drain secret attached as a header_x-readablebyai-drain-secret parameter. Copy the whole line. Cloudflare turns header_ parameters into request headers, so the secret reaches the endpoint as the same header a Vercel drain sends.
2. In the Cloudflare dashboard open the domain (zone), then Logpush, and choose Create a Logpush job. Destination: HTTP destination. Paste the endpoint and continue. Cloudflare sends a test delivery; the endpoint accepts it. No ownership challenge is needed for HTTP destinations.
3. Dataset: HTTP requests. Fields: ClientRequestHost, ClientRequestPath, ClientRequestUserAgent, ClientIP, EdgeResponseStatus, EdgeStartTimestamp, EdgeTimeToFirstByteMs. Other fields are ignored and only make deliveries larger. Sampling: 100%. Timestamp format: any (unixnano, unix, and RFC 3339 at any precision are all read).
4. Optional, recommended: a filter so only crawler lines leave your zone (below). Submit.

Filter (paste as the job's filter, or build the same conditions in the dashboard with OR between them). Each condition is ClientRequestUserAgent contains …:

{"where":{"or":[{"key":"ClientRequestUserAgent","operator":"contains","value":"GPT"},{"key":"ClientRequestUserAgent","operator":"contains","value":"OAI-"},{"key":"ClientRequestUserAgent","operator":"contains","value":"Claude"},{"key":"ClientRequestUserAgent","operator":"contains","value":"Perplexity"},{"key":"ClientRequestUserAgent","operator":"contains","value":"bingbot"},{"key":"ClientRequestUserAgent","operator":"contains","value":"Googlebot"},{"key":"ClientRequestUserAgent","operator":"contains","value":"Applebot"},{"key":"ClientRequestUserAgent","operator":"contains","value":"CCBot"},{"key":"ClientRequestUserAgent","operator":"contains","value":"Amazonbot"},{"key":"ClientRequestUserAgent","operator":"contains","value":"Bytespider"},{"key":"ClientRequestUserAgent","operator":"contains","value":"meta-external"},{"key":"ClientRequestUserAgent","operator":"contains","value":"DuckAssist"},{"key":"ClientRequestUserAgent","operator":"contains","value":"MistralAI"}]}}

979 bytes; Cloudflare accepts filters up to about 1,000 bytes. A crawler left out of a filter never reaches us, so the report cannot show it. Without a filter the endpoint drops non-crawler lines itself.

Cloudflare offers Logpush on Enterprise zones (Cloudflare docs, checked 2026-09-06). Not on Vercel or a Cloudflare Enterprise zone? Reply to any report with the host you use; nginx, Apache, Netlify, and CloudFront follow.

What the next report shows

A section headed OBSERVED FROM YOUR LOGS: for each tracked crawler in the last seven days, how many requests it made, how many came from the vendor's own IP ranges versus impostors versus unverifiable, the response status split, the paths it fetched most, slow responses (over one second), and 4xx/5xx answers. Crawler roles are stated precisely: GPTBot is a training crawler, OAI-SearchBot feeds a search index, ChatGPT-User is a live fetch on a user's behalf. They are never blended.

An empty window is reported as a finding, not hidden: if your drain is connected and no tracked crawler fetched the domain, the report says so.

What is kept, what is not

Security

The endpoint URL contains an encrypted, domain-bound configuration. A separate random secret must arrive in a custom header on every delivery; only its hash is stored. A wrong secret, a tampered URL, or a batch for another host is rejected. Deliveries larger than 2 MB are refused. If our store is unavailable the endpoint returns an error rather than a silent success, so Vercel retries and no evidence is quietly dropped.

Cloudflare deliveries arrive gzip-compressed; the endpoint accepts compressed or plain bodies up to 2 MB on the wire and 12 MB inflated, and reads up to 10,000 lines per delivery. A delivery beyond the line cap is accepted, counted up to the cap, and flagged in our logs rather than refused, because Cloudflare keeps retrying a refused batch until the data ages out and disables a job after 24 hours without a successful delivery. Keep the field list to the seven above and use the filter so batches stay small. The endpoint URL you paste into Cloudflare contains the secret: treat it as a credential and paste it only into the Logpush job.

To rotate or revoke: reply to any report. Removing the drain in Vercel, or the job in Cloudflare, stops delivery immediately.