Skip to main content

Allowlist Uptimus in CDN and firewall providers

Some websites block automated traffic before it reaches the origin server. When that happens, Uptimus may show a 403 Forbidden, 429 Too Many Requests, a timeout, or another restricted response even though the website works in your browser.

The right fix is usually one of these:

  • allowlist Uptimus monitoring locations;
  • allowlist the Uptimus User-Agent;
  • create a dedicated public health endpoint;
  • accept a non-200 status only when that status is intentional.

Uptimus User-Agent​

Use this User-Agent in firewall, WAF or bot rules:

Uptimus.app Monitor (+https://uptimus.app/docs/features/uptime-monitoring)

If your provider supports IP allowlisting, allowlist the monitoring locations you selected for the monitor. This is stronger than User-Agent matching because User-Agent headers can be copied by anyone.

Loading monitoring agent IPs...Fetching the current live allowlist from Uptimus.

The list above is loaded from active Uptimus monitoring agents. When we add, remove or redeploy an agent, the docs update automatically after the agent sends its next heartbeat.

Cloudflare​

Use Cloudflare rules when Bot Fight Mode, WAF custom rules or rate limiting blocks monitoring requests.

  1. Open Cloudflare Dashboard.
  2. Select the site.
  3. Go to Security or Rules.
  4. Create a custom rule that matches either Uptimus monitoring IPs or the Uptimus User-Agent.
  5. Set the action to Skip, Allow or bypass the security features that block uptime checks.
  6. Keep the rule narrow: apply it only to the monitored hostname or health endpoint.

Recommended condition when User-Agent allowlisting is acceptable:

http.user_agent contains "Uptimus.app Monitor"

Akamai​

Akamai often returns 403 Forbidden from the edge when bot, WAF or property rules block the request.

  1. Open Akamai Control Center.
  2. Review the property/security configuration for the monitored hostname.
  3. Add an allow rule for Uptimus monitoring IPs or User-Agent.
  4. If Bot Manager is enabled, create a narrow exception for the health endpoint.
  5. Deploy the property change and retest the monitor.

If Uptimus detects server: AkamaiNetStorage, it means the response came from the Akamai edge layer. It does not prove the origin server is down.

Amazon CloudFront​

CloudFront can block checks through AWS WAF, signed URL requirements, geo rules or origin behavior.

  1. Open the CloudFront distribution.
  2. Check attached AWS WAF web ACLs.
  3. Add an allow rule for Uptimus monitoring IPs or User-Agent.
  4. Confirm the cache behavior forwards the request to the expected origin.
  5. If a protected app intentionally returns 401 or 403, add that status to accepted status codes instead of treating it as an outage.

Fastly​

Fastly may block checks through VCL, edge ACLs, bot rules or rate limiting.

  1. Open the Fastly service.
  2. Review edge ACLs, VCL snippets and rate limit rules.
  3. Add a narrow allow rule for Uptimus monitoring IPs or User-Agent.
  4. Apply it only to the monitored hostname or health endpoint.
  5. Purge/redeploy if your Fastly workflow requires it.

Generic firewall or host rule​

For firewalls, load balancers, security plugins or hosting panels:

  1. Allow requests from the Uptimus locations selected for the monitor.
  2. Allow the Uptimus User-Agent if IP allowlisting is not available.
  3. Make sure HEAD or GET is allowed, depending on your monitor settings.
  4. Avoid blocking requests just because they are automated or have no browser cookies.
  5. Create a /health endpoint when the public homepage has strict bot rules.

If the status is intentional​

Some monitors intentionally expect restricted status codes. Examples:

  • 401 for a private API without credentials;
  • 403 for a protected login page;
  • 405 when a route should reject a method;
  • 429 when you are specifically testing rate limiting.

In those cases, open Response settings and add the expected status code. Uptimus will then treat that response as healthy for that monitor.

How Uptimus detects providers​

Uptimus looks at response headers and DNS records to detect providers such as Cloudflare, Akamai, Fastly, CloudFront, Vercel, Netlify, Sucuri, Imperva, Azure Front Door, Bunny CDN, KeyCDN, Google Cloud CDN and StackPath.

Detection is best-effort. Some providers hide identifying headers, and some teams use custom reverse proxies. If Uptimus cannot identify the provider, it will still show the HTTP status and the recommended next action.