> ## Documentation Index
> Fetch the complete documentation index at: https://firecrawl-claude-docs-safe-mode-page.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Safe Mode

> Keep your organization in Firecrawl's strictest compliance posture. Firecrawl honors each site's rules, never scrapes behind a login, and identifies itself as automated. Enforced server-side.

Safe Mode keeps your organization in Firecrawl's strictest compliance posture. When Safe Mode is on, Firecrawl honors each site's rules and never works around a site's restrictions. Firecrawl never scrapes content behind a login. The browser identifies itself as automated.

Use Safe Mode when your legal, security, or compliance policy requires a conservative scraping posture on every request. Safe Mode applies to the whole organization: every API key and every endpoint. You set it once, and each request follows it automatically.

<Note>
  Safe Mode is an enterprise feature and is gated per organization. Firecrawl turns it on for your organization. Contact your Firecrawl account team or [support@firecrawl.com](mailto:support@firecrawl.com) to have it enabled.
</Note>

## What changes for your requests

Safe Mode contains a set of protections. All protections are on by default. A team admin can turn off each protection separately. See [Configuring Safe Mode](#configuring-safe-mode).

Some requests are refused with an error. Other requests succeed, but Firecrawl changes how it fetches the page. The sections below tell you which is which.

### Proxies

Firecrawl uses basic proxies only. It does not use enhanced or mobile proxies, and it does not escalate to an enhanced proxy automatically.

* A request that sets `proxy: "enhanced"` is refused.
* A request that omits `proxy`, or sets `proxy: "auto"`, succeeds on a basic proxy.
* Pages that Firecrawl fetches for you inside a crawl, a batch scrape, a search, or an extract also use a basic proxy.

To see which proxy Firecrawl used, read `metadata.proxyUsed` in the response. With Safe Mode on, it is `"basic"`.

### Logins and credentials

Firecrawl never scrapes behind a login. These requests are refused:

* A request with a browser `profile`.
* A request with an `Authorization`, `Cookie`, or `Proxy-Authorization` header.
* A request with a `write`, `press`, or `executeJavascript` action. These actions can enter credentials.

Firecrawl also removes credentials from pages that it fetches for you inside a crawl, a batch scrape, a search, or an extract. It removes a user name and password from a URL such as `https://user:pass@example.com`. It never returns or stores those credentials.

`executeJavascript` is refused only as an action. Page JavaScript still runs, so Firecrawl still scrapes content that JavaScript renders.

### robots.txt

Firecrawl honors robots.txt on every request, including single-page scrapes. A request that sets `ignoreRobotsTxt` is refused.

### Site restrictions

When a site restricts automated access, Firecrawl does not work around the restriction. The request returns the `SCRAPE_SITE_RESTRICTION_BLOCKED` error instead of the page content.

### Browser identity

The browser presents itself as an automated tool, not as a person:

* It sends the standard signal that identifies the browser as automated.
* It sends a user agent that identifies the browser as automated.
* It reports the actual device and operating system of the browser.
* It uses a location only when your request sets one. It never selects a location automatically.
* It sends a referrer header only when your request sets one.

### Threat Protection

Safe Mode turns on your [Threat Protection](/features/threat-protection) domain lists for every request, even when your Threat Protection mode is Off. Your blocklist, allowlist, and blocked TLDs apply. A request cannot turn Threat Protection off or lower its mode.

### Requests that succeed with restricted results

Most endpoints refuse a restricted option with a `403`. These requests do not. They succeed, and Firecrawl applies the restrictions to the pages it fetches:

* `extract` requests.
* `search` requests without `scrapeOptions`.
* [Monitoring](/features/monitoring) runs.

These requests return a `200` with no sign that Firecrawl restricted them. If your results look incomplete, compare them with a known good result. Do not wait for an error.

## Cache-only mode

Cache-only mode is the strictest Safe Mode setting. It is off by default. When it is on, Firecrawl never contacts the target website:

* Firecrawl serves only pages that it already has in its cache. When you do not set `maxAge`, cached pages up to 2 years old are eligible.
* A page that is not in the cache returns the `SCRAPE_LOCKDOWN_CACHE_MISS` error.
* A crawl does not discover pages from robots.txt or sitemaps.
* A map returns results from the index only.
* Zero data retention applies to every request.

Cache-only mode takes priority over the other protections, because Firecrawl makes no outbound request. Threat Protection domain lists still filter cached results.

For the same behavior on a single request, see [Lockdown Mode](/features/lockdown).

## Configuring Safe Mode

Team admins configure Safe Mode from [Enterprise Controls → Safe Mode](https://www.firecrawl.dev/app/enterprise-controls?tab=safe-mode) in the dashboard:

1. Open **Enterprise Controls → Safe Mode**.
2. Turn on **Cache-only mode** if you need a guarantee that Firecrawl never contacts the target website.
3. Under **Request controls** and **Identity**, turn off any protection that you do not need. The other protections stay on.
4. Under **Governance**, add domains to the **Allowlist**, and choose whether requests can opt out of Safe Mode.
5. Select **Save changes**.

Only team admins can change Safe Mode settings.

### Allowlist

The allowlist contains domains that do not get the proxy, robots.txt, login, site restriction, and browser identity protections. Enter a domain such as `example.com`, or a pattern such as `*.example.com`. The allowlist holds up to 500 entries.

Cache-only mode and Threat Protection domain lists still apply to allowlisted domains.

### Per-request opt-outs

When you turn on **Allow requests to disable Safe Mode**, a single request can opt out of Safe Mode. The request sends `safeMode: false`. Your request logs record each opt-out.

## The `safeMode` request parameter

You do not need to send `safeMode`. Your organization's settings apply to every request automatically. The parameter has three states:

| Value   | Result                                                                                                    |
| ------- | --------------------------------------------------------------------------------------------------------- |
| Omitted | Your organization's settings apply. This is the normal case.                                              |
| `true`  | Accepted when Safe Mode is on for your organization. Refused with a `403` when it is not.                 |
| `false` | Opts out of Safe Mode for this request. Refused with a `403` unless an admin allows per-request opt-outs. |

Send `safeMode` at the top level on `scrape` and `batch scrape`. Send it inside `scrapeOptions` on `crawl` and `search`.

```json theme={null}
{
  "url": "https://example.com",
  "safeMode": true
}
```

## Billing

Safe Mode adds no credit charges.

Safe Mode turns on your Threat Protection policy. If your Threat Protection mode is Off, Firecrawl applies only your own domain lists, and there is no scan fee. If your stored Threat Protection mode is Normal, the Normal mode scan fee of +2 credits per URL applies. Zscaler mode has no scan fee. To prevent the fee, set your Threat Protection mode to Off. See [Threat Protection billing](/features/threat-protection#billing).

## Error reference

| Status                   | Code                              | When                                                                                            | What to do                                                                                                                                            |
| ------------------------ | --------------------------------- | ----------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- |
| `403`                    | `SAFE_MODE_BLOCKED`               | The request uses an option that Safe Mode does not allow. The `error` message names the option. | Remove the option from the request, or ask an admin to change your Safe Mode settings.                                                                |
| `403`                    | `SAFE_MODE_BLOCKED`               | The request sends `safeMode: false`, and your organization does not allow opt-outs.             | Remove `safeMode: false`, or ask an admin to allow per-request opt-outs.                                                                              |
| `403`                    | `SAFE_MODE_BLOCKED`               | The request sends `safeMode: true`, and Safe Mode is not on for your organization.              | Remove `safeMode`, or contact [support@firecrawl.com](mailto:support@firecrawl.com).                                                                  |
| `403`                    | `unsafe_domain_blocked`           | Your Threat Protection policy blocks the URL.                                                   | See [Threat Protection](/features/threat-protection).                                                                                                 |
| `500`                    | `SCRAPE_SITE_RESTRICTION_BLOCKED` | The site restricts automated access.                                                            | Do not retry. The result does not change. To scrape the site, an admin can turn off **Respect site restrictions** or add the domain to the allowlist. |
| `404` on v2, `500` on v1 | `SCRAPE_LOCKDOWN_CACHE_MISS`      | Cache-only mode is on, and the page is not in the cache.                                        | The page is not available in cache-only mode. v2 and v1 return different status codes for this error, so check the `code`.                            |

Some Safe Mode refusals return a `403` without a `code`. Check the status and the `error` message as well as the `code`.

## What Safe Mode does not change

Safe Mode controls how Firecrawl fetches a page. It does not control what you do with the result. These features work as usual:

* Output formats, [document parsing](/features/document-parsing), and PDF parsing.
* [JSON and LLM extraction](/features/llm-extract).
* Webhooks.
* `blockAds` and `skipTlsVerification`.
* Actions such as `scroll` and `wait`, and headers such as `User-Agent`.

## Notes

* Safe Mode applies to every API key and every endpoint in your organization. A request cannot turn off enforcement, unless an admin allows per-request opt-outs.
* The Firecrawl SDKs do not include constants for the Safe Mode error codes yet. Compare the `code` string directly.
* Safe Mode is independent of [Key Restrictions](/features/key-restrictions) and [IP Restrictions](/features/ip-restrictions). An organization can use all three at the same time.