Skip to main content

Allowlisting and HTTP status codes

Uptimus can validate a domain even when the page does not return a normal 200 OK response. That distinction matters:

  • DNS can resolve: the domain exists.
  • The server can respond: Uptimus reached an HTTP endpoint.
  • The response may still be unhealthy: the server returned a blocked, missing, rate-limited or error status.

When this happens, Uptimus lets you continue setup, but it shows a warning so you can decide whether the status is expected or needs fixing.

If Uptimus can identify an edge provider, it will show a detected provider such as Cloudflare, Akamai, Fastly or CloudFront. Provider detection is best-effort: we use response headers and DNS signals, but some providers hide those details.

Common status codes​

StatusMeaningWhat to do
401 UnauthorizedThe endpoint requires authentication.Add the required headers or monitor a public health endpoint.
403 ForbiddenA firewall, CDN, WAF or server rule blocked the monitoring request.Allowlist Uptimus agents or User-Agent.
404 Not FoundThe URL is not published or no longer exists.Check the URL, or accept 404 only if it is intentional.
405 Method Not AllowedThe endpoint rejected the HTTP method.Change the request method in Request settings.
408 Request TimeoutThe server timed out while handling the request.Review timeout/server performance rules.
423 LockedThe resource is locked.Accept only if your application uses this as a healthy state.
429 Too Many RequestsMonitoring requests are being rate limited.Allowlist agents or raise limits for the monitor endpoint.
451 Unavailable For Legal ReasonsAccess is blocked by policy/legal restrictions.Confirm whether the restriction is expected.
5xxThe server reported an error.Usually treat as unhealthy unless your endpoint intentionally returns it.

When to allowlist Uptimus​

Allowlisting is useful when your site is protected by:

  • Cloudflare WAF, Bot Fight Mode or custom rules;
  • a host firewall;
  • basic auth or internal network restrictions;
  • rate limiting rules;
  • security tools that block monitoring agents.

If you selected multiple monitoring locations, allowlist the IPs for those locations. If your firewall supports it, allowlisting the Uptimus User-Agent is often easier to maintain than IP allowlisting.

User-Agent: Uptimus.app Monitor (+https://uptimus.app/docs/features/uptime-monitoring)

For provider-specific setup, see Allowlist Uptimus in CDN and firewall providers. That guide also shows the current live monitoring agent IP list.

When to accept a non-200 status​

Some teams intentionally monitor endpoints that return non-200 statuses. Examples:

  • a private endpoint that should return 401;
  • a login-only page that should return 403;
  • an API route where 405 confirms the wrong method is blocked;
  • a maintenance page where a temporary status is expected.

In those cases, open Response settings and add the status code to the accepted status codes list. Uptimus will then treat that code as healthy for that monitor.

For public websites, use:

Accepted status codes: 200-399

For protected apps, prefer a dedicated health endpoint:

https://example.com/health

The endpoint should be fast, public enough for Uptimus agents, and return a stable status code that reflects the application state.

What happens in the setup wizard​

During setup Uptimus checks:

  1. DNS resolution.
  2. The homepage HTTP response.
  3. Favicon and brand assets.

If DNS works but HTTP returns a restricted status such as 403, the monitor can still be created. However, the first real checks may report incidents until you allowlist Uptimus or configure the expected response rules.