Skip to main content
Safe Mode keeps your organization in Firecrawl’s strictest compliance posture. When Safe Mode is on, Firecrawl honors each site’s rules and never works around a site’s restrictions. Firecrawl never scrapes content behind a login. The browser identifies itself as automated. Use Safe Mode when your legal, security, or compliance policy requires a conservative scraping posture on every request. Safe Mode applies to the whole organization: every API key and every endpoint. You set it once, and each request follows it automatically.
Safe Mode is an enterprise feature and is gated per organization. Firecrawl turns it on for your organization. Contact your Firecrawl account team or support@firecrawl.com to have it enabled.

​
What changes for your requests

Safe Mode contains a set of protections. All protections are on by default. A team admin can turn off each protection separately. See Configuring Safe Mode. Some requests are refused with an error. Other requests succeed, but Firecrawl changes how it fetches the page. The sections below tell you which is which.

​
Proxies

Firecrawl uses basic proxies only. It does not use enhanced or mobile proxies, and it does not escalate to an enhanced proxy automatically.
  • A request that sets proxy: "enhanced" is refused.
  • A request that omits proxy, or sets proxy: "auto", succeeds on a basic proxy.
  • Pages that Firecrawl fetches for you inside a crawl, a batch scrape, a search, or an extract also use a basic proxy.
To see which proxy Firecrawl used, read metadata.proxyUsed in the response. With Safe Mode on, it is "basic".

​
Logins and credentials

Firecrawl never scrapes behind a login. These requests are refused:
  • A request with a browser profile.
  • A request with an Authorization, Cookie, or Proxy-Authorization header.
  • A request with a write, press, or executeJavascript action. These actions can enter credentials.
Firecrawl also removes credentials from pages that it fetches for you inside a crawl, a batch scrape, a search, or an extract. It removes a user name and password from a URL such as https://user:pass@example.com. It never returns or stores those credentials. executeJavascript is refused only as an action. Page JavaScript still runs, so Firecrawl still scrapes content that JavaScript renders.

​
robots.txt

Firecrawl honors robots.txt on every request, including single-page scrapes. A request that sets ignoreRobotsTxt is refused.

​
Site restrictions

When a site restricts automated access, Firecrawl does not work around the restriction. The request returns the SCRAPE_SITE_RESTRICTION_BLOCKED error instead of the page content.

​
Browser identity

The browser presents itself as an automated tool, not as a person:
  • It sends the standard signal that identifies the browser as automated.
  • It sends a user agent that identifies the browser as automated.
  • It reports the actual device and operating system of the browser.
  • It uses a location only when your request sets one. It never selects a location automatically.
  • It sends a referrer header only when your request sets one.

​
Threat Protection

Safe Mode turns on your Threat Protection domain lists for every request, even when your Threat Protection mode is Off. Your blocklist, allowlist, and blocked TLDs apply. A request cannot turn Threat Protection off or lower its mode.

​
Requests that succeed with restricted results

Most endpoints refuse a restricted option with a 403. These requests do not. They succeed, and Firecrawl applies the restrictions to the pages it fetches:
  • extract requests.
  • search requests without scrapeOptions.
  • Monitoring runs.
These requests return a 200 with no sign that Firecrawl restricted them. If your results look incomplete, compare them with a known good result. Do not wait for an error.

​
Cache-only mode

Cache-only mode is the strictest Safe Mode setting. It is off by default. When it is on, Firecrawl never contacts the target website:
  • Firecrawl serves only pages that it already has in its cache. When you do not set maxAge, cached pages up to 2 years old are eligible.
  • A page that is not in the cache returns the SCRAPE_LOCKDOWN_CACHE_MISS error.
  • A crawl does not discover pages from robots.txt or sitemaps.
  • A map returns results from the index only.
  • Zero data retention applies to every request.
Cache-only mode takes priority over the other protections, because Firecrawl makes no outbound request. Threat Protection domain lists still filter cached results. For the same behavior on a single request, see Lockdown Mode.

​
Configuring Safe Mode

Team admins configure Safe Mode from Enterprise Controls → Safe Mode in the dashboard:
  1. Open Enterprise Controls → Safe Mode.
  2. Turn on Cache-only mode if you need a guarantee that Firecrawl never contacts the target website.
  3. Under Request controls and Identity, turn off any protection that you do not need. The other protections stay on.
  4. Under Governance, add domains to the Allowlist, and choose whether requests can opt out of Safe Mode.
  5. Select Save changes.
Only team admins can change Safe Mode settings.

​
Allowlist

The allowlist contains domains that do not get the proxy, robots.txt, login, site restriction, and browser identity protections. Enter a domain such as example.com, or a pattern such as *.example.com. The allowlist holds up to 500 entries. Cache-only mode and Threat Protection domain lists still apply to allowlisted domains.

​
Per-request opt-outs

When you turn on Allow requests to disable Safe Mode, a single request can opt out of Safe Mode. The request sends safeMode: false. Your request logs record each opt-out.

​
The safeMode request parameter

You do not need to send safeMode. Your organization’s settings apply to every request automatically. The parameter has three states: Send safeMode at the top level on scrape and batch scrape. Send it inside scrapeOptions on crawl and search.

​
Billing

Safe Mode adds no credit charges. Safe Mode turns on your Threat Protection policy. If your Threat Protection mode is Off, Firecrawl applies only your own domain lists, and there is no scan fee. If your stored Threat Protection mode is Normal, the Normal mode scan fee of +2 credits per URL applies. Zscaler mode has no scan fee. To prevent the fee, set your Threat Protection mode to Off. See Threat Protection billing.

​
Error reference

Some Safe Mode refusals return a 403 without a code. Check the status and the error message as well as the code.

​
What Safe Mode does not change

Safe Mode controls how Firecrawl fetches a page. It does not control what you do with the result. These features work as usual:

​
Notes

  • Safe Mode applies to every API key and every endpoint in your organization. A request cannot turn off enforcement, unless an admin allows per-request opt-outs.
  • The Firecrawl SDKs do not include constants for the Safe Mode error codes yet. Compare the code string directly.
  • Safe Mode is independent of Key Restrictions and IP Restrictions. An organization can use all three at the same time.