allowlist-aios-monitoring-and-scanning
title: "How to Allowlist AIOS Uptime Monitoring and Site Scanning" description: "Learn how to allowlist AIOS uptime monitoring and site scanning requests using IP addresses and firewall rules."
How to allowlist AIOS uptime monitoring and site scanning
If your AIOS uptime monitor incorrectly reports your website as down, or your site scans fail to complete, your firewall may be blocking requests from TeamUpdraft services.
This guide explains how to identify and allowlist requests from AIOS uptime monitoring and site scanning services to prevent your firewall, Web Application Firewall (WAF), or hosting provider from blocking them.
The two services use different IP addresses, so it's important to allowlist the correct addresses for the feature you're using.
Understanding the two services
AIOS uses two services that send requests to your WordPress website.
| Service | Purpose | How to identify requests |
|---|---|---|
| Uptime monitor | Checks whether your website is available | IP address and User-Agent |
| Site scanner | Scans your website for malware and vulnerabilities | IP address |
The uptime monitor sends a specific User-Agent header, while the site scanner does not send a TeamUpdraft User-Agent.
For the site scanner, requests must be identified and allowlisted by IP address.
Common signs that requests are being blocked
You may need to allowlist these services if:
- Your website is incorrectly reported as down: Your AIOS dashboard shows your website as DOWN, even though it's accessible in a browser. This may indicate that the uptime monitor is being blocked.
- Your site scans fail: A site scan doesn't complete or returns no results. This may indicate that the site scanner is being blocked.
Follow the relevant instructions below to identify the correct IP addresses and configure your firewall.
Allowlisting the AIOS uptime monitor
The AIOS uptime monitor checks whether your website is available by sending requests to your site.
These requests can be identified using the monitor's User-Agent and IP addresses.
Uptime monitor User-Agent
The uptime monitor sends the following User-Agent header:
AIOS-Uptime-Monitor/1.0
This User-Agent is included in:
- HTTP and HTTPS requests.
- HEAD and GET requests.
- Each request made when following redirects.
When creating a firewall rule, match the following prefix rather than the complete User-Agent:
AIOS-Uptime-Monitor
The version number may change in a future release. Matching the prefix helps prevent future version changes from affecting your rule.
Important: Anyone can send a matching User-Agent header. It should only be used to identify requests in your logs, not as the sole basis for bypassing important security checks.
If your firewall rule bypasses security checks, allowlist by IP address and use the User-Agent as an additional condition.
Uptime monitor IP addresses
The uptime monitor sends requests from the following IP addresses:
| IP address | Type |
|---|---|
97.107.138.114 | IPv4 |
2600:3c03::f03c:91ff:fe2c:7f44 | IPv6 |
Add both addresses to your firewall allowlist.
The monitor can use either IPv4 or IPv6, depending on your website's DNS configuration:
- AAAA record: The monitor can use the IPv6 address.
- A record only: The monitor uses the IPv4 address.
Allowlisting both addresses helps ensure that monitoring requests aren't blocked.
Allowlisting the AIOS site scanner
The AIOS site scanner checks your website for malware and vulnerabilities.
Unlike the uptime monitor, the site scanner does not send a TeamUpdraft User-Agent. Its requests must be identified and allowlisted using the IP ranges below.
Site scanner IP ranges
| IP range | Type |
|---|---|
192.88.134.0/23 | IPv4 |
185.93.228.0/22 | IPv4 |
66.248.200.0/22 | IPv4 |
208.109.0.0/22 | IPv4 |
2a02:fe80::/29 | IPv6 |
Add these IP ranges to the allowlist in the security system that is blocking the requests.
- If your firewall supports IPv6, add the IPv6 range alongside the IPv4 ranges.
- If your firewall doesn't support IPv6, add the IPv4 ranges only.
Important: These IP ranges may change. Refer to this documentation page for the current list.
How to allowlist AIOS requests in your firewall
The allowlisting process depends on which security system is blocking the requests.
You may need to configure your:
- Cloudflare WAF.
- Wordfence firewall.
- ModSecurity configuration.
- Hosting provider's firewall.
Always add the IP addresses to the security layer responsible for blocking the requests.
Cloudflare
If you use Cloudflare, you can create a WAF custom rule to allow the uptime monitor or site scanner requests.
Create a WAF custom rule using the Skip action.
For the AIOS uptime monitor, use the following expression:
(ip.src in {97.107.138.114 2600:3c03::f03c:91ff:fe2c:7f44} and http.user_agent contains "AIOS-Uptime-Monitor")
This matches requests from the uptime monitor's IP addresses that also contain the expected User-Agent prefix.
For the AIOS site scanner, use the following expression:
(ip.src in {192.88.134.0/23 185.93.228.0/22 66.248.200.0/22 208.109.0.0/22 2a02:fe80::/29})
This matches requests originating from the published site scanner IP ranges.
When configuring your rules:
- Select the Skip action.
- Skip only the WAF features responsible for blocking the requests.
- Position the rule above any rules that would otherwise block the requests.
- Save your changes.
Avoid disabling unnecessary security protections.
Wordfence
If you're using Wordfence to protect your WordPress website, you can add the AIOS service IP addresses to its allowlist.
- Open your WordPress dashboard.
- Navigate to Wordfence → Firewall → All Firewall Options.
- Find Advanced Firewall Options.
- Locate Allowlisted IP addresses that bypass all rules.
- Add the relevant uptime monitor IP addresses or site scanner IP ranges.
- Enter each address or range on a separate line.
- Save your changes.
The Wordfence allowlist also applies to rate limiting, so you don't need to add the same addresses separately in the Rate Limiting settings.
Using Wordfence with Cloudflare or another CDN
If your website uses Cloudflare or another CDN or proxy, check that Wordfence is identifying visitor IP addresses correctly.
- Navigate to Wordfence → Dashboard → Global Options.
- Find General Wordfence Options.
- Locate the setting How does Wordfence get IPs.
- Check that Wordfence is reading the visitor's IP address rather than the CDN's IP address.
If Wordfence identifies the CDN's IP address instead of the original visitor's IP address, your allowlist may not match the AIOS requests.
ModSecurity
If ModSecurity is blocking AIOS requests, add the relevant uptime monitor IP addresses or site scanner IP ranges to your ModSecurity configuration.
Only allowlist the required addresses or ranges.
Do not disable ModSecurity rules for all requests, as this could reduce protection for legitimate website traffic.
Apache and nginx web server configuration
If your website uses Apache or nginx, it's important to identify which security layer is blocking AIOS requests before making changes.
Adding an allow rule to your web server configuration won't bypass a firewall operating upstream, such as:
- A CDN firewall.
- A WAF.
- A hosting provider's firewall.
Configure the allowlist in the security layer responsible for blocking the requests.
Incorrectly configured web server rules could unintentionally block legitimate visitors.
Hosting provider firewall
Some hosting providers operate their own WAF, which you may not be able to configure directly.
If your hosting provider's firewall is blocking AIOS requests, contact their support team and ask them to allowlist the published IP addresses or ranges for your domain.
Provide the relevant IP addresses from the uptime monitor or site scanner sections above.
How to verify that AIOS requests are no longer blocked
After updating your firewall rules, check your website's access logs to confirm that AIOS requests can reach your site.
Verify uptime monitoring requests
To find requests from the uptime monitor in an nginx access log, run:
grep "AIOS-Uptime-Monitor" /var/log/nginx/access.log | tail -20
This command displays the 20 most recent matching log entries.
Check the HTTP status codes returned by your website:
| Status code | Meaning |
|---|---|
200 | The request completed successfully. |
403 | The request was forbidden and may have been blocked by a security rule. |
429 | Too many requests; a rate-limiting system may be blocking the monitor. |
If you see 403 or 429 responses, investigate which firewall or security layer is responsible.
Verify site scanner requests
To check whether the site scanner can access your website, search your access logs for requests originating from the site scanner IP ranges listed earlier in this guide.
Confirm that the requests are reaching your website and aren't being blocked by your security configuration.
Understanding how the AIOS uptime monitor works
The uptime monitor follows a specific request pattern when checking your website.
Understanding this behaviour can help you identify legitimate monitoring requests and troubleshoot unexpected downtime reports.
HEAD and GET requests
The uptime monitor sends a HEAD request first.
HEAD requests transfer less data than GET requests because they don't return a response body.
Some servers don't support HEAD requests correctly.
If the server returns one of the following status codes, the monitor sends a GET request to the same URL:
405– Method Not Allowed.501– Not Implemented.502– Bad Gateway.
As a result, you may see two log entries for a single monitoring check. This is expected behaviour.
Redirect handling
The uptime monitor follows redirects and sends the same User-Agent on each request.
If a redirect points to a different URL on the same host, the monitor updates the stored URL.
When comparing hosts, the monitor ignores whether the www subdomain is present.
Monitoring frequency
The uptime monitor checks each website at regular intervals.
The minimum interval between two checks of the same website is five minutes.
Request timeout
Each monitoring request has a timeout of 10 seconds.
If your server doesn't respond within 10 seconds, the monitor records the website as down.
If you receive unexpected downtime notifications, check your server's response times as well as your firewall configuration.
HTTP 304 responses
If your server returns a 304 Not Modified status, the uptime monitor doesn't record a status change.
Troubleshooting AIOS monitoring and scanning issues
If your uptime monitor continues to report your website as down, or your site scans still fail after allowlisting the relevant addresses:
- Confirm that you've added the correct IP addresses or ranges for the affected service.
- Check whether another firewall, CDN or hosting security layer is blocking requests.
- Review your access logs for blocked requests or HTTP error responses.
- If you're using Wordfence behind a CDN, check that it's identifying the original visitor IP addresses.
- For unexpected uptime monitoring failures, check whether your server is responding within the 10-second timeout.
The uptime monitor and site scanner use different IP addresses, so make sure you've allowlisted the addresses for the service experiencing problems.