Is it safe to allowlist a monitoring service in my firewall?

Yes, if the rule is narrow. Allowlist only the IP addresses the provider publishes, skip only the protections that block it, and avoid allowlisting by user-agent alone, since that string is easy to fake. Review the rule when the provider updates its IP list.

Will Cloudflare's "I'm Under Attack" mode break my uptime monitoring?

Very likely. That mode shows a challenge to every visitor, and monitors don't solve challenges, so checks fail while it is on. Exclude the monitor with a rule or expect blocked results until the mode is switched off.

Why does the site load in my browser while the monitor gets a 403?

Your browser runs JavaScript, keeps cookies and connects from a home or office network, so bot protection trusts it. A monitor connects from a data centre with none of those signals. A 403 for the monitor and a 200 for you is the typical sign of a firewall block.

Can a firewall block Googlebot as well?

It can, usually through country blocks, rate limits or strict custom rules. Search Console's Crawl stats report and the live test in URL Inspection are the reliable ways to check, because they show what Google actually received.

Should I just turn the security plugin off?

No. Disabling protection to make a monitor happy swaps a reporting problem for a security one. A targeted allowlist rule keeps the protection for real traffic and lets the monitor through.

← Back to the blog Uptime, SSL and domains

Uptime Monitor Blocked by a Firewall: How to Spot It and Fix It

When an uptime monitor is blocked by a firewall, the site is usually working for people, but the security layer in front of it has decided the monitor looks like a bot and refused the request. That layer might be a WAF, Cloudflare's bot protection or a WordPress security plugin. The monitor sees a 403, a challenge page or sometimes a 503 instead of the real page. The fix is a narrow allowlist rule, not switching protection off.

Why security tools block monitors

A monitor behaves exactly like the bots a firewall is built to stop. It requests the same URL at fixed intervals, from data centre IP addresses, without running JavaScript or keeping cookies. The usual sources of the block are:

Cloudflare features such as Bot Fight Mode, "I'm Under Attack" mode, or custom rules that challenge whole countries or networks
a WAF at hosting level, for example ModSecurity rule sets, that rate-limits or filters by user-agent
WordPress security plugins like Wordfence or Solid Security with rate limiting or country blocking switched on
deny rules in .htaccess or the nginx config aimed at unknown user-agents

How to recognise a firewall block

The pattern is consistent: the monitor reports a failure while the site loads normally in your browser. Then look at the response itself:

403 Forbidden with a short block page from the firewall or plugin
a 403 or 503 whose body says something like "Just a moment..." or asks to verify you are human
a cf-mitigated: challenge header on a Cloudflare response
429 Too Many Requests when rate limiting is the cause

Running curl -I from a server in a data centre, rather than from your laptop, often reproduces the block. The firewall's own log tells you which rule fired: Security Events in Cloudflare, Live Traffic in Wordfence, or the WAF log in the hosting panel. That rule is what you need to adjust.

Why "blocked" is not the same as "offline"

Offline means nobody can reach the site, and the client is losing visitors. Blocked means the monitor can't see the site, while visitors may be fine. Mixing the two causes trouble both ways. False "down" alerts at night teach you to ignore alerts. Worse, while the monitor is blocked it can't tell you when the site really does go down.

The same broad rule can also catch crawlers. Cloudflare's bot features generally let verified search engine bots through, but a country block or a strict custom rule may not. If you suspect it, check the Crawl stats report in Search Console for a rise in 403 or 5xx responses, and run a live test in URL Inspection. Our article on whether downtime hurts SEO covers what repeated errors mean for crawling.

How to allowlist a monitor safely

Start from the monitoring provider's documentation. Most publish the IP addresses or user-agent their checks come from.

Prefer IP-based rules over user-agent rules. Anyone can fake a user-agent string.
Keep the rule narrow. In Cloudflare, a custom rule matching the monitor's IPs with the Skip action can skip only the components that block it. Super Bot Fight Mode can be skipped this way, while Bot Fight Mode on the free plan can't be bypassed by custom rules.
In Wordfence, add the IPs to the allowlisted IP addresses in the firewall options, keeping in mind that these bypass all firewall rules.
Write the change down in the client's notes with the date and reason, so nobody removes it during a later clean-up.

If you can't allowlist, monitoring a lightweight URL excluded from bot protection is an option, as long as you accept it tells you less about the pages that matter. On WordPress, WordPress SEO monitoring covers other ways plugins change a site without warning.

What Deltio shows when it's blocked

Deltio checks each site over HTTP every 10 minutes and gives it one of three states: online, offline or firewall blocked. Because firewall blocked is reported separately from offline, you know to look at the security settings rather than call the host. For the IP addresses or user-agent to allowlist, check Deltio's documentation or ask support rather than guessing. Deltio doesn't tell you whether Googlebot is blocked: Search Console remains the place for that.

Plans start at £24 a month, and there is a 14-day free trial.

Frequently asked questions

Is it safe to allowlist a monitoring service in my firewall?: Yes, if the rule is narrow. Allowlist only the IP addresses the provider publishes, skip only the protections that block it, and avoid allowlisting by user-agent alone, since that string is easy to fake. Review the rule when the provider updates its IP list.
Will Cloudflare's "I'm Under Attack" mode break my uptime monitoring?: Very likely. That mode shows a challenge to every visitor, and monitors don't solve challenges, so checks fail while it is on. Exclude the monitor with a rule or expect blocked results until the mode is switched off.
Why does the site load in my browser while the monitor gets a 403?: Your browser runs JavaScript, keeps cookies and connects from a home or office network, so bot protection trusts it. A monitor connects from a data centre with none of those signals. A 403 for the monitor and a 200 for you is the typical sign of a firewall block.
Can a firewall block Googlebot as well?: It can, usually through country blocks, rate limits or strict custom rules. Search Console's Crawl stats report and the live test in URL Inspection are the reliable ways to check, because they show what Google actually received.
Should I just turn the security plugin off?: No. Disabling protection to make a monitor happy swaps a reporting problem for a security one. A targeted allowlist rule keeps the protection for real traffic and lets the monitor through.