Verify the raw api The best practice for bots is to include a "+ prefixed url back to the calling domain" as User agent substring. To verify that this has been implemented correctly in this patch, run this command: $ php -r "define('CLI_SCRIPT', true); require_once('config.php'); print \core_useragent::get_moodlebot_useragent().PHP_EOL;" The output should be similar to this: MoodleBot/3.8 (+http://moodle.local) h3 Verify with a call from Moodle out Verify this is being used by curl() test using a 3rd party service which just echo's headers: Run the following command: php -r "define('CLI_SCRIPT', true); require_once('config.php'); require_once('lib/filelib.php'); print_object(json_decode(download_file_content('https://postman-echo.com/get')));" The output should be similar to: stdClass Object ( [args] => stdClass Object ( )   [headers] => stdClass Object ( [x-forwarded-proto] => https [host] => postman-echo.com [accept] => */* [accept-charset] => ISO-8859-1,utf-8;q=0.7,*;q=0.7 [accept-encoding] => deflate, gzip, br [user-agent] => MoodleBot/3.8 (+http://boysenberry.local/im) [x-forwarded-port] => 443 )   [url] => https://postman-echo.com/get ) Note the MoodleBot in the user-agent section which should contain your own wwwroot