# How it works > What happens from the moment a bot asks for a page until it gets the full HTML. Source page: https://docs.jazui.com/how-it-works/en ## The problem it solves Websites built with Angular, React, Vue, Blazor or other JavaScript frameworks (SPAs) are built in the browser: the server returns almost empty HTML and JavaScript paints the content. People don't notice, but many bots do: - **AI bots** (GPTBot, ClaudeBot, PerplexityBot…) don't run JavaScript. They see an empty page and can't cite or recommend you. - **Social networks** (WhatsApp, LinkedIn, X, Facebook, Telegram…) build link previews from the HTML. Without a title, description and image, the link is shared without a card. - **Google** does run JavaScript, but in a second pass that can take days, costs more resources per page and depends on your JavaScript loading well. Jazui makes all of them get the same page a person sees, already rendered, without changing your application. ## The journey of a request 1. **A bot asks for a page** on your website, for example GPTBot asks for `https://mysite.com/pricing`. 2. **Your integration recognizes it** (on your CDN or server) by its user agent and, instead of serving your SPA, asks Jazui's API for it with your token. 3. **Jazui checks** the token, the plan, your rules and whether the site is verified. 4. **If the page is cached**, it returns it instantly. If not, it opens it with Chrome, waits for your JavaScript to finish, saves it and returns it. 5. **Your integration delivers** the full HTML to the bot, with the real status code (200, 404, redirect…). People don't go through Jazui: your integration only diverts bot requests. If Jazui is slow or fails, your integration serves your normal website. ## How the integration recognizes bots A request goes through Jazui only if all of these are true: - It's a `GET` or `HEAD`. - Its user agent contains one of the names in Jazui's bot list (case-insensitive), **or** the address has `_escaped_fragment_`. - The path does **not** end in a file extension: `.js`, `.css`, images, fonts, videos, documents, archives, `.json`, `.xml`, `.txt`… Your website always serves those files. - The request does **not** carry the `X-Jazui` header. This prevents loops: when Jazui opens your page with Chrome, it does so as a normal browser and your website serves it directly. ### The bot list It has more than 230 names: search engines (Googlebot, Bingbot, Yandex, Baidu, DuckDuckBot, Applebot…), AI bots (GPTBot, ChatGPT-User, OAI-SearchBot, ClaudeBot, PerplexityBot, CCBot and about 150 more), social networks and link previews (facebookexternalhit, Twitterbot, LinkedInBot, WhatsApp, TelegramBot, Discordbot, Slackbot…), SEO and monitoring tools (AhrefsBot, SemrushBot, Lighthouse, GTmetrix…) and others such as archive.org. The list is maintained by Jazui and **the JavaScript and ASP.NET Core integrations download it on their own every day** (`GET /v2/bots`); if they can't, they keep the one they ship with. In nginx, IIS and Apache the list lives in the configuration: the dashboard shows you the updated block to copy when it changes. ### Bots we don't know yet If a request looks like a bot (its user agent contains *bot*, *crawl*, *spider*, *fetch*, *preview*…) but isn't on the list, the JavaScript and ASP.NET Core integrations serve it normally and notify Jazui in the background, at most once a day per agent. That's how new bots are found and added to the list. ## What the integration asks Jazui The integration calls `GET https://api.jazui.com/Render` with: - `url`: the full address the bot asked for. nginx, IIS and Apache, which can't encode it in the query, send it in the `X-Jazui-Url` header. - `botAgent`: the bot's user agent (if missing, the request's `User-Agent` is used). - `Authorization: Bearer` with your token. - `X-Jazui-Client-IP`: the bot's IP, for metrics and to check it is who it claims to be. - `If-None-Match`, if the bot sent it, to answer `304` when the page hasn't changed. `Integration request`: ```http GET https://api.jazui.com/Render?url=https%3A%2F%2Fmisitio.com%2Fprecios&botAgent=Mozilla%2F5.0%20(compatible%3B%20GPTBot%2F1.2) Authorization: Bearer JAZUI_TOKEN X-Jazui-Client-IP: 20.171.207.12 If-None-Match: "4812-638976215370000000" ``` ## What Jazui checks before serving In this order: 1. **The token**: it must be the current one for your account or a site. A site token only works for its domain and its added subdomains. 2. **AI bots**: if you've blocked that AI bot in the site settings, it gets a `403`. 3. **The free plan**: if it has used up the month's renders or requests, it stops receiving service until next month and your website is served normally. 4. **Verified site**: if the domain isn't verified, Jazui doesn't render it. 5. **Your rules**: they can block the bot, exclude the URL from rendering or change how it's rendered. 6. **Plan limits**: renders for the month and cached pages, and on plans that require it, the badge. ## Rendering When a page isn't cached, Jazui opens it with **Chrome**, runs your JavaScript and waits for it to finish loading, at most the wait time you set for the site (up to 5 seconds on the free plan and 10 on paid plans). Then: - It removes what only matters in the browser and keeps the final HTML: title, metadata, structured data, text and links. - It keeps the **real status code**: if your page says it's a 404 or redirects, the bot gets that 404 or that redirect, not a fake 200. - It applies what your rules say, for example adding a title, description or structured data to the ``. - It reviews the page and calculates its SEO score. ## The cache Every rendered page is saved. Later requests from any bot are served from the cache instantly (`X-Jazui-Cache: HIT`), without opening Chrome again or using renders. To keep the cache fresh: - **Automatic recache** every so many days, per site or per rule (never below your plan's minimum recache: [Plans and limits](https://docs.jazui.com/llms/en/plans.txt)). - **Instant recache** from the dashboard, or through the cache API when you publish changes. - **Warning** if the saved version no longer matches your live website. Each page has an `ETag`: if the bot asks whether it changed (`If-None-Match`) and it hasn't, it gets a `304` with no body. ## Response headers | Header | Meaning | |---|---| | `X-Jazui: true` | The response comes from Jazui. Integrations only pass it to the bot if it has this header. | | `X-Jazui-Cache` | `HIT`: served from the cache. `MISS`: rendered on this request. | | `ETag` and `Last-Modified` | Version of the saved page, for conditional requests. | | `X-Jazui-Blocked` | On a `403`: `ai-bot` if you blocked that AI bot, `rule` if a rule blocks it. | | `X-Jazui-Limit` | On a `429`: `plan` (free plan used up), `renders` (no renders left this month) or `pages` (cached page limit reached). | ## If Jazui doesn't respond Integrations are built so your website never goes down because of Jazui. If Jazui takes more than 20 seconds, answers with an error, the token is invalid or the plan is used up, the request continues and the bot gets your normal website, as if Jazui didn't exist. Only Jazui's responses (those with `X-Jazui`) and the blocks you decided on (`403` with `X-Jazui-Blocked`) are passed to the bot. > There are two exceptions, because of how those servers work: with **IIS** and **Apache** the proxy can't fall back to your website if Jazui fails, and the bot gets the error. With **nginx**, a `403` for an unverified site reaches the bot. That's why you should verify the site before enabling the configuration. ## Real bots and bots pretending to be others Anyone can put «Googlebot» in their user agent. With the IP your integration sends, Jazui checks through reverse DNS whether the major search engines are who they claim to be: Googlebot and its variants, Bingbot, Applebot, Yandex, Baidu, Seznam, Petal and Naver. In your bot traffic you'll see which ones are verified and which ones are pretending. ## Privacy - People visiting your website **never go through Jazui**: the integration only diverts bot requests. - Jazui only renders verified domains, always with your account token. - The JavaScript and ASP.NET Core integrations send Jazui only what's needed (address, user agent, bot IP and the cache header), without cookies. - You can delete the cache and your account whenever you want.