Firewalls and security plugins

Some firewalls treat regular checks from one address as suspicious. When that happens the site looks down to us although visitors can use it.

Signs of a block

• The dashboard reports 403 Forbidden or 429 Too Many Requests while the site works in your browser.
• The plugin status says the health check cannot be reached.

What to allow

• Our checking addresses, listed on the bot page and as a plain-text list.
• The user agent UptimeGlass/1.0 (+https://uptimeglass.com/bot).
• The REST route /wp-json/uptimewpress/v1/ping. It answers only requests that carry the site's secret token.

Common tools

• Wordfence: add the addresses to the allowlisted IP addresses of the firewall.
• Cloudflare: create a WAF custom rule that skips the managed rules for the user agent or the addresses.
• Plugins that disable the REST API: allow the namespace uptimewpress/v1.
• Hosts with bot protection: ask support to allow the addresses and send them the link to our bot page.

If the site is still reported down, send us a bug report with the site address.